Ulterius Technologies FDN40 Multi Service Business Gateway User Manual Manual

Ulterius Technologies, LLC Multi Service Business Gateway Manual

Manual

ulteriustech.com FDN40 Configuration User Manual FDN40ConfigUM/20160505 Version No: 2.0
Contents CHAPTER 1: INTRODUCTION _______________________________________________ 21 1.1 PURPOSE AND SCOPE .................................................................................21 1.2 ACRONYMS ................................................................................................21 1.3 REFERENCES .............................................................................................23 1.4 DOCUMENT CONVENTIONS ..........................................................................23 1.5 GENERAL CONFIGURATIONS ........................................................................24 1.5.1 CLI Modes..............................................................................................24 1.5.2 SNMP Configurations ............................................................................24 CHAPTER 2: SYSTEM FEATURES ___________________________________________ 27 2.1 TOPOLOGIES ..............................................................................................27 2.2 SYSTEM FEATURES / CONFIGURATIONS .......................................................28 2.2.1 Configuring the Default IP Address .......................................................28 2.2.1.1 CLI Configuration ----------------------------------------------------------------- 28 2.2.1.2 WEB Configuration --------------------------------------------------------------- 29 2.2.2 Configuring IP address for an Interface .................................................30 2.2.2.1 CLI Configuration ----------------------------------------------------------------- 30 2.2.2.2 WEB Configuration --------------------------------------------------------------- 31 2.2.3 Configuring the Base MAC Address ......................................................32 2.2.3.1 CLI Configuration ----------------------------------------------------------------- 32 2.2.3.2 WEB Configuration --------------------------------------------------------------- 33 2.2.4 Configuring the Login Authentication Method........................................33 2.2.4.1 CLI Configuration ----------------------------------------------------------------- 33 2.2.4.2 Web Configuration --------------------------------------------------------------- 33 2.2.5 Configuring the Restoration File Name .................................................34 2.2.5.1 CLI Configuration ----------------------------------------------------------------- 34 2.2.5.2 Web Configuration --------------------------------------------------------------- 35 2.2.6 Saving the Current Configurations for Restoration ................................36 2.2.7 Erasing a Saved Configuration File .......................................................37 2.2.8 Copying System Logs into Remote Location .........................................38 2.2.8.1 Web Configuration --------------------------------------------------------------- 38 2.2.9 Copying a File from Remote Site/Flash to Remote Site/Flash ..............39 2.2.9.1 Web Configuration --------------------------------------------------------------- 39 2.2.10 Configuring the Default VLAN Identifier .................................................40 2.2.10.1 CLI Configuration ----------------------------------------------------------------- 40 2.2.10.2 WEB Configuration --------------------------------------------------------------- 41 2.2.11 Configuring Switch Clock .......................................................................41 2.2.11.1 CLI Configuration ----------------------------------------------------------------- 41 2.2.11.2 Web Configuration --------------------------------------------------------------- 41 2.2.12 Enabling/Disabling Console CLI through Serial Port .............................41 2.2.12.1 CLI Configuration ----------------------------------------------------------------- 41 2.2.12.2 WEB Configuration --------------------------------------------------------------- 42 2.2.13 Enabling/Disabling HTTP .......................................................................42 2.2.14 Configuring HTTP Port Number ............................................................42 2.2.14.1 CLI Configuration ----------------------------------------------------------------- 42 2.2.14.2 Web Configuration --------------------------------------------------------------- 43 2.2.15 Configuring HTTP Authentication scheme ............................................43 2.2.15.1 CLI Configuration ----------------------------------------------------------------- 43 2.2.15.2 WEB Configuration --------------------------------------------------------------- 45 2.2.16 Enabling/Disabling Trap Generation on an Interface ............................45 2.2.16.1 CLI Configuration ----------------------------------------------------------------- 45 2.2.16.2 WEB Configuration --------------------------------------------------------------- 46 2.2.17 Configuring an Interface as Switch Port/ Router Port ............................47
Configuration User Manual 4 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. 2.2.17.1 CLI Configuration ----------------------------------------------------------------- 47 2.2.17.2 Web Configuration --------------------------------------------------------------- 47 2.2.18 Configuring Debug Logging ...................................................................48 2.2.18.1 CLI Configuration ----------------------------------------------------------------- 48 2.2.18.2 Web Configuration --------------------------------------------------------------- 48 2.2.19 Configuring ACL Filters ..........................................................................49 2.2.19.1 CLI Configuration ----------------------------------------------------------------- 49 2.2.19.2 WEB Configuration --------------------------------------------------------------- 51 2.2.19.2.1 IP Standard Access List ---------------------------------------------------- 51 2.2.19.2.2 MAC Access List ------------------------------------------------------------- 52 2.2.20 Software image upgradation ..................................................................53 2.2.20.1 Software image upgrade through CLI --------------------------------------- 53 2.2.20.1.1 Upgrade from R1_1_2 image to R1_1_3 ------------------------------- 53 2.2.20.1.2 Upgrade from R1_1_3 image to > R1_1_3 ---------------------------- 55 2.2.20.2 Software image upgrade through WEB ------------------------------------- 55 2.2.21 Setting default OOB IP for system(first time in a new board) ................57 2.2.21.1 CLI Configuration ----------------------------------------------------------------- 57 2.2.21.2 WEB Configuration --------------------------------------------------------------- 58 CHAPTER 3: DHCP SERVER ________________________________________________ 59 3.1 PROTOCOL DESCRIPTION ............................................................................59 3.2 TOPOLOGY .................................................................................................59 3.3 CONFIGURATION GUIDELINES ......................................................................59 3.4 DEFAULT CONFIGURATIONS ........................................................................60 3.5 DHCP CONFIGURATIONS ............................................................................60 3.5.1 Enabling DHCP server ...........................................................................60 3.5.1.1 CLI Configuration ----------------------------------------------------------------- 60 3.5.1.2 WEB Configuration --------------------------------------------------------------- 61 3.5.2 Configuring Offer Reuse Time Out ........................................................61 3.5.2.1 CLI Configuration ----------------------------------------------------------------- 61 3.5.2.2 WEB Configuration --------------------------------------------------------------- 62 3.5.3 Configuring DHCP Address Pools .........................................................62 3.5.3.1 Creating a DHCP Address Pool ----------------------------------------------- 62 3.5.3.2 Configuring End IP for the Pool ----------------------------------------------- 63 3.5.3.3 Configuring Lease Time -------------------------------------------------------- 63 3.5.3.4 Configuring Utilization Threshold --------------------------------------------- 64 3.5.3.5 WEB Configuration for DHCP Address Pool ------------------------------- 65 3.5.4 Creating an Excluded Address in the Pool ............................................65 3.5.4.1 CLI Configuration ----------------------------------------------------------------- 65 3.5.4.2 WEB Configuration --------------------------------------------------------------- 66 3.5.5 Configuring DHCP Pool Options ...........................................................66 3.5.5.1 Configuring a Domain Name Option ----------------------------------------- 66 3.5.5.2 Configuring DNS Option with Single IP Address -------------------------- 67 3.5.5.3 Configuring NTP Option with Two IP Addresses ------------------------- 68 3.5.5.4 Configuring Default Router ----------------------------------------------------- 69 3.5.5.5 Configuring Options Specific to Address Pools --------------------------- 70 3.5.5.6 WEB Configuration for DHCP Pool Options ------------------------------- 71 3.5.6 Configuring Host Specific Options .........................................................71 3.5.6.1 CLI Configuration ----------------------------------------------------------------- 71 CHAPTER 4: RIP __________________________________________________________ 73 4.1 PROTOCOL DESCRIPTION ............................................................................73 4.2 TOPOLOGY .................................................................................................74 4.3 CONFIGURATION GUIDELINES ......................................................................74 4.3.1 Configuration in FDN40-1 ......................................................................74 4.3.2 Configuration in FDN40-2 ......................................................................75 4.3.3 Configuration in FDN40-3 ......................................................................76
Configuration User Manual 5 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. 4.4 DEFAULT CONFIGURATIONS ........................................................................76 4.5 RIP CONFIGURATIONS ................................................................................76 4.5.1 Enabling and Disabling RIP ...................................................................76 4.5.1.1 Enabling RIP ----------------------------------------------------------------------- 76 4.5.1.2 Disabling RIP ---------------------------------------------------------------------- 77 4.5.1.3 WEB Configuration --------------------------------------------------------------- 77 4.5.2 Enabling RIP on an IP Network .............................................................77 4.5.2.1 CLI Configuration ----------------------------------------------------------------- 78 4.5.2.2 WEB Configuration --------------------------------------------------------------- 78 4.5.3 Configuring RIP Security .......................................................................79 4.5.3.1 CLI Configuration ----------------------------------------------------------------- 79 4.5.3.2 WEB Configuration --------------------------------------------------------------- 80 4.5.4 Configuring RIP Packets Retransmission Interval and Retries Count ..80 4.5.4.1 CLI Configuration ----------------------------------------------------------------- 80 4.5.4.2 WEB Configuration --------------------------------------------------------------- 82 4.5.5 Configuring RIP Neighbor ......................................................................82 4.5.5.1 CLI Configuration ----------------------------------------------------------------- 82 4.5.5.2 WEB Configuration --------------------------------------------------------------- 83 4.5.6 Configuring RIP Passive Interface .........................................................83 4.5.6.1 CLI Configuration ----------------------------------------------------------------- 83 4.5.6.2 WEB Configuration --------------------------------------------------------------- 85 4.5.7 Configuring Output-delay .......................................................................85 4.5.7.1 CLI Configuration ----------------------------------------------------------------- 85 4.5.7.2 WEB Configuration --------------------------------------------------------------- 87 4.5.8 Configuring Redistribution .....................................................................87 4.5.8.1 CLI Configuration ----------------------------------------------------------------- 87 4.5.8.2 WEB Configuration --------------------------------------------------------------- 88 4.5.8.3 Sample Configuration to Test Redistribution ------------------------------ 88 4.5.9 Configuring Default-metric .....................................................................91 4.5.9.1 CLI Configuration ----------------------------------------------------------------- 91 4.5.9.2 WEB Configuration --------------------------------------------------------------- 91 4.5.9.3 Sample Configuration to Test Default-metric ------------------------------ 91 4.5.10 Configuring Auto-summary ....................................................................94 4.5.10.1 CLI Configuration ----------------------------------------------------------------- 94 4.5.10.2 WEB Configuration --------------------------------------------------------------- 96 4.5.11 Configuring Interface Specific RIP Parameters .....................................96 4.5.11.1 Configuring RIP Default Route Propagation ------------------------------- 96 4.5.11.2 Configuring to Install Default Route ------------------------------------------ 97 4.5.11.2.1 Sample Configuration to test Default Route Origination and Installation --------------------------------------------------------------------- 97 4.5.11.3 Configuring Version for Receiving RIP Advertisement ----------------- 100 4.5.11.4 Configuring Version for Transmitting RIP Advertisement -------------- 101 4.5.11.5 Configuring Timer Basic ------------------------------------------------------- 102 4.5.11.6 Configuring RIP Split Horizon ------------------------------------------------ 103 4.5.11.7 WEB Configuration for RIP Interface Paramters ------------------------- 104 4.5.12 Configuring RIP Summary-address .....................................................105 4.5.12.1 CLI Configuration ---------------------------------------------------------------- 105 4.5.12.2 WEB Configuration -------------------------------------------------------------- 105 4.5.12.3 Sample Configuration to configure RIP summary-address ------------ 106 4.5.13 Configuring Interface Specific Authentication ......................................107 4.5.13.1 CLI Configuration ---------------------------------------------------------------- 107 4.5.13.2 WEB Configuration -------------------------------------------------------------- 108 4.5.13.3 Sample Configuration for Enabling Authentication ---------------------- 108 4.5.13.4 Sample Configuration for Enabling Crypto Authentication ------------ 110 4.5.14 Configuring Debug Level for RIP .........................................................113 4.5.15 Configuring Route Map – RIP ..............................................................113
Configuration User Manual 6 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. 4.5.15.1 Configuring Route Map -------------------------------------------------------- 114 4.5.15.1.1 CLI Configuration ------------------------------------------------------------ 114 4.5.15.1.2 WEB Configuration ---------------------------------------------------------- 114 4.5.15.2 Configuring Route Map Match Criteria ------------------------------------- 114 4.5.15.2.1 CLI Configuration ------------------------------------------------------------ 114 4.5.15.2.2 WEB Configuration ---------------------------------------------------------- 116 4.5.15.3 Configuring RIP Distance ------------------------------------------------------ 116 4.5.15.3.1 CLI Configuration ------------------------------------------------------------ 116 4.5.15.3.2 WEB Configuration ---------------------------------------------------------- 117 4.5.15.4 Configuring Redistribution with Route Map ------------------------------- 117 4.5.15.4.1 CLI Configuration ------------------------------------------------------------ 117 4.5.15.5 WEB Configuration -------------------------------------------------------------- 118 CHAPTER 5: VLAN _______________________________________________________ 119 5.1 PROTOCOL DESCRIPTION ..........................................................................119 5.2 TOPOLOGY ...............................................................................................120 5.3 CONFIGURATION GUIDELINES ....................................................................120 5.4 DEFAULT CONFIGURATIONS ......................................................................121 5.5 VLAN CONFIGURATIONS ...........................................................................121 5.5.1 Configuring Static VLAN ......................................................................121 5.5.1.1 CLI Configuration ---------------------------------------------------------------- 121 5.5.1.2 WEB Configuration -------------------------------------------------------------- 123 5.5.2 Deleting a VLAN ..................................................................................124 5.5.2.1 CLI Configuration ---------------------------------------------------------------- 124 5.5.2.2 Web Configuration -------------------------------------------------------------- 124 5.5.3 Enabling VLANs ...................................................................................124 5.5.4 Classifying Frames to a VLAN .............................................................124 5.5.4.1 Port Based Classification ------------------------------------------------------ 124 5.5.4.2 WEB Configuration -------------------------------------------------------------- 125 5.5.5 Configuring Port Filtering .....................................................................126 5.5.5.1 Configuring Acceptable Frametype ----------------------------------------- 126 CHAPTER 6: NAT ________________________________________________________ 129 6.1 TOPOLOGY ...............................................................................................129 6.2 CONFIGURATION GUIDELINES ....................................................................130 6.3 DEFAULT CONFIGURATIONS ......................................................................130 6.4 NAT CONFIGURATIONS .............................................................................130 6.4.1 Enabling and Disabling NAT on an Interface .......................................130 6.4.1.1 CLI Configuration ---------------------------------------------------------------- 130 6.4.1.2 WEB Configuration -------------------------------------------------------------- 131 6.4.2 Enabling and Disabling NAPT .............................................................132 6.4.2.1 CLI Configuration ---------------------------------------------------------------- 132 6.4.2.2 WEB Configuration -------------------------------------------------------------- 133 6.4.3 Configuring Static NAT and NAPT ......................................................134 6.4.3.1 CLI Configuration ---------------------------------------------------------------- 134 6.4.3.2 WEB Configuration -------------------------------------------------------------- 135 6.4.4 Configuring Dynamic NAT ...................................................................136 6.4.4.1 CLI Configuration ---------------------------------------------------------------- 137 6.4.4.2 WEB Configuration -------------------------------------------------------------- 138 6.4.5 Configuring Virtual Server ....................................................................138 6.4.5.1 CLI Configuration ---------------------------------------------------------------- 138 6.4.5.2 WEB Configuration -------------------------------------------------------------- 139 CHAPTER 7: IPSEC _______________________________________________________ 141 7.1 PROTOCOL DESCRIPTION ..........................................................................141 7.2 TOPOLOGY ...............................................................................................142 7.3 IPSEC CONFIGURATIONS ..........................................................................142
Configuration User Manual 7 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. 7.3.1 Enabling VPN Module ..........................................................................142 7.3.1.1 CLI Configuration ---------------------------------------------------------------- 142 7.3.1.2 WEB Configuration -------------------------------------------------------------- 143 7.3.2 Configuring VPN IPSec Policy .............................................................143 7.3.2.1 Creating VPN Policy ------------------------------------------------------------ 143 7.3.2.2 Configuring VPN Policy Type ------------------------------------------------- 144 7.3.2.3 Configuring IPSec mode ------------------------------------------------------- 145 7.3.2.4 Configuring Peer Identity ------------------------------------------------------ 147 7.3.2.5 Configuring IPSec Session Keys -------------------------------------------- 148 7.3.2.6 Configuring Access List -------------------------------------------------------- 149 7.3.2.7 Binding of Policy ----------------------------------------------------------------- 150 7.3.2.8 Removing Policy from Interface ---------------------------------------------- 151 7.3.2.9 Deleting Policy ------------------------------------------------------------------- 152 7.3.2.10 WEB Configuration for IPSec VPN Policy Parameters ----------------- 152 7.3.3 Sample Configuration ..........................................................................154 CHAPTER 8: IKE _________________________________________________________ 157 8.1 PROTOCOL DESCRIPTION ..........................................................................157 8.1.1 IKEv1 ...................................................................................................157 8.1.1.1 Phase 1 – Main/Aggressive --------------------------------------------------- 157 8.1.1.1.1 Main Mode -------------------------------------------------------------------- 157 8.1.1.1.2 Aggressive Mode ------------------------------------------------------------ 158 8.1.1.2 Phase 2 - Quick Mode ---------------------------------------------------------- 158 8.1.2 IKEv2 ...................................................................................................158 8.2 IKE CONFIGURATIONS ..............................................................................159 8.2.1 Importing and Deleting RSA Key .........................................................159 8.2.1.1 Importing a RSA Key ----------------------------------------------------------- 159 8.2.1.2 Deleting a RSA Key Pair ------------------------------------------------------- 159 8.2.2 Configuring Certificates .......................................................................159 8.2.2.1 Importing a Certificate ---------------------------------------------------------- 159 8.2.2.2 Deleting a Certificate ----------------------------------------------------------- 161 8.2.2.3 Importing a CA Certificate ----------------------------------------------------- 161 8.2.2.4 Deleting a CA Certificate ------------------------------------------------------ 163 8.2.2.5 Importing a Peer Certificate --------------------------------------------------- 164 8.2.2.6 Deleting Peer Certificate ------------------------------------------------------- 165 8.2.3 Configuring Remote Identity and Authentication Method ....................166 8.2.3.1 Authentication Method Preshered-Key ------------------------------------- 166 8.2.3.2 Authentication Method RSA Certificate ------------------------------------ 166 8.2.3.3 Deleting a Configured Remote Identity ------------------------------------- 167 8.2.3.4 WEB Configuration -------------------------------------------------------------- 167 8.2.4 Creating VPN Policy ............................................................................168 8.2.4.1 CLI Configuration ---------------------------------------------------------------- 168 8.2.4.2 WEB Configuration -------------------------------------------------------------- 169 8.2.5 Configuring VPN IKE Policy Parameters .............................................170 8.2.5.1 Configuring IKE Version ------------------------------------------------------- 170 8.2.5.2 Configuring Key Mode ---------------------------------------------------------- 170 8.2.5.2.1 Certificate Mode ------------------------------------------------------------- 170 8.2.5.2.2 Preshared Key Mode ------------------------------------------------------- 171 8.2.5.3 Configuring Peer IP ------------------------------------------------------------- 171 8.2.5.4 Configuring IPSec Mode ------------------------------------------------------- 172 8.2.5.4.1 Tunnel Mode------------------------------------------------------------------ 172 8.2.5.5 Configuring Remote Identity -------------------------------------------------- 172 8.2.5.6 Configuring Local Identity------------------------------------------------------ 173 8.2.5.7 Configuring Phase 1 Parameters -------------------------------------------- 174 8.2.5.7.1 For IKEv1 ---------------------------------------------------------------------- 175 8.2.5.7.2 For IKEv2 ---------------------------------------------------------------------- 176
Configuration User Manual 8 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. 8.2.5.8 Configuring Phase 2 Parameters -------------------------------------------- 177 8.2.5.8.1 ESP Protocol with Integrity ------------------------------------------------ 177 8.2.5.9 Configuring Access-list --------------------------------------------------------- 178 8.2.5.9.1 Access-list for Tunnel Policy ---------------------------------------------- 178 8.2.5.10 Attaching the Policy to the Interface ---------------------------------------- 179 8.2.5.11 Removing the Policy from the Interface ------------------------------------ 179 8.2.5.12 Deleting the Policy -------------------------------------------------------------- 180 8.2.5.13 Web Configuration for VPN IKE Policy ------------------------------------- 180 8.2.6 Displaying the VPN Statistics ..............................................................182 8.2.6.1 CLI Configuration ---------------------------------------------------------------- 182 8.2.6.2 WEB Configuration -------------------------------------------------------------- 182 8.3 IKE EXAMPLES .........................................................................................183 8.3.1 General Configuration ..........................................................................183 8.3.2 Configuring IKEv1 - Tunnel Mode - Preshared key .............................183 8.3.2.1 DUT1 Configuration ------------------------------------------------------------- 184 8.3.2.2 DUT2 Configuration ------------------------------------------------------------- 186 CHAPTER 9: FIREWALL ___________________________________________________ 189 9.1 TOPOLOGY ...............................................................................................189 9.2 DEFAULT CONFIGURATIONS ......................................................................189 9.3 FIREWALL CONFIGURATIONS .....................................................................189 9.3.1 Enabling and Disabling Firewall Module ..............................................190 9.3.1.1 CLI Configuration ---------------------------------------------------------------- 190 9.3.1.2 WEB Configuration -------------------------------------------------------------- 190 9.3.2 Configuring Firewall Filters for IPv4 .....................................................191 9.3.2.1 CLI Configuration ---------------------------------------------------------------- 191 9.3.2.2 WEB Configuration -------------------------------------------------------------- 194 9.3.3 Configuring Firewall Access List ..........................................................196 9.3.3.1 CLI Configuration ---------------------------------------------------------------- 196 9.3.3.2 WEB Configuration -------------------------------------------------------------- 204 9.3.4 Configuring Zones ...............................................................................206 9.3.4.1 CLI Configuration ---------------------------------------------------------------- 206 9.3.4.2 WEB Configuration -------------------------------------------------------------- 207 CHAPTER 10: IPS-IDS ______________________________________________________ 209 10.1 209 10.2 TOPOLOGY ...............................................................................................209 10.3 DEFAULT CONFIGURATIONS ......................................................................209 10.4 IPS-IDS CONFIGURATIONS .......................................................................210 10.4.1 Enabling and Disabling IPS-IDS Module .............................................210 10.4.1.1 CLI Configuration ---------------------------------------------------------------- 210 10.4.1.2 WEB Configuration -------------------------------------------------------------- 210 10.4.2 Enabling and Disabling IDS Logging ...................................................211 10.4.2.1 CLI Configuration ---------------------------------------------------------------- 211 10.4.2.2 WEB Configuration -------------------------------------------------------------- 212 10.4.3 Configuring IDS Logging Size and Log Size Threshold ......................213 10.4.3.1 CLI Configuration ---------------------------------------------------------------- 213 10.4.3.2 WEB Configuration -------------------------------------------------------------- 214 10.4.4 Configuring IPS status in firewall access-list .......................................214 10.4.4.1 CLI Configuration ---------------------------------------------------------------- 214 10.4.4.2 WEB Configuration -------------------------------------------------------------- 218 10.4.5 Displaying IPS Categories and IPS Rules ...........................................220 10.4.5.1 CLI Configuration ---------------------------------------------------------------- 220 10.4.5.2 WEB Configuration -------------------------------------------------------------- 222 CHAPTER 11: POE ________________________________________________________ 223 11.1 PROTOCOL DESCRIPTION ..........................................................................223
Configuration User Manual 9 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. 11.2 TOPOLOGY ...............................................................................................223 11.3 POE CONFIGURATIONS ............................................................................224 11.3.1 Enabling POE Module .........................................................................224 11.3.1.1 CLI Configuration ---------------------------------------------------------------- 224 11.3.1.2 WEB Configuration -------------------------------------------------------------- 225 11.3.2 Enabling POE on port ..........................................................................225 11.3.2.1 CLI Configuration ---------------------------------------------------------------- 225 11.3.2.2 WEB Configuration -------------------------------------------------------------- 226 11.3.3 To apply power to a POE device .........................................................227 11.3.3.1 CLI Configuration ---------------------------------------------------------------- 227 11.3.3.2 WEB Configuration -------------------------------------------------------------- 228 11.3.4 To view the PSE status ........................................................................228 11.3.4.1 CLI Configuration ---------------------------------------------------------------- 228 11.3.4.2 WEB Configuration -------------------------------------------------------------- 229 CHAPTER 12: WI-FI ________________________________________________________ 231 12.1 TOPOLOGY ...............................................................................................231 12.2 CONFIGURATION GUIDELINES ....................................................................232 12.3 WI-FI CONFIGURATIONS ............................................................................232 12.3.1 Enabling WiFi interfaces ......................................................................232 12.3.1.1 CLI Configuration ---------------------------------------------------------------- 232 12.3.1.2 WEB Configuration -------------------------------------------------------------- 233 12.3.2 Disabling Wi-Fi interface ......................................................................233 12.3.2.1 CLI Configuration ---------------------------------------------------------------- 233 12.3.2.2 WEB Configuration -------------------------------------------------------------- 234 12.3.3 VAP creation and VLAN association ...................................................235 12.3.3.1 CLI Configuration ---------------------------------------------------------------- 235 12.3.3.2 WEB Configuration -------------------------------------------------------------- 236 12.3.3.2.1 VAP (SSID) Creation ------------------------------------------------------- 236 12.3.3.2.2 VLAN Association with VAP ---------------------------------------------- 237 12.3.3.2.3 SSID Summary -------------------------------------------------------------- 237 12.3.4 VAP deletion ........................................................................................237 12.3.4.1 CLI Configuration ---------------------------------------------------------------- 237 12.3.4.2 WEB Configuration -------------------------------------------------------------- 238 12.3.5 Rate-limit Configurations .....................................................................238 12.3.5.1 CLI Configurations -------------------------------------------------------------- 238 12.3.5.2 WEB Configuration -------------------------------------------------------------- 239 12.3.6 Configuring Mac-Filtering for VAP .......................................................240 12.3.6.1 CLI Configuration ---------------------------------------------------------------- 240 12.3.6.2 WEB Configuration -------------------------------------------------------------- 241 12.3.7 Configuring Authentication Algorithms for VAP ...................................241 12.3.7.1 CLI Configuration ---------------------------------------------------------------- 241 12.3.7.1.1 Open Authentication -------------------------------------------------------- 241 12.3.7.1.2 WEP Authentication -------------------------------------------------------- 242 12.3.7.1.3 WPA2 PSK AUTHENTICATION ----------------------------------------- 243 12.3.7.2 WEB Configuration -------------------------------------------------------------- 243 12.4 DISPLAYING THE CONFIGURATIONS ...........................................................244 12.5 WI-FI CLIENT ASSOCIATION ......................................................................246 12.5.1 CLI Configuration .................................................................................246 12.5.2 WEB Configuration ..............................................................................247 CHAPTER 13: NTP _________________________________________________________ 249 13.1 PROTOCOL DESCRIPTION ..........................................................................249 13.2 TOPOLOGY ...............................................................................................250 13.3 CONFIGURATION GUIDELINES ....................................................................250 13.4 DEFAULT CONFIGURATIONS ......................................................................250 13.5 NTP CONFIGURATIONS .............................................................................251
Configuration User Manual 10 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. 13.5.1 Configuring NTP system ......................................................................251 13.5.1.1 Enabling the NTP system------------------------------------------------------ 251 13.5.1.2 Disabling the NTP system ----------------------------------------------------- 251 13.5.1.3 Configuring the NTP Client Mode ------------------------------------------- 252 13.5.1.4 2.WEB Configuration ----------------------------------------------------------- 252 13.5.1.4.1 Enabling/ Disabling NTP --------------------------------------------------- 252 13.5.1.4.2 Configuring NTP Client Mode -------------------------------------------- 253 13.5.2 Configuring NTP Server .......................................................................253 13.5.2.1 CLI Configuration ---------------------------------------------------------------- 253 13.5.2.2 Web Configuration -------------------------------------------------------------- 254 CHAPTER 14: QOS ________________________________________________________ 257 14.1 PROTOCOL DESCRIPTION ..........................................................................257 14.2 TOPOLOGY ...............................................................................................257 14.3 CONFIGURATION GUIDELINES ....................................................................258 14.4 DEFAULT CONFIGURATIONS ......................................................................258 14.5 QOS CONFIGURATIONS.............................................................................258 14.5.1 Configuring QoS Subsystem ...............................................................258 14.5.1.1 Enabling the QoS Subsystem ------------------------------------------------ 258 14.5.1.2 Disabling the QoS Subsystem ------------------------------------------------ 259 14.5.1.3 Making the QoS Subsystem Up ---------------------------------------------- 259 14.5.1.4 WEB Configuration -------------------------------------------------------------- 260 14.5.2 Configuring Rate-Limiting at Port level (Ingress port-rate limiting) ......260 14.5.2.1 CLI Configuration ---------------------------------------------------------------- 260 14.5.2.2 WEB Configuration -------------------------------------------------------------- 260 14.5.3 Configuring Storm-Control at Port level (Ingress port-storm control) ..261 14.5.3.1 CLI Configuration ---------------------------------------------------------------- 261 14.5.3.2 WEB Configuration -------------------------------------------------------------- 261 14.5.4 Configuring Per Queue Shaping (Egress per- port per- queue shaping) .............................................................................................................262 14.5.4.1 CLI Configuration ---------------------------------------------------------------- 262 14.5.4.2 WEB Configuration -------------------------------------------------------------- 263 14.5.4.2.1 Shape Template ------------------------------------------------------------- 263 14.5.4.2.2 Queue Table ------------------------------------------------------------------ 264 14.5.5 Configuring Queue Template ..............................................................264 14.5.5.1 CLI Configuration ---------------------------------------------------------------- 264 14.5.5.2 WEB Configuration -------------------------------------------------------------- 265 14.5.5.2.1 QueueTemplate-------------------------------------------------------------- 265 14.5.5.2.2 Queue Table ------------------------------------------------------------------ 266 14.5.6 Configuring Queue Map .......................................................................266 14.5.6.1 CLI Configuration ---------------------------------------------------------------- 266 14.5.6.2 WEB Configuration -------------------------------------------------------------- 267 14.5.6.2.1 QueueTemplate-------------------------------------------------------------- 267 14.5.7 Configuring Scheduler .........................................................................267 14.5.7.1 CLI Configuration ---------------------------------------------------------------- 267 14.5.7.2 WEB Configuration -------------------------------------------------------------- 268 CHAPTER 15: OSPF _______________________________________________________ 269 15.1 PROTOCOL DESCRIPTION ..........................................................................269 15.2 TOPOLOGY ...............................................................................................270 15.3 CONFIGURATION GUIDELINES ....................................................................271 15.3.1 Configuration in FDN40-1 ....................................................................271 15.3.2 Configuration in FDN40-2 ....................................................................271 15.3.3 Configuration in FDN40-3 ....................................................................272 15.3.4 Configuration in FDN40-4 ....................................................................273 15.3.5 Configuration in FDN40-5 ....................................................................273 15.3.6 Configuration in FDN40-6 ....................................................................274
Configuration User Manual 11 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. 15.3.7 Configuration in FDN40-7 ....................................................................275 15.3.8 Configuration in FDN40-6 ....................................................................275 15.3.9 Configuration in FDN40-9 ....................................................................276 15.4 DEFAULT CONFIGURATIONS ......................................................................276 15.5 OSPF CONFIGURATIONS ..........................................................................279 15.5.1 Enabling and Disabling OSPF .............................................................279 15.5.1.1 CLI Configuration ---------------------------------------------------------------- 279 15.5.1.2 WEB Configuration -------------------------------------------------------------- 279 15.5.2 Configuring Router-id ...........................................................................280 15.5.2.1 CLI Configuration ---------------------------------------------------------------- 280 15.5.2.2 WEB Configuration -------------------------------------------------------------- 280 15.5.3 Configuring OSPF Interface .................................................................281 15.5.3.1 CLI Configuration ---------------------------------------------------------------- 281 15.5.3.2 WEB Configuration -------------------------------------------------------------- 283 15.5.4 Configuring OSPF Interface Parameters .............................................284 15.5.4.1 CLI Configuration ---------------------------------------------------------------- 284 15.5.4.2 WEB Configuration -------------------------------------------------------------- 284 15.5.5 Configuring OSPF Interface Priority ....................................................284 15.5.5.1 CLI Configuration ---------------------------------------------------------------- 284 15.5.5.2 WEB Configuration -------------------------------------------------------------- 285 15.5.6 Configuring LSA Retransmission Level ...............................................285 15.5.6.1 CLI Configuration ---------------------------------------------------------------- 285 15.5.6.2 WEB Configuration -------------------------------------------------------------- 286 15.5.7 Configuring Hello Interval ....................................................................286 15.5.7.1 CLI Configuration ---------------------------------------------------------------- 286 15.5.7.2 WEB Configuration -------------------------------------------------------------- 286 15.5.8 Configuring Dead Interval ....................................................................286 15.5.8.1 CLI Configuration ---------------------------------------------------------------- 287 15.5.8.1 WEB Configuration -------------------------------------------------------------- 287 15.5.9 Configuring Network Type ...................................................................287 15.5.10 Configuring Interface Cost ...................................................................287 15.5.10.1 CLI Configuration ---------------------------------------------------------------- 287 15.5.10.2 WEB Configuration -------------------------------------------------------------- 288 15.5.11 Configuring OSPF Authentication ........................................................288 15.5.11.1 Configuring Simple Password Authentication ---------------------------- 289 15.5.11.1.1 CLI Configuration ------------------------------------------------------------ 289 15.5.11.1.2 WEB Configuration ---------------------------------------------------------- 291 15.5.11.2 Configuring Message-Digest Authentication ------------------------------ 292 15.5.11.2.1 CLI Configuration ------------------------------------------------------------ 292 15.5.11.2.2 WEB Configuration ---------------------------------------------------------- 293 15.5.11.3 Configuring Message-Digest with key constants ------------------------ 294 15.5.11.3.1 CLI Configuration ------------------------------------------------------------ 294 15.5.11.3.2 WEB Configuration ---------------------------------------------------------- 295 15.5.11.4 Configuring NULL Authentication -------------------------------------------- 295 15.5.11.4.1 CLI Configuration ------------------------------------------------------------ 295 15.5.11.4.2 WEB Configuration ---------------------------------------------------------- 296 15.5.12 Configuring Passive Interface ..............................................................296 15.5.12.1 CLI Configuration ---------------------------------------------------------------- 296 15.5.12.2 WEB Configuration -------------------------------------------------------------- 298 15.5.13 Configuring OSPF Area Parameters ...................................................298 15.5.13.1 Configuring Stub Area ---------------------------------------------------------- 298 15.5.13.1.1 CLI Configuration ------------------------------------------------------------ 299 15.5.13.1.2 WEB Configuration ---------------------------------------------------------- 299 15.5.13.2 Configuring ASBR Router ----------------------------------------------------- 300 15.5.13.2.1 CLI Configuration ------------------------------------------------------------ 300 15.5.13.2.2 WEB Configuration ---------------------------------------------------------- 300
Configuration User Manual 12 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. 15.5.13.3 Configuring Redistribution ----------------------------------------------------- 300 15.5.13.3.1 CLI Configuration ------------------------------------------------------------ 300 15.5.13.3.2 WEB Configuration ---------------------------------------------------------- 307 15.5.13.4 Configuring NSSA Area -------------------------------------------------------- 307 15.5.13.4.1 CLI Configuration ------------------------------------------------------------ 307 15.5.13.4.2 WEB Configuration ---------------------------------------------------------- 307 15.5.13.5 Configuring Summary Address ----------------------------------------------- 307 15.5.13.5.1 CLI Configuration ------------------------------------------------------------ 307 15.5.13.5.2 WEB Configuration ---------------------------------------------------------- 308 15.5.13.6 Configuring Area-default Cost ------------------------------------------------ 309 15.5.13.6.1 CLI Configuration ------------------------------------------------------------ 309 15.5.13.6.2 WEB Configuration ---------------------------------------------------------- 317 15.5.13.7 Configuring NSSA asbr-default-route translator ------------------------- 318 15.5.13.7.1 CLI Configuration ------------------------------------------------------------ 318 15.5.13.7.2 WEB Configuration ---------------------------------------------------------- 318 15.5.13.8 Configuring NSSA Area Translation Role --------------------------------- 318 15.5.13.8.1 CLI Configuration ------------------------------------------------------------ 318 15.5.13.8.2 WEB Configuration ---------------------------------------------------------- 319 15.5.13.9 Configuring Stability Interval for NSSA ------------------------------------- 319 15.5.13.9.1 CLI Configuration ------------------------------------------------------------ 319 15.5.13.9.2 WEB Configuration ---------------------------------------------------------- 320 15.5.13.10 Configuring ABR-Type ----------------------------------------------------- 320 15.5.13.10.1 CLI Configuration ------------------------------------------------------------ 320 15.5.13.10.2 WEB Configuration ---------------------------------------------------------- 321 15.5.13.11 Configuring RFC 1583 Compatibility ----------------------------------- 321 15.5.13.11.1 CLI Configuration ------------------------------------------------------------ 321 15.5.13.11.2 WEB Configuration ---------------------------------------------------------- 321 15.5.13.12 Configuring Default-information Originate Always ------------------ 322 15.5.13.12.1 CLI Configuration ------------------------------------------------------------ 322 15.5.13.12.2 WEB Configuration ---------------------------------------------------------- 322 15.5.13.13 Configuring Redist-Config ------------------------------------------------ 322 15.5.13.13.1 CLI Configuration ------------------------------------------------------------ 322 15.5.13.13.2 WEB Configuration ---------------------------------------------------------- 328 15.5.13.14 Configuring Neighbor ------------------------------------------------------ 329 15.5.13.14.1 CLI Configuration ------------------------------------------------------------ 329 15.5.13.14.2 WEB Configuration ---------------------------------------------------------- 330 15.5.13.15 Configuring Virtual link ----------------------------------------------------- 330 15.5.13.15.1 CLI Configuration ------------------------------------------------------------ 330 15.5.13.15.2 WEB Configuration ---------------------------------------------------------- 331 15.5.13.16 Configuring Area-range --------------------------------------------------- 331 15.5.13.16.1 CLI Configuration ------------------------------------------------------------ 331 15.5.13.16.2 WEB Configuration ---------------------------------------------------------- 336 15.5.14 Configuring Route Map - OSPF ...........................................................336 15.5.14.1 Configuring Route Map -------------------------------------------------------- 336 15.5.14.1.1 CLI Configuration ------------------------------------------------------------ 336 15.5.14.1.2 WEB Configuration ---------------------------------------------------------- 337 15.5.14.2 Configuring Route Map Match Criteria ------------------------------------- 337 15.5.14.2.1 CLI Configuration ------------------------------------------------------------ 337 15.5.14.2.2 WEB Configuration ---------------------------------------------------------- 338 15.5.14.3 Configuring OSPF Distance --------------------------------------------------- 338 15.5.14.3.1 CLI Configuration ------------------------------------------------------------ 338 15.5.14.3.2 WEB Configuration ---------------------------------------------------------- 339 15.5.14.4 Configuring Redistribution with Route Map ------------------------------- 339 15.5.14.4.1 CLI Configuration ------------------------------------------------------------ 339 15.5.14.4.2 WEB Configuration ---------------------------------------------------------- 340 15.5.14.5 Topology Configuration for OSPF Testing--------------------------------- 340
Configuration User Manual 13 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. 15.5.14.6 Redistribution Topology -------------------------------------------------------- 344 15.5.14.6.1 Redistribution Interface Configuration ---------------------------------- 345 15.5.14.6.2 Redistribution Protocol Configuration ---------------------------------- 345 15.5.14.7 OSPF Inbound Filtering with Route Map ---------------------------------- 349 15.5.14.7.1 Interface Configuration ----------------------------------------------------- 349 15.5.14.7.2 Protocol Configuration ----------------------------------------------------- 350 CHAPTER 16: DHCP RELAY AGENT __________________________________________ 355 16.1 PROTOCOL DESCRIPTION ..........................................................................355 16.2 TOPOLOGY ...............................................................................................356 16.3 CONFIGURATION GUIDELINES ....................................................................356 16.4 DEFAULT CONFIGURATIONS ......................................................................356 16.5 ENABLING DHCP RELAY ...........................................................................357 16.5.1.1 CLI Configuration ---------------------------------------------------------------- 357 16.5.1.2 WEB Configuration -------------------------------------------------------------- 358 16.6 CONFIGURING A DHCP SERVER ADDRESS ................................................358 16.6.1.1 CLI Configuration ---------------------------------------------------------------- 358 16.6.1.2 WEB Configuration -------------------------------------------------------------- 359 16.7 ENABLING RELAY AGENT INFORMATION .....................................................359 16.7.1.1 CLI Configuration ---------------------------------------------------------------- 359 16.7.1.2 WEB Configuration -------------------------------------------------------------- 360 16.8 CONFIGURING RELAY AGENT SUB-OPTIONS ...............................................360 16.8.1.1 CLI Configuration ---------------------------------------------------------------- 360 16.8.1.2 WEB Configuration -------------------------------------------------------------- 361 16.9 ENABLING TRACES FOR DHCP RELAY .......................................................361 16.10 ACQUIRING IP FROM A SERVER RESIDING OUTSIDE THE CLIENT NETWORK .362 CHAPTER 17: RAVPN ______________________________________________________ 369 17.1 PROTOCOL DESCRIPTION ..........................................................................369 17.2 TOPOLOGY ...............................................................................................370 17.3 RAVPN CONFIGURATIONS ........................................................................370 17.3.1 Enabling VPN Module ..........................................................................370 17.3.1.1 CLI Configuration ---------------------------------------------------------------- 370 17.3.1.2 WEB Configuration -------------------------------------------------------------- 371 17.3.2 Configuring pool IP address ................................................................371 17.3.2.1 CLI Configuration ---------------------------------------------------------------- 371 17.3.2.2 WEB Configuration -------------------------------------------------------------- 372 17.3.3 Configuring RAVPN Policy Type .........................................................372 17.3.3.1 CLI Configuration ---------------------------------------------------------------- 372 17.3.3.2 WEB Configuration -------------------------------------------------------------- 373 17.3.4 Configuring IPSec mode ......................................................................374 17.3.4.1 CLI Configuration ---------------------------------------------------------------- 374 17.3.5 Configuring Peer Identity .....................................................................375 17.3.5.1 CLI Configuration ---------------------------------------------------------------- 375 17.3.5.2 WEB Configuration -------------------------------------------------------------- 376 17.3.6 Configuring IPSec Session Keys .........................................................377 17.3.6.1 CLI Configuration ---------------------------------------------------------------- 377 17.3.6.2 WEB Configuration -------------------------------------------------------------- 378 17.3.7 Configuring Access List .......................................................................379 17.3.7.1 CLI Configuration ---------------------------------------------------------------- 379 17.3.7.2 WEB Configuration -------------------------------------------------------------- 380 17.3.8 Binding of Policy ..................................................................................380 17.3.8.1 CLI Configuration ---------------------------------------------------------------- 380 17.3.8.2 WEB Configuration -------------------------------------------------------------- 381 17.3.9 Removing Policy from Interface ...........................................................382 17.3.9.1 CLI Configuration ---------------------------------------------------------------- 382 17.3.9.2 WEB Configuration -------------------------------------------------------------- 383
Configuration User Manual 14 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. 17.3.10 Deleting Policy .....................................................................................383 17.3.10.1 CLI Configuration ---------------------------------------------------------------- 383 17.3.10.2 WEB Configuration -------------------------------------------------------------- 383 17.3.11 Sample Configuration ..........................................................................385 17.3.11.1 RAVPN Server Configuration ------------------------------------------------- 386
Configuration User Manual 15 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Figures Figure 6-1: Configuration for Basic System Features ................................................................................. 27 Figure 6-2: Configuration for Advanced System Features .......................................................................... 27 Figure 7-1: DHCP - Topology 1 ................................................................................................................... 59 Figure 13-1: RIP Topology 1 ....................................................................................................................... 74 Figure 13-2: RIP Topology 2 ....................................................................................................................... 74 Figure 16-1: Topology for VLAN Configuration ......................................................................................... 120 Figure 17-1 - NAT Topology ...................................................................................................................... 129 Screen 17-3: Static NAT and NAPT .......................................................................................................... 136 Figure 18-1: IPSec Topology ..................................................................................................................... 142 Figure 18-2: Topology Diagram for Sample IPSec Configuration ............................................................. 154 Figure 19-1: IKE Topology ......................................................................................................................... 183 Figure 20-1: Firewall Topology .................................................................................................................. 189 Figure 20-5: IPS Topology ......................................................................................................................... 209 Screen 20-7: IPS Basic Settings - Disabling IPS-IDS global status .......................................................... 211 Screen 20-14: Firewall Access List – View IPS status .............................................................................. 220 Figure 21-1: Wi-Fi Topology ...................................................................................................................... 231 Figure 22-1: NTP Topology ....................................................................................................................... 250 Figure 23-1: QOS Topology ...................................................................................................................... 257 Figure 24-1: OSPF Topology ..................................................................................................................... 270 Screen 24-2: OSPF Basic Settings ........................................................................................................... 281 Figure 24-2: Topology For Testing Authentication .................................................................................... 289 Figure 24-3: Topology For Configuration of stub area, ASBR and route redistribution ............................ 301 Figure 24-4: Topology For NSSA, summary address and area-default Cost Configuration ..................... 310 Figure 24-5: Topology For testing default-information originate always and redist-config ........................ 323 Figure 24-6: Topology For testing virtual link and route summarization ................................................... 332 Figure 24-7: Topology Configuration for OSPF Testing ............................................................................ 340 Figure 24-8: Redistribution Topology Configuration .................................................................................. 345 Figure 24-9: Distribute-list In Topology Configurations ............................................................................. 349 Figure 29-1: DHCP – Topology ................................................................................................................. 356 Figure 30-1: RAVPN - Topology ................................................................................................................ 370 Screen 30-1: VPN Policy - VPN Module Status ........................................................................................ 371 Screen 30-2: RAVPN Pool IP Address configuration ................................................................................ 372 Screen 30-3: RAVPN Policy Type Configuration ...................................................................................... 374 Screen 30-4: Peer Identity Configuration .................................................................................................. 377 Screen 30-5: IPSec Session Keys Configuration ...................................................................................... 379 Screen 30-6: Access List Configuration .................................................................................................... 380 Screen 30-7: Binding of Policy .................................................................................................................. 382 Screen 30-8: Removal of Policy from Interface ......................................................................................... 383 Screen 30-9: Deleting Policy ..................................................................................................................... 384 Figure 30-2: RAVPN Topology – Sample Configuration ........................................................................... 385
Configuration User Manual 17 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Web Screens List Screen 2-1: Factory Default Settings ........................................................................................................... 30 Screen 2-2: IPv4 Interface Setings .............................................................................................................. 31 Screen 2-3: System Information- Login Authentication ............................................................................... 34 Screen 2-4: Restore Configuration .............................................................................................................. 36 Screen 2-5: Log Transfer ............................................................................................................................. 39 Screen 2-6: Log Transfer ............................................................................................................................. 39 Screen 2-7: HTTP Configuration ................................................................................................................. 45 Screen 2-8: Port Basic Settings ................................................................................................................... 47 Screen 2-9: IP Standard ACL Configuration ............................................................................................... 52 Screen 2-10: MAC ACL Configuration ......................................................................................................... 52 Screen 2-11: Image Upgradation using normal ........................................................................................... 56 Screen 2-12: Image Upgradation using FallBack ........................................................................................ 57 Screen 2-13: IP Erase configuration ............................................................................................................ 58 Screen 3-1: DHCP Basic Settings ............................................................................................................... 61 Screen 3-2: DHCP Pool Settings ................................................................................................................. 65 Screen 3-3: DHCP Server IP Exclude Setings ............................................................................................ 66 Screen 3-4: DHCP Pool Options Settings ................................................................................................... 71 Screen 4-1: RIP VRF Creation .................................................................................................................... 77 Screen 4-2: RIP Interface ............................................................................................................................ 79 Screen 4-3: RIP Basic Settings ................................................................................................................... 80 Screen 4-4: RIP Neighbour List ................................................................................................................... 83 Screen 4-5: RIP Interface - Passive ............................................................................................................ 85 Screen 4-6: RRD RIP Configuration ............................................................................................................ 88 Screen 4-7: RIP Interface - Parameters .................................................................................................... 105 Screen 4-8: RIP Interface Specific Address Summarization ..................................................................... 106 Screen 4-9: RIP Security Settings ............................................................................................................. 108 Screen 4-10: RouteMap Creation .............................................................................................................. 114 Screen 4-11: RouteMap Match .................................................................................................................. 116 Screen 5-1: Static VLAN Configuration ..................................................................................................... 124 Screen 5-2: VLAN Port Settings ................................................................................................................ 126 Screen 6-1: Interface NAT Settings screen - NAT Status ......................................................................... 132 Screen 6-2: Interface NAT Settings screen - NAPT Status ....................................................................... 134 Screen 6-4: Address Pool screen .............................................................................................................. 138 Screen 6-5: Virtual Server Configuration ................................................................................................... 139 Screen 7-1: VPN Policy - VPN Module Status .......................................................................................... 143 Screen 7-2: VPN IPSec ............................................................................................................................. 153 Screen 8-1: VPN Global Setings ............................................................................................................... 167 Screen 8-2: VPN Policy ............................................................................................................................. 169 Screen 8-3: VPN IKE ................................................................................................................................. 181 Screen 8-4: VPN Statistics ........................................................................................................................ 182 Firewall Configurations .............................................................................................................................. 189 Screen 9-1: Firewall Basic Settings ........................................................................................................... 191 Screen 9-2: Firewall Filter Configuration ................................................................................................... 195 Screen 9-3: Firewall - ACL Configuration .................................................................................................. 205 Screen 9-4: Firewall Interface Configuration ............................................................................................. 208 Screen 10-1: IPS Basic Settings - Enabling IPS-IDS global status ........................................................... 211 Screen 10-2: IPS Basic Settings - Disabling IPS-IDS global status .......................................................... 211 Screen 10-3: IPS Basic Settings - Enabling IDS logging status ................................................................ 212 Screen 10-4: IPS Basic Settings - Disabling IDS logging status ............................................................... 213 Screen 10-5: IPS Basic Settings - Configure IDS logging file size ............................................................ 214 Screen 10-6: IPS Basic Settings - Disabling IDS logging status ............................................................... 214 Screen 10-7: Firewall Access List - Configure IPS status as enabled ...................................................... 219
Configuration User Manual 18 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 10-8: Firewall Access List - Configure IPS status as disabled ...................................................... 219 To view IPS status in the firewall access-list ............................................................................................. 219 Screen 10-9: Firewall Access List – View IPS status ................................................................................ 220 Screen 10-10: IPS Signature – Display signatures for not-suspicious category ....................................... 222 Screen 11-1: POE Basic Settings .............................................................................................................. 225 Screen 11-2: POE Port Configuration ....................................................................................................... 227 Screen 11-3: POE Port Configuration ....................................................................................................... 228 Screen 11-4: PSE Configuration ............................................................................................................... 229 Screen 12-1: AP RadioSettings - Enabling Radio Interfaces .................................................................... 233 Screen 12-2: AP RadioSettings - Disabling Wi-Fi Interface ...................................................................... 234 Screen 12-3: AP RadioSettings - Creating VAP (SSID) ............................................................................ 236 Screen 12-4: VAP ...................................................................................................................................... 237 Screen 12-5: SSID Summary .................................................................................................................... 237 Screen 12-6: AP RadioSettings - Deleting VAP (SSID) ............................................................................ 238 Screen 12-7: Rate Limit ............................................................................................................................. 239 Screen 12-8: VAP - MAC Filtering ............................................................................................................. 241 Screen 12-9: VAP – Authentication with WEP .......................................................................................... 244 Screen 12-10: AP Radio Statistics ............................................................................................................ 247 Screen 13-1: NTP Basic Settings .............................................................................................................. 253 Screen 13-2: NTP Client Mode .................................................................................................................. 253 Screen 13-3: NTP Server Configurations .................................................................................................. 255 Screen 14-1: QoS Basic Settings .............................................................................................................. 260 Screen 14-2: Ingress Rate Limiting ........................................................................................................... 261 Screen 14-3: Storm-Control ....................................................................................................................... 262 Screen 14-4: Shape Template Configurations .......................................................................................... 264 Screen 14-5: Queue Configurations .......................................................................................................... 264 Screen 14-10: QueueTemplate Configurations ......................................................................................... 266 Screen 14-11: Queue Configurations ........................................................................................................ 266 Screen 14-12: Queue Map Configurations ................................................................................................ 267 Screen 14-6: Scheduler Configurations..................................................................................................... 268 Screen 15-1: OSPF VRF Creation ............................................................................................................ 279 Screen 15-3: OSPF Interface Configuration .............................................................................................. 283 Screen 15-4: OSPF Area Configuration .................................................................................................... 299 Screen 15-5: OSPF Area Aggregation ...................................................................................................... 309 Screen 15-6: OSPF RRD Route Configuration ......................................................................................... 329 Screen 15-7: OSPF Virtual Interface Configuration .................................................................................. 331 Screen 16-1: DHCP Relay Configuration .................................................................................................. 358 Screen 16-2: DHCP Relay Interface Configuration ................................................................................... 361
Configuration User Manual 19 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Tables Table 1-1- Acronyms used in the Document ............................................................................................... 21 Table 1-2: Document Conventions .............................................................................................................. 23 Table 1-3: General Configurations .............................................................................................................. 24 Table 7-1: Default Configurations ................................................................................................................ 60 Table 16-1: Default Configurations ............................................................................................................ 121 Table 20-1: IPv4 Addresses of Interfaces and Hosts ................................................................................ 189 Table 20-1: IPv4 Addresses of Interfaces and Hosts ................................................................................ 209 Table 21-1: Wi-Fi Topology Description .................................................................................................... 231 Table 22-2: Default Configurations ............................................................................................................ 250 Table 23-1: QOS Topology Description..................................................................................................... 257 Table 23-2: Default Configurations ............................................................................................................ 258 Table 24-1: Default Configurations ............................................................................................................ 276 Table 24-2 IPv4 Addresses of Interfaces in the Routers Topology – OSPF Testing ................................ 341 Table 24-3: IPv4 Addresses of Interfaces in the Routers – Redistribution Topology ................................ 345 Table 24-4: IPv4 Addresses of Interfaces in the Routers – OSPF Inbound Filtering ................................ 349 Table 29-1: Default Configurations ............................................................................................................ 356
Configuration User Manual 21 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 1 Introduction 1.1 Purpose and Scope FDN40 is a Multi Service Business Gateway solution for providing scalable, converged voice and data connectivity to SMB customers. FDN40 is an integrated data infrastructure solution providing:  Converged Data, Switching, Security & Robust Routing Platform  Integrated advanced routing, security applications & WLAN access point with application-aware QoS into an single box solution  Simplicity via integration and expandability This document is applicable for the below FDN40 Variants 1. FDN40-4 2. FDN40-6 3. FDN40-6P 1.2 Acronyms Table 1-1- Acronyms used in the Document Acronym Explanation ACL Access Control List AH Authentication Header ALG Application Layer Gateway BOOTP Bootstrap Protocol
CHAPTER 1: INTRODUCTION Configuration User Manual 22 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Acronym Explanation BPDU Bridge Protocol Data Unit CBS Committed Burst Size CIR Committed Information Rate CLI Command Line Interface DHCP Dynamic Host Configuration Protocol DOS Denial of Service DSCP Differentiated Services Code Point DES Data Encryption Standard DH Diffie-Hellman DPI Deep Packet Inspection DUT Device Under Test EIR Excess Information Rate EBS Excess Burst Size ESP Encapsulating Security Protocol EXEC EXECutable mode FID Filtering Identifier IP Internet Protocol IDS Intrusion Detection System IKE Internet Key Exchange IPS Intrusion Prevention System IPSec Internet Protocol for Security IETF Internet Engineering Task Force HTTP Hyper Text Transfer Protocol ICMP Internet Control Message Protocol IP Internet Protocol IVL Independent VLAN Learning LAN Local Area Network MAC Media Access Control MIB Management Information Base MTU Maximum Transfer Unit NAT Network Address Translation NAPT Network Address Port Translation NTP Network Time Protocol NVRAM Non-Volatile Random Access Memory PNAC Port Based Network Authentication Protocol PVID Port VLAN ID QoS Quality-of-Service RADIUS Remote Authentication Dial-In User Service RA-VPN Remote Access Virtual Private Network
CHAPTER 1: INTRODUCTION Configuration User Manual 23 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Acronym Explanation RSA Rivest Shamir Adleman Algorithm RIP Routing Information Protocol RRD Route Redistribution RTM Routing Table Manager RFC Request For Comments RMON Remote Monitoring SA Security Association SAD Security Association Database SG Security Gateway SHA1 Secure Hash Algorithm 1 SPD Security Policy Database SPI Security Parameter Index SNMP Simple Network Management Protocol TCP Transmission Control Protocol UDP User Datagram Protocol VPN Virtual Private Network VAP Virtual Access Point VACM View based Access Control Model VID VLAN Identifier VLAN Virtual Local Area Network WAN Wide Area Network 1.3 References FDN40 CLI Configuration Guide 1.4 Document Conventions Table 1-2: Document Conventions Convention Usage Bold CLI commands Italics User inputs for CLI commands Courier New 10 Regular CLI command outputs  Notes / Guidelines / Pre-requisites are keyed using this style. Output areas specific to the configuration
CHAPTER 1: INTRODUCTION Configuration User Manual 24 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 1.5 General Configurations 1.5.1 CLI Modes The following table provides the access and exit methods to various general configuration modes. Table 1-3: General Configurations Command Mode Access Method Prompt Exit method User EXEC This is the initial mode to start a session. UltOs> The logout method is used. Privileged EXEC The User EXEC mode command enable, is used to enter the Privileged EXEC mode. UltOs# To return from the Privileged EXEC mode to User EXEC mode the disable command is used. Global Configuration The Privileged EXEC mode command configure terminal, is used to enter the Global Configuration mode UltOs(config)# To exit to the Global Configuration mode the exit command is used and to exit to the Privileged EXEC mode the end command is used. Interface Configuration The Global Configuration mode command interface <interface-type><interface-id> is used to enter the Interface Configuration mode. UltOs(config-if)# To exit to the Global Configuration mode the exit command is used and to exit to the Privileged EXEC mode the end command is used. VLAN Configuration The Global Configuration Mode command VLAN <VLANid>, is used to enter the VLAN configuration mode UltOs(config-vlan)# To exit to the Global Configuration Mode, the exit command is used and to exit to the Privileged EXEC mode, the end command is used NTP Configuration The Global Configuration mode command ntp is used to enter the NTP configuration mode. UltOs(config-ntp)# To exit to the Global Configuration mode the exit command is used and to exit to the Privileged EXEC mode the end command is used. 1.5.2 SNMP Configurations SNMP configurations can be done in two ways: 1. Using NETSNMP commands 2. Using Scotty manager We have done the configurations using Scotty manager version 2.1.10. To start the configurations, follow the steps given below.
CHAPTER 1: INTRODUCTION Configuration User Manual 25 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 3. Execute Scotty. root@localhost mibs# scotty2.1.10 % 4. Load the mib files. This is to register the mib files with the SNMP manager. % mib load fsrmon.mib % mib load stdrmon.mib 5. Create a session. % snmp session -address 12.0.0.1 -community "NETMAN" -retries 0 -version SNMPv2C -timeout 30 snmp0 To configure a particular object, use the set command as given below. % snmp0 set {{ rmonEnableStatus.0 enable}} Where rmonEnableStatus is the object name, 0 is the index and enable is the object value to be set. To obtain a configured value, use the get command. For example, % snmp0 get rmonEnableStatus.0 Where rmonEnableStatus is the object name, 0 is the index. If the object is the tabular object, use the interface ID to which the object is configured as the index.
Configuration User Manual 27 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 2 System Features 2.1 Topologies Figure 2-1: Configuration for Basic System Features Figure 2-2: Configuration for Advanced System Features Packet capturing device P1 12.0.0.1 12.0.0.100 FDN40-1 Host1 P2 P1 FDN40-1 – 12.0.0.1 SMART BITS P2 P1 P1 P2
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 28 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2.2 System Features / Configurations 2.2.1 Configuring the Default IP Address Configuring the Default IP Address will result in the IP address to be written to the NVRAM and this will be used as the IP address of the default interface when the switch is restarted. This will update the IP address of the Inband Management VLAN. 2.2.1.1 CLI Configuration 1. Execute the following commands to configure the Default IP Address.  Enter the Global Configuration mode. UltOs# configure terminal  Configure the default IP address and subnet mask as 10.10.10.1 and 255.255.0.0, respectively. UltOs(config)# default ip 10.10.10.1 subnet-mask 255.255.0.0  Exit from the Global Configuration mode. UltOs(config)#end 2. View the default IP address and subnet mask by executing the following command. UltOs# show nvram Default IP Address : 10.10.10.1 Default Subnet Mask : 255.255.255.0 OOB IP Address : 172.30.19.108 OOB Subnet Mask : 255.255.255.0 Default IP Address Config Mode : Manual Default IP Address Allocation Protocol : DHCP Switch Base MAC Address : 54:df:00:00:08:01 Default Interface Name : wan0/1 Default RM Interface Name : NONE Config Restore Option : Restore Config Save Option : Startup save Auto Save : Disable Incremental Save : Disable Roll Back : Enable Config Save IP Address : 0.0.0.0 Config Save Filename : zeus.conf Config Restore Filename : zeus.conf PIM Mode : Sparse Mode IGS Forwarding Mode : MAC based
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 29 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Cli Serial Console : Yes SNMP EngineID : 80.00.08.1c.03.54 SNMP Engine Boots : 351 Default VLAN Identifier : 1 Stack PortCount : 0 ColdStandby : Disable Store Default Value : Disable Vrf Unique Mac : Disable Hitless Restart Flag : Disable Hardware Version : 2.0 Firmware Version : v1.2.29 Hardware Part Number : 1511MMC001 Software Serial Number : 1-0-0 Software Version : R1.1.3 Switch Name : FDN40-4 RM Heart Beat Mode : Internal RM Redundancy Type : Hot RM Data Plane Type : Shared RM Type : OOB NPAPI mode : Synchronous TimeStamp Method : TransHardware Restore Flag : Disabled Dynamic Port Count : 56 FIPS operation mode : Disabled Restore Option : Enabled BRIDGE_MODE_WAN1 :Customer Bridge BRIDGE_MODE_WAN2 :Customer Bridge Debugging Log File Location :/media/iss-db/ Management Port : Enabled Automatic Port Create Flag : Enabled IMG_DUMP_PATH : Manufacturing Date : 04202016  VLAN 1 (default VLAN) will have this IP address and subnet mask after the switch restart only if the allocation method is manual. 2.2.1.2 WEB Configuration Default IP Address can be configured through WEB interface using the Factory Default Settings screen (Navigation - System > NVRAM Settings)
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 30 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 2-1: Factory Default Settings 2.2.2 Configuring IP address for an Interface Configuring IP address for an Interface configures the IP address which will be used for sending and receiving the packets. 2.2.2.1 CLI Configuration 1. Execute the following commands to configure an IP address for a VLAN interface.  Enter the Global Configuration mode. UltOs# configure terminal  Enter the VLAN Configuration Mode (for VLAN 1). UltOs(config)# VLAN 1  Add member ports for VLAN. UltOs(config-vlan)# ports lan 0/1-4 untagged lan 0/1-4
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 31 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  Enter the Interface Configuration mode. UltOs(config)# interface vlan 1  Shut down the VLAN interface. UltOs(config-if)# shutdown  Configure the IP address and subnet mask. UltOs(config-if)# ip address 10.0.0.100 255.0.0.0  Bring up the VLAN interface. UltOs(config-if)#no shutdown  Exit from the Interface Configuration mode. UltOs(config)#end  Configuring the IP address for an Interface requires the interface to be shutdown prior to the configuration. 2. View the configured interface IP address by executing the following show command. UltOs# show ip interface Vlan1 is up, line protocol is up Internet Address is 10.0.0.100/8 Broadcast Address 10.255.255.255 2.2.2.2 WEB Configuration IP Address for an interface can be configured through WEB interface using the IPv4 Interface Settings screen (Navigation - Layer3 Management > IP > IPv4 Addr Conf) Screen 2-2: IPv4 Interface Setings
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 32 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2.2.3 Configuring the Base MAC Address Configuring the Base MAC Address will result in the Switch Base MAC address to be written to the NVRAM. This will be used as the Base MAC address of the when the switch is restarted. 2.2.3.1 CLI Configuration 1. Execute the following commands to change the base MAC address of the switch.  Enter the Global Configuration mode. UltOs# configure terminal  Configure the base MAC address for the switch. UltOs(config)# base-mac 00:01:02:03:0A:0B  Exit from the Global Configuration mode. UltOs(config)#end 2. View the base MAC address by executing the following show command. UltOs# show nvram Default IP Address : 12.0.0.1 Default Subnet Mask : 255.0.0.0 Default IP Address Config Mode : Manual Default IP Address Allocation Protocol : DHCP Switch Base MAC Address : 00:01:02:03:0a:0b Default Interface Name : wan0/1 Config Restore Option : No restore Config Save Option : No save Auto Save : Enable Incremental Save : Disable Roll Back : Enable Config Save IP Address : 0.0.0.0 Config Save Filename : FDN40.conf Config Restore Filename : FDN40.conf PIM Mode : Sparse Mode IGS Forwarding Mode : MAC based Cli Serial Console : Yes SNMP EngineID : 80.00.08.1c.04.46.53  The configuration takes effect only on switch restart.
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 33 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2.2.3.2 WEB Configuration Base MAC can be configured through WEB interface using the Factory Default Settings screen. For screenshot, refer section 2.2.1.2 2.2.4 Configuring the Login Authentication Method Configuring the Login Authentication Method sets the authentication method for user logins. 2.2.4.1 CLI Configuration 1. Execute the following commands to change the authentication method for switch login.  Enter the Global Configuration mode. UltOs# configure terminal  Configure the login authentication method as RADIUS. UltOs(config)# login authentication radius  Exit from configuration mode. UltOs(config)#end 2. View the current authentication method by executing the following show command. UltOs# show system information Hardware Version : 5.2.3 Firmware Version : 4.0.0.0 Switch Name : FDN40-4 System Contact : info@ulteriustech.com System Location : Ulterius Logging Option : Console Logging Login Authentication Mode : Remote Config Save Status : Not Initiated Remote Save Status : Not Initiated Config Restore Status : Not Initiated 2.2.4.2 Web Configuration Login Authentication can be set through WEB interface using the System Information screen (Navigation - System > System Information)
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 34 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 2-3: System Information- Login Authentication 2.2.5 Configuring the Restoration File Name Configuring the restoration file name will result in the restoration file name to be written to the NVRAM. This will be used as the configuration restoration file. 2.2.5.1 CLI Configuration 1. Execute the following commands to configure the restoration file name.  Enter the Global Configuration mode. UltOs# configure terminal  Configure the configuration restoration file name for the Switch.
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 35 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# default restore-file switch.conf  Exit from the Global Configuration mode. UltOs(config)#end 2. View the default restoration file name by executing the following show command. UltOs# show nvram Default IP Address : 12.0.0.1 Default Subnet Mask : 255.0.0.0 Default IP Address Config Mode : Manual Default IP Address Allocation Protocol : DHCP Switch Base MAC Address : 00:01:02:03:0a:0b Default Interface Name : wan0/1 Config Restore Option : No restore Config Save Option : No save Config Save IP Address : 0.0.0.0 Auto Save : Enable Incremental Save : Disable Roll Back : Enable Config Save Filename : zeus.conf Config Restore Filename : switch.conf PIM Mode : Sparse Mode IGS Forwarding Mode : MAC based Cli Serial Console : Yes SNMP EngineID : 80.00.08.1c.04.46.53 2.2.5.2 Web Configuration Restore file name can be set through WEB interface using the Restore Configuration screen (Navigation - System > Save and Restore > Restore)
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 36 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 2-4: Restore Configuration 2.2.6 Saving the Current Configurations for Restoration Saving the current configurations for restoration writes the running-config to a flash file, a startup-configuration file or to a remote site. 1. Execute the following command to save the current running configuration into a file. UltOs# write startup-config 2. View the restoration status by executing the following show command. UltOs# show nvram Default IP Address : 12.0.0.1 Default Subnet Mask : 255.0.0.0 Default IP Address Config Mode : Manual Default IP Address Allocation Protocol : DHCP Switch Base MAC Address : 00:01:02:03:04:01 Default Interface Name : wan0/1 Config Restore Option : Restore Config Save Option : Startup save Auto Save : Enable Incremental Save : Disable Roll Back : Enable Config Save IP Address : 0.0.0.0 Config Save Filename : switch.conf Config Restore Filename : switch.conf PIM Mode : Sparse Mode IGS Forwarding Mode : MAC based Cli Serial Console : Yes
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 37 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. SNMP EngineID : 80.00.08.1c.04.46.53 3. View the restoration status by executing the following show command. UltOs# show system information Hardware Version : 5.2.3 Firmware Version : 4.0.0.0 Switch Name : FDN40-4 System Contact : info@.com System Location : Ulterius Logging Option : Console Logging Login Authentication Mode : Local Config Save Status : Successful Remote Save Status : Not Initiated Config Restore Status : Not Initiated 4. View the restoration status after rebooting the switch by executing the following show command. UltOs# show system information Hardware Version : 5.2.3 Firmware Version : 4.0.0.0 Switch Name : FDN40-4 System Contact : info@ulteriustech.com System Location : Ulterius Logging Option : Console Logging Login Authentication Mode : Local Config Save Status : Not Initiated Remote Save Status : Not Initiated Config Restore Status : Successful  Notes:  The current configurations will be saved into a file specified by default restore-file command.  Default name for the restoration file is zeus.conf.  The switch will start with the saved configuration on reboot. 2.2.7 Erasing a Saved Configuration File Erasing a saved configuration file clears the contents of the startup configuration or sets the parameters in NVRAM to their default values. 1. Execute the following command to erase the saved configuration file.
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 38 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# erase startup-config 2. View the erase status by executing the following show command. UltOs# show nvram Default IP Address : 12.0.0.1 Default Subnet Mask : 255.0.0.0 Default IP Address Config Mode : Manual Default IP Address Allocation Protocol : DHCP Switch Base MAC Address : 00:01:02:03:04:01 Default Interface Name : wan0/1 Config Restore Option : No restore Config Save Option : No save Auto Save : Enable Incremental Save : Disable Roll Back : Enable Config Save IP Address : 0.0.0.0 Config Save Filename : switch.conf Config Restore Filename : switch.conf PIM Mode : Sparse Mode IGS Forwarding Mode : MAC based Cli Serial Console : Yes SNMP EngineID : 80.00.08.1c.04.46.53  The switch will start with the default configurations on reboot. 2.2.8 Copying System Logs into Remote Location Copying System Logs into Remote Location upload the log file to a remote location. Execute the following command to upload the log file to remote location 12.0.0.100. UltOs# copy logs tftp://12.0.0.100/logfile 2.2.8.1 Web Configuration Log transfer can be set through WEB interface using the Log Transfer Settings screen (Navigation - System > Log Transfer)
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 39 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 2-5: Log Transfer 2.2.9 Copying a File from Remote Site/Flash to Remote Site/Flash Copying a configuration file from remote location to flash copies a file from a source remote site /flash to a destination remote site/flash. Execute the following command to copy the file sctipt.txt from remote location 12.0.0.100 to flash. UltOs# copy tftp://12.0.0.100/script.txt flash:script.txt 2.2.9.1 Web Configuration File Transfer can be set through WEB interface using the File Upload screen (Navigation - System > File Transfer > File Upload) Screen 2-6: Log Transfer
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 40 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2.2.10 Configuring the Default VLAN Identifier Configuring the default VLAN identifier results in the VLAN ID to be written to the NVRAM and this will be used as the default VLAN ID when the switch is restarted. 2.2.10.1 CLI Configuration 1. Execute the following commands to configure the default VLAN identifier.  Enter the Global Configuration mode. UltOs# configure terminal  Configure the default VLAN ID as 10. UltOs(config)# default vlan id 10  Exit from the Global Configuration mode. UltOs(config)# end 2. View the default VLAN ID by executing the following command. UltOs# show nvram Default IP Address : 10.0.0.100 Default Subnet Mask : 255.255.0.0 Default IP Address Config Mode : Manual Default IP Address Allocation Protocol : DHCP Switch Base MAC Address : 00:01:02:03:04:01 Default Interface Name : wan0/1 Default RM Interface Name : eth0 Config Restore Option : No restore Config Save Option : No save Auto Save : Enable Incremental Save : Disable Roll Back : Enable Config Save IP Address : 0.0.0.0 Config Save Filename : FDN40.conf Config Restore Filename : FDN40.conf PIM Mode : Sparse Mode IGS Forwarding Mode : MAC based Cli Serial Console : Yes SNMP EngineID : 80.00.08.1c.04.46.53 SNMP Engine Boots : 0 Default VLAN Identifier : 10  Notes:
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 41 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  It is not advisable to change the default VLAN ID when some configurations are already saved.  Once the default VLAN ID is configured, switch has to be restarted before saving any configuration. 2.2.10.2 WEB Configuration Default VLAN Identifier can be configured through WEB interface using the Factory Default Settings screen. For screenshot, refer section 2.2.1.2 2.2.11 Configuring Switch Clock 2.2.11.1 CLI Configuration Configuring the Clock sets the Switch clock time. 1. Execute the following commands to adjust the switch clock. UltOs# clock set 16:00:00 1 jan 2007 2. View the configured clock by executing the following show command. UltOs# show clock Mon Jan 01 16:00:01 2007 2.2.11.2 Web Configuration Switch Clock can be set through WEB interface using the System Information screen. For screenshot, refer 2.2.4.2. 2.2.12 Enabling/Disabling Console CLI through Serial Port 2.2.12.1 CLI Configuration 1. Execute the following command to enable console CLI through serial port. UltOs# cli console 2. View the console CLI status using the following show command. UltOs# show nvram Default IP Address : 12.0.0.1 Default Subnet Mask : 255.0.0.0 Default IP Address Config Mode : Manual Default IP Address Allocation Protocol : DHCP Switch Base MAC Address : 00:01:02:03:04:01 Default Interface Name : wan0/1 Config Restore Option : No restore Config Save Option : No save Auto Save : Enable Incremental Save : Disable
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 42 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Roll Back : Enable Config Save IP Address : 0.0.0.0 Config Save Filename : FDN40.conf Config Restore Filename : FDN40.conf PIM Mode : Sparse Mode IGS Forwarding Mode : MAC based Cli Serial Console : Yes SNMP EngineID : 80.00.08.1c.04.46.53 2.2.12.2 WEB Configuration CLI Console can be configured through WEB interface using the Factory Default Settings screen. For screenshot, refer section 2.2.1.2 2.2.13 Enabling/Disabling HTTP Enabling/Disabling HTTP enables/disables HTTP server in the switch. 1. Execute the following commands to enable HTTP server on the switch.  Enter the Global Configuration mode. UltOs# configure terminal  Enable HTTP server in the switch. UltOs(config)# set ip http enable  Exit from the Global Configuration mode. UltOs(config)# end 2. View the http server status using the following show command. UltOs# show http server status HTTP server status : Enabled HTTP port is : 80 2.2.14 Configuring HTTP Port Number 2.2.14.1 CLI Configuration Configuring the HTTP port number sets the HTTP port number to be used for HTTP packets. 1. Execute the following commands to configure the HTTP Port Number in the switch.  Enter the Global Configuration mode. UltOs# configure terminal  Configure the port number for the HTTP server as 6080. UltOs(config)# ip http port 6080  Exit from the Global Configuration mode.
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 43 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# end 2. View the HTTP port number by executing the following show command. UltOs# show http server status HTTP server status : Enabled HTTP port is : 6080 2.2.14.2 Web Configuration HTTP Port can be configured through WEB interface using the System Information screen. For screenshot, refer 2.2.4.2. 2.2.15 Configuring HTTP Authentication scheme HTTP Authentication scheme is designed using two parameters namely, Operational Authentication scheme and the Configurable Authentication scheme. The Configurable HTTP Authentication scheme can be modified at run time. For the modified Authentication scheme to be effective the value has to be saved in configuration file and the system has to be restarted. The Configurable HTTP Authentication scheme can be set to default or basic or digest. The Operational HTTP Authentication scheme is initialized on start up and cannot be modified at run-time. The Operational Authentication scheme is used to authenticate all the HTTP sessions. During startup, the Operational Authentication scheme is set to the Configurable Authentication scheme. 2.2.15.1 CLI Configuration 1. Execute the following commands to configure the HTTP Authentication scheme as DEFAULT in the switch.  Enter the Global Configuration mode. UltOs# configure terminal  Configure the authentication scheme for the HTTP server as default. UltOs(config)# set http authentication-scheme default  Exit from the Global Configuration mode. UltOs(config)# end  View the HTTP authentication scheme by executing the following show command. UltOs# show http authentication-scheme The Operational HTTP authentication scheme is Digest The Configured HTTP authentication scheme is Default  Save the configuration. UltOs# write startup-config  Restart the exe.  Ensure the MSR restoration is complete.
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 44 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  View the HTTP authentication scheme by executing the following show command. UltOs# show http authentication-scheme The Operational HTTP authentication scheme is Default The Configured HTTP authentication scheme is Default  Restart the web browser and clear the saved session information and cache from the browser. 2. Execute the following commands to configure the HTTP Authentication scheme as BASIC in the switch.  Enter the Global Configuration mode. UltOs# configure terminal  Configure the authentication scheme for the HTTP server as basic. UltOs(config)# set http authentication-scheme basic  Exit from the Global Configuration mode. UltOs(config)# end  View the HTTP authentication scheme by executing the following show command. UltOs# show http authentication-scheme The Operational HTTP authentication scheme is Digest The Configured HTTP authentication scheme is Basic  Save the configuration. UltOs# write startup-config  Restart the exe.  Ensure the MSR restoration is complete.  View the HTTP authentication scheme by executing the following show command. UltOs# show http authentication-scheme The Operational HTTP authentication scheme is Basic The Configured HTTP authentication scheme is Basic  Restart the web browser and clear the saved session information and cache from the browser. 3. Execute the following commands to configure the HTTP Authentication scheme as DIGEST in the switch.  Enter the Global Configuration mode. UltOs# configure terminal  Configure the authentication scheme for the HTTP server as digest. UltOs(config)# set http authentication-scheme digest  Exit from the Global Configuration mode. UltOs(config)# end
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 45 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  View the HTTP authentication scheme by executing the following show command. UltOs# show http authentication-scheme The Operational HTTP authentication scheme is Basic The Configured HTTP authentication scheme is Digest  Save the configuration. UltOs# write startup-config  Restart the exe.  Ensure the MSR restoration is complete.  View the HTTP authentication scheme by executing the following show command. UltOs# show http authentication-scheme The Operational HTTP authentication scheme is Digest The Configured HTTP authentication scheme is Digest  Restart the web browser and clear the saved session information and cache from the browser. 2.2.15.2 WEB Configuration HTTP Authentication Scheme can be configured through WEB interface using the HTTP Configuration screen (Navigation - System > HTTP>HTTP Scalars) Screen 2-7: HTTP Configuration 2.2.16 Enabling/Disabling Trap Generation on an Interface Enabling/Disabling trap generation on an interface enables/disables trap generation either on the physical interface or on the port-channel interface. 2.2.16.1 CLI Configuration 1. Execute the following commands to disable SNMP trap on the interface lan 0/1.  Enter the Global Configuration mode. UltOs# configure terminal  Enter the Interface Configuration mode for lan 0/1. UltOs(config)# interface lan 0/1  Disable trap on the interface.
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 46 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-if)# no snmp trap link-status  Exit from configuration mode. UltOs(config-if)# end 2. View the trap state for the interface lan 0/1 by executing the following show command. UltOs# show interface lan 0/1 Lan0/1 up, line protocol is up (connected) Hardware Address is 00:08:02:03:04:01 MTU 1500 bytes, Full duplex, 100 Mbps, Auto-Negotiation HOL Block Prevention enabled. Input flow-control is on, output flow-control is on Link Up/Down Trap is disabled Reception Counters Octets : 0 Unicast Packets : 0 Discarded Packets : 0 Error Packets : 0 Unknown Protocol : 0 Transmission Counters Octets : 0 Unicast Packets : 0 Discarded Packets : 0 Error Packets : 0  If trap is enabled, then the Switch sends trap messages to the SNMP Manager on specific events such as link up, link down, etc. 2.2.16.2 WEB Configuration Traps can be enabled or disabled on an interface through WEB interface using the Port Basic Settings screen (Navigation - Layer2 Management > Port Manager > Basic Settings)
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 47 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 2-8: Port Basic Settings 2.2.17 Configuring an Interface as Switch Port/ Router Port Configuring an interface as Router Port configures the port as a Layer 3 interface. 2.2.17.1 CLI Configuration 1. Execute the following commands to configure a port as a switch port.  Enter the Global Configuration mode. UltOs# configure terminal  Enter the Interface Configuration mode for lan 0/1. UltOs(config)# interface lan 0/1  Shutdown the interface. UltOs(config-if)# shutdown  Configure the interface as switch port. UltOs(config-if)# switchport  Bring up the interface. UltOs(config-if)# no shutdown  Exit from configuration mode. UltOs(config-if)# end  The specified interface must be shutdown prior to the configuration. "no switchport" configuration is applicable only in WAN ports. 2.2.17.2 Web Configuration Switch Port/ Router Port can be configured through WEB interface using the Port Basic Settings screen. For screenshot, refer 2.2.16.2.
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 48 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2.2.18 Configuring Debug Logging Configuring Debug Logging configures where the debug logs are to be displayed, that is, either on the console or on a file or on the flash memory. 2.2.18.1 CLI Configuration 1. Execute the following commands to modify the logging option of debug traces.  Enter the Global Configuration mode. UltOs# configure terminal  Configure to log the debug traces in to a file. UltOs(config)# debug-logging file  Exit from the Global Configuration mode. UltOs(config)# end 2. View the logging option by executing the following show command. UltOs# show system information Hardware Version : 5.2.3 Firmware Version : 4.0.0.0 Switch Name : FDN40-4 System Contact : info@ulteriustech.com System Location : Ulterius Logging Option : File Logging Login Authentication Mode : Local Config Save Status : Not Initiated Remote Save Status : Not Initiated Config Restore Status : Not Initiated 3. Execute the following commands to view the debug traces logged in the file.  Enable debug trace for any of the module, for example PNAC module. UltOs# debug dot1x all  View debug logs in the file using the following command. UltOs# show debug-logging PNAC: SNMPPROP: Trace Option is set with value: 347 2.2.18.2 Web Configuration Debug logging can be configured through WEB interface using the System Information screen. For screenshot, refer 2.2.4.2.
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 49 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2.2.19 Configuring ACL Filters ACL filters are used to filter packets at the hardware, based on certain filtering criteria configured/programmed in the switch. The switch examines each packet to determine whether it is to be blocked or to be forwarded based on the access lists configured. 2.2.19.1 CLI Configuration The following example shows how to block the ICMP traffic from a host with IP address 12.0.0.100. Refer Figure 2-1 for set up. Port 1 of the switch is connected to the host. Execute the following commands in FDN40-1. IP address of Host 1 is assumed as 12.0.0.100. 1. Configure the IP address of the switch as 12.0.0.1. UltOs# configure terminal UltOs(config)# interface vlan 1 UltOs(config-if)# shutdown UltOs(config-if)# ip address 12.0.0.1 255.0.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# end 2. View the ping between Host 1 and FDN40-1 by executing the following command in FDN40-1. UltOs# ping 12.0.0.100 Reply Received From: 12.0.0.100, TimeTaken: 30 msecs Reply Received From: 12.0.0.100, TimeTaken: 30 msecs Reply Received From: 12.0.0.100, TimeTaken: 30 msecs --- 12.0.0.100 Ping Statistics --- 3 Packets Transmitted, 3 Packets Received, 0% Packets Loss 3. Enter the Global Configuration mode. UltOs# configure terminal 4. Create a filter with ID 1001. UltOs(config)# ip access-list standard 1000  Filter type can be standard. Standard filters are used to filter the traffic based on the source IP address and destination IP address.. IP Access List is supported only on WAN side and not on LAN side. In this example, ICMP packets from 12.0.0.100 need to be filtered. 5. Deny the ICMP traffic from host 12.0.0.100 to any network/host. UltOs(config-ext-nacl)# deny host 12.0.0.100 any priority 2 6. Exit from Global Configuration mode.
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 50 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-ext-nacl)# exit 7. Apply the filter 1000 to port1. UltOs(config)# interface wan 0/1 UltOs(config-if)# ip access-group 1000 in 8. Exit from the Interface Configuration mode. UltOs(config-if)# end 9. View the configuration details by executing the following command. UltOs# sh access-lists IP ACCESS LISTS ----------------- Standard IP Access List 1000 ---------------------------- Filter Priority : 2 IP address Type : IPV4 Source IP address : 12.0.0.100 Source IP address mask : 255.255.255.255 Source IP Prefix Length : 32 Destination IP address : 0.0.0.0 Destination IP address mask : 0.0.0.0 Destination IP Prefix Length : 0 Flow Identifier : 0 In Port List : wan0/1 Out Port List : NIL Filter Action : Deny Filter Creation Mode : External Redirect Port List : NIL TrafficDistField : Unknown Sub Action : NONE Sub Action Id : 0 Status : Active MAC ACCESS LISTS -----------------
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 51 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. No MAC Access Lists have been configured USER DEFINED LISTS ---------------------- No User Defined Lists have been configured 10. View that the ICMP packet from Host 1 is blocked. UltOs# ping 12.0.0.100 Reply Not Received From : 12.0.0.100, Timeout : 5 secs Reply Not Received From : 12.0.0.100, Timeout : 5 secs Reply Not Received From : 12.0.0.100, Timeout : 5 secs --- 12.0.0.100 Ping Statistics --- 3 Packets Transmitted, 0 Packets Received, 100% Packets Loss 2.2.19.2 WEB Configuration 2.2.19.2.1 IP Standard Access List IP Standard ACLs can be configured through WEB interface using the IP Standard ACL Configuration screen (Navigation - System > ACL > IP Standard ACL)
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 52 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 2-9: IP Standard ACL Configuration 2.2.19.2.2 MAC Access List MAC ACLs can be configured through WEB interface using the MAC ACL Configuration screen (Navigation - System > ACL > MAC ACL) Screen 2-10: MAC ACL Configuration
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 53 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2.2.20 Software image upgradation 2.2.20.1 Software image upgrade through CLI 2.2.20.1.1 Upgrade from R1_1_2 image to R1_1_3 The R1_1_3 is the first fully integrated software image that takes care of automatic upgrade of uboot, IPMC, FPGA, SW application images by the trigger of a single integrated image upgrade procedure. 1. Start fdn404_r1_1_2.img as usual and arrive at FDN40 prompt. 2. Upgrade Image through CLI UltOs# firmware upgrade tftp tftp://<server IP>/fdn404_r1_1_3.img flash:normal UltOs# firmware upgrade tftp tftp://<server IP>/fdn404_r1_1_3.img flash:fallback UltOs# reload 3. Image is now upgraded to r1_1_3.img. Since this is first time that an integrated image is applied on filesystem, this process needs to be repeated again once more to ensure permanent marking on the file system. Please note that this is only needed for first time upgrade that we execute below step again. UltOs# firmware upgrade tftp tftp://<server IP>/fdn404_r1_1_3.img flash:normal UltOs# firmware upgrade tftp tftp://<server IP>/fdn404_r1_1_3.img flash:fallback UltOs# reload 4. Now system is ready and upgraded fully to new integrated image and all internal parts like FPGA, IPMC,Uboot and SW application. Please verify if below output is seen to confirm upgrade is successful. 5. fdn404/fdn406 is the suffix used to differentiate between FDN40-4 and FDN40-6 board. Error will be thrown when wrong image is uploaded. Sample: UltOs# show system information Hardware Version : 2.0 Firmware Version : v1.2.29 Hardware Part Number : 1444FDN00007 FPGA Version : 2.1 IPMC Version : 2.2 UBOOT Version : 1.5 Software Serial Number : 1-0-0 Software Version : R1.1.3 Switch Name : FDN40-4
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 54 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. System UpTime : 0 Days 0 Hrs, 50 Mins, 11 Secs System Contact : info@ulteriustech.com System Location : Ulterius Technologies,Kansas, USA Logging Option : Console Logging Login Authentication Mode : Local Config Save Status : Not Initiated Remote Save Status : Not Initiated Config Restore Status : Not Initiated Traffic Separation Control : none LCD Brightness : 30 “show hardware” command is applicable only for FDN40-6 as there is no POE compatible FDN404 device. UltOs# show hardware Line Card Config table ---------------------- SlotId Status Card Name Serial number MFG id MFG date Product Name RevisionNo Mac Address Required power MMCVersion ------ ------ --------- ------------- ------ -------- ------------ ---------- ---------------- ---------- ------------- 2 UP POE 1446FDN00074 BEI 11/25/2014 IOM-POE 2.0 54:DF:00:00:04:58 8 1.4 3 UP POE 1446FDN00041 BEI 11/24/2014 IOM-POE 2.0 54:DF:00:00:04:40 8 1.4 4 UP NONPOE 1446FDN00078 BEI 11/24/2014 IOM-ETH 2.0 54:DF:00:00:00:F0 8 1.4 5 UP NONPOE 1446FDN00077 BEI 11/24/2014 IOM-ETH 2.0 54:DF:00:00:00:E0 8 1.4 6 UP NONPOE 1446FDN00130 BEI 11/24/2014 IOM-ETH 2.0 54:DF:00:00:00:E8 8 1.4
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 55 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2.2.20.1.2 Upgrade from R1_1_3 image to > R1_1_3 The R1_1_3 is the first fully integrated software image that takes care of automatic upgrade of uboot, IPMC,FPGA, SW application images by the trigger of a single integrated image upgrade procedure. 1. Start fdn404_r1_1_3.img as usual and arrive at UltOs prompt. 2. Insert all needed IOM cards in all slots in order to ensure IPMC of IOM cards are also upgraded as part of integrated image upgrade. 3. Upgrade Image through CLI UltOs# firmware upgrade tftp tftp://<server IP>/fdn404_r1_1_4.img flash:normal UltOs# firmware upgrade tftp tftp://<server IP>/fdn404_r1_1_4.img flash:fallback UltOs# reload 4. Now system is ready and upgraded fully to new integrated image and all internal parts like FPGA, IPMC, Uboot and SW application. 2.2.20.2 Software image upgrade through WEB 1. Start existing fdn404_rxxxx.img on board as usual and arrive at FDN40 prompt. 2. Upgrade active image through GUI on active partition  Choose option Home->System->Image Download option.  Choose upgrade type as TFTP, address type as IPv4 and configure tftp Server IP Address, image File Name and upgrade mode as Normal for flashing image to normal partition and click apply. Once image is downloaded, we should see the notification as “Image Download Successful”  Connect to the CLI prompt to restart system for new image to boot up UltOs#reload  New image should now be loaded from active partition.
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 56 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 2-11: Image Upgradation using normal 3 Now software is ready for use. 4 Upgrade standby image through GUI on standby partition  Choose option Home->System->Image Download option.  Choose upgrade type as TFTP, address type as IPv4 and configure tftp Server IP Address, image File Name and upgrade mode as Fall Back for flashing image to standby partition and click apply. Once image is downloaded, we should see the notification as “Image Download Successful”  Connect to the CLI prompt and type below command to restart system for new image to get flashed to standby partition. This image would normally boot up only when active image fails to get loaded successfully. UltOs# reload
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 57 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 2-12: Image Upgradation using FallBack 5 Now software is ready for use. 2.2.21 Setting default OOB IP for system (first time in a new board) 2.2.21.1 CLI Configuration The R1_1_3 is the first fully integrated software image that boots with default OOB IP as 10.10.10.1. This can be changed later to user defined OOB IP using below steps. 1. Assign IP to OOB Interface UltOs# conf t UltOs(config)# int oob UltOs(config)# ip address <new IP> <Netmask> UltOs(config)# no shut UltOs(config)# exit UltOs# write startup-config Above step saves new IP in NVRAM and for further reboots, configured IP is reflected from NVRAM. 2. Reset OOB IP to factory default UltOs# erase startup-config UltOs# erase nvram: UltOs# reload Above step restores OOB IP to factory default 10.10.10.1 after reload is successful. If user wants to change OOB IP, step 1 has to be executed.
CHAPTER 2: SYSTEM FEATURES Configuration User Manual 58 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2.2.21.2 WEB Configuration Default OOB IP for the system can be configured through WEB interface using the Factory Default Settings screen.(Navigation – System > NVRAM Settings) For screenshot, refer section 2.2.1.2. Erase startup-config and Erase nvram can be done using the Erase Configuration Screen.(Navigation – System > QoS > Save and Restore) Screen 2-13: IP Erase configuration
Configuration User Manual 59 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 3 DHCP Server 3.1 Protocol Description DHCP server maintains a configured set of IP address pools from which IP addresses are allocated to the DHCP clients, whenever they request the Server dynamically. Once the IP address is allocated, the Server will keep this IP as reserved until the lease time for that IP expires. If the client does not renew the IP before the lease time expiry, this will be returned into the free pool and will be offered to new clients. 3.2 Topology Figure 3-1: DHCP - Topology 1 3.3 Configuration Guidelines Refer to the CLI Configuration Guide for the complete set of commands and the various options available for configuring DHCP. The following are the configuration guidelines: DHCP Client 12.0.0.1 FDN40-1 (DHCP SERVER) DHCP CLIENT 1 1
CHAPTER 3: DHCP SERVER Configuration User Manual 60 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  If the router interface was not assigned an IP address by the DHCP server, the renew DHCP command fails and displays the following error message: Interface does not have a DHCP originated address DHCP Server  DHCP Relay must be disabled before enabling the DHCP server.  The DHCP server assumes that all pool addresses may be assigned to clients. 3.4 Default Configurations Table 3-1: Default Configurations Feature Default Setting DHCP server status Disabled ICMP echo Disabled Offer reuse time out 5 seconds DHCP next server address 0.0.0.0 (none) Boot file name None DHCP server pool lease time 3600 seconds DHCP server pool utilization threshold 75% DHCP server debug level None DHCP relay status Disabled DHCP relay server address 0.0.0.0 (none) RAI option Disabled DHCP relay debug level None DHCP client debug level None 3.5 DHCP Configurations 3.5.1 Enabling DHCP server Refer Figure 3-1 for Topology Setup. DHCP server is disabled by default. 3.5.1.1 CLI Configuration 1. Execute the following commands in FDN40-1.  Enter the Global Configuration mode. UltOs# configure terminal  Enable DHCP server. UltOs(config)# service dhcp-server  Exit from the Global configuration mode. UltOs(config)# end
CHAPTER 3: DHCP SERVER Configuration User Manual 61 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2. View the DHCP server status using the following command. UltOs# show ip dhcp server information The output in FDN40-1 is DHCP server status : Enable Send Ping Packets : Disable Debug level : None Server Address Reuse Timeout : 5 secs Next Server Address : 0.0.0.0 Boot file name : None 3.5.1.2 WEB Configuration DHCP Server can be enabled / disabled through WEB interface using the DHCP Basic Settings screen (Navigation - Layer3Management > DHCP Server > Basic Settings) Screen 3-1: DHCP Basic Settings 3.5.2 Configuring Offer Reuse Time Out Refer Figure 3-1 for setup. Offer Reuse Timeout is the maximum time frame after which an offered IP can be returned to the free address pool. This can be configured in the range of 1-120 seconds. 3.5.2.1 CLI Configuration 1. Execute the following commands in FDN40-1.  Enter the Global Configuration mode. UltOs# configure terminal  Configure offer reuse time out as 10 seconds UltOs(config)# ip dhcp server offer-reuse 10  Exit from the Global configuration mode UltOs(config)# end 2. View the offer reuse time out configured in FDN40-1.
CHAPTER 3: DHCP SERVER Configuration User Manual 62 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# show ip dhcp server information DHCP server status : Enable Send Ping Packets : Enable Debug level : None Server Address Reuse Timeout : 10 secs Next Server Address : 0.0.0.0 Boot file name : None 3.5.2.2 WEB Configuration Offer Re-use Timeout can be configured through WEB interface using the DHCP Basic Settings screen. Refer section 3.5.1.2 3.5.3 Configuring DHCP Address Pools Refer Figure 3-1 for Topology Setup. Address pools are used by the servers to allocate the IP addresses to the client. This command specifies the IP addresses that are available in the server to configure the clients. 3.5.3.1 Creating a DHCP Address Pool 1. Execute the following commands in FDN40-1.  Enter the Global Configuration mode. UltOs# configure terminal  Create pool 1 and enter the DHCP pool configuration mode. UltOs(config)# ip dhcp pool 1  Configure the network as 12.0.0.0 and mask as 255.0.0.0. UltOs(dhcp-config)# network 12.0.0.0 255.0.0.0  Exit from the DHCP Pool configuration mode. UltOs(dhcp-config)# end 2. View the DHCP server pools available using the following command. UltOs# show ip dhcp server pools The output in FDN40-1 is Pool Id : 1 ------------------------------------------- Subnet : 12.0.0.0 Subnet Mask : 255.0.0.0 Lease time : 3600 secs Utilization threshold : 75% Start Ip : 12.0.0.1 End Ip : 12.255.255.255
CHAPTER 3: DHCP SERVER Configuration User Manual 63 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 3.5.3.2 Configuring End IP for the Pool Refer Figure 3-1 for Topology Setup. End IP is used to specify the upper limit for IP addresses in an address pool. 1. Execute the following command in FDN40-1.  Enter the Global Configuration mode. UltOs# configure terminal  Create pool 1 and enter into DHCP Pool configuration mode. UltOs(config)# ip dhcp pool 1  Configure the network as 12.0.0.0, mask 255.0.0.0 and end IP 12.0.0.100. UltOs(dhcp-config)# network 12.0.0.0 255.0.0.0 12.0.0.100  Exit from the DHCP Pool configuration mode. UltOs(dhcp-config)# end 2. View the end IP for the pools using the following command. UltOs# show ip dhcp server pools The output in FDN40-1 is Pool Id : 1 ------------------------------------- Subnet : 12.0.0.0 Subnet Mask : 255.0.0.0 Lease time : 3600 secs Utilization threshold : 75% Start Ip : 12.0.0.1 End Ip : 12.0.0.100 3.5.3.3 Configuring Lease Time Refer Figure 3-1 for Topology Setup. Lease time specifies the amount of time that the client can use the IP address assigned by the server. This parameter is specific to each IP address pool. Hence, every IP address allocated from a pool will be returned to the pool, if the client does not renew it. 1. Execute the following commands in FDN40-1.  Enter the Global Configuration mode. UltOs# configure terminal  Create pool 1 and enter into DHCP Pool configuration mode. UltOs(config)# ip dhcp pool 1  Configure the lease time as 1 day 2 hours and 30 minutes. UltOs(dhcp-config)# lease 1 2 30  Exit from the DHCP Pool configuration mode. UltOs(dhcp-config)# end 2. View the lease time of pools using the following command.
CHAPTER 3: DHCP SERVER Configuration User Manual 64 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# show ip dhcp server pools The output in FDN40-1 is Pool Id : 1 ------------------------------------------- Subnet : 12.0.0.0 Subnet Mask : 255.0.0.0 Lease time : 95400 secs Utilization threshold : 75% Start Ip : 12.0.0.1 End Ip : 12.0.0.100  DHCP server will return the allocated IP address to the free address pool, if the client does not renew the IP before the lease time expiry interval. 3.5.3.4 Configuring Utilization Threshold Refer Figure 3-1 for Topology setup. This specifies the upper limit (in percentage) for the address pool utilization, after which a notification will be sent to SNMP manager and an event will be logged into SYSLOG to indicate the possible exhaust of the pool. Range of possible values is 0-100 percentage. 1. Execute the following commands in FDN40-1 to configure Utilization threshold.  Enter the Global Configuration mode. UltOs# configure terminal  Create pool 1 and enter into DHCP pool configuration mode. UltOs(config)# ip dhcp pool 1  Configure the utilization threshold as 50%. UltOs(dhcp-config)# utilization threshold 50  Exit from the DHCP Pool configuration mode. UltOs(dhcp-config)# end 2. View the utilization threshold of the pools using the following command. UltOs# show ip dhcp server pools The output in FDN40-1 is Pool Id : 1 ------------------------------------------- Subnet : 12.0.0.0 Subnet Mask : 255.0.0.0 Lease time : 95400 secs Utilization threshold : 50% Start Ip : 12.0.0.1 End Ip : 12.0.0.100
CHAPTER 3: DHCP SERVER Configuration User Manual 65 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  If the number of IP addresses allocated from the pool is above the utilization threshold percentage, the server will log an event in SYSLOG and will send a SNMP trap message to the SNMP manager.  Refer SNMPv3 configuration user manual to configure SNMP manager for the Switch, so that the trap message will be sent appropriately. 3.5.3.5 WEB Configuration for DHCP Address Pool DHCP Address Pool can be configured through WEB interface using the DHCP Pool Settings screen (Navigation - Layer3Management > DHCP Server > Pool Settings) Screen 3-2: DHCP Pool Settings 3.5.4 Creating an Excluded Address in the Pool Refer Figure 3-1 for Topology Setup. Excluded address pool specifies a range of IP addresses that cannot be allocated for the client. 3.5.4.1 CLI Configuration 1. Execute the following commands in FDN40-1.  Enter the Global Configuration mode. UltOs# configure terminal  Create pool 1 and enter into DHCP pool configuration mode. UltOs(config)# ip dhcp pool 1  Configure the excluded address pool from 12.0.0.6 to 12.0.0.8 UltOs(dhcp-config)# excluded-address 12.0.0.6 12.0.0.8  Exit from the DHCP Pool configuration mode. UltOs(dhcp-config)# end 2. View the excluded address pools using the following command. UltOs# show ip dhcp server pools The output in FDN40-1 is
CHAPTER 3: DHCP SERVER Configuration User Manual 66 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Pool Id : 1 ------------------------------------------- Subnet : 12.0.0.0 Subnet Mask : 255.0.0.0 Lease time : 95400 secs Utilization threshold : 50% Start Ip : 12.0.0.1 End Ip : 12.0.0.100 Exclude Address Start IP : 12.0.0.6 Exclude Address End IP : 12.0.0.8 3.5.4.2 WEB Configuration Excluded Address can be configured through WEB interface using the DHCP Server IP Exclude Settings screen (Navigation - Layer3 Management > DHCP Server > Exclude List) Screen 3-3: DHCP Server IP Exclude Setings 3.5.5 Configuring DHCP Pool Options 3.5.5.1 Configuring a Domain Name Option Refer Figure 3-1 for Topology Setup. This is a pool specific option and will be offered to the clients in the pool as a configuration parameter. 1. Execute the following commands in FDN40-1 to configure a domain name option.  Enter the Global Configuration mode. UltOs# configure terminal  Create pool 1 and enter into the DHCP Pool Configuration mode. UltOs(config)# ip dhcp pool 1  Configure the domain name for this network as “future”.
CHAPTER 3: DHCP SERVER Configuration User Manual 67 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(dhcp-config)# domain-name future  Exit from the DHCP Pool configuration mode. UltOs(dhcp-config)# end 2. View the domain name option configured using the following command. UltOs# show ip dhcp server pools The output in FDN40-1 is Pool Id : 1 --------------------------------------------------- Subnet : 12.0.0.0 Subnet Mask : 255.0.0.0 Lease time : 95400 secs Utilization threshold : 50% Start Ip : 12.0.0.1 End Ip : 12.0.0.100 Exclude Address Start IP : 12.0.0.1 Exclude Address End IP : 12.0.0.10 Subnet Options -------------- Code : 15, Value : future  This option will be offered to the DHCP clients only when there is no Host specific option for the client. If this option is not configured and there is no Host option too, then the global option will be preferred. 3.5.5.2 Configuring DNS Option with Single IP Address Refer Figure 3-1 for Topology Setup. This is a pool specific option and will be offered to the DHCP client as a configuration parameter. 1. Execute the following commands in FDN40-1 to configure DNS option.  Enter the Global Configuration mode. UltOs# configure terminal  Create pool 1 and enter to DHCP pool configuration mode. UltOs(config)# ip dhcp pool 1  Configure the DNS IP address as 12.0.0.6. UltOs(dhcp-config)# dns-server 12.0.0.6  Exit from the DHCP Pool configuration mode. UltOs(dhcp-config)# end 2. View the domain name option configured using the following command. UltOs# show ip dhcp server pools The output in FDN40-1 is Pool Id : 1
CHAPTER 3: DHCP SERVER Configuration User Manual 68 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. ----------------------------------- Subnet : 12.0.0.0 Subnet Mask : 255.0.0.0 Lease time : 95400 secs Utilization threshold : 50% Start Ip : 12.0.0.1 End Ip : 12.0.0.100 Exclude Address Start IP : 12.0.0.1 Exclude Address End IP : 12.0.0.10 Subnet Options -------------- Code : 6, Value : 12.0.0.6 Code : 15, Value : future  Notes:  This option will be offered to the DHCP client only when there is no Host specific option for the client.  If this option is not configured and there is no Host option too, then the global option will be preferred. 3.5.5.3 Configuring NTP Option with Two IP Addresses Refer Figure 3-1 for Topology Setup. This is a pool specific option and will be offered to the DHCP client as a configuration parameter. 1. Execute the following commands in FDN40-1 to configure NTP option.  Enter the Global Configuration mode. UltOs# configure terminal  Create pool 1 and enter DHCP pool configuration mode. UltOs(config)# ip dhcp pool 1  Configure the two NTP IP addresses as 12.0.0.6 and 15.0.0.5. UltOs(dhcp-config)# ntp-server 12.0.0.6 15.0.0.5.  Exit from the DHCP Pool configuration mode. UltOs(dhcp-config)# end 2. View the configured ntp server option using the following command. UltOs# show ip dhcp server pools The output in FDN40-1 is Pool Id : 1 ----------------------------------- Subnet : 12.0.0.0 Subnet Mask : 255.0.0.0 Lease time : 95400 secs
CHAPTER 3: DHCP SERVER Configuration User Manual 69 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Utilization threshold : 50% Start Ip : 12.0.0.1 End Ip : 12.0.0.100 Exclude Address Start IP : 12.0.0.1 Exclude Address End IP : 12.0.0.10 Subnet Options -------------- Code : 42, Value : 12.0.0.6 15.0.0.5  Notes:  This option will be offered to the DHCP client only when there is no Host specific option for the client.  If this option is not configured and there is no Host option too, then the global option will be preferred. 3.5.5.4 Configuring Default Router Refer Figure 3-1 for Topology Setup. This is a pool specific option and will be offered to the clients as a configuration parameter. 1. Execute the following commands in FDN40-1.  Enter the Global Configuration mode. UltOs# configure terminal  Create pool 1 and enter into DHCP pool configuration mode. UltOs(config)# ip dhcp pool 1  Configure the default router for this pool as 12.0.0.3. UltOs(dhcp-config)# default-router 12.0.0.3  Exit from the DHCP Pool configuration mode. UltOs(dhcp-config)# end 2. View the default router configured using the following command. UltOs# show ip dhcp server pools The output in FDN40-1 is Pool Id : 1 -------------------------------------- Subnet : 12.0.0.0 Subnet Mask : 255.0.0.0 Lease time : 95400 secs Utilization threshold : 50% Start Ip : 12.0.0.1 End Ip : 12.0.0.100 Exclude Address Start IP : 12.0.0.1 Exclude Address End IP : 12.0.0.10
CHAPTER 3: DHCP SERVER Configuration User Manual 70 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Subnet Options -------------- Code : 3, Value : 12.0.0.3 Code : 6, Value : 12.0.0.6 Code : 15, Value : future Code : 46, Value : 1  This option will be offered to the DHCP clients only when there is no Host specific option for the client. If this option is not configured and there is no Host option too, then the global option will be preferred. 3.5.5.5 Configuring Options Specific to Address Pools Refer Figure 3-1 for Topology Setup. Apart from the options in the previous sections, options can be specified using the option codes specified in RFC 2132. These options will be offered to the clients as a configuration parameter. 1. Execute the following commands in FDN40-1.  Enter the Global Configuration mode. UltOs# configure terminal  Create pool 1 and enter into DHCP pool configuration mode. UltOs(config)# ip dhcp pool 1  Configure the option 1 (Subnet mask option) as 255.255.0.0. UltOs(dhcp-config)# option 1 ip 255.255.0.0  Exit from the DHCP Pool configuration mode. UltOs(dhcp-config)# end 2. View the options configured in the Switch using the following commands. UltOs# show ip dhcp server pools The output in FDN40-1 is Pool Id : 1 ---------------------------------- Subnet : 12.0.0.0 Subnet Mask : 255.0.0.0 Lease time : 95400 secs Utilization threshold : 50% Start Ip : 12.0.0.1 End Ip : 12.0.0.100 Exclude Address Start IP : 12.0.0.1 Exclude Address End IP : 12.0.0.10 Subnet Options --------------
CHAPTER 3: DHCP SERVER Configuration User Manual 71 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Code : 1, Value : 255.255.0.0 Code : 3, Value : 12.0.0.3 Code : 6, Value : 12.0.0.6 Code : 15, Value : future Code : 46, Value : 1  This option will be offered to the DHCP clients only when there is no Host specific option for the client. If this option is not configured and there is no Host option too, then the global option will be preferred.  Refer RFC 2132 to get the complete list of DHCP options and their corresponding codes. 3.5.5.6 WEB Configuration for DHCP Pool Options DHCP Pool options can be configured through WEB interface using the DHCP Pool Options Settings screen (Navigation - Layer3 Management >DHCP Server > Pool Options) Screen 3-4: DHCP Pool Options Settings 3.5.6 Configuring Host Specific Options Refer Figure 3-1 for Topology Setup. Apart from the global options and subnet options, options can be specified for Hosts. This configuration will be used for the specific hosts as a configuration parameter. 3.5.6.1 CLI Configuration 1. Execute the following commands in FDN40-1.  Enter the Global Configuration mode.
CHAPTER 3: DHCP SERVER Configuration User Manual 72 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# configure terminal  Create pool 1 and enter into the DHCP pool configuration mode. UltOs(config)# ip dhcp pool 1  Configure the option 1 (subnet mask) as 255.255.255.0 for the client with MAC address 00:11:22:33:44:55. UltOs(dhcp-config)# host hardware-type 1 client-identifier 00:11:22:33:44:55 option 1 ip 255.255.255.0  Exit from the DHCP Pool configuration mode. UltOs(dhcp-config)# end 2. View the options configured in the switch using the following command. UltOs# show ip dhcp server pools The output in FDN40-1 is Pool Id : 1 ------------------------------------------- Subnet : 12.0.0.0 Subnet Mask : 255.0.0.0 Lease time : 3600 secs Utilization threshold : 75% Start Ip : 12.0.0.1 End Ip : 12.255.255.255 Host Options ------------ Hardware type : 1 Client Identifier : 00:11:22:33:44:55 Code : 1, Value : 255.255.255.0  This option will be offered to the DHCP clients with hardware address 00:11:22:33:44:55 even if there is pool specific option or global option with this option code.  Refer RFC 2132 to get the complete list of DHCP options and their corresponding codes.
Configuration User Manual 73 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 4 RIP 4.1 Protocol Description RIP (Routing Information Protocol) is a widely-used protocol for managing router information within a self-contained network such as a corporate local area network or an interconnected group of such LANs. RIP is classified by the Internet Engineering Task Force (IETF) as one of several internal gateway protocols (Interior Gateway Protocol). RIP sends routing-update messages at regular intervals and when the network topology changes. When a Router receives a routing update that includes changes to an entry, it updates its routing table to reflect the new route. The metric value for the path is increased by 1, and the sender is indicated as the next hop. RIP routers maintain only the best route (the route with the lowest metric value) to a destination. After updating its routing table, the router immediately begins transmitting routing updates to inform other network routers of the change. These updates are sent independently of the regularly scheduled updates that RIP routers send. RIP uses a hop count as a way to determine network distance. The RIP basic and advanced configuration tasks are described in the following section(s)
CHAPTER 4: RIP Configuration User Manual 74 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 4.2 Topology Figure 4-1: RIP Topology 1 Figure 4-2: RIP Topology 2 4.3 Configuration Guidelines The following configuration needs to be done in all the switches, FDN40-1 and FDN40-2. This is a prerequisite for configuring the RIP. 4.3.1 Configuration in FDN40-1 Refer Figure 4-1 for Setup. Prerequisite: Configuration of VLAN Interfaces (vlan1 and vlan2) UltOs# configure terminal UltOs(config)# interface vlan 1 UltOs(config-if)# shutdown UltOs(config-if)# ip address 10.0.0.1 255.255.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 1 UltOs(config-vlan)# ports lan 0/1 untagged lan 0/1 FDN40-1 FDN40-2 FDN40-2 FDN40-1 FDN40-3
CHAPTER 4: RIP Configuration User Manual 75 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-vlan)# exit UltOs(config)# interface vlan 2 UltOs(config-if)# shutdown UltOs(config-if)# ip address 20.0.0.1 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 2 UltOs(config-vlan)# ports lan 0/2 untagged lan 0/2 UltOs(config-vlan)# exit UltOs(config)# interface lan 0/2 UltOs(config-if)# switchport pvid 2 UltOs(config-if)# no shutdown UltOs(config-if)# exit 4.3.2 Configuration in FDN40-2 Refer Figure 4-1 for Setup. Prerequisite: Configuration of VLAN Interfaces (vlan1 and vlan3 ) UltOs# configure terminal UltOs(config)# interface vlan 1 UltOs(config-if)# shutdown UltOs(config-if)# ip address 10.0.0.2 255.255.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 1 UltOs(config-vlan)# ports lan 0/1 untagged lan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 3 UltOs(config-if)# shutdown UltOs(config-if)# ip address 30.2.2.2 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 3 UltOs(config-vlan)# ports lan 0/3 untagged lan 0/3 UltOs(config-vlan)# exit UltOs(config)# interface lan 0/3 UltOs(config-if)# switchport pvid 3 UltOs(config-if)# no shutdown
CHAPTER 4: RIP Configuration User Manual 76 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-if)# exit 4.3.3 Configuration in FDN40-3 Refer Figure 4-2 for Setup. Prerequisite: Configuration of VLAN Interfaces (vlan1 and vlan4) UltOs# configure terminal UltOs(config)# interface vlan 1 UltOs(config-if)# shutdown UltOs(config-if)# ip address 10.0.0.3 255.255.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 1 UltOs(config-vlan)# ports lan 0/1 untagged lan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 4 UltOs(config-if)# shutdown UltOs(config-if)# ip address 40.2.2.2 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 4 UltOs(config-vlan)# ports lan 0/4 untagged lan 0/4 UltOs(config-vlan)# exit UltOs(config)# interface lan 0/4 UltOs(config-if)# switchport pvid 4 UltOs(config-if)# no shutdown UltOs(config-if)# exit 4.4 Default Configurations None 4.5 RIP Configurations 4.5.1 Enabling and Disabling RIP 4.5.1.1 Enabling RIP Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40- 2) before configuring RIP. RIP is disabled by default.
CHAPTER 4: RIP Configuration User Manual 77 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 1. Execute the following commands in the Switch FDN40-1 to enable RIP.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Exit from the router configuration mode. UltOs(config-router)# exit 4.5.1.2 Disabling RIP Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 1. Execute the following commands in the switch FDN40-1 to disable RIP.  Enter the Global Configuration mode. UltOs# configure terminal  Disable RIP globally in the switch FDN40-1. UltOs(config)# no router rip  Exit from the Global configuration mode. UltOs(config)# exit 4.5.1.3 WEB Configuration RIP can be enabled/ disabled through WEB interface using the RIP VRF Creation screen (Navigation - Layer3 Management > RIP>RIP VRF Creation) Screen 4-1: RIP VRF Creation 4.5.2 Enabling RIP on an IP Network Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP.
CHAPTER 4: RIP Configuration User Manual 78 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 4.5.2.1 CLI Configuration 1. Execute the following commands in the switch FDN40-1.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Exit from the router configuration mode. UltOs(config-router)# exit 2. View the RIP interface using the following command. UltOs# show ip rip statistics RIP Global Statistics: ---------------------- Total number of route changes is 0 Total number of queries responded is 0 Total number of periodic updates sent is 11 Total number of dropped packets is 0 RIP Interface Statistics: ------------------------- Interface Periodic BadRoutes Triggered BadPackets Admin IP Address Updates Sent Received Updates Sent Received Status ----------- ------------ --------- ------------ ---------- ------ 10.0.0.1 11 0 0 0 Enabled 3. View the RIP route UltOs# show ip rip database 10.0.0.0/8[1] summary route 10.0.0.0/16 directly connected, vlan1  RIP can be enabled on Pseudo wire interface similar to RIP on router port. 4.5.2.2 WEB Configuration RIP can be enabled/ disabled on an IP network through WEB interface using the RIP Interface screen (Navigation - Layer3 Management > RIP > Interface Configuration)
CHAPTER 4: RIP Configuration User Manual 79 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 4-2: RIP Interface 4.5.3 Configuring RIP Security Refer the section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. For enabling authentication, refer section 4.5.13.2. 4.5.3.1 CLI Configuration Execute the following commands in the switch FDN40-1 to enable RIP security. 1. Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Enable RIP security. UltOs(config-router)# ip rip security minimum  Exit from the router configuration mode. UltOs(config-router)# exit 2. Execute the following commands in the switch FDN40-1 to disable RIP security.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Disable RIP security. UltOs(config-router)# no ip rip security  Exit from the router configuration mode. UltOs(config-router)# exit
CHAPTER 4: RIP Configuration User Manual 80 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 4.5.3.2 WEB Configuration RIP security can be set to maximum or minimum through WEB interface using the RIP Basic Settings screen (Navigation - Layer3 Management > RIP > Basic Settings) Screen 4-3: RIP Basic Settings 4.5.4 Configuring RIP Packets Retransmission Interval and Retries Count Refer the section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 4.5.4.1 CLI Configuration 1. Execute the following commands in the switch FDN40-1 to configure the RIP packets retransmission interval and retries count.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Configure the retransmission interval. UltOs(config-router)# ip rip retransmission interval 10  Configure the retransmission retry count. UltOs(config-router)# ip rip retransmission retries 20 2. View the configured retransmission interval and the number of retries count using the following command. UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip Output Delay is disabled Retransmission timeout interval is 10 seconds Number of retransmission retries is 20
CHAPTER 4: RIP Configuration User Manual 81 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Default metric is 3 Auto-Summarisation of routes is enabled Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 30 seconds Invalid after 180 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 2 Authentication type is none Split Horizon with poissoned reverse is enabled Restricts default route installation Restricts default route origination  Configure the default retransmission interval. UltOs(config-router)# no ip rip retransmission interval  Configure the default retransmission retry count. UltOs(config-router)# no ip rip retransmission retries  Exit from the router configuration mode. UltOs(config-router)# exit 3. View the default retransmission interval and number of retries count using the following command. UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip Output Delay is disabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36 Default metric is 3 Auto-Summarisation of routes is enabled Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specifi Address Summarisation : Interface vlan1 Sending updates every 30 seconds
CHAPTER 4: RIP Configuration User Manual 82 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Invalid after 180 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 2 Authentication type is none Split Horizon with poissoned reverse is enabled Restrcts default route installation Restricts default route origination 4.5.4.2 WEB Configuration RIP retransmission interval and maximum retries count can be configured through WEB interface using the RIP Basic Settings screen. For screenshot, refer section 4.5.3.2. 4.5.5 Configuring RIP Neighbor Refer the Section 4.3 for configuration guidelines and Figure 4-2 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1, FDN40-2 and FDN40-3 ) before configuring RIP. 4.5.5.1 CLI Configuration Execute the following commands in the switch FDN40-1 to configure the RIP neighbor.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16) UltOs(config-router)# network 10.0.0.1  Configure the RIP trusted neighbor. UltOs(config-router)# neighbor 10.0.0.2 In FDN40-1, you can view only the routes that are sent as RIP updates from the neighbor router FDN40-2 (10.0.0.2) .  Delete the configured RIP neighbor. UltOs(config-router)# no neighbor 10.0.0.2 In FDN40-1, you can view the routes that are sent as RIP updates from both the neighbor routers FDN40-2 (10.0.0.2) and FDN40-3.(10.0.0.3).  Exit from the router configuration mode. UltOs(config-router)# exit
CHAPTER 4: RIP Configuration User Manual 83 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 4.5.5.2 WEB Configuration RIP Neighbor can be set to configured through WEB interface using the RIP Neighbour List screen (Navigation - Layer3 Management > RIP > Neighbors List) Screen 4-4: RIP Neighbour List 4.5.6 Configuring RIP Passive Interface Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 4.5.6.1 CLI Configuration 1. Execute the following commands in the switch FDN40-1 to configure RIP passive interface.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16) UltOs(config-router)# network 10.0.0.1  Configure the passive interface. UltOs(config-router)# passive-interface vlan 1  Exit from the router configuration mode. UltOs(config-router)# exit 2. View the passive interface configuration information using the following command. UltOs# show ip rip statistics RIP Global Statistics: ----------------------
CHAPTER 4: RIP Configuration User Manual 84 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Total number of route changes is 0 Total number of queries responded is 0 Total number of periodic updates sent is 0 Total number of dropped packets is 0 RIP Interface Statistics: ------------------------- Interface Periodic BadRoutes Triggered BadPackets Admin IP Address Updates Sent Received Updates Sent Received Status ----------- ------------ --------- ------------ ---------- ------ 10.0.0.1 0 0 0 0 Passive  View that no routing updates are sent over the passive interface vlan1 3. Execute the following commands in the switch FDN40-1 to disable RIP passive interface status.  Enter Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Disable the passive interface status. UltOs(config-router)# no passive-interface vlan 1  Exit from the router configuration mode. UltOs(config-router)# exit 4. View the RIP interface for the periodic updates sent over it using the following command. UltOs# show ip rip statistics RIP Global Statistics: ---------------------- Total number of route changes is 0 Total number of queries responded is 0 Total number of periodic updates sent is 1 Total number of dropped packets is 0 RIP Interface Statistics: ------------------------- Interface Periodic BadRoutes Triggered BadPackets Admin
CHAPTER 4: RIP Configuration User Manual 85 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. IP Address Updates Sent Received Updates Sent Received Status ----------- ------------ --------- ------------ ---------- ------ 10.0.0.1 1 0 0 0 Enabled 4.5.6.2 WEB Configuration RIP Interface can be configured as passive using the Status field in the RIP Interface screen (Navigation - Layer3 Management > RIP > Interface Configuration) Screen 4-5: RIP Interface - Passive 4.5.7 Configuring Output-delay Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 4.5.7.1 CLI Configuration 1. Execute the following commands in the switch FDN40-1 to enable the interpacket delay.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Enable the interpacket delay for RIP updates UltOs(config-router)# output-delay  Exit from the router configuration mode. UltOs(config-router)# end 2. View the enabled Output-delay using the following command. UltOs# show ip protocols Routing Protocol is rip
CHAPTER 4: RIP Configuration User Manual 86 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. RIP2 security level is Maximum Redistributing : rip Output Delay is Enabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36 Default metric is 3 Auto-Summarisation of routes is enabled Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 30 seconds Invalid after 180 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 2 Authentication type is none Split Horizon with poissoned reverse is enabled Restricts default route installation Restricts default route origination 3. Execute the following commands in the switch FDN40-1 to disable the interpacket delay.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Disable interpacket delay for RIP updates. UltOs(config-router)# no output-delay  Exit from the router configuration mode. UltOs(config-router)# end 4. View the disabled Output-delay using the following command. UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip Output Delay is disabled Retransmission timeout interval is 5 seconds
CHAPTER 4: RIP Configuration User Manual 87 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Number of retransmission retries is 36 Default metric is 3 Auto-Summarisation of routes is enabled Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 30 seconds Invalid after 180 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 2 Authentication type is none Split Horizon with poissoned reverse is enabled Restricts default route installation Restricts default route origination 4.5.7.2 WEB Configuration Output Delay can be configured through WEB interface using the RIP Basic Settings screen. For screenshot, refer section 4.5.3.2 4.5.8 Configuring Redistribution Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 4.5.8.1 CLI Configuration Execute the following commands in the switch FDN40-1 to configure redistribution.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Configure the redistribution of static routes into RIP domain. UltOs(config-router)# redistribute static  Exit from the router configuration mode. UltOs(config-router)# end
CHAPTER 4: RIP Configuration User Manual 88 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 4.5.8.2 WEB Configuration RIP Redistribution can be configured through WEB interface using the RRD RIP Configuration screen (Navigation - Layer3 Management > RRD > RIP) Screen 4-6: RRD RIP Configuration 4.5.8.3 Sample Configuration to Test Redistribution Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 1. Execute the following commands in the switch FDN40-1 to test redistribution.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16) UltOs(config-router)# network 10.0.0.1  Configure redistribution of static routes in the RIP domain UltOs(config-router)# redistribute static UltOs(config-router)# exit  Add static routes UltOs(config)# ip route 50.0.0.0 255.0.0.0 vlan 2
CHAPTER 4: RIP Configuration User Manual 89 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# ip route 60.0.0.0 255.0.0.0 vlan 2 UltOs(config)# ip route 70.0.0.0 255.0.0.0 vlan 2 UltOs(config)# ip route 80.0.0.0 255.0.0.0 vlan 2 UltOs(config)# end 2. Execute the following commands in the switch FDN40-2 to test redistribution.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-2. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.2/16) UltOs(config-router)# network 10.0.0.2 UltOs# config terminal UltOs(config)# router rip UltOs(config-router)# network 10.0.0.2 UltOs(config-router)# end 3. View the redistribution of static routes enabled using the following command. UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip, static Output Delay is disabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36 Default metric is 3 Auto-Summarisation of routes is enabled Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 30 seconds Invalid after 180 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 2 Authentication type is none Split Horizon with poissoned reverse is enabled
CHAPTER 4: RIP Configuration User Manual 90 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Restricts default route installation Restricts default route origination 4. View the RIP route entries for the static routes added in FDN40-1. (Static routes added in FDN40-1 with metric as 3 are redistributed into the RIP domain. In FDN40-2, view the redistributed static routes with metric as 4.) using the following command. UltOs# show ip rip database 10.0.0.0/8 [1] auto-summary 10.0.0.0/16 [1] directly connected, vlan1 50.0.0.0/8 [4] auto-summary 50.0.0.0/8 [4] via 10.0.0.1, vlan1 60.0.0.0/8 [4] auto-summary 60.0.0.0/8 [4] via 10.0.0.1, vlan1 70.0.0.0/8 [4] auto-summary 70.0.0.0/8 [4] via 10.0.0.1, vlan1 80.0.0.0/8 [4] auto-summary 80.0.0.0/8 [4] via 10.0.0.1, vlan1 UltOs# show ip route C 10.0.0.0/16 is directly connected, vlan1 C 30.2.2.0/24 is directly connected, vlan3 R 50.0.0.0/8 [4] via 10.0.0.1 R 60.0.0.0/8 [4] via 10.0.0.1 R 70.0.0.0/8 [4] via 10.0.0.1 R 80.0.0.0/8 [4] via 10.0.0.1 5. Execute the following commands in the switch FDN40-1 to disable redistribution.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Disable the redistribution of static routes into RIP domain UltOs(config-router)# no redistribute static UltOs(config-router)# end. 6. View in FDN40-2, the RIP route entries for the static routes added in FDN40-1, which are made as unreachable with metric as infinity (16) (Static routes added in FDN40-1 are redistributed into the RIP domain.) using the following command. UltOs# show ip rip database
CHAPTER 4: RIP Configuration User Manual 91 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 10.0.0.0/8 [1] auto-summary 10.0.0.0/16 [1] directly connected, vlan1 50.0.0.0/8 [16] via 10.0.0.1, vlan1 60.0.0.0/8 [16] via 10.0.0.1, vlan1 70.0.0.0/8 [16] via 10.0.0.1, vlan1 80.0.0.0/8 [16] via 10.0.0.1, vlan1 7. View the RIP route entries for the redistributed static routes are deleted from the IP routing table. UltOs# show ip route C 10.0.0.0/16 is directly connected, vlan1 C 30.2.2.0/24 is directly connected, vlan3 4.5.9 Configuring Default-metric Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 4.5.9.1 CLI Configuration 1. Execute the following commands in the switch FDN40-1 to configure the default-metric.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Configure default-metric for redistributed routes in the RIP domain. UltOs(config-router)# default-metric 10  Configure redistribution of static routes into RIP domain. UltOs(config-router)# redistribute static  Exit from the router configuration mode. UltOs(config-router)# end 4.5.9.2 WEB Configuration RIP default metric can be configured through WEB interface using the RRD RIP Configuration screen. For screenshot, refer section 4.5.8.2. 4.5.9.3 Sample Configuration to Test Default-metric Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP.
CHAPTER 4: RIP Configuration User Manual 92 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2. Execute the following commands in the switch FDN40-1 to test default-metric.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Configure default-metric as 10 for redistributing routes into RIP domain. UltOs(config-router)# default-metric 10  Configure redistribution of static routes into RIP domain. UltOs(config-router)# redistribute static UltOs(config-router)# exit  Add static routes. UltOs(config)# ip route 50.0.0.0 255.0.0.0 vlan 2 UltOs(config)# ip route 60.0.0.0 255.0.0.0 vlan 2 UltOs(config)# ip route 70.0.0.0 255.0.0.0 vlan 2 UltOs(config)# ip route 80.0.0.0 255.0.0.0 vlan 2 UltOs(config)# end 3. Execute the following commands in the switch FDN40-2 to test default-metric.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.2/16). UltOs(config-router)# network 10.0.0.2 4. View the metric for redistributed RIP route entries as 10 in FDN40-1 using the following command. UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip Output Delay is disabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36 Default metric is 10 Auto-Summarisation of routes is enabled
CHAPTER 4: RIP Configuration User Manual 93 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 30 seconds Invalid after 180 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 2 Authentication type is none Split Horizon with poissoned reverse is enabled Restricts default route installation Restricts default route origination UltOs# show ip rip database 10.0.0.0/8 [1] auto-summary 10.0.0.0/16 [1] directly connected, vlan1 50.0.0.0/8 [10] auto-summary 50.0.0.0/8 [10] redistributed via 0.0.0.0 60.0.0.0/8 [10] auto-summary 60.0.0.0/8 [10] redistributed via 0.0.0.0 70.0.0.0/8 [10] auto-summary 70.0.0.0/8 [10] redistributed via 0.0.0.0 80.0.0.0/8 [10] auto-summary 80.0.0.0/8 [10] redistributed via 0.0.0.0 5. Execute the following commands in the switch FDN40-1 to disable redistribution.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Disable route redistribution. UltOs(config-router)# no redistribute static UltOs(config-router)# end.  Configure default metric for redistributed routes. UltOs(config-router)# no default-metric  Enable static route redistribution. UltOs(config-router)# redistribute static
CHAPTER 4: RIP Configuration User Manual 94 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-router)# end. 6. View in FDN40-1, the metric for redistributed RIP route entries as 3 using the following command. UltOs# show ip rip database 10.0.0.0/8[1] summary route 10.0.0.0/16 directly connected, vlan1 50.0.0.0/8[3] summary route 50.0.0.0/8 [3] redistributed via vlan2 60.0.0.0/8[3] summary route 60.0.0.0/8 [3] redistributed via vlan2 70.0.0.0/8[3] summary route 70.0.0.0/8 [3] redistributed via vlan2 80.0.0.0/8[3] summary route 80.0.0.0/8 [3] redistributed via vlan2 4.5.10 Configuring Auto-summary Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 4.5.10.1 CLI Configuration 1. Execute the following commands in the switch FDN40-1 to configure auto-summary.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Disable auto-summary of RIP routes. UltOs(config-router)# auto-summary disable 2. View the disabled auto summarization using the following command. UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip Output Delay is disabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36
CHAPTER 4: RIP Configuration User Manual 95 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Default metric is 3 Auto-Summarisation of routes is disabled Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 30 seconds Invalid after 180 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 2 Authentication type is none Split Horizon with poissoned reverse is enabled Restricts default route installation Restricts default route origination 3. Execute the following commands in the switch FDN40-1 to enable auto-summary.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable auto-summary of RIP routes. UltOs(config-router)# auto-summary Enable  Exit from the router configuration mode. UltOs(config-router)# end 4. View the enabled auto summarization using the following command. UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip Output Delay is disabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36 Default metric is 3 Auto-Summarisation of routes is Enabled Routing for Networks : 10.0.0.0
CHAPTER 4: RIP Configuration User Manual 96 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 30 seconds Invalid after 180 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 2 Authentication type is none Split Horizon with poissoned reverse is enabled Restricts default route installation Restricts default route origination 4.5.10.2 WEB Configuration Auto Summary status can be configured through WEB interface using the RIP Basic Settings screen. For screenshot, refer section 4.5.3.2 4.5.11 Configuring Interface Specific RIP Parameters The following configurations are done in the interface mode. 1. Execute the following commands in the switch to configure interface specific RIP parameters.  Enter the Global Configuration mode. UltOs# configure terminal  Enter the interface configuration mode. UltOs(config)# interface vlan 1 UltOs(config-if)#  Exit from the interface configuration mode UltOs(config-if)#exit 4.5.11.1 Configuring RIP Default Route Propagation Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 1. Execute the following commands in the switch FDN40-1 to configure RIP default route propagation.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16).
CHAPTER 4: RIP Configuration User Manual 97 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-router)# network 10.0.0.1  Exit router configuration mode. UltOs(config-router)# exit  Enter interface configuration mode. UltOs(config)# interface vlan 1  Configure RIP default route origination. UltOs(config-if)# ip rip default route originate 10  Disable rip default route origination. UltOs(config-if)# no ip rip default route originate  Refer Section 4.5.11.2.1 for sample configuration to test Default Route Origination and Default Route Installation.. 4.5.11.2 Configuring to Install Default Route Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. Execute the following commands in the switch FDN40-1 to install the default route.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Exit router configuration mode. UltOs(config-router)# exit  Enter interface configuration mode. UltOs(config)# interface vlan 1  Enable installation of default route. UltOs(config-if)# ip rip default route install  Disable installation of default route. UltOs(config-if)# no ip rip default route install 4.5.11.2.1 Sample Configuration to test Default Route Origination and Installation Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 1. Execute the following commands in both the switches.  Configure the following in FDN40-1 to test Default Route Origination and Default Route Installation: UltOs# configure terminal
CHAPTER 4: RIP Configuration User Manual 98 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# router rip UltOs(config-router)# network 10.0.0.1 UltOs(config-router)# exit UltOs(config)# interface vlan 1  Enable installation of default route. UltOs(config-if)# ip rip default route install UltOs(config-if)# end UltOs#  Configure the following in FDN40-2 to test Default Route Origination and Default Route Installation. UltOs# configure terminal UltOs(config)# router rip UltOs(config-router)# network 10.0.0.2 UltOs(config-router)# exit UltOs(config)# interface vlan 1  Enable default route origination. UltOs(config-if)# ip rip default route originate 11 UltOs(config-if)# end 2. View in FDN40-2, the RIP response packet sent out through the interface vlan 1 in the switch FDN40-2. The RIP response packets will have a default route. . UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip Output Delay is disabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36 Default metric is 3 Auto-Summarisation of routes is Enabled Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 30 seconds Invalid after 180 seconds Flushed after 120 seconds
CHAPTER 4: RIP Configuration User Manual 99 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Send version is 1 2, receive version is 1 2 Authentication type is none Split Horizon with poissoned reverse is enabled Restricts default route installation Originate default route 3. View in FDN40-1, the default route with next hop as 10.0.0.2 (FDN40-2 interface vlan 1 IP address) and metric as 12 (11+1) using the following command. UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip Output Delay is disabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36 Default metric is 3 Auto-Summarisation of routes is Enabled Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 30 seconds Invalid after 180 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 2 Authentication type is none Split Horizon with poissoned reverse is enabled Installs default route received Restricts default route origination UltOs# show ip rip database 0.0.0.0/0 [12] via 10.0.0.2, vlan1 10.0.0.0/8 [1] auto-summary 10.0.0.0/16 [1] directly connected, vlan1 UltOs# show ip route R 0.0.0.0/0 [12] via 10.0.0.2
CHAPTER 4: RIP Configuration User Manual 100 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. C 10.0.0.0/16 is directly connected, vlan1 C 20.0.0.0/24 is directly connected, vlan2 4.5.11.3 Configuring Version for Receiving RIP Advertisement Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 1. Execute the following commands in the switch FDN40-1 for configuring version for receiving RIP advertisements.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Exit router configuration mode. UltOs(config-router)# exit  Enter interface configuration mode. UltOs(config)# interface vlan 1  Configure version of RIP packets to be received over the interface vlan 1. UltOs(config-if)# ip rip receive version 1 2. View how FDN40-1 will receive only RIP version 1 packets over the interface vlan1 using the following command.  View the RIP receive version in interface vlan 1 is 1. UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip Output Delay is disabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36 Default metric is 3 Auto-Summarisation of routes is Enabled Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 30 seconds
CHAPTER 4: RIP Configuration User Manual 101 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Invalid after 180 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 Authentication type is none Split Horizon with poissoned reverse is enabled Restricts default route installation Restricts default route origination 4.5.11.4 Configuring Version for Transmitting RIP Advertisement Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 1. Execute the following commands to configure version for transmitting RIP advertisement.  Enter Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Exit router configuration mode. UltOs(config-router)# exit  Enter interface configuration mode. UltOs(config)# interface vlan 1  Configure version of RIP packets to be sent over the interface vlan 1. UltOs(config-if)# ip rip send version 1 2. View how FDN40-1 will send (transmit) only RIP version 1 packets over the interface vlan1 using the following command.  View the RIP send version in interface vlan 1 is 1. UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip Output Delay is disabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36 Default metric is 3 Auto-Summarisation of routes is Enabled Routing for Networks :
CHAPTER 4: RIP Configuration User Manual 102 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 30 seconds Invalid after 180 seconds Flushed after 120 seconds Send version is 1, receive version is 1 2 Authentication type is none Split Horizon with poissoned reverse is enabled Restricts default route installation Restricts default route origination  Configure the default RIP packets send version UltOs(config-if)# no ip rip send version 4.5.11.5 Configuring Timer Basic Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 1. Execute the following commands in the switch FDN40-1 to configure Timer Basic.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Exit router configuration mode. UltOs(config-router)# exit  Enter interface configuration mode. UltOs(config)# interface vlan 1  Configure basic timers. UltOs(config-if)# timers basic 60 120 120 UltOs(config-if)# end 2. View the RIP update packets that are sent after 60 seconds and the configured timer values using the following command. UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum
CHAPTER 4: RIP Configuration User Manual 103 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Redistributing : rip Output Delay is disabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36 Default metric is 3 Auto-Summarisation of routes is Enabled Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 60 seconds Invalid after 120 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 2 Authentication type is none Split Horizon with poissoned reverse is enabled Restricts default route installation Restricts default route origination 4.5.11.6 Configuring RIP Split Horizon Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. By default, split horizon with poisson reverse will be enabled on all the RIP interfaces. 1. Execute the following commands in the switch FDN40-1 to configure RIP Split Horizon.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Exit router configuration mode. UltOs(config-router)# exit  Enter interface configuration mode. UltOs(config)# interface vlan 1
CHAPTER 4: RIP Configuration User Manual 104 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  Enable split horizon. UltOs(config-if)# ip split-horizon 2. View the split horizon enabled in FDN40-1 using the following command. UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip Output Delay is disabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36 Default metric is 3 Auto-Summarisation of routes is Enabled Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 30 seconds Invalid after 180 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 2 Authentication type is none Split Horizon is enabled Restricts default route installation Restricts default route origination  Disable split horizon. UltOs(config-if)# no ip split-horizon  Enable split horizon with poison reverse. UltOs(config-if)# ip split-horizon poisson UltOs(config-if)# end 4.5.11.7 WEB Configuration for RIP Interface Paramters RIP interface parameters can be configured through WEB interface using the RIP Interface screen (Navigation - Layer3 Management > RIP > Interface Configuration)
CHAPTER 4: RIP Configuration User Manual 105 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 4-7: RIP Interface - Parameters 4.5.12 Configuring RIP Summary-address Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 4.5.12.1 CLI Configuration Execute the following commands in the switch FDN40-1 to configure RIP summary-address.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Disable auto-summary feature. UltOs(config-router)# auto-summary disable  Exit router configuration mode. UltOs(config-router)# exit  Enter the interface configuration mode. UltOs(config)# interface vlan 1  Configure the version of RIP packets to be sent over the interface vlan 1. UltOs(config-if)# ip rip summary-address 40.0.0.0 255.0.0.0 UltOs(config-if)# end 4.5.12.2 WEB Configuration RIP Summary Address can be configured through WEB interface using the RIP Interface Specific Address Summarization screen (Navigation - Layer3 Management > RIP > Interface Configuration)
CHAPTER 4: RIP Configuration User Manual 106 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 4-8: RIP Interface Specific Address Summarization 4.5.12.3 Sample Configuration to configure RIP summary-address Refer the Section 4.3 and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 1. Execute the following configuration commands in FDN40-1 to configure RIP summary-address. UltOs# configure terminal UltOs(config)# router rip UltOs(config-router)# network 10.0.0.1 UltOs(config-router)# redistribute all  Disable auto-summary feature. UltOs(config-router)# auto-summary disable UltOs(config-router)# exit  Configure Static routes: UltOs(config-router)# ip route 40.1.0.0 255.255.0.0 vlan 2 UltOs(config-router)# ip route 40.2.0.0 255.255.0.0 vlan 2 UltOs(config-router)# ip route 40.3.0.0 255.255.0.0 vlan 2 UltOs(config-router)# ip route 40.4.0.0 255.255.0.0 vlan 2  Configure Summary address for 20.0.0.0/8: UltOs(config)# interface vlan 1 UltOs(config-if)# ip rip summary-address 40.0.0.0 255.0.0.0 UltOs(config-if)#end UltOs#
CHAPTER 4: RIP Configuration User Manual 107 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2. Execute the following configuration commands in FDN40-2. UltOs# config terminal UltOs(config)# router rip UltOs(config-router)# network 10.0.0.2 UltOs(config-router)# end 4.5.13 Configuring Interface Specific Authentication Refer the section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 4.5.13.1 CLI Configuration 1. Execute the following commands in the switch FDN40-1 to enable interface specific authentication.  Enter the Global Configuration mode. UltOs# configure terminal  Enable RIP globally in the switch FDN40-1. UltOs(config)# router rip  Enable RIP over the interface vlan 1 (IP address 10.0.0.1/16). UltOs(config-router)# network 10.0.0.1  Exit router configuration mode. UltOs(config-router)# exit  Enter interface configuration mode. UltOs(config)# interface vlan 1  Enable md5 authentication. UltOs(config-if)# ip rip authentication mode md5 key-chain 12345  Enable sha-1 Crypto authentication UltOs(config-if)# ip rip auth-type sha-1  Enable sha-1 Crypto authentication UltOs(config-if)# ip rip auth-type sha-256  Enable sha-1 Crypto authentication UltOs(config-if)# ip rip auth-type sha-384  Enable sha-1 Crypto authentication  UltOs(config-if)# ip rip auth-type sha-512Create crypto authentication key-id UltOs(config-if)# ip rip authentication key-id 1 key FSS  Configure the start-generate time for crypto authentication key-id UltOs(config-if)# ip rip key-id 1 start-generate 2013-05-12,21:40:20
CHAPTER 4: RIP Configuration User Manual 108 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  Configure the stop-generate time for crypto authentication key-id UltOs(config-if)# ip rip key-id 1 stop-generate 2013-05-12,22:40:20  Configure the start-accept time for crypto authentication key-id UltOs(config-if)# ip rip key-id 1 start-accept 2013-05-12,21:40:20  Configure the stop-accept time for crypto authentication key-id UltOs(config-if)# ip rip key-id 1 stop-accept 2013-05-12,22:40:20  Delete the configured crypto authentication key-id UltOs(config-if)# no ip rip authentication key-id 1  Disable authentication. UltOs(config-if)# no ip rip authentication 2. Execute the following commands in FDN40-1 to enable authentication last-key lifetime status.  Enter the Global Configuration mode. UltOs# configure terminal  Configure the lifetime status for authentication key-id.  UltOs(config)# rip authentication last-key infinite lifetime true 4.5.13.2 WEB Configuration RIP Authentication can be configured through WEB interface using the RIP Security Settings screen (Navigation - Layer3 Management > RIP > Security Settings) Screen 4-9: RIP Security Settings 4.5.13.3 Sample Configuration for Enabling Authentication Refer the section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 1. Execute the following commands in both the switches for enabling authentication.  Configure the following in FDN40-1:
CHAPTER 4: RIP Configuration User Manual 109 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# config terminal UltOs(config)# router rip UltOs(config-router)# network 10.0.0.1 UltOs(config-router)# redistribute all UltOs(config-router)# exit  Enable md5 authentication UltOs(config)# interface vlan 1 UltOs(config-if)# ip rip authentication mode md5 key-chain 12345 UltOs(config-if)#end UltOs#  Configurations in FDN40-2: UltOs# config terminal UltOs(config)# router rip UltOs(config-router)# network 10.0.0.2 UltOs(config-router)# exit  Enable md5 authentication UltOs(config)# interface vlan 1 UltOs(config-if)# ip rip authentication mode md5 key-chain 12345 UltOs(config-if)#end UltOs# 2. View in FDN40-1, the authentication type using the following command.  View in FDN40-1 all the RIP packets have authentication information. UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip Output Delay is disabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36 Default metric is 3 Auto-Summarisation of routes is Enabled Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1
CHAPTER 4: RIP Configuration User Manual 110 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Sending updates every 30 seconds Invalid after 180 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 2 Authentication type is md5 Split Horizon with poissoned reverse is enabled Restricts default route installation Restricts default route origination  View in FDN40-2, all the RIP packets have authentication information. 4.5.13.4 Sample Configuration for Enabling Crypto Authentication Refer the section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. 1. Execute the following commands in both the switches for enabling authentication.  Configure the following in FDN40-1: UltOs# config terminal UltOs(config)# router rip UltOs(config-router)# network 10.0.0.1 UltOs(config-router)# redistribute all UltOs(config-router)# exit Enable any one of the crypto authentication UltOs(config)# interface vlan 1 UltOs(config-if)# ip rip auth-type sha-1 UltOs(config-if)# ip rip authentication key-id 1 key FSS UltOs(config-if)# ip rip key-id 1 start-generate 2013-05-12,21:40:20 UltOs(config-if)# ip rip key-id 1 stop-generate 2013-05-12,22:40:20 UltOs(config-if)# ip rip key-id 1 start-accept 2013-05-12,21:40:20 UltOs(config-if)# ip rip key-id 1 stop-accept 2013-05-12,22:40:20 UltOs(config-if)#end UltOs#  Multiple keys can be configured over an interface, If the start time for generate, accept & stop time for generate, accept are not configured default values will be taken. UltOs# config terminal UltOs(config)# interface vlan 1
CHAPTER 4: RIP Configuration User Manual 111 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-if)# ip rip auth-type sha-1 UltOs(config-if)# ip rip authentication key-id 2 key FSS2 UltOs(config-if)#end UltOs#  Configure the following in FDN40-2: UltOs# config terminal UltOs(config)# router rip UltOs(config-router)# network 10.0.0.2 UltOs(config-router)# redistribute all UltOs(config-router)# exit  Enable any one of the crypto authentication UltOs(config)# interface vlan 1 UltOs(config-if)# ip rip auth-type sha-1 UltOs(config-if)# ip rip authentication key-id 1 key FSS UltOs(config-if)# ip rip key-id 1 start-generate 2013-05-12,21:40:20 UltOs(config-if)# ip rip key-id 1 stop-generate 2013-05-12,22:40:20 UltOs(config-if)# ip rip key-id 1 start-accept 2013-05-12,21:40:20 UltOs(config-if)# ip rip key-id 1 stop-accept 2013-05-12,22:40:20 UltOs(config-if)#end UltOs#  Multiple keys can be configured over an interface, If the start time for generate, accept & stop time for generate, accept are not configured default values will be taken. UltOs# config terminal UltOs(config)# interface vlan 1 UltOs(config-if)# ip rip auth-type sha-1 UltOs(config-if)# ip rip authentication key-id 2 key FSS2 UltOs(config-if)#end UltOs# 2. View the configured authentication information and the active key-id in use during packet transmission in FDN40-1 & FDN40-2 using the following show commands, UltOs# show ip rip authentication RIP Interface Authentication Statistics: Vrf default Interface Name vlan1 Authentication Type sha-1
CHAPTER 4: RIP Configuration User Manual 112 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Authentication KeyId in use: 1 Authentication Last key status: true RIP Authentication Key Info: Authentication KeyId 1 Start Accept Time 2013-05-12,21:40:20 Start Generate Time 2013-05-12,21:40:20 Stop Generate Time 2013-05-12,22:40:20 Stop Accept Time 2013-05-12,22:40:20 Authentication KeyId 2 Start Accept Time 2013-05-11,13:13:37 Start Generate Time 2013-05-11,13:13:37 Stop Generate Time 2136-02-06,06:28:15 Stop Accept Time 2136-02-06,06:28:15 UltOs# show ip protocols Routing Protocol is rip RIP2 security level is Maximum Redistributing : rip Output Delay is disabled Retransmission timeout interval is 5 seconds Number of retransmission retries is 36 Default metric is 3 Auto-Summarisation of routes is Enabled Routing for Networks : 10.0.0.0 Routing Information Sources : Interface Specific Address Summarisation : Interface vlan1 Sending updates every 30 seconds Invalid after 180 seconds Flushed after 120 seconds Send version is 1 2, receive version is 1 2 Authentication type is sha-1 Split Horizon with poissoned reverse is enabled Restricts default route installation Restricts default route origination
CHAPTER 4: RIP Configuration User Manual 113 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 4.5.14 Configuring Debug Level for RIP Refer the Section 4.3 for configuration guidelines and Figure 4-1 for the Setup. The prerequisite configuration needs to be done in the switches (FDN40-1 and FDN40-2) before configuring RIP. Execute the following commands in the switch FDN40-1 to configure the debug level for RIP. UltOs# config terminal UltOs(config)# router rip UltOs(config-router)# network 10.0.0.1 UltOs(config-router)# end  Configure the debug level for RIP module. UltOs# debug ip rip all RIP: Sending regular Update over this interface 0 RIP: Authentication not needed for this interface, So 25 routes can be composed RIP: If Agg Rt added to update with metric : 3 RIP: Sending RIP update through Port 0 RIP: Sending regular Update over this interface 0 RIP: Authentication not needed for this interface, So 25 routes can be composed RIP: If Agg Rt added to update with metric : 3 RIP: Sending RIP update through Port 0 RIP: Sending regular Update over this interface 0 RIP: Authentication not needed for this interface, So 25 routes can be composed RIP: If Agg Rt added to update with metric : 3  Disable the debug level for RIP module. UltOs# no debug ip rip all 4.5.15 Configuring Route Map – RIP URM (Unified Route Map) is a portable implementation of the route map capability for IPv4 and IPv6 unicast routing software. The URM provides a single interface for the administrator to set up and manage route maps. It also provides a common unified method for routing protocols and static route management software to use route maps for different purposes. The independent nature of the implementation helps to avoid the duplication of the route maps in the different routing modules in a router.
CHAPTER 4: RIP Configuration User Manual 114 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 4.5.15.1 Configuring Route Map 4.5.15.1.1 CLI Configuration This section lists the CLI configuration steps to define a route map with a specified name and the related parameters such as permission and sequence number. 1. Enter the Global configuration mode. UltOs# configure terminal 2. Configure the route map name, permission and sequence number. UltOs(config)# route-map aa permit 1 3. View the configured route map UltOs# show route-map Route-map aa, Permit, Sequence 1 Match Clauses: -------------- Set Clauses: -------------- 4. Execute the no form of the command to delete the route map. UltOs(config)# no route-map aa 1 4.5.15.1.2 WEB Configuration Route Map can be created through WEB interface using the RouteMap Creation screen (Navigation - Layer3 Management > Route Map > Route Map Creation) Screen 4-10: RouteMap Creation 4.5.15.2 Configuring Route Map Match Criteria 4.5.15.2.1 CLI Configuration This section lists the CLI configuration steps to define the filtering criteria for the route map and its related parameters.
CHAPTER 4: RIP Configuration User Manual 115 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 1. Enter the Global configuration mode. UltOs# configure terminal 2. Configure the route map name, permission and sequence number. UltOs(config)# route-map aa permit 1 3. Configure the route map match source IP address and the subnet mask. UltOs(config-rmap-aa)# match source ip 34.0.0.3 255.0.0.0 4. Configure the route map match source IPv6 address and the prefix length. UltOs(config-rmap-aa)# match source ipv6 2120::3 64 5. Configure the route map match destination IP address and the subnet mask. UltOs(config-rmap-aa)# match destination ip 91.0.0.1 255.0.0.0 6. Configure the route map match destination IPv6 address and the prefix length. UltOs(config-rmap-aa)# match destination ipv6 2150::2 64 7. Configure the route map match route-type as remote. (Route-type can be configured either as local or remote.) UltOs(config-rmap-aa)# match route-type remote 8. Configure the route map match metric-type as inter-area. (Metric type can be inter-area / intra-area / type-1-external / type-2-external.) UltOs(config-rmap-aa)# match metric-type inter-area 9. Configure the route map match metric value. UltOs(config-rmap-aa)# match metric 44 10. Configure the route map match next-hop IP address. UltOs(config-rmap-aa)# match next-hop ip 91.0.0.1 11. Configure the route map match next-hop IPv6 address. UltOs(config-rmap-aa)# match next-hop ipv6 3000::3 12. Configure the route map match tag. UltOs(config-rmap-aa)# match tag 10 13. View the configured parameters. UltOs# show running-config route-map Building configuration... route-map aa permit 1 match destination ip 91.0.0.1 255.0.0.0 match destination ipv6 2150::2 64 match source ip 34.0.0.3 255.0.0.0 match source ipv6 2120::3 64 match next-hop ip 91.0.0.1 match next-hop ipv6 3000::3 match metric 44 match tag 10
CHAPTER 4: RIP Configuration User Manual 116 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. match metric-type inter-area match route-type remote end 14. Execute the no form of the commands to delete the corresponding configurations. 4.5.15.2.2 WEB Configuration Route Map Match criteria can be configured through WEB interface using the RouteMap Creation screen (Navigation - Layer3Management > Route Map > Route Map Match) Screen 4-11: RouteMap Match 4.5.15.3 Configuring RIP Distance 4.5.15.3.1 CLI Configuration This section lists the CLI configuration steps to set the administrative distance for the RIP router. 1. Enter the Global configuration mode. UltOs# configure terminal 2. Enter the RIP router configuration mode. UltOs(config)# router rip 3. Configure the distance for the RIP routes. UltOs(config-router)# distance 100
CHAPTER 4: RIP Configuration User Manual 117 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 4. View the configured distance. UltOs# show running-config rip Building configuration... router rip distance 100 ! end UltOs# 5. Execute the no form of the command to re-configure the distance to its default value. UltOs(config-router)# no distance 6. View the configured distance. UltOs# sh running-config rip Building configuration... router rip ! end UltOs# 4.5.15.3.2 WEB Configuration RIP Diatance can be configured through WEB interface using the RIP Basic Settings screen. For screenshot, refer section 4.5.3.2 4.5.15.4 Configuring Redistribution with Route Map 4.5.15.4.1 CLI Configuration This section lists the CLI configuration steps to configure the protocol from which the routes have to be redistributed into RIP, by applying the route-map. 1. Enter the Global configuration mode. UltOs# configure terminal 2. Enable the RIP router configuration mode. UltOs(config)# router rip 3. Configure the network. UltOs(config-router)# network 12.0.0.1 4. Configure the redistribution of all routes with route-map aa. UltOs(config-router)# redistribute all route-map aa 5. View the configured parameters. UltOs# show running-config rip Building configuration... router rip redistribute all route-map aa
CHAPTER 4: RIP Configuration User Manual 118 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. network 12.0.0.1 ! interface vlan 1 ! end UltOs# 6. Execute the no form of the command to disable the redistribution of all routes with route-map. UltOs(config-router)# no redistribute all route-map aa 7. View the configured parameters after disabling the redistribution of all the routes with route map. UltOs# sh running-config rip Building configuration... router rip network 12.0.0.1 ! interface vlan 1 ! end UltOs# 4.5.15.5 WEB Configuration RIP redistribution can be configured through WEB interface using the RRD RIP Configuration screen. For screenshot, refer section 4.5.8.2.
Configuration User Manual 119 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 5 VLAN 5.1 Protocol Description Virtual LAN (VLAN) technology, defined under the IEEE 802.1q specifications, allows enterprises to extend the reach of their corporate networks across WAN. VLANs enable partitioning of a LAN based on functional requirements, while maintaining connectivity across all devices on the network. VLAN groups network devices and enable them to behave as if, they are in one single network. Data security is ensured by keeping the data exchanged between the devices of a particular VLAN within the same network. VLAN offers a number of advantages over traditional LAN. They are:  Performance In networks with traffic consisting of a high percentage of broadcasts and multicasts, VLAN minimizes the possibility of sending the broadcast and multicast traffic to unnecessary destinations.  Formation of Virtual Workgroups VLAN helps in forming virtual workgroups. During this period, communication between the members of the workgroup will be high. Broadcasts and multicasts can be restricted within the workgroup.  Simplified Administration Most of the network costs are a result of adds, moves, and changes of users in the network. Every time a user is moved in a LAN, recabling, new station addressing, and reconfiguration of hubs and routers becomes necessary. Some of these tasks can be simplified with the use of VLANs.  Reduced Cost VLANs can be used to create broadcast domains, which eliminate the need for expensive routers.
CHAPTER 5: VLAN Configuration User Manual 120 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  Security Sensitive data may be periodically broadcast on a network. Placing only those users, who are allowed to access to such sensitive data on a VLAN can reduce the chances of an outsider gaining access to the data. VLAN can also be used to control broadcast domains, set up firewalls, restrict access, and inform the network manager of an intrusion. VLAN logically segments the shared media LAN, forming virtual workgroups. It redefines and optimizes the basic Transparent Bridging functionalities such as learning, forwarding, filtering and flooding. 5.2 Topology Figure 5-1: Topology for VLAN Configuration 5.3 Configuration Guidelines  VLAN is enabled in the switch by default. GVRP and GMRP must be disabled prior to disabling VLAN.  The default interface - VLAN 1- cannot be deleted in the switch.  If port GVRP state is disabled, but global GVRP status is enabled, then GVRP is disabled on current port. GVRP packets received on that port will be discarded and GVRP registrations from other ports will not be propagated on this port.  GARP cannot be started, if VLAN is shutdown, and GARP cannot be shutdown, if GVRP and/or GMRP are enabled.  Mapping of forwarding database identifier (FID) to VLANs is successful only when, VLAN learning mode is hybrid.  To configure a static unicast/multicast MAC address in the forwarding database, VLAN must have been configured and member ports must have been configured for the specified VLAN.  Bridge-mode status cannot be set to provider mode, if the protocol/MAC based VLAN is enabled.  It is not possible to configure a port as trunk, if the port is an untagged member of a VLAN.  To enable Dot1q-tunneling status, Bridge Mode must be set to 'provider'..  It is not possible to set the Dot1q-tunnel status on the port, if the port mode is not 'access' type.  To enable Dot1q tunneling on a port 802.1X (PNAC), port control must be force-authorized. P2 P1 P1 Host A A B
CHAPTER 5: VLAN Configuration User Manual 121 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  BPDU tunneling on the port cannot be set; if Dot1q tunnel status is disabled.  Leave Timer must be two times greater than Join Timer, and Leaveall Timer must be greater than Leave Timer. 5.4 Default Configurations Table 5-1: Default Configurations Feature Default Setting VLAN Module status Enable Default VLAN Id configured in the switch 1 Mac based VLAN Classification Disabled Protocol-VLAN based classification Enabled System and port level GVRP and GMRP Module status Enabled Mac address table aging time 300 seconds Acceptable frame types All (Accepts untagged frames or priority-tagged frames or tagged frames received on the port) Ingress filtering Disabled Switch port priority 0 Switch port mode Hybrid GARP Timers Join: 20 seconds Leave: 60 seconds Leave all: 1000 seconds Max traffic classes Maximum number of traffic classes supported on a port is 8 Tunneling Disabled  In case of Provider Bridges, the default configurations and configuration guidelines are provided in the relevant subsection itself. 5.5 VLAN Configurations 5.5.1 Configuring Static VLAN Static VLAN entries can be configured with the required number of member ports, untagged ports and forbidden ports. The following configuration deals with the creation of member ports. 5.5.1.1 CLI Configuration 1. Execute the following commands to configure Static VLAN entry in the switch.  Enter the Global Configuration Mode. UltOs# configure terminal  Enter the VLAN Configuration Mode (for VLAN 2).
CHAPTER 5: VLAN Configuration User Manual 122 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# VLAN 2  Add member ports for VLAN. UltOs(config-vlan)# ports lan 0/2-5 untagged lan 0/3 Member ports represent the set of ports permanently assigned to the VLAN egress list. Frames belonging to the specified VLAN are forwarded to the ports in the egress list. If the port type is not explicitly specified as untagged, then all the ports are configured to be of tagged port type allowing transmission of frames with the specified VLAN tag. The untagged setting allows the port to transmit the frames without a VLAN tag. This setting is used to configure a port connected to an end user device. In the above example, the packets for the interface lan 0/3 are transmitted without the tag. On all the other ports, the packets are transmitted with the tag.  Configure port 1 as forbidden port. UltOs(config-vlan)# ports lan 0/2-5 forbidden lan 0/1 Alternatively, the forbidden setting prevents the port from participating in the specified VLAN activity and ensures that, any dynamic requests for the port to join the VLAN will be ignored.  Exit from the configuration mode. UltOs(config)# end 2. View the VLAN information by executing the following command. UltOs# show VLAN summary Number of VLANs: 2 The output displays the number of VLANs in a switch. 3. View the configuration details of all the VLANs by executing the following show command. UltOs# show VLAN VLAN database ------------- VLAN ID : 1 Member Ports : Lan0/1, Lan0/2, Lan0/3, Lan0/4, Gi0/5, Gi0/6 Gi0/7, Gi0/8, Gi0/9, Lan0/10, Lan0/11, Lan0/12 Lan0/13, Lan0/14, Lan0/15, Lan0/16, Lan0/17, Lan0/18 Lan0/19, Lan0/20, Lan0/21, Lan0/22, Lan0/23, Lan0/24 Untagged Ports : Lan0/1, Lan0/2, Lan0/3, Lan0/4, Gi0/5, Gi0/6 Gi0/7, Gi0/8, Gi0/9, Lan0/10, Lan0/11, Lan0/12
CHAPTER 5: VLAN Configuration User Manual 123 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Lan0/13, Lan0/14, Lan0/15, Lan0/16, Lan0/17, Lan0/18 Lan0/19, Lan0/20, Lan0/21, Lan0/22, Lan0/23, Lan0/24 Forbidden Ports : None Name : Status : Permanent ---------------------------------------------------- VLAN ID : 2 Member Ports : Lan0/2, Lan0/3, Lan0/4, Gi0/5 Untagged Ports : None Forbidden Ports : Lan0/1 Name : Status : Permanent ---------------------------------------------------- 4. View the configuration details of a particular VLAN by executing the following command. UltOs# show VLAN id 2 VLAN database ------------- VLAN ID : 2 Member Ports : Lan0/2, Lan0/3, Lan0/4, Gi0/5 Untagged Ports : None Forbidden Ports : Lan0/1 Name : Status : Permanent ------------------------------------------------- 5.5.1.2 WEB Configuration Static VLAN can be configured through WEB interface using the Static VLAN Configuration screen (Navigation - Layer2 Management > VLAN > StaticVLANs)
CHAPTER 5: VLAN Configuration User Manual 124 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 5-1: Static VLAN Configuration 5.5.2 Deleting a VLAN 5.5.2.1 CLI Configuration It is possible to delete a VLAN from the VLAN list using the no vlan <vlan-id(1-4094)> Global Configuration Mode command. UltOs(config)# no vlan 4  The default VLAN - VLAN 1 - cannot be deleted. 5.5.2.2 Web Configuration VLAN can be deleted through WEB interface using the Static VLAN Configuration screen. For screenshot, refer section 5.5.1.2 5.5.3 Enabling VLANs A VLAN can be made active by adding a member port to a VLAN (refer section Configuring Static ) 5.5.4 Classifying Frames to a VLAN As per the IEEE standards, rules are defined for classifying the frames in a VLAN. VLAN classification is accomplished by associating a VLAN ID with each port on the switch. Optionally, frames can be classified according to the protocol identifier contained within the frame. Frame classification priority begins with VLAN Tag; followed by MAC based, protocol match, and finally the PVID. 5.5.4.1 Port Based Classification In port-based classification, the VLAN ID associated with an untagged or priority-tagged frame is determined, based on the port on which the frame
CHAPTER 5: VLAN Configuration User Manual 125 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. arrives. Port-based classification requires the association of a specific VLAN ID, the port VLAN identifier (PVID) with each port.  A port can be a member of only one port-based VLAN.  If PVID value has not been explicitly configured for a port, then PVID assumes a default value of 1. 1. Execute the following commands to configure the PVID that is assigned to untagged/priority-tagged frames.  Enter the Global Configuration Mode. UltOs# configure terminal  Enter the Interface Configuration Mode for port gigabitethernet 0/1. UltOs(config)# interface lan 0/1  Configure the PVID that is to be assigned to untagged/priority-tagged frames. UltOs(config-if)# switchport pvid 2. View the configuration details by executing the following show command. UltOs# show VLAN port config port lan 0/1 VLAN Port configuration table ------------------------------- Port lan0/1 Port VLAN ID : 4 Port Acceptable Frame Type : Admit All Port Ingress Filtering : Disabled Port Mode : Hybrid Port Gvrp Status : Enabled Port Gmrp Status : Enabled Port Gvrp Failed Registrations : 0 Gvrp last pdu origin : 00:00:00:00:00:00 Port Restricted VLAN Registration : Disabled Port Restricted Group Registration : Disabled Mac Based Support : Disabled Port-and-Protocol Based Support : Enabled Default Priority : 0 -------------------------------------------------- 5.5.4.2 WEB Configuration VLAN Frame Classification can be configured through WEB interface using VLAN Port Settings screen (Navigation - Layer2 Management > VLAN > PortSettings)
CHAPTER 5: VLAN Configuration User Manual 126 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 5-2: VLAN Port Settings 5.5.5 Configuring Port Filtering 5.5.5.1 Configuring Acceptable Frametype It is possible to configure the acceptable frame type for the port as one of the following:  All frames  Tagged frames  Untagged and priority tagged frames. 1. Execute the following commands to configure the acceptable frame type for the port.  Enter the Global Configuration Mode. UltOs# configure terminal  Enter the Interface Configuration Mode and configure the frame type of the port as “tagged” for that interface. UltOs(config)# interface lan 0/2
CHAPTER 5: VLAN Configuration User Manual 127 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-if)# switchport acceptable-frame-type tagged 2. View the configuration information by executing the following show command. UltOs# show VLAN port config port lan 0/2 VLAN Port configuration table ------------------------------- Port Lan0/2 Port VLAN ID : 1 Port Acceptable Frame Type : Admit Only VLAN Tagged Port Ingress Filtering : Disabled Port Mode : Hybrid Port Gvrp Status : Enabled Port Gmrp Status : Enabled Port Gvrp Failed Registrations : 0 Gvrp last pdu origin : 00:00:00:00:00:00 Port Restricted VLAN Registration : Disabled Port Restricted Group Registration : Disabled Mac Based Support : Disabled Port-and-Protocol Based Support : Enabled Default Priority : 0 ----------------------------------------------------  When set to “tagged”, the device will discard untagged and priority tagged frames received on the port and will process only the VLAN tagged frames.
Configuration User Manual 129 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 6 NAT 6.1 Topology Figure 6-1 - NAT Topology Interface Index/Name Interface IPv4 Address lan0/1 10.0.0.1 wan0/1 80.0.0.1 H1 10.0.0.10 H2 80.0.0.10 H1 FDN40-1 H2 LAN Network WAN Network
CHAPTER 6: NAT Configuration User Manual 130 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 6.2 Configuration Guidelines  NAT and NAPT is enabled or disabled on an interface. 6.3 Default Configurations Parameter Default Configuration NAT Enabled NAPT Enabled 6.4 NAT Configurations 6.4.1 Enabling and Disabling NAT on an Interface This section describes the steps involved in enabling and disabling the NAT module on an interface. By default, nat module is enabled. 6.4.1.1 CLI Configuration 1. To enable nat on an interface:  Enter the Global Configuration mode. UltOs# configure terminal  Enter the Interface Configuration mode. UltOs(config)# interface wan 0/1  Enable nat UltOs(config-if)# interface nat enable  Exit from the Interface Configuration mode. UltOs(config-if)# end 2. To view nat status:  View the nat interface status UltOs# show ip nat interface NAT Configuration on the WAN Interface -------------------------------------- Interface NAT NAPT --------- ------ ------- wan0/1 Enabled Enabled  View the nat settings UltOs# show nat config NAT Configuration -----------------
CHAPTER 6: NAT Configuration User Manual 131 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. NAT Status : Enabled Maximum Translation Entries : 9000 Start Free Port : 6001 Idle Timeout : 10 seconds TCP Timeout : 3600 seconds UDP Timeout : 100 seconds ICMP Timeout : 30 seconds Max Threshold for Dropped Packets : 100  To modify NAT setting, nat has to be disabled on all interfaces. 3. To disable nat on an interface:  Enter the Global Configuration mode. UltOs# configure terminal  Enter the Interface Configuration mode. UltOs(config)# interface wan 0/1  Disable nat UltOs(config-if)# interface nat disable  Exit from the Interface Configuration Mode. UltOs(config-if)# end 4. To view the nat status UltOs# show ip nat interface NAT Configuration on the WAN Interface -------------------------------------- Interface NAT NAPT --------- ------ ------- wan0/1 Disabled Disabled 6.4.1.2 WEB Configuration NAT can be enabled / disabled on an interface through WEB interface using the Interface NAT Settings screen (Navigation - Layer3 Management > NAT > Interface Settings)
CHAPTER 6: NAT Configuration User Manual 132 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 6-1: Interface NAT Settings screen - NAT Status 6.4.2 Enabling and Disabling NAPT The Network Address Port Translation (NAPT) feature helps in conserving the IP address further. Different local addresses can be mapped to the same global address and the source port number present in the UDP and TCP connections will be translated to provide the necessary uniqueness. A new port number is picked out from the free port list maintained by the module. This section describes the steps involved in enabling and disabling the NAPT in the particular interface. NAPT translates the port number present in the packet to configured value. 6.4.2.1 CLI Configuration 1. To enable napt:  Enter the Global Configuration mode. UltOs# configure terminal  Enable Interface Configuration Mode. UltOs(config)# interface wan 0/1  Enable napt in the interface. UltOs(config-if)# ip nat napt enable  Exit from the Interface Configuration mode. UltOs(config-if)# end 2. To view napt status:  View the napt status. UltOs# show ip nat interface NAT Configuration on the WAN Interface
CHAPTER 6: NAT Configuration User Manual 133 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. -------------------------------------- Interface NAT NAPT --------- ------ ------- wan0/1 Enabled Enabled 3. To disable napt:  Enter the Global Configuration mode. UltOs# configure terminal  Enable Interface Configuration Mode. UltOs(config)# interface wan 0/1  Disable napt in the interface. UltOs(config-if)# ip nat napt disable  Exit from the Interface Configuration mode. UltOs(config-if)# end 4. To view napt status:  View the napt status. UltOs# show ip nat interface NAT Configuration on the WAN Interface -------------------------------------- Interface NAT NAPT --------- ------ ------- wan0/1 Enabled Disabled 6.4.2.2 WEB Configuration NAPT can be enabled / disabled through WEB interface using the Interface NAT Settings screen (Navigation - Layer3 Management > NAT > Interface Settings)
CHAPTER 6: NAT Configuration User Manual 134 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 6-2: Interface NAT Settings screen - NAPT Status 6.4.3 Configuring Static NAT and NAPT Valid addresses are needed to allow internal users access the Internet NAT allows certain devices on the inside to originate communication with devices on the outside by translating their invalid address to a valid address or pool of addresses. This section details the static NAT configuration in FDN40 when host H1 tries to communicate with host H2. The steps involved in translating the IP address of host H1 (10.0.0.10) to global IP address 80.0.0.1 for Statis NAT and with port numbers 30 to 40 for Static NAPT is given below. NAT must be enabled in interface wan0/1 to perform network address translation. 6.4.3.1 CLI Configuration 1. To configure static nat:  Enter the Global Configuration mode. UltOs# configure terminal  Enter the Interface Configuration mode. UltOs(config)# interface wan 0/1  Enable nat on the wan interface UltOs(config-if)# interface nat enable  Configure static nat for H1. UltOs(config-if)# static nat 10.0.0.10 80.0.0.1  Configure static napt for H1. UltOs(config-if)# static nat 10.0.0.10 30 80.0.0.1 40
CHAPTER 6: NAT Configuration User Manual 135 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  Exit from the Interface Configuration mode. UltOs(config)# end 2. To view nat interface status:  View the nat settings in interfaces. UltOs# show ip nat interface NAT Configuration on the WAN Interface -------------------------------------- Interface NAT NAPT --------- ------ ------- Wan 0/1 Enabled Enabled 3. To view static nat configuration:  View the nat settings in interfaces. UltOs# show ip nat static Static Address Mapping ---------------------- Interface Local IP Translated Local IP --------- --------- ------------------- wan 0/1 10.0.0.10 80.0.0.1 4. To view static nat configuration:  View the nat settings in interfaces. UltOs# show ip nat static napt Static NAPT entries ----------------------------- Interface : wan0/1 Local IP : 10.0.0.10 Local Port : 30 Protocol : ANY Global IP : 80.0.0.1 Global Port : 40 App Type : OTHER Description : Status : Enabled ------------------------------------------------------ 6.4.3.2 WEB Configuration Static NAT can be configured through WEB interface using the Static NAT screen (Navigation - Layer3 Management > NAT > Static NAT)
CHAPTER 6: NAT Configuration User Manual 136 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 6-3: Static NAT and NAPT 6.4.4 Configuring Dynamic NAT This section details the dynamic NAT configuration when host H1 communicates with host H2. Global address pool is configured in the interface which allows packets from H1 to retrieve IP address from the configured ip pool while translation.
CHAPTER 6: NAT Configuration User Manual 137 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 6.4.4.1 CLI Configuration 1. To configure dynamic nat:  Enter the Global Configuration mode. UltOs# configure terminal  Enter the Interface Configuration mode. UltOs(config)# interface wan 0/1  Enable nat on the wan interface UltOs(config-if)# interface nat enable  Add global address pool. UltOs(config-if)# ip nat pool 80.0.0.5 255.255.255.0  Exit from the Interface Configuration mode. UltOs(config)# end 2. To view nat interface status:  View the nat settings in interfaces. UltOs# show ip nat interface NAT Configuration on the WAN Interface -------------------------------------- Interface NAT NAPT --------- ------ ------- Wan 0/1 Enabled Enabled 3. To view dynamic NAT configuration:  View the NAT settings for interfaces. UltOs# show ip nat translations Translated Addresses --------------------- Interface Local Translated LocalTranslated Destination Dest IP LocalIP Port Port IP Port -------- -------- --------- ------ --------- ------------ ---- Wan 0/1 10.0.0.10 80.0.0.5 9806 3000 203.199.255.1 2048  View the dynamic NAT pool settings UltOs# show ip nat global Global Addresses Configured --------------------------- Interface Translated Local IP Translated IP Address Range
CHAPTER 6: NAT Configuration User Manual 138 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. --------- ------------------- ----------------------- Wan 0/1 80.0.0.5 255.255.255.0 6.4.4.2 WEB Configuration Dynamic NAT can be configured through WEB interface using the Address Pool screen (Navigation - Layer3 Management > NAT > Dynamic NAT) Screen 6-4: Address Pool screen 6.4.5 Configuring Virtual Server Virtual Server is required to allow external world to avail services in corporate world. This section describes the steps to configure telnet virtual server VS in the LAN network so that the telnet request for H1 given by H2 is received and handled by VS so that the IP address of host H1 remains hidden to outside world. 6.4.5.1 CLI Configuration 1. To create a telnet virtual server:  Enter the global configuration mode. UltOs# configure terminal  Enter Interface Configuration mode UltOs(config)# interface wan 0/1  Create a virtual server for telnet. UltOs(config-if)# virtual server 10.0.0.2 TELNET-server  Exit from the Interface Configuration mode. UltOs(config-if)# end 2. To view the configured virtual servers
CHAPTER 6: NAT Configuration User Manual 139 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# show virtual servers Virtual Servers Configuration ----------------------------- Interface : Wan0/1 Local IP : 10.0.0.2 Local Port : 23 Global IP : 20.10.10.10 Global Port : 23 App Type : TELNET Description : Server Status : Enabled ------------------------------------------------------ 3. To delete the configured virtual server:  Enter the Global Configuration mode. UltOs# configure terminal  Enter Interface Configuration mode UltOs(config)# interface wan 0/1  Create a virtual server for telnet. UltOs(config-if)# no virtual server 10.0.0.2 23  Exit from the Interface Configuration mode. UltOs(config-if)# end 6.4.5.2 WEB Configuration NAT Virtual Server can be configured through WEB interface using the Virtual Server Configuration screen (Navigation - Layer3 Management > NAT > NAT Virtual Server) Screen 6-5: Virtual Server Configuration
Configuration User Manual 141 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 7 IPSec 7.1 Protocol Description IPSec provides security services at the IP layer. The security services include access control, connectionless integrity, data origin authentication, rejection of replayed packets, confidentiality and limited traffic flow confidentiality. Since these services are provided at the IP layer, any higher layer protocol above IP (for example, TCP (Transmission Control Protocol), UDP (User Datagram Protocol) and the like) can make use of the offered security services. The protection offered is based on the requirements defined by a SPD (Security Policy Database). The packets are selected on the IP layer header information that is matched against entries in the selectors database. Each incoming and outgoing packet is secured, discarded or bypassed based on the policy identified by the selectors. IPSec performs a SAD (Security Association Database) lookup for both inbound and outbound datagram. A SAD contains parameters that identify the SA to be used for a particular destination. SA identifies the statement of agreement between two peers. SA defines the mode of operation (Tunnel), security protocol and its associated transforms for a particular peer. The type of the traffic to be protected or filtered is identified by the selectors, which have protocol and interface specific information. The decision to apply or bypass security is based on the configured policy for a particular set of traffic. IPSec provides the above mentioned security services with the help of the following infrastructure protocol. The ESP: Provides confidentiality, integrity, data origin authentication and anti-replay service. Security services are applied to traffic through ESP. Traffic is secured between two hosts or between a host and a security gateway or between two security gateways using two modes namely Tunnel mode or Transport mode.
CHAPTER 7: IPSEC Configuration User Manual 142 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. The Tunnel mode is used to protect traffic between a SG and a host or between two security gateways. The Transport mode is used to protect traffic between a pair of hosts or security gateways. 7.2 Topology Figure 7-1: IPSec Topology Node Interface Index/Name Interface IP Address DUT1 WAN 35.0.0.1 DUT2 WAN 35.0.0.2 DUT1 LAN 192.168.1.1 DUT2 LAN 192.168.2.1 H1 E0 192.168.1.10 R1 E0 192.168.2.10 7.3 IPSec Configurations 7.3.1 Enabling VPN Module The VPN (Virtual Private Network) module is enabled for encryption and decryption of the traffic flows. This section describes the steps involved in enabling the VPN module globally and configuring a VPN policy. This section also describes the verifying of the configuration using corresponding show command. 7.3.1.1 CLI Configuration To enable VPN globally 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Enable the VPN module. DUT2 / Ravpn Client / Ravpn Server DUT1 FDN40 R1 FDN40 H1 WAN WAN LAN LAN E0 E0
CHAPTER 7: IPSEC Configuration User Manual 143 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# set vpn enable 3. Exit from the Global Configuration mode. UltOs(config)# end To view the VPN global status 4. View the global VPN settings. UltOs# show vpn config VPN Global Configuration ------------------------ IPSecurity Status : Enabled Maximum Number of Tunnels : 100 Number of Tunnels configured : 1 Number of Tunnels Established: 1 7.3.1.2 WEB Configuration VPN can be enabled / disabled using the VPN Policy screen (Navigation - Security Management > VPN > VPN Settings > VPN Policy) Screen 7-1: VPN Policy - VPN Module Status 7.3.2 Configuring VPN IPSec Policy 7.3.2.1 Creating VPN Policy Crypto map is created to define a VPN policy that is negotiated for SA creation. Crypto map interacts with and applies various configuration components, security protocols and algorithms to support IPSec security services. This section describes the steps involved in creating a VPN policy. To create a crypto policy 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Create a new VPN policy with default configuration UltOs(config)# crypto map crypto_map_name 3. Exit from the Crypto Map Configuration mode. UltOs(config-crypto-map)# end To view the VPN policy parameters 4. View the parameters of the VPN policy. UltOs# show crypto map
CHAPTER 7: IPSEC Configuration User Manual 144 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : Inactive Policy Type : IKE Pre-shared Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Security Mode : Tunnel Local & Remote Tunnel Term Addr : None <== ==> None Interface Name : Not Configured Policy Protocol : any Policy Action : Apply Anti Replay : Disable IKE suite Info [PHASE I] : Encryption Algo : 3DES Hash Algorithm : HMAC SHA1 Diffie-Hellman Group : DH Group 2 IKE Exchange Mode : Main Life Time : 2400 Secs Identity Information : Local Identity Type : Default Local Identity value : Peer Identity Type : Default Peer Identity value : IPSEC suite Info [Phase II] : Protocol : ESP Encryption Algo : Not Confgiured Perfect Forward Secrecy : Not Confgiured Life Time : 800 Secs Crypto Session Status : Inactive Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0 No.of ACTIVE VPN policies = 0 No.of VPN policies configured = 1 7.3.2.2 Configuring VPN Policy Type The VPN policy type defines the policy to be imposed for the authentication of the users. The different policy types available are IPSec manual,
CHAPTER 7: IPSEC Configuration User Manual 145 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. preshared key, extended authentication, certificate and RA VPN preshared key. This section describes the steps involved in configuring VPN policy type. To configure VPN policy type 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Enter the Crypto Map Configuration mode for an existing policy. UltOs(config)# crypto map crypto_map_name 3. Set the key mode as manual mode. UltOs(config-crypto-map)# crypto key mode ipsec-manual 4. Exit from the Crypto Map Configuration mode. UltOs(config-crypto-map)# end To view the VPN policy parameters 5. View the parameters of the VPN policy. UltOs# show crypto map VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : Inactive Policy Type : IPSec Manual Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Security Mode : Tunnel Local & Remote Tunnel Term Addr : None <== ==> None Interface Name : Not Configured Policy Protocol : any Policy Action : Apply In/Out bound SPI : 0 / 0 Security Protocol : ESP Encryption Algo : Not Configured Anti Replay : Disable Crypto Session Status : Inactive Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0 No.of ACTIVE VPN policies = 0 No.of VPN policies configured = 1 7.3.2.3 Configuring IPSec mode The mode of the IPSec is configured based on the set up for securing the traffic. The mode can be either Tunnel or Transport.
CHAPTER 7: IPSEC Configuration User Manual 146 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. The Tunnel mode is used to protect traffic between a SG and a host or between two security gateways. The Transport mode is used to protect traffic between a pair of hosts or security gateways. Only the payload of the IP packet is encrypted and/or authenticated, when in transport mode. The entire IP packet is encrypted and/or authenticated, when in tunnel mode. This section describes the steps involved in configuring the IPSec mode. To configure the VPN policy mode 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Enter the Crypto Map Configuration mode for an existing policy. UltOs(config)# crypto map crypto_map_name 3. Set the IPSec mode. UltOs(config-crypto-map)# crypto ipsec mode tunnel 4. Exit from the Crypto Map Configuration mode. UltOs(config-crypto-map)# end To view the VPN policy parameters 5. View the parameters of the VPN policy. UltOs# sh crypto map VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : Inactive Policy Type : IPSec Manual Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Security Mode : Tunnel Local & Remote Tunnel Term Addr : None <== ==> None Interface Name : Not Configured Policy Protocol : any Policy Action : Apply In/Out bound SPI : 0 / 0 Security Protocol : ESP Encryption Algo : Not Configured Anti Replay : Disable Crypto Session Status : Inactive Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0 No.of ACTIVE VPN policies = 0
CHAPTER 7: IPSEC Configuration User Manual 147 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. No.of VPN policies configured = 1 7.3.2.4 Configuring Peer Identity Peer identity refers to the destination address set in the packet during authentication and encryption of outbound datagram. This peer identity is used for IPSec SA negotiations. This section describes the steps involved in configuring the peer identity. To configure the peer identity 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Enter the Crypto Map Configuration mode for an existing policy. UltOs(config)# crypto map crypto_map_name 3. Set the peer identity. UltOs(config-crypto-map)# set peer 35.0.0.1 4. Exit from the Crypto Map Configuration mode. UltOs(config-crypto-map)# end To view the VPN policy parameters 5. View the parameters of the VPN policy. UltOs# show crypto map VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : Inactive Policy Type : IPSec Manual Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Security Mode : Tunnel Local & Remote Tunnel Term Addr : 0.0.0.0 <== ==> 35.0.0.1 Interface Name : Not Configured Policy Protocol : any Policy Action : Apply In/Out bound SPI : 0 / 0 Security Protocol : ESP Encryption Algo : Not Configured Anti Replay : Disable Crypto Session Status : Inactive Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0 No.of ACTIVE VPN policies = 0
CHAPTER 7: IPSEC Configuration User Manual 148 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. No.of VPN policies configured = 1 7.3.2.5 Configuring IPSec Session Keys The IPSec session keys are configured for a VPN policy to set the security protocol, the authentication and encryption algorithms to be applied, and the inbound and outbound security parameter index that is used to uniquely identify a SA. This section describes the steps involved in configuring the IPSec session keys. To configure the IPSec session keys 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Enter the Crypto Map Configuration mode for an existing policy. UltOs(config)# crypto map crypto_map_name 3. Configure the IPSec session key. UltOs(config-crypto-map)# set session-key authenticator esp hmac-sha1 abcdef7812345678123456781234567812345678 esp des cipher abcdef7812345678 outbound 257 inbound 256 4. Exit from the Crypto Map Configuration mode. UltOs(config-crypto-map)# end To view the VPN policy parameters 5. View the parameters of the VPN policy. UltOs# sh crypto map VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : Inactive Policy Type : IPSec Manual Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Security Mode : Tunnel Local & Remote Tunnel Term Addr : 0.0.0.0 <== ==> 35.0.0.1 Interface Name : Not Configured Policy Protocol : any Policy Action : Apply In/Out bound SPI : 256 / 257 Security Protocol : ESP Authentication Algorithm : HMAC-SHA1 Encryption Algo : DES Anti Replay : Disable Crypto Session Status : Inactive
CHAPTER 7: IPSEC Configuration User Manual 149 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0 No.of ACTIVE VPN policies = 0 No.of VPN policies configured = 1 7.3.2.6 Configuring Access List The access list is configured to specify the traffic type, action to be taken, and source and destination IP address to which the policy is applied. This section describes the steps involved in configuring the access list. Multiple access list can be configured with different indexes. To configure the access list 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Enter the Crypto Map Configuration mode for an existing policy. UltOs(config)# crypto map crypto_map_name 3. Configure the access list. UltOs(config-crypto-map)# access-list 1 apply any source 192.168.1.0 255.255.255.0 destination 192.168.2.0 255.255.255.0 4. Exit from the Crypto Map Configuration mode UltOs(config-crypto-map)# end To view the VPN policy parameters 5. View the parameters of the VPN policy. UltOs# sh crypto map VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : Inactive Policy Type : IPSec Manual Ike Version : v1 AclIndex : 1 Local & Remote Protected N/W's : 192.168.1.0/24 <-- --> 192.168.2.0/24 Security Mode : Tunnel Local & Remote Tunnel Term Addr : 0.0.0.0 <== ==> 35.0.0.1 Interface Name : Not Configured Policy Protocol : any Policy Action : Apply In/Out bound SPI : 256 / 257
CHAPTER 7: IPSEC Configuration User Manual 150 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Security Protocol : ESP Authentication Algorithm : HMAC-SHA1 Encryption Algo : DES Anti Replay : Disable Crypto Session Status : Inactive Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0 No.of ACTIVE VPN policies = 0 No.of VPN policies configured = 1 7.3.2.7 Binding of Policy The configured VPN policy is bound to particular WAN (Wide Area Network) interface for configuring the interface details and local tunnel termination address in the policy and for activating the VPN policy. This section describes the steps involved in binding the policy to the WAN interface To bind a policy to a particular WAN Interface 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Enter the Interface Configuration mode. UltOs(config)# interface wan 0/1 3. Apply the existing policy to the interface. UltOs(config-if)# crypto map crypto_map_name 4. Exit from the Interface Configuration mode. UltOs(config-if)# end To view the VPN policy parameters 5. View the parameters of the VPN policy. UltOs# show crypto map VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : Active Policy Type : IPSec Manual Ike Version : v1 AclIndex : 1 Local & Remote Protected N/W's : 192.168.1.0/24 <-- --> 192.168.2.0/24 Security Mode : Tunnel Local & Remote Tunnel Term Addr : 35.0.0.2 <== ==> 35.0.0.1
CHAPTER 7: IPSEC Configuration User Manual 151 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Interface Name : wan0/1 Policy Protocol : any Policy Action : Apply In/Out bound SPI : 256 / 257 Security Protocol : ESP Authentication Algorithm : HMAC-SHA1 Encryption Algo : DES Anti Replay : Disable Crypto Session Status : Active Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0 No.of ACTIVE VPN policies = 1 No.of VPN policies configured = 1 7.3.2.8 Removing Policy from Interface The policy assigned to the WAN interface is removed for inactivating the policy. The policy should be inactivated before deleting. Policies assigned to the WAN interface and activated cannot be deleted. To make the policy inactive 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Enter the Interface Configuration mode. UltOs(config)#interface wan 0/1 3. Make the policy inactive. UltOs(config-if)# no crypto map crypto_map_name 4. Exit from the Interface Configuration mode. UltOs(config-if)# end To view the VPN policy parameters 5. View the parameters of the VPN policy. UltOs# show crypto map crypto_map_name VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : InActive Policy Type : IKE Pre-shared Ike Version : v1 AclIndex : 1 Local & Remote Protected N/W's : 192.168.1.0/24 <-- --> 192.168.2.0/24
CHAPTER 7: IPSEC Configuration User Manual 152 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Local & Remote Port Range : 0-65535 <-- --> 0-65535 Security Mode : Tunnel Local & Remote Tunnel Term Addr : 35.0.0.1 <== ==> 35.0.0.2 7.3.2.9 Deleting Policy This section describes the steps involved in deleting the policy. The policy should be made as inactive (Refer section 7.3.2.8 for the steps) before deleting. To delete the configured policy 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Delete the configured policy. UltOs(config)# no crypto map crypto_map_name 3. Exit from the Global Configuration mode. UltOs(config)# end To check the deletion of the policy 4. View the parameters of the VPN policy. UltOs# show crypto map crypto_map_name  No output is displayed for the specified crypto name, as the VPN policy is deleted. This confirms the deletion of the VPN policy. 7.3.2.10 WEB Configuration for IPSec VPN Policy Parameters VPN IPsec Policy can be configured through the WEB interface using the VPN IPSec screen (Navigation - Security Management > VPN > VPN Settings > IPSec)
CHAPTER 7: IPSEC Configuration User Manual 153 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 7-2: VPN IPSec
CHAPTER 7: IPSEC Configuration User Manual 154 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 7.3.3 Sample Configuration This section describes the sample configuration steps to be performed for configuring the IPSec module in a switch. Figure 7-2: Topology Diagram for Sample IPSec Configuration Node Name E0 V4 ADDR E1 V4 ADDR Host 1(H1) 50.0.0.2 NA Host 2(H2) 40.0.0.2 NA FDN40-1(R1) 80.0.0.2 50.0.0.1 FDN40-2(R2) 80.0.0.1 40.0.0.1 IPSec is installed in the Router 1 and the below mentioned commands are executed to configure the IPSec policy. 1. Assigning an IP to wan 0/1. UltOs# configure terminal UltOs(config)# interface wan 0/1 UltOs(config-if)# shutdown UltOs(config-if)# ip address 80.0.0.2 255.0.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# end UltOs# 2. Enabling the VPN module. UltOs# configure terminal UltOs(config)# set vpn enable UltOs(config)#exit UltOs# 3. Creating an IPSec crypto map policy with name as sa. UltOs# configure terminal R1 and R2 – with IPSec E0 IKEv2 Negotiation R2 R1 H2 H1 E1 E1 E0
CHAPTER 7: IPSEC Configuration User Manual 155 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# crypto map sa UltOs(config-crypto-map)# 4. Configuring IPSec crypto key mode for the policy sa. UltOs(config-crypto-map)# crypto key mode ipsec-manual 5. Configuring IPSec crypto ipsec mode for the policy sa. UltOs(config-crypto-map)# crypto ipsec mode tunnel 6. Configuring IPSec crypto peer address for the policy sa. UltOs(config-crypto-map)# set peer 80.0.0.1 7. Configuring IPSec crypto session key for the policy sa. UltOs(config-crypto-map)# set session-key authenticator esp hmac-md5 12345678123456781234567812345678 esp des cipher 1234567812345678 outbound 256 inbound 257 anti-replay 8. Configuring IPSec crypto access list for the policy sa UltOs(config-crypto-map)# access-list 1 apply any source 50.0.0.0 255.255.255.0 destination 40.0.0.0 255.255.255.0 9. Mapping IPSec crypto map policy sa to E1 in the switch UltOs(config-crypto-map)# end; configure terminal UltOs(config)# interface wan 0/1 UltOs(config-if)# crypto map sa IPSec is installed in the Router 2 and the below mentioned commands are executed to configure the IPSec policy. 10. Assigning an IP to wan 0/1. UltOs# configure terminal UltOs(config)# interface wan 0/1 UltOs(config-if)# shutdown UltOs(config-if)# ip address 80.0.0.1 255.0.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# end UltOs# 11. Enabling the VPN module. UltOs# configure terminal UltOs(config)# set vpn enable UltOs(config)#exit UltOs# 12. Creating an IPSec crypto map policy with name as sa. UltOs# configure terminal UltOs(config)# crypto map sa UltOs(config-crypto-map)# 13. Configuring IPSec crypto key mode for the policy sa. UltOs(config-crypto-map)# crypto key mode ipsec-manual
CHAPTER 7: IPSEC Configuration User Manual 156 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 14. Configuring IPSec crypto ipsec mode for the policy sa. UltOs(config-crypto-map)# crypto ipsec mode tunnel 15. Configuring IPSec crypto peer address for the policy sa. UltOs(config-crypto-map)# set peer 80.0.0.2 16. Configuring IPSec crypto session key for the policy sa. UltOs(config-crypto-map)# set session-key authenticator esp hmac-md5 12345678123456781234567812345678 esp des cipher 1234567812345678 outbound 258 inbound 259 anti-replay 17. Configuring IPSec crypto access list for the policy sa UltOs(config-crypto-map)# access-list 1 apply any source 40.0.0.0 255.255.255.0 destination 50.0.0.0 255.255.255.0 18. Mapping IPSec crypto map policy sa to E1 in the switch UltOs(config-crypto-map)# end; configure terminal UltOs(config)# interface wan 0/1 UltOs(config-if)# crypto map sa
Configuration User Manual 157 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 8 IKE 8.1 Protocol Description IKE is used to set up a security association in the IPSec protocol suite. IKE protocol uses UDP (User Datagram Protocol) on port number 500 for negotiating the SAs (Security Associations) with the peers. Therefore, port 500 must be permitted on any IP interface involved in exchanging IKE packets. The negotiated key materials will be given to IPSec stack. IKE exists in two versions, IKEv1 and IKEv2. 8.1.1 IKEv1 For IKEv1, the peers establish an IKE SA (phase 1 negotiation) using either an MM (Main Mode) exchange or an AM (Aggressive Mode) exchange. After the IKE SA is established, the IKE peers use the IKE SA for phase 2 negotiation with a QM (Quick Mode) exchange that establishes an IPsec SA pair. 8.1.1.1 Phase 1 – Main/Aggressive 8.1.1.1.1 Main Mode In an MM exchange, the IKE entities use the following six messages to establish the IKE SA:  Message 1: Initiator sends IKE SA proposals.  Message 2: Responder sends accepted IKE SA proposal.  Message 3: Initiator sends its Diffie-Hellman public value.  Message 4: Responder sends its Diffie-Hellman public value.  Message 5: Initiator sends IKE ID and authentication data.
CHAPTER 8: IKE Configuration User Manual 158 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  Message 6: Responder sends IKE ID and authentication data. 8.1.1.1.2 Aggressive Mode In an AM exchange, the IKE entities use the following three messages to establish the IKE SA:  Message 1: Initiator sends IKE SA proposals, Diffie-Hellman public value, IKE ID and authentication data.  Message 2: Responder sends accepted IKE SA proposal, Diffie-Hellman public value, IKE ID, and authentication data.  Message 3: Initiator sends Diffie-Hellman secured message. 8.1.1.2 Phase 2 - Quick Mode After an IKEv1 SA is established, the two systems have a secure channel for negotiating IPsec SAs. The IPsec SAs determine IPSec transformation(s) used (ESP (Encapsulation Security Payload) and/or AH (Authentication Header)), the encryption keys for ESP/ESP and other parameters. IPsec SAs are negotiated in pairs: an outbound SA for packets from the local network to the remote network and an inbound SA for packets from the remote network to the local network. In a QM exchange, the following three messages are required to establish an IPsec SA pair:  Message 1: Initiator sends IPsec SA proposals, SPI (Security Parameter Index) and traffic IDs.  Message 2: Responder sends accepted IPsec SA proposal, SPI, and traffic IDs.  Message 3: Initiator sends hash message to prove liveness. 8.1.2 IKEv2 IKEv2 uses the following four messages to establish an IKE SA and an initial IPsec SA pair.  Initial request/response of an IKE session (IKE_SA_INIT) negotiates security parameters for the IKE_SA, sends nonces, and sends Diffie-Hellman values.  Next request/response (IKE_AUTH) transmits identities, proves knowledge of the secrets corresponding to the two identities, and sets up an SA for the first (and often only) AH and/or ESP CHILD_SA.  Child Exchange (IKE_CHILD) request/response messages are used to refresh the already existing IKE/IPSec SAs or create new IPSec SAs.  Informational Exchange (IKE_INFO) request/response messages are used to send control messages to the peer.
CHAPTER 8: IKE Configuration User Manual 159 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 8.2 IKE Configurations 8.2.1 Importing and Deleting RSA Key 8.2.1.1 Importing a RSA Key This feature is supported only in CLI mode. The section lists the CLI configuration steps to import a RSA key pair from the specified file, into the database. This configuration is used to import an RSA key pair, if the user already has a RSA key pair and corresponding certificate.  Enter the Global configuration mode. UltOs# configure terminal  Import the RSA key pair. UltOs(config)# vpn import rsa key rsakey1 file rsakeyfilename  Exit the Global configuration mode. UltOs(config)#exit  View the RSA key information. UltOs# show vpn rsa keys KeyID rsakey1 RsaKey : ******** 8.2.1.2 Deleting a RSA Key Pair This feature is supported only in CLI mode. The section lists the CLI configuration steps to delete an imported or generated RSA key pair.  Enter the Global configuration mode. UltOs# configure terminal  Delete the imported RSA key pair. UltOs(config)# no vpn rsa key index rsakey1  Exit the Global configuration mode. UltOs(config)#exit  View the RSA key information. UltOs# show vpn rsa keys  No information is displayed, as the RSA key pair is deleted. 8.2.2 Configuring Certificates 8.2.2.1 Importing a Certificate This feature is supported only in CLI mode. The section lists the CLI configuration steps to import a certificate from the specified file into the database.  Enter the Global configuration mode. UltOs# configure terminal  Import the certificate.
CHAPTER 8: IKE Configuration User Manual 160 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# vpn import cert certid file RightGty.crt encode-type PEM key rsakey1  Exit the Global Configuration mode. UltOs(config)#exit  View the certificate information. UltOs# show vpn certs index certid Cert ID: raskey1 Certificate: Data: Version: 3 (0x2) Serial Number: 2 (0x2) Signature Algorithm: md5WithRSAEncryption Issuer: C=IN, ST=AP, L=Hyd, O=AA, OU=Products, CN=SSCA/Email= Validity Not Before: Aug 16 23:27:18 2009 GMT Not After : Aug 16 23:27:18 2010 GMT Subject: C=CH, O=Linux strongSwan, CN=IssGty Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:d4:aa:32:e8:ab:70:94:5c:8e:cf:38:f8:e9:b1: b7:1a:b9:4d:72:28:71:b1:33:bb:0b:8a:6b:1e:d9: 30:a9:81:71:e5:aa:47:78:32:47:d7:89:7f:7b:2e: 81:0d:4e:e8:75:65:28:c4:49:b9:9b:96:56:91:f3: 30:c6:ba:d0:f4:bf:db:b2:ba:c7:ab:84:7e:c4:02: 20:c8:69:e3:50:82:3b:d9:c8:fd:a5:75:92:58:a2: 40:1b:af:3f:56:51:d8:d0:9a:95:8f:e0:ba:a7:cd: 2a:fb:9f:69:ce:00:45:34:08:14:c1:1f:ea:44:0d: 8d:c2:a3:2b:3d:30:af:1d:d9 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE X509v3 Key Usage: Digital Signature, Key Encipherment, Key Agreement X509v3 Subject Key Identifier:
CHAPTER 8: IKE Configuration User Manual 161 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 91:FA:E1:FF:C5:3D:6D:E1:A5:93:B0:F3:1D:E7:08:B1:EA:E8:D0:30 X509v3 Subject Alternative Name: IP Address:35.0.0.2 Signature Algorithm: md5WithRSAEncryption 6e:8b:d7:03:3a:8d:fb:e2:fa:21:bd:6e:16:45:16:56:15:3a: b3:9e:48:96:0f:79:2a:c1:81:a1:22:02:f1:a0:f2:74:d6:2f: 85:52:b3:9c:25:b7:74:db:a6:82:7c:62:19:8c:b7:0d:3e:d7: 80:5e:24:d3:aa:82:26:d8:c9:66:9a:fa:72:10:4f:cc:d2:3d: 83:26:d8:e0:ec:78:87:66:05:dd:60:4e:62:92:f1:c5:1b:85: ea:65:44:df:52:6b:50:1c:ba:f7:94:95:b0:af:02:8d:fb:56: 91:ea:56:17:18:29:3e:ec:f7:9d:cd:f7:3a:9b:a8:74:44:77: b3:e9:fa:cb:9a:11:84:04:23:cd:2a:c2:7e:c8:6a:0a:1d:2d: 6a:0d:96:10:6d:ad:cd:3f:36:95:80:6e:65:f2:18:0a:80:43: 52:f9:a0:fa:b2:53:18:00:5e:e8:fd:f2:c0:8c:60:d8:e1:2d: 07:45:b3:0b:c1:5e:12:bd:01:ed:62:e5:af:51:2f:96:bb:29: 39:ae:41:21:d0:16:e5:5b:36:ce:db:c7:5e:6c:86:72:20:63: bc:2b:b3:d5:b1:a3:f7:86:94:43:9e:21:ca:39:6a:92:8d:4a: 55:cd:44:6a:b2:68:40:f7:99:13:36:9d:5b:52:40:af:48:0f: 86:b8:68:34 8.2.2.2 Deleting a Certificate This feature is supported only in CLI mode. The section lists the CLI configuration steps to delete a certificate from the database.  Enter the Global configuration mode. UltOs# configure terminal  Delete the imported certificate. UltOs(config)# no vpn cert index certid  Exit the Global configuration mode. UltOs(config)#exit  View the certificate information. UltOs# show vpn certs index certid  No information is displayed, as the imported cerificate is deleted. 8.2.2.3 Importing a CA Certificate This feature is supported only in CLI mode. The section lists the CLI configuration steps to import a CA (Certificate Authority) certificate from the specified file into the database.  Enter the Global configuration mode. UltOs# configure terminal
CHAPTER 8: IKE Configuration User Manual 162 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  Import the CA certificate. UltOs(config)# vpn import ca-cert cacert file cacertfilename encode-type PEM  View the CA peer certificate information. UltOs# show vpn ca-certs index cacertid Cert ID: cacert Certificate: Data: Version: 3 (0x2) Serial Number: 91:13:7b:31:9f:20:9c:94 Signature Algorithm: sha1WithRSAEncryption Issuer: C=IN, ST=AP, L=Hyd, O=, OU=Products, CN=SSCA/Email=help@.com Validity Not Before: Mar 5 12:45:08 2009 GMT Not After : Mar 5 12:45:08 2010 GMT Subject: C=IN, ST=AP, L=Hyd, O=, OU=Products, CN=SSCA/Email=help@.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:de:cd:6c:38:90:dd:14:6a:ac:9d:20:78:17:85: 37:02:67:cf:47:25:b8:47:4b:28:01:ea:4e:81:ba: 54:5b:c3:0f:c0:5f:2b:bb:b5:bd:a1:60:01:f0:2f: 03:e6:16:5c:a4:c3:7b:ef:bb:b3:70:6b:9f:6e:94: 0a:1a:7c:bc:3b:f0:e1:b3:10:68:15:19:b4:c1:98: 21:36:ba:15:d5:ce:97:d0:19:db:92:dc:03:a6:f4: 8a:03:7e:47:74:d9:59:92:eb:bb:a5:c4:2e:5c:47: 7a:35:18:ed:de:08:25:3f:c7:81:0c:ac:4f:37:72: 23:1f:a3:6a:57:b7:5b:b2:05:42:a6:cb:ec:92:3e: 88:9c:97:76:9d:2a:fb:7d:53:59:6e:4b:ff:f5:ee: 43:2a:76:4d:95:e7:14:61:d7:7e:8e:e2:45:8e:5a: 1e:2a:b8:90:0d:81:8f:e7:0e:05:7d:e2:88:93:e2: 2a:ad:2c:34:6c:a6:1d:b4:32:04:ab:35:e1:ac:89: df:a1:f0:7a:2f:41:c9:b7:57:df:ac:3f:f6:22:e1: 94:29:c8:44:7e:f2:40:6c:f0:81:59:29:03:c5:e4:
CHAPTER 8: IKE Configuration User Manual 163 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2d:86:2d:47:2c:14:13:4e:a2:fa:67:a9:b0:5a:7d: a9:f2:3a:42:d8:0a:30:ba:15:76:99:c2:93:09:af: eb:f1 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 7F:B4:2F:66:3B:47:67:C4:3E:EE:DC:4A:76:62:B7:D3:7B:EF:1C:A3 X509v3 Authority Key Identifier: keyid:7F:B4:2F:66:3B:47:67:C4:3E:EE:DC:4A:76:62:B7:D3:7B:EF:1C:A3 DirName:/C=IN/ST=AP/L=Hyd/O= /OU=Products/CN=SSCA/Email=help@.com serial:91:13:7B:31:9F:20:9C:94 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha1WithRSAEncryption d1:16:98:cd:4a:01:99:f1:70:4f:7c:db:99:76:93:e4:42:40: 08:9e:e7:ee:16:41:3e:f5:22:04:b7:97:60:35:cb:09:af:6b: a0:32:7d:88:9e:5f:86:3b:d9:13:54:f1:c6:4a:2d:78:a2:ab: 03:03:c1:6a:0a:99:6a:be:c5:b8:3b:47:69:07:f4:e6:89:8c: 3f:04:99:d0:8b:80:94:a4:cc:5d:25:c9:53:38:e9:64:14:dd: 7d:8e:01:52:3d:77:44:ac:b6:af:a8:f5:02:b2:f2:3b:bc:18: 6c:8c:67:b3:e1:b0:e9:f9:9c:b1:f1:f5:70:d6:18:4c:0d:8d: 69:6e:fd:ed:89:5d:a0:35:dc:19:13:61:b2:8c:e2:93:ae:c8: 66:40:72:67:c7:c9:2e:70:49:15:09:4e:74:f7:59:7e:52:a2: 1e:bc:c9:41:96:a2:94:9f:70:70:95:4f:e9:80:a0:8f:a6:46: 0f:31:d3:9d:fa:e0:f2:ea:d8:3b:32:79:50:2b:19:1b:8c:e0: 97:76:c7:99:e4:f5:49:ec:16:52:2b:0c:a6:ba:f1:45:d4:80: c2:63:c3:90:9f:e1:7f:be:1d:73:75:e4:12:d1:6c:c7:59:1b: 92:25:d3:cd:10:95:b7:c0:09:e2:48:f2:14:22:91:5d:1e:08: 3e:b6:6c:fd 8.2.2.4 Deleting a CA Certificate This feature is supported only in CLI mode. The section lists the CLI configuration steps to delete a CA certificate from the database.  Enter the Global configuration mode. UltOs# configure terminal  Delete the CA certificate.
CHAPTER 8: IKE Configuration User Manual 164 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# no vpn ca-cert index cacert  View the certificate information. UltOs# show vpn ca-certs index cacertid  No information is displayed, as the CA cerificate is deleted. 8.2.2.5 Importing a Peer Certificate This feature is supported only in CLI mode. The section lists the CLI configuration steps to import a peer’s certificate from the specified file into the database.  Enter the Global configuration mode. UltOs# configure terminal  Import the peer certificate. UltOs(config)# vpn import peer-cert peercertid1 file peercertfilename encode-type PEM trusted  View the certificate information. UltOs# show vpn peer-certs index peercertid1 Trusted peer certificates Certificate: Data: Version: 3 (0x2) Serial Number: 2 (0x2) Signature Algorithm: md5WithRSAEncryption Issuer: C=IN, ST=AP, L=Hyd, O=, OU=Products, CN=SSCA/Email=help@.com Validity Not Before: Aug 16 23:27:18 2009 GMT Not After : Aug 16 23:27:18 2010 GMT Subject: C=CH, O=Linux strongSwan, CN=IssGty Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:d4:aa:32:e8:ab:70:94:5c:8e:cf:38:f8:e9:b1: b7:1a:b9:4d:72:28:71:b1:33:bb:0b:8a:6b:1e:d9: 30:a9:81:71:e5:aa:47:78:32:47:d7:89:7f:7b:2e: 81:0d:4e:e8:75:65:28:c4:49:b9:9b:96:56:91:f3: 30:c6:ba:d0:f4:bf:db:b2:ba:c7:ab:84:7e:c4:02: 20:c8:69:e3:50:82:3b:d9:c8:fd:a5:75:92:58:a2: 40:1b:af:3f:56:51:d8:d0:9a:95:8f:e0:ba:a7:cd: 2a:fb:9f:69:ce:00:45:34:08:14:c1:1f:ea:44:0d:
CHAPTER 8: IKE Configuration User Manual 165 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 8d:c2:a3:2b:3d:30:af:1d:d9 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE X509v3 Key Usage: Digital Signature, Key Encipherment, Key Agreement X509v3 Subject Key Identifier: 91:FA:E1:FF:C5:3D:6D:E1:A5:93:B0:F3:1D:E7:08:B1:EA:E8:D0:30 X509v3 Subject Alternative Name: IP Address:35.0.0.2 Signature Algorithm: md5WithRSAEncryption 6e:8b:d7:03:3a:8d:fb:e2:fa:21:bd:6e:16:45:16:56:15:3a: b3:9e:48:96:0f:79:2a:c1:81:a1:22:02:f1:a0:f2:74:d6:2f: 85:52:b3:9c:25:b7:74:db:a6:82:7c:62:19:8c:b7:0d:3e:d7: 80:5e:24:d3:aa:82:26:d8:c9:66:9a:fa:72:10:4f:cc:d2:3d: 83:26:d8:e0:ec:78:87:66:05:dd:60:4e:62:92:f1:c5:1b:85: ea:65:44:df:52:6b:50:1c:ba:f7:94:95:b0:af:02:8d:fb:56: 91:ea:56:17:18:29:3e:ec:f7:9d:cd:f7:3a:9b:a8:74:44:77: b3:e9:fa:cb:9a:11:84:04:23:cd:2a:c2:7e:c8:6a:0a:1d:2d: 6a:0d:96:10:6d:ad:cd:3f:36:95:80:6e:65:f2:18:0a:80:43: 52:f9:a0:fa:b2:53:18:00:5e:e8:fd:f2:c0:8c:60:d8:e1:2d: 07:45:b3:0b:c1:5e:12:bd:01:ed:62:e5:af:51:2f:96:bb:29: 39:ae:41:21:d0:16:e5:5b:36:ce:db:c7:5e:6c:86:72:20:63: bc:2b:b3:d5:b1:a3:f7:86:94:43:9e:21:ca:39:6a:92:8d:4a: 55:cd:44:6a:b2:68:40:f7:99:13:36:9d:5b:52:40:af:48:0f: 86:b8:68:34 8.2.2.6 Deleting Peer Certificate This feature is supported only in CLI mode. The section lists the CLI configuration steps to import a peer’s certificate from database.  Enter the Global configuration mode. UltOs# configure terminal  Delete the peer certificate. UltOs(config)# no vpn import peer-cert index peercertid1  View the peer certificate information. UltOs# show vpn peer-certs index peercertid1  No information is displayed, as the peer certificate is deleted.
CHAPTER 8: IKE Configuration User Manual 166 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 8.2.3 Configuring Remote Identity and Authentication Method This section lists the CLI configuration steps to configure the the peer or remote identity and authentication method. 8.2.3.1 Authentication Method Preshered-Key This section lists the CLI configuration steps to configure a remote identity with authentication method as preshared-key.  Enter the Global configuration mode. UltOs# configure terminal  Configure the pre-shared key for the peer. UltOs(config)# vpn remote identity ipv4 35.0.0.2 psk mypresharedkey  Exit the Global configuration mode. UltOs(config)#exit  View the configured remote identity. UltOs# show vpn remote-ids Remote identity information table: Identity type Identity Value ------------- -------------- IPv4 35.0.0.2 No.of remote-id's displayed: 1 8.2.3.2 Authentication Method RSA Certificate This section lists the CLI configuration steps to configure authentication method as RSA certificate.  Enter the Global configuration mode. UltOs# configure terminal  Map the certificate to the peer. UltOs(config)# vpn remote identity ipv4 35.0.0.2 cert rsakey1  Exit the Global configuration mode. UltOs(config)#exit  View the configured remote identity. UltOs# show vpn remote-ids Remote identity information table: Identity type Identity Value ------------- -------------- IPv4 35.0.0.2 No.of remote-id's displayed: 1  View the certificate mapped to the peer. UltOs# show vpn map-cert
CHAPTER 8: IKE Configuration User Manual 167 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. KeyID rsakey1 PeerID type: (ipv4) PeerID: 35.0.0.2 8.2.3.3 Deleting a Configured Remote Identity This section lists the CLI configuration steps to delete a configured remote identity.  Enter the Global configuration mode. UltOs# configure terminal  Delete the configured remote identity. UltOs(config)# no vpn remote identity ipv4 35.0.0.2  Exit the Global configuration mode. UltOs(config)#exit  View the configured remote identities. UltOs# show vpn remote-ids Remote identity information table: Identity type Identity Value ------------- -------------- No.of remote-id's displayed: 0  No information is displayed, as the remote identity is deleted. 8.2.3.4 WEB Configuration VPN remote identity and authentication can be configured through WEB interface using the VPN Global Settings screen (Navigation - Security Management > VPN > VPN Settings) Screen 8-1: VPN Global Setings
CHAPTER 8: IKE Configuration User Manual 168 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 8.2.4 Creating VPN Policy This section lists the CLI configuration steps to create a VPN policy which will define the VPN policy to be negotiated for SA creation. 8.2.4.1 CLI Configuration  Enter the Global configuration mode. UltOs# configure terminal  Enter the policy configuration mode. UltOs(config)# crypto map sa  Exit the policy configuration mode. UltOs(config)#end  View the policy created. A policy will be created with the default values. UltOs# show crypto map sa VPN Policy Parameters ------------------------- Policy Name : sa Policy Status : Inactive Policy Type : IKE Pre-shared Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Security Mode : Tunnel Local & Remote Tunnel Term Addr : None <== ==> None Interface Name : Not Configured Policy Protocol : any Policy Action : Apply Anti Replay : Disable IKE suite Info [PHASE I] : Encryption Algo : 3DES Hash Algorithm : HMAC SHA1 Diffie-Hellman Group : DH Group 2 IKE Exchange Mode : Main Life Time : 2400 Secs Identity Information : Local Identity Type : Default Local Identity value : Peer Identity Type : Default Peer Identity value : IPSEC suite Info [Phase II] :
CHAPTER 8: IKE Configuration User Manual 169 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Protocol : ESP Encryption Algo : Not Confgiured Perfect Forward Secrecy : Not Confgiured Life Time : 800 Secs No.of ACTIVE VPN policies = 0 No.of VPN policies configured = 1 8.2.4.2 WEB Configuration  VPN Policies can be created through WEB interface using the VPN IPSec screen (Navigation - Security Management > Firewall > Access List) or VPN IKE screen (Navigation - Security Management > VPN > VPN Settings > IKE Pre-shared Secret)  The Policy details can be viewed through WEB interface using the VPN Policy screen (Navigation - Security Management > VPN > VPN Settings > VPN Policy) Screen 8-2: VPN Policy
CHAPTER 8: IKE Configuration User Manual 170 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 8.2.5 Configuring VPN IKE Policy Parameters 8.2.5.1 Configuring IKE Version This section lists the CLI configuration steps to configure the IKE version.  Enter the Global configuration mode. UltOs# configure terminal  Enter the policy configuration mode. UltOs(config)# crypto map sa  Set the IKE version (v1 or v2). UltOs(config-crypto-map)# set ike version v1  Exit the policy configuration mode. UltOs(config-crypto-map)#end  View the configured IKE version. UltOs# show crypto map sa VPN Policy Parameters ------------------------- Policy Name : sa Policy Status : Inactive Policy Type : IKE x509 Certificate Ike Version : v1 8.2.5.2 Configuring Key Mode This section lists the CLI configuration steps to configure the certificate mode and the preshared key mode. 8.2.5.2.1 Certificate Mode This section lists the CLI configuration steps to configure key mode as certificate.  Enter the Global configuration mode. UltOs# configure terminal  Enter the policy configuration mode. UltOs(config)# crypto map sa  Set the authentication method. UltOs(config-crypto-map)# crypto key mode cert  Exit the policy configuration mode. UltOs(config-crypto-map)#end  View the configured certificate key mode. UltOs# show crypto map sa VPN Policy Parameters -------------------------
CHAPTER 8: IKE Configuration User Manual 171 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Policy Name : sa Policy Status : Inactive Policy Type : IKE x509 Certificate Ike Version : v1 8.2.5.2.2 Preshared Key Mode This section lists the CLI configuration steps to configure key mode as preshared key.  Enter the Global configuration mode. UltOs# configure terminal  Enter the policy configuration mode. UltOs(config)# crypto map sa  Set the authentication method. UltOs(config-crypto-map)# crypto key mode preshared  Exit the policy configuration mode. UltOs(config-crypto-map)#end  View the configured preshared key mode. UltOs# show crypto map sa VPN Policy Parameters ------------------------- Policy Name : sa Policy Status : Inactive Policy Type : IKE Pre-shared Ike Version : v1 8.2.5.3 Configuring Peer IP This section lists the CLI configuration steps to configure the remote or peer IP.  Enter the Global configuration mode. UltOs# configure terminal  Enter the policy configuration mode. UltOs(config)# crypto map sa  Set the peer IP. UltOs(config-crypto-map)# set peer 35.0.0.2  Exit the policy configuration mode. UltOs(config-crypto-map)#end  View the configured peer IP. UltOs# show crypto map sa VPN Policy Parameters -------------------------
CHAPTER 8: IKE Configuration User Manual 172 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Policy Name : sa Policy Status : Inactive Policy Type : IKE Pre-shared Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Security Mode : Tunnel Local & Remote Tunnel Term Addr : 0.0.0.0 <== ==> 35.0.0.2 8.2.5.4 Configuring IPSec Mode This section lists the CLI configuration steps to configure the IPSec mode. 8.2.5.4.1 Tunnel Mode This section lists the CLI configuration steps to configure the IPSec mode as tunnel.  Enter the Global configuration mode. UltOs# configure terminal  Enter the policy configuration mode. UltOs(config)# crypto map sa  Set the IPSec mode as tunnel. UltOs(config-crypto-map)# crypto ipsec mode tunnel  Exit the policy configuration mode. UltOs(config-crypto-map)#end  View the configured IPSec mode. UltOs# show crypto map sa VPN Policy Parameters ------------------------- Policy Name : sa Policy Status : Inactive Policy Type : IKE Pre-shared Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Security Mode : Tunnel Local & Remote Tunnel Term Addr : 0.0.0.0 <== ==> 35.0.0.2 8.2.5.5 Configuring Remote Identity This section lists the CLI configuration steps to configure the remote identity of type IPv4.  Enter the Global configuration mode. UltOs# configure terminal
CHAPTER 8: IKE Configuration User Manual 173 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  Enter the policy configuration mode. UltOs(config)# crypto map sa  Configure the remote identity. UltOs(config-crypto-map)# )# isakmp peer identity ipv4 35.0.0.2  Exit the policy configuration mode. UltOs(config-crypto-map)#end  View the configured remote identity. UltOs# show crypto map sa VPN Policy Parameters ------------------------- Policy Name : sa Policy Status : Inactive Policy Type : IKE Pre-shared Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Security Mode : Tunnel Local & Remote Tunnel Term Addr : 0.0.0.0 <== ==> 35.0.0.2 Interface Name : Not Configured Policy Protocol : any Policy Action : Apply Anti Replay : Disable IKE suite Info [PHASE I] : Encryption Algo : 3DES Hash Algorithm : HMAC SHA1 Diffie-Hellman Group : DH Group 2 IKE Exchange Mode : Main Life Time : 2400 Secs Identity Information : Local Identity Type : Default Local Identity value : Peer Identity Type : IPv4 Peer Identity value : 35.0.0.2 8.2.5.6 Configuring Local Identity This section lists the CLI configuration steps to configure the local identity of type IPv4.  Enter the Global configuration mode. UltOs# configure terminal
CHAPTER 8: IKE Configuration User Manual 174 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  Enter the policy configuration mode. UltOs(config)# crypto map sa  Configure the local identity. UltOs(config-crypto-map)# )# isakmp local identity ipv4 35.0.0.1  Exit the policy configuration mode. UltOs(config-crypto-map)#end  View the configured local identity. UltOs# show crypto map sa VPN Policy Parameters ------------------------- Policy Name : sa Policy Status : Inactive Policy Type : IKE Pre-shared Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Security Mode : Tunnel Local & Remote Tunnel Term Addr : 0.0.0.0 <== ==> 35.0.0.2 Interface Name : Not Configured Policy Protocol : any Policy Action : Apply Anti Replay : Disable IKE suite Info [PHASE I] : Encryption Algo : 3DES Hash Algorithm : HMAC SHA1 Diffie-Hellman Group : DH Group 2 IKE Exchange Mode : Main Life Time : 2400 Secs Identity Information : Local Identity Type : IPv4 Local Identity value : 35.0.0.1 Peer Identity Type : IPv4 Peer Identity value : 35.0.0.2 8.2.5.7 Configuring Phase 1 Parameters This section provides the configuration details of phase 1 parameters for IKEv1 and IKEv2.
CHAPTER 8: IKE Configuration User Manual 175 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 8.2.5.7.1 For IKEv1 This section lists the CLI configuration steps to configure phase 1 parameters for the main mode.  Enter the Global configuration mode. UltOs# configure terminal  Enter the policy configuration mode. UltOs(config)# crypto map sa  Set the phase 1 parameters. UltOs(config-crypto-map)# )# isakmp policy encryption des hash md5 dh group2 exch main lifetime secs 1500  Exit the policy configuration mode. UltOs(config-crypto-map)#end  View the configured phase 1 parameters. UltOs# show crypto map sa VPN Policy Parameters ------------------------- Policy Name : sa Policy Status : Inactive Policy Type : IKE Pre-shared Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Local & Remote Port Range : 0-65535 <-- --> 0-65535 Security Mode : Tunnel Local & Remote Tunnel Term Addr : 0.0.0.0 <== ==> 35.0.0.2 Interface Name : Not Configured Policy Protocol : any Policy Action : Apply Anti Replay : Enable IKE suite Info [PHASE I] : Encryption Algo : DES Hash Algorithm : HMAC MD5 Diffie-Hellman Group : DH Group 2 IKE Exchange Mode : Main Life Time : 1500 Secs Identity Information : Local Identity Type : IPv4
CHAPTER 8: IKE Configuration User Manual 176 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 8.2.5.7.2 For IKEv2 This section lists the CLI configuration steps to configure phase 1 parameters for IKEv2.  Enter the Global configuration mode. UltOs# configure terminal  Enter the policy configuration mode. UltOs(config)# crypto map sa  Set the phase 1 parameters. UltOs(config-crypto-map)# )# isakmp policy encryption des hash md5 dh group2 lifetime secs 1500  Exit the policy configuration mode. UltOs(config-crypto-map)#end  View the configured phase 1 parameters. UltOs# show crypto map sa VPN Policy Parameters ------------------------- Policy Name : sa Policy Status : Inactive Policy Type : IKE Pre-shared Ike Version : v2 Local & Remote Protected N/W's : None <-- --> None Local & Remote Port Range : 0-65535 <-- --> 0-65535 Security Mode : Tunnel Local & Remote Tunnel Term Addr : 0.0.0.0 <== ==> 35.0.0.2 Interface Name : Not Configured Policy Protocol : any Policy Action : Apply Anti Replay : Enable IKE suite Info [PHASE I] : Encryption Algo : DES Hash Algorithm : HMAC MD5 Diffie-Hellman Group : DH Group 2 Life Time : 1500 Secs Identity Information : Local Identity Type : IPv4
CHAPTER 8: IKE Configuration User Manual 177 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 8.2.5.8 Configuring Phase 2 Parameters This section provides the configuration details of phase 2 parameters for ESP protocol. 8.2.5.8.1 ESP Protocol with Integrity This section lists the CLI configuration steps to configure phase-2 parameters for ESP protocol.  Enter the Global configuration mode. UltOs# configure terminal  Enter the policy configuration mode. UltOs(config)# crypto map sa  Set the phase 2 parameters for ESP. UltOs(config-crypto-map)# )# crypto map ipsec encryption esp des authentication esp sha1 pfs group2 lifetime secs 300  Exit the policy configuration mode. UltOs(config-crypto-map)#end  View the configured phase 2 parameters. UltOs# show crypto map sa VPN Policy Parameters ------------------------- Policy Name : sa Policy Status : Inactive Policy Type : IKE Pre-shared Ike Version : v2 Local & Remote Protected N/W's : None <-- --> None Local & Remote Port Range : 0-65535 <-- --> 0-65535 Security Mode : Tunnel Local & Remote Tunnel Term Addr : 0.0.0.0 <== ==> 35.0.0.2 Interface Name : Not Configured Policy Protocol : any Policy Action : Apply Anti Replay : Enable IKE suite Info [PHASE I] : Encryption Algo : DES Hash Algorithm : HMAC MD5 Diffie-Hellman Group : DH Group 2 Life Time : 1500 Secs Identity Information :
CHAPTER 8: IKE Configuration User Manual 178 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Local Identity Type : IPv4 Local Identity value : 35.0.0.1 Peer Identity Type : IPv4 Peer Identity value : 35.0.0.2 IPSEC suite Info [Phase II] : Protocol : ESP Encryption Algo : DES Authenticator : HMAC-SHA1 Perfect Forward Secrecy : DH Group 2 Life Time : 300 Secs 8.2.5.9 Configuring Access-list This section provides the configuration details of access-list for tunnel policy and transport policy. 8.2.5.9.1 Access-list for Tunnel Policy This section lists the CLI configuration steps to configure access-list for tunnel policy.  Enter the Global configuration mode. UltOs# configure terminal  Enter the policy configuration mode. UltOs(config)# crypto map sa  Set the access-list for the tunnel mode. UltOs(config-crypto-map)#access-list apply any source 192.168.1.0 255.255.255.0 destination 192.168.2.0 255.255.255.0  Exit the policy configuration mode. UltOs(config-crypto-map)#end  View the configured access-list. UltOs# show crypto map sa VPN Policy Parameters ------------------------- Policy Name : sa Policy Status : Inactive Policy Type : IKE Pre-shared Ike Version : v1 Local & Remote Protected N/W's : 192.168.1.0/24 <-- --> 192.168.2.0/24 Local & Remote Port Range : 0-65535 <-- --> 0-65535
CHAPTER 8: IKE Configuration User Manual 179 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Security Mode : Tunnel 8.2.5.10 Attaching the Policy to the Interface This section lists the CLI configuration steps to make the policy active.  Enter the Global configuration mode. UltOs# configure terminal  Make the policy active and bind to the WAN port. UltOs(config)#interface wan 0/1 UltOs(config-if)# crypto map sa  Exit from the interface configuration mode. UltOs(config-if)# end  View the policy active status. UltOs# show crypto map sa VPN Policy Parameters ------------------------- Policy Name : sa Policy Status : Active Policy Type : IKE Pre-shared Ike Version : v1 Local & Remote Protected N/W's : 192.168.1.0/24 <-- --> 192.168.2.0/24 Local & Remote Port Range : 0-65535 <-- --> 0-65535 Security Mode : Tunnel Local & Remote Tunnel Term Addr : 35.0.0.1 <== ==> 35.0.0.2 Interface Name : lan 0/1 8.2.5.11 Removing the Policy from the Interface This section lists the CLI configuration steps to make the policy inactive.  Enter the Global configuration mode. UltOs# configure terminal  Make the policy inactive. UltOs(config)#interface wan 0/1 UltOs(config-if)# no crypto map sa  Exit from the interface configuration mode. UltOs(config-if)# end  View the policy inactive status. UltOs# show crypto map sa VPN Policy Parameters
CHAPTER 8: IKE Configuration User Manual 180 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. ------------------------- Policy Name : sa Policy Status : InActive Policy Type : IKE Pre-shared Ike Version : v1 Local & Remote Protected N/W's : 192.168.1.0/24 <-- --> 192.168.2.0/24 Local & Remote Port Range : 0-65535 <-- --> 0-65535 Security Mode : Tunnel Local & Remote Tunnel Term Addr : 35.0.0.1 <== ==> 35.0.0.2 8.2.5.12 Deleting the Policy This section lists the CLI configuration steps to delete the configured policy.  Enter the Global configuration mode. UltOs# configure terminal  Delete the configured policy. UltOs(config)# no crypto map sa  Exit from the global configuration mode. UltOs(config)# end  View the configuration to check the policy being deleted. UltOs# show crypto map sa  No information is displayed, as the configured crypto map is deleted. 8.2.5.13 Web Configuration for VPN IKE Policy VPN IKE Policy can be configured using the VPN IKE screen (Navigation - Security Management > VPN > VPN Settings > IKE Pre-shared Secret)
CHAPTER 8: IKE Configuration User Manual 181 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 8-3: VPN IKE
CHAPTER 8: IKE Configuration User Manual 182 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 8.2.6 Displaying the VPN Statistics 8.2.6.1 CLI Configuration This section lists the CLI command to view the VPN global statistics. UltOs# show vpn global statistics VPN Global Statistics: -------------------------------- Packets In : 41 Packets Out : 18 Packets Secured : 0 Packets Dropped : 7 8.2.6.2 WEB Configuration VPN statistics can be viewed through WEB interface using the VPN Statistics screen (Navigation - Statistics > VPN) Screen 8-4: VPN Statistics
CHAPTER 8: IKE Configuration User Manual 183 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 8.3 IKE Examples This chapter provides the sample topology setup and various sample configurations of IKEthrough CLI. Figure 8-1: IKE Topology Node Interface Index/Name Interface IP Address DUT1 WAN 35.0.0.1 DUT2 WAN 35.0.0.2 DUT1 LAN 192.168.1.1 DUT2 LAN 192.168.2.1 H1 E0 192.168.1.10 R1 E0 192.168.2.10 8.3.1 General Configuration To configure a WAN port, execute the following CLI commands: UltOs#configure terminal UltOs(config)# interface wan 0/1 UltOs(config-if)# shutdown UltOs(config-if)# ip address 35.0.0.1 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# end 8.3.2 Configuring IKEv1 - Tunnel Mode - Preshared key Tunnel mode is most commonly used between gateways, or at an end-station to a gateway. The gateway acts as a proxy for the hosts behind it. In IKE Topology , tunnel mode is used to setup an IPSec tunnel between H1 and R1. FDN40 DUT2 / Ravpn Client / Ravpn Server) R1 DUT1 FDN40 H1 WAN WAN LAN LAN E0 E0
CHAPTER 8: IKE Configuration User Manual 184 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. This section describes the procedure to configure the IKEv1 site-to-site tunnel mode policy with the authentication method as preshared key. 8.3.2.1 DUT1 Configuration Execute the following steps in DUT1:  Enter the Global configuration mode. UltOs# configure terminal  Configure the pre-shared key for the peer. UltOs(config)# vpn remote identity ipv4 35.0.0.2 psk mypresharedkey  Enter the policy configuration mode. UltOs(config)# crypto map sa  Set the IKE version. UltOs(config-crypto-map)# set ike version v1  Set the authentication method. UltOs(config-crypto-map)# crypto key mode preshared  Set the IPSec mode as tunnel. UltOs(config-crypto-map)# crypto ipsec mode tunnel  Set the peer IP (DUT2 WAN IP). UltOs(config-crypto-map)# set peer 35.0.0.2  Set the peer identity. UltOs(config-crypto-map)# isakmp peer identity ipv4 35.0.0.2  Set the local identity. UltOs(config-crypto-map)# isakmp local identity ipv4 35.0.0.1  Set the phase 1 parameters. UltOs(config-crypto-map)# isakmp policy encryption des hash md5 dh group2 exch main lifetime secs 1500  Set the phase 2 parameters. UltOs(config-crypto-map)# crypto map ipsec encryption esp des authentication esp sha1 pfs group2 lifetime secs 300  Set the access-list parameters. UltOs(config-crypto-map)#access-list apply any source 192.168.1.0 255.255.255.0 destination 192.168.2.0 255.255.255.0  Exit from the policy configuration mode. UltOs(config-crypto-map)#exit  Make the policy active and bind to the WAN port. UltOs(config)#interface wan 0/1 UltOs(config-if)# crypto map sa  Exit from the interface configuration mode. UltOs(config-if)# end  View the configured VPN policy. UltOs# show crypto map sa
CHAPTER 8: IKE Configuration User Manual 185 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. VPN Policy Parameters ------------------------- Policy Name : sa Policy Status : Active Policy Type : IKE Pre-shared Ike Version : v1 Local & Remote Protected N/W's : 192.168.1.0/24 <-- --> 192.168.2.0/24 Local & Remote Port Range : 0-65535 <-- --> 0-65535 Security Mode : Tunnel Local & Remote Tunnel Term Addr : 35.0.0.1 <== ==> 35.0.0.2 Interface Name : wan 0/1 Policy Protocol : any Policy Action : Apply Anti Replay : Enable IKE suite Info [PHASE I] : Encryption Algo : DES Hash Algorithm : HMAC MD5 Diffie-Hellman Group : DH Group 2 IKE Exchange Mode : Main Life Time : 1500 Secs Identity Information : Local Identity Type : IPv4 Local Identity value : 35.0.0.1 Peer Identity Type : IPv4 Peer Identity value : 35.0.0.2 IPSEC suite Info [Phase II] : Protocol : ESP Encryption Algo : DES Authenticator : HMAC-SHA1 Perfect Forward Secrecy : DH Group 2 Life Time : 300 Secs Crypto Session Status : Inactive Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0
CHAPTER 8: IKE Configuration User Manual 186 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 8.3.2.2 DUT2 Configuration Execute the following steps in DUT2:  Enter the Global configuration mode. UltOs# configure terminal  Configure the pre-shared key for the peer. UltOs(config)# vpn remote identity ipv4 35.0.0.1 psk mypresharedkey  Enter the policy configuration mode. UltOs(config)# crypto map sa  Set the IKE version. UltOs(config-crypto-map)# set ike version v1  Set the authentication method. UltOs(config-crypto-map)# crypto key mode preshared  Set the IPSec mode as tunnel. UltOs(config-crypto-map)# crypto ipsec mode tunnel  Set the peer IP (DUT1 WAN IP). UltOs(config-crypto-map)# set peer 35.0.0.1  Set the peer identity. UltOs(config-crypto-map)# isakmp peer identity ipv4 35.0.0.1  Set the local identity. UltOs(config-crypto-map)# isakmp local identity ipv4 35.0.0.2  Set the phase 1 parameters. UltOs(config-crypto-map)# isakmp policy encryption des hash md5 dh group2 exch main lifetime secs 1500  Set the phase 2 parameters. UltOs(config-crypto-map)# crypto map ipsec encryption esp des authentication esp sha1 pfs group2 lifetime secs 300  Set the access-list parameters. UltOs(config-crypto-map)#access-list apply any source 192.168.2.0 255.255.255.0 destination 192.168.1.0 255.255.255.0  Exit from the policy configuration mode. UltOs(config-crypto-map)#exit  Make the policy active and bind to the WAN port. UltOs(config)#interface wan 0/1 UltOs(config-if)# crypto map sa  Exit from the interface configuration mode. UltOs(config-if)# end  View the configured VPN policy. UltOs# show crypto map sa VPN Policy Parameters -------------------------
CHAPTER 8: IKE Configuration User Manual 187 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Policy Name : sa Policy Status : Active Policy Type : IKE Pre-shared Ike Version : v1 Local & Remote Protected N/W's : 192.168.2.0/24 <-- --> 192.168.1.0/24 Local & Remote Port Range : 0-65535 <-- --> 0-65535 Security Mode : Tunnel Local & Remote Tunnel Term Addr : 35.0.0.2 <== ==> 35.0.0.1 Interface Name : wan 0/1 Policy Protocol : any Policy Action : Apply Anti Replay : Enable IKE suite Info [PHASE I] : Encryption Algo : DES Hash Algorithm : HMAC MD5 Diffie-Hellman Group : DH Group 2 IKE Exchange Mode : Main Life Time : 1500 Secs Identity Information : Local Identity Type : IPv4 Local Identity value : 35.0.0.2 Peer Identity Type : IPv4 Peer Identity value : 35.0.0.1 IPSEC suite Info [Phase II] : Protocol : ESP Encryption Algo : DES Authenticator : HMAC-SHA1 Perfect Forward Secrecy : DH Group 2 Life Time : 300 Secs Crypto Session Status : Inactive Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0
Configuration User Manual 189 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 9 Firewall 9.1 Topology Figure 9-1: Firewall Topology Table 9-1: IPv4 Addresses of Interfaces and Hosts Interface Index/Name Interface IPv4 Address LAN0/1 10.0.0.1 WAN0/1 80.0.0.1 H1 10.0.0.10 H2 80.0.0.10 9.2 Default Configurations When system comes up, FIREWALL is operationally disabled. Firewall Configurations Wan0/1 Lan0/1 FDN40-1 H2 H1 Host in WAN Network Host in LAN Network
CHAPTER 9: FIREWALL Configuration User Manual 190 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 9.2.1 Enabling and Disabling Firewall Module This section describes the steps involved in enabling and disabling the Firewall module globally. By default, firewall module is enabled. 9.2.1.1 CLI Configuration To enable firewall: 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Enable the Firewall module. UltOs(config)# firewall UltOs(config-firewall)# enable 3. Exit from the Global Configuration mode. UltOs(config-firewall)# end To disable firewall: 4. Enter the Global Configuration mode. UltOs# configure terminal 5. Disable the Firewall module. UltOs(config)# firewall UltOs(config-firewall)# disable 6. Exit from the Global Configuration mode. UltOs(config-firewall)# end To view the firewall status 7. View the firewall settings. UltOs# show firewall config Firewall Configuration ---------------------- Firewall Status : Enabled Trap Status : Disabled Max Filters : 10000 Max Access-Lists : 10000 Trap Threshold Configured : 50 IP Inspect Option : src-route 9.2.1.2 WEB Configuration To enable /disable firewall, Configure Firewall Status field from the Firewall Basic Settings screen (Navigation - Security Management > Firewall > Basic Settings)
CHAPTER 9: FIREWALL Configuration User Manual 191 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 9-1: Firewall Basic Settings 9.2.2 Configuring Firewall Filters for IPv4 Traffic from the private network to the Internet is regulated using Outbound Rules. These rules determine the services to which the users in the private network have access. Traffic from the Internet is regulated using Inbound Rules. These rules determine the access for the outsiders to use the private resources. Firewall rules are used to permit or deny specific traffic. The type of traffic is defined by a firewall filter, and the decision to permit or deny is defined by a firewall access list. A rule is an access list policy which uses a firewall filter to process any packet. Firewall, by default, allows outbound traffic from the computers in the private network to the Internet only for the following services:  FTP (Port 21)  HTTP (80) and HTTPS (Port 443)  SSH(22)  SNMP(161)  SNMPTRAP(162)  ISAKMP(500)  IPSEC NAT TRAVERSAL(4500) All other outbound traffic is blocked by Firewall. This section describes the steps involved in creation and deletion of firewall filters. 9.2.2.1 CLI Configuration To create a firewall filter: 1. Go to Global configuration mode. UltOs# configure terminal 2. Enter the firewall mode. UltOs(config)# firewall
CHAPTER 9: FIREWALL Configuration User Manual 192 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 3. Create a new firewall filter to to match the source IP address matches with LAN hostH1, destination IP address matches with H2, any protocol, any source port and destination port. UltOs(config-firewall)# filter add filter1 10.0.0.10/32 80.0.0.10/32 any To view firewall filters UltOs# show firewall filters Firewall Filters ---------------- Filter Proto Source Destination Src port/ Dest port/ TCP Address Address Icmp type Icmp code Flags ------ ----- ------- ------- -------- -------- ----- filter1 any 10.0.0.10/32 80.0.0.10/32 >1 >1 NA Def_AH_Filter 51 0.0.0.0/0 192.168.1.1/24 >1 >1 NA Def_ESP_Filter 50 0.0.0.0/0 192.168.1.1/24 >1 >1 NA Def_FTP_Filter tcp 0.0.0.0/0 192.168.1.1/24 >1 =21 any Def_SSH_Filter tcp 0.0.0.0/0 192.168.1.1/24 >1 =22 any Def_HTTP_Filter tcp 0.0.0.0/0 192.168.1.1/24 >1 =80 any Def_ICMP_Filter icmp 0.0.0.0/0 0.0.0.0/0 any any NA Def_SNMP_Filter udp 0.0.0.0/0 192.168.1.1/24 >1 =161 NA Def_HTTPS_Filter tcp 0.0.0.0/0 192.168.1.1/24 >1 =443 any Def_TELNET_Filter tcp 0.0.0.0/0 192.168.1.1/24 >1 =6023 any Def_IKE_UDP_Filter udp 0.0.0.0/0 192.168.1.1/24 >1 =500 NA Def_SNTP_UDP_Filter udp 0.0.0.0/0 0.0.0.0/0 >1 =123 NA Def_SNMP_Trap_Filter udp 0.0.0.0/0 192.168.1.1/24 >1 =162 NA Def_IKE_NAT_UDP_Filter udp 0.0.0.0/0 192.168.1.1/24 >1 =4500 NA Def_IKE_UDP_Loc_Filter udp 0.0.0.0/0 0.0.0.0/0 >1 =500 NA
CHAPTER 9: FIREWALL Configuration User Manual 193 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. This below section describes the steps involved in deleting the ipv4 firewall filter. To delete the configured ipv4 firewall filter 4. Enter the Global Configuration mode. UltOs# configure terminal 5. Enter into firewall mode UltOs(config)# firewall 6. Delete the ipv4 firewall filter UltOs(config-firewall)# no filter filter1 The below section describes the steps needed to create filters to filter packets from WAN Host to LAN host. To create a firewall filter: 7. Go to Global configuration mode. UltOs# configure terminal 8. Enter the firewall mode. UltOs(config)# firewall 9. Create a new firewall filter to to match the source IP address as WAN host IP, destination IP address as LAN host IP, tcp protocol, any source port and destination port. UltOs(config-firewall)# filter add filter2 80.0.0.10/32 10.0.0.10/32 tcp To view firewall filters UltOs# show firewall filters Firewall Filters ---------------- Filter Proto Source Destination Src port/ Dest port/ TCP Address Address Icmp type Icmp code Flags ------ ----- ------- ------- -------- -------- ----- filter1 any 10.0.0.10/32 80.0.0.10/32 >1 >1 NA filter2 tcp 80.0.0.10/32 10.0.0.10/32 >1 >1 any Def_AH_Filter 51 0.0.0.0/0 192.168.1.1/24 >1 >1 NA Def_ESP_Filter 50 0.0.0.0/0 192.168.1.1/24 >1 >1 NA Def_FTP_Filter tcp 0.0.0.0/0 192.168.1.1/24 >1 =21 any Def_SSH_Filter tcp 0.0.0.0/0 192.168.1.1/24 >1 =22 any
CHAPTER 9: FIREWALL Configuration User Manual 194 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Def_HTTP_Filter tcp 0.0.0.0/0 192.168.1.1/24 >1 =80 any Def_ICMP_Filter icmp 0.0.0.0/0 0.0.0.0/0 any any NA Def_SNMP_Filter udp 0.0.0.0/0 192.168.1.1/24 >1 =161 NA Def_HTTPS_Filter tcp 0.0.0.0/0 192.168.1.1/24 >1 =443 any Def_TELNET_Filter tcp 0.0.0.0/0 192.168.1.1/24 >1 =6023 any Def_IKE_UDP_Filter udp 0.0.0.0/0 192.168.1.1/24 >1 =500 NA Def_SNTP_UDP_Filter udp 0.0.0.0/0 0.0.0.0/0 >1 =123 NA Def_SNMP_Trap_Filter udp 0.0.0.0/0 192.168.1.1/24 >1 =162 NA Def_IKE_NAT_UDP_Filter udp 0.0.0.0/0 192.168.1.1/24 >1 =4500 NA Def_IKE_UDP_Loc_Filter udp 0.0.0.0/0 0.0.0.0/0 >1 =500 NA This below section describes the steps involved in deleting the ipv4 firewall filter. To delete the configured ipv4 firewall filter 10. Enter the Global Configuration mode. UltOs# configure terminal 11. Enter into firewall mode UltOs(config)# firewall 12. Delete the ipv4 firewall filter UltOs(config-firewall)# no filter filter2 9.2.2.2 WEB Configuration Firewall filters can be configured through WEB interface using the Firewall Filter Configuration screen (Navigation - Security Management > Firewall > Filters)
CHAPTER 9: FIREWALL Configuration User Manual 195 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 9-2: Firewall Filter Configuration
CHAPTER 9: FIREWALL Configuration User Manual 196 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 9.2.3 Configuring Firewall Access List Firewall Access List is a policy which is based on the direction of the traffic, the firewall filter and the order of precedence to allow or deny the traffic. This section describes the steps involved in configuring firewall access-list. 9.2.3.1 CLI Configuration To create an access-list: 1. Enter the global configuration mode. UltOs# configure terminal 2. Enter firewall mode UltOs(config)# firewall 3. Create an access list policy to allow traffic from H1 to H2. UltOs(config-firewall)# access-list acl1 lan wan filter1 permit 8 To view the configured firewall access list UltOs# show firewall access-lists Firewall Access Lists ACL Name From To Filter Combination Action Prio- Fragmented Zone Zone rity Packet -------------------- ------ ------ --------------------- ------ ----- ---------- acl1 LAN WAN filter1 permit 8 permit Def_HTTPS_ACL_LAN_Local LAN Local Def_HTTPS_Filter permit 9987 permit Def_HTTP_ACL_LAN_Local LAN Local Def_HTTP_Filter permit 9984 permit Def_SNMP_ACL_LAN_Local LAN Local Def_SNMP_Filter permit 9980 permit Def_SNMP_Trap_ACL_LAN_LocalLAN Local Def_SNMP_Trap_Filter permit 9976 permit Def_SSH_ACL_LAN_Local LAN Local Def_SSH_Filter permit 9991 permit Def_TELNET_ACL_LAN_Local LAN Local Def_TELNET_Filter permit 9995 permit Def_AH_ACL_WAN_Local WAN Local Def_AH_Filter permit 9967 permit Def_ESP_ACL_WAN_Local WAN Local Def_ESP_Filter permit 9969 permit Def_HTTPS_ACL_WAN_Local WAN Local Def_HTTPS_Filter permit 9989 permit
CHAPTER 9: FIREWALL Configuration User Manual 197 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Def_IKE_ACL_WAN_Local WAN Local Def_IKE_UDP_Filter permit 9965 permit Def_IKE_NAT_ACL_WAN_LocalWAN Local Def_IKE_NAT_UDP_Filter permit 9963 permit Def_SNMP_ACL_WAN_Local WAN Local Def_SNMP_Filter permit 9982 permit Def_SNMP_Trap_ACL_WAN_LocalWAN Local Def_SNMP_Trap_Filter permit 9978 permit Def_SSH_ACL_WAN_Local WAN Local Def_SSH_Filter permit 9993 permit Def_HTTPS_ACL_DMZ_Local DMZ Local Def_HTTPS_Filter permit 9986 permit Def_HTTP_ACL_DMZ_Local DMZ Local Def_HTTP_Filter permit 9983 permit Def_SNMP_ACL_DMZ_Local DMZ Local Def_SNMP_Filter permit 9979 permit Def_SNMP_Trap_ACL_DMZ_LocalDMZ Local Def_SNMP_Trap_Filter permit 9975 permit Def_SSH_ACL_DMZ_Local DMZ Local Def_SSH_Filter permit 9990 permit Def_TELNET_ACL_DMZ_Local DMZ Local Def_TELNET_Filter permit 9994 permit Def_HTTPS_ACL_VPN_Local VPN Local Def_HTTPS_Filter permit 9988 permit Def_HTTP_ACL_VPN_Local VPN Local Def_HTTP_Filter permit 9985 permit Def_SNMP_ACL_VPN_Local VPN Local Def_SNMP_Filter permit 9981 permit Def_SNMP_Trap_ACL_VPN_LocalVPN Local Def_SNMP_Trap_Filter permit 9977 permit Def_SSH_ACL_VPN_Local VPN Local Def_SSH_Filter permit 9992 permit Def_TELNET_ACL_VPN_Local VPN Local Def_TELNET_Filter permit 9996 permit Def_ACL_ICMP_Local_LAN Local LAN Def_ICMP_Filter permit 9961 permit Def_FTP_ACL_Local_LAN Local LAN Def_FTP_Filter permit 9999 permit Def_SNTP_ACL_Local_LAN Local LAN Def_SNTP_UDP_Filter permit 9972 permit Def_ACL_ICMP_Local_WAN Local WAN Def_ICMP_Filter permit 9962 permit Def_AH_ACL_Local_WAN Local WAN Def_AH_Filter permit 9968 permit
CHAPTER 9: FIREWALL Configuration User Manual 198 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Def_ESP_ACL_Local_WAN Local WAN Def_ESP_Filter permit 9970 permit Def_FTP_ACL_Local_WAN Local WAN Def_FTP_Filter permit 10000 permit Def_IKENAT_ACL_Local_WAN Local WAN Def_IKE_NAT_UDP_Filter permit 9964 permit Def_IKE_ACL_Local_WAN Local WAN Def_IKE_UDP_Loc_Filter permit 9966 permit Def_SNTP_ACL_Local_WAN Local WAN Def_SNTP_UDP_Filter permit 9974 permit Def_ACL_ICMP_Local_DMZ Local DMZ Def_ICMP_Filter permit 9960 permit Def_FTP_ACL_Local_DMZ Local DMZ Def_FTP_Filter permit 9998 permit Def_SNTP_ACL_Local_DMZ Local DMZ Def_SNTP_UDP_Filter permit 9971 permit Def_ACL_ICMP_Local_VPN Local VPN Def_ICMP_Filter permit 9959 permit Def_FTP_ACL_Local_VPN Local VPN Def_FTP_Filter permit 9997 permit Def_SNTP_ACL_Local_VPN Local VPN Def_SNTP_UDP_Filter permit 9973 permit To delete the configured firewall access list: 4. Enter the Global Configuration mode. UltOs# configure terminal 5. Enter into firewall mode UltOs(config)# firewall 6. Delete the configured access-list UltOs(config-firewall)# no access-list acl1 lan wan The below section describes the steps needed to allow traffic from WAN host H2 to LAN host H1 when nat configuration is disabled. The filter filter2 created in section 3.2 is used to create an inbound access-list which permits traffic from H2 to H1. To create an access-list: 7. Enter the global configuration mode. UltOs# configure terminal 8. Enter firewall mode UltOs(config)# firewall 9. Create an access list policy to allow traffic from H2 to H1. UltOs(config-firewall)# access-list acl2 wan lan filter2 permit 8 To view the configured firewall access list UltOs# show firewall access-lists
CHAPTER 9: FIREWALL Configuration User Manual 199 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Firewall Access Lists ACL Name From To Filter Combination Action Prio- Fragmented Zone Zone rity Packet -------------------- ------ ------ --------------------- ------ ----- ---------- Def_HTTPS_ACL_LAN_Local LAN Local Def_HTTPS_Filter permit 9987 permit Def_HTTP_ACL_LAN_Local LAN Local Def_HTTP_Filter permit 9984 permit Def_SNMP_ACL_LAN_Local LAN Local Def_SNMP_Filter permit 9980 permit Def_SNMP_Trap_ACL_LAN_LocalLAN Local Def_SNMP_Trap_Filter permit 9976 permit Def_SSH_ACL_LAN_Local LAN Local Def_SSH_Filter permit 9991 permit Def_TELNET_ACL_LAN_Local LAN Local Def_TELNET_Filter permit 9995 permit acl2 WAN LAN filter2 permit 8 permit Def_AH_ACL_WAN_Local WAN Local Def_AH_Filter permit 9967 permit Def_ESP_ACL_WAN_Local WAN Local Def_ESP_Filter permit 9969 permit Def_HTTPS_ACL_WAN_Local WAN Local Def_HTTPS_Filter permit 9989 permit Def_IKE_ACL_WAN_Local WAN Local Def_IKE_UDP_Filter permit 9965 permit Def_IKE_NAT_ACL_WAN_LocalWAN Local Def_IKE_NAT_UDP_Filter permit 9963 permit Def_SNMP_ACL_WAN_Local WAN Local Def_SNMP_Filter permit 9982 permit Def_SNMP_Trap_ACL_WAN_LocalWAN Local Def_SNMP_Trap_Filter permit 9978 permit Def_SSH_ACL_WAN_Local WAN Local Def_SSH_Filter permit 9993 permit Def_HTTPS_ACL_DMZ_Local DMZ Local Def_HTTPS_Filter permit 9986 permit Def_HTTP_ACL_DMZ_Local DMZ Local Def_HTTP_Filter permit 9983 permit Def_SNMP_ACL_DMZ_Local DMZ Local Def_SNMP_Filter permit 9979 permit
CHAPTER 9: FIREWALL Configuration User Manual 200 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Def_SNMP_Trap_ACL_DMZ_LocalDMZ Local Def_SNMP_Trap_Filter permit 9975 permit Def_SSH_ACL_DMZ_Local DMZ Local Def_SSH_Filter permit 9990 permit Def_TELNET_ACL_DMZ_Local DMZ Local Def_TELNET_Filter permit 9994 permit Def_HTTPS_ACL_VPN_Local VPN Local Def_HTTPS_Filter permit 9988 permit Def_HTTP_ACL_VPN_Local VPN Local Def_HTTP_Filter permit 9985 permit Def_SNMP_ACL_VPN_Local VPN Local Def_SNMP_Filter permit 9981 permit Def_SNMP_Trap_ACL_VPN_LocalVPN Local Def_SNMP_Trap_Filter permit 9977 permit Def_SSH_ACL_VPN_Local VPN Local Def_SSH_Filter permit 9992 permit Def_TELNET_ACL_VPN_Local VPN Local Def_TELNET_Filter permit 9996 permit Def_ACL_ICMP_Local_LAN Local LAN Def_ICMP_Filter permit 9961 permit Def_FTP_ACL_Local_LAN Local LAN Def_FTP_Filter permit 9999 permit Def_SNTP_ACL_Local_LAN Local LAN Def_SNTP_UDP_Filter permit 9972 permit Def_ACL_ICMP_Local_WAN Local WAN Def_ICMP_Filter permit 9962 permit Def_AH_ACL_Local_WAN Local WAN Def_AH_Filter permit 9968 permit Def_ESP_ACL_Local_WAN Local WAN Def_ESP_Filter permit 9970 permit Def_FTP_ACL_Local_WAN Local WAN Def_FTP_Filter permit 10000 permit Def_IKENAT_ACL_Local_WAN Local WAN Def_IKE_NAT_UDP_Filter permit 9964 permit Def_IKE_ACL_Local_WAN Local WAN Def_IKE_UDP_Loc_Filter permit 9966 permit Def_SNTP_ACL_Local_WAN Local WAN Def_SNTP_UDP_Filter permit 9974 permit Def_ACL_ICMP_Local_DMZ Local DMZ Def_ICMP_Filter permit 9960 permit Def_FTP_ACL_Local_DMZ Local DMZ Def_FTP_Filter permit 9998 permit Def_SNTP_ACL_Local_DMZ Local DMZ Def_SNTP_UDP_Filter permit 9971 permit
CHAPTER 9: FIREWALL Configuration User Manual 201 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Def_ACL_ICMP_Local_VPN Local VPN Def_ICMP_Filter permit 9959 permit Def_FTP_ACL_Local_VPN Local VPN Def_FTP_Filter permit 9997 permit Def_SNTP_ACL_Local_VPN Local VPN Def_SNTP_UDP_Filter permit 9973 permit To delete the configured firewall access list: 10. Enter the Global Configuration mode. UltOs# configure terminal 11. Enter into firewall mode UltOs(config)# firewall 12. Delete the configured access-list UltOs(config-firewall)# no access-list acl2 wan lan The below section describes the steps needed to create an inbound access-list as above, when nat configuration is enabled. To create an access-list, a virtual server needs to be created in the wan interface of FDN40-4 to allow the traffic from WAN network to LAN network. The filter filter2 created in section 3.2 is used to create the access-list. To create a virtual server: 13. Enter the global configuration mode. UltOs# configure terminal 14. Enter interface configuration mode UltOs(config)# interface wan 0/1 15. Create a virtual server in the wan interface of FDN40-4 (eth1). The following virtual server allows ftp traffic from H2 to H1. UltOs(config-if)# virtual server 10.0.0.10 ftp FTP-server To create an access-list: 16. Enter the global configuration mode. UltOs# configure terminal 17. Enter firewall mode UltOs(config)# firewall 18. Create an access list policy to allow traffic from WAN host H2 to LAN host H1. UltOs(config-firewall)# access-list natacl wan lan filter2 permit 10 To view the configured firewall access list UltOs# show firewall access-lists Firewall Access Lists ACL Name From To Filter Combination Action Prio- Fragmented
CHAPTER 9: FIREWALL Configuration User Manual 202 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Zone Zone rity Packet -------------------- ------ ------ --------------------- ------ ----- ---------- Def_HTTPS_ACL_LAN_Local LAN Local Def_HTTPS_Filter permit 9987 permit Def_HTTP_ACL_LAN_Local LAN Local Def_HTTP_Filter permit 9984 permit Def_SNMP_ACL_LAN_Local LAN Local Def_SNMP_Filter permit 9980 permit Def_SNMP_Trap_ACL_LAN_LocalLAN Local Def_SNMP_Trap_Filter permit 9976 permit Def_SSH_ACL_LAN_Local LAN Local Def_SSH_Filter permit 9991 permit Def_TELNET_ACL_LAN_Local LAN Local Def_TELNET_Filter permit 9995 permit natacl WAN LAN filter2 permit 10 permit Def_AH_ACL_WAN_Local WAN Local Def_AH_Filter permit 9967 permit Def_ESP_ACL_WAN_Local WAN Local Def_ESP_Filter permit 9969 permit Def_HTTPS_ACL_WAN_Local WAN Local Def_HTTPS_Filter permit 9989 permit Def_IKE_ACL_WAN_Local WAN Local Def_IKE_UDP_Filter permit 9965 permit Def_IKE_NAT_ACL_WAN_LocalWAN Local Def_IKE_NAT_UDP_Filter permit 9963 permit Def_SNMP_ACL_WAN_Local WAN Local Def_SNMP_Filter permit 9982 permit Def_SNMP_Trap_ACL_WAN_LocalWAN Local Def_SNMP_Trap_Filter permit 9978 permit Def_SSH_ACL_WAN_Local WAN Local Def_SSH_Filter permit 9993 permit Def_HTTPS_ACL_DMZ_Local DMZ Local Def_HTTPS_Filter permit 9986 permit Def_HTTP_ACL_DMZ_Local DMZ Local Def_HTTP_Filter permit 9983 permit Def_SNMP_ACL_DMZ_Local DMZ Local Def_SNMP_Filter permit 9979 permit Def_SNMP_Trap_ACL_DMZ_LocalDMZ Local Def_SNMP_Trap_Filter permit 9975 permit Def_SSH_ACL_DMZ_Local DMZ Local Def_SSH_Filter permit 9990 permit
CHAPTER 9: FIREWALL Configuration User Manual 203 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Def_TELNET_ACL_DMZ_Local DMZ Local Def_TELNET_Filter permit 9994 permit Def_HTTPS_ACL_VPN_Local VPN Local Def_HTTPS_Filter permit 9988 permit Def_HTTP_ACL_VPN_Local VPN Local Def_HTTP_Filter permit 9985 permit Def_SNMP_ACL_VPN_Local VPN Local Def_SNMP_Filter permit 9981 permit Def_SNMP_Trap_ACL_VPN_LocalVPN Local Def_SNMP_Trap_Filter permit 9977 permit Def_SSH_ACL_VPN_Local VPN Local Def_SSH_Filter permit 9992 permit Def_TELNET_ACL_VPN_Local VPN Local Def_TELNET_Filter permit 9996 permit Def_ACL_ICMP_Local_LAN Local LAN Def_ICMP_Filter permit 9961 permit Def_FTP_ACL_Local_LAN Local LAN Def_FTP_Filter permit 9999 permit Def_SNTP_ACL_Local_LAN Local LAN Def_SNTP_UDP_Filter permit 9972 permit Def_ACL_ICMP_Local_WAN Local WAN Def_ICMP_Filter permit 9962 permit Def_AH_ACL_Local_WAN Local WAN Def_AH_Filter permit 9968 permit Def_ESP_ACL_Local_WAN Local WAN Def_ESP_Filter permit 9970 permit Def_FTP_ACL_Local_WAN Local WAN Def_FTP_Filter permit 10000 permit Def_IKENAT_ACL_Local_WAN Local WAN Def_IKE_NAT_UDP_Filter permit 9964 permit Def_IKE_ACL_Local_WAN Local WAN Def_IKE_UDP_Loc_Filter permit 9966 permit Def_SNTP_ACL_Local_WAN Local WAN Def_SNTP_UDP_Filter permit 9974 permit Def_ACL_ICMP_Local_DMZ Local DMZ Def_ICMP_Filter permit 9960 permit Def_FTP_ACL_Local_DMZ Local DMZ Def_FTP_Filter permit 9998 permit Def_SNTP_ACL_Local_DMZ Local DMZ Def_SNTP_UDP_Filter permit 9971 permit Def_ACL_ICMP_Local_VPN Local VPN Def_ICMP_Filter permit 9959 permit Def_FTP_ACL_Local_VPN Local VPN Def_FTP_Filter permit 9997 permit
CHAPTER 9: FIREWALL Configuration User Manual 204 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Def_SNTP_ACL_Local_VPN Local VPN Def_SNTP_UDP_Filter permit 9973 permit To view the configured virtual server: UltOs# show virtual servers Virtual Servers Configuration ----------------------------- Interface : wan0/1 Local IP : 10.0.0.10 Local Port : 21 Protocol : ANY Global IP : 100.0.0.1 Global Port : 21 App Type : FTP Description : FTP-server Status : Disabled ------------------------------------------------------To delete the configured firewall access list: 19. Enter the Global Configuration mode. UltOs# configure terminal 20. Enter into firewall mode UltOs(config)# firewall 21. Delete the configured access-list UltOs(config-firewall)# no access-list natacl wan lan 9.2.3.2 WEB Configuration Firewall Access Lists can be configured through WEB interface using the ACL Configuration screen (Navigation - Security Management > Firewall > Access List)
CHAPTER 9: FIREWALL Configuration User Manual 205 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 9-3: Firewall - ACL Configuration
CHAPTER 9: FIREWALL Configuration User Manual 206 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 9.2.4 Configuring Zones Firewall configuration works on zone basis. User needs to specify ingress and egress zones while configuring Firewall Access List. Zones are classified as follows, 1. Local 2. LAN 3. WAN 4. DMZ 5. VPN Local zone will be taken by default when IP interface is created. LAN, WAN and DMZ zones can be configured by the user. DMZ or De Militarized Zone is a physical or logical subnetwork that contains and exposes an organization's external services to a larger untrusted network, usually the Internet. The host/hosts in this zone, called DMZ host, will have unrestricted access from the public/external network (Internet). This section describes the steps involved in setting and resetting a host in the Local Area Network as DMZ host. VPN zone comes into effect when IPSec tunnel is established. 9.2.4.1 CLI Configuration To configure a IPv4 DMZ host UltOs# c t UltOs(config)# interface wan 0/1 UltOs(config-if)# switchport UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 10 UltOs(config-vlan)# ports add wan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 10 UltOs(config-if)# ip address 10.10.10.2 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# zone wan UltOs(config-if)# exit UltOs(config)# interface lan 0/1 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 11
CHAPTER 9: FIREWALL Configuration User Manual 207 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-vlan)# ports add lan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 11 UltOs(config-if)# no shutdown UltOs(config-if)# ip address 11.11.11.2 255.255.255.0 UltOs(config-if)# zone lan UltOs(config-if)# exit UltOs(config)# vlan 13 UltOs(config-vlan)# ports add lan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 13 UltOs(config-if)# ip address 13.0.0.1 255.255.255.0 UltOs(config-if)# zone dmz UltOs(config-if)# no shutdown UltOs(config-if)# end UltOs# show firewall interface config Firewall Zones ---------------- Interface Zone --------------- ----------- wan0/2 WAN vlan1 Local vlan10 WAN vlan11 LAN vlan13 DMZ 9.2.4.2 WEB Configuration IPv4 DMZ zone can be configured through WEB interface using the Firewall Interface Configuration screen (Navigation - Layer3 Management > IP > Zone)
CHAPTER 9: FIREWALL Configuration User Manual 208 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 9-4: Firewall Interface Configuration
Configuration User Manual 209 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 10 IPS-IDS 10.1 Topology Figure 10-5: IPS Topology Table 10-1: IPv4 Addresses of Interfaces and Hosts Interface Index/Name Interface IPv4 Address LAN0/1 10.0.0.1 WAN0/1 80.0.0.1 H1 10.0.0.10 H2 80.0.0.10 10.2 Default Configurations When system comes up, IPS-IDS is operationally disabled. Wan0/1 Lan0/1 FDN40 H2 H1 Host in WAN Network Host in LAN Network
CHAPTER 10: IPS-IDS Configuration User Manual 210 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 10.3 IPS-IDS Configurations 10.3.1 Enabling and Disabling IPS-IDS Module This section describes the steps involved in enabling and disabling the IPS-IDS status globally. By default, IPS-IDS status is disabled. 10.3.1.1 CLI Configuration To enable IPS-IDS: 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Enable the Firewall module. UltOs(config)# firewall UltOs(config-firewall)# enable 3. Enable IPS-IDS status UltOs(config-firewall)# ips-ids enable 4. Exit from the Global Configuration mode. UltOs(config-firewall)# end To disable IPS-IDS: 5. Enter the Global Configuration mode. UltOs# configure terminal 6. Enter firewall configuration mode. UltOs(config)# firewall 7. Disable IPS-IDS status. UltOs(config-firewall)# ips-ids disable 8. Exit from the Global Configuration mode. UltOs(config-firewall)# end To view the IPS status: 9. UltOs# show ips config IPS Configuration ---------------------- IPS/IDS Status : Enabled IDS Logging Status : Enabled IPS Log file Size : 1048576 IPS Log file Size Threshold : 70 10.3.1.2 WEB Configuration IPS-IDS global status is configured through WEB interface using IPS Basic Settings screen (Home->Security Management->IPS)
CHAPTER 10: IPS-IDS Configuration User Manual 211 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 10-1: IPS Basic Settings - Enabling IPS-IDS global status Screen 10-2: IPS Basic Settings - Disabling IPS-IDS global status 10.3.2 Enabling and Disabling IDS Logging This section describes the steps involved in enabling and disabling the IDS slogging status. By default, IDS logging status is disabled. 10.3.2.1 CLI Configuration To enable IDS Logging: 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Enable the Firewall module. UltOs(config)# firewall UltOs(config-firewall)# enable 3. Enable IPS-IDS status UltOs(config-firewall)# ids logging 4. Exit from the Global Configuration mode.
CHAPTER 10: IPS-IDS Configuration User Manual 212 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-firewall)# end To disable IDS Logging: 5. Enter the Global Configuration mode. UltOs# configure terminal 6. Enter firewall configuration mode. UltOs(config)# firewall 7. Disable IPS-IDS status. UltOs(config-firewall)# no ids logging 8. Exit from the Global Configuration mode. UltOs(config-firewall)# end To view the IDS logging status: 9. UltOs# show ips config IPS Configuration ---------------------- IPS/IDS Status : Enabled IDS Logging Status : Enabled IPS Log file Size : 1048576 IPS Log file Size Threshold : 70 10.3.2.2 WEB Configuration IPS-IDS global status is configured through WEB interface using IPS Basic Settings screen (Home->Security Management->IPS) Enabling IDS logging status through web interface Screen 10-3: IPS Basic Settings - Enabling IDS logging status Disabling IDS logging status through web interface
CHAPTER 10: IPS-IDS Configuration User Manual 213 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 10-4: IPS Basic Settings - Disabling IDS logging status 10.3.3 Configuring IDS Logging Size and Log Size Threshold This section describes the steps involved in configuring the IDS logging file size and logging size threshold. By default, the IDS logging file size is 1048576Kb and logging file size threshold is 70%. 10.3.3.1 CLI Configuration To configure IDS logging file size and threshold: 1. Enter the Global Configuration mode. UltOs# configure terminal 2. Enable the Firewall module. UltOs(config)# firewall 3. Configure IDS log file size UltOs(config-firewall)# ids logging filesize 1045600 4. Configure IDS logging threshold UltOs(config-firewall)# ids logging logsize-threshold 80 5. Exit from the Global Configuration mode. UltOs(config-firewall)# end To view the IDS logging file size and threshold: 6. UltOs# show ips config IPS Configuration ---------------------- IPS/IDS Status : Enabled IDS Logging Status : Enabled IPS Log file Size : 1045600 IPS Log file Size Threshold : 80
CHAPTER 10: IPS-IDS Configuration User Manual 214 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 10.3.3.2 WEB Configuration IPS-IDS Logging file size and threshold is configured through WEB interface using IPS Basic Settings screen (Home->Security Management->IPS) Configure IDS logging file size as 1045600 through web interface Screen 10-5: IPS Basic Settings - Configure IDS logging file size Configure IDS logging threshold as 80% through web interface Screen 10-6: IPS Basic Settings - Disabling IDS logging status 10.3.4 Configuring IPS status in firewall access-list This section describes the steps involved in enabling and disabling the IPS status in the firewall access-list to lookup DPI engine per flow. For creating firewall access-list refer section 15.3.1.5. By default, the IPS status in the firewall access-list is disabled. Refer section 15.3 for interface configuration with packet processing. 10.3.4.1 CLI Configuration To configure IPS status per firewall access-list: 1. To enable IPS status in access-list:
CHAPTER 10: IPS-IDS Configuration User Manual 215 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2. Enter the Global Configuration mode. UltOs# configure terminal 3. Enable the Firewall module. UltOs(config)# firewall 4. Enable Global IPS status UltOs(config-firewall)#ips-ids enable 5. Enable IPS status in firewall access-list UltOs(config-firewall)# access-list acl1 lan wan filter1 permit 8 ips enable 6. Exit from the Global Configuration mode. UltOs(config-firewall)# end 7. Disable IPS status in firewall access-list 8. Enter the Global Configuration mode. UltOs# configure terminal 9. Enable the Firewall module. UltOs(config)# firewall 10. Enable Global IPS status UltOs(config-firewall)#ips-ids enable 11. Enable IPS status in firewall access-list UltOs(config-firewall)# access-list acl1 lan wan filter1 permit 8 ips disable 12. Exit from the Global Configuration mode. UltOs(config-firewall)# end To view the IPS status per firewall access-list: 13. UltOs# show firewall access-lists Firewall Access Lists ACL Name From To Filter Combination Action Prio- Fragmented IPS Zone Zone rity Packet Status -------------------- ------ ------ --------------------- ------ ----- ---------- ---------- acl1 LAN WAN filter1 permit 8 permit Enable Def_HTTPS_ACL_LAN_Local LAN Local Def_HTTPS_Filter permit 9987 permit Disable Def_HTTP_ACL_LAN_Local LAN Local Def_HTTP_Filter permit 9984 permit Disable
CHAPTER 10: IPS-IDS Configuration User Manual 216 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Def_SNMP_ACL_LAN_Local LAN Local Def_SNMP_Filter permit 9980 permit Disable Def_SNMP_Trap_ACL_LAN_LocalLAN Local Def_SNMP_Trap_Filter permit 9976 permit Disable Def_SSH_ACL_LAN_Local LAN Local Def_SSH_Filter permit 9991 permit Disable Def_TELNET_ACL_LAN_Local LAN Local Def_TELNET_Filter permit 9995 permit Disable Def_AH_ACL_WAN_Local WAN Local Def_AH_Filter permit 9967 permit Disable Def_ESP_ACL_WAN_Local WAN Local Def_ESP_Filter permit 9969 permit Disable Def_HTTPS_ACL_WAN_Local WAN Local Def_HTTPS_Filter permit 9989 permit Disable Def_IKE_ACL_WAN_Local WAN Local Def_IKE_UDP_Filter permit 9965 permit Disable Def_IKE_NAT_ACL_WAN_LocalWAN Local Def_IKE_NAT_UDP_Filter permit 9963 permit Disable Def_SNMP_ACL_WAN_Local WAN Local Def_SNMP_Filter permit 9982 permit Disable Def_SNMP_Trap_ACL_WAN_LocalWAN Local Def_SNMP_Trap_Filter permit 9978 permit Disable Def_SSH_ACL_WAN_Local WAN Local Def_SSH_Filter permit 9993 permit Disable Def_HTTPS_ACL_DMZ_Local DMZ Local Def_HTTPS_Filter permit 9986 permit Disable Def_HTTP_ACL_DMZ_Local DMZ Local Def_HTTP_Filter permit 9983 permit Disable Def_SNMP_ACL_DMZ_Local DMZ Local Def_SNMP_Filter permit 9979 permit Disable Def_SNMP_Trap_ACL_DMZ_LocalDMZ Local Def_SNMP_Trap_Filter permit 9975 permit Disable
CHAPTER 10: IPS-IDS Configuration User Manual 217 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Def_SSH_ACL_DMZ_Local DMZ Local Def_SSH_Filter permit 9990 permit Disable Def_TELNET_ACL_DMZ_Local DMZ Local Def_TELNET_Filter permit 9994 permit Disable Def_HTTPS_ACL_VPN_Local VPN Local Def_HTTPS_Filter permit 9988 permit Disable Def_HTTP_ACL_VPN_Local VPN Local Def_HTTP_Filter permit 9985 permit Disable Def_SNMP_ACL_VPN_Local VPN Local Def_SNMP_Filter permit 9981 permit Disable Def_SNMP_Trap_ACL_VPN_LocalVPN Local Def_SNMP_Trap_Filter permit 9977 permit Disable Def_SSH_ACL_VPN_Local VPN Local Def_SSH_Filter permit 9992 permit Disable Def_TELNET_ACL_VPN_Local VPN Local Def_TELNET_Filter permit 9996 permit Disable Def_ACL_ICMP_Local_LAN Local LAN Def_ICMP_Filter permit 9961 permit Disable Def_FTP_ACL_Local_LAN Local LAN Def_FTP_Filter permit 9999 permit Disable Def_SNTP_ACL_Local_LAN Local LAN Def_SNTP_UDP_Filter permit 9972 permit Disable Def_ACL_ICMP_Local_WAN Local WAN Def_ICMP_Filter permit 9962 permit Disable Def_AH_ACL_Local_WAN Local WAN Def_AH_Filter permit 9968 permit Disable Def_ESP_ACL_Local_WAN Local WAN Def_ESP_Filter permit 9970 permit Disable Def_FTP_ACL_Local_WAN Local WAN Def_FTP_Filter permit 10000 permit Disable Def_IKENAT_ACL_Local_WAN Local WAN Def_IKE_NAT_UDP_Loc_Filterpermit 9964 permit Disable
CHAPTER 10: IPS-IDS Configuration User Manual 218 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Def_IKE_ACL_Local_WAN Local WAN Def_IKE_UDP_Loc_Filter permit 9966 permit Disable Def_SNTP_ACL_Local_WAN Local WAN Def_SNTP_UDP_Filter permit 9974 permit Disable Def_ACL_ICMP_Local_DMZ Local DMZ Def_ICMP_Filter permit 9960 permit Disable Def_FTP_ACL_Local_DMZ Local DMZ Def_FTP_Filter permit 9998 permit Disable Def_SNTP_ACL_Local_DMZ Local DMZ Def_SNTP_UDP_Filter permit 9971 permit Disable Def_ACL_ICMP_Local_VPN Local VPN Def_ICMP_Filter permit 9959 permit Disable Def_FTP_ACL_Local_VPN Local VPN Def_FTP_Filter permit 9997 permit Disable Def_SNTP_ACL_Local_VPN Local VPN Def_SNTP_UDP_Filter permit 9973 permit Disable 10.3.4.2 WEB Configuration IPS status in firewall access-list is configured through WEB interface using IPS Basic Settings screen (Home->Security Management->Firewall->Access List) Configuring IPS status as enabled in firewall access-list
CHAPTER 10: IPS-IDS Configuration User Manual 219 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 10-7: Firewall Access List - Configure IPS status as enabled Configure IPS status per access-list as disabled through web interface Screen 10-8: Firewall Access List - Configure IPS status as disabled To view IPS status in the firewall access-list
CHAPTER 10: IPS-IDS Configuration User Manual 220 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 10-9: Firewall Access List – View IPS status 10.3.5 Displaying IPS Categories and IPS Rules This section describes the steps involved in displaying IPS signature categories and IPS Rules per category. IPS signature files are loaded in the FLASH to view the categories and rules 10.3.5.1 CLI Configuration To display IPS signature categories: 1. UltOs# show ips categories IPS Categories ============== not-suspicious unknown bad-unknown attempted-recon successful-recon-limited successful-recon-largescale attempted-dos successful-dos attempted-user unsuccessful-user successful-user attempted-admin successful-admin rpc-portmap-decode shellcode-detect string-detect suspicious-filename-detect suspicious-login system-call-detect tcp-connection trojan-activity
CHAPTER 10: IPS-IDS Configuration User Manual 221 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. unusual-client-port-connection network-scan denial-of-service non-standard-protocol protocol-command-decode web-application-activity web-application-attack misc-activity misc-attack icmp-event inappropriate-content policy-violation default-login-attempt sdf file-format malware-cnc client-side-exploit To display signatures per category: 2. UltOs# show ips rules not-suspicious IPS Categories Rule List - not-suspicious =============================================== SID Description ====== ===================================================================== 8704 SERVER-MAIL Yahoo YPOPS Banner 539 DELETED NETBIOS Samba clientaccess 716 DELETED INFO TELNET access 3446 DELETED SQL DNS query with 4 requests 3451 DELETED SQL DNS query with 9 requests 3447 DELETED SQL DNS query with 5 requests 3444 DELETED SQL DNS query with 2 requests 3443 DELETED SQL DNS query with 1 requests 3452 DELETED SQL DNS query with 10 requests 3448 DELETED SQL DNS query with 6 requests
CHAPTER 10: IPS-IDS Configuration User Manual 222 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 3445 DELETED SQL DNS query with 3 requests 3450 DELETED SQL DNS query with 8 requests 3449 DELETED SQL DNS query with 7 requests 10.3.5.2 WEB Configuration IPS Signature Categories and rules are displayed through WEB interface using IPS Basic Settings screen (Home->Security Management->IPS->IPS Signature) To Display Signatures per category Screen 100-10: IPS Signature – Display signatures for not-suspicious category
Configuration User Manual 223 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 11 POE 11.1 Protocol Description Power over Ethernet technology is a system that transmits electrical power, along with data, to remote devices over standard twisted-pair cable in an Ethernet network. The advantage of this technology is that the installers need to run only a single Ethernet cable that carries both power and data to each device. IP telephones, wireless LAN access points, webcams, Ethernet hubs, computers, and other appliances use this technology. Access Points and network devices can be easily located, decreasing installation costs in many cases. Power over Ethernet is standardized in IEEE 802.3af. This technology offers new options to system designers by providing economical and flexible deployment of networked devices. POE is supported only in the 6 port Variant of FDN406 11.2 Topology This network topology explains IP phone and Wireless access point connection to FDN406P. When POE is enabled on these ports, power will be delivered to IP phone and Access point.
CHAPTER 11: POE Configuration User Manual 224 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Figure 11-1 11.3 POE Configurations 11.3.1 Enabling POE Module This section describes steps involved in enabling POE module. 11.3.1.1 CLI Configuration To enable POE globally - Enter the Global Configuration mode. UltOs# configure terminal - Enable the POE module. UltOs(config)# set poe enable - Exit from the Global Configuration mode. UltOs(config)# end To view the POE global status UltOs# show power detail PSE Status ---------- PoE Global Admin State : Enabled PSE Oper Status : On Max Power Supply : 1 Total Power in (watts) : 30 Total Power Consumed : 0 Pse Usage Threshold : 99 FDN406P
CHAPTER 11: POE Configuration User Manual 225 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 11.3.1.2 WEB Configuration POE can be enabled / disabled using the POE Basic Settings screen (Navigation – POE> POE Basic Settings) Screen 111-1: POE Basic Settings 11.3.2 Enabling POE on port 11.3.2.1 CLI Configuration To Enable POE on port - Enter the Global Configuration mode. UltOs# configure terminal - Enter the Interface Configuration mode UltOs(config)# interface lan 0/6 - Enable POE on the interface 3. UltOs(config-if)# power inline enable - Exit from the Interface Configuration mode. UltOs(config-if)# end To View power applied on port UltOs# show power inline lan 0/6 PoE Port Info ------------- Port Number : 10(lan 0/6) PoeAdminStatus : Up PoeDetectionState : Disabled class : 0 Priority : low Port Power Mode : Never Port Power : 0
CHAPTER 11: POE Configuration User Manual 226 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Actual Pwr Consumed: 0 To view power applied on all the ports UltOs# show power inline PoE Port Info ------------- Port-Index PoeAdminState DetectionSts pwrClass priority Mode PwrConfigured ActualPwrConsumed ---------- ------------- ------------ -------- -------- ---- ------------- ----------------- 5(lan 0/1) down Disabled class 0 low Never 0 Watts 0 Watts 6(lan 0/2) down Disabled class 0 low Never 0 Watts 0 Watts 7(lan 0/3) down Disabled class 0 low Never 0 Watts 0 Watts 8(lan 0/4) down Disabled class 0 low Never 0 Watts 0 Watts 9(lan 0/5) down Disabled class 0 low Never 0 Watts 0 Watts 10(lan 0/6) up Disabled class 0 low Never 0 Watts 0 Watts 11.3.2.2 WEB Configuration POE functionality on interface can be enabled on PSE Port Configuration page (Navigation – POE> Port Settings)
CHAPTER 11: POE Configuration User Manual 227 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 111-2: POE Port Configuration 11.3.3 To apply power to a POE device 11.3.3.1 CLI Configuration To apply power to a POE device - Enter the Global Configuration mode. UltOs# configure terminal - Enter the Interface Configuration mode UltOs(config)# interface lan 0/6 - Apply power on the interface 4. UltOs(config-if)# power inline static 6000 - Exit from the Interface Configuration mode. UltOs(config-if)# end To view the device power status UltOs# show power inline lan 0/6 PoE Port Info ------------- Port Number : 10(lan 0/6) PoeAdminStatus : Up PoeDetectionState : Delivering Power class : 0
CHAPTER 11: POE Configuration User Manual 228 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Priority : low Port Power Mode : Static Port Power : 6 Actual Pwr Consumed: 6000 11.3.3.2 WEB Configuration Power can be applied to a device on PSE Port Configuration page (Navigation – POE> Port Settings) Screen 111-3: POE Port Configuration 11.3.4 To view the PSE status 11.3.4.1 CLI Configuration To view the PSE status UltOs# show power detail PSE Status ---------- PoE Global Admin State : Enabled PSE Oper Status : On Max Power Supply : 1 Total Power in (watts) : 30 Total Power Consumed : 6
CHAPTER 11: POE Configuration User Manual 229 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Pse Usage Threshold : 99 11.3.4.2 WEB Configuration PSE status can be viewed on PSE configuration page (Navigation – POE> PSE Settings) Screen 111-4: PSE Configuration
Configuration User Manual 231 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 12 Wi-Fi 12.1 Topology Figure 12-1: Wi-Fi Topology Table 12-1: Wi-Fi Topology Description Switch / Host Interface of FDN40 Switches WiFi Host 1 FDN40-1(Supports 16 VAPs) VLAN associated with each VAP PC/Linux/Mobile with wireless adapter
CHAPTER 12: WI-FI Configuration User Manual 232 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 12.2 Configuration Guidelines The FDN40 CLI user manual can be referred for the complete set of commands and the various options available for configuring Wi-Fi. 12.3 Wi-Fi Configurations 12.3.1 Enabling WiFi interfaces 12.3.1.1 CLI Configuration 1. Execute the following commands to enable Radio interfaces on the target. Enabling the radio0 interface programs the hardware and starts protocol operation.  Enter the Global Configuration Mode. UltOs# configure terminal  Specify the radio interface. UltOs(config)# apradio radio0  Enable the radio0 interface. UltOs(config-apradio0) # no shutdown  Exit the radio0 interface Mode UltOs(config-apradio0)#end 2. View the Wi-Fi interface status. UltOs# show interfaces description Interface Status Protocol Description --------- ------ -------- ----------- wan0/1 down down ApRadio2 up up ApRadio3 down down lan0/1 down down lan0/2 down down lan0/3 down down lan0/4 down down vlan1 up down vlan100 up up Use the following command to enable the radio1 interface.  Enter the Global Configuration Mode. UltOs# configure terminal  Specify the radio interface.
CHAPTER 12: WI-FI Configuration User Manual 233 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# apradio radio1  Enable the radio1 interface. UltOs(config-apradio1) # no shutdown  Exit the radio1 interface Mode UltOs(config-apradio1)#end 3. View the Wi-Fi interface status. UltOs# show interfaces description Interface Status Protocol Description --------- ------ -------- ----------- wan0/1 down down ApRadio2 down down ApRadio3 up up lan0/1 down down lan0/2 down down lan0/3 down down lan0/4 down down vlan1 up down vlan100 up up 12.3.1.2 WEB Configuration Radio Interfaces can be enabled through WEB interface using the AP Radio Setings screen (Navigation - Home-> Access Point-> Radio Settings). Select the radio Interface Radio0/Radio1 from “RadioType” tab and set the status to “On” in “Staus” tab. Screen 12-1: AP RadioSettings - Enabling Radio Interfaces 12.3.2 Disabling Wi-Fi interface 12.3.2.1 CLI Configuration 1. Execute the following commands to enable Wi-Fi on the target.
CHAPTER 12: WI-FI Configuration User Manual 234 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Disabling the AP module, stops the protocol operation by deleting the hardware configuration.  Enter the Global Configuration Mode. UltOs# configure terminal  Specify the radio interface. UltOs(config)# apradio radio0  To configure radio1 interface, use the following command UltOs(config)# apradio radio1  Disable the Wi-Fi interface. UltOs(config-apradio) # no shutdown  Exit the WiFi interface Mode UltOs(config-apradio)#exit  Exit the global configuration Mode. UltOs(config)# exit 2. View the Wi-Fi interface status. UltOs# show int desc Interface Status Protocol Description --------- ------ -------- ----------- wan0/1 down down ApRadio2 down down ApRadio3 down down lan0/1 down down lan0/2 down down lan0/3 down down lan0/4 down down vlan1 up down vlan100 up up 12.3.2.2 WEB Configuration Radio Interface can be disabled through WEB interface using the AP Radio Setings screen (Navigation - Home-> Access Point-> Radio Settings). Select the Radio Interface and set the status to Off. Screen 12-2: AP RadioSettings - Disabling Wi-Fi Interface
CHAPTER 12: WI-FI Configuration User Manual 235 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 12.3.3 VAP creation and VLAN association 12.3.3.1 CLI Configuration 1. Execute the following commands to configure a virtual access point (VAP) on the target. This configuration would create a VAP interface to support virtual access point functionality.  Enter the Global Configuration Mode. UltOs# configure terminal  Specify the Radio interface. UltOs(config)# apradio radio0  Use the following command for configuring radio1 interfaces UltOs(config)# apradio radio1  Enable the Wi-Fi interface. UltOs(config-apradio) # no shutdown  Configure a VAP (maximum 31 characters length name) UltOs(config-apradio)# ssid FDN40_ssid  Associate a VLAN with the VAP interface UltOs(config-ssid)# vlan 100  Exit the VAP configuration Mode. UltOs(config-ssid)# exit  Exit the WiFi interface Mode UltOs(config-apradio)#exit  Exit the global configuration Mode. UltOs(config)# exit 2. View the Default configurations for the created VAP in the VAP summary table UltOs# show apradio radio0 ssid summary SSID : FDN40_ssid BeaconPeriod :100 DTIM Period :1 Regulatory Domain:Yes Rate :216700000 RTS threshold :2347 Fragmentation Threshold :2346 Vlan :100 Country :US Radiomode :802.11an
CHAPTER 12: WI-FI Configuration User Manual 236 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Channel :36 Channel Width :Default Short Guard :Yes TxPower :17 Security Mode :Open WMM UAPSD :Enabled 12.3.3.2 WEB Configuration There is an operation mode in which the signals in the 3 chains are not correlated, i.e. the equipment will always have spatial multiplexing across 3 physically independent RF paths. 12.3.3.2.1 VAP (SSID) Creation VAP can be created through WEB interface using the AP Radio Setings screen (Navigation - Home-> Access Point-> Radio Settings). To configure ssid in radio1 interface, Select AP_Radio_1 in “RadioType” tab. Screen 12-3: AP RadioSettings - Creating VAP (SSID)
CHAPTER 12: WI-FI Configuration User Manual 237 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 12.3.3.2.2 VLAN Association with VAP VLAN can be associated with VAP through WEB interface using the VAP screen (Navigation - Home-> Access Point-> VAP>Security). Selec the Radio Type and the corresponding SSIDs are displayed in SSID tab. Screen 12-4: VAP 12.3.3.2.3 SSID Summary VAP configurations can be viewed through web interface using the SSID Summary screen (Navigation - Home-> Access Point-> Radio Settings->SSID Summary) Screen 12-5: SSID Summary 12.3.4 VAP deletion 12.3.4.1 CLI Configuration 1. Execute the following commands to delete a virtual access point (VAP) on the target.  Enter the Global Configuration Mode. UltOs# configure terminal  Specify the radio interface. UltOs(config)# apradio radio0  Disable the radio interface before removing a VAP . UltOs(config-apradio0)# shutdown  Delete the VAP . UltOs(config-apradio0)# no ssid FDN40_ssid  Exit the WiFi configuration Mode. . UltOs(config-apradio0)# exit  Exit the global configuration Mode . UltOs(config)# exit  View in the below command to ensure the VAP is deleted..
CHAPTER 12: WI-FI Configuration User Manual 238 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# show apradio radio0 ssid summary 12.3.4.2 WEB Configuration VAP can be deleted through WEB interface using the AP Radio Setings screen (Navigation - Home-> Access Point-> Radio Settings) Screen 12-6: AP RadioSettings - Deleting VAP (SSID) 12.3.5 Rate-limit Configurations 12.3.5.1 CLI Configurations 1. Execute the following commands to configure Rate-limiting configurations on the target.  Enter the Global Configuration Mode. UltOs# configure terminal  Specify the radio interface. UltOs(config)# apradio radio1  Rate-limit configurations can be applied for interface or for the desired Station.Rate-limit for the interface can be done as : UltOs(config-apradio1)# rate-limit interface Cir 1 Cbs 1 Eir 5000 Ebs 8000000 Coupling-Flag enable  Exit the configuration Mode. UltOs(config-apradio1)# end 2. View the Rate-limit configurations for the interface. UltOs# show apradio radio1 interfacerate-limit CIR EIR CBS EBS C-Flag RowStatus --- --- --- --- ------ --------- 1 5000 1 8000000 Enabled Active 3. Rate-limit configurations can be disabled in the WiFi configuration mode. UltOs(config-apradio1)# no rate-limit interface 4. Execute the show command to ensure if the Rate-limit configurations are deleted.
CHAPTER 12: WI-FI Configuration User Manual 239 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# show apradio radio1 interface rate-limit 5. Rate-limit configurations can be applied for a desired Station . UltOs(config-apradio1)# rate-limit station 00:00:00:00:00:01 Cir 1 Cbs 1 eir 5000 ebs 90000 Coupling-Flag Enable  Exit the WiFi configuration Mode UltOs(config-apradio)# end 6. View the Rate-limit configurations for the station. UltOs# show apradio rate-limit Station-Mac CIR EIR CBS EBS C-Flag RowStatus ----------- --- --- --- --- ------ --------- 00:00:00:00:00:01 1 5000 1 90000 Enabled Active 7. Rate-limit configuration for the station can be removed. UltOs(config-apradio1)# no rate-limit station 00:00:00:00:00:01  Exit the Wi-Fi configuration Mode. UltOs(config-apradio1)# end 8. View the Rate-limit configurations for the station. UltOs# show apradio rate-limit 12.3.5.2 WEB Configuration Rate Limit can be configured through WEB interface using the Rate Limit screen (Navigation - Home-> Access Point-> VAP>Rate Limit) Screen 12-7: Rate Limit
CHAPTER 12: WI-FI Configuration User Manual 240 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 12.3.6 Configuring Mac-Filtering for VAP 12.3.6.1 CLI Configuration Execute the following commands to configure Mac-based Filtering in the AP. 1. Enter the VAP configuration Mode for the desired VAP for which the Mac based filtering of stations need to be done. UltOs(config-apradio0)# ssid FDN40_ssid 2. Enable Mac based Filtering Mode. UltOs(config-ssid)# mac-auth enable 3. Configure the MAC addresses that needs to be allowed in this VAP.Maximum of 32 Mac address can be added beyond which Error will be thrown. UltOs(config-ssid)# mac-address 00:00:00:00:00:01 UltOs(config-ssid)# mac-address 00:00:00:00:00:02 UltOs(config-ssid)# mac-address 00:00:00:00:00:03 UltOs(config-ssid)# mac-address 00:00:00:00:00:04 4. Exit the WiFi configuration Mode UltOs(config-ssid)# end 5. View the configurations for the "ALLOWED" stations for the VAP using the following command. UltOs# show apradio radio0 stations mac-restricted SSID Status Station-Mac ---- ------ ----------- FDN40_ssid Enabled 00:00:00:00:00:01 FDN40_ssid Enabled 00:00:00:00:00:02 FDN40_ssid Enabled 00:00:00:00:00:03 FDN40_ssid Enabled 00:00:00:00:00:04 Mac -addresses can also be removed from the "LIST" for the VAP. 6. Enter the Wi-Fi Configuration Mode and the desired VAP mode. UltOs(config-apradio0)# ssid FDN40_ssid 7. Mac-address can be removed from the MAC-filtering list for the VAP. UltOs(config-ssid)# no mac-address 00:00:00:00:00:02 8. Exit the WiFi configuration Mode UltOs(config-ssid)# end 9. View the configurations for the "ALLOWED" stations for the VAP using the following command. UltOs# show apradio radio0 stations mac-restricted SSID Status Station-Mac ---- ------ ----------- FDN40_ssid Enabled 00:00:00:00:00:01 FDN40_ssid Enabled 00:00:00:00:00:03
CHAPTER 12: WI-FI Configuration User Manual 241 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. FDN40_ssid Enabled 00:00:00:00:00:04 10. The Mac- based Filtering Mode can be disabled that would eventually remove the LIST configured for the VAP. UltOs(config-ssid)# mac-auth disable UltOs(config-ssid)# end 11. -Exit the global configuration Mode and View the Mac-filtered List for the AP. UltOs# show apradio radio0 stations mac-restricted SSID Status Station-Mac 12.3.6.2 WEB Configuration Mac filtering can be configured through WEB interface using the VAP screen (Navigation - Home-> Access Point-> VAP>Security) Screen 12-8: VAP - MAC Filtering 12.3.7 Configuring Authentication Algorithms for VAP 12.3.7.1 CLI Configuration 12.3.7.1.1 Open Authentication By default , VAP is configured in the "OPEN" Authentication mode. UltOs# show apradio radio1 ssid summary SSID : FDN40_ssid BeaconPeriod :100 DTIM Period :1
CHAPTER 12: WI-FI Configuration User Manual 242 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Regulatory Domain:Yes Rate :216700000 RTS threshold :2347 Fragmentation Threshold :2346 Vlan :100 Country :US Radiomode :802.11ng Channel :36 Channel Width :Default Short Guard :Yes TxPower :17 Security Mode :Open When other algorithms are configured, "OPEN" can be configured using the following command. UltOs(config-ssid)# security auth open 12.3.7.1.2 WEP Authentication WEP configurations can be done with the Key size as 40 or 104 bits and the Key index can be one of the four index. : UltOs(config-ssid)# security static-wep-key encryption key40 ascii hello 1 UltOs(config-ssid)# end WEP configuration for the VAP is displayed in the display command. UltOs# show apradio radio1 ssid summary SSID : FDN40_ssid BeaconPeriod :100 DTIM Period :1 Regulatory Domain:Yes Rate :0 RTS threshold :2347 Fragmentation Threshold :2346 Vlan :100 Country :US Radiomode :802.11ng Channel :36 Channel Width :Default Short Guard :Yes TxPower :17 Security Mode :WEP
CHAPTER 12: WI-FI Configuration User Manual 243 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 12.3.7.1.3 WPA2 PSK AUTHENTICATION WPA2 PSK Key size must be 8 to 63 characters length The command is UltOs(config-ssid)# security wpa2-psk-key encryption 8 password 1 WPA2 PSK Configurations for the VAP interface is displayed as below: UltOs# show apradio radio1 ssid summary SSID : FDN40_ssid BeaconPeriod :100 DTIM Period :1 Regulatory Domain:Yes Rate :216700000 RTS threshold :2347 Fragmentation Threshold :2346 Vlan :100 Country :US Radiomode :802.11ng Channel :36 Channel Width :Default Short Guard :Yes TxPower :17 Security Mode :WPA2-PSK 12.3.7.2 WEB Configuration Authentication Algorithms can be configured through WEB interface using the VAP screen (Navigation - Home-> Access Point-> VAP>Security)
CHAPTER 12: WI-FI Configuration User Manual 244 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 12-9: VAP – Authentication with WEP 12.4 Displaying the Configurations 1. . View the Default configurations for the created VAP in the VAP summary table UltOs# show apradio {radio0 | radio1} ssid summary SSID : FDN40_ssid BeaconPeriod :100 DTIM Period :1 Regulatory Domain:Yes Rate :216700000 RTS threshold :2347 Fragmentation Threshold :2346 Vlan :100 Country :US Radiomode :802.11an Channel :36 Channel Width :Default Short Guard :Yes TxPower :17 Security Mode :Open 2. . View the QOS EDCA Parameters for the AP UltOs# show apradio {radio0 | radio1}edca params SSID Queue-Index CWmin CWmax AIFS
CHAPTER 12: WI-FI Configuration User Manual 245 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. -------- ----------- ----- ----- ---- : FDN40_ssid 0 4 6 3 : FDN40_ssid 1 4 10 7 : FDN40_ssid 2 3 4 1 : FDN40_ssid 3 2 3 1 3. The "ALLOWED" stations for the VAP are displayed using the following command. UltOs# show apradio {radio0 | radio1} stations mac-restricted SSID Status Station-Mac ---- ------ ----------- FDN40_ssid Enabled 00:00:00:00:00:01 FDN40_ssid Enabled 00:00:00:00:00:03 FDN40_ssid Enabled 00:00:00:00:00:04 4. Rate -limit Show commands for Interface configuration: UltOs# show apradio {radio0 | radio1} interface rate-limit CIR EIR CBS EBS C-Flag RowStatus --- --- --- --- ------ --------- 1 5000 1 8000000 Enabled Active 5. Rate-limit station configurations are displayed in the below command: UltOs# show apradio {radio0 | radio1} rate-limit Station-Mac CIR EIR CBS EBS C-Flag RowStatus ----------- --- --- --- --- ------ --------- 00:00:00:00:00:01 1 5000 1 90000 Enabled Active 6. Display for the connected stations to the Access Point UltOs# show apradio {radio0 | radio1} connected-stations statistics SSID :FDN40_ssid :: Clients connected : 1 BSSID Mac :04:f0:21:09:04:b1 Assoc UpTime (seconds) :12 Tx Packets :0 Drop -AuthFail :0 Drop- Assoc Fail :0 Rx Packets :0 Station Mac :c0:4a:00:14:44:aa
CHAPTER 12: WI-FI Configuration User Manual 246 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Ip Address: 100.0.0.30 Total number of Clients connected :1 12.5 Wi-Fi Client Association 12.5.1 CLI Configuration For a successful association of AP to a Wireless Client, following configurations need to be done in the AP 1. Create a radio1 interface and associate with a VLAN(For radio0 configure with radio0): UltOs(config)# apradio radio1 UltOs(config-apradio1)# no shutdown UltOs(config-apradio1)# UltOs(config-apradio1)# ssid ZEUS_ssid UltOs(config-ssid1)# UltOs(config-ssid1)# UltOs(config-ssid1)# end UltOs# UltOs# c t UltOs(config)# apradio radio1 UltOs(config-apradio1)# ssid ZEUS_ssid UltOs(config-ssid)# vlan 100 UltOs(config-ssid)# end UltOs# c t 2. Configure a dhcp pool to enable IP address allocation for the Wireless Client UltOs(config)# service dhcp-server UltOs(config)# ip dhcp pool 1 UltOs(dhcp-config)# network 100.0.0.30 255.255.255.0 100.0.0.50 UltOs(dhcp-config)# exit UltOs(config)# exit UltOs# c t 3. IVR configurations are done to observe switching and routing behavior UltOs(config)# int vlan 100 UltOs(config-if)# ip address 100.0.0.1 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# end UltOs# 4. - Disable Firewall configurations
CHAPTER 12: WI-FI Configuration User Manual 247 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# c t ; firewall ; disable ; exit ; exit ; 5. - Now, the wireless clients can connect to the AP 12.5.2 WEB Configuration Connection Statistics can be viewed through WEB interface using the AP Radio Statistics screen (Navigation - Home-> Statistics-> ApRadio). Select the RadioType and provide the SSID Name. Screen 12-10: AP Radio Statistics
Configuration User Manual 249 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 13 NTP 13.1 Protocol Description Network Time Protocol (NTP) message to one or more servers and processes the replies as received. The server interchanges addresses and ports, fills in or overwrites certain fields in the message, recalculates the checksum and returns it immediately. Information included in the NTP message allows each client/server peer to determine the timekeeping characteristics of its other peers, including the expected accuracies of their clocks. Using this information each peer is able to select the best time from possibly several other clocks, update the local clock and estimate its accuracy. In FDN40, system time is synchronized using NTP daemon (ntpd). ntpd is an operating system daemon which sets and maintains the system time of day in synchronism with Internet standard time servers. It is a complete implementation of the Network Time Protocol. FDN40 will use open source NTP code for NTP functionality. There will be a separate process running for controlling the ntpd daemon. This process will be responsible for managing the ntpd daemon and sending trap messages to process if NTP server is not reachable. That way, if the daemon is stopped and restarted, it can reinitialize itself to the previous estimate without spending time re computing the frequency estimate. ntpd can operate in any of several modes, including symmetric active/passive, client/server broadcast/multicast and manycast. FDN40 release 1.0 supports only NTP client configuration with maximum of 2 NTP servers for time synchronization. No modification or customization will be done on open source NTP.
CHAPTER 13: NTP Configuration User Manual 250 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 13.2 Topology Figure 13-1: NTP Topology 13.3 Configuration Guidelines The FDN40 CLI user manual can be referred for the complete set of commands and the various options available for configuring NTP. 13.4 Default Configurations Table 13-2: Default Configurations Parameter Default Setting System Control Start NTP mode Disable NTP Client mode Disabled Default Server IP 0.0.0.0 Default Min Polltime 6
CHAPTER 13: NTP Configuration User Manual 251 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 13.5 NTP Configurations 13.5.1 Configuring NTP system 13.5.1.1 Enabling the NTP system 1. Execute the following commands to enable NTP on the target. Enabling the NTP module is a two step configuration First enable NTP mode and then enabling client mode and further user configuration of server and polltime  Enter the Global Configuration Mode. UltOs# configure terminal  Enter NTP config mode. UltOs(config)# ntp  Enable NTP mode UltOs(config-ntp)# set ntp enable  Enable NTP client mode unicast set ntp client mode {unicast | multicast | disabled} UltOs(config-ntp)# set ntp client mode unicast  User can now configure IP and polltime in unicast mode UltOs(config-ntp)# exit 2. View the NTP related global information. UltOs# show ntp mode NTP SERVICE ENABLE CONFIGURATION: NTP SERVICE ENABLE : ENABLED UltOs# show ntp client mode NTP SERVCIE CONFIGURATION INFORMATION: NTP CLIENT MODE : UNICAST UltOs# show ntp server NTP SERVER INFO : Server Address: 172.30.19.172 Polltime: 6 NTP SERVER INFO : Server Address: 172.30.19.123 Polltime: 6 13.5.1.2 Disabling the NTP system 1. Execute the following commands to disable NTP on the target.  Enter the Global Configuration Mode. UltOs# configure terminal
CHAPTER 13: NTP Configuration User Manual 252 © Ulterius Technologies, LLC 2016. Confidential & Proprietary.  Enter the NTP config mode UltOs(config)# ntp  Disable the NTP client mode UltOs(config-ntp)# set ntp client mode disable  Disable the NTP mode UltOs(config-ntp)# set ntp disable 2. View the NTP related global information. UltOs# show ntp mode NTP SERVICE ENABLE CONFIGURATION: NTP SERVICE ENABLE : DISABLED UltOs# show ntp client mode NTP SERVCIE CONFIGURATION INFORMATION: NTP CLIENT MODE : DISABLED 13.5.1.3 Configuring the NTP Client Mode 1. Execute the following commands to configure NTP client mode on the target.  Enter the Global Configuration Mode. UltOs# configure terminal  Enter NTP config mode. UltOs(config)# ntp  Enable NTP mode UltOs(config-ntp)# set ntp {enable | disable}  Enable NTP client mode unicast UltOs(config-ntp)# set ntp client mode unicast 2. View the NTP client mode related global information UNICAST MODE UltOs# show ntp client mode NTP SERVCIE CONFIGURATION INFORMATION: NTP CLIENT MODE : UNICAST 13.5.1.4 2.WEB Configuration 13.5.1.4.1 Enabling/ Disabling NTP NTP can be enabled/disabled can be viewed through WEB interface using the Basic Settings screen (Navigation - Home-> NTP-> Basic Settings)
CHAPTER 13: NTP Configuration User Manual 253 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 13-1: NTP Basic Settings 13.5.1.4.2 Configuring NTP Client Mode NTP Client Mode can be configured through WEB interface using the NTP Settings screen (Navigation - Home-> NTP-> NTP Settings) Screen 13-2: NTP Client Mode 13.5.2 Configuring NTP Server 13.5.2.1 CLI Configuration To Configure NTP Server IP and Polltime the below steps to be followed: 1. Configure NTP Server with Server IP and Polltime (UNICAST MODE) UltOs# configure terminal UltOs(config)# ntp UltOs(config-if)# set ntp enable UltOs(config-if)# set ntp client mode unicast UltOs(config-if)# set ntp server 1 172.30.19.152 10 UltOs(config-if)# exit 2. Configure NTP Server IP for any one index (UNICAST MODE) UltOs# configure terminal UltOs(config)# ntp UltOs(config-if)# set ntp enable UltOs(config-if)# set ntp client mode unicast
CHAPTER 13: NTP Configuration User Manual 254 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-if)# set ntp server ip 1 172.30.19.152 UltOs(config-if)# exit 3. Configure both the NTP Server IPs. (UNICAST MODE) UltOs# configure terminal UltOs(config)# ntp UltOs(config-if)# set ntp enable UltOs(config-if)# set ntp client mode unicast UltOs(config-if)# set ntp server ips 172.30.19.152 172.30.19.153 UltOs(config-if)# exit 4. Configure both the NTP Server Polltime for any one index(UNICAST MODE) UltOs# configure terminal UltOs(config)# ntp UltOs(config-if)# set ntp enable UltOs(config-if)# set ntp client mode unicast UltOs(config-if)# set ntp server polling 1 10 UltOs(config-if)# exit 5. View the configuration by executing the show command as mentioned below. UltOs# show ntp server NTP SERVER INFO : Server Address: 172.30.19.152 Polltime: 10 NTP SERVER INFO : Server Address: 172.30.19.153 Polltime: 6 13.5.2.2 Web Configuration NTP server can be configured through WEB interface using the NTP Settings screen (Navigation - Home-> NTP-> NTP Settings)
CHAPTER 13: NTP Configuration User Manual 255 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 13-3: NTP Server Configurations
Configuration User Manual 257 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 14 QOS 14.1 Protocol Description QoS (Quality of Service) defines the ability to provide different priorities to different applications, users or data flows or the ability to guarantee a certain level of performance to a data flow. QoS at layer 2 involves 802.1p support. QoS also includes support for DiffServ (Differentiated services). This includes the flow based on specific rate limits, scheduling and shaping. QoS supports 802.1p for mapping VLAN priority to traffic class/queues. It also supports DiffServ features which include scheduling and shaping based on the features supported by the switching silicon used. The realization of QoS is done using the QoSx module on the platforms based on AXM. 14.2 Topology Figure 14-1: QOS Topology Table 14-1: QOS Topology Description Switch / Host Interface of FDN40 Switches IPv4 Address / Mask FDN40-1 VLAN 1 12.0.0.1/255.0.0.0
FDN40 Configuration User Manual 258 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 14.3 Configuration Guidelines The FDN40 CLI user manual can be referred for the complete set of commands and the various options available for configuring QoS. 14.4 Default Configurations Table 14-2: Default Configurations Parameter Default Setting System Control Start System Control Enable Rate Unit kbps Rate Granularity 64 Trace Flag 0 14.5 QoS Configurations 14.5.1 Configuring QoS Subsystem 14.5.1.1 Enabling the QoS Subsystem 1. Execute the following commands to enable QoS on the target. Enabling the QoS module programs the hardware and starts protocol operation.  Enter the Global Configuration Mode. UltOs# configure terminal  Enable the QoS. UltOs(config)# qos enable  Exit theGlobal Configuration Mode. UltOs(config)# exit 2 View the QoS related global information. UltOs# show qos global info QoS Global Information ---------------------- System Control : Start System Control : Enable Rate Unit : kbps Rate Granularity : 64 Trace Flag : 0
FDN40 Configuration User Manual 259 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 14.5.1.2 Disabling the QoS Subsystem 1. Execute the following commands to disable QoS on the target. Disabling the QoS module stops the protocol operation by deleting the hardware configuration.  Enter the Global Configuration Mode. UltOs# configure terminal  Disable the QoS. UltOs(config)# qos disable UltOs(config)# exit 2. View the QoS related global information. UltOs# show qos global info QoS Global Information ---------------------- System Control : Start System Control : Disable Rate Unit : kbps Rate Granularity : 64 Trace Flag : 0 14.5.1.3 Making the QoS Subsystem Up 1. Execute the following commands to make the QoS subsystem up. When QoS subsystem is set as start, resources required by the QoS module are allocated and QoS module starts running.  Enter the global configuration mode. UltOs# configure terminal  Make the QoS subsystem up. UltOs(config)# no shutdown qos UltOs(config)# exit 2 View the QoS related global information. UltOs# show qos global info QoS Global Information ---------------------- System Control : Start System Control : Disable Rate Unit : kbps Rate Granularity : 64 Trace Flag : 0
FDN40 Configuration User Manual 260 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 14.5.1.4 WEB Configuration QoS can be enabled/ disabled through WEB interface using the QoS Basic Settings screen (Navigation - System-> QoS-> QoSInGress-> Basic Settings) Screen 14-1: QoS Basic Settings 14.5.2 Configuring Rate-Limiting at Port level (Ingress port-rate limiting) 14.5.2.1 CLI Configuration 1. Ingress rate-limiting feature helps to rate limit the traffic ingressing on a port. UltOs# configure terminal UltOs(config)# interface lan 0/1 UltOs(config-if)# rate-limit cir 100 cbs 50 UltOs# show rate-limit Vlan CIR CBS Mode --------- ----------- --- --- ---------- -- lan0/1 0 100 50 ColorBlind 14.5.2.2 WEB Configuration Rate limiting can be configured through WEB interface using the Rate Limit screen (Navigation – System > Qos > QosIngress> Rate Limiting)
FDN40 Configuration User Manual 261 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 14-2: Ingress Rate Limiting  Supporting on LAN and WAN ports. 14.5.3 Configuring Storm-Control at Port level (Ingress port-storm control) 14.5.3.1 CLI Configuration 1. Ingress storm control feature helps to control the traffics (DLF, Muliticast and Broadcast) ingressing on a port. UltOs# configure terminal Storm-Control on WAN ports. UltOs(config)# interface wan 0/1 UltOs(config-if)# storm-control bc_dlf_mc cir 100 cbs 50 UltOs(config-if)#exit 2. UltOs# show storm-control Interface CIR CBS --------- --- --- wan0/1 100 50 14.5.3.2 WEB Configuration Rate limiting can be configured through WEB interface using the Storm Control screen (Navigation - System> Qos> QosIngress> Storm Control)
FDN40 Configuration User Manual 262 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 14-3: Storm-Control 14.5.4 Configuring Per Queue Shaping (Egress per- port per- queue shaping) 14.5.4.1 CLI Configuration 1. Shaping can be done per queue by configuring the shape-template values and mapping it to the specific queue. UltOs# configure terminal UltOs(config)# shape-template 10 cir 100 cbs 50 eir 100 ebs 50 UltOs(config)# queue 1 interface wan 0/1 shaper 10 UltOs(config)# end Here, the shaper template is created with the value cir = 1000 Kbps. The shaper template is associated to the queue. Shaping of traffic on each queue depends on the values of shaper configured for each queue. 2. View the shaping configurations of the queues of an egress interface UltOs# show queue interface wan 0/1 QoS Queue Entries ----------------- IfIndex Queue QTemplate Scheduler Weight Priority QType ShapeIdx GlobalId ------- ----- --------- --------- ------ -------- ----- -------- -------- wan0/1 1 1 0 1 0 UC 10 1
FDN40 Configuration User Manual 263 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. wan0/1 2 1 0 1 1 UC none 2 wan0/1 3 1 0 1 2 UC none 3 wan0/1 4 1 0 1 3 UC none 4 wan0/1 5 1 0 1 4 UC none 5 wan0/1 6 1 0 1 5 UC none 6 wan0/1 7 1 0 1 6 UC none 7 wan0/1 8 1 0 1 7 UC none 8 3. To disable shaping for a queue, the queue needs to be mapped to shaper 0. UltOs# configure terminal UltOs(config)# queue 1 interface wan 0/1 shaper 0 UltOs(config)# end 14.5.4.2 WEB Configuration 14.5.4.2.1 Shape Template Shape Template can be configured through WEB interface using the Shape Template Settings screen (Navigation - System-> QoS-> QoSEgress-> Shape Template)
FDN40 Configuration User Manual 264 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 14-4: Shape Template Configurations 14.5.4.2.2 Queue Table Queue Table can be configured through WEB interface using the Queue Table Settings screen (Navigation - System-> QoS-> QoSEgress-> Queue Table) Screen 14-5: Queue Configurations 14.5.5 Configuring Queue Template 14.5.5.1 CLI Configuration 1. Tail Drop can be done per queue by configuring the queue-template values and mapping it to the specific queue. UltOs# configure terminal UltOs(config)# queue-type 2
FDN40 Configuration User Manual 265 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config -qtype)# set algo-type tailDrop queue-limit 1 UltOs(config)# end UltOs(config)# queue 1 interface wan 0/1 qtype 2 UltOs(config)# end The queue template is associated to the queue. 2. View the queue template configurations of the queues of an egress interface UltOs# show queue interface wan 0/1 Queue Template Entries ---------------------- Q Template Id : 1 Q Limit : 256 Drop Type : Tail Drop Drop Algo Status : Enable 3. To disable queue-template for a queue. UltOs# configure terminal UltOs(config)# no queue 1 interface wan 0/1 UltOs(config)# end UltOs(config)#no queue-type 2 14.5.5.2 WEB Configuration 14.5.5.2.1 QueueTemplate QueueTemplate can be configured through WEB interface using the QueueTemplate Settings screen (Navigation - System-> QoS-> QoSEgress-> QueueTemplate)
FDN40 Configuration User Manual 266 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 14-10: QueueTemplate Configurations 14.5.5.2.2 Queue Table Queue Table can be configured through WEB interface using the Queue Table Settings screen (Navigation - System-> QoS-> QoSEgress-> Queue Table) Screen 14-11: Queue Configurations 14.5.6 Configuring Queue Map 14.5.6.1 CLI Configuration 1. Queue Map can be done per queue by configuring the qmap values and mapping it to the specific queue. UltOs# configure terminal UltOs(config)# queue-map regn-priority vlanPri 0 interface lan 0/1 queue-id 1 UltOs(config)# end The queue map is associated to the queue. 2. View the queue map configurations of the queues of an egress interface UltOs# show queue interface lan 0/1 Q Template Id : 1 QoS Queue Map Entries --------------------- IfIndex CLASS PriorityType Priority Value Mapped Queue ---------- ---------- --------------- --------------- --------------- lan0/1 none VlanPri 0 1 3. To disable queue-map for a queue. UltOs# configure terminal
FDN40 Configuration User Manual 267 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# no queue-map regn-priority vlanPri 0 interface lan 0/1 UltOs(config)# end 14.5.6.2 WEB Configuration 14.5.6.2.1 QueueTemplate Queue Map can be configured through WEB interface using the Queue Map screen (Navigation - System-> QoS-> QoSEgress-> QMap) Screen 14-12: Queue Map Configurations 14.5.7 Configuring Scheduler 14.5.7.1 CLI Configuration The supported scheduling algorithms are:  Strict-Priority scheduling 1. Configure the scheduling algorithm UltOs# configure terminal UltOs(config)# scheduler interface wan 0/1 sched-algo strict-priority UltOs# show scheduler QoS Scheduler Entries --------------------- IfIndex Scheduler Index Scheduler Algo Shape Index Scheduler HL Global
FDN40 Configuration User Manual 268 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Id ---------- --------------- -------------------- ----------- ------------ ------- ----- wan0/1 0 strictPriority 0 0 1 ApRadio2 0 strictPriority 0 0 2 ApRadio3 0 strictPriority 0 0 3 lan0/1 0 strictPriority 0 0 4 lan0/2 0 strictPriority 0 0 5 lan0/3 0 strictPriority 0 0 6 lan0/4 0 strictPriority 0 0 7 14.5.7.2 WEB Configuration Scheduler Table can be configured through WEB interface using the Scheduler Table Settings screen (Navigation - System-> QoS-> QoSEgress-> Scheduler Table) Screen 14-6: Scheduler Configurations  Schedulers are Pre-Created at ports.
FDN40 `FDN40ConfigUM/20160505 269 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Chapter 15 OSPF 15.1 Protocol Description OSPF (Open Shortest Path First) protocol, is an Interior Gateway Protocol used to distribute routing information within a single Autonomous System. Routers use link-state algorithms to send routing information to all nodes in an inter-network by calculating the shortest path to each node based on the topography of the Internet constructed by each node. Each router sends that portion of the routing table (keeps track of routes to particular network destinations), which describes the state of its own links. In addition, it also sends the complete routing structure (topography). The OSPF basic and advanced configuration tasks are described in the following section(s)
FDN40 `FDN40ConfigUM/20160505 270 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.2 Topology Figure 15-1: OSPF Topology
FDN40 `FDN40ConfigUM/20160505 271 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.3 Configuration Guidelines The following sections describe the configuration of OSPF running as a part of ULTERIUS FDN40 product. This is a prerequisite for configuring the OSPF. 15.3.1 Configuration in FDN40-1 Prerequisite: Configuration of VLAN Interfaces (vlan11 and vlan10) UltOs# configure terminal UltOs(config)# vlan 11 UltOs(config-vlan)# ports wan 0/1 untagged wan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 11 UltOs(config-if)# shut UltOs(config-if)# ip address 10.4.0.1 255.255.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 10 UltOs(config-vlan)# ports wan 0/2 untagged wan 0/2 UltOs(config-vlan)# exit UltOs(config)# interface vlan 10 UltOs(config-if)# shutdown UltOs(config-if)# ip address 10.10.2.1 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# interface wan0/2 UltOs(config-if)# switchport pvid 10 UltOs(config-if)# no shutdown UltOs(config-if)# exit 15.3.2 Configuration in FDN40-2 Prerequisite: Configuration of VLAN Interfaces UltOs# configure terminal UltOs(config)# vlan 11 UltOs(config-vlan)# ports wan 0/1 untagged wan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 11
FDN40 `FDN40ConfigUM/20160505 272 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-if)# shutdown UltOs(config-if)# ip address 10.4.0.2 255.255.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 2 UltOs(config-vlan)# ports wan 0/2 untagged wan 0/2 UltOs(config-vlan)# exit UltOs(config)# interface vlan 2 UltOs(config-if)# ip address 10.2.2.2 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# interface wan 0/2 UltOs(config-if)# no shutdown UltOs(config-if)# switchport pvid 2 UltOs(config-if)# exit 15.3.3 Configuration in FDN40-3 Prerequisite: Configuration of VLAN Interfaces UltOs# configure terminal UltOs(config)# vlan 11 UltOs(config-vlan)# ports wan 0/1 untagged wan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 11 UltOs(config-if)# shutdown UltOs(config-if)# ip address 10.4.0.3 255.255.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 2 UltOs(config-vlan)# ports wan 0/2 untagged wan 0/2 UltOs(config-vlan)# exit UltOs(config)# interface vlan 2 UltOs(config-if)# ip address 10.1.1.3 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# interface wan 0/2 UltOs(config-if)# no shutdown
FDN40 `FDN40ConfigUM/20160505 273 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-if)# switchport pvid 2 UltOs(config-if)# exit 15.3.4 Configuration in FDN40-4 Prerequisite: Configuration of VLAN Interfaces UltOs# configure terminal UltOs(config)# interface wan 0/1 UltOs(config-if)# no shutdown UltOs(config)# exit UltOs(config)# vlan 11 UltOs(config-vlan)# ports wan 0/1 untagged wan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 11 UltOs(config-if)# shutdown UltOs(config-if)# ip address 10.4.0.4 255.255.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 3 UltOs(config-vlan)# ports wan 0/2 UltOs(config-vlan)# exit UltOs(config)# interface vlan 3 UltOs(config-if)# ip address 10.5.6.4 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 4 UltOs(config-vlan)# ports add wan 0/2 UltOs(config-vlan)# exit UltOs(config)# interface vlan 4 UltOs(config-if)# ip address 10.5.5.4 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit 15.3.5 Configuration in FDN40-5 Prerequisite: Configuration of VLAN Interfaces UltOs# configure terminal UltOs(config)# vlan 11
FDN40 `FDN40ConfigUM/20160505 274 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-vlan)# ports wan 0/1 untagged wan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 11 UltOs(config-if)# shutdown UltOs(config-if)# ip address 10.8.0.5 255.255.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 4 UltOs(config-vlan)# ports wan 0/2 untagged wan 0/2 UltOs(config-vlan)# exit UltOs(config)# interface vlan 4 UltOs(config-if)# ip address 10.5.5.5 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# interface wan 0/2 UltOs(config-if)# no shutdown UltOs(config-if)# switchport pvid 4 UltOs(config-if)# exit 15.3.6 Configuration in FDN40-6 Prerequisite: Configuration of VLAN Interfaces UltOs# configure terminal UltOs(config)# vlan 11 UltOs(config-vlan)# ports wan 0/1 untagged wan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 11 UltOs(config-if)# shutdown UltOs(config-if)# ip address 10.7.0.6 255.255.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 3 UltOs(config-vlan)# ports wan 0/2 untagged wan 0/2 UltOs(config-vlan)# exit UltOs(config)# interface vlan 3 UltOs(config-if)# ip address 10.5.6.6 255.255.255.0 UltOs(config-if)# no shutdown
FDN40 `FDN40ConfigUM/20160505 275 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-if)# exit UltOs(config)# interface wan 0/2 UltOs(config-if)# no shutdown UltOs(config-if)# switchport pvid 3 UltOs(config-if)# exit 15.3.7 Configuration in FDN40-7 Prerequisite: Configuration of VLAN Interfaces UltOs# configure terminal UltOs(config)# vlan 11 UltOs(config-vlan)# ports wan 0/1 untagged wan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 11 UltOs(config-if)# shutdown UltOs(config-if)# ip address 10.8.0.7 255.255.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit 15.3.8 Configuration in FDN40-6 Prerequisite: Configuration of VLAN Interfaces UltOs# configure terminal UltOs(config)# vlan 10 UltOs(config-vlan)# ports wan 0/2 untagged wan 0/2 UltOs(config-vlan)# exit UltOs(config)# interface vlan 10 UltOs(config-if)# shutdown UltOs(config-if)# ip address 10.10.2.8 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# interface wan 0/2 UltOs(config-if)# switchport pvid 10 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# vlan 11 UltOs(config-vlan)# ports wan 0/1 untagged wan 0/1
FDN40 `FDN40ConfigUM/20160505 276 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-vlan)# exit UltOs(config)# interface vlan 11 UltOs(config-if)# shutdown UltOs(config-if)# ip address 10.10.1.8 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# interface wan 0/1 UltOs(config-if)# switchport pvid 11 UltOs(config-if)# no shutdown UltOs(config-if)# exit 15.3.9 Configuration in FDN40-9 Prerequisite: Configuration of VLAN Interfaces UltOs# configure terminal UltOs(config)# vlan 2 UltOs(config-vlan)# ports wan 0/2 untagged wan 0/2 UltOs(config-vlan)# exit UltOs(config)# interface vlan 2 UltOs(config-if)# shutdown UltOs(config-if)# ip address 10.2.2.9 255.255.255.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# interface wan 0/2 UltOs(config-if)# switchport pvid 2 UltOs(config-if)# no shutdown UltOs(config-if)# exit 15.4 Default Configurations Table 15-1: Default Configurations Parameter Default Configuration Stability interval 40 translation-role Candidate compatible rfc1583 Enabled abr-type standard neighbor priority 1 area default-cost 10
FDN40 `FDN40ConfigUM/20160505 277 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. area tos 0 area metric 10 area - metric-type 1 area - tos 0 default-information originate always metric 10 default-information originate always metric metric-type 2 Authentication no authentication hello-interval 10 retransmit-interval 5 transmit-delay 1 dead-interval 40 tag 2 summary-address advertise translation disabled redist-config metric-value 10 redist-config metric-type asExttype2 redist-config tag manual nssa asbr-default-route translator disable
FDN40ConfigUM/20160505 279 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. 15.5 OSPF Configurations 15.5.1 Enabling and Disabling OSPF Enabling OSPF takes the user to the Router Configuration Mode from which the router related commands are executed. Disabling OSPF terminates the OSPF process. 15.5.1.1 CLI Configuration 1. Execute the following commands to enable OSPF. - Enter the Global Configuration mode. UltOs# configure terminal - Enable OSPF globally in the Switch FDN40-1. UltOs(config)# router ospf 2. This command takes the user to the router configuration mode. UltOs(config-router)# To disable OSPF globally in the switch FDN40-1 by executing the following command. UltOs(config)# no router ospf 15.5.1.2 WEB Configuration OSPF can be enabled/ disabled through WEB interface using the OSPF VRF Creation screen (Navigation - Layer3 Management > OSPF > OSPF VRF Creation Screen 15-1: OSPF VRF Creation
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 280 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.5.2 Configuring Router-id The Router-id configured must be one of the IP addresses of the IP interfaces configured in the switch. 15.5.2.1 CLI Configuration 1. Execute the following commands to configure the router-id. - Enter the Global Configuration mode. UltOs# configure terminal - Enable OSPF globally in the Switch FDN40-1. UltOs(config)# router ospf - Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 It is possible to configure an arbitrary value for the IP address for each router. However, each router ID must be unique. To ensure uniqueness, the router-id must match with one of the IP interface addresses of the router. - Exit from the Router Configuration mode. UltOs(config-router)# exit 2. View the configuration details by executing the following show command. UltOs# show ip ospf OSPF Router ID 10.10.2.1 Supports only single TOS(TOS0) route ABR Type supported is Standard ABR It is an Area Border Router Number of Areas in this router is 2 Area is 0.0.0.6 Number of interfaces in this area is 1 SPF algorithm executed 6 times Area is 0.0.0.0 Number of interfaces in this area is 1 SPF algorithm executed 6 times 15.5.2.2 WEB Configuration Router id can be set to configured through WEB interface using the OSPF Basic Settings screen (Navigation - Layer3 Management > OSPF > Basic Settings)
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 281 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 15-2: OSPF Basic Settings 15.5.3 Configuring OSPF Interface 15.5.3.1 CLI Configuration 1. Execute the following commands to configure OSPF interface. - Enter the Global Configuration mode. UltOs# configure terminal - Enable OSPF globally in the Switch FDN40-1. UltOs(config)# router ospf - Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 - Enable OSPF over the VLAN interface and associate the interface with an OSPF area. VLAN Interfaces VLAN11 and VLAN10 are created as part of the prerequisite configuration. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 - Enabling OSPF over the VLAN interfaces defines the interfaces on which OSPF runs and the area ID for those interfaces.
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 282 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2. View the configuration details by executing the following show command. UltOs# show ip ospf OSPF Router ID 10.10.2.1 Supports only single TOS(TOS0) route ABR Type supported is Standard ABR It is an Area Border Router Number of Areas in this router is 2 Area is 0.0.0.6 Number of interfaces in this area is 1 SPF algorithm executed 6 times Area is 0.0.0.0 Number of interfaces in this area is 1 SPF algorithm executed 6 times 3. View the OSPF interfaces. UltOs# show ip ospf interface vlan11 is line protocol is up Internet Address 10.4.0.1, Mask 255.255.0.0, Area 0.0.0.0 AS 1, Router ID 10.10.2.1, Network Type BROADCAST, Cost 1 Transmit Delay is 1 sec, State 4, Priority 1 Designated RouterId 10.10.2.1, Interface address 10.4.0.1 Backup Designated RouterId 10.4.0.4, Interface address 10.4.0.4 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 8 sec Neighbor Count is 3, Adjacent neighbor count is 3 Adjacent with the neighbor 10.4.0.4 Adjacent with the neighbor 10.4.0.3 Adjacent with the neighbor 10.4.0.2 vlan10 line protocol is up Internet Address 10.10.2.1, Mask 255.255.255.0, Area 0.0.0.6 AS 1, Router ID 10.10.2.1, Network Type BROADCAST, Cost 1 Transmit Delay is 1 sec, State 4, Priority 1
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 283 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Designated RouterId 10.10.2.1, Interface address 10.10.2.1 Backup Designated RouterId 10.10.1.8, Interface address 10.10.2.8 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 6 sec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with the neighbor 10.10.1.8 OSPF Router ID 10.10.2.1 Execute the no form of the command to disable OSPF routing for the interfaces defined and to remove the area ID of the interface. UltOs(config-router)# no network 10.4.0.1 area 0.0.0.0 PW interface can be configured as OSPF interface similar to router port. For Creating and assigning the IP address to PW interface refer FDN40 configuration user manual. 15.5.3.2 WEB Configuration Interface can be set to configured through WEB interface using the OSPF Basic Settings screen (Navigation - Layer3 Management > OSPF > Interface Screen 15-3: OSPF Interface Configuration
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 284 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.5.4 Configuring OSPF Interface Parameters The interface parameters are configured in the Interface Configuration mode. 15.5.4.1 CLI Configuration Execute the following commands prior to the configuration of OSPF Interface Parameters. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Enable OSPF over the VLAN interface and associate the interface with an OSPF area. VLAN Interfaces VLAN11 and VLAN10 are created as part of the prerequisite configuration. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 UltOs(config-router)# exit 5. Enter the Interface Configuration mode. UltOs(config)# interface vlan 11 UltOs(config-if)# 15.5.4.2 WEB Configuration OSPF Interface Parameters can be configured through WEB interface using the OSPF Interface screen. For screenshot, refer section 4.5.3.2 15.5.5 Configuring OSPF Interface Priority Configuring OSPF Interface Priority sets the interface priority of the router, which helps to determine the designated router for the link connected to the interface. 15.5.5.1 CLI Configuration 1. Execute the following command to configure the VLAN 11 interface priority as 10. UltOs(config-if)#ip ospf priority 10 2. View the configuration details by executing the following show command. UltOs# show ip ospf interface vlan 11 vlan11 is line protocol is up
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 285 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Internet Address 10.4.0.1, Mask 255.255.0.0, Area 0.0.0.0 AS 1, Router ID 10.10.2.1, Network Type BROADCAST, Cost 1 Transmit Delay is 1 sec, State 4, Priority 10 Designated RouterId 10.10.2.1, Interface address 10.4.0.1 No backup designated router on this network Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 4 sec Neighbor Count is 0, Adjacent neighbor count is 0 15.5.5.2 WEB Configuration OSPF Interface Priority can be configured through WEB interface using the OSPF Interface screen. For screenshot, refer section 4.5.3.2. A priority value of 0 signifies that the router is not eligible to become the designated router on a particular network. The default interface priority value is 1. Restore the default value of the OSPF Interface by executing the following command. UltOs(config-if)# no ip ospf priority 15.5.6 Configuring LSA Retransmission Level Configuring LSA Retransmission Interval specifies the time interval between the successive link-state advertisement (LSA) retransmissions. 15.5.6.1 CLI Configuration 1. Execute the following command to configure the VLAN 11 retransmit-interval as 10 seconds. UltOs(config-if)# ip ospf retransmit-interval 10 2. View the configuration details by executing the following show command. UltOs# show ip ospf interface vlan 11 vlan11 is line protocol is up Internet Address 10.4.0.1, Mask 255.255.0.0, Area 0.0.0.0 AS 1, Router ID 10.10.2.1, Network Type BROADCAST, Cost 1 Transmit Delay is 1 sec, State 4, Priority 1 Designated RouterId 10.10.2.1, Interface address 10.4.0.1 No backup designated router on this network
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 286 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 10 Neighbor Count is 0, Adjacent neighbor count is 0 15.5.6.2 WEB Configuration LSA Retransmission Level can be configured through WEB interface using the OSPF Interface screen. For screenshot, refer section 4.5.3.2. Restore the default value of retransmission interval by executing the following command. UltOs(config-if)# no ip ospf retransmit-interval 15.5.7 Configuring Hello Interval Configuring Hello Interval specifies the interval between the hello packets sent on the interface. 15.5.7.1 CLI Configuration 1. Execute the following command to configure the VLAN 11 hello interval as 40 seconds. UltOs(config-if)# ip ospf hello-interval 40 2. View the configuration details by executing the following show command. UltOs# show ip ospf interface vlan 11 vlan11 is line protocol is up Internet Address 10.4.0.1, Mask 255.255.0.0, Area 0.0.0.0 AS 1, Router ID 10.10.2.1, Network Type BROADCAST, Cost 1 Transmit Delay is 1 sec, State 4, Priority 1 Designated RouterId 10.10.2.1, Interface address10.4.0.1 No backup designated router on this network Timer intervals configured, Hello 40, Dead 40, Wait 40, Retransmit 5 Hello due in 4 sec Neighbor Count is 0, Adjacent neighbor count is 0 15.5.7.2 WEB Configuration Hello Interval can be configured through WEB interface using the OSPF Interface screen. For screenshot, refer section 4.5.3.2. 15.5.8 Configuring Dead Interval Configuring Dead-Interval sets the interval at which hello packets must not be seen before the neighbors declare the router down.
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 287 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.5.8.1 CLI Configuration 1. Execute the following command to configure the VLAN 11 dead-interval as 120 seconds. UltOs(config-if)# ip ospf dead-interval 120 2. View the configuration details by executing the following show command. UltOs# show ip ospf interface vlan 11 vlan11 is line protocol is up Internet Address 10.4.0.1, Mask 255.255.0.0, Area 0.0.0.0 AS 1, Router ID 10.10.2.1, Network Type BROADCAST, Cost 1 Transmit Delay is 1 sec, State 4, Priority 1 Designated RouterId 10.10.2.1, Interface address 10.4.0.1 No backup designated router on this network Timer intervals configured, Hello 10, Dead 120, Wait 120, Retransmit 5 Hello due in 4 sec Neighbor Count is 0, Adjacent neighbor count is 0 15.5.8.1 WEB Configuration Dead Interval can be configured through WEB interface using the OSPF Interface screen. For screenshot, refer section 4.5.3.2. Restore the default value for dead-interval (40 seconds) by executing the following command. UltOs(config-if)# no ip ospf dead-interval 15.5.9 Configuring Network Type The OSPF network type can be broadcast only. The OSPF network type can not be configured to a type other than the default for a given media. 15.5.10 Configuring Interface Cost Configuring Interface Cost explicitly specifies the cost of sending a packet on an interface. 15.5.10.1 CLI Configuration 1. Execute the following command to configure the VLAN 11 interface cost as 20. UltOs(config-if)# ip ospf cost 20 2. View the configuration details by executing the following show command. UltOs# show ip ospf interface vlan 11
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 288 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. vlan11 is line protocol is up Internet Address 10.4.0.1, Mask 255.255.0.0, Area 0.0.0.0 AS 1, Router ID 10.10.2.1, Network Type BROADCAST, Cost 20 Transmit Delay is 1 sec, State 4, Priority 1 Designated RouterId 10.10.2.1, Interface address 10.4.0.1 No backup designated router on this network Timer intervals configured, Hello 10, Dead 120, Wait 120, Retransmit 5 Hello due in 4 sec Neighbor Count is 0, Adjacent neighbor count is 0 15.5.10.2 WEB Configuration OSPF Interface Cost can be configured through WEB interface using the OSPF Interface screen. For screenshot, refer section 4.5.3.2. Restore the default value for interface cost by executing the following command. UltOs(config-if)# no ip ospf cost 15.5.11 Configuring OSPF Authentication The authentication type for OSPF can be configured as “Simple Password Authentication”, “Message-Digest Authentication” or “Null Authentication”. The following sections describe the configuration of OSPF Authentication. Authentication related configuration are done in the Interface Configuration mode. Execute the following commands prior to the configuration of OSPF Authentication. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Enable OSPF over the VLAN interface (VLAN Interfaces vlan11 and vlan10 already created as part of prerequisite configuration) and associate the interface with an OSPF area. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 UltOs(config-router)# exit 5. Enter the Interface Configuration mode. UltOs(config)# interface vlan 11
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 289 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-if)# Sample Configuration for Testing Authentication Figure 15-2: Topology for Testing Authentication Some prerequisite configuration (refer Configuration Guidelines (Prerequisite)) must be done in the switches FDN40-2, FDN40-4 before configuring OSPF. 15.5.11.1 Configuring Simple Password Authentication For the Simple Password Authentication, a password must be specified which is to be used by the neighboring routers that are using the OSPF simple password authentication. 15.5.11.1.1 CLI Configuration 1. Execute the following commands in FDN40-2 and FDN40-4. Simple Password authentication Configuration in FDN40-2:
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 290 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. - Enter the Global Configuration mode. UltOs# configure terminal - Enable OSPF globally in the switch FDN40-2. UltOs(config)# router ospf - Configure the OSPF router-id. UltOs(config-router)# router-id 10.4.0.2 - Enable OSPF over the VLAN interface and associate the interface with an OSPF area. UltOs(config-router)# network 10.4.0.2 area 0.0.0.0 - Exit from the router configuration mode. UltOs(config-router)# exit - Enter the Interface Configuration mode. UltOs(config)#interface vlan 11 - Configure the authentication key for simple password authentication. UltOs(config-if)# ip ospf authentication-key 1234 - Enable simple password authentication. UltOs(config-if)# ip ospf authentication - Exit from the Interface Configuration mode. UltOs(config-if)# exit - Exit from the configuration mode. UltOs(config)# exit Configuration in FDN40-4: - Enter the Global Configuration mode. UltOs# configure terminal - Enable OSPF globally in the switch FDN40-4. UltOs(config)# router ospf - Configure the OSPF router-id. UltOs(config-router)# router-id 10.4.0.4 - Enable OSPF over the VLAN interface and associate the interface with an OSPF area. UltOs(config-router)# network 10.4.0.4 area 0.0.0.0 - Exit from the Router Configuration mode. UltOs(config-router)# exit - Enter the Interface Configuration mode. UltOs(config)#interface vlan 11 - Configure the authentication key for simple password authentication. UltOs(config-if)# ip ospf authentication-key 1234
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 291 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. - Enable simple password authentication. UltOs(config-if)# ip ospf authentication - Exit from the Interface Configuration mode. UltOs(config-if)# exit - Exit from the configuration mode. UltOs(config)# exit UltOs# 2.View the authentication type configured by executing the following show command. UltOs# show ip ospf interface vlan11 is line protocol is up Internet Address 10.4.0.2, Mask 255.255.0.0, Area 0.0.0.0 AS 1, Router ID 10.4.0.2, Network Type BROADCAST, Cost 1 Transmit Delay is 1 sec, State 5, Priority 1 Designated RouterId 10.4.0.4, Interface address 10.4.0.4 Backup Designated RouterId 10.4.0.2, Interface address 10.4.0.2 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 0 sec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with the neighbor 10.4.0.4 Simple password authentication enabled 3.View the adjacency formed between the neighbors (FDN40-2 and FDN40-4) by executing the following command. UltOs# show ip ospf neighbor detail Neighbor 10.4.0.4, interface address 10.4.0.4 In the area 0.0.0.0 via interface vlan11 Neighbor priority is 1, State is FULL/BACKUP, 5 state changes DR is 10.4.0.4 BDR is 10.4.0.2 Options is 0x2 A previously assigned OSPF password can be removed by executing the following command. UltOs(config-if)# no ip ospf authentication-key 15.5.11.1.2 WEB Configuration OSPF Simple Password Authentication can be configured through WEB interface using the OSPF Interface screen. For screenshot, refer section 4.5.3.2. A previously assigned OSPF password can be removed by executing the following command. UltOs(config-if)# no ip ospf authentication-key
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 292 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.5.11.2 Configuring Message-Digest Authentication Message-Digest authentication is a cryptographic authentication. A key (password) and key-id are configured on each router. The router uses an algorithm based on the OSPF packet, the key, and the key-id to generate a “message-digest” that appends to the packet. 15.5.11.2.1 CLI Configuration 1. Execute the following commands to configure the message-digest authentication. Configuration in FDN40-2: ˗ Enter the Global Configuration mode. UltOs# configure terminal ˗ Enter the Interface Configuration mode. UltOs(config)#interface vlan 11 ˗ Delete the authentication key for simple password authentication. UltOs(config-if)# no ip ospf authentication-key ˗ Configure the authentication key for the message-digest authentication. UltOs(config-if)# ip ospf message-digest-key 0 md5 asdf ˗ Enable message-digest authentication. UltOs(config-if)# ip ospf authentication message-digest ˗ Exit from the Interface Configuration mode. UltOs(config-if)# exit ˗ Exit from the configuration mode. UltOs(config)# exit Configuration in FDN40-4: ˗ Enter the Global Configuration mode. UltOs# configure terminal ˗ Enter the Interface Configuration mode. UltOs(config)#interface vlan 11 ˗ Delete the authentication key for simple password authentication. UltOs(config-if)# no ip ospf authentication-key ˗ Configure the authentication key for message-digest authentication. UltOs(config-if)# ip ospf message-digest-key 0 md5 asdf ˗ Enable message-digest authentication.
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 293 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-if)# ip ospf authentication message-digest ˗ Exit from the Interface Configuration mode. UltOs(config-if)# exit ˗ Exit from the configuration mode. UltOs(config)# exit 2. View the configuration details by executing the following show commands. In FDN40-2: View the type of authentication configured. UltOs# show ip ospf interface 0 vlan11 is line protocol is up Internet Address 10.4.0.2, Mask 255.255.0.0, Area 0.0.0.0 AS 1, Router ID 10.4.0.2, Network Type BROADCAST, Cost 1 Transmit Delay is 1 sec, State 5, Priority 1 Designated RouterId 10.4.0.4, Interface address 10.4.0.4 Backup Designated RouterId 10.4.0.2, Interface address 10.4.0.2 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 0 sec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with the neighbor 10.4.0.4 Message digest authentication enabled Youngest key id is 0 View the adjacency formation between the neighbors. UltOs# show ip ospf neighbor detail Neighbor 10.4.0.4, interface address 10.4.0.4 In the area 0.0.0.0 via interface vlan11 Neighbor priority is 1, State is FULL/BACKUP, 5 state changes DR is 10.4.0.4 BDR is 10.4.0.2 Options is 0x2 15.5.11.2.2 WEB Configuration OSPF Message Digest Authentication can be configured through WEB interface using the OSPF Interface screen. For screenshot, refer section 4.5.3.2.
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 294 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.5.11.3 Configuring Message-Digest with key constants 15.5.11.3.1 CLI Configuration 1. Execute the following commands to configure the message-digest authentication with key constants. Configuration in FDN40-2: - Enter the Global Configuration mode. UltOs# configure terminal - Enter the Interface Configuration mode. UltOs(config)#interface vlan 11 - Delete the authentication key for simple password authentication. UltOs(config-if)# no ip ospf authentication-key - Configure the authentication key for the message-digest authentication. UltOs(config-if)# ip ospf message-digest-key 1 md5 asdf - Enable message-digest authentication. UltOs(config-if)# ip ospf authentication message-digest Configuration in FDN40-4: - Enter the Global Configuration mode. UltOs# configure terminal - Enter the Interface Configuration mode. UltOs(config)#interface vlan 11 - Delete the authentication key for simple password authentication. UltOs(config-if)# no ip ospf authentication-key - Configure the authentication key for the message-digest authentication. UltOs(config-if)# ip ospf message-digest-key 1 md5 asdf - Enable message-digest authentication. UltOs(config-if)# ip ospf authentication message-digest 2. View the configuration details by executing the following show commands. In FDN40-2: View the type of authentication configured. UltOs# show ip ospf interface vlan11 is line protocol is up Internet Address 12.0.0.1, Mask 255.0.0.0, Area 0.0.0.0 AS 1, Router ID 12.0.0.1, Network Type BROADCAST, Cost 1
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 295 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Transmit Delay is 1 sec, State 5, Priority 1 Designated RouterId 12.0.0.2, Interface address 12.0.0.2 Backup Designated RouterId 12.0.0.1, Interface address 12.0.0.1 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 7 sec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with the neighbor 12.0.0.2 Message digest authentication enabled Youngest key id is 1 Key Start Accept Time is 30 Jan 2012 09:21 Key Start Generate Time is 30 Jan 2012 09:21 Key Stop Generate Time is 30 Jan 2012 09:31 Key Stop Generate Time is 30 Jan 2012 09:31 Connected to VRF default 15.5.11.3.2 WEB Configuration OSPF Message Digest Authentication can be configured through WEB interface using the OSPF Interface screen. For screenshot, refer section 4.5.3.2. 15.5.11.4 Configuring NULL Authentication 15.5.11.4.1 CLI Configuration 1. Execute the following commands to configure the OSPF authentication type as Null Authentication. Configuration in FDN40-2: ˗ Enter the Global Configuration mode. UltOs# configure terminal ˗ Enter the Interface Configuration mode. UltOs(config)#interface vlan 11 ˗ Delete the authentication key for message digest authentication. UltOs(config-if)# no ip ospf message-digest-key 0 ˗ Enable Null digest authentication. UltOs(config-if)# ip ospf authentication null ˗ Exit from the Interface Configuration mode. UltOs(config-if)# exit ˗ Exit from the configuration mode. UltOs(config)# exit
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 296 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# Configuration in FDN40-4: ˗ Enter the Global Configuration mode. UltOs# configure terminal ˗ Enter the Interface Configuration mode. UltOs(config)#interface vlan 11 ˗ Delete the authentication key for message digest authentication. UltOs(config-if)# no ip ospf message-digest-key 0 ˗ Enable Null digest authentication. UltOs(config-if)# ip ospf authentication null ˗ Exit from the Interface Configuration mode. UltOs(config-if)# exit ˗ Exit from the configuration mode. UltOs(config)# exit 2. View the adjacency formation between the neighbors by executing the following show command. UltOs# show ip ospf neighbor detail Neighbor 10.4.0.4, interface address 10.4.0.4 In the area 0.0.0.0 via interface vlan11 Neighbor priority is 1, State is FULL/BACKUP, 5 state changes DR is 10.4.0.4 BDR is 10.4.0.2 Options is 0x23 15.5.11.4.2 WEB Configuration OSPF Message Digest Authentication can be configured through WEB interface using the OSPF Interface screen. For screenshot, refer section 4.5.3.2 15.5.12 Configuring Passive Interface Configuring Passive Interface suppresses routing updates on all interfaces. 15.5.12.1 CLI Configuration 1. Execute the following commands to suppress routing updates on all the interfaces. - Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 297 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. - Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf - Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 - Suppress routing updates by executing the following command. UltOs(config-if)# passive-interface default All the OSPF interfaces created after the execution of this command will be passive. This is useful in Internet service provider (ISP) and large enterprise networks where many of the distribution routers have more than 200 interfaces. - Enable OSPF over the VLAN interface. UltOs(config-if)# network 10.4.0.1 area 0.0.0.0 2. View the configuration details using the following command. UltOs# show ip ospf interface vlan 11 vlan11 is line protocol is up Internet Address 10.4.0.1, Mask 255.255.0.0, Area 0.0.0.0 AS 1, Router ID 10.10.2.1, Network Type BROADCAST, Cost 1 Transmit Delay is 1 sec, State 2, Priority 1 No designated router on this network No backup designated router on this network Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 No Hellos (Passive interface) Neighbor Count is 0, Adjacent neighbor count is 0 Restore routing updates on all interfaces by executing the following commands. UltOs(config-if)# no network 10.4.0.1 area 0.0.0.0 UltOs(config-if)# no passive-interface default It is also possible to suppress routing updates on a specified interface. 1. Execute the following commands to suppress routing updates on a specified interface. - Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal - Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 298 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. - Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 - Exit from the router configuration mode. UltOs(config-router)# exit - Enter the Interface Configuration Mode for VLAN 11. UltOs(config)# interface vlan 11 - Enable OSPF over the VLAN interface. UltOs(config-if)# network 10.4.0.1 area 0.0.0.0 - Configure the VLAN 11 interface as passive interface. UltOs(config-if)# passive-interface vlan 11 2. View the configuration details by executing the following show command. UltOs# show ip ospf interface vlan 11. vlan11 is line protocol is up Internet Address 10.4.0.1, Mask 255.255.0.0, Area 0.0.0.0 AS 1, Router ID 10.10.2.1, Network Type BROADCAST, Cost 1 Transmit Delay is 1 sec, State 2, Priority 1 No designated router on this network No backup designated router on this network Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 No Hellos (Passive interface) Neighbor Count is 0, Adjacent neighbor count is 0 15.5.12.2 WEB Configuration OSPF Message Digest Authentication can be configured through WEB interface using the OSPF Interface screen. For screenshot, refer section 4.5.3.2 Restore routing updates on interface VLAN 11. UltOs(config-if)# no passive-interface vlan 11 15.5.13 Configuring OSPF Area Parameters Area parameters can be configured only after enabling the OSPF process. Area parameters are configured in the Router Configuration mode. 15.5.13.1 Configuring Stub Area Configuring Stub Area specifies an area as a stub area. It also configures other parameters related to that area.
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 299 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.5.13.1.1 CLI Configuration Execute the following commands to configure an area as a stub area. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Configure the OSPF interface. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 5. Configure the area 0.0.0.6 as a stub area. UltOs(config-router)# area 0.0.0.6 stub Execute the following command to re-Configure the area 0.0.0.6 as a normal area. UltOs(config-router)# no area 0.0.0.6 stub Refer Sample Configuration for Stub area, ASBR and route redistribution. 15.5.13.1.2 WEB Configuration OSPF Stub Area can be set to configured through WEB interface using the OSPF Area Configuration screen (Navigation - Layer3 Management > OSPF > Area) Screen 15-4: OSPF Area Configuration
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 300 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.5.13.2 Configuring ASBR Router Routers that act as gateways (redistribution) between OSPF and other routing protocols (IGRP, EIGRP, RIP, BGP, Static) or other instances of the OSPF routing process are called autonomous system boundary router (ASBR). 15.5.13.2.1 CLI Configuration Execute the following commands to configure a router as an ASBR router. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Configure the ASBR router. UltOs(config-router)# asbr router Disable the ASBR router by executing the following command. UltOs(config-router)# no asbr router Refer Sample Configuration for Stub area, ASBR and route redistribution. 15.5.13.2.2 WEB Configuration OSPF ASBR Router can be configured through WEB interface using the OSPF Area screen. For screenshot, refer section 15.5.13.1.2 15.5.13.3 Configuring Redistribution Configuring Redistribution configures the protocol from which the routes have to be redistributed into OSPF. 15.5.13.3.1 CLI Configuration Execute the following commands to configure redistribution. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Configure the router as ASBR router. UltOs(config-router)# asbr router
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 301 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 5. Configure redistribution of all routes. UltOs(config-router)# redistribute all Disable redistribution of routes by executing the following command. UltOs(config-router)# no redistribute all Figure 15-3: Topology For Configuration of stub area, ASBR and route redistribution Sample Configuration for Stub area, ASBR and route redistribution
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 302 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Some prerequisite configuration (refer Configuration Guidelines (Prerequisite)) must be done in the switches FDN40-4, FDN40-5, and FDN40-7 before configuring OSPF. 1. Execute the following commands in FDN40-4, FDN40-5 and FDN40-7. Configuration in FDN40-4: FDN40-4 is configured as an ASBR router for redistributing the external routes into OSPF domain. UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# router-id 10.4.0.4 UltOs(config-router)# asbr router UltOs(config-router)# redistribute all UltOs(config-router)# network 10.5.5.4 area 0.0.0.0 UltOs(config-router)# exit UltOs(config)# ip route 100.0.0.0 255.0.0.0 10.5.5.5 UltOs(config)# end Configuration in FDN40-5: In FDN40-5 area 0.0.0.4 is configured as a stub area. UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# router-id 10.8.0.5 UltOs(config-router)# network 10.8.0.5 area 0.0.0.4 UltOs(config-router)# network 10.5.5.5 area 0.0.0.0 UltOs(config-router)# area 0.0.0.4 stub UltOs(config-router)# exit Configuration in FDN40-7: In FDN40-7 area 0.0.0.4 is configured as a stub area . External routes are not redistributed into Stub area. UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# router-id 10.8.0.7 UltOs(config-router)# network 10.8.0.7 area 0.0.0.4 UltOs(config-router)# area 0.0.0.4 stub UltOs(config-router)# exit
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 303 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2. View the configuration details by executing the following show commands. In FDN40-4: UltOs# show ip ospf route OSPF Process Routing Table Dest/Mask TOS NextHop/Interface Cost Rt.Type Area --------- --- -------/--------- ---- ------- ---- 10.5.5.0/255.255.255.0 0 0.0.0.0/vlan4 1 IntraArea 0.0.0.0 10.8.0.0/255.255.0.0 0 10.5.5.5/vlan4 2 InterArea 0.0.0.0 UltOs# show ip ospf 0.0.0.0 database external OSPF Router with ID (10.4.0.4) AS External Link States ----------------------- LS age : 300 Options : (No ToS Capability, DC) LS Type : AS External Link Link State ID : 10.4.0.0 Advertising Router : 10.4.0.4 LS Seq Number : 0x80000001 Checksum : 0x2a6 Length : 36 Network Mask : 255.255.0.0 Metric Type : 0x80 Metric : 10 Forward Address : 0.0.0.0 Externel Route Tag: 0 AS External Link States ----------------------- LS age : 300 Options : (No ToS Capability, DC) LS Type : AS External Link Link State ID : 10.5.5.0 Advertising Router : 10.4.0.4 LS Seq Number : 0x80000001 Checksum : 0xbee3 Length : 36 Network Mask : 255.255.255.0
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 304 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Metric Type : 0x80 Metric : 10 Forward Address : 0.0.0.0 Externel Route Tag: 0 AS External Link States ----------------------- LS age : 300 Options : (No ToS Capability, DC) LS Type : AS External Link Link State ID : 10.5.6.0 Advertising Router : 10.4.0.4 LS Seq Number : 0x80000001 Checksum : 0xb3ed Length : 36 Network Mask : 255.255.255.0 Metric Type : 0x80 Metric : 10 Forward Address : 0.0.0.0 Externel Route Tag: 0 AS External Link States ----------------------- LS age : 300 Options : (No ToS Capability, DC) LS Type : AS External Link Link State ID : 100.0.0.0 Advertising Router : 10.4.0.4 LS Seq Number : 0x80000001 Checksum : 0xcd6b Length : 36 Network Mask : 255.0.0.0 Metric Type : 0x80 Metric : 10 Forward Address : 10.5.5.5 Externel Route Tag: 0
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 305 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. In FDN405: View the external routes are redistributed in this switch UltOs# show ip ospf route OSPF Process Routing Table Dest/Mask TOS NextHop/Interface Cost Rt.Type Area --------- --- -------/--------- ---- ------- ---- 10.4.0.0/255.255.0.0 0 10.5.5.4/vlan4 10 Type2Ext 0.0.0.0 10.5.5.0/255.255.255.0 0 0.0.0.0/vlan4 1 IntraArea 0.0.0.0 10.5.6.0/255.255.255.0 0 10.5.5.4/vlan4 10 Type2Ext 0.0.0.0 10.8.0.0/255.255.0.0 0 0.0.0.0/vlan11 1 IntraArea 0.0.0.4 100.0.0.0/255.0.0.0 0 10.5.5.5/vlan4 10 Type2Ext 0.0.0.0 UltOs# show ip ospf 0.0.0.0 database external OSPF Router with ID (10.8.0.5) AS External Link States ----------------------- LS age : 300 Options : (No ToS Capability, DC) LS Type : AS External Link Link State ID : 10.4.0.0 Advertising Router : 10.4.0.4 LS Seq Number : 0x80000001 Checksum : 0x2a6 Length : 36 Network Mask : 255.255.0.0 Metric Type : 0x80 Metric : 10 Forward Address : 0.0.0.0 Externel Route Tag: 0 AS External Link States ----------------------- LS age : 300 Options : (No ToS Capability, DC) LS Type : AS External Link Link State ID : 10.5.5.0 Advertising Router : 10.4.0.4 LS Seq Number : 0x80000001
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 306 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Checksum : 0xbee3 Length : 36 Network Mask : 255.255.255.0 Metric Type : 0x80 Metric : 10 Forward Address : 0.0.0.0 Externel Route Tag: 0 AS External Link States ----------------------- LS age : 300 Options : (No ToS Capability, DC) LS Type : AS External Link Link State ID : 10.5.6.0 Advertising Router : 10.4.0.4 LS Seq Number : 0x80000001 Checksum : 0xb3ed Length : 36 Network Mask : 255.255.255.0 Metric Type : 0x80 Metric : 10 Forward Address : 0.0.0.0 Externel Route Tag: 0 In FDN40-7: View the external routes are not redistributed into the stub area 0.0.0.4. UltOs# show ip ospf route OSPF Process Routing Table Dest/Mask TOS NextHop/Interface Cost Rt.Type Area --------- --- -------/--------- ---- ------- ---- 0.0.0.0/0.0.0.0 0 10.8.0.5/vlan11 2 InterArea 0.0.0.4 10.5.5.0/255.255.255.0 0 10.8.0.5/vlan11 2 InterArea 0.0.0.4 10.8.0.0/255.255.0.0 0 0.0.0.0/vlan11 1 IntraArea 0.0.0.4 UltOs# show ip ospf 0.0.0.4 database external OSPF Router with ID (10.8.0.7)
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 307 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.5.13.3.2 WEB Configuration OSPF Redistribution can be configured through WEB interface using the OSPF Area screen. For screenshot, refer section 15.5.13.1.2 15.5.13.4 Configuring NSSA Area An NSSA area has the capability to import limited number of external routes. 15.5.13.4.1 CLI Configuration Execute the following commands to configure an area as an NSSA area. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Configure the OSPF interface. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 5. Configure the area 0.0.0.6 as an nssa area. UltOs(config-router)# area 0.0.0.6 nssa Re-Configure the area 0.0.0.6 as a normal area by executing the following command. UltOs(config-router)# no area 0.0.0.6 nssa Refer Sample NSSA Configuration, summary address configuration and area-default cost 15.5.13.4.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF Area screen. For screenshot, refer section 15.5.13.1.2 15.5.13.5 Configuring Summary Address 15.5.13.5.1 CLI Configuration Execute the following commands to configure summary address. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 308 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 4. Configure the OSPF interface. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 5. Configure the area 0.0.0.6 as an NSSA area. UltOs(config-router)# area 0.0.0.6 nssa 6. Configure the summary address for 90.0.0.0/8 in the NSSA area. UltOs(config-router)# summary-address 90.0.0.0 255.0.0.0 0.0.0.6 Delete the summary address configuration for 90.0.0.0/8 in the NSSA area by executing the following command. UltOs(config-router)# no summary-address 90.0.0.0 255.0.0.0 0.0.0.6 Refer Sample NSSA Configuration, summary address configuration and area-default cost 15.5.13.5.2 WEB Configuration OSPF Stub Area can be set to configured through WEB interface using the OSPF Area Configuration screen (Navigation - Layer3 Management > OSPF > Aggregation)
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 309 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 15-5: OSPF Area Aggregation 15.5.13.6 Configuring Area-default Cost Configuring Area-default Cost specifies the cost for the default summary route sent into a stub or NSSA. 15.5.13.6.1 CLI Configuration Execute the following commands to configure the Area-default Cost. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Configure the OSPF interface. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 5. Configure the area 0.0.0.6 as an NSSA area. UltOs(config-router)# area 0.0.0.6 nssa 6. Configure the cost for the default summary route sent into the NSSA area. UltOs(config-router)# area 0.0.0.6 default-cost 50 Configure the default cost for the default summary route sent into NSSA area by executing the following command. UltOs(config-router)# no area 0.0.0.6 default-cost Sample NSSA Configuration, summary address configuration and area-default cost
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 310 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Figure 15-4: Topology For NSSA, summary address and area-default Cost Configuration Some prerequisite configuration (refer Configuration Guidelines (Prerequisite)) must be done in the switches FDN40-2, FDN40-4, FDN40-9 before configuring OSPF. 1. Execute the following commands in FDN40-2, FDN40-4 and FDN40-9. Configuration in FDN40-2:
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 311 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# router-id 10.4.0.2 UltOs(config-router)# network 10.4.0.2 area 0.0.0.0 UltOs(config-router)# network 10.2.2.2 area 0.0.0.2 - Configure area 0.0.0.2 as an NSSA area. UltOs(config-router)# area 0.0.0.2 nssa UltOs(config-router)# exit Configuration in FDN40-4: UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# router-id 10.4.0.4 UltOs(config-router)# network 10.4.0.4 area 0.0.0.0 UltOs(config-router)# end Configuration in FDN40-9: UltOs# configure terminal UltOs(config)# router ospf - Configure ASBR status and redistribute static routes into the OSPF domain. UltOs(config-router)# asbr router UltOs(config-router)# redistribute static UltOs(config-router)# router-id 10.2.2.9 UltOs(config-router)# network 10.2.2.9 area 0.0.0.2 Configure the area 0.0.0.2 as an NSSA area. UltOs(config-router)# area 0.0.0.2 nssa - Configure summary address for the range 90.0.0.0/8 in the area 0.0.0.2. UltOs(config-router)# summary-address 90.0.0.0 255.0.0.0 0.0.0.2 UltOs(config-router)# exit -Configure static routes. UltOs(config)# ip route 90.1.0.0 255.255.0.0 10.2.2.2 UltOs(config)# ip route 90.2.0.0 255.255.0.0 10.2.2.2 UltOs(config)# ip route 90.3.0.0 255.255.0.0 10.2.2.2 UltOs(config)# ip route 90.4.0.0 255.255.0.0 10.2.2.2
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 312 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# ip route 90.5.0.0 255.255.0.0 10.2.2.2 UltOs(config)# end 2. View the configuration details by executing the following show commands. In FDN40-2 View the two nssa-external LSAs one for 90.0.0.0/8 matching the summary range configured and the other for the default external route in the NSSA area. Another external LSA is generated in the area 0.0.0.0 corresponding to the nssa-external LSA 90.0.0.0/8. UltOs# show ip ospf database nssa-external OSPF Router with ID (10.4.0.2) NSSA External Link States (Area 0.0.0.2) ---------------------------------------------- LS age : 300 Options : (No ToS Capability, DC) LS Type : NSSA External Link Link State ID : 90.0.0.0 Advertising Router : 10.2.2.9 LS Seq Number : 0x80000001 Checksum : 0xc84f Length : 36 NSSA External Link States (Area 0.0.0.2) ---------------------------------------------- LS age : 300 Options : (No ToS Capability, DC) LS Type : NSSA External Link Link State ID : 0.0.0.0 Advertising Router : 10.4.0.2 LS Seq Number : 0x80000002 Checksum : 0x120 Length : 36 UltOs# show ip ospf database external OSPF Router with ID (10.4.0.2) AS External Link States -----------------------
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 313 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. LS age : 0 Options : (No ToS Capability, DC) LS Type : AS External Link Link State ID : 90.0.0.0 Advertising Router : 10.4.0.2 LS Seq Number : 0x80000001 Checksum : 0x49fd Length : 36 Network Mask : 255.0.0.0 Metric Type : 0x80 Metric : 10 Forward Address : 10.2.2.9 Externel Route Tag: 0 UltOs# show ip ospf route OSPF Process Routing Table Dest/Mask TOS NextHop/Interface Cost Rt.Type Area --------- --- -------/--------- ---- ------- ---- 10.2.2.0/255.255.255.0 0 0.0.0.0/vlan2 1 IntraArea 0.0.0.2 10.4.0.0/255.255.0.0 0 0.0.0.0/vlan11 1 IntraArea 0.0.0.0 90.0.0.0/255.0.0.0 0 10.2.2.9/vlan2 10 Type2Ext 0.0.0.2 In FDN40-4 UltOs# show ip ospf route OSPF Process Routing Table Dest/Mask TOS NextHop/Interface Cost Rt.Type Area --------- --- -------/--------- ---- ------- ---- 10.2.2.0/255.255.255.0 0 10.4.0.2/vlan11 2 InterArea 0.0.0.0 10.4.0.0/255.255.0.0 0 0.0.0.0/vlan11 1 IntraArea 0.0.0.0 90.0.0.0/255.0.0.0 0 10.4.0.2/vlan11 10 Type2Ext 0.0.0.0 In FDN40-9 UltOs# show ip ospf database nssa-external OSPF Router with ID (10.2.2.9) NSSA External Link States (Area 0.0.0.2) ---------------------------------------------- LS age : 300
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 314 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Options : (No ToS Capability, DC) LS Type : NSSA External Link Link State ID : 90.0.0.0 Advertising Router : 10.2.2.9 LS Seq Number : 0x80000001 Checksum : 0xc84f Length : 36 NSSA External Link States (Area 0.0.0.2) ---------------------------------------------- LS age : 300 Options : (No ToS Capability, DC) LS Type : NSSA External Link Link State ID : 0.0.0.0 Advertising Router : 10.4.0.2 LS Seq Number : 0x80000002 Checksum : 0x120 Length : 36 UltOs# show ip ospf summary-address Display of Summary addresses for Type5 and Type7 from redistributed routes OSPF External Summary Address Configuration Information ----------------------------------------------------- Network Mask Area Effect TranslationState ------- ---- ---- ------ --------------- 90.0.0.0 255.0.0.0 0.0.0.2 advertiseMatching enabled UltOs# show ip route O 0.0.0.0/0 [2] via 10.2.2.2 C 10.2.2.0/24 is directly connected, vlan2 O 10.4.0.0/16 [2] via 10.2.2.2 C 12.0.0.0/8 is directly connected, vlan11 S 90.1.0.0/16 [1] via 10.2.2.2 S 90.2.0.0/16 [1] via 10.2.2.2 S 90.3.0.0/16 [1] via 10.2.2.2 S 90.4.0.0/16 [1] via 10.2.2.2 S 90.5.0.0/16 [1] via 10.2.2.2
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 315 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# show ip ospf route OSPF Process Routing Table Dest/Mask TOS NextHop/Interface Cost Rt.Type Area --------- --- -------/--------- ---- ------- ---- 0.0.0.0/0.0.0.0 0 10.2.2.2/vlan2 2 Type1Ext 0.0.0.2 10.2.2.0/255.255.255.0 0 0.0.0.0/vlan2 1 IntraArea 0.0.0.2 10.4.0.0/255.255.0.0 0 10.2.2.2/vlan2 2 InterArea 0.0.0.2 Configuration in FDN40-9: 1. To Test no summary command. UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# no summary-address 90.0.0.0 255.0.0.0 0.0.0.2 2. View the configuration detail in FDN40-9. UltOs# show ip ospf summary-address Display of Summary addresses for Type5 and Type7 from redistributed routes nssa-external LSA is generated for all the static routes. UltOs# show ip ospf database OSPF Router with ID (10.2.2.9) Router Link States (Area 0.0.0.2) --------------------------------------- Link ID ADV Router Age Seq# Checksum Link count ------- ---------- --- ---- -------- ---------- 10.4.0.2 10.4.0.2 300 0x80000006 0x1dc6 1 10.2.2.9 10.2.2.9 300 0x80000007 0xec0 1 Network Link States (Area 0.0.0.2) --------------------------------------- Link ID ADV Router Age Seq# Checksum ------- ---------- --- ---- -------- 10.2.2.9 10.2.2.9 300 0x80000002 0x5290 Summary Link States (Area 0.0.0.2) -------------------------------------
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 316 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Link ID ADV Router Age Seq# Checksum ------- ---------- --- ---- -------- 10.4.0.0 10.4.0.2 300 0x80000003 0x56c5 NSSA External Link States (Area 0.0.0.2) ---------------------------------------- Link ID ADV Router Age Seq# Checksum ------- ---------- --- ---- -------- 90.4.0.0 10.2.2.9 300 0x80000001 0x36e4 90.5.0.0 10.2.2.9 300 0x80000001 0x2aef 0.0.0.0 10.4.0.2 300 0x80000003 0xfe21 90.1.0.0 10.2.2.9 300 0x80000001 0x5ac3 90.2.0.0 10.2.2.9 300 0x80000001 0x4ece 90.3.0.0 10.2.2.9 300 0x80000001 0x42d9 In FDN40-2: 3. View the OSPF external routes corresponding to all the NSSA-external LSAs. UltOs# show ip ospf route OSPF Process Routing Table Dest/Mask TOS NextHop/Interface Cost Rt.Type Area --------- --- -------/--------- ---- ------- ---- 10.2.2.0/255.255.255.0 0 0.0.0.0/vlan2 1 IntraArea 0.0.0.2 10.4.0.0/255.255.0.0 0 0.0.0.0/vlan11 1 IntraArea 0.0.0.0 90.1.0.0/255.255.0.0 0 10.2.2.2/vlan2 10 Type2Ext 0.0.0.2 90.2.0.0/255.255.0.0 0 10.2.2.2/vlan2 10 Type2Ext 0.0.0.2 90.3.0.0/255.255.0.0 0 10.2.2.2/vlan2 10 Type2Ext 0.0.0.2 90.4.0.0/255.255.0.0 0 10.2.2.2/vlan2 10 Type2Ext 0.0.0.2 90.5.0.0/255.255.0.0 0 10.2.2.2/vlan2 10 Type2Ext 0.0.0.2 Configuration in FDN40-2: 1. To test the area default-cost command. UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# area 0.0.0.2 default-cost 50 In FDN40-9:
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 317 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. FDN40-2 sends a type 7 LSA for the default route with the updated metric as 50. Therefore, the metric for the default route should be 51 in FDN40-9. 2. View the configuration UltOs# show ip ospf route OSPF Process Routing Table Dest/Mask TOS NextHop/Interface Cost Rt.Type Area --------- --- -------/--------- ---- ------- ---- 0.0.0.0/0.0.0.0 0 10.2.2.2/vlan2 51 Type1Ext 0.0.0.2 10.2.2.0/255.255.255.0 0 0.0.0.0/vlan2 1 IntraArea 0.0.0.2 10.4.0.0/255.255.0.0 0 10.2.2.2/vlan2 2 InterArea 0.0.0.2 Configuration in FDN40-2: 1. To Test no area default-cost command. UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# no area 0.0.0.2 default-cost In FDN40-9: FDN40-2 must have sent a type 7 LSA for the default route with the updated default metric as 10. Therefore, the metric for the default route must be 11 in FDN40-9. 2. View the configuration UltOs# show ip ospf route OSPF Process Routing Table Dest/Mask TOS NextHop/Interface Cost Rt.Type Area --------- --- -------/--------- ---- ------- ---- 0.0.0.0/0.0.0.0 0 10.2.2.2/vlan2 11 Type1Ext 0.0.0.2 10.2.2.0/255.255.255.0 0 0.0.0.0/vlan2 1 IntraArea 0.0.0.2 10.4.0.0/255.255.0.0 0 10.2.2.2/vlan2 2 InterArea 0.0.0.2 15.5.13.6.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF Area screen. For screenshot, refer section 15.5.13.1.2
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 318 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.5.13.7 Configuring NSSA asbr-default-route translator Configuring NSSA asbr-default-route translator enables/disables setting of P bit in the default Type-7 LSA generated by NSSA internal ASBR. 15.5.13.7.1 CLI Configuration Execute the following commands to configure the NSSA asbr-default-route translator. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Configure the ASBR router status. UltOs(config-router)#asbr router 5. Configure the OSPF interface. UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 6. Configure the area 0.0.0.6 as an nssa area. UltOs(config-router)# area 0.0.0.6 nssa 7. Enable nssa asbr-default-route translator. UltOs(config-router)# set nssa asbr-default-route translator enable Disable nssa asbr-default-route translator by executing the following command. UltOs(config-router)# set nssa asbr-default-route translator disable 15.5.13.7.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF Area screen. For screenshot, refer section 15.5.13.1.2 15.5.13.8 Configuring NSSA Area Translation Role Configuring NSSA Area Translation Role configures the translation role for the NSSA as always or candidate. Execute the following commands to configure the NSSA Area Translation Role. 15.5.13.8.1 CLI Configuration 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 319 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Configure the ASBR router status. UltOs(config-router)#asbr router 5. Configure the OSPF interface. UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 6. Configure the area 0.0.0.6 as an nssa area. UltOs(config-router)# area 0.0.0.6 nssa 7. Configure the translation role for the NSSA area 0.0.0.6. UltOs(config-router)# area 0.0.0.6 translation-role always Configure the default translation role for the NSSA area 0.0.0.6 by executing the following command. UltOs(config-router)# no area 0.0.0.6 translation-role The default translation role is candidate and is configured using the command no area <area-id> translation-role. 15.5.13.8.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF Area screen. For screenshot, refer section 15.5.13.1.2 15.5.13.9 Configuring Stability Interval for NSSA Configuring Stability Interval for the NSSA configures the number of seconds after which an elected translator determines that its services are no longer required, and that it must continue to perform its translation duties for NSSA. 15.5.13.9.1 CLI Configuration Execute the following commands to configure the Stability Interval for NSSA. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Configure the ASBR router status. UltOs(config-router)#asbr router 5. Configure the OSPF interface. UltOs(config-router)# network 10.10.2.1 area 0.0.0.6
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 320 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 6. Configure the area 0.0.0.6 as an nssa area UltOs(config-router)# area 0.0.0.6 nssa 7. Configure the Stability interval for the NSSA area 0.0.0.6 as 120 seconds. UltOs(config-router)# area 0.0.0.6 stability-interval 120 Configure the default Stability interval for the NSSA area 0.0.0.6 by executing the following command. UltOs(config-router)# no area 0.0.0.6 stability-interval The default value for stability interval is 40 seconds and is configured using the command no area <area-id> stability-interval. 15.5.13.9.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF Area screen. For screenshot, refer section 15.5.13.1.2 15.5.13.10 Configuring ABR-Type Configuring abr-type sets the ABR-Type as either standard, or Cisco or IBM. 15.5.13.10.1 CLI Configuration 1. Execute the following commands to configure the abr-type. - Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal - Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf - Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 - Enable OSPF over the VLAN interface and associate the interface with an OSPF area. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 - Configure the ABR type as Cisco. UltOs(config-router)# abr-type cisco The default value ABR type is standard. 2. View the configuration details by executing the following show command. UltOs# show ip ospf OSPF Router ID 10.10.2.1 Supports only single TOS(TOS0) route ABR Type supported is Cisco ABR
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 321 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. It is an Area Border Router Number of Areas in this router is 2 Area is 0.0.0.6 Number of interfaces in this area is 1 SPF algorithm executed 3 times Area is 0.0.0.0 Number of interfaces in this area is 1 SPF algorithm executed 3 times 15.5.13.10.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF Area For screenshot, refer section 15.5.13.1.2 15.5.13.11 Configuring RFC 1583 Compatibility Configuring RFC 1583 Compatibility sets the OSPF compatibility list to be compatible with the RFC 1583. 15.5.13.11.1 CLI Configuration Execute the following commands to configure the RFC 1583 Compatibility. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Enable OSPF over the VLAN interface and associate the interface with an OSPF area. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 5. Configure the rfc1583 compatibility. UltOs(config-router)# compatible rfc1583 Disable RFC 1583 compatibility by executing the following command. UltOs(config-router)# no compatible rfc1583 15.5.13.11.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF Basic settings screen. For screenshot, refer section 15.5.2.2
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 322 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.5.13.12 Configuring Default-information Originate Always Configuring Default-information Originate Always enables generation of a default external route into the OSPF routing domain and other parameters related to that area. 15.5.13.12.1 CLI Configuration Execute the following commands to configure Default-information Originate Always. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Enable OSPF over the VLAN interface and associate the interface with an OSPF area. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 5. Configure the ASBR router status. UltOs(config-router)#asbr router 6. Configure the generation of a default external route. UltOs(config-router)# default-information originate always metric 40 Disable generation of a default external route by executing the following command. UltOs(config-router)# no default-information originate always Refer Sample Configuration for testing default-information originate always and redist-config. 15.5.13.12.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF Basic settings screen. For screenshot, refer section 15.5.2.2 15.5.13.13 Configuring Redist-Config Configuring redist-config configures the information to be applied to routes learnt from RTM. 15.5.13.13.1 CLI Configuration 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 323 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Configure the asbr router. UltOs(config-router)# asbr router 5. Configure the redistribution of static routes. UltOs(config-router)# redistribute static 6. Configure the redist-config. UltOs(config-router)# redist-config 20.0.0.0 255.0.0.0 metric-value 100 metric-type asExttype1 tag 10 Delete the information applied to the routes learnt from RTM by executing the following command. UltOs(config-router)# no redist-config 20.0.0.0 255.0.0.0 Figure 15-5: Topology For testing default-information originate always and redist-config Sample Configuration for testing default-information originate always and redist-config.
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 324 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Some prerequisite configuration (refer Configuration Guidelines (Prerequisite)) must be done in the switches FDN40-1, FDN40-2 before configuring OSPF. Configuration in FDN40-1: 1. Execute the following commands in FDN40-1 to configure the generation of a default external route. - Enter the Global Configuration mode. UltOs# configure terminal - Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf - Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 - Enable OSPF over the VLAN interface and associate the interface with an OSPF area. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 - Configure the asbr router. UltOs(config-router)# asbr router - Configure the generation of a default external route. UltOs(config-router)# default-information originate always metric 40 - Exit from the router configuration mode. UltOs(config-router)# end UltOs# Configuration in FDN40-2: 2. Execute the following commands in FDN40-2 - Enter the Global Configuration mode. UltOs# configure terminal - Enable OSPF globally in the switch FDN40-2. UltOs(config)# router ospf - Configure the OSPF router-id. UltOs(config-router)# router-id 10.4.0.2 - Enable OSPF over the VLAN interface and associate the interface with an OSPF area. UltOs(config-router)# network 10.4.0.2 area 0.0.0.0 UltOs(config-router)# network 10.2.2.2 area 0.0.0.2 - Configure area 0.0.0.2 as an NSSA area.
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 325 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-router)# area 0.0.0.2 nssa - Exit from the router configuration mode. UltOs(config-router)# end UltOs# 3. View the configuration details by executing the following show command in FDN40-1. Type 5 External LSA must be generated for the default route. UltOs# show ip ospf database external OSPF Router with ID (10.10.2.1) AS External Link States ----------------------- LS age : 0 Options : (No ToS Capability, DC) LS Type : AS External Link Link State ID : 0.0.0.0 Advertising Router : 10.10.2.1 LS Seq Number : 0x80000001 Checksum : 0xb5dd Length : 36 Network Mask : 0.0.0.0 Metric Type : 0x80 Metric : 40 Forward Address : 0.0.0.0 Externel Route Tag: 0 4. View the configuration details by executing the following show command in FDN40-2. The route entry for the default route must exist. UltOs# show ip ospf route OSPF Process Routing Table Dest/Mask TOS NextHop/Interface Cost Rt.Type Area --------- --- -------/--------- ---- ------- ---- 0.0.0.0/0.0.0.0 0 10.4.0.1/vlan11 40 Type2Ext 0.0.0.0 10.2.2.0/255.255.255. 0 0 0.0.0.0/vlan2 1 IntraArea 0.0.0.2 10.4.0.0/255.255.0.0 0 0.0.0.0/vlan11 1 IntraArea 0.0.0.0 10.10.0.0/255.255.0.0 0 10.4.0.1/vlan11 2 InterArea 0.0.0.0
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 326 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Configuration in FDN40-1: 1. Execute the following commands to disable generation of a default external route. UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# no default-information originate always UltOs(config-router)# end UltOs# 2. View the configuration detail by executing the following show command. Type 5 External LSA for the default route must be flushed. UltOs# show ip ospf database external OSPF Router with ID (10.10.2.1) 3. Execute the following show command in FDN40-2. The route entry for the default route must be deleted. UltOs# show ip ospf route OSPF Process Routing Table Dest/Mask TOS NextHop/Interface Cost Rt.Type Area --------- --- -------/--------- ---- ------- ---- 10.2.2.0/255.255.255.0 0 0.0.0.0/vlan2 1 IntraArea 0.0.0.2 10.4.0.0/255.255.0.0 0 0.0.0.0/vlan11 1 IntraArea 0.0.0.0 10.10.0.0/255.255.0.0 0 10.4.0.1/vlan11 2 InterArea 0.0.0.0 Configuration in FDN40-1: 1. Execute the following commands in FDN40-1 to test redist-config. UltOs# configure terminal UltOs(config)# router ospf - Configure redistribution of static routes redist-config. UltOs(config-router)# redistribute static - Configure redist-config. UltOs(config-router)# redist-config 20.0.0.0 255.0.0.0 metric-value 100 metric-type asExttype1 tag 10 UltOs(config-router)# exit - Add a static route for 20.0.0.0/8 network. UltOs(config)# ip route 20.0.0.0 255.0.0.0 10.4.0.2 UltOs(config)# end UltOs#
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 327 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2. View the configuration details by executing the following show command. An external LSA is generated for 20.0.0.0 with metric as 100, metric type as asExtType1 and tag as 10. UltOs# show ip ospf database external OSPF Router with ID (10.10.2.1) AS External Link States ----------------------- LS age : 600 Options : (No ToS Capability, DC) LS Type : AS External Link Link State ID : 20.0.0.0 Advertising Router : 10.10.2.1 LS Seq Number : 0x80000001 Checksum : 0xf6b2 Length : 36 Network Mask : 255.0.0.0 Metric Type : 0x0 Metric : 100 Forward Address : 10.4.0.2 Externel Route Tag: 10 In FDN40-2: 3. View the external route 20.0.0.0/8 with metric as 101. UltOs# show ip ospf route OSPF Process Routing Table Dest/Mask TOS NextHop/Interface Cost Rt.Type Area --------- --- -------/--------- ---- ------- ---- 10.2.2.0/255.255.255.0 0 0.0.0.0/vlan2 1 IntraArea 0.0.0.2 10.4.0.0/255.255.0.0 0 0.0.0.0/vlan1 1 IntraArea 0.0.0.0 10.10.0.0/255.255.0.0 0 10.4.0.1/vlan1 2 InterArea 0.0.0.0 20.0.0.0/255.0.0.0 0 10.4.0.2/vlan1 101 Type1Ext 0.0.0.0 Configuration in FDN40-1: 1. Execute the following command in FDN40-1 to test no redist-config. UltOs# configure terminal UltOs(config)# router ospf 2. Configure no redist-config. UltOs(config-router)# no redist-config 20.0.0.0 255.0.0.0 UltOs(config-router)# end
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 328 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# In FDN40-1: 3. View the configuration details by executing the following show command. The external LSA generated for 20.0.0.0 with metric as 100, metric type as asExtType1 and tag as 10 is flushed and a new external LSA is generated with the default redistribution configuration. UltOs# show ip ospf database external OSPF Router with ID (10.10.2.1) AS External Link States ----------------------- LS age : 0 Options : (No ToS Capability, DC) LS Type : AS External Link Link State ID : 20.0.0.0 Advertising Router : 10.10.2.1 LS Seq Number : 0x80000002 Checksum : 0x3c50 Length : 36 Network Mask : 255.0.0.0 Metric Type : 0x80 Metric : 10 Forward Address : 10.4.0.2 Externel Route Tag: 0 15.5.13.13.2 WEB Configuration OSPF Stub Area can be set to configured through WEB interface using the OSPF RRD Route Configuration screen (Navigation - Layer3 Management > OSPF > RRD Route)
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 329 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 15-6: OSPF RRD Route Configuration 15.5.13.14 Configuring Neighbor Configuring Neighbor specifies an NBMA neighbor router and its priority. 15.5.13.14.1 CLI Configuration Execute the following commands to configure neighbor. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Configure the OSPF interface. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 5. Exit from the Router Configuration mode. UltOs(config-router)# exit 6. Enter the Interface Configuration mode. UltOs(config)# interface vlan 11
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 330 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 7. Configure the network type as NBMA. UltOs(config-if)# ip ospf network non-broadcast 8. Configure the neighbor with priority. UltOs(config-if)# exit UltOs(config)# router ospf UltOs(config-router)# neighbor 10.4.0.2 priority 10 9. Configure the neighbor with default priority. UltOs(config-router)# no neighbor 10.4.0.2 priority 10 Delete the configured neighbor by executing the following command. UltOs(config-router)# no neighbor 10.4.0.2 15.5.13.14.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF Basic settings screen. For screenshot, refer section 15.5.2.2 15.5.13.15 Configuring Virtual link Configuring Virtual Link defines an OSPF virtual link and its related parameters. 15.5.13.15.1 CLI Configuration Execute the following commands to configure the Virtual Link. 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Configure the OSPF interface. UltOs(config-router)# network 10.4.0.1 area 0.0.0.1 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 5. Configure the virtual link. UltOs(config-router)# area 0.0.0.6 virtual-link 20.0.0.1 authentication message-digest hello-interval 100 retransmit-interval 100 transmit-delay 50 dead-interval 200 authentication-key asdf Delete the virtual link by executing the following command. UltOs(config-router)# no area 0.0.0.6 virtual-link 20.0.0.1 Refer Sample Configuration for testing virtual link and route summarization
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 331 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.5.13.15.2 WEB Configuration OSPF Stub Area can be set to configured through WEB interface using the OSPF Virtual Interface Configuration screen (Navigation - Layer3 Management > OSPF > Virtual Interface) Screen 15-7: OSPF Virtual Interface Configuration 15.5.13.16 Configuring Area-range The area-range is configured to consolidate and summarize routes at an area boundary. 15.5.13.16.1 CLI Configuration 1. Enter the Global Configuration mode in FDN40-1. UltOs# configure terminal 2. Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf 3. Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 4. Configure the OSPF interface. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 5. Configure the route summarization at an area border router. UltOs(config-router)# area 0.0.0.6 range 10.10.0.0 255.255.0.0 summary 6. Delete the route summarization information by executing the following command. UltOs(config-router)# no area 0.0.0.6 range 10.10.0.0 255.255.0.0 Sample Configuration for testing virtual link and route summarization
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 332 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Some prerequisite configuration (refer Configuration Guidelines (Prerequisite)) must be done in the switches FDN40-1, FDN40-4, FDN40-5 and FDN40-6 before configuring OSPF. Figure 15-6: Topology For testing virtual link and route summarization 1. Execute the following commands Configurations in FDN40-1: - Enter the Global Configuration mode. UltOs# configure terminal
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 333 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. - Enable OSPF globally in the switch FDN40-1. UltOs(config)# router ospf - Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.2.1 - Enable OSPF over the VLAN interface and associate the interface with an OSPF area. UltOs(config-router)# network 10.4.0.1 area 0.0.0.0 UltOs(config-router)# network 10.10.2.1 area 0.0.0.6 - Configure the route summarization at an area border router. UltOs(config-router)# area 0.0.0.6 range 10.10.0.0 255.255.0.0 summary - Exit from the router configuration mode. - UltOs(config-router)# end. Configurations in FDN40-4: - Enter the Global Configuration mode. UltOs# configure terminal - Enable OSPF globally in the switch FDN40-4. UltOs(config)# router ospf - Configure the OSPF router-id. UltOs(config-router)# router-id 10.4.0.4 - Enable OSPF over the VLAN interface and associate the interface with an OSPF area. UltOs(config-router)# network 10.4.0.4 area 0.0.0.0 UltOs(config-router)# network 10.5.6.4 area 0.0.0.3 UltOs(config-router)# network 10.5.5.4 area 0.0.0.3 - Configure the virtual link for backbone connectivity. UltOs(config-router)# area 0.0.0.3 virtual-link 10.7.0.6 UltOs(config-router)# area 0.0.0.3 virtual-link 10.8.0.5 - Exit from the router configuration mode. UltOs(config-router)# end Configurations in FDN40-5: - Enter the Global Configuration mode. UltOs# configure terminal - Enable OSPF globally in the switch FDN40-5.
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 334 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# router ospf - Configure the OSPF router-id. UltOs(config-router)# router-id 10.8.0.5 - Enable OSPF over the VLAN interface and associate the interface with an OSPF area. UltOs(config-router)# network 10.8.0.5 area 0.0.0.4 UltOs(config-router)# network 10.5.5.5 area 0.0.0.3 - Configure a virtual link for backbone connectivity. UltOs(config-router)# area 0.0.0.3 virtual-link 10.4.0.4 - Exit from the router configuration mode. UltOs(config-router)# end Configurations in FDN40-6: - Enter the Global Configuration mode. UltOs# configure terminal - Enable OSPF globally in the switch FDN40-6. UltOs(config)# router ospf - Configure the OSPF router-id. UltOs(config-router)# router-id 10.7.0.6 - Enable OSPF over the VLAN interface and associate the interface with an OSPF area. UltOs(config-router)# network 10.7.0.6 area 0.0.0.4 UltOs(config-router)# network 10.5.6.6 area 0.0.0.3 - Configure the virtual link for backbone connectivity. UltOs(config-router)# area 0.0.0.3 virtual-link 10.4.0.4 - Exit from the router configuration mode. UltOs(config-router)# end Configurations in FDN40-6: - Enter the Global Configuration mode. UltOs# configure terminal - Enable OSPF globally in the switch FDN40-6. UltOs(config)# router ospf - Configure the OSPF router-id. UltOs(config-router)# router-id 10.10.1.8
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 335 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. - Enable OSPF over the VLAN interface and associate the interface with an OSPF area. UltOs(config-router)# network 10.10.1.8 area 0.0.0.6 UltOs(config-router)# network 10.10.2.8 area 0.0.0.6 - Exit from the configuration mode. UltOs(config-router)# end 2. View the route summarization information in FDN40-1. In FDN40-1: UltOs# show ip ospf area-range Display of Summary addresses for Type3 and Translated Type5 OSPF Summary Address Configuration Information ---------------------------------------------- Network Mask LSAType Area Effect Tag ------- ---- ------- ---- ------ --- 10.10.0.0 255.255.0.0 Summary 0.0.0.6 Advertise 150746304 3. View the virtual link and the status of the link in FDN40-4. UltOs# show ip ospf virtual-links Virtual Link to router 10.7.0.6, Interface State is POINT_TO_POINT Transit Area 0.0.0.3 Transmit Delay is 1 sec, Neighbor State FULL Timer intervals configured, Hello 10, Dead 60, Retransmit 5 Virtual Link to router 10.8.0.5, Interface State is POINT_TO_POINT Transit Area 0.0.0.3 Transmit Delay is 1 sec, Neighbor State FULL Timer intervals configured, Hello 10, Dead 60, Retransmit 5 4. View the virtual link in FDN40-5. UltOs# show ip ospf virtual-links Virtual Link to router 10.4.0.4, Interface State is POINT_TO_POINT Transit Area 0.0.0.3 Transmit Delay is 1 sec, Neighbor State FULL Timer intervals configured, Hello 10, Dead 60, Retransmit 5 5. View the virtual link in FDN40-6.
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 336 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# show ip ospf virtual-links Virtual Link to router 10.4.0.4, Interface State is POINT_TO_POINT Transit Area 0.0.0.3 Transmit Delay is 1 sec, Neighbor State FULL Timer intervals configured, Hello 10, Dead 60, Retransmit 5 6. View the route available to reach ABR FDN40-1. UltOs# show ip ospf border-routers OSPF Process Border Router Information Destination TOS Type NextHop Cost Rt.Type Area ----------- --- ---- ------- ---- ------- ---- 10.4.0.4 0 ABR 10.5.6.4 1 intraArea 0.0.0.3 10.8.0.5 0 ABR 10.5.6.4 2 intraArea 0.0.0.3 10.10.2.1 0 ABR 255.255.255.255 0 0.0.0.0 15.5.13.16.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF RRD Route screen. For screenshot, refer section 15.5.13.13.2 15.5.14 Configuring Route Map - OSPF Ulterius URM (Unified Route Map) is a portable implementation of the route map capability for IPv4 unicast routing software. The URM provides a single interface for the administrator to set up and manage route maps. It also provides a common unified method for routing protocols and static route management software to use route maps for different purposes. The independent nature of the implementation helps to avoid the duplication of the route maps in the different routing modules in a router. 15.5.14.1 Configuring Route Map This section lists the CLI configuration steps to define a route map with a specified name and the related parameters such as permission and sequence number. 15.5.14.1.1 CLI Configuration 1. Execute the following commands - Enter the Global Configuration mode. UltOs# configure terminal - Configure the route map name, permission and sequence number. UltOs(config)# route-map aa permit 1 2. View the configured route map UltOs# show route-map
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 337 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Route-map aa, Permit, Sequence 1 Match Clauses: -------------- Set Clauses: -------------- Delete the route map configured. UltOs(config)# no route-map aa 1 15.5.14.1.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF RRD Route screen. For screenshot, refer section 15.5.13.13.2 15.5.14.2 Configuring Route Map Match Criteria 15.5.14.2.1 CLI Configuration This section lists the CLI configuration steps to define the filtering criteria for the route map and its related parameters. 1. Execute the following commands - Enter the Global Configuration mode. UltOs# configure terminal - Configure the route map name, permission and sequence number. UltOs(config)# route-map aa permit 1 - Configure the route map match destination IP address and the subnet mask. UltOs(config-rmap-aa)# match destination ip 91.0.0.1 255.0.0.0 - Configure the route map match route-type as remote. (Route-type can be configured either as local or remote.) UltOs(config-rmap-aa)# match route-type remote - Configure the route map match metric-type. (Metric type can be inter-area / intra-area / type-1-external / type-2-external.) UltOs(config-rmap-aa)# match metric-type inter-area - Configure the route map match metric value. UltOs(config-rmap-aa)# match metric 44 - Configure the route map match next-hop IP address. UltOs(config-rmap-aa)# match next-hop ip 91.0.0.1 - Configure the route map match tag. UltOs(config-rmap-aa)# match tag 10
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 338 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2. View the configured parameters. UltOs# show running-config route-map Building configuration... route-map aa permit 1 match destination ip 91.0.0.1 255.0.0.0 match next-hop ip 91.0.0.1 match metric 44 match tag 10 match route-type remote end Execute the no form of the commands to delete the configurations. 15.5.14.2.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF RRD Route screen. For screenshot, refer section 15.5.13.13.2 15.5.14.3 Configuring OSPF Distance 15.5.14.3.1 CLI Configuration This section lists the CLI configuration steps to set the administrative distance for the OSPF router. 1. Execute the following commands ˗ Enter the Global Configuration mode. UltOs# configure terminal ˗ Enter the OSPF router configuration mode. UltOs(config)# router ospf ˗ Configure the distance for the OSPF routes. UltOs(config-router)# distance 130 2. View the configured distance. UltOs# show running-config ospf Building configuration... router ospf distance 130 ! router ospf !
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 339 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. end Re-configure the distance to its default value. UltOs(config-router)# no distance 15.5.14.3.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF Basic Settings screen. For screenshot, refer section 15.5.2.2 15.5.14.4 Configuring Redistribution with Route Map 15.5.14.4.1 CLI Configuration This section lists the CLI configuration steps to configure the protocol from which the routes have to be redistributed into OSPF, by applying the route-map. 1. Execute the following commands ˗ Enter the Global Configuration mode. UltOs# configure terminal ˗ Enable the OSPF router configuration mode. UltOs(config)# router ospf ˗ Configure the OSPF router ID. UltOs(config-router)# router-id 10.10.2.1 ˗ Configure the router as ASBR (Autonomous System Boundary Router). UltOs(config-router)# ASBR Router ˗ Configure the redistribution of all routes with route-map aa. UltOs(config-router)# redistribute all route-map aa 2. View the configured parameters. UltOs# show running-config ospf Building configuration... router ospf router-id 10.10.2.1 ASBR Router redistribute static route-map aa redistribute connected route-map aa redistribute rip route-map aa redistribute bgp route-map aa distance 130
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 340 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. ! router ospf ! end Disable the redistribution of all routes with route-map. UltOs(config-router)# no redistribute all route-map aa 15.5.14.4.2 WEB Configuration OSPF NSSA can be configured through WEB interface using the OSPF RRD Route screen. For screenshot, refer section 15.5.13.13.2 15.5.14.5 Topology Configuration for OSPF Testing This section provides the sample configuration for testing Route map with OSPF. Figure 15-7: Topology Configuration for OSPF Testing
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 341 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Table 15-2 IPv4 Addresses of Interfaces in the Routers Topology – OSPF Testing R1 – ASBR router All OSPF routers have router-ID 0.0.0.N, where N - number of router. All OSPF routers use area 0.0.0.0. Some prerequisite configuration (refer Configuration Guidelines (Prerequisite)) must be done in the switches R1, R2, R3 and R4 before configuring OSPF. 1. To test the behavior of route selection, when distance command is applied to the OSPF router, execute the following commands in R1, R2, R3 and R4. R1: UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# router-id 0.0.0.1 UltOs(config-router)# ASBR Router UltOs(config-router)# network 13.0.0.1 area 0.0.0.0 UltOs(config-router)# end UltOs# UltOs# configure terminal UltOs(config)# router rip UltOs(config-router)# network 12.0.0.1
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 342 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-router)#end UltOs# R2: UltOs# configure terminal UltOs(config)# router rip UltOs(config-router)# network 12.0.0.2 UltOs(config-router)# network 24.0.0.2 UltOs(config-router)#end UltOs# R3: UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# router-id 0.0.0.2 UltOs(config-router)# network 13.0.0.3 area 0.0.0.0 UltOs(config-router)# network 34.0.0.3 area 0.0.0.0 UltOs(config-router)# end UltOs# R4: UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# router-id 0.0.0.3 UltOs(config-router)# network 34.0.0.4 area 0.0.0.0 UltOs(config-router)# end UltOs# UltOs# configure terminal UltOs(config)# router rip UltOs(config-router)# network 24.0.0.4 UltOs(config-router)#end 2. Configure the route-map aa with a match criteria at R4. UltOs# configure terminal UltOs(config)# route-map aa permit 1 UltOs(config-rmap-aa)# match source ip 34.0.0.3 255.0.0.0 UltOs(config-rmap-aa)# exit UltOs(config)# exit 3. Apply redistribute all to RIP and OSPF routers at R4.
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 343 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# router ospf UltOs(config-router)# redistribute all UltOs(config-router)#end UltOs# UltOs(config)# router rip UltOs(config-router)# redistribute all UltOs(config-router)#end 4. View the routes at R4. UltOs# show ip route Vrf Name: default C 12.0.0.0/8 is directly connected, vlan1 O 13.0.0.0/8 [2] via 34.0.0.3 O 15.0.0.0/8 [10] via 34.0.0.3 C 24.0.0.0/8 is directly connected, vlan24 C 34.0.0.0/8 is directly connected, vlan34 O 70.0.0.0/8 [10] via 34.0.0.3 5. Set the administrative distance 130 to the OSPF router in R4. UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# distance 130 route-map aa UltOs(config-router)# exit 6. Force routes updates in R1. UltOs(config)# router ospf UltOs(config-router)# no redistribute all UltOs(config-router)# redistribute all UltOs(config-router)# exit UltOs(config)# router rip UltOs(config-router)# no redistribute all UltOs(config-router)# redistribute all UltOs(config-router)# exit 7. View the routes at R4. UltOs# show ip route C 12.0.0.0/8 is directly connected, vlan1 O 13.0.0.0/8 [2] via 34.0.0.3 R 15.0.0.0/8 [2] via 24.0.0.2 C 24.0.0.0/8 is directly connected, vlan24
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 344 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. C 34.0.0.0/8 is directly connected, vlan34 R 70.0.0.0/8 [5] via 24.0.0.2 8. Reset the administrative distance to the OSPF router in R4. UltOs# configure terminal UltOs(config)# router ospf UltOs(config-router)# no distance 130 route-map aa UltOs(config-router)# exit 9. Force routes updates in R1. UltOs(config)# router ospf UltOs(config-router)# no redistribute all UltOs(config-router)# redistribute all UltOs(config-router)# exit UltOs(config)# router rip UltOs(config-router)# no redistribute all UltOs(config-router)# redistribute all UltOs(config-router)# exit 10. View the routes at R4. UltOs# show ip route C 12.0.0.0/8 is directly connected, vlan1 O 13.0.0.0/8 [2] via 34.0.0.3 O 15.0.0.0/8 [10] via 34.0.0.3 C 24.0.0.0/8 is directly connected, vlan24 C 34.0.0.0/8 is directly connected, vlan34 O 70.0.0.0/8 [10] via 34.0.0.3 15.5.14.6 Redistribution Topology This section provides the sample configuration for testing redistribution of routes into OSPF with route map.
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 345 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Figure 15-8: Redistribution Topology Configuration 15.5.14.6.1 Redistribution Interface Configuration Table 15-3: IPv4 Addresses of Interfaces in the Routers – Redistribution Topology 15.5.14.6.2 Redistribution Protocol Configuration Configuration Protocol Configuration: Configure the protocols in the given interfaces in each of the routers as follows: At R1
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 346 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Interface Vlan 12 Enable RIPv2. Enable RIPng. At R2 Interface Vlan 12 Enable RIPv2. Enable RIPng. Interface Vlan 23 Enable OSPFv2 with Area 0. Configure this as the ASBR router. Enable OSPFv3 with Area 0. Configure this as the ASBR router. Interface Vlan 25 Enable BGP with peer Vlan 25 interface on R5 with remote AS 300. At R3 Interface Vlan 23 Enable OSPFv2 with Area 0. Enable OSPFv3 with Area 0. At R5 Interface Vlan 25 Enable BGP with peer as VLAN 25 interface on R2 with remote AS 100. 1. To test the following behaviors, execute the following commands: redistribution of static routes into OSPFv2 with the route map with <match destination ip> clause. redistribution of static routes into OSPFv2, when the route map is modified or deleted. redistribution of static routes into OSPFv2, when static routes for redistribution are added or deleted. Configurations at R1: UltOs(config)# router rip UltOs(config-router)# network 140.0.0.1 UltOs(config-router)# exit Configurations at R2: UltOs(config)# router rip UltOs(config-router)# network 140.0.0.2 UltOs(config-router)# exit UltOs(config)# UltOs(config)# router ospf
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 347 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-router)# router-id 0.0.0.1 UltOs(config-router)# ASBR Router UltOs(config-router)# network 20.0.0.2 area 0.0.0.0 UltOs(config-router)# exit UltOs(config)# as-num 100 UltOs(config)# router-id 40.0.0.2 UltOs(config-router)# neighbor 40.0.0.5 remote-as 300 UltOs(config-router)# exit Configurations at R3 UltOs(config)# router ospf UltOs(config-router)# router-id 0.0.0.2 UltOs(config-router)# network 20.0.0.3 area 0.0.0.0 UltOs(config-router)# exit Configurations at R5 UltOs(config)# as-num 300 UltOs(config)# router-id 40.0.0.5 UltOs(config-router)# neighbor 40.0.0.2 remote-as 100 UltOs(config-router)# exit 2. Do the following configurations in R2 In R2, create static routes and create a route-map aa. UltOs(config)# ip route 91.0.0.0 255.0.0.0 vlan 24 UltOs(config)# ip route 92.0.0.0 255.0.0.0 vlan 24 UltOs(config)# route-map aa permit 1 UltOs(config-rmap-aa)# match destination ip 91.0.0.0 255.0.0.0 UltOs(config-rmap-aa)# end UltOs#configure terminal UltOs(config)# route-map aa deny 2 UltOs(config-rmap-aa)# match destination ip 93.0.0.0 255.0.0.0 UltOs(config-rmap-aa)# 3. Enable redistribution of static routes into OSPFv2 with route map aa. UltOs(config)# router ospf UltOs(config-router)# redistribute static route-map aa 4. Verify the route in R3, verify 91.0.0.0/8 is present in the general routing table. UltOs# show ip route
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 348 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Vrf Name: default C 11.0.0.0/8 is directly connected, vlan130 C 12.0.0.0/8 is directly connected, vlan1 C 20.0.0.0/8 is directly connected, vlan23 O 91.0.0.0/8 [10] via 20.0.0.2 5. In R2, modify the route map aa. UltOs# configure terminal UltOs(config)# route-map aa permit 1 UltOs(config-rmap-aa)# no match destination ip 91.0.0.0 255.0.0.0 UltOs(config-rmap-aa)# match destination ip 92.0.0.0 255.0.0.0 UltOs(config-rmap-aa)# exit 6. In R3, verify 91.0.0.0/8 is removed from the general routing table and 92.0.0.0/8 is present in the general routing table. UltOs# show ip route Vrf Name: default C 11.0.0.0/8 is directly connected, vlan130 C 12.0.0.0/8 is directly connected, vlan1 C 20.0.0.0/8 is directly connected, vlan23 O 92.0.0.0/8 [10] via 20.0.0.2 7. In R2, add/remove static routes. UltOs# configure terminal UltOs(config)# ip route 93.0.0.0 255.0.0.0 vlan 24 UltOs(config)# no ip route 92.0.0.0 255.0.0.0 vlan 24 UltOs(config)# end 8. In R3, verify 92.0.0.0/8 is removed from the general routing table and verify 93.0.0.0/8 is present in the general routing table. UltOs# show ip route Vrf Name: default C 11.0.0.0/8 is directly connected, vlan130 C 12.0.0.0/8 is directly connected, vlan1 C 20.0.0.0/8 is directly connected, vlan23 O 93.0.0.0/8 [10] via 20.0.0.2 9. Delete the route map aa. UltOs# configure terminal UltOs(config)# no route-map aa 1 UltOs(config)# no route-map aa 2
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 349 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# end 10. In R3, verify that all the connected routes and static routes are present in the general routing table. UltOs# show ip route Vrf Name: default C 11.0.0.0/8 is directly connected, vlan130 C 12.0.0.0/8 is directly connected, vlan1 C 20.0.0.0/8 is directly connected, vlan23 O 91.0.0.0/8 [10] via 20.0.0.2 O 93.0.0.0/8 [10] via 20.0.0.2 15.5.14.7 OSPF Inbound Filtering with Route Map This section provides the sample configuration for testing OSPF inbound filtering with route map. Figure 15-9: Distribute-list In Topology Configurations 15.5.14.7.1 Interface Configuration Table 15-4: IPv4 Addresses of Interfaces in the Routers – OSPF Inbound Filtering
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 350 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 15.5.14.7.2 Protocol Configuration Configure the protocol in the given interfaces in each of the routers as follows: At R1 Configure this as ASBR router. Interface Vlan 12 Enable OSPFv2/OSPFv3 with Area 0.0.0.0. Interface Vlan 100 Enable OSPFv2/OSPFv3 with Area 1.1.1.1. Interface Vlan 110 Enable OSPFv2/OSPFv3 with Area 0.0.0.0. At R2 Interface Vlan 12 Enable OSPFv2/OSPFv3 with Area 0.0.0.0. Interface Vlan 23 Enable OSPFv2/OSPFv3 with Area 0.0.0.0. Interface Vlan 120 Enable OSPFv2/OSPFv3 with Area 0.0.0.0. At R3 Configure this as ASBR router. Interface Vlan 23 Enable OSPFv2/OSPFv3 with Area 0.0.0.0. Interface Vlan 130
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 351 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Enable OSPFv2/OSPFv3 with Area 0.0.0.0. Interface Vlan 140 Enable OSPFv2/OSPFv3 with Area 0.0.0.0. 1. Do the following configurations in R1, R2 and R3. Configurations at R1 Configure R1 as ASBR Router. UltOs(config)# router ospf UltOs(config-router)# router-id 0.0.0.1 UltOs(config-router)# network 10.0.0.1 area 0.0.0.0 UltOs(config-router)# network 130.0.0.1 area 0.0.0.0 UltOs(config-router)# network 20.0.0.1 area 1.1.1.1 UltOs(config-router)# exit Configurations at R2 UltOs(config)# router ospf UltOs(config-router)# router-id 0.0.0.2 UltOs(config-router)# network 10.0.0.2 area 0.0.0.0 UltOs(config-router)# network 30.0.0.2 area 0.0.0.0 UltOs(config-router)# network 100.0.0.2 area 0.0.0.0 UltOs(config-router)# exit Configurations at R3 UltOs(config)# router ospf UltOs(config-router)# router-id 0.0.0.3 UltOs(config-router)# network 30.0.0.3 area 0.0.0.0 UltOs(config-router)# network 120.0.0.3 area 0.0.0.0 UltOs(config-router)# network 150.0.0.3 area 1.1.1.1 UltOs(config-router)# exit 2. In R3, create static routes and enable redistribution of static routes. UltOs# configure terminal UltOs(config)# ip route 91.0.0.0 255.0.0.0 40.0.24.4 UltOs(config)# UltOs(config)# router ospf UltOs(config-router)# redistribute static UltOs(config-router)# end 3. In R2, shutdown interfaces Vlan12 and Vlan23. UltOs(config-router)# end
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 352 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs#configure terminal UltOs(config)# interface vlan 12 UltOs(config-if)# shutdown UltOs(config-if)# end UltOs# configure terminal UltOs(config)# interface vlan 23 UltOs(config-if)# shutdown UltOs(config-if)# 4. In R2, create route map aa and enable incoming filtering of routes in OSPFv2 with route map aa. UltOs# configure terminal UltOs(config)# route-map aa permit 10 UltOs(config-rmap-aa)# exit UltOs(config)# route-map aa deny 1 UltOs(config-rmap-aa)# match destination ip 150.0.0.0 255.0.0.0 UltOs(config-rmap-aa)# match destination ip 91.0.0.0 255.0.0.0 UltOs(config-rmap-aa)# end UltOs(config)# router ospf UltOs(config-router)# distribute-list route-map aa in UltOs(config-router)# 5. Start interfaces Vlan12 and Vlan23. UltOs(config)# interface vlan 12 UltOs(config-if)# no shutdown UltOs(config-if)# end UltOs(config-if)# configure terminal UltOs(config)# interface vlan 23 UltOs(config-if)# no shutdown UltOs(config-if)#end 6. Wait for one minute for all the route updates, and verify the routes in R2. UltOs# show ip route Vrf Name: default C 10.0.0.0/8 is directly connected, vlan12 C 12.0.0.0/8 is directly connected, vlan1 O 20.0.0.0/8 [2] via 10.0.0.1 C 30.0.0.0/8 is directly connected, vlan23
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 353 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. C 100.0.0.0/8 is directly connected, vlan120 O 120.0.0.0/8 [2] via 30.0.0.3 O 130.0.0.0/8 [2] via 10.0.0.1 7. In R2, shutdown interfaces: Vlan12 and Vlan23. UltOs# configure terminal UltOs(config)# interface vlan 12 UltOs(config-if)# shutdown UltOs(config-if)# end UltOs# configure terminal UltOs(config)# interface vlan 23 UltOs(config-if)# shutdown 8. Modify the route map aa. UltOs# configure terminal UltOs(config)# route-map aa deny 1 UltOs(config-rmap-aa)# no match destination ip 150.0.0.0 255.0.0.0 UltOs(config-rmap-aa)# match destination ip 130.0.0.0 255.0.0.0 UltOs(config-rmap-aa)# end 9. Start interfaces Vlan12 and Vlan23. UltOs(config)# interface vlan 12 UltOs(config-if)# no shutdown UltOs(config-if)# end UltOs(config-if)# configure terminal UltOs(config)# interface vlan 23 UltOs(config-if)# no shutdown UltOs(config-if)#end 10. Wait for one minute for all the route updates and verify the routes in R2. UltOs# show ip route C 10.0.0.0/8 is directly connected, vlan12 C 12.0.0.0/8 is directly connected, vlan1 O 20.0.0.0/8 [2] via 10.0.0.1 C 30.0.0.0/8 is directly connected, vlan23 C 100.0.0.0/8 is directly connected, vlan120 O 120.0.0.0/8 [2] via 30.0.0.3 O 150.0.0.0/8 [2] via 30.0.0.3 11. In R2, shutdown interfaces Vlan12 and Vlan23. UltOs(config-router)# end; configure terminal
CHAPTER 15: OSPF `FDN40ConfigUM/20160505 354 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# interface vlan 12 UltOs(config-if)# shutdown UltOs(config-if)# end UltOs# configure terminal UltOs(config)# interface vlan 23 UltOs(config-if)# shutdown 12. Delete the route map aa. UltOs# configure terminal UltOs(config)# no route-map aa 1 UltOs(config)# end 13. Start interfaces Vlan12 and Vlan23. UltOs(config)# interface vlan 12 UltOs(config-if)# no shutdown UltOs(config-if)# end UltOs(config-if)# configure terminal UltOs(config)# interface vlan 23 UltOs(config-if)# no shutdown UltOs(config-if)#end 14. Wait for one minute for all the route updates, and verify the routes in R2. UltOs# show ip route Vrf Name: default C 10.0.0.0/8 is directly connected, vlan12 C 12.0.0.0/8 is directly connected, vlan1 O 20.0.0.0/8 [2] via 10.0.0.1 C 30.0.0.0/8 is directly connected, vlan23 O 91.0.0.0/8 [10] via 30.0.0.2 C 100.0.0.0/8 is directly connected, vlan120 O 120.0.0.0/8 [2] via 30.0.0.3 O 130.0.0.0/8 [2] via 10.0.0.1 O 150.0.0.0/8 [2] via 30.0.0.3
FDN40ConfigUM/20160505 355 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. Chapter 16 DHCP Relay Agent 16.1 Protocol Description DHCP relay agent is used to forward the DHCP packets between client and server when they are not in the same subnets. The relay receives packets from the client and inserts certain information like the network in which the packet is received and then forwards it to the server. The Server identifies the client’s network from this information and allocates IP accordingly, then sends the reply to the relay. The Relay then strips the information inserted and broadcasts the packets into the client’s network.
CHAPTER 17: DHCP RELAY AGENT `FDN40ConfigUM/20160505 356 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 16.2 Topology Figure 16-1: DHCP – Topology 16.3 Configuration Guidelines The following sections describe the configuration of DHCP running as a part of ULTERIUS FDN40.  DHCP Server must be disabled before enabling the DHCP Relay agent.  Only when enabled, the Relay Agent, - becomes active - forwards the packets from the client to a specific DHCP server - does any processing related to Relay Agent Information Options - like inserting the necessary options while relaying a packet from a client to a server and examining/stripping of options when relaying a packet from a server to a client 16.4 Default Configurations Table 16-1: Default Configurations Feature Default Setting DHCP server status Disabled ICMP echo Disabled Offer reuse time out 5 seconds FDN40 -1(DHCP SERVER) FDN40 -2(DHCP RELAY)
CHAPTER 17: DHCP RELAY AGENT `FDN40ConfigUM/20160505 357 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Feature Default Setting DHCP next server address 0.0.0.0 (none) Boot file name None DHCP server pool lease time 3600 seconds DHCP server pool utilization threshold 75% DHCP server debug level None DHCP relay status Disabled DHCP relay server address 0.0.0.0 (none) RAI option Disabled DHCP relay debug level None DHCP client debug level None 16.5 Enabling DHCP Relay 16.5.1.1 CLI Configuration Refer Figure 16-1 for Topology Setup. DHCP relay is disabled by default. a. Execute the following commands in FDN40-2 to enable DHCP Relay. - Enter the Global Configuration mode. UltOs# configure terminal - Enable the DHCP server. UltOs(config)# service dhcp-relay - Exit from the Global configuration mode. UltOs(config)# end b. View the DHCP relay status using the following command. UltOs# show ip dhcp relay information The output in the switch is Dhcp Relay : Enabled Dhcp Relay Servers only : Disabled DHCP server : 0.0.0.0 Dhcp Relay RAI option : Disabled Default Circuit Id information : router-index Debug Level : 0x1 No of Packets inserted RAI option : 0 No of Packets inserted circuit ID suboption : 0 No of Packets inserted remote ID suboption : 0 No of Packets inserted subnet mask suboption : 0
CHAPTER 17: DHCP RELAY AGENT `FDN40ConfigUM/20160505 358 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. No of Packets dropped : 0 No of Packets which did not inserted RAI option : 0 16.5.1.2 WEB Configuration DHCP Relay can be enabled through WEB interface using the DHCP Relay Configuration screen (Navigation – Layer3 Management > DHCP Relay > Basic Settings) Screen 16-1: DHCP Relay Configuration 16.6 Configuring a DHCP Server Address 16.6.1.1 CLI Configuration Refer Figure 16-1 for Topology Setup. DHCP server address can be configured in the DHCP Relay Agent using the following commands. A maximum of 5 servers can be configured. If no servers are configured, then the DHCP packets will be broadcasted to entire network, except to the network from which packet is received. 1. Execute the following commands to configure a DHCP Server Address. - Enter into the global configuration mode. UltOs# configure terminal - Configure DHCP server address. UltOs(config)# ip dhcp server 20.0.0.1 - Exit from the Global configuration mode. UltOs(config)# end 2. View the server address configured in the relay using the following command. UltOs# show ip dhcp relay information The output in the switch is Dhcp Relay : Enabled Dhcp Relay Servers only : Enabled DHCP server 1 : 20.0.0.1
CHAPTER 17: DHCP RELAY AGENT `FDN40ConfigUM/20160505 359 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Dhcp Relay RAI option : Disabled Default Circuit Id information : router-index Debug Level : 0x1 No of Packets inserted RAI option : 0 No of Packets inserted circuit ID suboption : 0 No of Packets inserted remote ID suboption : 0 No of Packets inserted subnet mask suboption : 0 No of Packets dropped : 0 No of Packets which did not inserted RAI option : 0 16.6.1.2 WEB Configuration DHCP Server Address can be configured through WEB interface using the DHCP Relay Configuration screen.(Navigation – Layer3 Management > DHCP Relay > Basic Settings) For screenshot, refer section 16.5.1.2 16.7 Enabling Relay Agent Information 16.7.1.1 CLI Configuration Refer Figure 16-1 for the Topology Setup. 1. Execute the following commands to enable the Relay agent information option in FDN40-2. - Enter into the Global configuration mode. UltOs# configure terminal - Configure DHCP server address. UltOs(config)# ip dhcp relay information option - Exit from the Global configuration mode. UltOs(config)# end 2. View the Relay Agent information option status using the following command. UltOs# show ip dhcp relay information The output in the Switch is Dhcp Relay : Enabled Dhcp Relay Servers only : Enabled DHCP server 1 : 20.0.0.1 Dhcp Relay RAI option : Enabled Default Circuit Id information : router-index Debug Level : 0x1 No of Packets inserted RAI option : 0
CHAPTER 17: DHCP RELAY AGENT `FDN40ConfigUM/20160505 360 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. No of Packets inserted circuit ID suboption : 0 No of Packets inserted remote ID suboption : 0 No of Packets inserted subnet mask suboption : 0 No of Packets dropped : 0 No of Packets which did not inserted RAI option : 0 16.7.1.2 WEB Configuration Relay Agent Information can be enabled through WEB interface using the DHCP Relay Configuration screen.(Navigation – Layer3 Management > DHCP Relay > Basic Settings) For screenshot, refer section 16.5.1.2 16.8 Configuring Relay Agent Sub-options 16.8.1.1 CLI Configuration Refer Figure 16-1 for the Topology Setup. 1. Execute the following commands to configure Circuit-id and Remote-id Relay agent information option in FDN40-2. - Enter into the Global Configuration mode. UltOs# configure terminal - Enter into the VLAN Interface Configuration mode. UltOs(config)# interface vlan 1 - Execute the following commands to configure the Circuit-id sub-option and the Remote-id sub-option. UltOs(config-if)# ip dhcp relay circuit-id 340 UltOs(config-if)# ip dhcp relay remote-id hello - Exit from the VLAN Interface Configuration mode. UltOs(config-if)# end 2. Execute the following show command to view the Relay Agent information option. UltOs# show ip dhcp relay information The output in the Switch is Dhcp Relay : Enabled Dhcp Relay Servers only : Enabled DHCP server 1 : 20.0.0.1 Dhcp Relay RAI option : Enabled Default Circuit Id information : router-index Debug Level : 0x1 No of Packets inserted RAI option : 0
CHAPTER 17: DHCP RELAY AGENT `FDN40ConfigUM/20160505 361 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. No of Packets inserted circuit ID suboption : 0 No of Packets inserted remote ID suboption : 0 No of Packets inserted subnet mask suboption : 0 No of Packets dropped : 0 No of Packets which did not inserted RAI option : 0 Interface vlan1 Circuit ID : 340 Remote ID : hello UltOs# show ip dhcp relay information vlan 1 Interface vlan1 Circuit ID : 340 Remote ID : hello Configuration of DHCP Relay circuit ID should be greater than the value of the macro DHRL_MAX_L3_IF_INDEX. The value of the macro DHRL_MAX_L3_IF_INDEX is different for FDN40 packages. For METRO package the value of macro is 1136 and for Enterprise package, the value of macro is 160. 16.8.1.2 WEB Configuration Relay Agent Sub-options can be configured through WEB interface using the DHCP Relay Interface Configuration screen (Navigation – Layer3 Management > DHCP Relay > Interface Settings) Screen 16-2: DHCP Relay Interface Configuration 16.9 Enabling Traces for DHCP Relay Refer Figure 16-1 for Topology Setup. 1. Execute the following commands in FDN40-2 to enable DHCP relay debug traces. UltOs# debug ip dhcp relay all
CHAPTER 17: DHCP RELAY AGENT `FDN40ConfigUM/20160505 362 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 2. View the debug trace level. UltOs# show ip dhcp relay information Dhcp Relay : Enabled Dhcp Relay Servers only : Enabled DHCP server 1 : 20.0.0.1 Dhcp Relay RAI option : Enabled Default Circuit Id information : router-index Debug Level : 0xff No of Packets inserted RAI option : 0 No of Packets inserted circuit ID suboption : 0 No of Packets inserted remote ID suboption : 0 No of Packets inserted subnet mask suboption : 0 No of Packets dropped : 0 No of Packets which did not inserted RAI option : 0 Interface vlan1 Circuit ID : 340 Remote ID : hello 16.10 Acquiring IP from a Server Residing Outside the Client Network Refer Figure 16-1 for the Topology Setup. Connect Port 1 of FDN40-1 to Port 1 of FDN40-2 and connect Port 2 of FDN40-2 to Port 1 of DHCP client. 1. Create vlan2 in FDN40-1 with Port 1 as member port. Then, add a route to 30.0.0.0 network though 20.0.0.2 (FDN40-2). UltOs# configure terminal UltOs(config)# vlan 2 UltOs(config-vlan)# ports lan 0/1 untagged lan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 2 UltOs(config-if)# shutdown UltOs(config-if)# ip address 20.0.0.1 255.0.0.0 UltOs(config-if)# no shutdown UltOs(config-vlan)# exit UltOs(config)# interface lan 0/1 UltOs(config-if)# switchport pvid 2
CHAPTER 17: DHCP RELAY AGENT `FDN40ConfigUM/20160505 363 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-vlan)# exit UltOs(config)# ip route 30.0.0.0 255.0.0.0 20.0.0.2 UltOs(config) # end 2. View the VLAN configurations and route configuration using the following commands. UltOs# show ip interface vlan 2 vlan2 is up, line protocol is up Internet Address is 20.0.0.1/8 Broadcast Address 20.255.255.255 UltOs# show vlan id 2 Vlan database ------------- Vlan ID : 2 Member Ports : lan0/1 Untagged Ports : lan0/1 Forbidden Ports : None Name : lan Status : Permanent Egress Ethertype : 0x8100 MacLearning Admin-Status : Disabled MacLearning Oper-Status : Enabled -------------------------------------------------UltOs# show ip route C 12.0.0.0/8 is directly connected, vlan1 C 20.0.0.0/8 is directly connected, vlan2 S 30.0.0.0/8 [1] via 20.0.0.2 3. Create vlan2 with port1 as member port and vlan3 with port2 as member port in FDN40-2. UltOs# configure terminal UltOs(config)# vlan 2 UltOs(config-vlan)# ports lan 0/1 untagged lan 0/1 UltOs(config-vlan)# exit UltOs(config)# interface vlan 2 UltOs(config-if)# shutdown UltOs(config-if)# ip address 20.0.0.2 255.0.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit
CHAPTER 17: DHCP RELAY AGENT `FDN40ConfigUM/20160505 364 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# interface lan 0/1 UltOs(config-if)# switchport pvid 2 UltOs(config-if)# exit UltOs(config)# vlan 3 UltOs(config-vlan)# ports lan 0/2 untagged lan 0/2 UltOs(config-vlan)# exit UltOs(config)# interface vlan 3 UltOs(config-if)# shutdown UltOs(config-if)# ip address 30.0.0.2 255.0.0.0 UltOs(config-if)# no shutdown UltOs(config-if)# exit UltOs(config)# interface lan 0/2 UltOs(config-if)# switchport pvid 3 UltOs(config-if)# no shutdown UltOs(config-if)# end 4. View the configuration using the following commands UltOs# show vlan id 2 Vlan database ------------- Vlan ID : 2 Member Ports : lan0/1 Untagged Ports : lan0/1 Forbidden Ports : None Name : lan Status : Permanent Egress Ethertype : 0x8100 MacLearning Admin-Status : Disabled MacLearning Oper-Status : Enabled ----------------------------------------------------UltOs# show vlan id 3 Vlan database ------------- Vlan ID : 3 Member Ports : lan0/2 Untagged Ports : lan0/2 Forbidden Ports : None Name : lan
CHAPTER 17: DHCP RELAY AGENT `FDN40ConfigUM/20160505 365 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Status : Permanent Egress Ethertype : 0x8100 MacLearning Admin-Status : Disabled MacLearning Oper-Status : Enabled -------------------------------------------------UltOs# show ip interface vlan 2 vlan2 is up, line protocol is up Internet Address is 20.0.0.2/8 Broadcast Address 20.255.255.255 UltOs# show ip interface vlan 3 vlan3 is up, line protocol is up Internet Address is 30.0.0.2/8 Broadcast Address 30.255.255.255 5. Enable DHCP server in FDN40-1. Since the client is in Vlan3, an address pool with 30.0.0.0 network needs to be configured in the Server. UltOs# configure terminal UltOs(config)# service dhcp-server UltOs(config)# ip dhcp pool 1 UltOs(dhcp-config)# network 30.0.0.0 UltOs(dhcp-config)# lease 0 0 30 UltOs(dhcp-config)# end 6. View the configuration using the following commands. UltOs# show ip dhcp server information DHCP server status : Enable Send Ping Packets : Disable Debug level : None Server Address Reuse Timeout : 5 secs Next Server Adress : 0.0.0.0 Boot file name : None UltOs# show ip dhcp server pools Pool Id : 1 ---------------------------------- Subnet : 30.0.0.0 Subnet Mask : 255.0.0.0 Lease time : 1800 secs Utilization threshold : 75% Start Ip : 30.0.0.1
CHAPTER 17: DHCP RELAY AGENT `FDN40ConfigUM/20160505 366 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. End Ip : 30.255.255.255 Subnet Options -------------- Code : 1, Value : 255.0.0.0 7. Enable DHCP Relay in FDN40-2, which connects the networks between Client and Server. UltOs# configure terminal UltOs(config)# service dhcp-relay UltOs(config)# end 8. View the configuration using the following commands. UltOs# show ip dhcp relay information Dhcp Relay : Enabled Dhcp Relay Servers only : Disabled DHCP server : 0.0.0.0 Dhcp Relay RAI option : Disabled Debug Level : 0x1 No of Packets inserted RAI option : 0 No of Packets inserted circuit ID suboption : 0 No of Packets inserted remote ID suboption : 0 No of Packets inserted subnet mask suboption : 0 No of Packets dropped : 0 No of Packets which did not inserted RAI option : 0 9. Configure DHCP server address in FDN40-2. UltOs(config)# ip dhcp server 20.0.0.1 UltOs(config)# end 10. View the server address configured in the DHCP Relay using the following command. UltOs# show ip dhcp relay information The output in the switch is Dhcp Relay : Enabled Dhcp Relay Servers only : Enabled DHCP server 1 : 20.0.0.1 Dhcp Relay RAI option : Disabled Default Circuit Id information : router-index Debug Level : 0x1
CHAPTER 17: DHCP RELAY AGENT `FDN40ConfigUM/20160505 367 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. No of Packets inserted RAI option : 0 No of Packets inserted circuit ID suboption : 0 No of Packets inserted remote ID suboption : 0 No of Packets inserted subnet mask suboption : 0 No of Packets dropped : 0 No of Packets which did not inserted RAI option : 0 11. Enable DHCP Relay Information option in FDN40-2. UltOs(config)# ip dhcp relay information option UltOs(config)# end 12. In FDN40-2 view the Relay Agent information option status using the following command. UltOs# show ip dhcp relay information The output in the Switch is Dhcp Relay : Enabled Dhcp Relay Servers only : Enabled DHCP server 1 : 20.0.0.1 Dhcp Relay RAI option : Enabled Default Circuit Id information : router-index Debug Level : 0x1 No of Packets inserted RAI option : 0 No of Packets inserted circuit ID suboption : 0 No of Packets inserted remote ID suboption : 0 No of Packets inserted subnet mask suboption : 0 No of Packets dropped : 0 No of Packets which did not inserted RAI option : 0 13. In FDN40-2 execute the following commands to configure the Circuit-id sub-option and the Remote-id sub-option. UltOs(config)# interface vlan 2 UltOs(config-if)# ip dhcp relay circuit-id 340 UltOs(config-if)# ip dhcp relay remote-id hello UltOs(config-if)# end 14. In FDN40-2 execute the following show command to view the Relay Agent information option. UltOs# show ip dhcp relay information The output in the Switch is Dhcp Relay : Enabled Dhcp Relay Servers only : Enabled DHCP server 1 : 20.0.0.1
CHAPTER 17: DHCP RELAY AGENT `FDN40ConfigUM/20160505 368 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Dhcp Relay RAI option : Enabled Default Circuit Id information : router-index Debug Level : 0x1 No of Packets inserted RAI option : 0 No of Packets inserted circuit ID suboption : 0 No of Packets inserted remote ID suboption : 0 No of Packets inserted subnet mask suboption : 0 No of Packets dropped : 0 No of Packets which did not inserted RAI option : 0 Interface vlan2 Circuit ID : 340 Remote ID : hello UltOs# show ip dhcp relay information vlan 2 Interface vlan2 Circuit ID : 340 Remote ID : hello 15. Enable DHCP Client to get the IP address from the DHCP server (FDN40-2) via DHCP Relay (FDN40-1).
FDN40 FDN40ConfigUM/20160505 369 © Ulterius Technologies, LLC 2014. Confidential & Proprietary. Chapter 17 RAVPN 17.1 Protocol Description RAVPN (acronym for Client to Site VPN) connects individual hosts to private networks. In a Remote Access VPN, every host must have VPN client software. Whenever the host tries to send any traffic, the VPN client software encapsulates and encrypts that traffic before sending it over the Internet to the VPN gateway at the edge of the target network. If the target host inside the private network returns a response, the VPN gateway performs the reverse process to send an encrypted response back to the VPN client over the Internet. These remote access VPNs may use passwords, or other cryptographic methods. The most common secure tunneling protocol IPSec is deployed in RAVPN. Remote-Access VPNs allow employees to access their company's intranet from home or while traveling outside the office, where as site-to-site VPNs allow employees in geographically disparate offices to share one cohesive virtual network.
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 370 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 17.2 Topology Node Interface Index/Name Interface IP Address DUT1 WAN 35.0.0.1 R1 WAN 35.0.0.2 H1 E0 192.168.1.10 DUT1 LAN 192.168.1.1 17.3 RAVPN Configurations 17.3.1 Enabling VPN Module The VPN (Virtual Private Network) module is enabled for encryption and decryption of the traffic flows. This section describes the steps involved in enabling the VPN module globally and configuring a VPN policy. This section also describes the verifying of the configuration using corresponding show command. 17.3.1.1 CLI Configuration To enable VPN globally - Enter the Global Configuration mode. UltOs# configure terminal - Enable the VPN module. E0 LAN WAN DUT1 FDN40 R1 WAN RAVPN Server RAVPN Client H1 Figure 17-1: RAVPN - Topology
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 371 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config)# set vpn enable - Exit from the Global Configuration mode. UltOs(config)# end To view the VPN global status - View the global VPN settings. UltOs# show vpn config VPN Global Configuration ------------------------ IPSecurity Status : Enabled Maximum Number of Tunnels : 100 Number of Tunnels configured : 1 Number of Tunnels Established: 1 17.3.1.2 WEB Configuration VPN can be enabled / disabled using the VPN Policy screen (Navigation - Security Management > VPN > VPN Settings > VPN Policy) Screen 17-1: VPN Policy - VPN Module Status 17.3.2 Configuring pool IP address 17.3.2.1 CLI Configuration To create a pool ip address - Enter the Global Configuration mode. UltOs# configure terminal - Create the pool IP address UltOs# ip ra-vpn pool ravpnpool 192.168.2.1 – 192.168.2.2 - Exit from the Crypto Map Configuration mode. UltOs# end To view the pool IP address - View the pool ip UltOs# show ra-vpn address-pool Address PoolName Start Ip End Ip Prefix length
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 372 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. ---------------- ---------- -------- ----------- ravpnpool 192.168.2.1 192.168.2.2 8 17.3.2.2 WEB Configuration RAVPN Pool can be created using the Address Pool screen (Navigation - Security Management > VPN > Users >Address Pool) Screen 17-2: RAVPN Pool IP Address configuration 17.3.3 Configuring RAVPN Policy Type The VPN policy type defines the policy to be imposed for the authentication of the users. The different policy types available are IPSec manual, preshared key, extended authentication, certificate and RA VPN key. This section describes the steps involved in configuring VPN policy type. 17.3.3.1 CLI Configuration To configure RAVPN policy type - Enter the Global Configuration mode. UltOs# configure terminal - Enter the Crypto Map Configuration mode for an existing policy. UltOs(config)# crypto map crypto_map_name - Set the key mode as ravpn preshared key. UltOs(config-crypto-map)# crypto key mode ravpn-preshared-key - Exit from the Crypto Map Configuration mode. UltOs(config-crypto-map)# end
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 373 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. To view the RAVPN policy parameters - View the parameters of the VPN policy. UltOs# show crypto map VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : Inactive Policy Type : ravpn preshared key Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Security Mode : Tunnel Local & Remote Tunnel Term Addr : None <== ==> None Interface Name : Not Configured Policy Protocol : any Policy Action : Apply In/Out bound SPI : 0 / 0 Security Protocol : ESP Encryption Algo : Not Configured Anti Replay : Disable Crypto Session Status : Inactive Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0 No.of ACTIVE VPN policies = 0 No.of VPN policies configured = 1 17.3.3.2 WEB Configuration RA-VPN policy Type can be configured using the Client termination screen (Navigation - Security Management > VPN > Users > Client termination)
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 374 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 17-3: RAVPN Policy Type Configuration 17.3.4 Configuring IPSec mode The mode of the IPSec is configured based on the set up for securing the traffic. The mode can be either Tunnel or Transport. The Tunnel mode is used to protect traffic between a SG and a host or between two security gateways. The Transport mode is used to protect traffic between a pair of hosts or security gateways. Only the payload of the IP packet is encrypted and/or authenticated, when in transport mode. The entire IP packet is encrypted and/or authenticated, when in tunnel mode. This section describes the steps involved in configuring the IPSec mode. 17.3.4.1 CLI Configuration To configure the VPN policy mode - Enter the Global Configuration mode. UltOs# configure terminal - Enter the Crypto Map Configuration mode for an existing policy. UltOs(config)# crypto map crypto_map_name - Set the IPSec mode. UltOs(config-crypto-map)# crypto ipsec mode tunnel - Exit from the Crypto Map Configuration mode. UltOs(config-crypto-map)# end To view the VPN policy parameters - View the parameters of the VPN policy. UltOs# sh crypto map VPN Policy Parameters -------------------------
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 375 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Policy Name : crypto_map_name Policy Status : Inactive Policy Type : IPSec Manual Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Security Mode : Tunnel Local & Remote Tunnel Term Addr : None <== ==> None Interface Name : Not Configured Policy Protocol : any Policy Action : Apply In/Out bound SPI : 0 / 0 Security Protocol : ESP Encryption Algo : Not Configured Anti Replay : Disable Crypto Session Status : Inactive Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0 No.of ACTIVE VPN policies = 0 No.of VPN policies configured = 1 17.3.5 Configuring Peer Identity Peer identity refers to the destination address set in the packet during authentication and encryption of outbound datagram. This peer identity is used for IPSec SA negotiations. This section describes the steps involved in configuring the peer identity. 17.3.5.1 CLI Configuration To configure the peer identity - Enter the Global Configuration mode. UltOs# configure terminal - Enter the Crypto Map Configuration mode for an existing policy. UltOs(config)# crypto map crypto_map_name - Set the peer identity. UltOs(config-crypto-map)# set peer 35.0.0.2 - Exit from the Crypto Map Configuration mode. UltOs(config-crypto-map)# end To view the VPN policy parameters - View the parameters of the VPN policy.
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 376 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs# show crypto map VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : Inactive Policy Type : IPSec Manual Ike Version : v1 Local & Remote Protected N/W's : 198.168.1.0/24 <- - - - > 110.0.0.0/24 Security Mode : Tunnel Local & Remote Tunnel Term Addr : 0.0.0.0 <== ==> 35.0.0.2 Interface Name : Not Configured Policy Protocol : any Policy Action : Apply In/Out bound SPI : 0 / 0 Security Protocol : ESP Encryption Algo : Not Configured Anti Replay : Disable Crypto Session Status : Inactive Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0 No.of ACTIVE VPN policies = 0 No.of VPN policies configured = 1 17.3.5.2 WEB Configuration RA-VPN peer identity can be created using the Client termination screen (Navigation - Security Management > VPN > Users > Client termination)
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 377 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 17-4: Peer Identity Configuration 17.3.6 Configuring IPSec Session Keys The IPSec session keys are configured for a VPN policy to set the security protocol, the authentication and encryption algorithms to be applied, and the inbound and outbound security parameter index that is used to uniquely identify a SA. This section describes the steps involved in configuring the IPSec session keys. 17.3.6.1 CLI Configuration To configure the IPSec session keys - Enter the Global Configuration mode. UltOs# configure terminal - Enter the Crypto Map Configuration mode for an existing policy. UltOs(config)# crypto map crypto_map_name - Configure the IPSec session key. UltOs(config-crypto-map)# set session-key authenticator esp hmac-sha1 abcdef7812345678123456781234567812345678 esp des cipher abcdef7812345678 outbound 257 inbound 256 - Exit from the Crypto Map Configuration mode. UltOs(config-crypto-map)# end To view the VPN policy parameters - View the parameters of the VPN policy. UltOs# sh crypto map
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 378 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : Inactive Policy Type : IPSec Manual Ike Version : v1 Local & Remote Protected N/W's : None <-- --> None Security Mode : Tunnel Local & Remote Tunnel Term Addr : 0.0.0.0 <== ==> 35.0.0.1 Interface Name : Not Configured Policy Protocol : any Policy Action : Apply In/Out bound SPI : 256 / 257 Security Protocol : ESP Authentication Algorithm : HMAC-SHA1 Encryption Algo : DES Anti Replay : Disable Crypto Session Status : Inactive Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0 No.of ACTIVE VPN policies = 0 No.of VPN policies configured = 1 17.3.6.2 WEB Configuration RA-VPN IPSec session keys can be created using the Client termination screen (Navigation - Security Management > VPN > Users > Client termination)
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 379 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 17-5: IPSec Session Keys Configuration 17.3.7 Configuring Access List The access list is configured to specify the traffic type, action to be taken, and source and destination IP address to which the policy is applied. This section describes the steps involved in configuring the access list. 17.3.7.1 CLI Configuration To configure the access list - Enter the Global Configuration mode. UltOs# configure terminal - Enter the Crypto Map Configuration mode for an existing policy. UltOs(config)# crypto map crypto_map_name - Configure the access list. UltOs(config-crypto-map)# access-list 1 apply any source 192.168.1.0 255.255.255.0 destination 192.168.2.0 255.255.255.0 - Exit from the Crypto Map Configuration mode UltOs(config-crypto-map)# end To view the VPN policy parameters - View the parameters of the VPN policy. UltOs# sh crypto map VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : Inactive Policy Type : IPSec Manual Ike Version : v1 Local & Remote Protected N/W's : 192.168.1.0/24 <-- --> 192.168.2.0/24 Security Mode : Tunnel Local & Remote Tunnel Term Addr : 0.0.0.0 <== ==> 35.0.0.1 Interface Name : Not Configured Policy Protocol : any Policy Action : Apply In/Out bound SPI : 256 / 257 Security Protocol : ESP Authentication Algorithm : HMAC-SHA1 Encryption Algo : DES
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 380 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Anti Replay : Disable Crypto Session Status : Inactive Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0 No.of ACTIVE VPN policies = 0 No.of VPN policies configured = 1 17.3.7.2 WEB Configuration RA-VPN policy can be created using the Client termination screen (Navigation - Security Management > VPN > Users > Client termination) Screen 17-6: Access List Configuration 17.3.8 Binding of Policy The configured VPN policy is bound to particular WAN (Wide Area Network) interface for configuring the interface details and local tunnel termination address in the policy and for activating the VPN policy. This section describes the steps involved in binding the policy to the WAN interface 17.3.8.1 CLI Configuration To bind a policy to a particular WAN Interface - Enter the Global Configuration mode. UltOs# configure terminal - Enter the Interface Configuration mode. UltOs(config)# interface wan 0/1 - Apply the existing policy to the interface.
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 381 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs(config-if)# crypto map crypto_map_name - Exit from the Interface Configuration mode. UltOs(config-if)# end To view the VPN policy parameters - View the parameters of the VPN policy. UltOs# show crypto map VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : Active Policy Type : IPSec Manual Ike Version : v1 Local & Remote Protected N/W's : 192.168.1.0/24 <-- --> 192.168.2.0/24 Security Mode : Tunnel Local & Remote Tunnel Term Addr : 35.0.0.2 <== ==> 35.0.0.1 Interface Name : wan0/1 Policy Protocol : any Policy Action : Apply In/Out bound SPI : 256 / 257 Security Protocol : ESP Authentication Algorithm : HMAC-SHA1 Encryption Algo : DES Anti Replay : Disable Crypto Session Status : Active Crypto Session Encr Pkts : 0 Crypto Session Decr Pkts : 0 No.of ACTIVE VPN policies = 1 No.of VPN policies configured = 1 17.3.8.2 WEB Configuration VPN policy can be bound over WAN interface using the Client termination screen (Navigation - Security Management > VPN > Users > Client termination)
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 382 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 17-7: Binding of Policy 17.3.9 Removing Policy from Interface The policy assigned to the WAN interface is removed for inactivating the policy. The policy should be inactivated before deleting. Policies assigned to the WAN interface and activated cannot be deleted. 17.3.9.1 CLI Configuration - To make the policy inactiveEnter the Global Configuration mode. UltOs# configure terminal - Enter the Interface Configuration mode. UltOs(config)#interface wan 0/1 - Make the policy inactive. UltOs(config-if)# no crypto map crypto_map_name - Exit from the Interface Configuration mode. UltOs(config-if)# end To view the VPN policy parameters - View the parameters of the VPN policy. UltOs# show crypto map crypto_map_name VPN Policy Parameters ------------------------- Policy Name : crypto_map_name Policy Status : InActive Policy Type : IKE Pre-shared Ike Version : v1 Local & Remote Protected N/W's : 192.168.1.0/24 <-- --> 192.168.2.0/24 Local & Remote Port Range : 0-65535 <-- --> 0-65535
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 383 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Security Mode : Tunnel Local & Remote Tunnel Term Addr : 35.0.0.1 <== ==> 35.0.0.2 17.3.9.2 WEB Configuration VPN policy can be removed using the Client termination screen (Navigation - Security Management > VPN > Users > Client termination) Screen 17-8: Removal of Policy from Interface 17.3.10 Deleting Policy This section describes the steps involved in deleting the policy. The policy should be made as inactive before deleting. 17.3.10.1 CLI Configuration To delete the configured policy - Enter the Global Configuration mode. UltOs# configure terminal - Delete the configured policy. UltOs(config)# no crypto map crypto_map_name - Exit from the Global Configuration mode. UltOs(config)# end To check the deletion of the policy - View the parameters of the VPN policy. UltOs# show crypto map crypto_map_name 17.3.10.2 WEB Configuration VPN policy can be created using the Client termination screen (Navigation - Security Management > VPN > Users > Client termination)
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 384 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. Screen 17-9: Deleting Policy
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 385 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 17.3.11 Sample Configuration This section describes the sample configuration steps to be performed for configuring the RAVPN module in a switch. Node Name E0 V4 ADDR WAN V4 ADDR Host 1(H1) 192.168.1.2 NA Host 2(H2) 35.0.0.2 NA FDN40-1(R1) 192.168.1.1 35.0.0.1 R1 H1 E0 E0 WAN RAVPN SERVER INTERNET HOST RAVPN CLIENT E0 H2 Figure 17-2: RAVPN Topology – Sample Configuration E0
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 386 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. 17.3.11.1 RAVPN Server Configuration IPSec RAVPN is installed in the R1 and the below mentioned commands are executed to configure the IPSec policy in IKEv1 mode. 1. Create VLAN interface 100 and assigning an IP UltOs# configure terminal UltOs#interface lan 0/1 UltOs#no shutdown UltOs#exit UltOs#vlan 100 UltOs#ports add lan 0/1 UltOs#exit UltOs#interface vlan 100 UltOs#ip address 192.168.1.0 255.255.255.0 UltOs#no shutdown UltOs#exit 2. Assigning an IP to WAN 0/1 interface UltOs#interface wan 0/1 UltOs#ip address 35.0.0.1 255.255.255.0 UltOs#no shutdown UltOs#exit 3. Enable VPN and its parameter UltOs#set vpn enable UltOs#vpn remote-access server UltOs#vpn remote identity keyId CLIENT psk KEY12345 UltOs#ra-vpn username myravpnuser password myravpnpass UltOs#ip ra-vpn pool myravpnpoolname 192.168.2.1 – 192.168.2.2 4. Create crypto map UltOs#crypto map sa UltOs#set ike version v1 UltOs#crypto ipsec mode tunnel UltOs#crypto key mode ravpn-preshared-key UltOs#set peer 0.0.0.0 UltOs#isakmp local identity keyId SERVER UltOs#isakmp peer identity keyId CLIENT
CHAPTER 17: RAVPN `FDN40ConfigUM/20160505 387 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. UltOs#isakmp policy encryption DES hash sha1 dh Group2 exch aggressive lifetime Secs 3000 UltOs#crypto map ipsec encryption esp DES authentication esp sha1 lifetime Secs 3000 UltOs#access-list Apply any source 192.168.1.0 255.255.255.0 destination 192.168.2.0 255.255.255.0 UltOs#exit 5. Add default route UltOs#ip route 0.0.0.0 0.0.0.0 35.0.0.2 6. Bind crypto map to wan 0/1 UltOs#interface wan 0/1 UltOs#crypto map sa UltOs#exit UltOs#exit Note: For IKEv2, set the version as v2. UltOs# set ike version v2
CHAPTER 17: FCC COMPLIANCE STATEMENT `FDN40ConfigUM/20160505 388 © Ulterius Technologies, LLC 2016. Confidential & Proprietary. FCC Compliance Statement (1) This device may not cause harmful interference, and (2) This device must accept any interference received, including interference that may cause undesired operation FCC Caution! • Any changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate this equipment. • This equipment should be installed and operated with minimum distance 20 cm between the radiator & your body. Part 15B compliance statements for digital devices: NOTE: This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: —Reorient or relocate the receiving antenna. —Increase the separation between the equipment and receiver. —Connect the equipment into an outlet on a circuit different from that to which the receiver is connected —Consult the dealer or an experienced radio/TV technician for help.

Navigation menu