Manuals / Cabletron Systems / Computer Equipment / Network Router

Cabletron Systems SmartSwitch manual 282

Models: SmartSwitch

1 338

Download 338 pages 45.77 Kb

Page 282

Chapter 18: Security Configuration Guide

282	SmartSwitch Router User Reference Manual

Image 282

Cabletron Systems SmartSwitch manual 282

Contents

SmartSwitch Router User Reference Manual 9032578-04SmartSwitch Router User Reference Manual Industry Canada Notice Vcci NoticeCabletron SYSTEMS, INC Program License Agreement SmartSwitch Router User Reference Manual SmartSwitch Router User Reference Manual SmartSwitch Router User Reference Manual Cabletron Systems Limited Program License Agreement SmartSwitch Router User Reference Manual Safety Information Laser Radiation and ConnectorsEC Directive 89/336/EEC EC Directive 73/23/EECSmartSwitch Router User Reference Manual Contents Hot Swapping Line Cards and Control Modules SmartTRUNK Configuration Guide Creating a non-IP/non-IPX VlanVrrp Configuration Guide 127 Multicast Routing Configuration Guide 199 IP Multicast Overview 199209 Web Hosting Configuration Guide 233 255 QoS Configuration Guide 283 WAN Configuration Guide 315 Contents About This Manual How to Use This ManualPreface Who Should Read This Manual?Preface Related Documentation Installing and setting up the SSRManaging the SSR using Cabletron’s For Information About SeePreface SmartSwitch Router User Reference Manual SSR Hardware and software specifications Feature SpecificationChapter SSR Product Overview IPX RIP, SAP Multicast IGMP, DvmrpSupported Media Encapsulation Type Supported Routing ProtocolsConfiguring the SmartSwitch Router Understanding the Command Line InterfaceRouting Information Protocol RIP Version 1 Common CLI key commands Basic Line Editing CommandsAccess Modes Key Sequence CommandUser Mode Enable Mode Exit Configure Mode Boot Prom Mode PvstBoot and System Image Loading System Images and Configuration FilesDisabling a Function or Feature Configuration FilesLoading System Image Software Ssr# system show versionLoading Boot Prom Software Activating the Configuration Commands in the ScratchpadEnter the system image list command to verify the change Copying the Configuration to the Startup Configuration File CLI displays the following messageEnter yes or y to activate the changes Displaying Configuration Changes Managing the SSRSetting the SSR Name Setting SSR Date and TimeConfiguring NTP Configuring the SSR CLI Configuring Snmp ServicesConfiguring DNS Connecting Between the SSR and Other Systems Configuring LoggingMonitoring Configuration Task CommandShow the configuration changes Show the SSR login bannerShow the type of Power-On Self Test Post Reboot Show the status of the switching fabricChapter Hot Swapping Line Cards Control Modules Hot Swapping OverviewHot Swapping Line Cards Deactivating the Line Card Removing the Line CardInstalling a New Line Card Hot Swapping a Secondary Control ModuleHot Swapping One Type of Line Card With Another Deactivating the Control Module Removing the Control ModuleHot Swapping a Switching Fabric Module SSR 8600 only Installing the Control ModuleSSR-SF-16 Offline Switching Fabric Chapter Bridging Configuration Guide Bridging OverviewSpanning Tree Ieee 802.1d Vlan Overview Bridging Modes Flow-Based and Address-BasedProtocol-based VLANs Port-based VLANsMAC-address-based VLANs Subnet-based VLANsPolicy-based VLANs SSR Vlan SupportMulticast-based VLANs VLANs and the SSRAccess Ports and Trunk Ports 802.1Q support Ports, VLANs, and L3 InterfacesConfiguring SSR Bridging Functions Configuring Address-based or Flow-based BridgingExplicit and Implicit VLANs Configuring Spanning Tree Address-Based Bridge Table Flow-Based Bridge TableAdjusting Spanning-Tree Parameters Setting the Bridge PriorityMore ports for a particular Vlan Setting a Port Priority Adjusting Bridge Protocol Data Unit Bpdu IntervalsAssigning Port Costs Adjusting the Interval between Hello Times Defining the Forward Delay IntervalDefining the Maximum Age Configuring VLANs for Bridging Configuring a Port or Protocol based VlanConfiguring Vlan Trunk Ports Creating a Port or Protocol Based VlanConfiguring Layer-2 Filters Monitoring BridgingCreating a non-IP/non-IPX Vlan Configuration ExamplesCreating an IP or IPX Vlan Show information on MACsPage Chapter SmartTRUNK Configuration Guide OverviewConfiguring SmartTRUNKs Creating a SmartTRUNKAdd Physical Ports to the SmartTRUNK Monitoring SmartTRUNKs Specify Traffic Distribution Policy OptionalExample Configurations St.2 St.4 Router Switch ServerSmartTRUNK Configuration Guide Page Configuration Guide ChapterDhcp Overview Configuring Client Parameters Configuring DhcpConfiguring an IP Address Pool Client ParametersConfiguring a Static IP Address Grouping Scopes with a Common InterfaceConfiguring Dhcp Server Parameters Updating the Lease DatabaseMonitoring the Dhcp Server Define an IP address pool for addresses 10.1.1.10 through Dhcp Configuration ExamplesDefine Dhcp network parameters for the scope ‘scope1’ Define a static IP address forConfiguring Secondary Subnets Secondary Subnets and Directly-Connected Clients Include ‘scope2’ in the superscope ‘super1’Interacting with Relay Agents Define the address pool for ‘scope1’ Page Chapter IP Routing Configuration Guide IP Routing OverviewUnicast Routing Protocols IP Routing ProtocolsSSR supports standards-based TCP, UDP, and IP Multicast Routing ProtocolsConfiguring IP Interfaces for a Vlan Configuring IP Interfaces and ParametersConfiguring IP Addresses to Ports Specifying Ethernet Encapsulation MethodConfiguring Address Resolution Protocol ARP Configuring ARP Cache EntriesConfiguring Proxy ARP Configuring Reverse Address Resolution Protocol Rarp Specifying IP Interfaces for RarpDefining MAC-to-IP Address Mappings Monitoring Rarp Configuring DNS ParametersConfiguring IP Services Icmp Specify pingConfiguring IP Helper Configuring Direct BroadcastConfiguring Denial of Service DOS Configuring Router Discovery Monitoring IP ParametersAssigning IP/IPX Interfaces IP Routing Configuration Guide Configuring Vrrp Vrrp OverviewConfiguration of Router R1 Basic Vrrp ConfigurationBackup Following is the configuration file for Router R1 in FigureSymmetrical Configuration Configuration for Router R2Following is the configuration file for Router R2 in Figure Master for VRID=1 Master for VRID=2 Backup for VRID=2 Symmetrical Vrrp ConfigurationMulti-Backup Configuration Configuration of Router R2Multi-Backup Vrrp Configuration SmartSwitch Router User Reference Manual 101 Virtual Router Default Priority Configured Priority Additional Configuration Configuration of Router R3Following is the configuration file for Router R3 in Figure Setting the Backup Priority Setting the Advertisement IntervalSetting Pre-empt Mode Setting an Authentication Key Monitoring VrrpIp-redundancy trace Virtual routers Display information about all Vrrp Configuration NotesIp-redundancy show Specific virtual routerSmartSwitch Router User Reference Manual 107 108 Chapter RIP Configuration Guide Configuring RIPRIP Overview Configuring RIP Interfaces Configuring RIP ParametersEnabling and Disabling RIP To RIP Set the authentication methodCharacters Set the authentication method Specify that RIP V2 packetsConfiguring RIP Route Preference Configuring RIP Route Default-MetricMonitoring RIP Configuration Example 114 Ospf Ospf OverviewDisable Ospf Configuring OspfEnable Ospf Ospf MultipathConfiguring Ospf Interface Parameters Ospf Parameter Default ValueOspf Interface Parameters Configuring an Ospf Area Create an Ospf areaAdd an interface to an Ospf area Add a stub host to an Ospf area Configuring Ospf Area ParametersCreating Virtual Links Add a network to an Ospf area forLink Configuring Ospf over Non-Broadcast Multiple AccessCreate a virtual Set virtual linkMonitoring Ospf Ospf Configuration Examples Exporting All Interface & Static Routes to Ospf Exporting All RIP, Interface & Static Routes to OspfCreate a RIP export source Create a Ospf export destination for type-1 routesCreate a Ospf export destination for type-2 routes Create a Static export sourceCreate a RIP export destination Create Ospf export sourceCreate OSPF-ASE export source R10 Chapter BGP Configuration Guide BGP OverviewBasic BGP Tasks SSR BGP ImplementationConfiguring a BGP Peer Group Setting the Autonomous System NumberSetting the Router ID Ip-router global set autonomous-system num1 loops num2Where Autonomous-system numberUsing AS-Path Regular Expressions Adding and Removing a BGP PeerStarting BGP 132 Using the AS Path Prepend Feature AS-Path Regular Expression ExamplesTo import MCI routes with a preference BGP Configuration Examples Following is an exampleBGP Peering Session Example CLI configuration for router SSR1 is as follows AS-1 AS-2Physical Link Peering Relationship Gated.conf file for router SSR1 is as follows Ibgp Configuration ExampleCLI configuration for router SSR2 is as follows Gated.conf file for router SSR2 is as followsIbgp Routing Group Example Sample Ibgp Configuration Routing Group Type AS-64801Following lines in the Cisco router configure Ospf Ibgp Internal Group Example Illustrates a sample Ibgp Internal group configuration Sample Ibgp Configuration Internal Group TypeSmartSwitch Router User Reference Manual 143 Ebgp Multihop Configuration Example Configuration for router C1 a Cisco router is as followsConfiguration for router C2 a Cisco router is as follows AS-64800 Physical LinkCLI configuration for router SSR3 is as follows Gated.conf file for router SSR3 is as follows CLI configuration for router SSR4 is as followsCommunity Attribute Example Gated.conf file for router SSR4 is as followsSample BGP Configuration Specific Community Sample BGP Configuration Well-Known Community , router SSR11 has the following configuration , router SSR13 has the following configuration , router SSR10 has the following configuration , router SSR14 has the following configurationSmartSwitch Router User Reference Manual 153 LocalPref Attribute Example Sample BGP Configuration LocalPref Attribute Multi-Exit Discriminator Attribute Example Sample BGP Configuration MED Attribute Router SSR6 has the following CLI configurationAS-64900 Router SSR8 has the following CLI configurationEbgp Aggregation Example AS-64901Router SSR9 has the following CLI configuration Route Reflection ExampleShows a sample configuration that uses route reflection AS-64902SmartSwitch Router User Reference Manual 161 162 Chapter Routing Policy Configuration Guide Route Import and Export Policy OverviewDefault Preference Values Preference Defined by CLI Command DefaultPreference Import Policies Import-SourceExport-Destination Export PoliciesRoute-Filter Export-SourceSpecifying a Route Filter Aggregates and Generates Aggregate-Destination Aggregate-SourceAuthentication Authentication MethodsConfiguring Simple Routing Policies Authentication Keys and Key ManagementRedistributing Static Routes Redistributing Directly Attached NetworksRedistributing RIP into RIP Redistributing RIP into Ospf Redistributing Ospf to RIPRedistributing Aggregate Routes Routes into Ospf Simple Route Redistribution ExamplesTo redistribute aggregate Example 1 Redistribution into RIPExporting a Given Static Route to All RIP Interfaces Exporting All Static Routes to All RIP InterfacesExample 2 Redistribution into Ospf 176 Configuring Advanced Routing Policies 178 Creating an Export Destination Creating an Export SourceCreating an Aggregate Route Creating an Import SourceCreating a Route Filter Create a RIP importSmartSwitch Router User Reference Manual 181 Examples of Import Policies Creating an Aggregate DestinationCreating an Aggregate Source Example 1 Importing from RIPR41 184 Example 2 Importing from Ospf 186 R41 Importing a Selected Subset of OSPF-ASE Routes Examples of Export Policies Example 1 Exporting to RIPIp-router policy create rip-export-source ripExpSrc Exporting a Given Static Route to a Specific RIP Interface Exporting Aggregate-Routes into RIP Ip-router policy create aggr-export-source aggrExpSrc Example 2 Exporting to Ospf SmartSwitch Router User Reference Manual 195 196 SmartSwitch Router User Reference Manual 197 198 Chapter Multicast Routing Configuration Guide IP Multicast OverviewIgmp Overview Dvmrp Overview Configuring Igmp Query Interval Configuring IgmpConfiguring Igmp on an IP Interface Configuring Igmp Response Wait TimeConfiguring Dvmrp Configuring Per-Interface Control of Igmp MembershipStarting and Stopping Dvmrp Configuring Dvmrp on an Interface Configuring Dvmrp ParametersConfiguring the Dvmrp Routing Metric Configuring Dvmrp TTL & Scope Configuring a Dvmrp TunnelMonitoring Igmp & Dvmrp Show all interfaces running Multicast protocols IgmpShow all multicast routes Page 208 Chapter IP Policy-Based Forwarding Configuration Guide Configuring IP Policies Defining an ACL ProfileAssociating the Profile with an IP Policy Creating Multi-statement IP Policies Setting Load Distribution for Next-hop Gateways Setting the IP Policy ActionApplying an IP Policy to an Interface Checking the Availability of Next-hop GatewaysAn IP interface Apply a defined IP policy to IP Policy Configuration ExamplesRouting Traffic to Different ISPs All IP interfaces on the SSRUsing an IP policy to route traffic to two different ISPs Prioritizing Service to Customers Using an IP policy to prioritize service to customersAuthenticating Users through a Firewall Using an IP policy to authenticate users through a firewallFirewall Load Balancing Selecting Next Hop Gateway from IP Packet InformationIP policies Monitoring IP PoliciesDisplay information about all Display statistics about aIp-policy show interface interface SmartSwitch Router User Reference Manual 221 222 Chapter Network Address Translation Configuration Guide Configuring NAT Setting Inside and Outside InterfacesStatic Setting NAT RulesManaging Dynamic Bindings DynamicNAT and FTP Static ConfigurationSpecify the FTP session timeout Monitoring NATNext, define the interfaces to be NAT inside or outside Using Static NATFirst step is to create the interfaces Then, define the NAT static rulesDynamic Configuration Using Dynamic NATDynamic NAT with IP Overload PAT Configuration Using Dynamic NAT with IP Overload Dynamic NAT with Outside Interface RedundancyUsing Dynamic NAT with Matching Interface Redundancy 232 Chapter Web Hosting Configuration Guide Creating the Server Group Configuring Load BalancingLoad Balancing Specifying Load Balancing Policy OptionalSetting Server Status Adding Servers to the Load Balancing GroupAllowing Access to Load Balancing Servers Setting Timeouts for Load Balancing MappingsLoad Balancing and FTP Configuration Examples Displaying Load Balancing InformationFtp.quick.com Internet Router User Queries 207.135.89.16 10.1.1.1 Ftp.quick..com 10.1.1.2Virtual IP Address Ranges 207.135.89.16 207.135.89.17 207.135.89.18Configuring Web Caching Web CachingRedirected to cache servers Creating the Cache GroupSpecifying the Clients for the Cache Group Optional Not redirected to cache serversConfiguration Example Other ConfigurationsBypassing Cache Servers Distributing Frequently-Accessed Sites Across Cache Servers Monitoring Web-CachingProxy Server Redundancy Show caching policy information Show cache server informationChapter IPX Routing Configuration Guide IPX Routing OverviewRIP Routing Information Protocol SAP Service Advertising Protocol Configuring IPX RIP & SAP Creating IPX InterfacesIPX Addresses Configuring IPX Interfaces for a Vlan Configuring IPX Interfaces and ParametersConfiguring IPX Addresses to Ports Specifying IPX Encapsulation MethodEnabling IPX RIP Configuring IPX RoutingConfiguring Static Routes Enabling SAPConfiguring Static SAP Table Entries Controlling Access to IPX NetworksCreating an IPX Access Control List Creating an IPX Type 20 Access Control List Creating an IPX SAP Access Control ListCreating an IPX GNS Access Control List Creating an IPX RIP Access Control List Monitoring an IPX NetworkAdds a SAP access list Adds a GNS access list 254 Chapter Access Control List Configuration Guide ACL Basics Defining Selection Criteria in ACL RulesHow ACL Rules are Evaluated Implicit Deny Rule Allowing External Responses to Established TCP Connections Following ACL illustrates this feature Creating and Modifying ACLsEditing ACLs Offline Maintaining ACLs Using the ACL Editor Using ACLs Applying ACLs to InterfacesThese uses of ACLs are described in the following sections Applying ACLs to Services Using ACLs as ProfilesFollowing SSR features use ACL profiles SSR Feature ACL Profile UsageUsing Profile ACLs with the IP Policy Facility Using Profile ACLs with the Traffic Rate Limiting Facility Using Profile ACLs with Dynamic NAT Using Profile ACLs with the Port Mirroring FacilityUsing Profile ACLs with the Web Caching Facility Redirecting Http Traffic to Cache ServersEnabling ACL Logging Preventing Web Objects From Being CachedMonitoring ACLs 270 Chapter Security Configuration Guide Security OverviewConfiguring SSR Access Security Configuring RadiusConfiguring Tacacs Monitoring RadiusMonitoring Tacacs Configuring Tacacs Plus Monitoring Tacacs PlusConfiguring Passwords Layer-2 Security FiltersConfiguring Layer-2 Address Filters Configuring Layer-2 Port-to-Address Lock FiltersConfigure a source static Configuring Layer-2 Static Entry FiltersConfiguring Layer-2 Secure Port Filters Configure a destination staticMonitoring Layer-2 Security Filters Layer-2 Filter Examples Et.1.1 Et.1.2 Et.1.3 HubStatic Entries Example Port-to-Address Lock Examples Example 2 Secure PortsLayer-3 Access Control Lists ACLs 282 Chapter QoS Configuration Guide QoS & Layer-2/Layer-3/Layer-4 Flow OverviewLayer-2 and Layer-3 & Layer-4 Flow Specification Precedence for Layer-3 FlowsConfiguring Layer-2 QoS Traffic Prioritization for Layer-2 FlowsSSR Queuing Policies Configuring IP QoS Policies Traffic Prioritization for Layer-3 & Layer-4 FlowsSetting an IPX QoS Policy Configuring IPX QoS PoliciesSetting an IP QoS Policy Specifying Precedence for an IP QoS PolicyToS Rewrite Configuring SSR Queueing PolicyAllocating Bandwidth for a Weighted-Fair Queuing Policy Specifying Precedence for an IPX QoS PolicyConfiguring ToS Rewrite for IP Packets MBZTos-rewrite Show all IP QoS flows Monitoring QoSLimiting Traffic Rate Show all IPX QoS flowsApply a rate limit profile to an Example ConfigurationDefine a rate limit profile InterfaceDisplaying Rate Limit Information Interface interface294 Chapter Performance Monitoring Guide Performance Monitoring OverviewMAC table Show information about a Show port error statisticsShow information about the master Particular MAC address Show info about multicastsConfiguring the SSR for Port Mirroring Monitoring Broadcast TrafficOnly IP ACLs can be specified for port mirroring 298 Configuring and Enabling Rmon Rmon OverviewExample of Rmon Configuration Commands Rmon Groups Lite Rmon GroupsStandard Rmon Groups Professional Rmon GroupsControl Tables Using Rmon Configuring Rmon Groups String status enabledisable EnabledisableNum status enabledisable Size owner string status enabledisableRmon protocol-distribution index index-number Port port owner string status enabledisableOid type absolutedelta status enabledisable Rmon user-history-control index index-numberDisplaying Rmon Information Rmon CLI Filters Following shows Host table output without a CLI filter 01000CCCCCCCTroubleshooting Rmon Using Rmon CLI FiltersCreating Rmon CLI Filters 312 Allocating Memory to Rmon Ssr# rmon show status Rmon StatusRmon set memory number WAN WAN OverviewStatic, Mapped, and Dynamic Peer IP/IPX Addresses Configuring WAN InterfacesPrimary and Secondary Addresses Static AddressesMapped Addresses Following command line displays an example for a VlanFollowing command line displays two examples for PPP Dynamic AddressesFollowing command line displays an example for PPP Forcing Bridged EncapsulationPacket Compression Nature of the Data Example ConfigurationsAverage Packet Size Link IntegrityWAN Quality of Service Packet EncryptionCongestion Management Weighted-Fair QueueingSource Filtering and ACLs Random Early Discard REDFrame Relay Overview Virtual CircuitsAdaptive Shaping Configuring Frame Relay Interfaces for the SSR Permanent Virtual Circuits PVCsSetting up a Frame Relay Service Profile Applying a Service Profile to an Active Frame Relay WAN PortFrame Relay Port Configuration Monitoring Frame Relay WAN Ports326 Configuring PPP Interfaces Point-to-Point Protocol PPP OverviewUse of LCP Magic Numbers Setting up a PPP Service Profile Defining the Type and Location of a PPP InterfaceApplying a Service Profile to an Active PPP Port Configuring Multilink PPP BundlesCompression on MLP Bundles or Links PPP Port Configuration Monitoring PPP WAN PortsSsrconfig# ppp apply service profile2 ports hs.5.1 WAN Configuration Examples Simple Configuration FileMulti-Router WAN Configuration Multi-router WAN configurationRouter R2 Configuration File Router R1 Configuration FileFollowing configuration file applies to Router R1 Following configuration file applies to Router R2Router R4 Configuration File Router R3 Configuration FileFollowing configuration file applies to Router R3 Following configuration file applies to Router R4Router R6 Configuration File Router R5 Configuration FileFollowing configuration file applies to Router R5 Following configuration file applies to Router R6SmartSwitch Router User Reference Manual 337 338