Manuals / Enterasys Networks / Computer Equipment / Network Router

Enterasys Networks X-PeditionTM manual Configuring Adsl

Models: X-PeditionTM

1 466

Download 466 pages 52.77 Kb

Page 23

Measuring Bandwidth Utilization	12-5
Describing Priority Queues	12-5
Configuring Priority Queues	12-5
Describing Traffic Policing	12-6
Configuring Traffic Policing	12-6
Class-based Traffic Shaping	12-7
Traffic Shaping per Policy-Map	12-8
Differences Between Traffic Policing and Traffic Shaping	12-9
Traffic Shaping and Queue Limit	12-9
Congestion Control & Avoidance	12-10
Describing Queue Size Control (Drop Tail)	12-10
Describing Random Early Detection	12-10
Describing Weighted Random Early Detection	12-11
Configuration per Interface	12-12
Suggestions for Using QoS on the XSR	12-13
QoS and Link Fragmentation and Interleaving (LFI)	12-13
Configuring QoS with MLPPP Multi-Class	12-13
Configuring QoS with FRF.12	12-14
QoS with VLAN	12-14
Traffic Classification	12-14
Describing VLAN QoS Packet Flow	12-15
VLAN Packet with Priority Routed out a Fast/GigabitEthernet Interface	12-15
VLAN Packet with Priority Routed out a Serial Interface	12-15
Non-VLAN IP Packet Routed Out a Fast/GigabitEthernet Interface	12-16
QoS with VLAN Configuration Process	12-16
QoS on Input	12-17
QoS on VPN	12-17
QoS over VPN Features	12-18
Configuring QoS on a Physical Interface	12-18
Configuring QoS on a Virtual Tunnel Interface	12-18
QoS on a Virtual Interface Example	12-19
QoS and VPN Interaction	12-22
Configuring the Shaper on the VPN Interface	12-23
QoS Policy Configuration Examples	12-24
Simple QoS on Physical Interface Policy	12-24
QoS for Frame Relay Policy	12-25
QoS with MLPPP Multi-Class Policy	12-26
QoS with FRF.12 Policy	12-27
QoS with VLAN Policy	12-28
Input and Output QoS Policy	12-28
Input QoS on Ingress to the Diffserv Domain Policy	12-29

Chapter 13: Configuring ADSL

Overview	13-1
Features	13-1
PDU Encapsulation Choices	13-2
PPP over ATM	13-2
PPP over Ethernet over ATM (Routed)	13-3
Routed IP over ATM	13-4
ADSL Limitations	13-5

xxi

Image 23

Enterasys Networks X-PeditionTM manual Configuring Adsl

Contents

Version PeditionSecurity RouterPage Enterasys Networks, Inc Minuteman Road Andover, MA Federal Communications Commission FCC Notice Regulatory Compliance InformationClass a ITE Notice Clase A. Aviso de ITE Product SafetyIndustry Canada Notices TTE Directive DeclarationVcci Notice Electromagnetic Compatibility EMCCompatibilidad Electromágnetica EMC Elektro- magnetische Kompatibilität EMCUSA Declaration of ConformityApproved Enterasys Networks, Inc Firmware License Agreement Viii Page Page Contents Configuring an Interface Displaying Interface Attributes Managing LAN/WAN Interfaces Configuring T1/E1 & T3/E3 InterfacesConfiguring IP How Triggered-on-Demand RIP Works Configuration Considerations Configuring the Border Gateway ProtocolRoute Reflectors Confederations Configuring PIM-SM and IgmpConfiguring PPP Configuring Dialer Services Configuring Frame Relay10-13 Configuring Quality of Service Configuring Integrated Services Digital NetworkConfiguring Adsl Configuring the Virtual Private Network Configuring Dhcp Configuring Security on the XSR Appendix B XSR Snmp Proprietary and Associated Standard MIBs DOS Attacks Blocked Counters DOS Attacks Blocked Table Preface Contents of the GuideFollowing conventions are used in this guide Conventions Used in This GuideBold/En negrilla FTP Getting HelpOverview Overview XSR User’s Guide Overview Connecting via the Console Port on XSR Series Utilizing the Command Line InterfaceConnecting a Serial Interface to a Modem Using the Console Port to Remotely Control the XSRTerminal Commands Connecting via TelnetConnecting via SSH Synchronizing the Clock Accessing the Initial PromptManaging the Session Remote Auto InstallRAI Features and Requirements Utilizing the Command Line Interface Frame Relay Remote Router RAI Requirements on the XSRHow RAI Components Work Frame Relay Central Site Bootp ClientReverse DNS Client Tftp ClientDhcp over LAN RAI over Ethernet PPP RAI over Adsl PPP RAI over a Leased LinePPP RAI over a Dial-in Line CLI Editing Rules CLI Shortcuts Command Description Setting CLI Configuration ModesRefer to -1for a graphic example of configuration modes CLI Configuration Modes Function Access Method PromptPrivileged Exec Mode Global Configuration ModeExiting From the Current Mode User Exec ModeFollowing example Mode ExamplesObserving Command Syntax and Conventions Supported Virtual Interfaces CLI Command LimitsDescribing Ports and Interfaces Supported Physical InterfacesSupported Ports Setting Interface Type and NumberingSetting Port Configuration Mode Numbering XSR Slots, Cards, and PortsDialer Example Configuration ExamplesT1 Example T1-PRI Isdn ExampleFollowing interfaces are added BRI-Dialer Idsn ExampleYou may type Entering Commands that Control TablesAdding Table Entries Following sub-interfaces are addedDisplaying Table Entries Managing XSR InterfacesDeleting Table Entries Modifying Table EntriesDisabling an Interface Configuring an InterfaceFollowing command enables an interface Enabling an InterfaceManaging Message Logs Performing Fault ManagementLogging Commands Capturing Fault Report Data Fault Report CommandsRTC/Network Clock Options Using the Real-Time ClockManaging the System Configuration RTC CommandsUsing the Default Button XSR 1800/1200 Series Only Resetting the Configuration to Factory DefaultDownloading the Configuration Configuration Save OptionsBulk Configuration Management Using File System CommandsFull-config Backup Uploading the Configuration/Crash ReportCreating Alternate Configuration Files Creating Alternate Software Image Files BootRom Upgrade ChoicesPre-upgrade Procedures Managing the Software ImageUsing the Bootrom Update Utility Using TFTP, transfer updateBootrom.fls from the network Local Bootrom Upgrade XSR1800 bU bootromuncmp.fls Loading Software Images Using EOS Fallback to Upgrade the ImageConfiguring EOS Fallback via Snmp Configuring EOS Fallback on the CLISet the operation to imageSetSelected Software Image CommandsConfiguration Change Hashing Downloading with Fips SecurityCreating Resources Memory ManagementDisplaying System Status and Statistics Network Management through Snmp Statistics Snmp InformsShaping Trap Traffic Measuring Performance Metrics Alarm Management TrapsNetwork Monitoring via Service Level Agreement Agent Create a Measurement to Ping Via CLI Create an OwnerVia CLI Via SnmpSchedule a measurement Via CLI Following command schedules a measurement immediatelyCabletron CTdownload MIB Full Configuration Backup/RestoreUsing the SLA Agent in Snmp Enterasys Configuration Management MIBCLI Translator Software Image Download using NetSightAppending CLI Commands to Configuration Files via Snmp Snmp Download with Auto-Reboot OptionNetwork Management Tools Accessing the XSR Through the WebNetSight Atlas Router Services Manager Firmware Upgrade ProceduresAuto-discovery Fault ReportingUsing the CLI for Downloads Using Snmp for DownloadsOverview of LAN Interfaces LAN FeaturesXSR supports the following LAN interface features MIB Statistics Configuring the LANOverview of WAN Interfaces WAN FeaturesXSR supports the following WAN interface features Configuring the WAN Following example configures the XSR to dial-out async Configuring the WAN Managing LAN/WAN Interfaces T1/E1 Functionality FeaturesT1/E1 Mode OverviewE3 Mode T3 ModeT3/E3 Subsystem Configuration T1/E1 Subsystem ConfigurationT1 Drop & Insert One-to-One DS0 Bypassing Drop and Insert FeaturesD&I NIM does not support channelized mode nor PRI Specify the controllers framing type Configuring Channelized T1/E1 InterfacesEnter the no shutdown command to enable the line Specify the clock source for the controllerEnable the Serial line Configuring Un-channelized T3/E3 InterfacesEnable the Controller line Optionally, if you prefer to configure internal clockingT1/E1 & T3/E3 Physical Layer Troubleshooting Troubleshooting T1/E1 & T3/E3 LinksXSRconfig#controller t1 1/0 XSRconfig-controllerT1-1/0# Restart the controller T1/E1 & T3/E3 Alarm AnalysisReceive Alarm Indication Signal AIS Blue Alarm Transmit Alarm Indication Signal AIS Blue Alarm Receive Remote Alarm Indication RAI Yellow AlarmTransmit Remote Alarm Indication RAI Yellow Alarm Transmit Sending Remote Alarm Red AlarmXSR T1/E1 & T3/E3 Error Events AnalysisController Slip Seconds Counter IncreasingLine Code Violations Increasing Configuring the D&I NIMFraming Loss Seconds Increasing Page General IP Features Configuring IPSecondary IP TelnetRIP Troubleshooting Tools Ping Traceroute IP RoutingProxy DNS BOOTP/DHCP RelayARP and Proxy ARP Local Broadcast BroadcastDirected Broadcast Telnet TCPInterface & Secondary IP Trivial File Transfer Protocol TftpIP Interface Secondary IPIcmp & Secondary IP ARP & Secondary IPUnnumbered Interface & Secondary IP Routing Table Manager & Secondary IPOspf & Secondary IP RIP & Secondary IPTraceroute IP Routing ProtocolsMaximum Transmission Unit MTU PingRIPv1 How Triggered-on-Demand RIP Works Triggered-on-Demand RIPIP Routing Protocols Ospf Ospf Database Overflow LSA Type 3 and 5 SummarizationFollowing is a high priority Overflow Exited log report Ospf Passive InterfacesFollowing is a high priority Overflow Entered log report Route Preference Ospf TroubleshootingNull Interface Vlan Routing Static Routes802.1Q Vlan Tag Forwarding VLAN, PPPoE over VlanIP Routing Table Vlan Processing Over the XSR’s Ethernet InterfacesVlan Ethernet to Fast/GigabitEthernet Topology Vlan Processing VLAN-enabled Ethernet to WAN InterfacesQoS with Vlan Accessing the Global Routing Policy TablePolicy Based Routing PBR Cache Match ClausesSet Clauses Router ID Default NetworkClassless Inter-Domain Routing Cidr Real Time Protocol RTP Header Compression Network Address Translation FeaturesVirtual Router Redundancy Protocol XSR1 XSR2 Vrrp DefinitionsDifferent States of a Vrrp Router How the Vrrp WorksMultiple VRs Per Router Vrrp FeaturesAuthentication Multiple Virtual IP Addresses per VRProxy ARP Load BalancingARP Process on a Vrrp Router Host ARPInterface Monitoring Icmp PingWatch Group Monitoring Equal-Cost Multi-Path Ecmp Configuration ConsiderationsCentral XSR Configuring RIP ExamplesConfiguring RIP Examples Configuring Ospf Example Configuring Unnumbered IP Serial Interface ExampleBasic One-to-One Static NAT Configuring NAT ExamplesConfiguring Static Translation Register the global NAT pool Dynamic Pool ConfigurationConfiguring Dynamic Pool Translation Bind the interface and optional ACL to the NAT pool Configuring NaptEnable an interface F1, for example Network Address and Port Translation14 Multiple NAT Pools within Interface Multiple NAT Pools within an InterfaceStatic NAT within an Interface 15 Static NAT within Interface Inside OutsideNAT Port Forwarding Configuring Policy Based Routing ExampleEnter the following commands to enable NAT Port Forwarding Router XSRb Configuring Vrrp ExampleRouter XSRa For a QoS with Vlan example, refer to QoS with Vlan on Configuring Vlan ExamplesFollowing example configures a Vlan interface for PPPoE Configuring the Border Gateway Protocol Open Describing BGP MessagesNotification UpdateDefining BGP Path Attributes KeepaliveOrigin AS PathLocal Preference Next HopLocal Preference Applied to Direct Egress Traffic from AS Atomic Aggregate WeightMulti-Exit Discriminator AggregatorAspath Communities CommunityApplication of Community Attribute BGP Routing Policy BGP Path Selection ProcessRoute Maps Access Control ListsFilter Lists Community ListsRegular Expression Examples Regular ExpressionsRegular Expression Characters Display all routes with any AS path Peer GroupsCreating a Peer Group Assigning Peer Group OptionsAdding BGP Neighbors Initial BGP ConfigurationResetting BGP Connections For an example, refer to Configuring BGP Neighbors onRoute Flap Dampening SynchronizationAddress Aggregation Recommendations for Route Flap Dampening Capability AdvertisementRoute Refresh 10 Fully Meshed BGP Scaling BGP11 Route Reflector Applied to Minimize Ibgp Mesh Route ReflectorsConfederations 12 Use of Confederations to Reduce Ibgp Mesh Sub AS-302 Displaying System and Network StatisticsConfiguring BGP Route Maps BGP Path Filtering by Neighbor Example Configuring BGP NeighborsBGP Aggregate Route Examples Configuring BGP ConfederationsThis section details Ibgp and an Ebgp peer group examples Configuring BGP Peer GroupsTCP MD5 Authentication for BGP Example Ibgp Peer Group ExampleBGP Community with Route Maps Examples Ebgp Peer Group ExampleXSRconfig#router bgp XSRconfig-router#network 1.0.0.0 mask Configuring BGP Peer Groups Differences with Industry-Standard Approach Configuring PIM-SM and IgmpDefining Multicast Group Addressing IP Multicast OverviewComparing Multicast Distribution Trees Outlining Igmp VersionsForwarding Multicast Traffic Describing the XSR’s IP Multicast FeaturesSending a Query Group Membership ActionsSending and Receiving Queries and Reports Interoperating with Older Igmp Versions Behavior of Multicast Routers Among Older Version Queriers Describing the XSR’s PIM-SM v2 FeaturesBehavior of Group Members Among Older Version Group Members Phase 2 Building Shortest Path Tree Between Sender & RP Phase 1 Building a Shared TreePhase 2 Topology Shortest Path Tree Between Sender and RP Neighbor Discovery and DR Election Assert Processing Bootstrap & Rendezvous PointPIM Register Message PIM Join/Prune MessagePIM SM over Frame Relay Source-Specific MulticastPIM Configuration Examples PIM Configuration Examples Configuring PIM-SM and Igmp PPP Features Configuring PPPNetwork Control Protocol NCP Link Control Protocol LCPMicrosoft Challenge Handshake Protocol MS-CHAP AuthenticationPassword Authentication Protocol PAP Challenge Handshake Authentication Protocol ChapMultilink PPP Mlppp Link Quality Monitoring LQMMulti-Class Mlppp Multilink Header Option Format Multilink Head Format Negotiation Fragment Interleaving Over the LinkMulti-Class Receiving Packet Events and AlarmsIP Control Protocol Ipcp Multi-Class Option NegotiationIP Address Assignment PPP Bandwidth Allocation/Control Protocols BAP/BAPCEnter encapsulation ppp to enable PPP encapsulation Configuring PPP with a Dialed Backup LineConfiguring a Synchronous Serial Interface Enter the media-type for the interface default RS232Enter no shutdown to enable this interface Configuring a Dialed Backup LineConfiguring the Dialer Interface Configuring the Physical Interface for the Dialer InterfaceConfigure interface dialer 1 to use dial pool Configuring the Interface as the Backup Dialer InterfaceDialer Example Configuring Mlppp on a Multilink/Dialer interfaceMultilink Example XSR1 Configuration Configuring BAPDual XSRs One Router Using DoD with Call Request Configure the dialer list and ACL for DoD XSR2 ConfigurationConfigure the Dialer 1 interface with a dialer pool Dual XSRs BAP Using Call/Callback Request Configuring BAP Configuring BAP Configuring PPP DLCIs Virtual CircuitsDCEs DTEsMulti-Protocol Encapsulation Frame Relay FeaturesRate Enforcement CIR Generic Traffic Shaping Address ResolutionDynamic Resolution Using Inverse ARP Controlling Congestion in Frame Relay NetworksBackward Explicit Congestion Notification Becn Discard Eligibility DE BitForward Explicit Congestion Notification Fecn Controlling Congestion in Frame Relay Networks Sub-interfaces Link Management Information LMIEnd-to-End Fragmentation User Configuration CommandsFRF.12 Fragmentation Clear Statistics Reports and AlarmsMap-Class Configuration Show Running ConfigurationMinneapolis Houston Memphis Interconnecting via Frame Relay NetworkMulti-point to Point-to-Point Example Configuring Frame RelayConfiguring Frame Relay Configuring Frame Relay Configuring Frame Relay Dial Services Features Overview of Dial Services25bis over Synchronous Interfaces AT Commands on Asynchronous PortsAsynchronous and Synchronous Support DTR Dialing for Synchronous Interfaces Time of Day featureTypical Use for Dial Services Ethernet BackupDialer Profiles Implementing Dial ServicesAddressing Dialer Resources Dialer InterfaceDialer Strings Dialer PoolIsdn Callback Configuring EncapsulationLogical View of Dialer Profiles Sample Dialer Topology Dialer Profile of Destination 416 Dialer Profile of Destination 987 Creating and Configuring the Dialer InterfaceConfigure a backup link for dial purposes with priority Sample Dialer ConfigurationConfiguring the Map Class Configuring the Physical Interface for the Dialer InterfacePoint-to-Multipoint with One Neighbor Configuring Isdn CallbackPoint-to-Point with Matched Calling/Called Numbers Point-to-Point with Different Calling/Called NumbersDial Backup Features Overview of Dial BackupSequence of Backup Events Backup Link Failure Example Link Failure Backup ExampleConfigure backup serial port for dialing purposes Configuring Interface as the Backup Dialer InterfaceDialer Sample ConfigurationConfigure interface dialer 2 to use dial pool Overview of Dial on Demand/Bandwidth on Demand Dialer Watch Dialer Interface SpoofingDialer Watch Topology Dialer Watch BehaviorCaveat Answering Incoming Isdn CallsIncoming Call Mapping Example Node a Calling Node ConfigurationFollowing command maps ACL 101 to dialer group Node D Calling Node Configuration Node B Called Node ConfigurationFollowing command maps ACL 1061 to dialer group Configuring DoD/BoD11 Dial on Demand Topology PPP Point-to-Multipoint ConfigurationNode a Configuration PPP Multipoint-to-Multipoint ConfigurationFollowing command maps ACL 105 to dialer group PPP Point-to-Point ConfigurationsNode B Configuration Dial-out Routing for Dial on Demand Example Following commands configure dialer interfaceDial-in Routing for Dial on Demand Example 13 PPP Point-to-Multipoint Topology PPP Point-to-Multipoint ConfigurationsDial-in Router Example Dial-out Router ExampleFollowing command sets remote user authentication Mlppp Point-to-Multipoint Configuration14 Mlppp Point-to-Point Topology Mlppp Point-to-Point ConfigurationsMlppp Point-to-Multipoint Configurations 15 Mlppp Point-to-Multipoint Topology Mlppp Multipoint-to-Multipoint Configuration Bandwidth-on-Demand Switched PPP Multilink ConfigurationFollowing command maps ACL 106 to dialer group Node C Called Node ConfigurationNode a Backed-up Node Configuration Backup ConfigurationBackup Using Isdn XSRconfig#username toronto privilege 0 password cleartext z Following command configures Serial sub-interface 2/01 Configuration for Backup with Mlppp BundleFollowing command configures Serial sub-interface 2/00 Following commands configure Serial sub-interface 2/00 Configuration for Ethernet FailoverConfiguration for Frame Relay Encapsulation Backup Configuration Configuring Dialer Services Leased line Isdn configuration examples T1 PRI E1 PRI Isdn FeaturesUnderstanding Isdn BRI FeaturesPRI Features Channel Basic Rate InterfacePrimary Rate Interface ChannelsChannel Standards Channel Signaling and Carrier NetworksIsdn Equipment Configurations Security Bandwidth OptimizationQ921 Decoding Call MonitoringIsdn Trace Trace DecodingReference Parameters Q931 DecodingStatus + Next line 04 Bearer capabilityBRI NI-1, DMS100 & 5ESS Spid Registration Isdn ConfigurationTerminal Endpoint Identifier TEI Management Procedures Decoded IEsBRI Switched Configuration Model Switched BRI Configuration Model PRI Configuration Model PRI Configuration Model Interface BRI 0/1/21 Leased-Line Configuration ModelFollowing example configures a switched line BRI connection More Configuration ExamplesFollowing example configures a PRI connection on a T1 card Following example configures a PRI connection on an E1 cardBRI Leased PPP Following example configures a leased-line BRI connectionIsdn ITU Standard Q.931 Call Status Cause Codes BRI Leased LineCall Status Cause Codes Code Cause Incoming calls barred Configuring Quality of Service Traffic Classification Mechanisms Providing QoSDescribing the Policy Map Describing the Class MapDescribing Class-Based Weight Fair Queuing Queuing and ServicesDescribing Priority Queues Configuring CbwfqConfiguring Priority Queues Measuring Bandwidth UtilizationAssign the class frost to the priority queue Configuring Traffic PolicingDescribing Traffic Policing Class-based Traffic Shaping Traffic Shaping per Policy-Map Traffic Shaping and Queue Limit Differences Between Traffic Policing and Traffic ShapingDescribing Random Early Detection Congestion Control & AvoidanceDescribing Queue Size Control Drop Tail RED Drop Probability Calculation Describing Weighted Random Early DetectionVPN Configuration per InterfaceQoS and Link Fragmentation and Interleaving LFI Suggestions for Using QoS on the XSRConfiguring QoS with Mlppp Multi-Class QoS with Vlan Configuring QoS with FRF.12Vlan Packet with Priority Routed out a Serial Interface Describing Vlan QoS Packet FlowLAN/QoS Serial Scenario QoS with Vlan Configuration ProcessQoS on VPN QoS on InputConfiguring QoS on a Virtual Tunnel Interface QoS over VPN FeaturesConfiguring QoS on a Physical Interface QoS on a Virtual Interface Example Configure the output policy map Ser classes RTP1 and FTP1 Configure the input policy map Vpn classes RTP and FTPConfigure the IPSec SA Configure ACLsConfigure the IKE policy foo for pre-share keys Route QoS and VPN InteractionAH Hmac ESP+3DES Configuring the Shaper on the VPN InterfaceCreate the policy map QoS Policy Configuration ExamplesSimple QoS on Physical Interface Policy QoS for Frame Relay Policy Apply the configuration to the interfaceQoS with Mlppp Multi-Class Policy QoS with FRF.12 Policy Input and Output QoS Policy QoS with Vlan PolicyInput QoS on Ingress to the Diffserv Domain Policy QoS Policy Configuration Examples Configuring Adsl PPP over ATM PDU Encapsulation ChoicesPPP over Ethernet over ATM Routed PPPoA Network DiagramRouted IP over ATM PPPoE Network DiagramNIM Card Adsl LimitationsAdsl Hardware DSP Firmware Adsl Data FramingATM Support Adsl on the MotherboardOAM Cells Access Concentrator RestrictionsClass of Service Dslam CompatibilityPPPoE Configuration ExamplesInverse ARP QoSPPPoA Following optional commands configure two default routesFollowing optional commands configure NAT IPoA Enter the following commands to configure a IPoA topologyVPN Overview Internet Security IssuesHow a Virtual Private Network Works Ensuring VPN Security with IPSec/IKE/GRETransport Mode Processing GRE over IPSec Tunnel Mode ProcessingDigital Signatures Describing Public-Key Infrastructure PKIDefining VPN Encryption Machine Certificates for the XSR CertificatesCertificate Chains CA HierarchiesCertificate Chain Example RA ModeCRL Retrieval Pending ModeEnroll Password DF Bit FunctionalityVPN Applications NAT Traversal Site-to-Site NetworksSite-to-Central-Site Networks Internet Client ModeNetwork Extension Mode NEM Remote Access NetworksConfiguring Ospf Over Site-to-Central Site in Client Mode Using Ospf Over a VPN NetworkOspf Commands Server ClientServer Client InternetInterfaces Fast/GigabitEthernet 1 and VPN Configuring Ospf with Fail Over RedundancyServer ClientInterfaces Fast/GigabitEthernet 1, VPN 1 and VPN XSR VPN FeaturesLimitations Napt Master Encryption Key Generation VPN Configuration OverviewConfiguring ACLs ACL Configuration RulesSA lifetimes Selecting Policies IKE/IPSec Transform-SetsSecurity Policy Considerations Configuring PolicyCreating Crypto Maps Configuring Crypto MapsUser-Name Authentication, Authorization and Accounting ConfigurationConfiguring AAA AAA CommandsPKI Configuration Options PKI Certificate Enrollment Example Configuring PKICA-AUTHENTICATED XSRconfig#ip domain acme.com Interface VPN Options Following sub-commands are available at VPN Interface mode Configuring a Simple VPN Site-to-Site ApplicationVPN Interface Sub-Commands XSRconfig#crypto isakmp proposal Test XSRconfig-crypto-m#description external interface Configuring the VPN Using EZ-IPSecXSRconfig#interface vpn 1 point-to-point EZ-IPSec ConfigurationXSR with VPN Central Gateway Add ACLs to permit IP and UDP traffic Configure IKE policy for the remote peerConfigure the following four IPSec SAs Add a default route to the next hop Internet gateway Configure and enable the FastEthernet 1 interfaceClear the DF bit globally Create a group for NEM and Client mode usersTunnel a XSR-3250 VPN GRE Site-to-Site Tunnel GRE Tunnel for OspfXSRconfig-isakmp-peer#proposal shared Tunnel B XSR-1805 VPN GRE Site-to-Site Tunnel Enable Ospf on the trusted and VPN interfacesEnable Ospf on the trusted and VPN interfaces XSR/Cisco Site-to-Site Example Cisco ConfigurationXSR Configuration Scenario 1 Gateway-to-Gateway with Pre-Shared Secrets Interoperability Profile for the XSRConfigure IKE Phase 1 policy Configure the Gateway a external LAN network AWConfigure a default route Interoperability Profile for the XSR 14 Gateway-to Gateway with Certificates Topology Scenario 2 Gateway-to-Gateway with CertificatesXSR#clock timezone -7 State CA-AUTHENTICATED Overview of Dhcp Configuring DhcpDhcp Server Standards How Dhcp WorksTemporary or Permanent Network Address Allocation Dhcp ServicesAssigned Network Configuration Values to Clients Options Persistent Storage of Network Parameters for ClientsPool subnet Bootp Legacy SupportProvisioning Differentiated Network Values by Client Class Nested Scopes IP Pool SubsetsManual Bindings Scope CaveatDhcp Client Interaction Dhcp Client ServicesRouter Option Parameter Request List OptionInteraction with Remote Auto Install RAI Dhcp Client TimeoutsDhcp CLI Commands Configuring Dhcp Network Configuration Parameters Dhcp Set Up OverviewConfiguration Steps Configuring Dhcp Address PoolsOptional Configure a Dhcp Manual Binding Configure Dhcp Network ParametersEnable the Dhcp Server Optional Set Up a Dhcp Nested ScopeManual Binding with Class Example Dhcp Server Configuration ExamplesPool with Hybrid Servers Example Manual Binding ExampleDhcp Option Examples Bootp Client Support ExampleAccess Control Lists Configuring Security on the XSRLANd Attack ACL Violations Alarm ExampleFirst alarms logged will display as follows Packet FilteringSpoofed Address Check Smurf AttackFraggle Attack IP Packet with Multicast/Broadcast Source AddressPing of Death Attack General Security PrecautionsSpurious State Transition Large Icmp PacketsAAA Services Connecting Remotely via SSH or Telnet with AAA Service PuTTY Exit Option PuTTY Alert Message Reasons for Installing a Firewall Firewall Feature Set OverviewACL and Packet Filter Firewalls Types of FirewallsALG and Proxy Firewalls Filtering non-TCP/UDP Packets XSR Firewall Feature Set FunctionalityStateful Inspection Firewalls Stateful Firewall Inspection SFIApplication Level Gateway Application Level CommandsEnabling URL Filtering in Firewall Policy On Board URL FilteringImporting URL Lists from an Ascii File Writing URL List EntriesConfiguring URL Redirection Denial of Service DoS Attack ProtectionAlarms Alarm Logging12 Authentication Process AuthenticationACLs and Firewall Dynamic ReconfigurationFirewall and NAT Firewall and VPNFirewall CLI Commands Firewall CLI Commands 13 Sample Telnet Screen Firewall Limitations Steps to Configure the Firewall Pre-configuring the FirewallXSR with Firewall Log only critical events Complete LAN and WAN interface configuration15 XSR Firewall with PPPoE DSL and Dhcp XSR with Firewall, PPPoE and DhcpXSR with Firewall and VPN Configure the Dhcp pool, DNS server and related settingsAdd four ACLs to permit IP pool, L2TP and NEM traffic XP PC NEMConfigure the following IPSec SAs XSRconfig#ip local pool test 10.120.70.0 Define the local pool network used for tunnel IP addresses Define the Internet as all possible IP addressesDefine the public VPN interface crypto map Define three trusted networks in the enterpriseDefine service for Radius accounting Define service for IsakmpDefine service for L2TP tunnels Define service for Radius authenticationConfigure Radius network objects Firewall Configuration for VrrpLoad the firewall configuration Configuring Simple Security RPC Policy Configuration Configuration Examples Configuring Security on the XSR Recommended System Limits Alarms/Events, System Limits Standard Ascii TableSnmp views Table A-5 Alarm Behavior System Alarms and EventsDriv ETH1 ETH0 Table A-6 High Severity Alarms/Events Table A-7 Medium Severity Alarms/Events Sntp PPP MS-CHAP authentication failed while Shutdown command Portchannel Corrected the problem by resetting itself Table A-9 Firewall and NAT Alarms Firewall and NAT Alarms and ReportsNAT TCP reset, NAT port %d, %IPP2 UDP Detected UDP Flood attack %IPP2 Deny Icmp unsupported packet %IP2ICMP UDP Request Entry pool is empty Space Standard Ascii Character TableStandard Ascii Character Table VPN MIB Tables on page B-12 Service Level Reporting MIB TablesEtsysSrvcLvlMetricTable EtsysSrvcLvlHistoryTable EtsysSrvcLvlOwnerTableEtsysSrvcLvlNetMeasureTable Field Example CLI commandRtr schedule aliased to EtsysSrvcLvlAggrMeasureTableBGP v4 Peer Table BGP v4 MIB TablesGeneral Variables Table BgpPeerAdminStatus Bgp4PathAttrIpAddrPrefix BGP-4 Received Path Attribute TableBGP-4 Traps Global Interface Operations Firewall MIB TablesSession Totals Counters Monitoring ObjectsPolicy Rule Table Totals Counters Policy Rule True TableIP Session Table Authenticated Address CountersAuthenticated Addresses Table IP Session CountersDOS Attacks Blocked Table VPN MIB TablesDOS Attacks Blocked Counters EtsysVpnIkePeerProposals Table EtsysVpnIkePeer TableEtsysVpnIntfPolicy Table EtsysVpnIkeProposal TableEtsysVpnIpsecPolicy Table EtsysVpnIpsecPolProposals Table EtsysVpnIpsecPolicyRule TableEtsysVpnAhTransform Table EtsysVpnIpsecProposal TableEtsysVpnIpsecPropTransforms Table EtsysVpnIpcompTransform Table EtsysVpnEspTransform TableHost Resources MIB Objects IpCidrRouteTable for Static RoutesField Description ConfigMgmtOperations Enterasys Configuration Management MIBField Description EtsysConfigChangeNonVolatile Group Enterasys Configuration Change MIBEnterasys Snmp Persistence MIB Field Description EtsysSyslogClient Group Enterasys Syslog Client MIBTable B-46 Enterasys Syslog Client MIB Compliance Statements