Interface VPN Options | Enterasys Networks X-PeditionTM specs

VPN Configuration Overview

Issuer:	C=US, O=sml, CN=ldapca
Valid From:		2002	Aug 5th, 12:40:46 GMT
Valid To:		2004	Aug 5th, 12:48:15 GMT
Subject:	C=US, O=sml, CN=ldapca
Fingerprint:		D423E129 81904CE0 1E6D0FE0 A123A302
Certificate Size:		1157	bytes
RA KeyEncipher Certificate - ldapca-rae
State:		CA-AUTHENTICATED
Version:		V3
Serial Number:		458128935273366930063530
Issuer:	C=US, O=sml, CN=ldapca
Valid From:	2002 Sep 20th, 14:07:34 GMT
Valid To:	2004 Aug 5th, 16:16:08 GMT
Subject:	C=US, O=sml.com, CN=sml_requestor
Fingerprint:		F1279D63 AFFC3D93 48E5F311 73A1D16F
Certificate Size:		1695	bytes
RA Signature Certificate - ldapca-ras
State:		CA-AUTHENTICATED
Version:		V3
Serial Number:		458128729515158954573993
Issuer:	C=US, O=sml, CN=ldapca
Valid From:		2002	Sep 20th, 20:45:13 GMT
Valid To:		2004	Aug 5th, 20:55:13 GMT
Subject:	C=US, O=sml.com, CN=sml_requestor
Fingerprint:		91EB5A77 B5CA535A 077B65C5 65035615
Certificate Size:		1695	bytes

10.Optional. Change the enrollment retry count and period to a value matching your CA administrator’s needs.

The following values handle “non-pending” mode at the CA when a certificate request could time out while waiting for a response. Six requests will be issued every 10 minutes.

XSR(config)#enrollment retry count 6 XSR(config)#enrollment retry period 10

Interface VPN Options

Some configurations require the construct of virtual interfaces that represent tunnels on the XSR. A virtual interface defined by the interface vpn command often represents IPSec tunnels configured automatically by EZ-IPSec. A VPN interface can also be configured as a point-to-pointor a point-to-multi-pointinterface with the following conditions:

•The interface vpn [#] point-to-pointcommand applies to Site-to-Site or EZ-IPSec tunnels initiated by the XSR

•The interface vpn [#] multi-pointcommand applies to an XSR used as a gateway and tunnel terminator

XSR User’s Guide 14-31

Image 353

Enterasys Networks X-PeditionTM manual Interface VPN Options

Contents

Version PeditionSecurity RouterPage Enterasys Networks, Inc Minuteman Road Andover, MA Federal Communications Commission FCC Notice Regulatory Compliance Information Industry Canada Notices Product SafetyTTE Directive Declaration Class a ITE Notice Clase A. Aviso de ITE Compatibilidad Electromágnetica EMC Electromagnetic Compatibility EMCElektro- magnetische Kompatibilität EMC Vcci Notice USA Declaration of Conformity Approved Enterasys Networks, Inc Firmware License Agreement Viii Page Page Contents Configuring an Interface Displaying Interface Attributes Managing LAN/WAN Interfaces Configuring T1/E1 & T3/E3 InterfacesConfiguring IP How Triggered-on-Demand RIP Works Configuration Considerations Configuring the Border Gateway Protocol Route Reflectors Confederations Configuring PIM-SM and Igmp Configuring PPP Configuring Dialer Services Configuring Frame Relay 10-13 Configuring Quality of Service Configuring Integrated Services Digital Network Configuring Adsl Configuring the Virtual Private Network Configuring Dhcp Configuring Security on the XSR Appendix B XSR Snmp Proprietary and Associated Standard MIBs DOS Attacks Blocked Counters DOS Attacks Blocked Table Preface Contents of the Guide Following conventions are used in this guide Conventions Used in This Guide Bold/En negrilla FTP Getting Help Overview Overview XSR User’s Guide Overview Connecting via the Console Port on XSR Series Utilizing the Command Line Interface Connecting a Serial Interface to a Modem Using the Console Port to Remotely Control the XSR Terminal Commands Connecting via TelnetConnecting via SSH Synchronizing the Clock Accessing the Initial Prompt Managing the Session Remote Auto InstallRAI Features and Requirements Utilizing the Command Line Interface Frame Relay Remote Router RAI Requirements on the XSRHow RAI Components Work Reverse DNS Client Bootp ClientTftp Client Frame Relay Central Site Dhcp over LAN RAI over Ethernet PPP RAI over Adsl PPP RAI over a Leased LinePPP RAI over a Dial-in Line CLI Editing Rules CLI Shortcuts Command Description Setting CLI Configuration Modes Refer to -1for a graphic example of configuration modes CLI Configuration Modes Function Access Method Prompt Exiting From the Current Mode Global Configuration ModeUser Exec Mode Privileged Exec Mode Following example Mode ExamplesObserving Command Syntax and Conventions Describing Ports and Interfaces CLI Command LimitsSupported Physical Interfaces Supported Virtual Interfaces Setting Port Configuration Mode Setting Interface Type and NumberingNumbering XSR Slots, Cards, and Ports Supported Ports T1 Example Configuration ExamplesT1-PRI Isdn Example Dialer Example Following interfaces are added BRI-Dialer Idsn Example Adding Table Entries Entering Commands that Control TablesFollowing sub-interfaces are added You may type Deleting Table Entries Managing XSR InterfacesModifying Table Entries Displaying Table Entries Following command enables an interface Configuring an InterfaceEnabling an Interface Disabling an Interface Managing Message Logs Performing Fault ManagementLogging Commands Capturing Fault Report Data Fault Report Commands Managing the System Configuration Using the Real-Time ClockRTC Commands RTC/Network Clock Options Using the Default Button XSR 1800/1200 Series Only Resetting the Configuration to Factory Default Bulk Configuration Management Configuration Save OptionsUsing File System Commands Downloading the Configuration Full-config Backup Uploading the Configuration/Crash ReportCreating Alternate Configuration Files Pre-upgrade Procedures BootRom Upgrade ChoicesManaging the Software Image Creating Alternate Software Image Files Using the Bootrom Update Utility Using TFTP, transfer updateBootrom.fls from the network Local Bootrom Upgrade XSR1800 bU bootromuncmp.fls Loading Software Images Using EOS Fallback to Upgrade the Image Configuring EOS Fallback via Snmp Configuring EOS Fallback on the CLI Configuration Change Hashing Software Image CommandsDownloading with Fips Security Set the operation to imageSetSelected Creating Resources Memory ManagementDisplaying System Status and Statistics Network Management through Snmp Statistics Snmp InformsShaping Trap Traffic Measuring Performance Metrics Alarm Management TrapsNetwork Monitoring via Service Level Agreement Agent Via CLI Create an OwnerVia Snmp Create a Measurement to Ping Via CLI Schedule a measurement Via CLI Following command schedules a measurement immediately Using the SLA Agent in Snmp Full Configuration Backup/RestoreEnterasys Configuration Management MIB Cabletron CTdownload MIB Appending CLI Commands to Configuration Files via Snmp Software Image Download using NetSightSnmp Download with Auto-Reboot Option CLI Translator NetSight Atlas Router Services Manager Accessing the XSR Through the WebFirmware Upgrade Procedures Network Management Tools Using the CLI for Downloads Fault ReportingUsing Snmp for Downloads Auto-discovery Overview of LAN Interfaces LAN FeaturesXSR supports the following LAN interface features MIB Statistics Configuring the LAN Overview of WAN Interfaces WAN FeaturesXSR supports the following WAN interface features Configuring the WAN Following example configures the XSR to dial-out async Configuring the WAN Managing LAN/WAN Interfaces T1/E1 Mode FeaturesOverview T1/E1 Functionality E3 Mode T3 Mode T3/E3 Subsystem Configuration T1/E1 Subsystem Configuration T1 Drop & Insert One-to-One DS0 Bypassing Drop and Insert FeaturesD&I NIM does not support channelized mode nor PRI Enter the no shutdown command to enable the line Configuring Channelized T1/E1 InterfacesSpecify the clock source for the controller Specify the controllers framing type Enable the Controller line Configuring Un-channelized T3/E3 InterfacesOptionally, if you prefer to configure internal clocking Enable the Serial line T1/E1 & T3/E3 Physical Layer Troubleshooting Troubleshooting T1/E1 & T3/E3 Links XSRconfig#controller t1 1/0 XSRconfig-controllerT1-1/0# Restart the controller T1/E1 & T3/E3 Alarm AnalysisReceive Alarm Indication Signal AIS Blue Alarm Transmit Remote Alarm Indication RAI Yellow Alarm Receive Remote Alarm Indication RAI Yellow AlarmTransmit Sending Remote Alarm Red Alarm Transmit Alarm Indication Signal AIS Blue Alarm XSR T1/E1 & T3/E3 Error Events Analysis Controller Slip Seconds Counter Increasing Line Code Violations Increasing Configuring the D&I NIMFraming Loss Seconds Increasing Page General IP Features Configuring IP Secondary IP Telnet RIP Troubleshooting Tools Ping Traceroute IP Routing Proxy DNS BOOTP/DHCP RelayARP and Proxy ARP Local Broadcast BroadcastDirected Broadcast Telnet TCP IP Interface Trivial File Transfer Protocol TftpSecondary IP Interface & Secondary IP Icmp & Secondary IP ARP & Secondary IP Ospf & Secondary IP Routing Table Manager & Secondary IPRIP & Secondary IP Unnumbered Interface & Secondary IP Maximum Transmission Unit MTU IP Routing ProtocolsPing Traceroute RIPv1 How Triggered-on-Demand RIP Works Triggered-on-Demand RIP IP Routing Protocols Ospf Ospf Database Overflow LSA Type 3 and 5 Summarization Following is a high priority Overflow Exited log report Ospf Passive InterfacesFollowing is a high priority Overflow Entered log report Route Preference Ospf TroubleshootingNull Interface Vlan Routing Static Routes 802.1Q Vlan Tag Forwarding VLAN, PPPoE over Vlan IP Routing Table Vlan Processing Over the XSR’s Ethernet Interfaces Vlan Ethernet to Fast/GigabitEthernet Topology Vlan Processing VLAN-enabled Ethernet to WAN Interfaces QoS with Vlan Accessing the Global Routing Policy TablePolicy Based Routing PBR Cache Match ClausesSet Clauses Router ID Default NetworkClassless Inter-Domain Routing Cidr Real Time Protocol RTP Header Compression Network Address Translation Features Virtual Router Redundancy Protocol XSR1 XSR2 Vrrp Definitions Different States of a Vrrp Router How the Vrrp Works Authentication Vrrp FeaturesMultiple Virtual IP Addresses per VR Multiple VRs Per Router ARP Process on a Vrrp Router Load BalancingHost ARP Proxy ARP Interface Monitoring Icmp Ping Watch Group Monitoring Equal-Cost Multi-Path Ecmp Configuration Considerations Central XSR Configuring RIP Examples Configuring RIP Examples Configuring Ospf Example Configuring Unnumbered IP Serial Interface Example Basic One-to-One Static NAT Configuring NAT ExamplesConfiguring Static Translation Register the global NAT pool Dynamic Pool ConfigurationConfiguring Dynamic Pool Translation Enable an interface F1, for example Configuring NaptNetwork Address and Port Translation Bind the interface and optional ACL to the NAT pool 14 Multiple NAT Pools within Interface Multiple NAT Pools within an Interface Static NAT within an Interface 15 Static NAT within Interface Inside Outside NAT Port Forwarding Configuring Policy Based Routing ExampleEnter the following commands to enable NAT Port Forwarding Router XSRb Configuring Vrrp ExampleRouter XSRa For a QoS with Vlan example, refer to QoS with Vlan on Configuring Vlan ExamplesFollowing example configures a Vlan interface for PPPoE Configuring the Border Gateway Protocol Open Describing BGP Messages Defining BGP Path Attributes UpdateKeepalive Notification Origin AS Path Local Preference Next Hop Local Preference Applied to Direct Egress Traffic from AS Atomic Aggregate Weight Multi-Exit Discriminator Aggregator Aspath Communities Community Application of Community Attribute BGP Routing Policy BGP Path Selection Process Filter Lists Access Control ListsCommunity Lists Route Maps Regular Expression Examples Regular ExpressionsRegular Expression Characters Creating a Peer Group Peer GroupsAssigning Peer Group Options Display all routes with any AS path Resetting BGP Connections Initial BGP ConfigurationFor an example, refer to Configuring BGP Neighbors on Adding BGP Neighbors Route Flap Dampening SynchronizationAddress Aggregation Recommendations for Route Flap Dampening Capability AdvertisementRoute Refresh 10 Fully Meshed BGP Scaling BGP 11 Route Reflector Applied to Minimize Ibgp Mesh Route Reflectors Confederations 12 Use of Confederations to Reduce Ibgp Mesh Sub AS-302 Displaying System and Network Statistics Configuring BGP Route Maps BGP Path Filtering by Neighbor Example Configuring BGP Neighbors BGP Aggregate Route Examples Configuring BGP Confederations TCP MD5 Authentication for BGP Example Configuring BGP Peer GroupsIbgp Peer Group Example This section details Ibgp and an Ebgp peer group examples BGP Community with Route Maps Examples Ebgp Peer Group Example XSRconfig#router bgp XSRconfig-router#network 1.0.0.0 mask Configuring BGP Peer Groups Differences with Industry-Standard Approach Configuring PIM-SM and Igmp Defining Multicast Group Addressing IP Multicast Overview Comparing Multicast Distribution Trees Outlining Igmp Versions Forwarding Multicast Traffic Describing the XSR’s IP Multicast Features Sending a Query Group Membership ActionsSending and Receiving Queries and Reports Interoperating with Older Igmp Versions Behavior of Multicast Routers Among Older Version Queriers Describing the XSR’s PIM-SM v2 FeaturesBehavior of Group Members Among Older Version Group Members Phase 2 Building Shortest Path Tree Between Sender & RP Phase 1 Building a Shared Tree Phase 2 Topology Shortest Path Tree Between Sender and RP Neighbor Discovery and DR Election PIM Register Message Bootstrap & Rendezvous PointPIM Join/Prune Message Assert Processing PIM SM over Frame Relay Source-Specific Multicast PIM Configuration Examples PIM Configuration Examples Configuring PIM-SM and Igmp PPP Features Configuring PPP Network Control Protocol NCP Link Control Protocol LCP Password Authentication Protocol PAP AuthenticationChallenge Handshake Authentication Protocol Chap Microsoft Challenge Handshake Protocol MS-CHAP Multilink PPP Mlppp Link Quality Monitoring LQM Multi-Class Mlppp Multilink Header Option Format Multilink Head Format Negotiation Fragment Interleaving Over the Link IP Control Protocol Ipcp Events and AlarmsMulti-Class Option Negotiation Multi-Class Receiving Packet IP Address Assignment PPP Bandwidth Allocation/Control Protocols BAP/BAPC Configuring a Synchronous Serial Interface Configuring PPP with a Dialed Backup LineEnter the media-type for the interface default RS232 Enter encapsulation ppp to enable PPP encapsulation Configuring the Dialer Interface Configuring a Dialed Backup LineConfiguring the Physical Interface for the Dialer Interface Enter no shutdown to enable this interface Configure interface dialer 1 to use dial pool Configuring the Interface as the Backup Dialer Interface Dialer Example Configuring Mlppp on a Multilink/Dialer interfaceMultilink Example XSR1 Configuration Configuring BAPDual XSRs One Router Using DoD with Call Request Configure the dialer list and ACL for DoD XSR2 ConfigurationConfigure the Dialer 1 interface with a dialer pool Dual XSRs BAP Using Call/Callback Request Configuring BAP Configuring BAP Configuring PPP DLCIs Virtual Circuits DCEs DTEs Multi-Protocol Encapsulation Frame Relay Features Dynamic Resolution Using Inverse ARP Address ResolutionControlling Congestion in Frame Relay Networks Rate Enforcement CIR Generic Traffic Shaping Backward Explicit Congestion Notification Becn Discard Eligibility DE BitForward Explicit Congestion Notification Fecn Controlling Congestion in Frame Relay Networks Sub-interfaces Link Management Information LMI End-to-End Fragmentation User Configuration CommandsFRF.12 Fragmentation Map-Class Configuration Reports and AlarmsShow Running Configuration Clear Statistics Minneapolis Houston Memphis Interconnecting via Frame Relay Network Multi-point to Point-to-Point Example Configuring Frame Relay Configuring Frame Relay Configuring Frame Relay Configuring Frame Relay Dial Services Features Overview of Dial Services 25bis over Synchronous Interfaces AT Commands on Asynchronous PortsAsynchronous and Synchronous Support Typical Use for Dial Services Time of Day featureEthernet Backup DTR Dialing for Synchronous Interfaces Dialer Profiles Implementing Dial Services Dialer Strings Dialer InterfaceDialer Pool Addressing Dialer Resources Isdn Callback Configuring Encapsulation Logical View of Dialer Profiles Sample Dialer Topology Dialer Profile of Destination 416 Dialer Profile of Destination 987 Creating and Configuring the Dialer Interface Configuring the Map Class Sample Dialer ConfigurationConfiguring the Physical Interface for the Dialer Interface Configure a backup link for dial purposes with priority Point-to-Point with Matched Calling/Called Numbers Configuring Isdn CallbackPoint-to-Point with Different Calling/Called Numbers Point-to-Multipoint with One Neighbor Dial Backup Features Overview of Dial BackupSequence of Backup Events Backup Link Failure Example Link Failure Backup Example Configure backup serial port for dialing purposes Configuring Interface as the Backup Dialer Interface Dialer Sample ConfigurationConfigure interface dialer 2 to use dial pool Overview of Dial on Demand/Bandwidth on Demand Dialer Watch Dialer Interface Spoofing Dialer Watch Topology Dialer Watch Behavior Caveat Answering Incoming Isdn Calls Incoming Call Mapping Example Node a Calling Node ConfigurationFollowing command maps ACL 101 to dialer group Node D Calling Node Configuration Node B Called Node Configuration Following command maps ACL 1061 to dialer group Configuring DoD/BoD 11 Dial on Demand Topology PPP Point-to-Multipoint Configuration Node a Configuration PPP Multipoint-to-Multipoint Configuration Following command maps ACL 105 to dialer group PPP Point-to-Point ConfigurationsNode B Configuration Dial-out Routing for Dial on Demand Example Following commands configure dialer interfaceDial-in Routing for Dial on Demand Example 13 PPP Point-to-Multipoint Topology PPP Point-to-Multipoint Configurations Dial-in Router Example Dial-out Router Example Following command sets remote user authentication Mlppp Point-to-Multipoint Configuration 14 Mlppp Point-to-Point Topology Mlppp Point-to-Point Configurations Mlppp Point-to-Multipoint Configurations 15 Mlppp Point-to-Multipoint Topology Mlppp Multipoint-to-Multipoint Configuration Bandwidth-on-Demand Switched PPP Multilink Configuration Following command maps ACL 106 to dialer group Node C Called Node Configuration Node a Backed-up Node Configuration Backup ConfigurationBackup Using Isdn XSRconfig#username toronto privilege 0 password cleartext z Following command configures Serial sub-interface 2/01 Configuration for Backup with Mlppp BundleFollowing command configures Serial sub-interface 2/00 Following commands configure Serial sub-interface 2/00 Configuration for Ethernet Failover Configuration for Frame Relay Encapsulation Backup Configuration Configuring Dialer Services Leased line Isdn configuration examples T1 PRI E1 PRI Isdn Features Understanding Isdn BRI FeaturesPRI Features Primary Rate Interface Basic Rate InterfaceChannels Channel Channel Standards Channel Signaling and Carrier NetworksIsdn Equipment Configurations Security Bandwidth Optimization Isdn Trace Call MonitoringTrace Decoding Q921 Decoding Reference Parameters Q931 Decoding Status + Next line 04 Bearer capability Terminal Endpoint Identifier TEI Management Procedures Isdn ConfigurationDecoded IEs BRI NI-1, DMS100 & 5ESS Spid Registration BRI Switched Configuration Model Switched BRI Configuration Model PRI Configuration Model PRI Configuration Model Interface BRI 0/1/21 Leased-Line Configuration Model Following example configures a PRI connection on a T1 card More Configuration ExamplesFollowing example configures a PRI connection on an E1 card Following example configures a switched line BRI connection Isdn ITU Standard Q.931 Call Status Cause Codes Following example configures a leased-line BRI connectionBRI Leased Line BRI Leased PPP Call Status Cause Codes Code Cause Incoming calls barred Configuring Quality of Service Traffic Classification Mechanisms Providing QoS Describing the Policy Map Describing the Class Map Describing Class-Based Weight Fair Queuing Queuing and Services Configuring Priority Queues Configuring CbwfqMeasuring Bandwidth Utilization Describing Priority Queues Assign the class frost to the priority queue Configuring Traffic PolicingDescribing Traffic Policing Class-based Traffic Shaping Traffic Shaping per Policy-Map Traffic Shaping and Queue Limit Differences Between Traffic Policing and Traffic Shaping Describing Random Early Detection Congestion Control & AvoidanceDescribing Queue Size Control Drop Tail RED Drop Probability Calculation Describing Weighted Random Early Detection VPN Configuration per Interface QoS and Link Fragmentation and Interleaving LFI Suggestions for Using QoS on the XSRConfiguring QoS with Mlppp Multi-Class QoS with Vlan Configuring QoS with FRF.12 Vlan Packet with Priority Routed out a Serial Interface Describing Vlan QoS Packet Flow LAN/QoS Serial Scenario QoS with Vlan Configuration Process QoS on VPN QoS on Input Configuring QoS on a Virtual Tunnel Interface QoS over VPN FeaturesConfiguring QoS on a Physical Interface QoS on a Virtual Interface Example Configure the output policy map Ser classes RTP1 and FTP1 Configure the input policy map Vpn classes RTP and FTP Configure the IPSec SA Configure ACLsConfigure the IKE policy foo for pre-share keys Route QoS and VPN Interaction AH Hmac ESP+3DES Configuring the Shaper on the VPN Interface Create the policy map QoS Policy Configuration ExamplesSimple QoS on Physical Interface Policy QoS for Frame Relay Policy Apply the configuration to the interface QoS with Mlppp Multi-Class Policy QoS with FRF.12 Policy Input and Output QoS Policy QoS with Vlan Policy Input QoS on Ingress to the Diffserv Domain Policy QoS Policy Configuration Examples Configuring Adsl PPP over ATM PDU Encapsulation Choices PPP over Ethernet over ATM Routed PPPoA Network Diagram Routed IP over ATM PPPoE Network Diagram NIM Card Adsl LimitationsAdsl Hardware ATM Support Adsl Data FramingAdsl on the Motherboard DSP Firmware Class of Service Access Concentrator RestrictionsDslam Compatibility OAM Cells Inverse ARP Configuration ExamplesQoS PPPoE PPPoA Following optional commands configure two default routesFollowing optional commands configure NAT IPoA Enter the following commands to configure a IPoA topology VPN Overview Internet Security Issues How a Virtual Private Network Works Ensuring VPN Security with IPSec/IKE/GRE Transport Mode Processing GRE over IPSec Tunnel Mode Processing Digital Signatures Describing Public-Key Infrastructure PKIDefining VPN Encryption Machine Certificates for the XSR Certificates Certificate Chains CA Hierarchies Certificate Chain Example RA Mode Enroll Password Pending ModeDF Bit Functionality CRL Retrieval VPN Applications NAT Traversal Site-to-Site NetworksSite-to-Central-Site Networks Internet Client Mode Network Extension Mode NEM Remote Access Networks Configuring Ospf Over Site-to-Central Site in Client Mode Using Ospf Over a VPN NetworkOspf Commands Server ClientServer Client Internet Server Configuring Ospf with Fail Over RedundancyClient Interfaces Fast/GigabitEthernet 1 and VPN Interfaces Fast/GigabitEthernet 1, VPN 1 and VPN XSR VPN FeaturesLimitations Napt Master Encryption Key Generation VPN Configuration Overview Configuring ACLs ACL Configuration Rules SA lifetimes Selecting Policies IKE/IPSec Transform-Sets Security Policy Considerations Configuring Policy Creating Crypto Maps Configuring Crypto Maps User-Name Authentication, Authorization and Accounting Configuration Configuring AAA AAA Commands PKI Configuration Options PKI Certificate Enrollment Example Configuring PKI CA-AUTHENTICATED XSRconfig#ip domain acme.com Interface VPN Options Following sub-commands are available at VPN Interface mode Configuring a Simple VPN Site-to-Site ApplicationVPN Interface Sub-Commands XSRconfig#crypto isakmp proposal Test XSRconfig-crypto-m#description external interface Configuring the VPN Using EZ-IPSec XSRconfig#interface vpn 1 point-to-point EZ-IPSec Configuration XSR with VPN Central Gateway Add ACLs to permit IP and UDP traffic Configure IKE policy for the remote peerConfigure the following four IPSec SAs Add a default route to the next hop Internet gateway Configure and enable the FastEthernet 1 interface Clear the DF bit globally Create a group for NEM and Client mode users Tunnel a XSR-3250 VPN GRE Site-to-Site Tunnel GRE Tunnel for Ospf XSRconfig-isakmp-peer#proposal shared Tunnel B XSR-1805 VPN GRE Site-to-Site Tunnel Enable Ospf on the trusted and VPN interfaces Enable Ospf on the trusted and VPN interfaces XSR/Cisco Site-to-Site Example Cisco Configuration XSR Configuration Scenario 1 Gateway-to-Gateway with Pre-Shared Secrets Interoperability Profile for the XSR Configure IKE Phase 1 policy Configure the Gateway a external LAN network AWConfigure a default route Interoperability Profile for the XSR 14 Gateway-to Gateway with Certificates Topology Scenario 2 Gateway-to-Gateway with Certificates XSR#clock timezone -7 State CA-AUTHENTICATED Overview of Dhcp Configuring Dhcp Dhcp Server Standards How Dhcp Works Assigned Network Configuration Values to Clients Options Dhcp ServicesPersistent Storage of Network Parameters for Clients Temporary or Permanent Network Address Allocation Provisioning Differentiated Network Values by Client Class Bootp Legacy SupportNested Scopes IP Pool Subsets Pool subnet Manual Bindings Scope Caveat Router Option Dhcp Client ServicesParameter Request List Option Dhcp Client Interaction Interaction with Remote Auto Install RAI Dhcp Client Timeouts Dhcp CLI Commands Configuration Steps Dhcp Set Up OverviewConfiguring Dhcp Address Pools Configuring Dhcp Network Configuration Parameters Enable the Dhcp Server Configure Dhcp Network ParametersOptional Set Up a Dhcp Nested Scope Optional Configure a Dhcp Manual Binding Pool with Hybrid Servers Example Dhcp Server Configuration ExamplesManual Binding Example Manual Binding with Class Example Dhcp Option Examples Bootp Client Support Example Access Control Lists Configuring Security on the XSR First alarms logged will display as follows ACL Violations Alarm ExamplePacket Filtering LANd Attack Fraggle Attack Smurf AttackIP Packet with Multicast/Broadcast Source Address Spoofed Address Check Spurious State Transition General Security PrecautionsLarge Icmp Packets Ping of Death Attack AAA Services Connecting Remotely via SSH or Telnet with AAA Service PuTTY Exit Option PuTTY Alert Message Reasons for Installing a Firewall Firewall Feature Set Overview ACL and Packet Filter Firewalls Types of Firewalls ALG and Proxy Firewalls Stateful Inspection Firewalls XSR Firewall Feature Set FunctionalityStateful Firewall Inspection SFI Filtering non-TCP/UDP Packets Application Level Gateway Application Level Commands Importing URL Lists from an Ascii File On Board URL FilteringWriting URL List Entries Enabling URL Filtering in Firewall Policy Configuring URL Redirection Denial of Service DoS Attack Protection Alarms Alarm Logging 12 Authentication Process Authentication Firewall and NAT Dynamic ReconfigurationFirewall and VPN ACLs and Firewall Firewall CLI Commands Firewall CLI Commands 13 Sample Telnet Screen Firewall Limitations Steps to Configure the Firewall Pre-configuring the Firewall XSR with Firewall Log only critical events Complete LAN and WAN interface configuration 15 XSR Firewall with PPPoE DSL and Dhcp XSR with Firewall, PPPoE and Dhcp XSR with Firewall and VPN Configure the Dhcp pool, DNS server and related settings Add four ACLs to permit IP pool, L2TP and NEM traffic XP PC NEM Configure the following IPSec SAs XSRconfig#ip local pool test 10.120.70.0 Define the public VPN interface crypto map Define the Internet as all possible IP addressesDefine three trusted networks in the enterprise Define the local pool network used for tunnel IP addresses Define service for L2TP tunnels Define service for IsakmpDefine service for Radius authentication Define service for Radius accounting Configure Radius network objects Firewall Configuration for VrrpLoad the firewall configuration Configuring Simple Security RPC Policy Configuration Configuration Examples Configuring Security on the XSR Recommended System Limits Alarms/Events, System Limits Standard Ascii Table Snmp views Table A-5 Alarm Behavior System Alarms and Events Driv ETH1 ETH0 Table A-6 High Severity Alarms/Events Table A-7 Medium Severity Alarms/Events Sntp PPP MS-CHAP authentication failed while Shutdown command Portchannel Corrected the problem by resetting itself Table A-9 Firewall and NAT Alarms Firewall and NAT Alarms and Reports NAT TCP reset, NAT port %d, %IPP2 UDP Detected UDP Flood attack %IPP2 Deny Icmp unsupported packet %IP2ICMP UDP Request Entry pool is empty Space Standard Ascii Character Table Standard Ascii Character Table VPN MIB Tables on page B-12 Service Level Reporting MIB TablesEtsysSrvcLvlMetricTable EtsysSrvcLvlHistoryTable EtsysSrvcLvlOwnerTable EtsysSrvcLvlNetMeasureTable Field Example CLI command Rtr schedule aliased to EtsysSrvcLvlAggrMeasureTable BGP v4 Peer Table BGP v4 MIB TablesGeneral Variables Table BgpPeerAdminStatus Bgp4PathAttrIpAddrPrefix BGP-4 Received Path Attribute Table BGP-4 Traps Global Interface Operations Firewall MIB Tables Policy Rule Table Totals Counters Monitoring ObjectsPolicy Rule True Table Session Totals Counters Authenticated Addresses Table Authenticated Address CountersIP Session Counters IP Session Table DOS Attacks Blocked Table VPN MIB TablesDOS Attacks Blocked Counters EtsysVpnIkePeerProposals Table EtsysVpnIkePeer Table EtsysVpnIntfPolicy Table EtsysVpnIkeProposal TableEtsysVpnIpsecPolicy Table EtsysVpnIpsecPolProposals Table EtsysVpnIpsecPolicyRule Table EtsysVpnAhTransform Table EtsysVpnIpsecProposal TableEtsysVpnIpsecPropTransforms Table EtsysVpnIpcompTransform Table EtsysVpnEspTransform Table Host Resources MIB Objects IpCidrRouteTable for Static Routes Field Description ConfigMgmtOperations Enterasys Configuration Management MIB Field Description EtsysConfigChangeNonVolatile Group Enterasys Configuration Change MIB Enterasys Snmp Persistence MIB Field Description EtsysSyslogClient Group Enterasys Syslog Client MIB Table B-46 Enterasys Syslog Client MIB Compliance Statements