Enterasys Networks X-PeditionTM specs

Interoperability Profile for the XSR

XSR(config)#crypto ipsec transform-set esp-des-md5 esp-des esp-md5-hmac XSR(cfg-crypto-tran)#set pfs group2

XSR(cfg-crypto-tran)#no set security-association life kilo XSR(cfg-crypto-tran)#set security-association life secon 700

XSR(config)#crypto map test 20

XSR(config-crypto-m)#set transform-set esp-des-md5

XSR(config-crypto-m)#match address 120

XSR(config-crypto-m)#set peer 192.168.2.5

XSR(config-crypto-m)#mode tunnel

XSR(config)#interface fastethernet 1

XSR(config-if<F1>)#no shutdown

XSR(config-if<F1>)#ip address 192.168.1.2 255.255.255.0

XSR(config)#interface fastethernet 2

XSR(config-if<F2>)#crypto map test

XSR(config-if<F2>)#no shutdown

XSR(config-if<F2>)#ip address 192.168.2.2 255.255.255.0

XSR(config)#ip route 192.168.3.0 255.255.255.0 192.168.2.5

XSR(config)#ip route 0.0.0.0 0.0.0.0 192.168.2.1

XSR(config)#snmp-server disable

Interoperability Profile for the XSR

Scenario 1: Gateway-to-Gateway with Pre-Shared Secrets

This section describes how to configure the XSR according to the VPN Consortium’s interoperability scenarios (http://www.vpnc.org/). The following is a typical gateway-to- gateway VPN that uses a pre-shared secret for authentication, as illustrated in Figure 14-13.

Figure 14-13 Gateway-to Gateway with Pre-Shared Secrets Topology

10.5.6.0/24	Gateway A	Gateway B	172.23.9.0/24
	Gateway A	Gateway B

Internet

AL	AW	BW	BL
10.5.6.1	14.15.16.17	22.23.24.25	172.23.9.1

Gateway A connects the internal LAN 10.5.6.0/24 to the Internet. Gateway A's LAN interface has the address 10.5.6.1, and its WAN (Internet) interface has the address 14.15.16.17.

Gateway B connects the internal LAN 172.23.9.0/24 to the Internet. Gateway B's WAN (Internet) interface has the address 22.23.24.25. Gateway B's LAN interface address, 172.23.9.1, can be used for testing IPsec but is not needed for configuring Gateway A.

The IKE Phase 1 parameters used in Scenario 1 are:

14-46 Configuring the Virtual Private Network

Image 368

Contents

PeditionSecurity Router VersionPage Enterasys Networks, Inc Minuteman Road Andover, MA Regulatory Compliance Information Federal Communications Commission FCC Notice Product Safety Industry Canada NoticesTTE Directive Declaration Class a ITE Notice Clase A. Aviso de ITE Electromagnetic Compatibility EMC Compatibilidad Electromágnetica EMCElektro- magnetische Kompatibilität EMC Vcci Notice Declaration of Conformity USA Approved Enterasys Networks, Inc Firmware License Agreement Viii Page Page Contents Configuring an Interface Displaying Interface Attributes Managing LAN/WAN Interfaces Configuring T1/E1 & T3/E3 InterfacesConfiguring IP How Triggered-on-Demand RIP Works Configuring the Border Gateway Protocol Configuration Considerations Configuring PIM-SM and Igmp Route Reflectors Confederations Configuring PPP Configuring Frame Relay Configuring Dialer Services 10-13 Configuring Integrated Services Digital Network Configuring Quality of Service Configuring Adsl Configuring the Virtual Private Network Configuring Dhcp Configuring Security on the XSR Appendix B XSR Snmp Proprietary and Associated Standard MIBs DOS Attacks Blocked Counters DOS Attacks Blocked Table Contents of the Guide Preface Conventions Used in This Guide Following conventions are used in this guide Bold/En negrilla Getting Help FTP Overview Overview XSR User’s Guide Overview Utilizing the Command Line Interface Connecting via the Console Port on XSR Series Using the Console Port to Remotely Control the XSR Connecting a Serial Interface to a Modem Terminal Commands Connecting via TelnetConnecting via SSH Accessing the Initial Prompt Synchronizing the Clock Managing the Session Remote Auto InstallRAI Features and Requirements Utilizing the Command Line Interface Frame Relay Remote Router RAI Requirements on the XSRHow RAI Components Work Bootp Client Reverse DNS ClientTftp Client Frame Relay Central Site Dhcp over LAN RAI over Ethernet PPP RAI over Adsl PPP RAI over a Leased LinePPP RAI over a Dial-in Line CLI Editing Rules Setting CLI Configuration Modes CLI Shortcuts Command Description CLI Configuration Modes Function Access Method Prompt Refer to -1for a graphic example of configuration modes Global Configuration Mode Exiting From the Current ModeUser Exec Mode Privileged Exec Mode Following example Mode ExamplesObserving Command Syntax and Conventions CLI Command Limits Describing Ports and InterfacesSupported Physical Interfaces Supported Virtual Interfaces Setting Interface Type and Numbering Setting Port Configuration ModeNumbering XSR Slots, Cards, and Ports Supported Ports Configuration Examples T1 ExampleT1-PRI Isdn Example Dialer Example BRI-Dialer Idsn Example Following interfaces are added Entering Commands that Control Tables Adding Table EntriesFollowing sub-interfaces are added You may type Managing XSR Interfaces Deleting Table EntriesModifying Table Entries Displaying Table Entries Configuring an Interface Following command enables an interfaceEnabling an Interface Disabling an Interface Managing Message Logs Performing Fault ManagementLogging Commands Fault Report Commands Capturing Fault Report Data Using the Real-Time Clock Managing the System ConfigurationRTC Commands RTC/Network Clock Options Resetting the Configuration to Factory Default Using the Default Button XSR 1800/1200 Series Only Configuration Save Options Bulk Configuration ManagementUsing File System Commands Downloading the Configuration Full-config Backup Uploading the Configuration/Crash ReportCreating Alternate Configuration Files BootRom Upgrade Choices Pre-upgrade ProceduresManaging the Software Image Creating Alternate Software Image Files Using the Bootrom Update Utility Using TFTP, transfer updateBootrom.fls from the network Local Bootrom Upgrade XSR1800 bU bootromuncmp.fls Using EOS Fallback to Upgrade the Image Loading Software Images Configuring EOS Fallback on the CLI Configuring EOS Fallback via Snmp Software Image Commands Configuration Change HashingDownloading with Fips Security Set the operation to imageSetSelected Creating Resources Memory ManagementDisplaying System Status and Statistics Network Management through Snmp Statistics Snmp InformsShaping Trap Traffic Measuring Performance Metrics Alarm Management TrapsNetwork Monitoring via Service Level Agreement Agent Create an Owner Via CLIVia Snmp Create a Measurement to Ping Via CLI Following command schedules a measurement immediately Schedule a measurement Via CLI Full Configuration Backup/Restore Using the SLA Agent in SnmpEnterasys Configuration Management MIB Cabletron CTdownload MIB Software Image Download using NetSight Appending CLI Commands to Configuration Files via SnmpSnmp Download with Auto-Reboot Option CLI Translator Accessing the XSR Through the Web NetSight Atlas Router Services ManagerFirmware Upgrade Procedures Network Management Tools Fault Reporting Using the CLI for DownloadsUsing Snmp for Downloads Auto-discovery Overview of LAN Interfaces LAN FeaturesXSR supports the following LAN interface features Configuring the LAN MIB Statistics Overview of WAN Interfaces WAN FeaturesXSR supports the following WAN interface features Configuring the WAN Following example configures the XSR to dial-out async Configuring the WAN Managing LAN/WAN Interfaces Features T1/E1 ModeOverview T1/E1 Functionality T3 Mode E3 Mode T1/E1 Subsystem Configuration T3/E3 Subsystem Configuration T1 Drop & Insert One-to-One DS0 Bypassing Drop and Insert FeaturesD&I NIM does not support channelized mode nor PRI Configuring Channelized T1/E1 Interfaces Enter the no shutdown command to enable the lineSpecify the clock source for the controller Specify the controllers framing type Configuring Un-channelized T3/E3 Interfaces Enable the Controller lineOptionally, if you prefer to configure internal clocking Enable the Serial line Troubleshooting T1/E1 & T3/E3 Links T1/E1 & T3/E3 Physical Layer Troubleshooting XSRconfig#controller t1 1/0 XSRconfig-controllerT1-1/0# Restart the controller T1/E1 & T3/E3 Alarm AnalysisReceive Alarm Indication Signal AIS Blue Alarm Receive Remote Alarm Indication RAI Yellow Alarm Transmit Remote Alarm Indication RAI Yellow AlarmTransmit Sending Remote Alarm Red Alarm Transmit Alarm Indication Signal AIS Blue Alarm T1/E1 & T3/E3 Error Events Analysis XSR Slip Seconds Counter Increasing Controller Line Code Violations Increasing Configuring the D&I NIMFraming Loss Seconds Increasing Page Configuring IP General IP Features Telnet Secondary IP Troubleshooting Tools Ping Traceroute IP Routing RIP Proxy DNS BOOTP/DHCP RelayARP and Proxy ARP Local Broadcast BroadcastDirected Broadcast TCP Telnet Trivial File Transfer Protocol Tftp IP InterfaceSecondary IP Interface & Secondary IP ARP & Secondary IP Icmp & Secondary IP Routing Table Manager & Secondary IP Ospf & Secondary IPRIP & Secondary IP Unnumbered Interface & Secondary IP IP Routing Protocols Maximum Transmission Unit MTUPing Traceroute RIPv1 Triggered-on-Demand RIP How Triggered-on-Demand RIP Works IP Routing Protocols Ospf LSA Type 3 and 5 Summarization Ospf Database Overflow Following is a high priority Overflow Exited log report Ospf Passive InterfacesFollowing is a high priority Overflow Entered log report Route Preference Ospf TroubleshootingNull Interface Static Routes Vlan Routing Forwarding VLAN, PPPoE over Vlan 802.1Q Vlan Tag Vlan Processing Over the XSR’s Ethernet Interfaces IP Routing Table Vlan Processing VLAN-enabled Ethernet to WAN Interfaces Vlan Ethernet to Fast/GigabitEthernet Topology QoS with Vlan Accessing the Global Routing Policy TablePolicy Based Routing PBR Cache Match ClausesSet Clauses Router ID Default NetworkClassless Inter-Domain Routing Cidr Real Time Protocol RTP Header Compression Features Network Address Translation Virtual Router Redundancy Protocol Vrrp Definitions XSR1 XSR2 How the Vrrp Works Different States of a Vrrp Router Vrrp Features AuthenticationMultiple Virtual IP Addresses per VR Multiple VRs Per Router Load Balancing ARP Process on a Vrrp RouterHost ARP Proxy ARP Icmp Ping Interface Monitoring Watch Group Monitoring Configuration Considerations Equal-Cost Multi-Path Ecmp Configuring RIP Examples Central XSR Configuring RIP Examples Configuring Unnumbered IP Serial Interface Example Configuring Ospf Example Basic One-to-One Static NAT Configuring NAT ExamplesConfiguring Static Translation Register the global NAT pool Dynamic Pool ConfigurationConfiguring Dynamic Pool Translation Configuring Napt Enable an interface F1, for exampleNetwork Address and Port Translation Bind the interface and optional ACL to the NAT pool Multiple NAT Pools within an Interface 14 Multiple NAT Pools within Interface Static NAT within an Interface Inside Outside 15 Static NAT within Interface NAT Port Forwarding Configuring Policy Based Routing ExampleEnter the following commands to enable NAT Port Forwarding Router XSRb Configuring Vrrp ExampleRouter XSRa For a QoS with Vlan example, refer to QoS with Vlan on Configuring Vlan ExamplesFollowing example configures a Vlan interface for PPPoE Configuring the Border Gateway Protocol Describing BGP Messages Open Update Defining BGP Path AttributesKeepalive Notification AS Path Origin Next Hop Local Preference Local Preference Applied to Direct Egress Traffic from AS Weight Atomic Aggregate Aggregator Multi-Exit Discriminator Community Aspath Communities Application of Community Attribute BGP Path Selection Process BGP Routing Policy Access Control Lists Filter ListsCommunity Lists Route Maps Regular Expression Examples Regular ExpressionsRegular Expression Characters Peer Groups Creating a Peer GroupAssigning Peer Group Options Display all routes with any AS path Initial BGP Configuration Resetting BGP ConnectionsFor an example, refer to Configuring BGP Neighbors on Adding BGP Neighbors Route Flap Dampening SynchronizationAddress Aggregation Recommendations for Route Flap Dampening Capability AdvertisementRoute Refresh Scaling BGP 10 Fully Meshed BGP Route Reflectors 11 Route Reflector Applied to Minimize Ibgp Mesh Confederations Displaying System and Network Statistics 12 Use of Confederations to Reduce Ibgp Mesh Sub AS-302 Configuring BGP Route Maps Configuring BGP Neighbors BGP Path Filtering by Neighbor Example Configuring BGP Confederations BGP Aggregate Route Examples Configuring BGP Peer Groups TCP MD5 Authentication for BGP ExampleIbgp Peer Group Example This section details Ibgp and an Ebgp peer group examples Ebgp Peer Group Example BGP Community with Route Maps Examples XSRconfig#router bgp XSRconfig-router#network 1.0.0.0 mask Configuring BGP Peer Groups Configuring PIM-SM and Igmp Differences with Industry-Standard Approach IP Multicast Overview Defining Multicast Group Addressing Outlining Igmp Versions Comparing Multicast Distribution Trees Describing the XSR’s IP Multicast Features Forwarding Multicast Traffic Sending a Query Group Membership ActionsSending and Receiving Queries and Reports Interoperating with Older Igmp Versions Behavior of Multicast Routers Among Older Version Queriers Describing the XSR’s PIM-SM v2 FeaturesBehavior of Group Members Among Older Version Group Members Phase 1 Building a Shared Tree Phase 2 Building Shortest Path Tree Between Sender & RP Phase 2 Topology Shortest Path Tree Between Sender and RP Neighbor Discovery and DR Election Bootstrap & Rendezvous Point PIM Register MessagePIM Join/Prune Message Assert Processing Source-Specific Multicast PIM SM over Frame Relay PIM Configuration Examples PIM Configuration Examples Configuring PIM-SM and Igmp Configuring PPP PPP Features Link Control Protocol LCP Network Control Protocol NCP Authentication Password Authentication Protocol PAPChallenge Handshake Authentication Protocol Chap Microsoft Challenge Handshake Protocol MS-CHAP Link Quality Monitoring LQM Multilink PPP Mlppp Multi-Class Mlppp Multilink Header Option Format Fragment Interleaving Over the Link Multilink Head Format Negotiation Events and Alarms IP Control Protocol IpcpMulti-Class Option Negotiation Multi-Class Receiving Packet PPP Bandwidth Allocation/Control Protocols BAP/BAPC IP Address Assignment Configuring PPP with a Dialed Backup Line Configuring a Synchronous Serial InterfaceEnter the media-type for the interface default RS232 Enter encapsulation ppp to enable PPP encapsulation Configuring a Dialed Backup Line Configuring the Dialer InterfaceConfiguring the Physical Interface for the Dialer Interface Enter no shutdown to enable this interface Configuring the Interface as the Backup Dialer Interface Configure interface dialer 1 to use dial pool Dialer Example Configuring Mlppp on a Multilink/Dialer interfaceMultilink Example XSR1 Configuration Configuring BAPDual XSRs One Router Using DoD with Call Request Configure the dialer list and ACL for DoD XSR2 ConfigurationConfigure the Dialer 1 interface with a dialer pool Dual XSRs BAP Using Call/Callback Request Configuring BAP Configuring BAP Configuring PPP Virtual Circuits DLCIs DTEs DCEs Frame Relay Features Multi-Protocol Encapsulation Address Resolution Dynamic Resolution Using Inverse ARPControlling Congestion in Frame Relay Networks Rate Enforcement CIR Generic Traffic Shaping Backward Explicit Congestion Notification Becn Discard Eligibility DE BitForward Explicit Congestion Notification Fecn Controlling Congestion in Frame Relay Networks Link Management Information LMI Sub-interfaces End-to-End Fragmentation User Configuration CommandsFRF.12 Fragmentation Reports and Alarms Map-Class ConfigurationShow Running Configuration Clear Statistics Interconnecting via Frame Relay Network Minneapolis Houston Memphis Configuring Frame Relay Multi-point to Point-to-Point Example Configuring Frame Relay Configuring Frame Relay Configuring Frame Relay Overview of Dial Services Dial Services Features 25bis over Synchronous Interfaces AT Commands on Asynchronous PortsAsynchronous and Synchronous Support Time of Day feature Typical Use for Dial ServicesEthernet Backup DTR Dialing for Synchronous Interfaces Implementing Dial Services Dialer Profiles Dialer Interface Dialer StringsDialer Pool Addressing Dialer Resources Configuring Encapsulation Isdn Callback Logical View of Dialer Profiles Sample Dialer Topology Dialer Profile of Destination 416 Creating and Configuring the Dialer Interface Dialer Profile of Destination 987 Sample Dialer Configuration Configuring the Map ClassConfiguring the Physical Interface for the Dialer Interface Configure a backup link for dial purposes with priority Configuring Isdn Callback Point-to-Point with Matched Calling/Called NumbersPoint-to-Point with Different Calling/Called Numbers Point-to-Multipoint with One Neighbor Dial Backup Features Overview of Dial BackupSequence of Backup Events Link Failure Backup Example Backup Link Failure Example Configuring Interface as the Backup Dialer Interface Configure backup serial port for dialing purposes Dialer Sample ConfigurationConfigure interface dialer 2 to use dial pool Overview of Dial on Demand/Bandwidth on Demand Dialer Interface Spoofing Dialer Watch Dialer Watch Behavior Dialer Watch Topology Answering Incoming Isdn Calls Caveat Incoming Call Mapping Example Node a Calling Node ConfigurationFollowing command maps ACL 101 to dialer group Node B Called Node Configuration Node D Calling Node Configuration Configuring DoD/BoD Following command maps ACL 1061 to dialer group PPP Point-to-Multipoint Configuration 11 Dial on Demand Topology PPP Multipoint-to-Multipoint Configuration Node a Configuration Following command maps ACL 105 to dialer group PPP Point-to-Point ConfigurationsNode B Configuration Dial-out Routing for Dial on Demand Example Following commands configure dialer interfaceDial-in Routing for Dial on Demand Example PPP Point-to-Multipoint Configurations 13 PPP Point-to-Multipoint Topology Dial-out Router Example Dial-in Router Example Mlppp Point-to-Multipoint Configuration Following command sets remote user authentication Mlppp Point-to-Point Configurations 14 Mlppp Point-to-Point Topology Mlppp Point-to-Multipoint Configurations 15 Mlppp Point-to-Multipoint Topology Mlppp Multipoint-to-Multipoint Configuration Switched PPP Multilink Configuration Bandwidth-on-Demand Node C Called Node Configuration Following command maps ACL 106 to dialer group Node a Backed-up Node Configuration Backup ConfigurationBackup Using Isdn XSRconfig#username toronto privilege 0 password cleartext z Following command configures Serial sub-interface 2/01 Configuration for Backup with Mlppp BundleFollowing command configures Serial sub-interface 2/00 Configuration for Ethernet Failover Following commands configure Serial sub-interface 2/00 Configuration for Frame Relay Encapsulation Backup Configuration Configuring Dialer Services Isdn Features Leased line Isdn configuration examples T1 PRI E1 PRI Understanding Isdn BRI FeaturesPRI Features Basic Rate Interface Primary Rate InterfaceChannels Channel Channel Standards Channel Signaling and Carrier NetworksIsdn Equipment Configurations Bandwidth Optimization Security Call Monitoring Isdn TraceTrace Decoding Q921 Decoding Q931 Decoding Reference Parameters + Next line 04 Bearer capability Status Isdn Configuration Terminal Endpoint Identifier TEI Management ProceduresDecoded IEs BRI NI-1, DMS100 & 5ESS Spid Registration BRI Switched Configuration Model Switched BRI Configuration Model PRI Configuration Model PRI Configuration Model Leased-Line Configuration Model Interface BRI 0/1/21 More Configuration Examples Following example configures a PRI connection on a T1 cardFollowing example configures a PRI connection on an E1 card Following example configures a switched line BRI connection Following example configures a leased-line BRI connection Isdn ITU Standard Q.931 Call Status Cause CodesBRI Leased Line BRI Leased PPP Call Status Cause Codes Code Cause Incoming calls barred Configuring Quality of Service Mechanisms Providing QoS Traffic Classification Describing the Class Map Describing the Policy Map Queuing and Services Describing Class-Based Weight Fair Queuing Configuring Cbwfq Configuring Priority QueuesMeasuring Bandwidth Utilization Describing Priority Queues Assign the class frost to the priority queue Configuring Traffic PolicingDescribing Traffic Policing Class-based Traffic Shaping Traffic Shaping per Policy-Map Differences Between Traffic Policing and Traffic Shaping Traffic Shaping and Queue Limit Describing Random Early Detection Congestion Control & AvoidanceDescribing Queue Size Control Drop Tail Describing Weighted Random Early Detection RED Drop Probability Calculation Configuration per Interface VPN QoS and Link Fragmentation and Interleaving LFI Suggestions for Using QoS on the XSRConfiguring QoS with Mlppp Multi-Class Configuring QoS with FRF.12 QoS with Vlan Describing Vlan QoS Packet Flow Vlan Packet with Priority Routed out a Serial Interface QoS with Vlan Configuration Process LAN/QoS Serial Scenario QoS on Input QoS on VPN Configuring QoS on a Virtual Tunnel Interface QoS over VPN FeaturesConfiguring QoS on a Physical Interface QoS on a Virtual Interface Example Configure the input policy map Vpn classes RTP and FTP Configure the output policy map Ser classes RTP1 and FTP1 Configure the IPSec SA Configure ACLsConfigure the IKE policy foo for pre-share keys QoS and VPN Interaction Route Configuring the Shaper on the VPN Interface AH Hmac ESP+3DES Create the policy map QoS Policy Configuration ExamplesSimple QoS on Physical Interface Policy Apply the configuration to the interface QoS for Frame Relay Policy QoS with Mlppp Multi-Class Policy QoS with FRF.12 Policy QoS with Vlan Policy Input and Output QoS Policy Input QoS on Ingress to the Diffserv Domain Policy QoS Policy Configuration Examples Configuring Adsl PDU Encapsulation Choices PPP over ATM PPPoA Network Diagram PPP over Ethernet over ATM Routed PPPoE Network Diagram Routed IP over ATM NIM Card Adsl LimitationsAdsl Hardware Adsl Data Framing ATM SupportAdsl on the Motherboard DSP Firmware Access Concentrator Restrictions Class of ServiceDslam Compatibility OAM Cells Configuration Examples Inverse ARPQoS PPPoE PPPoA Following optional commands configure two default routesFollowing optional commands configure NAT Enter the following commands to configure a IPoA topology IPoA Internet Security Issues VPN Overview Ensuring VPN Security with IPSec/IKE/GRE How a Virtual Private Network Works Transport Mode Processing Tunnel Mode Processing GRE over IPSec Digital Signatures Describing Public-Key Infrastructure PKIDefining VPN Encryption Certificates Machine Certificates for the XSR CA Hierarchies Certificate Chains RA Mode Certificate Chain Example Pending Mode Enroll PasswordDF Bit Functionality CRL Retrieval VPN Applications NAT Traversal Site-to-Site NetworksSite-to-Central-Site Networks Client Mode Internet Remote Access Networks Network Extension Mode NEM Configuring Ospf Over Site-to-Central Site in Client Mode Using Ospf Over a VPN NetworkOspf Commands Server ClientServer Internet Client Configuring Ospf with Fail Over Redundancy ServerClient Interfaces Fast/GigabitEthernet 1 and VPN Interfaces Fast/GigabitEthernet 1, VPN 1 and VPN XSR VPN FeaturesLimitations Napt VPN Configuration Overview Master Encryption Key Generation ACL Configuration Rules Configuring ACLs Selecting Policies IKE/IPSec Transform-Sets SA lifetimes Configuring Policy Security Policy Considerations Configuring Crypto Maps Creating Crypto Maps Authentication, Authorization and Accounting Configuration User-Name AAA Commands Configuring AAA PKI Configuration Options Configuring PKI PKI Certificate Enrollment Example CA-AUTHENTICATED XSRconfig#ip domain acme.com Interface VPN Options Following sub-commands are available at VPN Interface mode Configuring a Simple VPN Site-to-Site ApplicationVPN Interface Sub-Commands XSRconfig#crypto isakmp proposal Test Configuring the VPN Using EZ-IPSec XSRconfig-crypto-m#description external interface EZ-IPSec Configuration XSRconfig#interface vpn 1 point-to-point XSR with VPN Central Gateway Add ACLs to permit IP and UDP traffic Configure IKE policy for the remote peerConfigure the following four IPSec SAs Configure and enable the FastEthernet 1 interface Add a default route to the next hop Internet gateway Create a group for NEM and Client mode users Clear the DF bit globally GRE Tunnel for Ospf Tunnel a XSR-3250 VPN GRE Site-to-Site Tunnel XSRconfig-isakmp-peer#proposal shared Enable Ospf on the trusted and VPN interfaces Tunnel B XSR-1805 VPN GRE Site-to-Site Tunnel Enable Ospf on the trusted and VPN interfaces Cisco Configuration XSR/Cisco Site-to-Site Example XSR Configuration Interoperability Profile for the XSR Scenario 1 Gateway-to-Gateway with Pre-Shared Secrets Configure IKE Phase 1 policy Configure the Gateway a external LAN network AWConfigure a default route Interoperability Profile for the XSR Scenario 2 Gateway-to-Gateway with Certificates 14 Gateway-to Gateway with Certificates Topology XSR#clock timezone -7 State CA-AUTHENTICATED Configuring Dhcp Overview of Dhcp How Dhcp Works Dhcp Server Standards Dhcp Services Assigned Network Configuration Values to Clients OptionsPersistent Storage of Network Parameters for Clients Temporary or Permanent Network Address Allocation Bootp Legacy Support Provisioning Differentiated Network Values by Client ClassNested Scopes IP Pool Subsets Pool subnet Scope Caveat Manual Bindings Dhcp Client Services Router OptionParameter Request List Option Dhcp Client Interaction Dhcp Client Timeouts Interaction with Remote Auto Install RAI Dhcp CLI Commands Dhcp Set Up Overview Configuration StepsConfiguring Dhcp Address Pools Configuring Dhcp Network Configuration Parameters Configure Dhcp Network Parameters Enable the Dhcp ServerOptional Set Up a Dhcp Nested Scope Optional Configure a Dhcp Manual Binding Dhcp Server Configuration Examples Pool with Hybrid Servers ExampleManual Binding Example Manual Binding with Class Example Bootp Client Support Example Dhcp Option Examples Configuring Security on the XSR Access Control Lists ACL Violations Alarm Example First alarms logged will display as followsPacket Filtering LANd Attack Smurf Attack Fraggle AttackIP Packet with Multicast/Broadcast Source Address Spoofed Address Check General Security Precautions Spurious State TransitionLarge Icmp Packets Ping of Death Attack AAA Services Connecting Remotely via SSH or Telnet with AAA Service PuTTY Exit Option PuTTY Alert Message Firewall Feature Set Overview Reasons for Installing a Firewall Types of Firewalls ACL and Packet Filter Firewalls ALG and Proxy Firewalls XSR Firewall Feature Set Functionality Stateful Inspection FirewallsStateful Firewall Inspection SFI Filtering non-TCP/UDP Packets Application Level Commands Application Level Gateway On Board URL Filtering Importing URL Lists from an Ascii FileWriting URL List Entries Enabling URL Filtering in Firewall Policy Denial of Service DoS Attack Protection Configuring URL Redirection Alarm Logging Alarms Authentication 12 Authentication Process Dynamic Reconfiguration Firewall and NATFirewall and VPN ACLs and Firewall Firewall CLI Commands Firewall CLI Commands 13 Sample Telnet Screen Firewall Limitations Pre-configuring the Firewall Steps to Configure the Firewall XSR with Firewall Complete LAN and WAN interface configuration Log only critical events XSR with Firewall, PPPoE and Dhcp 15 XSR Firewall with PPPoE DSL and Dhcp Configure the Dhcp pool, DNS server and related settings XSR with Firewall and VPN XP PC NEM Add four ACLs to permit IP pool, L2TP and NEM traffic Configure the following IPSec SAs XSRconfig#ip local pool test 10.120.70.0 Define the Internet as all possible IP addresses Define the public VPN interface crypto mapDefine three trusted networks in the enterprise Define the local pool network used for tunnel IP addresses Define service for Isakmp Define service for L2TP tunnelsDefine service for Radius authentication Define service for Radius accounting Configure Radius network objects Firewall Configuration for VrrpLoad the firewall configuration Configuring Simple Security RPC Policy Configuration Configuration Examples Configuring Security on the XSR Alarms/Events, System Limits Standard Ascii Table Recommended System Limits Snmp views System Alarms and Events Table A-5 Alarm Behavior Driv ETH1 ETH0 Table A-6 High Severity Alarms/Events Table A-7 Medium Severity Alarms/Events Sntp PPP MS-CHAP authentication failed while Shutdown command Portchannel Corrected the problem by resetting itself Firewall and NAT Alarms and Reports Table A-9 Firewall and NAT Alarms NAT TCP reset, NAT port %d, %IPP2 UDP Detected UDP Flood attack %IPP2 Deny Icmp unsupported packet %IP2ICMP UDP Request Entry pool is empty Standard Ascii Character Table Space Standard Ascii Character Table VPN MIB Tables on page B-12 Service Level Reporting MIB TablesEtsysSrvcLvlMetricTable EtsysSrvcLvlOwnerTable EtsysSrvcLvlHistoryTable Field Example CLI command EtsysSrvcLvlNetMeasureTable EtsysSrvcLvlAggrMeasureTable Rtr schedule aliased to BGP v4 Peer Table BGP v4 MIB TablesGeneral Variables Table BgpPeerAdminStatus BGP-4 Received Path Attribute Table Bgp4PathAttrIpAddrPrefix BGP-4 Traps Firewall MIB Tables Global Interface Operations Monitoring Objects Policy Rule Table Totals CountersPolicy Rule True Table Session Totals Counters Authenticated Address Counters Authenticated Addresses TableIP Session Counters IP Session Table DOS Attacks Blocked Table VPN MIB TablesDOS Attacks Blocked Counters EtsysVpnIkePeer Table EtsysVpnIkePeerProposals Table EtsysVpnIntfPolicy Table EtsysVpnIkeProposal TableEtsysVpnIpsecPolicy Table EtsysVpnIpsecPolicyRule Table EtsysVpnIpsecPolProposals Table EtsysVpnAhTransform Table EtsysVpnIpsecProposal TableEtsysVpnIpsecPropTransforms Table EtsysVpnEspTransform Table EtsysVpnIpcompTransform Table IpCidrRouteTable for Static Routes Host Resources MIB Objects Enterasys Configuration Management MIB Field Description ConfigMgmtOperations Enterasys Configuration Change MIB Field Description EtsysConfigChangeNonVolatile Group Enterasys Snmp Persistence MIB Enterasys Syslog Client MIB Field Description EtsysSyslogClient Group Table B-46 Enterasys Syslog Client MIB Compliance Statements