PeditionSecurity Router
Version
Page
Enterasys Networks, Inc Minuteman Road Andover, MA
Regulatory Compliance Information
Federal Communications Commission FCC Notice
Product Safety
Industry Canada Notices
TTE Directive Declaration
Class a ITE Notice Clase A. Aviso de ITE
Electromagnetic Compatibility EMC
Compatibilidad Electromágnetica EMC
Elektro- magnetische Kompatibilität EMC
Vcci Notice
Declaration of Conformity
USA
Approved
Enterasys Networks, Inc Firmware License Agreement
Viii
Page
Page
Contents
Configuring an Interface Displaying Interface Attributes
Configuring IP
Configuring T1/E1 & T3/E3 Interfaces
Managing LAN/WAN Interfaces
How Triggered-on-Demand RIP Works
Configuring the Border Gateway Protocol
Configuration Considerations
Configuring PIM-SM and Igmp
Route Reflectors Confederations
Configuring PPP
Configuring Frame Relay
Configuring Dialer Services
10-13
Configuring Integrated Services Digital Network
Configuring Quality of Service
Configuring Adsl
Configuring the Virtual Private Network
Configuring Dhcp
Configuring Security on the XSR
Appendix B XSR Snmp Proprietary and Associated Standard MIBs
DOS Attacks Blocked Counters DOS Attacks Blocked Table
Contents of the Guide
Preface
Conventions Used in This Guide
Following conventions are used in this guide
Bold/En negrilla
Getting Help
FTP
Overview
Overview
XSR User’s Guide
Overview
Utilizing the Command Line Interface
Connecting via the Console Port on XSR Series
Using the Console Port to Remotely Control the XSR
Connecting a Serial Interface to a Modem
Connecting via SSH
Connecting via Telnet
Terminal Commands
Accessing the Initial Prompt
Synchronizing the Clock
RAI Features and Requirements
Remote Auto Install
Managing the Session
Utilizing the Command Line Interface
How RAI Components Work
RAI Requirements on the XSR
Frame Relay Remote Router
Bootp Client
Reverse DNS Client
Tftp Client
Frame Relay Central Site
Dhcp over LAN RAI over Ethernet
PPP RAI over a Dial-in Line
PPP RAI over a Leased Line
PPP RAI over Adsl
CLI Editing Rules
Setting CLI Configuration Modes
CLI Shortcuts Command Description
CLI Configuration Modes Function Access Method Prompt
Refer to -1for a graphic example of configuration modes
Global Configuration Mode
Exiting From the Current Mode
User Exec Mode
Privileged Exec Mode
Observing Command Syntax and Conventions
Mode Examples
Following example
CLI Command Limits
Describing Ports and Interfaces
Supported Physical Interfaces
Supported Virtual Interfaces
Setting Interface Type and Numbering
Setting Port Configuration Mode
Numbering XSR Slots, Cards, and Ports
Supported Ports
Configuration Examples
T1 Example
T1-PRI Isdn Example
Dialer Example
BRI-Dialer Idsn Example
Following interfaces are added
Entering Commands that Control Tables
Adding Table Entries
Following sub-interfaces are added
You may type
Managing XSR Interfaces
Deleting Table Entries
Modifying Table Entries
Displaying Table Entries
Configuring an Interface
Following command enables an interface
Enabling an Interface
Disabling an Interface
Logging Commands
Performing Fault Management
Managing Message Logs
Fault Report Commands
Capturing Fault Report Data
Using the Real-Time Clock
Managing the System Configuration
RTC Commands
RTC/Network Clock Options
Resetting the Configuration to Factory Default
Using the Default Button XSR 1800/1200 Series Only
Configuration Save Options
Bulk Configuration Management
Using File System Commands
Downloading the Configuration
Creating Alternate Configuration Files
Uploading the Configuration/Crash Report
Full-config Backup
BootRom Upgrade Choices
Pre-upgrade Procedures
Managing the Software Image
Creating Alternate Software Image Files
Using the Bootrom Update Utility
Using TFTP, transfer updateBootrom.fls from the network
Local Bootrom Upgrade
XSR1800 bU bootromuncmp.fls
Using EOS Fallback to Upgrade the Image
Loading Software Images
Configuring EOS Fallback on the CLI
Configuring EOS Fallback via Snmp
Software Image Commands
Configuration Change Hashing
Downloading with Fips Security
Set the operation to imageSetSelected
Displaying System Status and Statistics
Memory Management
Creating Resources
Network Management through Snmp
Shaping Trap Traffic
Snmp Informs
Statistics
Network Monitoring via Service Level Agreement Agent
Alarm Management Traps
Measuring Performance Metrics
Create an Owner
Via CLI
Via Snmp
Create a Measurement to Ping Via CLI
Following command schedules a measurement immediately
Schedule a measurement Via CLI
Full Configuration Backup/Restore
Using the SLA Agent in Snmp
Enterasys Configuration Management MIB
Cabletron CTdownload MIB
Software Image Download using NetSight
Appending CLI Commands to Configuration Files via Snmp
Snmp Download with Auto-Reboot Option
CLI Translator
Accessing the XSR Through the Web
NetSight Atlas Router Services Manager
Firmware Upgrade Procedures
Network Management Tools
Fault Reporting
Using the CLI for Downloads
Using Snmp for Downloads
Auto-discovery
XSR supports the following LAN interface features
LAN Features
Overview of LAN Interfaces
Configuring the LAN
MIB Statistics
XSR supports the following WAN interface features
WAN Features
Overview of WAN Interfaces
Configuring the WAN
Following example configures the XSR to dial-out async
Configuring the WAN Managing LAN/WAN Interfaces
Features
T1/E1 Mode
Overview
T1/E1 Functionality
T3 Mode
E3 Mode
T1/E1 Subsystem Configuration
T3/E3 Subsystem Configuration
D&I NIM does not support channelized mode nor PRI
Drop and Insert Features
T1 Drop & Insert One-to-One DS0 Bypassing
Configuring Channelized T1/E1 Interfaces
Enter the no shutdown command to enable the line
Specify the clock source for the controller
Specify the controllers framing type
Configuring Un-channelized T3/E3 Interfaces
Enable the Controller line
Optionally, if you prefer to configure internal clocking
Enable the Serial line
Troubleshooting T1/E1 & T3/E3 Links
T1/E1 & T3/E3 Physical Layer Troubleshooting
XSRconfig#controller t1 1/0 XSRconfig-controllerT1-1/0#
Receive Alarm Indication Signal AIS Blue Alarm
T1/E1 & T3/E3 Alarm Analysis
Restart the controller
Receive Remote Alarm Indication RAI Yellow Alarm
Transmit Remote Alarm Indication RAI Yellow Alarm
Transmit Sending Remote Alarm Red Alarm
Transmit Alarm Indication Signal AIS Blue Alarm
T1/E1 & T3/E3 Error Events Analysis
XSR
Slip Seconds Counter Increasing
Controller
Framing Loss Seconds Increasing
Configuring the D&I NIM
Line Code Violations Increasing
Page
Configuring IP
General IP Features
Telnet
Secondary IP
Troubleshooting Tools Ping Traceroute IP Routing
RIP
ARP and Proxy ARP
BOOTP/DHCP Relay
Proxy DNS
Directed Broadcast
Broadcast
Local Broadcast
TCP
Telnet
Trivial File Transfer Protocol Tftp
IP Interface
Secondary IP
Interface & Secondary IP
ARP & Secondary IP
Icmp & Secondary IP
Routing Table Manager & Secondary IP
Ospf & Secondary IP
RIP & Secondary IP
Unnumbered Interface & Secondary IP
IP Routing Protocols
Maximum Transmission Unit MTU
Ping
Traceroute
RIPv1
Triggered-on-Demand RIP
How Triggered-on-Demand RIP Works
IP Routing Protocols
Ospf
LSA Type 3 and 5 Summarization
Ospf Database Overflow
Following is a high priority Overflow Entered log report
Ospf Passive Interfaces
Following is a high priority Overflow Exited log report
Null Interface
Ospf Troubleshooting
Route Preference
Static Routes
Vlan Routing
Forwarding VLAN, PPPoE over Vlan
802.1Q Vlan Tag
Vlan Processing Over the XSR’s Ethernet Interfaces
IP Routing Table
Vlan Processing VLAN-enabled Ethernet to WAN Interfaces
Vlan Ethernet to Fast/GigabitEthernet Topology
Policy Based Routing
Accessing the Global Routing Policy Table
QoS with Vlan
Set Clauses
Match Clauses
PBR Cache
Classless Inter-Domain Routing Cidr
Default Network
Router ID
Real Time Protocol RTP Header Compression
Features
Network Address Translation
Virtual Router Redundancy Protocol
Vrrp Definitions
XSR1 XSR2
How the Vrrp Works
Different States of a Vrrp Router
Vrrp Features
Authentication
Multiple Virtual IP Addresses per VR
Multiple VRs Per Router
Load Balancing
ARP Process on a Vrrp Router
Host ARP
Proxy ARP
Icmp Ping
Interface Monitoring
Watch Group Monitoring
Configuration Considerations
Equal-Cost Multi-Path Ecmp
Configuring RIP Examples
Central XSR
Configuring RIP Examples
Configuring Unnumbered IP Serial Interface Example
Configuring Ospf Example
Configuring Static Translation
Configuring NAT Examples
Basic One-to-One Static NAT
Configuring Dynamic Pool Translation
Dynamic Pool Configuration
Register the global NAT pool
Configuring Napt
Enable an interface F1, for example
Network Address and Port Translation
Bind the interface and optional ACL to the NAT pool
Multiple NAT Pools within an Interface
14 Multiple NAT Pools within Interface
Static NAT within an Interface
Inside Outside
15 Static NAT within Interface
Enter the following commands to enable NAT Port Forwarding
Configuring Policy Based Routing Example
NAT Port Forwarding
Router XSRa
Configuring Vrrp Example
Router XSRb
Following example configures a Vlan interface for PPPoE
Configuring Vlan Examples
For a QoS with Vlan example, refer to QoS with Vlan on
Configuring the Border Gateway Protocol
Describing BGP Messages
Open
Update
Defining BGP Path Attributes
Keepalive
Notification
AS Path
Origin
Next Hop
Local Preference
Local Preference Applied to Direct Egress Traffic from AS
Weight
Atomic Aggregate
Aggregator
Multi-Exit Discriminator
Community
Aspath Communities
Application of Community Attribute
BGP Path Selection Process
BGP Routing Policy
Access Control Lists
Filter Lists
Community Lists
Route Maps
Regular Expression Characters
Regular Expressions
Regular Expression Examples
Peer Groups
Creating a Peer Group
Assigning Peer Group Options
Display all routes with any AS path
Initial BGP Configuration
Resetting BGP Connections
For an example, refer to Configuring BGP Neighbors on
Adding BGP Neighbors
Address Aggregation
Synchronization
Route Flap Dampening
Route Refresh
Capability Advertisement
Recommendations for Route Flap Dampening
Scaling BGP
10 Fully Meshed BGP
Route Reflectors
11 Route Reflector Applied to Minimize Ibgp Mesh
Confederations
Displaying System and Network Statistics
12 Use of Confederations to Reduce Ibgp Mesh Sub AS-302
Configuring BGP Route Maps
Configuring BGP Neighbors
BGP Path Filtering by Neighbor Example
Configuring BGP Confederations
BGP Aggregate Route Examples
Configuring BGP Peer Groups
TCP MD5 Authentication for BGP Example
Ibgp Peer Group Example
This section details Ibgp and an Ebgp peer group examples
Ebgp Peer Group Example
BGP Community with Route Maps Examples
XSRconfig#router bgp XSRconfig-router#network 1.0.0.0 mask
Configuring BGP Peer Groups
Configuring PIM-SM and Igmp
Differences with Industry-Standard Approach
IP Multicast Overview
Defining Multicast Group Addressing
Outlining Igmp Versions
Comparing Multicast Distribution Trees
Describing the XSR’s IP Multicast Features
Forwarding Multicast Traffic
Sending and Receiving Queries and Reports
Group Membership Actions
Sending a Query
Interoperating with Older Igmp Versions
Behavior of Group Members Among Older Version Group Members
Describing the XSR’s PIM-SM v2 Features
Behavior of Multicast Routers Among Older Version Queriers
Phase 1 Building a Shared Tree
Phase 2 Building Shortest Path Tree Between Sender & RP
Phase 2 Topology Shortest Path Tree Between Sender and RP
Neighbor Discovery and DR Election
Bootstrap & Rendezvous Point
PIM Register Message
PIM Join/Prune Message
Assert Processing
Source-Specific Multicast
PIM SM over Frame Relay
PIM Configuration Examples
PIM Configuration Examples Configuring PIM-SM and Igmp
Configuring PPP
PPP Features
Link Control Protocol LCP
Network Control Protocol NCP
Authentication
Password Authentication Protocol PAP
Challenge Handshake Authentication Protocol Chap
Microsoft Challenge Handshake Protocol MS-CHAP
Link Quality Monitoring LQM
Multilink PPP Mlppp
Multi-Class Mlppp
Multilink Header Option Format
Fragment Interleaving Over the Link
Multilink Head Format Negotiation
Events and Alarms
IP Control Protocol Ipcp
Multi-Class Option Negotiation
Multi-Class Receiving Packet
PPP Bandwidth Allocation/Control Protocols BAP/BAPC
IP Address Assignment
Configuring PPP with a Dialed Backup Line
Configuring a Synchronous Serial Interface
Enter the media-type for the interface default RS232
Enter encapsulation ppp to enable PPP encapsulation
Configuring a Dialed Backup Line
Configuring the Dialer Interface
Configuring the Physical Interface for the Dialer Interface
Enter no shutdown to enable this interface
Configuring the Interface as the Backup Dialer Interface
Configure interface dialer 1 to use dial pool
Multilink Example
Configuring Mlppp on a Multilink/Dialer interface
Dialer Example
Dual XSRs One Router Using DoD with Call Request
Configuring BAP
XSR1 Configuration
Configure the Dialer 1 interface with a dialer pool
XSR2 Configuration
Configure the dialer list and ACL for DoD
Dual XSRs BAP Using Call/Callback Request
Configuring BAP
Configuring BAP Configuring PPP
Virtual Circuits
DLCIs
DTEs
DCEs
Frame Relay Features
Multi-Protocol Encapsulation
Address Resolution
Dynamic Resolution Using Inverse ARP
Controlling Congestion in Frame Relay Networks
Rate Enforcement CIR Generic Traffic Shaping
Forward Explicit Congestion Notification Fecn
Discard Eligibility DE Bit
Backward Explicit Congestion Notification Becn
Controlling Congestion in Frame Relay Networks
Link Management Information LMI
Sub-interfaces
FRF.12 Fragmentation
User Configuration Commands
End-to-End Fragmentation
Reports and Alarms
Map-Class Configuration
Show Running Configuration
Clear Statistics
Interconnecting via Frame Relay Network
Minneapolis Houston Memphis
Configuring Frame Relay
Multi-point to Point-to-Point Example
Configuring Frame Relay
Configuring Frame Relay
Configuring Frame Relay
Overview of Dial Services
Dial Services Features
Asynchronous and Synchronous Support
AT Commands on Asynchronous Ports
25bis over Synchronous Interfaces
Time of Day feature
Typical Use for Dial Services
Ethernet Backup
DTR Dialing for Synchronous Interfaces
Implementing Dial Services
Dialer Profiles
Dialer Interface
Dialer Strings
Dialer Pool
Addressing Dialer Resources
Configuring Encapsulation
Isdn Callback
Logical View of Dialer Profiles
Sample Dialer Topology
Dialer Profile of Destination 416
Creating and Configuring the Dialer Interface
Dialer Profile of Destination 987
Sample Dialer Configuration
Configuring the Map Class
Configuring the Physical Interface for the Dialer Interface
Configure a backup link for dial purposes with priority
Configuring Isdn Callback
Point-to-Point with Matched Calling/Called Numbers
Point-to-Point with Different Calling/Called Numbers
Point-to-Multipoint with One Neighbor
Sequence of Backup Events
Overview of Dial Backup
Dial Backup Features
Link Failure Backup Example
Backup Link Failure Example
Configuring Interface as the Backup Dialer Interface
Configure backup serial port for dialing purposes
Configure interface dialer 2 to use dial pool
Sample Configuration
Dialer
Overview of Dial on Demand/Bandwidth on Demand
Dialer Interface Spoofing
Dialer Watch
Dialer Watch Behavior
Dialer Watch Topology
Answering Incoming Isdn Calls
Caveat
Following command maps ACL 101 to dialer group
Node a Calling Node Configuration
Incoming Call Mapping Example
Node B Called Node Configuration
Node D Calling Node Configuration
Configuring DoD/BoD
Following command maps ACL 1061 to dialer group
PPP Point-to-Multipoint Configuration
11 Dial on Demand Topology
PPP Multipoint-to-Multipoint Configuration
Node a Configuration
Node B Configuration
PPP Point-to-Point Configurations
Following command maps ACL 105 to dialer group
Dial-in Routing for Dial on Demand Example
Following commands configure dialer interface
Dial-out Routing for Dial on Demand Example
PPP Point-to-Multipoint Configurations
13 PPP Point-to-Multipoint Topology
Dial-out Router Example
Dial-in Router Example
Mlppp Point-to-Multipoint Configuration
Following command sets remote user authentication
Mlppp Point-to-Point Configurations
14 Mlppp Point-to-Point Topology
Mlppp Point-to-Multipoint Configurations
15 Mlppp Point-to-Multipoint Topology
Mlppp Multipoint-to-Multipoint Configuration
Switched PPP Multilink Configuration
Bandwidth-on-Demand
Node C Called Node Configuration
Following command maps ACL 106 to dialer group
Backup Using Isdn
Backup Configuration
Node a Backed-up Node Configuration
XSRconfig#username toronto privilege 0 password cleartext z
Following command configures Serial sub-interface 2/00
Configuration for Backup with Mlppp Bundle
Following command configures Serial sub-interface 2/01
Configuration for Ethernet Failover
Following commands configure Serial sub-interface 2/00
Configuration for Frame Relay Encapsulation
Backup Configuration Configuring Dialer Services
Isdn Features
Leased line Isdn configuration examples T1 PRI E1 PRI
PRI Features
BRI Features
Understanding Isdn
Basic Rate Interface
Primary Rate Interface
Channels
Channel
Isdn Equipment Configurations
Channel Signaling and Carrier Networks
Channel Standards
Bandwidth Optimization
Security
Call Monitoring
Isdn Trace
Trace Decoding
Q921 Decoding
Q931 Decoding
Reference Parameters
+ Next line 04 Bearer capability
Status
Isdn Configuration
Terminal Endpoint Identifier TEI Management Procedures
Decoded IEs
BRI NI-1, DMS100 & 5ESS Spid Registration
BRI Switched Configuration Model
Switched BRI Configuration Model
PRI Configuration Model
PRI Configuration Model
Leased-Line Configuration Model
Interface BRI 0/1/21
More Configuration Examples
Following example configures a PRI connection on a T1 card
Following example configures a PRI connection on an E1 card
Following example configures a switched line BRI connection
Following example configures a leased-line BRI connection
Isdn ITU Standard Q.931 Call Status Cause Codes
BRI Leased Line
BRI Leased PPP
Call Status Cause Codes Code Cause
Incoming calls barred
Configuring Quality of Service
Mechanisms Providing QoS
Traffic Classification
Describing the Class Map
Describing the Policy Map
Queuing and Services
Describing Class-Based Weight Fair Queuing
Configuring Cbwfq
Configuring Priority Queues
Measuring Bandwidth Utilization
Describing Priority Queues
Describing Traffic Policing
Configuring Traffic Policing
Assign the class frost to the priority queue
Class-based Traffic Shaping
Traffic Shaping per Policy-Map
Differences Between Traffic Policing and Traffic Shaping
Traffic Shaping and Queue Limit
Describing Queue Size Control Drop Tail
Congestion Control & Avoidance
Describing Random Early Detection
Describing Weighted Random Early Detection
RED Drop Probability Calculation
Configuration per Interface
VPN
Configuring QoS with Mlppp Multi-Class
Suggestions for Using QoS on the XSR
QoS and Link Fragmentation and Interleaving LFI
Configuring QoS with FRF.12
QoS with Vlan
Describing Vlan QoS Packet Flow
Vlan Packet with Priority Routed out a Serial Interface
QoS with Vlan Configuration Process
LAN/QoS Serial Scenario
QoS on Input
QoS on VPN
Configuring QoS on a Physical Interface
QoS over VPN Features
Configuring QoS on a Virtual Tunnel Interface
QoS on a Virtual Interface Example
Configure the input policy map Vpn classes RTP and FTP
Configure the output policy map Ser classes RTP1 and FTP1
Configure the IKE policy foo for pre-share keys
Configure ACLs
Configure the IPSec SA
QoS and VPN Interaction
Route
Configuring the Shaper on the VPN Interface
AH Hmac ESP+3DES
Simple QoS on Physical Interface Policy
QoS Policy Configuration Examples
Create the policy map
Apply the configuration to the interface
QoS for Frame Relay Policy
QoS with Mlppp Multi-Class Policy
QoS with FRF.12 Policy
QoS with Vlan Policy
Input and Output QoS Policy
Input QoS on Ingress to the Diffserv Domain Policy
QoS Policy Configuration Examples
Configuring Adsl
PDU Encapsulation Choices
PPP over ATM
PPPoA Network Diagram
PPP over Ethernet over ATM Routed
PPPoE Network Diagram
Routed IP over ATM
Adsl Hardware
Adsl Limitations
NIM Card
Adsl Data Framing
ATM Support
Adsl on the Motherboard
DSP Firmware
Access Concentrator Restrictions
Class of Service
Dslam Compatibility
OAM Cells
Configuration Examples
Inverse ARP
QoS
PPPoE
Following optional commands configure NAT
Following optional commands configure two default routes
PPPoA
Enter the following commands to configure a IPoA topology
IPoA
Internet Security Issues
VPN Overview
Ensuring VPN Security with IPSec/IKE/GRE
How a Virtual Private Network Works
Transport Mode Processing
Tunnel Mode Processing
GRE over IPSec
Defining VPN Encryption
Describing Public-Key Infrastructure PKI
Digital Signatures
Certificates
Machine Certificates for the XSR
CA Hierarchies
Certificate Chains
RA Mode
Certificate Chain Example
Pending Mode
Enroll Password
DF Bit Functionality
CRL Retrieval
VPN Applications
Site-to-Central-Site Networks
Site-to-Site Networks
NAT Traversal
Client Mode
Internet
Remote Access Networks
Network Extension Mode NEM
Ospf Commands
Using Ospf Over a VPN Network
Configuring Ospf Over Site-to-Central Site in Client Mode
Server
Client
Server
Internet
Client
Configuring Ospf with Fail Over Redundancy
Server
Client
Interfaces Fast/GigabitEthernet 1 and VPN
Limitations
XSR VPN Features
Interfaces Fast/GigabitEthernet 1, VPN 1 and VPN
Napt
VPN Configuration Overview
Master Encryption Key Generation
ACL Configuration Rules
Configuring ACLs
Selecting Policies IKE/IPSec Transform-Sets
SA lifetimes
Configuring Policy
Security Policy Considerations
Configuring Crypto Maps
Creating Crypto Maps
Authentication, Authorization and Accounting Configuration
User-Name
AAA Commands
Configuring AAA
PKI Configuration Options
Configuring PKI
PKI Certificate Enrollment Example
CA-AUTHENTICATED
XSRconfig#ip domain acme.com
Interface VPN Options
VPN Interface Sub-Commands
Configuring a Simple VPN Site-to-Site Application
Following sub-commands are available at VPN Interface mode
XSRconfig#crypto isakmp proposal Test
Configuring the VPN Using EZ-IPSec
XSRconfig-crypto-m#description external interface
EZ-IPSec Configuration
XSRconfig#interface vpn 1 point-to-point
XSR with VPN Central Gateway
Configure the following four IPSec SAs
Configure IKE policy for the remote peer
Add ACLs to permit IP and UDP traffic
Configure and enable the FastEthernet 1 interface
Add a default route to the next hop Internet gateway
Create a group for NEM and Client mode users
Clear the DF bit globally
GRE Tunnel for Ospf
Tunnel a XSR-3250 VPN GRE Site-to-Site Tunnel
XSRconfig-isakmp-peer#proposal shared
Enable Ospf on the trusted and VPN interfaces
Tunnel B XSR-1805 VPN GRE Site-to-Site Tunnel
Enable Ospf on the trusted and VPN interfaces
Cisco Configuration
XSR/Cisco Site-to-Site Example
XSR Configuration
Interoperability Profile for the XSR
Scenario 1 Gateway-to-Gateway with Pre-Shared Secrets
Configure a default route
Configure the Gateway a external LAN network AW
Configure IKE Phase 1 policy
Interoperability Profile for the XSR
Scenario 2 Gateway-to-Gateway with Certificates
14 Gateway-to Gateway with Certificates Topology
XSR#clock timezone -7
State
CA-AUTHENTICATED
Configuring Dhcp
Overview of Dhcp
How Dhcp Works
Dhcp Server Standards
Dhcp Services
Assigned Network Configuration Values to Clients Options
Persistent Storage of Network Parameters for Clients
Temporary or Permanent Network Address Allocation
Bootp Legacy Support
Provisioning Differentiated Network Values by Client Class
Nested Scopes IP Pool Subsets
Pool subnet
Scope Caveat
Manual Bindings
Dhcp Client Services
Router Option
Parameter Request List Option
Dhcp Client Interaction
Dhcp Client Timeouts
Interaction with Remote Auto Install RAI
Dhcp CLI Commands
Dhcp Set Up Overview
Configuration Steps
Configuring Dhcp Address Pools
Configuring Dhcp Network Configuration Parameters
Configure Dhcp Network Parameters
Enable the Dhcp Server
Optional Set Up a Dhcp Nested Scope
Optional Configure a Dhcp Manual Binding
Dhcp Server Configuration Examples
Pool with Hybrid Servers Example
Manual Binding Example
Manual Binding with Class Example
Bootp Client Support Example
Dhcp Option Examples
Configuring Security on the XSR
Access Control Lists
ACL Violations Alarm Example
First alarms logged will display as follows
Packet Filtering
LANd Attack
Smurf Attack
Fraggle Attack
IP Packet with Multicast/Broadcast Source Address
Spoofed Address Check
General Security Precautions
Spurious State Transition
Large Icmp Packets
Ping of Death Attack
AAA Services
Connecting Remotely via SSH or Telnet with AAA Service
PuTTY Exit Option
PuTTY Alert Message
Firewall Feature Set Overview
Reasons for Installing a Firewall
Types of Firewalls
ACL and Packet Filter Firewalls
ALG and Proxy Firewalls
XSR Firewall Feature Set Functionality
Stateful Inspection Firewalls
Stateful Firewall Inspection SFI
Filtering non-TCP/UDP Packets
Application Level Commands
Application Level Gateway
On Board URL Filtering
Importing URL Lists from an Ascii File
Writing URL List Entries
Enabling URL Filtering in Firewall Policy
Denial of Service DoS Attack Protection
Configuring URL Redirection
Alarm Logging
Alarms
Authentication
12 Authentication Process
Dynamic Reconfiguration
Firewall and NAT
Firewall and VPN
ACLs and Firewall
Firewall CLI Commands
Firewall CLI Commands
13 Sample Telnet Screen
Firewall Limitations
Pre-configuring the Firewall
Steps to Configure the Firewall
XSR with Firewall
Complete LAN and WAN interface configuration
Log only critical events
XSR with Firewall, PPPoE and Dhcp
15 XSR Firewall with PPPoE DSL and Dhcp
Configure the Dhcp pool, DNS server and related settings
XSR with Firewall and VPN
XP PC NEM
Add four ACLs to permit IP pool, L2TP and NEM traffic
Configure the following IPSec SAs
XSRconfig#ip local pool test 10.120.70.0
Define the Internet as all possible IP addresses
Define the public VPN interface crypto map
Define three trusted networks in the enterprise
Define the local pool network used for tunnel IP addresses
Define service for Isakmp
Define service for L2TP tunnels
Define service for Radius authentication
Define service for Radius accounting
Load the firewall configuration
Firewall Configuration for Vrrp
Configure Radius network objects
Configuring Simple Security
RPC Policy Configuration
Configuration Examples Configuring Security on the XSR
Alarms/Events, System Limits Standard Ascii Table
Recommended System Limits
Snmp views
System Alarms and Events
Table A-5 Alarm Behavior
Driv
ETH1
ETH0
Table A-6 High Severity Alarms/Events
Table A-7 Medium Severity Alarms/Events
Sntp
PPP MS-CHAP authentication failed while
Shutdown command
Portchannel
Corrected the problem by resetting itself
Firewall and NAT Alarms and Reports
Table A-9 Firewall and NAT Alarms
NAT TCP reset, NAT port %d, %IPP2
UDP Detected UDP Flood attack %IPP2
Deny Icmp unsupported packet %IP2ICMP
UDP Request Entry pool is empty
Standard Ascii Character Table
Space
Standard Ascii Character Table
EtsysSrvcLvlMetricTable
Service Level Reporting MIB Tables
VPN MIB Tables on page B-12
EtsysSrvcLvlOwnerTable
EtsysSrvcLvlHistoryTable
Field Example CLI command
EtsysSrvcLvlNetMeasureTable
EtsysSrvcLvlAggrMeasureTable
Rtr schedule aliased to
General Variables Table
BGP v4 MIB Tables
BGP v4 Peer Table
BgpPeerAdminStatus
BGP-4 Received Path Attribute Table
Bgp4PathAttrIpAddrPrefix
BGP-4 Traps
Firewall MIB Tables
Global Interface Operations
Monitoring Objects
Policy Rule Table Totals Counters
Policy Rule True Table
Session Totals Counters
Authenticated Address Counters
Authenticated Addresses Table
IP Session Counters
IP Session Table
DOS Attacks Blocked Counters
VPN MIB Tables
DOS Attacks Blocked Table
EtsysVpnIkePeer Table
EtsysVpnIkePeerProposals Table
EtsysVpnIpsecPolicy Table
EtsysVpnIkeProposal Table
EtsysVpnIntfPolicy Table
EtsysVpnIpsecPolicyRule Table
EtsysVpnIpsecPolProposals Table
EtsysVpnIpsecPropTransforms Table
EtsysVpnIpsecProposal Table
EtsysVpnAhTransform Table
EtsysVpnEspTransform Table
EtsysVpnIpcompTransform Table
IpCidrRouteTable for Static Routes
Host Resources MIB Objects
Enterasys Configuration Management MIB
Field Description ConfigMgmtOperations
Enterasys Configuration Change MIB
Field Description EtsysConfigChangeNonVolatile Group
Enterasys Snmp Persistence MIB
Enterasys Syslog Client MIB
Field Description EtsysSyslogClient Group
Table B-46 Enterasys Syslog Client MIB
Compliance Statements