Enterasys Networks X-PeditionTM manual XSR with Firewall and VPN

Configuration Examples

XSR(config-if)#ip address negotiated XSR(config-if)#ip mtu 1492 XSR(config-if)#ip nat source assigned overload

XSR(config-if)#ppp pap sent-username b1jsSW23 “password is not displayed” XSR(config-if)#no shutdown

Attach a static route to the PPPoE interface and add a local IP pool:

XSR(config)#ip route 0.0.0.0 0.0.0.0 FastEthernet2.1

XSR(config)#ip local pool myDhcpPool 10.10.10.0 255.255.255.0

Specify network objects including Mgmt and Ten for SSH and DHCP service:

XSR(config)#ip firewall network INT_NETS 10.10.10.0 mask 10.10.10.255 internal XSR(config)#ip firewall network MY_EXT 1.0.0.0 255.255.255.254 external XSR(config)#ip firewall network Mgmt 10.10.10.1 mask 255.255.255.255 internal XSR(config)#Ip firewall network Ten 10.1.0.0 mask 255.255.0.0 internal

Set the policies and filters allowing Web, DNS, FTP, SSL, and ICMP traffic between

ANY_INTERNAL and ANY_EXTERNAL networks. Also write a policy for DHCP and SSH access to the XSR. Be sure to install an SSHv2 client on your connecting PC. Note that policy objects and names are case-sensitive and you must cite network and protocol names exactly:

XSR(config)#ip firewall policy P_intExtHttp ANY_INTERNAL ANY_EXTERNAL WWW allow XSR(config)#ip firewall policy P_intExtDns ANY_INTERNAL ANY_EXTERNAL DNSUDP allow XSR(config)#ip firewall policy P_intExtFtp ANY_INTERNAL ANY_EXTERNAL FTP allow XSR(config)#ip firewall policy P_intExtHttps ANY_INTERNAL ANY_EXTERNAL SSL allow XSR(config)#ip firewall policy adminSSH ANY_INTERNAL Mgmt SSH allow bidirectional XSR(config)#ip firewall policy allowDHCP Ten Ten Bootp allow bidirectional XSR(config)#ip firewall filter F_ECHO_RESP ANY_EXTERNAL ANY_INTERNAL protocol- keyword ICMP 0

XSR(config)#ip firewall filter F_ECHO_REQ ANY_INTERNAL ANY_EXTERNAL protocol- keyword ICMP 8

Trial load the completed configuration into the firewall engine, and if successful, load the configuration:

XSR(config)#ip firewall load trial

XSR(config)#ip firewall load

Configure the DHCP pool, DNS server and related settings:

XSR(config)#ip dhcp pool myDhcpPool

XSR(config)#default-router 10.10.10.1

XSR(config)#dns-server 209.226.175.223

XSR(config)#domain-name BT_basement

XSR(config)#lease 1 3 15

Globally enable the firewall. Even though you have configured and loaded the firewall, only invoking the following command “turns on” the firewall. Once enabled, if you are remotely connected, the firewall will close your session. Simply login again.

XSR(config)#ip firewall enable

XSR with Firewall and VPN

In this scenario, as illustrated in Figure 16-16, a head-end VPN gateway is configured to perform the following:

XSR User’s Guide 16-27