Manuali utente per Black Box LR1112A-T1/E1

Sommario

• Contents

  5
• DHCP Relay

  11
  • 1.1 DHCP Relay

    11
    • 1.1.1 Feature Overview

      11
    • 1.1.2 Functionality

      11
      • 1.1.2.1 BOOTP Requests

        11
      • 1.1.2.2 BOOTP Replies

        12
    • 1.1.3 Using DHCP Relay with NAT

      12
    • 1.1.4 Command Line Interface

      12
      • 1.1.4.1 Enabling DHCP Relay

        12
      • 1.1.4.2 Disabling DHCP Relay

        13
      • 1.1.4.3 Configuring the Gateway Address field when NAT is enabled

        13
    • 1.1.5 Displaying DHCP Configuration

      13
    • 1.1.6 Displaying Statistics

      13
    • 1.1.7 DHCP Limitations

      14
• Configuring Internet Group Management Protocol

  15
  • 2.1 IGMP Configuration

    15
    • 2.1.1 IGMP Commands

      16
    • 2.1.2 IGMP Configuration Examples

      16
      • 2.1.2.1 Example 1

        16
      • 2.1.2.2 Example 2

        16
      • 2.1.2.3 Example 3

        16
      • 2.1.2.4 Example 4

        16
      • 2.1.2.5 Example 5

        17
      • 2.1.2.6 Example 6

        17
      • 2.1.2.7 Example 7

        17
      • 2.1.2.8 Example 8

        17
      • 2.1.2.9 Example 9

        17
      • 2.1.2.10 Example 10

        17
      • 2.1.2.11 Example 11

        17
      • 2.1.2.12 Example 12

        17
      • 2.1.2.13 Example 13

        17
• Filtering IP Traffic

  19
  • 3.1 IP Packet Filter Lists

    19
    • 3.1.1 Example1

      19
      • 3.1.1.1 Configure the Black Box LR1104A.

        19
    • 3.1.2 Example 2

      20
      • 3.1.2.1 Configure the Black Box LR1104A

        20
    • 3.1.3 Example 3

      20
      • 3.1.3.1 Configure the Black Box LR1104A

        20
• Configuring Security

  21
  • 4.1 IPSec Configurations

    21
  • 4.2 Example 1: Managing the Black Box LR1104A Securely Over an IPSec Tunnel

    22
    • Step 10.1: Configure firewall policies to allow IKE negotiation through untrusted interface (appl...

      24
    • Step 10.2: Configure firewall policies to allow desired services through untrusted interface to m...

      24
    • Step 10.3: Display firewall policies in the internet map (applicable only if firewall license is ...

      24
    • Step 10.4: Display firewall policies in the internet map in detail (applicable only if firewall l...

      24
  • 4.3 Example 2: Single Proposal: Tunnel Mode Between Two Black Box Security Gateways

    26
    • Step 8.1: Configure firewall policies to allow IKE negotiation through untrusted interface (appli...

      28
    • Step 8.2: Display firewall policies in the internet map (applicable only if firewall license is e...

      28
    • Step 8.3: Display firewall policies in the internet map in detail (applicable only if firewall li...

      28
    • Step 8.4: Configure firewall policies to allow transit traffic from remote LAN to the local LAN (...

      29
    • Step 8.5: Display firewall policies in the corp map (applicable only if firewall license is enabled)

      29
    • Step 8.6: Display firewall policies in the corp map in detail (applicable only if firewall licens...

      29
  • 4.4 Example 3: Multiple IPSec Proposals: Tunnel Mode Between Two Black Box Security Gateways

    31
  • 4.5 Example 4: IPSec remote access to corporate LAN using user group method

    33
    • Step 1: As in Step1 of Example 1

      33
    • Step 2: As in Step2 of Example 1

      34
    • Step 3: As in Step3 of Example 1

      34
    • Step 4: Configure dynamic IKE policy for a group of mobile users

      34
    • Step 5: Display dynamic IKE policies

      34
    • Step 6: Display dynamic IKE policies in detail

      34
    • Step 7: Configure dynamic IPSec policy for a group of mobile users

      34
    • Step 8: Display dynamic IPSec policies

      35
    • Step 9: Display dynamic IPSec policies in detail

      35
    • Step 10: Configure radius server (applicable only if client authentication is configured in dynam...

      36
    • Step 11: Configure firewall policies to allow IKE negotiation through untrusted interface (applic...

      36
    • Step 12: Display firewall policies in the internet map (applicable only if firewall license is en...

      37
    • Step 13: Display firewall policies in the internet map in detail (applicable only if firewall lic...

      37
    • Step 14: Configure firewall policies for a group of mobile users to allow access to the local LAN...

      37
    • Step 15: Display firewall policies in the corp map (applicable only if firewall license is enabled)

      37
    • Step 16: Display firewall policies in the corp map in detail (applicable only if firewall license...

      38
  • 4.1 Example 5: IPSec remote access to corporate LAN using mode configuration method

    38
    • Step 1: As in Step1 of Example 1

      39
    • Step 2: As in Step2 of Example 1

      39
    • Step 3: As in Step3 of Example 1

      39
    • Step 4: Configure dynamic IKE policy for a group of mobile users

      39
    • Step 5: Display dynamic IKE policies

      39
    • Step 6: Display dynamic IKE policies in detail

      40
    • Step 7: Configure dynamic IPSec policy for a group of mobile users

      40
    • Step 8: Display dynamic IPSec policies

      40
    • Step 9: Display dynamic IPSec policies in detail

      40
    • Step 10: Configure firewall policies to allow IKE negotiation through untrusted interface (applic...

      41
    • Step 11: Display firewall policies in the internet map (applicable only if firewall license is en...

      41
    • Step 12: Display firewall policies in the internet map in detail (applicable only if firewall lic...

      41
    • Step 13: Configure firewall policies for a group of mobile users to allow access to the local LAN...

      42
    • Step 14: Display firewall policies in the corp map (applicable only if firewall license is enabled)

      42
    • Step 15: Display firewall policies in the corp map in detail (applicable only if firewall license...

      42
• IPSec Specifications

  45
  • 5.1 IPSec Appendix

    45
    • 5.1.1 Black Box IKE and IPSec Defaults

      46
      • 5.1.1.1 IKE Defaults

        46
      • 5.1.1.2 IPSec Defaults

        46
• Forwarding IP Traffic

  49
  • 6.1 IP Multiplexing

    49
    • 6.1.1 Packet Forwarding Modes

      49
    • 6.1.2 Proxy ARP and Packet Forwarding

      49
    • 6.1.3 Addressing in IP Multiplexing Networks

      50
    • 6.1.4 Single Subnet

      51
    • 6.1.5 Split Subnet

      51
    • 6.1.6 Secondary Addressing – POP Only

      52
    • 6.1.7 Secondary Addressing – 30 Bit

      52
    • 6.1.8 Secondary Addressing – 29 Bit

      53
    • 6.1.9 Pros and Cons of Different IP Addressing Schemes

      53
    • 6.1.10 Routing Considerations for IP Multiplexing

      53
• IP Multiplexing HDLC Configurations

  55
  • 7.1 Connecting a Black Box Router to a Router/CSU via HDLC

    55
    • 7.1.1 Configure the Black Box LR1104A at Site 2

      56
• IP Multiplexing PPP and MLPPP Configurations

  57
  • 8.1 Configuring Multiple PPP and MLPPP Bundles

    57
    • 8.1.1 Configure the Black Box LR1104A at the Main Site

      59
• Configuring PPP, MLPPP, and HDLC

  61
  • 9.1 Layer Two Configurations: PPP, MLPPP, and HDLC

    61
    • 9.1.1 MLPPP Configuration

      62
      • 9.1.1.1 Configure the Black Box LR1114A System at Site 1

        62
    • 9.1.2 PPP and MLPPP Configuration

      62
      • 9.1.2.1 Configure the Black Box LR1104A System at the Main Site

        62
    • 9.1.3 HDLC Configuration

      62
      • 9.1.3.1 Configure the Black Box LR1104A System at the Main Site

        62
• Configuring Firewalls

  63
  • 10.1 Firewalls

    63
  • 10.2 Firewall Configuration Examples

    64
    • 10.2.1 Basic Firewall Configuration

      64
      • Step 1:Configure the Ethernet interfaces and the WAN interfaces with IP addresses:

        64
      • Step 2: Create the security zones CORP and DMZ and attach interfaces:

        65
      • Step 3: Verify that the interfaces are attached to the security zones:

        65
      • Step 4: Create policies for Security Zone CORP that:

        65
      • Step 5: Verify the firewall policy for Security Zone CORP:

        66
      • Step 6: Verify that the HTTP filter object in Security Zone CORP is created as configured.

        66
      • Step 7: Create policies for Security Zone DMZ that:

        66
      • Step 8:Verify the firewall policy for Security Zone DMZ

        67
      • Step 9: Verify that the FTP filter objects for Security Zone DMZ are created as configured:

        67
      • Step 10: Create a default route out of the WAN

        67
      • Step 11:Verify the system configuration by displaying the running configuration.

        67
    • 10.2.1 Stopping DoS Attacks

      71
    • 10.2.2 Packet Reassembly

      72
  • 10.3 NAT Configurations

    72
  • 10.4 NAT Configuration Examples

    72
    • 10.4.1 Dynamic NAT (many to many)

      73
    • 10.4.2 Static NAT (one to one)

      74
    • 10.4.3 Port Address Translation (Many to one)

      75
      • Method:1 – Specifying NAT address with the policy command

        75
      • Method:2 – Attaching nat pool to the policy

        75
• Multipath Multicast Configurations

  77
  • 11.1 Multipath Multicast

    77
  • 11.2 Multipath Commands

    78
    • 11.2.1 Multipath Examples

      78
• Configuring NAT

  79
  • 12.1 Network Address Translation

    79
    • 12.1.1 Dynamic NAT

      79
    • 12.1.2 Static NAT

      79
    • 12.1.3 Configuration for Figure 1

      80
    • 12.1.4 Configuration for Figure 2

      81
    • 12.1.5 Reverse NAT

      81
    • 12.1.6 Configuration for Figure 3

      82
• NAT Configuration Examples

  83
  • 13.1 NAT Configurations

    83
  • 13.1 NAT Configuration Examples

    83
    • 13.1.1 Dynamic NAT (many to many)

      83
    • 13.1.2 Static NAT (one to one)

      85
    • 13.1.3 Port Address Translation (Many to one)

      86
      • Method:1 – Specifying NAT address with the policy command

        86
      • Method:2 – Attaching nat pool to the policy

        86
• Remote Access VPNs

  87
  • 14.1 Secure Remote Access Using IPSec VPN

    87
  • 14.2 Access Methods

    87
    • 14.2.1 Remote Access: User Group

      87
    • 14.2.2 Remote Access: Mode Configuration

      88
  • 14.3 Configuration Examples

    88
  • 14.4 IPSec Remote Access User Group Method – Single Proposal, Pre-shared Key Authentication

    88
  • 14.5 IPSec Remote Access Mode Configuration Group Method

    90
• Networking with Routing Information Protocol

  93
  • 15.1 Routing Information Protocol

    93
    • 15.1.1 Configuring RIP for Ethernet 0 and WAN 1 Interfaces

      93
    • 15.1.2 Displaying RIP Configuration

      93
    • 15.1.3 Displaying All Configured RIP Interfaces

      93
• Configuring Static Routes

  95
  • 16.1 Static Routing Configuration

    95
    • 16.1.1 Configure the Router at Site “A”

      96
    • 16.1.2 Configure the Router at site “B”

      96
• Configuring Open Shortest Path First Routing

  97
  • 17.1 OSPF Routing Protocol

    97
    • 17.1.1 Configuring the host name

      97
    • 17.1.2 Configuring interface ethernet 0

      97
    • 17.1.3 Configuring interface bundle Dallas

      97
    • 17.1.4 Configuring ospf

      98
    • 17.1.5 Configuring ospf interface parameters

      98
    • 17.1.6 Displaying neighbors

      98
    • 17.1.7 Displaying ospf routes

      98
    • 17.1.8 Displaying IP routes

      98
• Configuring Generic Routing Encapsulation

  99
  • 18.1 Configuring GRE

    99
  • 18.2 Installing Licenses

    99
  • 18.3 GRE Configuration Examples

    100
    • 18.3.1 Configuring Site to Site Tunnel

      101
  • 18.4 Configuring GRE Site to Site with IPSec

    103
  • 18.5 Configuring GRE Site to Site with IPSec and OSPF

    104
• Configuring OSPF and Frame Relay

  105
  • 19.1 OSPF - Frame Relay

    105
    • 19.1.1 Configuring the host name

      106
    • 19.1.2 Configuring interface ethernet 0

      106
    • 19.1.3 Configuring interface bundle Dallas

      106
    • 19.1.4 Configuring OSPF

      106
    • 19.1.5 Configuring interface Dallas parameters

      106
    • 19.1.6 Configuring interface ethernet 0 parameters

      106
    • 19.1.7 Displaying OSPF parameters

      106
• Configuring Protocol Independent Multicasting Routing

  107
  • 20.1 PIM Configuration

    107
    • 20.1.1 PIM Commands

      107
    • 20.1.2 PIM Configuration Examples

      110
• mtrace Configuration

  115
  • 21.1 Multicast Traceroute Facility

    115
    • 21.1.1 mtrace Command

      115
      • 21.1.2 Restrictions

        115
    • 21.1.2 mtrace Example

      116
• Configuring Quality of Service Routing

  117
  • 22.1 Configuring QoS

    117
    • 22.1.1 Features

      117
    • 22.1.2 Definitions

      118
    • 22.1.3 Classification Types

      118
      • 22.1.3.1 Create bundle AppTest

        119
      • 22.1.3.2 Create traffic classes

        119
      • 22.1.3.3 Assign classification types

        119
    • 22.1.4 VLAN Identifiers

      119
      • 22.1.4.1 Create bundle VLANtest

        120
      • 22.1.4.2 Create traffic classes and assign classifications

        120
    • 22.1.5 Bulk Statistics

      120
      • 22.1.5.1 Configuring bulk statistics

        121
• Virtual LAN Tagging

  123
  • 23.1 Managing Traffic with VLAN Tagging

    123
    • 23.1.1 Reston configuration: Black Box LR1104A

      124
      • 23.1.1.1 Configure interface bundle balt1

        124
      • 23.1.1.2 Configure interface balt1 pvc 100

        124
      • 23.1.1.3 Configure interface bundle dc1

        124
      • 23.1.1.4 Configure interface ethernet 0

        124
      • 23.1.1.5 Configure ip routing

        125
    • 23.1.2 DC configuration: Black Box LR1114A

      125
      • 23.1.2.1 Configure interface ethernet 0

        125
      • 23.1.2.2 Configure interface bundle mip

        125
      • 23.1.2.3 Configure ip routing

        125
• Managing Redundant connections

  127
  • 24.1 Trunk Group/Failover

    127
    • 24.1.1 Configuration Details

      127
      • 24.1.1.1 Configure the Black Box LR1114A for Failover Operation

        128
• WAN Interface Configurations

  129
  • 25.1 T1 Interface Configuration

    129
    • 25.1.1 Module Configuration

      129
      • 25.1.1.1 T1

        129
    • 25.1.2 Bundle Configuration

      129
      • 25.1.2.1 Fractional T1

        129
        • 27.1.3 T1

          130
        • 27.1.4 NxT1

          130
• Virtual LAN Forwarding

  131
  • 26.1 Managing VLAN Traffic

    131
    • 26.1.1 POP configuration: Black Box LR1104A

      133
      • 26.1.1.1 Configure mlppp bundle interface

        133
      • 26.1.1.2 Configure interface ethernet 0

        133
      • 26.1.1.3 Configure in-band vlan forwarding table

        133
      • 26.1.1.4 Configure rate limiting for vlans

        133
    • 26.1.2 Bldg1 configuration: Black Box LR1114A

      133
      • 26.1.2.1 Configure interface bundle uplink

        134
      • 26.1.2.2 Configure inband VLAN forwarding table

        134
      • 26.1.2.3 Configure rate limiting for VLANs

        134
      • 26.1.2.4 Configure SNMP

        134
• Mutlilink Frame Relay

  135
  • 27.1 Multilink Frame Relay FRF.15 and FRF.16

    135
    • 27.1.1 Features

      135
      • 27.1.1.1 # Configure Ethernet interface

        136
      • 27.1.1.2 # Configure CVC1

        136
      • 27.1.1.3 # Congfigure CVC2

        136
      • 27.1.1.4 # Configure CVC3

        136
      • 27.1.1.5 #Configure AVC

        136
• Configuring Frame Relay and Multilink Frame Relay

  137
  • 28.1 Layer Two Configurations FR and MFR

    137
    • 28.1.1 FR Configuration

      138
      • 28.1.1.1 Configure the HSSI Bundle at Site 1

        138
      • 28.1.1.2 Configure the Clear Channel Bundle on the LR1104A

        139
    • 28.1.2 MFR Configuration

      139
      • 28.1.2.1 Configure the LR1104A LR1104A at Site 1

        139
      • 28.1.2.2 Configure the LR1104A

        139
      • 28.1.2.3 Configure the LR1104A LR1114A at Site 2

        140
      • 28.1.2.4 Configure the LR1104A

        140