AIconnect Multi-Purpose, Modular Application Line Card Configuration Guide

Transcription

1 AIconnect Multi-Purpose, Modular Application Line Card Configuration Guide Part Number CF-CON Rev by Kentrox, Inc. All rights reserved.

2 Copyright 2008 by Kentrox, Inc. All Rights Reserved. The material discussed in this publication is the proprietary property of Kentrox, Inc. Kentrox retains all rights to reproduction and distribution of this publication. Kentrox is a registered trademark of Kentrox, Inc. Applied Innovation, Applied Innovation Inc., the AI logo, and other names are the intellectual property of Kentrox. All other product names are trademarks or registered trademarks of their respective owners. Information published here is current as of this document s date of publication, but is subject to change without notice. You may verify product information by contacting our headquarters in Oregon. Kentrox is an Equal Opportunity/Affirmative Action employer. Kentrox, Inc Innovation Dr. Dublin, Ohio USA Toll Free: (800) International: +1 (614) Fax: +1 (614) NW Tanasbourne Dr. Hillsboro, Oregon USA Toll Free: (800) Direct: (503)

3 About this Document This document explains how to install, configure, and operate the AIconnect multi-purpose, modular application line card. You should have a working knowledge of the following: Telecommunications networks, system architecture, and network topology Network devices FTP tools OSPF DHCP Iptables Radius and/or TACACS+ NTP Bootp/DHCP relay VRRP (standby groups) SNMP i

4 AIconnect Configuration Guide About this Document: Document Conventions Document Conventions Table 1 describes the text conventions used in this document. Table 1 Document Conventions Convention Screen Text, Menu Items, System Prompts, Messages and Reports Static Command Text Variable Command Text Meaning This style indicates Kentrox configuration screen text, menu items, system prompts, messages, and reports. In a command statement, this style indicates text that should be entered exactly as shown at a command line. In a command statement, this style indicates user-specified text.... In a command statement, ellipses (...) signify that the preceding parameter can be repeated a number of times. [ ] [ ] In a command statement, square brackets indicate an optional parameter. Two or more parameters in square brackets with a vertical bar ( ) between them indicate a choice of optional parameters. { } In a command statement, two or more parameters in braces with a vertical bar ( ) between them indicate a choice of required parameters. Menus and Menu Commands Dialog Boxes, Tabs, Fields, Check Boxes, and Command Buttons Variable Field Text KEYS Labels This style indicates menu and menu commands. A vertical bar ( ) separates the menus from the submenus or menu commands. The vertical bar also indicates the order in which you should click the menus, submenus, and menu commands. This style indicates dialog boxes, tabs, fields, check boxes, and command buttons. This style indicates variable information you type in a dialog box field. Uppercase body text indicates keys on a keyboard, such as the TAB or ENTER keys. Keys used in combination are connected with a plus symbol (+). This style designates physical components on Kentrox products such as jumpers, switches, and cable connectors. ii

5 AIconnect Configuration Guide About this Document: Document Conventions Table 1 Document Conventions (Continued) Convention Note: Important: Tip: CAUTION: WARNING: LASER DANGER: Meaning Note messages emphasize or supplement important points of the main text. Important messages provide information that is essential to the completion of a task. Tip messages provide information that assists users in operating equipment more effectively. Caution messages indicate that failure to take a specified action could result in loss of data and/or harm to the software or hardware. Warning messages indicate that failure to take a specified action could result in physical harm to the user. Laser danger messages indicate that failure to take a specified action could result in eye damage or blindness to the user due to overexposure to invisible laser radiation. iii

6 AIconnect Configuration Guide About this Document: Customer Assistance Customer Assistance Kentrox offers technical support 24 hours a day, seven days a week. Before you contact Kentrox for assistance, please have the following information available: The type of hardware and software you are using The error number and exact wording of any messages that appeared on your screen What happened and what you were doing when the problem occurred How you tried to solve the problem Web Site Support Support is available 24 hours a day using our Web site at: Support support is available 24 hours a day. When you use support, please be sure to include the details of your problem within the . To contact Technical Support, send to: techsupport@aiinet.com Phone Support Phone support is available. When you call Kentrox for support, please be sure you are at your computer and have the details of your problem available. To contact Technical Support, call (866) Kentrox Product Documentation To order documentation, please contact your sales representative at (800) or +1 (614) You can also access and view the most current versions of Kentrox product documentation on our Web site at: iv

7 Table of Contents Chapter 1: Getting Started Accessing the CLI Using a Local Connection Accessing the CLI Using a Remote Connection Setting Up the User Environment Saving the Configuration Chapter 2: Configuring IP, Clock, and Network Parameters Configuring the IP Settings Configuring the System Clock with NTP Server Settings Configuring the System Clock with a Local Time and Date Configuring Remote Authentication Configuring Bootp/DHCP Relay Configuring SNMP Chapter 3: Configuring Controllers and Interfaces Configuring Bridge Group Controllers Configuring Bridge Group Interfaces Configuring Ethernet Controllers Configuring MAC Security on an Ethernet Controller Configuring Tagged VLAN Ethernet Controllers Configuring Ethernet Interfaces Configuring a Standby Group for an Ethernet Interface Configuring Tagged Virtual LAN Ethernet Interfaces Configuring Serial Controllers Configuring Serial Interfaces Chapter 4: Configuring Static Routes Adding a Static Route to the IP Routing Table Adding the Default Static Route to the IP Routing Table AIconnect Configuration Guide TOC-1

8 Table of Contents Chapter 5: Configuring Iptables Iptables Overview Filter Table NAT Table Mangle Table Configuring AIconnect to Filter Packets Configuring AIconnect with a Firewall Enabling a Telnet Connection Between AIconnect and a Remote Location Enabling an FTP Connection Between AIconnect and a Remote Location Configuring Ping Capabilities to Any Location Masquerading IP Addresses with AIconnect Chapter 6: Configuring Standby Clusters Standby Cluster Overview Configuring Ethernet Interfaces to Failover Simultaneously Chapter 7: Configuring Users in the CLI Adding a New User Changing a User Password Deleting a User Appendix A: Updating the AIconnect Software From the CLI... A-1 Updating the Software...A-2 Appendix B: Backing Up and Restoring the AIconnect Configuration B-1 Backing Up the Configuration...B-2 Restoring the Configuration...B-3 Glossary... Glossary-1 TOC-2 AIconnect Configuration Guide

9 version 2.0x 1 Getting Started This chapter provides information on getting started with AIconnect. It includes step-by-step scenarios on how to access the CLI, set up the user environment, and save the configuration. Guide to this Chapter Accessing the CLI Using a Local Connection Accessing the CLI Using a Remote Connection Setting Up the User Environment Saving the Configuration AIconnect Configuration Guide 1-1

10 Getting Started Accessing the CLI Using a Local Connection Accessing the CLI Using a Local Connection In this scenario, you will complete the following:! Connect to AIconnect locally using the console port! Log into the CLI using the default user name (ai) and password (ai)! (optional) Access help information To access the CLI using a local connection: 1. Use a PC or laptop with terminal emulation software such as HyperTerminal to connect to AIconnect. For information on operating your particular terminal emulation software, refer to the documentation provided with the program. 2. Set up your terminal emulation software to connect using COM port 1 (COM1). 3. Configure COM port 1 with the following parameters:! Bits per second: 9600! Data bits: 8! Parity: None! Stop bits: 1! Flow control: None 4. From within your terminal emulation software, press ENTER to request a login prompt. 5. At the login prompt, enter your user name: ai 6. At the password prompt, enter your password: ai " Notes: Passwords are case-sensitive. " ai is the default user name and password. AIconnect allows you to log in only five times using the default password. On your sixth login, AIconnect will prompt you to change the default password to a new password. 1-2 AIconnect Configuration Guide

11 Getting Started Accessing the CLI Using a Local Connection..... The main CLI prompt appears.. _ / Applied Innovation Inc. _ / _ _ AIconnect AIconnect login: ai Password: You have 4 grace logins remaining using the default user password. (AI) > 7. (optional) Access help information: help or? " Note: For more information on using the CLI, refer to section Using the CLI in the AIconnect Multi-Purpose, Modular Application Line Card Command Reference Guide, part number CG-CON. AIconnect Configuration Guide 1-3

12 Getting Started Accessing the CLI Using a Remote Connection Accessing the CLI Using a Remote Connection In this scenario, you will complete the following:! Connect to AIconnect remotely using either a Telnet or SSH connection! Log into the CLI using the default user name (ai) and password (ai)! (optional) Access help information To access the CLI using either a Telnet or SSH connection: 1. Use a PC or laptop with terminal emulation software to connect to AIconnect. For information on operating your particular terminal emulation software, refer to the documentation provided with the program. 2. Set up your terminal emulation software to connect using either a Telnet or SSH connection. " Notes: Individual procedures for making this connection will vary based on the type of software you are using. " To login to AIconnect via SSH, you must execute command config remote-access ssh-sftp enable. 3. Enter the IP address of the AIconnect to which you want to connect. 4. At the login prompt, enter your user name: ai 5. At the password prompt, enter your password: ai " Notes: Passwords are case-sensitive. " ai is the default user name and password. AIconnect lets you log in only five times using the default password. On your sixth login, AIconnect will prompt you to change the default password to a new password. 1-4 AIconnect Configuration Guide

13 Getting Started Setting Up the User Environment..... Setting Up the User Environment In this scenario, you will complete the following:! Add a user with user name janedoe and password mypassword and assign profile supervisor! Configure the banner with delimiting character #, banner text This is my banner., the current date (\d), and the current time (\t)! Configure interface ethernet 0/1 with IP address and subnet mask ! Configure the host name as DublinCo! Configure the CLI session timeout as 20 minutes! Configure the remote access protocol as telnet-ftp To set up the user environment: 1. At the main prompt, add a user with user name janedoe and password mypassword and assign the supervisor profile: config users add janedoe supervisor mypassword mypassword 2. Configure the banner specifying # as the delimiting character: config banner # The following message appears: Enter the banner text. End the banner with a # character. 3. Configure the banner to display This is my banner.: This is my banner. 4. Configure the banner to display the current date: \d 5. Configure the banner to display the current time: \t 6. Enter the delimiting character to end the banner configuration: # The prompt re-appears. AIconnect Configuration Guide 1-5

14 Getting Started Setting Up the User Environment 7. Configure interface ethernet 0/1 with IP address and subnet mask : config interface ethernet 0/1 ip address " Note: When an interface is configured for the first time, it is automatically enabled. 8. Configure the host name as DublinCo: config hostname DublinCo 9. Configure the CLI session timeout as 20 minutes: config timeout Configure the remote access protocol as telnet-ftp. config remote-access telnet-ftp enable " Note: In this guide, procedures that involve file transfer refer only to the FTP utility. However, an SFTP utility is required if the SSH-SFTP remote access protocol option is enabled. Refer to the remote access configuration commands in the AIconnect Multi-Purpose, Modular Application Line Card Command Reference Guide for information on enabling and disabling remote access protocols. 11. (optional) Verify that the user environment has been set up properly: running-config The command response appears similar to the following: (DublinCo)>running-config # Product: AIconnect # Version: 2.00 # Created: ,11:13:39.0,+0000 # User: ai config banner # This is my banner. \d \t # config hostname DublinCo config interface ethernet 0/1 ip address /16 config timeout 20 config users add janedoe supervisor -e$1$bh9tc8z0$u1spgxo5vhlhuacljb8ra/ -e$1$bh 9tC8Z0$U1sPgxo5vHLHUAcLJB8Ra/ (DublinCo)> 1-6 AIconnect Configuration Guide

15 Getting Started Setting Up the User Environment..... " Notes: The preceding example was obtained using a supervisor profile. Users with a supervisor profile can view the entire configuration; however, users with management and status profiles cannot view configuration information pertaining to users and other sensitive data. " The -e, which precedes the encrypted text, indicates that the password and password confirmation have been encrypted. 12. Save the configuration. (Refer to Saving the Configuration on page 1-8.) AIconnect Configuration Guide 1-7

16 Getting Started Saving the Configuration Saving the Configuration You should save the configuration each time you make a change that you want to keep. If you reset AIconnect without first saving the configuration, any unsaved changes will be lost. In this scenario, you will save the running configuration. To save the configuration, copy the running configuration to the startup configuration: copy running-config startup-config 1-8 AIconnect Configuration Guide

17 2 Configuring IP, Clock, and Network Parameters This chapter provides step-by-step scenarios on how to configure the IP, clock, and network parameters for AIconnect. Guide to this Chapter Configuring the IP Settings Configuring the System Clock with NTP Server Settings Configuring the System Clock with a Local Time and Date Configuring Remote Authentication Configuring Bootp/DHCP Relay Configuring SNMP AIconnect Configuration Guide 2-1

18 Configuring IP, Clock, and Network Parameters Configuring the IP Settings Configuring the IP Settings In this scenario, you will complete the following:! Configure domain name Configure the first DNS server with IP address ! Configure the second DNS server with IP address ! Enable IP forwarding To configure the IP settings: 1. At the main prompt, configure domain name config ip domain-name 2. Configure the first DNS server with IP address : config ip name-server Configure the second DNS server with IP address : config ip name-server Enable IP forwarding: config ip forward 2-2 AIconnect Configuration Guide

19 Configuring IP, Clock, and Network Parameters Configuring the IP Settings (optional) Verify that the IP settings have been configured properly: running-config The command response appears similar to the following display: (DublinCo)>running-config # Product: AIconnect # Version: 2.00 # Created: ,09:52:03.0,+0000 # User: janedoe config banner # This is my banner. \d \t # config hostname DublinCo config ip domain-name config ip forward config ip name-server config ip name-server config timeout 0 config users add janedoe supervisor -e$1$bh9tc8z0$u1spgxo5vhlhuacljb8ra/ -e$1$bh 9tC8Z0$U1sPgxo5vHLHUAcLJB8Ra/ config users add test supervisor -e$1$rzlnnidn$fxmpezmg9gq48rnilaqkl. -e$1$rzlnn IDn$FxmpezmG9GQ48rniLaqkL. (DublinCo)> Tip: You can also use the show ip domain-name, show ip forward, and show ip name-server commands to verify the individual IP configurations. 6. Save the configuration. AIconnect Configuration Guide 2-3

20 Configuring IP, Clock, and Network Parameters Configuring the System Clock with NTP Server Settings Configuring the System Clock with NTP Server Settings In this scenario, you will complete the following:! Configure the first NTP server with IP address ! Configure the second NTP server with IP address and set it as the preferred server! Define the minimum NTP polling interval as 7 (128 seconds) and maximum NTP polling interval as 12 (4096 seconds)! Enable NTP To configure system clock parameters using the common clock time maintained by the AIconnect NTP server: 1. At the main prompt, configure the first NTP server with IP address : config ntp server Tip: The first server configured becomes the preferred server and the second server configured becomes the secondary server, unless indicated otherwise by entering prefer as in step Configure the second NTP server with an IP address of and set it as the preferred server: config ntp server prefer 3. Define the minimum NTP polling interval as 7 (128 seconds) and maximum NTP polling interval as 12 (4096 seconds): config ntp poll-interval 7 12 Tip: The value for the interval is 2 raised to the power of the value entered. 4. Enable NTP on AIconnect: config ntp enable 2-4 AIconnect Configuration Guide

21 Configuring IP, Clock, and Network Parameters Configuring the System Clock with NTP Server Settings Verify that the clock parameters have been configured properly: running-config The command response appears similar to the following: (DublinCo)>running-config # Product: AIconnect # Version: 2.00 # Created: ,10:09:35.0,+0000 # User: janedoe config banner # This is my banner. \d \t # config hostname DublinCo config ip domain-name config ip forward config ip name-server config ip name-server config ntp enable config ntp poll-interval 7 12 config ntp server prefer config ntp server config timeout 0 config users add janedoe supervisor -e$1$bh9tc8z0$u1spgxo5vhlhuacljb8ra/ -e$1$bh 9tC8Z0$U1sPgxo5vHLHUAcLJB8Ra/ config users add test supervisor -e$1$rzlnnidn$fxmpezmg9gq48rnilaqkl. -e$1$rzlnn IDn$FxmpezmG9GQ48rniLaqkL. (DublinCo)> Tip: You can also use the show ntp command to verify the NTP configuration. 6. Save the configuration. AIconnect Configuration Guide 2-5

22 Configuring IP, Clock, and Network Parameters Configuring the System Clock with a Local Time and Date Configuring the System Clock with a Local Time and Date In this scenario, you will complete the following:! Configure the local time as 15:23:50 and the local date as 4/15/2006! Enable daylight savings with EDT as the name! Configure the time zone as EST with an offset of -5:00 Important: You must disable NTP before you can configure the AIconnect system clock locally. 1. At the main prompt, configure the local time as 15:23:50 and the local date as 4/15/2006: config clock local-time 15:23:50 4/15/ Enable daylight savings and assign EDT as the name displayed during daylight savings time: config clock daylight-savings EDT 3. Configure the time zone as EST with an offset of -5:00: config clock timezone EST -5:00 4. Verify that the clock parameters have been configured properly: show clock The command response appears similar to the following display: (DublinCo)>show clock Sat Apr 15 11:24:33 EDT 2006 Uptime 1 days, 16:39 The timezone is named EST and has an offset of -05:00 GMT. Daylight savings time is enabled and is named EDT. (DublinCo)> Tip: In the command response for show clock, the name assigned to indicate that daylight savings is enabled will appear in the timestamp during daylight savings. After daylight savings, the name of the configured time zone will appear in the timestamp. 5. Save the configuration. 2-6 AIconnect Configuration Guide

23 Configuring IP, Clock, and Network Parameters Configuring Remote Authentication..... Configuring Remote Authentication In this scenario, you will complete the following:! Configure the primary RAS server with IP address , port number 100, and secret ohio! Configure the secondary RAS server with IP address , port number 200, and secret dublin! Set the server type as TACACS+ with local fallback enabled To configure remote authentication: 1. At the main prompt, configure a primary RAS server with IP address and port 100: config ras server port Configure secret ohio for the primary RAS server: config ras server secret ohio 3. Configure a secondary RAS server with IP address and port 200: config ras server port Configure secret dublin for the secondary RAS server: config ras server secret dublin 5. Set RAS server type TACACS+ with local fallback enabled: config ras shell tacacs+ fallback 6. (optional) Verify that the remote authentication settings have been configured properly: show ras The command response appears similar to the following display: (DublinCo)>show ras Shell RAS option: TACACS+ with Local Fallback Primary RAS Server: [ohio] Secondary RAS Server: [dublin] (DublinCo)> 7. Save the configuration. AIconnect Configuration Guide 2-7

24 Configuring IP, Clock, and Network Parameters Configuring Bootp/DHCP Relay Configuring Bootp/DHCP Relay In this scenario, you will complete the following:! Configure the bootp/dhcp server with an IP address of This is the bootp/dhcp server to which AIconnect forwards bootp and DHCP packets when bootp/dhcp relay is enabled. A maximum of three bootp/dhcp server(s) can be configured.! Enable bootp/dhcp relay. When bootp/dhcp relay is enabled, AIconnect acts as a bootp/dhcp relay agent; it passes bootp/dhcp configuration information between bootp/dhcp clients and servers. To configure bootp/dhcp relay: 1. Configure the bootp/dhcp server IP address as : config dhcp-relay server Enable bootp/dhcp relay: config dhcp-relay enable 3. (optional) Verify that the remote authentication settings have been configured properly: show dhcp-relay The command response appears similar to the following: (DublinCo)>show dhcp-relay bootp/dhcp relay is enabled bootp/dhcp relay servers: (DublinCo)> 4. Save the configuration. 2-8 AIconnect Configuration Guide

25 Configuring IP, Clock, and Network Parameters Configuring SNMP..... Configuring SNMP " Note: This procedure applies only when an SNMP management system such as AppliedView is used to manage AIconnect. The following management information bases (MIBs) are available for AIconnect:! aisyscfg.mib! aisyscfgconfig.mib! aisystem.mib! aisysteminv.mib! aisystemtftp.mib! airfmonitor.mib To access the available MIBs for AIconnect, go to In this scenario, you will complete the following:! Configure an SNMP version 1 community string named newadministrator and assign read-only access to objects in the MIB! Configure a management station with IP address , port number 162 and community string newadministrator for sending SNMP traps! Enable authentication trap transfer To configure SNMP: 1. At the main prompt, configure an SNMP version 1 community string named newadministrator and assign read-only access to objects in the MIB: config snmp community newadministrator v1 readonly 2. Configure a management station with IP address , port number 162, and community string newadministrator for sending SNMP traps: config snmp host newadministrator 3. Enable the sending of authentication traps: config snmp auth-trap enable 4. (optional) Verify that SNMP has been configured properly: show snmp summary AIconnect Configuration Guide 2-9

26 Configuring IP, Clock, and Network Parameters Configuring SNMP The command response appears similar to the following: (DublinCo)>show snmp summary Authentication traps: enabled Communities: Name Type Mode administrator v1 readwrite newadministrator v1 readonly public v1 readonly Hosts: IP Address Port Type Community v2 newadministrator (DublinCo)> 5. Save the configuration AIconnect Configuration Guide

27 3 Configuring Controllers and Interfaces This chapter provides step-by-step scenarios on how to configure AIconnect controllers and interfaces. Guide to this Chapter Configuring Bridge Group Controllers Configuring Bridge Group Interfaces Configuring Ethernet Controllers Configuring MAC Security on an Ethernet Controller Configuring Tagged VLAN Ethernet Controllers Configuring Ethernet Interfaces Configuring a Standby Group for an Ethernet Interface Configuring Tagged Virtual LAN Ethernet Interfaces Configuring Serial Controllers Configuring Serial Interfaces AIconnect Configuration Guide 3-1

28 Configuring Controllers and Interfaces Configuring Bridge Group Controllers Configuring Bridge Group Controllers In this scenario, you will complete the following:! Add bridge group controller bg1 and configure the description as Bridge Group 1! Add bridge group controller bg2 and configure the description as Bridge Group 2 To configure bridge group controllers: 1. At the main prompt, add controller bridge bg1 and configure the description as Bridge Group Controller 1: config controller bridge bg1 description Bridge Group Controller 1 2. Add controller bridge bg2 and configure the description as Bridge Group Controller 2: config controller bridge bg2 description Bridge Group Controller 2 3. (optional) Verify that controllers bg1 and bg2 have been configured properly: show controllers bridge The command response appears similar to the following example: (DublinCo)>show controllers bridge bridge bg1 system-name=br0 status=enabled oper-state=up stp=enabled forward-delay=15 hello-time=2 max-age=20 priority=32768 stp_root_bridge description=bridge Group Controller 1 bridge bg2 system-name=br1 status=enabled oper-state=up stp=enabled forward-delay=15 hello-time=2 max-age=20 priority=32768 stp_root_bridge description=bridge Group Controller 2 (DublinCo)> 4. Save the configuration. 3-2 AIconnect Configuration Guide

29 Configuring Controllers and Interfaces Configuring Bridge Group Interfaces..... Configuring Bridge Group Interfaces In this scenario, you will complete the following:! Add bridge group interface bridge bg1 and configure the interface description as Bridge Group Interface 1! Configure the interface IP address as and the subnet mask length as 24 To configure an bridge group interface: 1. At the main prompt, add interface bridge bg1 and configure the interface description as Bridge Group Interface 1: config interface bridge bg1 description Bridge Group Interface 1 " Note: When an interface is configured for the first time, it is automatically enabled. 2. Configure the interface IP address as and subnet mask length as 24: config interface bridge bg1 ip address /24 3. (optional) Verify that interface bridge bg1 has been configured properly: show interfaces bridge bg1 The command response appears similar to the following example: (DublinCo)>show interfaces bridge bg1 bridge bg1 system-name=br_bg1 status=enabled link-state=up desc=bridge Group Interface 1 address= /24 Stats: Bytes Packets Errors Dropped Overrun Framing Rx Tx (DublinCo)> 4. Save the configuration. AIconnect Configuration Guide 3-3

30 Configuring Controllers and Interfaces Configuring Ethernet Controllers Configuring Ethernet Controllers In this scenario, you will add controller ethernet 0/2 and configure the controller description as Ethernet Controller 2. To configure an Ethernet controller: 1. At the main prompt, add controller ethernet 0/2 and configure the description as Ethernet Controller 2: config controller ethernet 0/2 description Ethernet Controller 2 2. (optional) Verify that controller ethernet 0/2 has been configured properly: show controllers ethernet 0/2 The command response appears similar to the following example: (DublinCo)>show controllers ethernet 0/2 ethernet 0/2 system-name=eth0_2 status=enabled link-state=down admin-speed=auto oper-speed=10h hardware-address=00:40:72:01:62:17 default-address=00:40:72:01:62:17 proxy-arp=disabled desc=ethernet Controller 2 mac-security admin-state=disabled oper-state=disabled (DublinCo)> 3. Save the configuration. 3-4 AIconnect Configuration Guide

31 Configuring Controllers and Interfaces Configuring MAC Security on an Ethernet Controller..... Configuring MAC Security on an Ethernet Controller In this scenario, you will complete the following:! Configure AIconnect to listen to traffic on controller ethernet 0/2, capture MAC addresses learned on the controller for 30 seconds, and add captured addresses to the controller s MAC address table! Manually add MAC address 00:e0:52:cc:0b:00 to the MAC address table for the controller! Enable MAC security on the controller To configure MAC security on an Ethernet controller: 1. Capture MAC addresses for 30 seconds and add addresses to the controller s MAC address table: config controller ethernet 0/2 mac-security capture time Manually add MAC address 00:e0:52:cc:0b:00 to the controller s MAC address table: config controller ethernet 0/2 mac-security address 00:e0:52:cc:0b:00 3. Enable MAC security: config controller ethernet 0/2 mac-security enable 4. (optional) Verify that MAC security has been configured properly: show controllers ethernet 0/2 The command response appears similar to the following: (DublinCo)>show controllers ethernet 0/2 ethernet 0/2 system-name=eth0_2 status=enabled link-state=down admin-speed=auto oper-speed=10h hardware-address=00:40:72:01:62:17 default-address=00:40:72:01:62:17 proxy-arp=disabled desc=ethernet Controller 2 mac-security admin-state=enabled oper-state=disabled address=00:e0:52:cc:0b:00 5. Save the configuration. AIconnect Configuration Guide 3-5

32 Configuring Controllers and Interfaces Configuring Tagged VLAN Ethernet Controllers Configuring Tagged VLAN Ethernet Controllers In this scenario, you will complete the following:! Add controller ethernet 0/2 with tagged virtual LAN (VLAN) identifier 2188 and configure the description as Tagged VLAN Controller 1! Add controller ethernet 0/3 with tagged VLAN identifier 1592 and configure the description as Tagged VLAN Controller 2 To configure a tagged VLAN Ethernet controller: 1. At the main prompt, add controller ethernet 0/2 with tagged VLAN identifier 2188 and description Tagged VLAN Controller 1: config controller ethernet 0/2 tagged-vlan 2188 description Tagged VLAN Controller 1 2. Add controller ethernet 0/3 with tagged VLAN identifier 1592 and description Tagged VLAN Controller 2: config controller ethernet 0/3 tagged-vlan 1592 description Tagged VLAN Controller 2 3. (optional) Verify that tagged VLAN controllers on ethernet 0/2 and ethernet 0/3 have been configured properly: show controllers The command response for controllers ethernet 0/2 and 0/3 appears similar to the following: ethernet 0/2 system-name=eth0_2 status=enabled link-state=down admin-speed=auto oper-speed=10h hardware-address=00:40:72:01:62:17 default-address=00:40:72:01:62:17 proxy-arp=disabled desc=ethernet Controller 2 mac-security admin-state=disabled oper-state=disabled tagged-vlan=2188 system-name= status=enabled link-state=down proxy-arp=disabled desc=tagged VLAN Controller 1 ethernet 0/3 system-name=eth0_3 status=enabled link-state=down admin-speed=auto oper-speed=10h hardware-address=00:40:72:01:62:18 default-address=00:40:72:01:62:18 proxy-arp=disabled mac-security admin-state=disabled oper-state=disabled tagged-vlan=1592 system-name= status=enabled link-state=down proxy-arp=disabled desc=tagged VLAN Controller 2 4. Save the configuration. 3-6 AIconnect Configuration Guide

33 Configuring Controllers and Interfaces Configuring Ethernet Interfaces..... Configuring Ethernet Interfaces In this scenario, you will complete the following:! Add interface ethernet 0/2 and configure the interface description as E0/2! Configure the primary interface IP address as and the primary subnet mask as ! Configure the secondary interface IP address as and secondary subnet mask length as 24! Add interface ethernet 0/3 and configure the interface description as E0/3! Configure the primary interface IP address as and primary subnet mask as To configure the Ethernet interfaces: 1. At the main prompt, add interface ethernet 0/2 and configure the interface description as E0/2: config interface ethernet 0/2 description E0/2 " Note: When an interface is configured for the first time, it is automatically enabled. 2. Configure the primary interface IP address as and primary subnet mask as : config interface ethernet 0/2 ip address Configure the secondary interface IP address as and secondary subnet mask length as 24: config interface ethernet 0/2 ip address /24 secondary 4. Add interface ethernet 0/3 and configure the interface description as E0/3: config interface ethernet 0/3 description E0/3 5. Configure the primary interface IP address as and primary subnet mask as : config interface ethernet 0/3 ip address AIconnect Configuration Guide 3-7

34 Configuring Controllers and Interfaces Configuring Ethernet Interfaces 6. (optional) Verify that interfaces ethernet 0/2 and ethernet 0/3 have been configured properly: show interfaces The command response appears similar to the following example: (DublinCo)>show interfaces bridge bg1 system-name=br_bg1 status=enabled link-state=up desc=bridge Group Interface 1 address= /24 ethernet 0/1 system-name=eth0_1 status=enabled link-state=up address= /16 ethernet 0/2 system-name=eth0_2 status=enabled link-state=down desc=e0/2 address= /24 secondary-address= /24 ethernet 0/3 system-name=eth0_3 status=enabled link-state=down desc=e0/3 address= /24 (DublinCo)> 7. Save the configuration. 3-8 AIconnect Configuration Guide

35 Configuring Controllers and Interfaces Configuring a Standby Group for an Ethernet Interface..... Configuring a Standby Group for an Ethernet Interface In this scenario, you will complete the following:! Add standby group 2 for interface ethernet 0/2! Configure the delay interval as 5 seconds for the standby group! Configure virtual router IP address for the standby group! Configure priority level 200 for interface ethernet 0/2 within the standby group! Enable the standby group To configure a standby group for an Ethernet interface: 1. Add standby group 2 for interface ethernet 0/2: config interface ethernet 0/2 standby 2 2. Configure the delay interval as 5 seconds: config interface ethernet 0/2 standby 2 delay 5 3. Configure virtual router IP address : config interface ethernet 0/2 standby 2 ip-address Configure priority level 200 for interface ethernet 0/2: config interface ethernet 0/2 standby 2 priority Enable the standby group: config interface ethernet 0/2 standby 2 enable 6. (optional) Verify that the standby group has been configured properly: show standby group 2 The command response appears similar to the following: (DublinCo)>show standby group 2 Standby group: 2 Status: enabled IP address: Priority: 200 Delay: 5 Interface: ethernet 0/2 (DublinCo)> 7. Save the configuration. AIconnect Configuration Guide 3-9

36 Configuring Controllers and Interfaces Configuring Tagged Virtual LAN Ethernet Interfaces Configuring Tagged Virtual LAN Ethernet Interfaces In this scenario, you will complete the following:! Add tagged virtual LAN (VLAN) interface ethernet 0/2 with VLAN identifier 2188! Configure interface IP address and subnet mask ! Configure the tagged VLAN interface description as ET0/2! Configure a secondary IP address as /24 To configure a tagged-vlan Ethernet interface: 1. At the main prompt, add tagged-vlan interface ethernet 0/2 with VLAN identifier 2188 and configure interface IP address and subnet mask : config interface ethernet 0/2 tagged-vlan 2188 ip address " Note: When an interface is configured for the first time, it is automatically enabled. 2. Configure the interface description as ET0/2: config interface ethernet 0/2 tagged-vlan 2188 description ET0/2 3. Configure the secondary interface IP address as /24: config interface ethernet 0/2 tagged-vlan 2188 ip address /24 secondary 3-10 AIconnect Configuration Guide

37 Configuring Controllers and Interfaces Configuring Tagged Virtual LAN Ethernet Interfaces (optional) Verify that tagged-vlan interface ethernet 0/2 has been configured properly: show interfaces ethernet 0/2 The command response appears similar to the following: (DublinCo)>show interfaces ethernet 0/2 ethernet 0/2 system-name=eth0_2 status=enabled link-state=down desc=e0/2 address= /24 secondary-address= /24 Stats: Bytes Packets Errors Dropped Overrun Framing Rx Tx ethernet 0/2 tagged-vlan 2188 system-name= status=enabled link-state=down desc=et0/2 address= /16 secondary-address= /24 Stats: Bytes Packets Errors Dropped Overrun Framing Rx Tx (DublinCo)> 5. Save the configuration. AIconnect Configuration Guide 3-11

38 Configuring Controllers and Interfaces Configuring Serial Controllers Configuring Serial Controllers In this scenario, you will complete the following:! Add controller serial 1/3 and configure a line buildout of -7.5db for the controller! Configure the controller description as Serial Controller 3! Add channel group ds0group1 for the controller and configure the channel group to use the PPP encapsulation protocol To configure a serial controller: 1. At the main prompt, add controller serial 1/3 and configure the line buildout as -7.5db: config controller serial 1/3 buildout -7.5db 2. Configure the description as Serial Controller 3: config controller serial 1/3 description Serial Controller 3 3. Add channel group ds0group1 and configure PPP as the encapsulation protocol: config controller serial 1/3 channel-group ds0group1 encapsulation ppp 3-12 AIconnect Configuration Guide

39 Configuring Controllers and Interfaces Configuring Serial Controllers (optional) Verify that controller serial 1/3 has been configured properly: show controllers serial 1/3 The command response appears similar to the following example: (DublinCo)>show controllers serial 1/3 serial 1/3 status=enabled rx-link-state=los tx-link-state=ais local-loop=norm remote-loop=norm buildout=-7.5db clock=loop framing=esf linecode=b8zs framer-crc-errors=0 framing-errors=0 line-coding-violations=0 severely-errored-framing-events=0 (DublinCo)> total-seconds=89004 available-seconds=0 unavailable-seconds=89004 total-errored-seconds=89004 total-severely-errored-seconds=89004 total-background-block-errors=0 available-errored-seconds=0 available-severely-errored-seconds=0 available-background-block-errors=0 errored-seconds-ratio=.00 severely-errored-seconds-ratio=.000 background-block-errors-ratio=.0000 desc=serial Controller 3 channel-group=ds0group1 status=enabled system-name=ser1_3_0 link-state=down speed=64 encap=ppp timeslot=1-24 ppp defaultroute=false local-method=none local-identity= remote-method=none remote-identity= mru=1520 mtu= Save the configuration. AIconnect Configuration Guide 3-13

40 Configuring Controllers and Interfaces Configuring Serial Interfaces Configuring Serial Interfaces In this scenario, you will complete the follow:! Add interface serial 1/3 channel group ds0group1 and configure the interface description as S1/3! Configure the interface IP address as and the peer IP address as To configure a serial interface: 1. At the main prompt, add interface serial 1/3 channel-group ds0group1 and configure the interface description as S1/3: config interface serial 1/3 channel-group ds0group1 description S1/3 " Note: When an interface is configured for the first time, it is automatically enabled. 2. Configure the interface IP address as and the primary peer IP address as : config interface serial 1/3 channel-group ds0group1 ip address pointopoint (optional) Verify that interface serial 1/3 has been configured properly: show interfaces serial 1/3 The command response appears similar to the following appears: (DublinCo)>show interfaces serial 1/3 serial 1/3 ds0group1 channel-group=ds0group1 system-name= status=enabled link-state=down desc=s1/3 address= pointopoint= Stats: Bytes Packets Errors Dropped Overrun Framing Rx Tx (DublinCo)> 4. Save the configuration AIconnect Configuration Guide

41 4 Configuring Static Routes This chapter provides step-by-step scenarios on how to configure static routes in the IP routing table. Guide to this Chapter Adding a Static Route to the IP Routing Table Adding the Default Static Route to the IP Routing Table AIconnect Configuration Guide 4-1

42 Configuring Static Routes Adding a Static Route to the IP Routing Table Adding a Static Route to the IP Routing Table In this scenario, you will add a static route with destination address , subnet mask length 16, and gateway address to the IP routing table. To add a static route to the IP routing table: 1. At the main prompt, add a static route with destination address , subnet mask length 16, and gateway address : config ip route / (optional) Verify that the static route has been added properly: show ip route The command response appears similar to the following: (DublinCo)>show ip route Destination Gateway Interface Flags / ethernet 0/1 Up / ethernet 0/2 Up / ethernet 0/2 Up / ser1_3_0 Host Up / * Reject Up / lo Host Up / ethernet 0/1 Up (DublinCo)> 3. Save the configuration. 4-2 AIconnect Configuration Guide

43 Configuring Static Routes Adding the Default Static Route to the IP Routing Table..... Adding the Default Static Route to the IP Routing Table In this scenario, you will add the default static route with gateway address to the IP routing table. To add the default static route to the IP routing table: 1. At the main prompt, add the default static route with gateway address : config ip route default (optional) Verify that the default static route has been added properly: show ip route The command response appears similar to the following: (DublinCo)>show ip route Destination Gateway Interface Flags / ethernet 0/1 Up / ethernet 0/1 Up / ethernet 0/2 Up / ethernet 0/2 Up / ser1_3_0 Host Up / * Reject Up / lo Host Up / ethernet 0/1 Up (DublinCo)> 3. Save the configuration. AIconnect Configuration Guide 4-3

44 Configuring Static Routes Adding the Default Static Route to the IP Routing Table 4-4 AIconnect Configuration Guide

45 AIconnect 5 Configuring Iptables This chapter provides information on the organization and implementation of iptables in AIconnect. Guide to this Chapter Iptables Overview Configuring AIconnect to Filter Packets Configuring AIconnect with a Firewall Enabling a Telnet Connection Between AIconnect and a Remote Location Enabling an FTP Connection Between AIconnect and a Remote Location Configuring Ping Capabilities to Any Location Masquerading IP Addresses with AIconnect AIconnect Configuration Guide 5-1

46 Configuring Iptables Iptables Overview Iptables Overview Iptables are used to set up, maintain, and inspect IP packet filter rules in the Linux kernel. Each table contains several built-in chains and may also accept user-defined chains. The following three independent iptables are available:! Filter Table! NAT Table! Mangle Table Filter Table This IP table is intended for simple filtering. It is the default IP table. The following built in chains are included:! INPUT Used to alter incoming packets.! FORWARD Used to alter packets that are being routed through AIconnect.! OUTPUT Used to alter packets generated by AIconnect before routing. NAT Table This table is consulted when a packet that creates a new connection is encountered. The following built in chains are included:! PREROUTING Used to alter incoming packets before routing.! OUTPUT Used to alter locally-generated packets before routing.! POSTROUTING Used to alter packets as they are about to be sent out from AIconnect. Mangle Table This packet is used for specialized packet alteration. The following built in chains are included:! PREROUTING Used to alter incoming packets before routing.! OUTPUT Used to alter packets generated by AIconnect before routing.! INPUT Used to alter incoming packets.! FORWARD Used to alter packets that are being routed through AIconnect.! POSTROUTING Used to alter packets as they are about to be sent out from AIconnect. 5-2 AIconnect Configuration Guide

47 Configuring Iptables Configuring AIconnect to Filter Packets..... Configuring AIconnect to Filter Packets In this scenario, you will complete the following:! Configure AIconnect to drop all outgoing packets to subnet /24.! Configure AIconnect to drop all incoming tcp packets from port 35 on subnet /24. To configure AIconnect to filter packets: 1. Configure AIconnect to drop all outgoing packets to subnet /24: config iptables -t filter -A OUTPUT -j DROP -d /24 2. Configure AIconnect to drop all incoming tcp packets from port 35 on subnet /24: config iptables -t filter -A INPUT -j DROP --proto tcp --sport 35 -d /24 3. (optional) Verify that the IP table commands have been configured properly: show iptables configuration The command response (for table filter) appears similar to the following: Table filter Chain INPUT (policy ACCEPT) -i lo -j ACCEPT -j DROP --proto tcp --sport 35 -d /24 Chain FORWARD (policy ACCEPT) Chain OUTPUT (policy ACCEPT) -d /8 -j ACCEPT -j DROP -d /24 4. Save the configuration. AIconnect Configuration Guide 5-3

48 Configuring Iptables Configuring AIconnect with a Firewall Configuring AIconnect with a Firewall In this scenario, you will complete the following:! Flush the existing rules from all iptables.! Configure AIconnect to permit all traffic with the firewall.! Set the policy for chain PREROUTING to DROP (block) all incoming packets that do not match the configured rule. To configure AIconnect with a firewall: 1. Flush the existing rules from all iptables: config iptables t filter F config iptables t nat F config iptables t mangle F 2. Configure AIconnect (source address ) to permit all traffic with the firewall (destination address ): config iptables t mangle A PREROUTING d s j ACCEPT 3. Set the policy for chain PREROUTING to DROP (block) all incoming packets that do not match the configured rule: config iptables -t mangle -P PREROUTING DROP Important: The default policy for the PREROUTING chain is to accept all packets, which makes the firewall ineffective. It is very important to set this default status to DROP. 5-4 AIconnect Configuration Guide

49 Configuring Iptables Configuring AIconnect with a Firewall (optional) Verify that the IP table commands have been configured properly: show iptables configuration The command response (for table mangle) appears similar to the following: Table mangle Chain PREROUTING (policy DROP) -i lo -j ACCEPT -d s j ACCEPT Chain INPUT (policy ACCEPT) -i lo -j ACCEPT Chain FORWARD (policy ACCEPT) Chain OUTPUT (policy ACCEPT) -d /8 -j ACCEPT Chain POSTROUTING (policy ACCEPT) -d /8 -j ACCEPT (DublinCo)> 5. Save the configuration. AIconnect Configuration Guide 5-5

50 Configuring Iptables Enabling a Telnet Connection Between AIconnect and a Remote Location Enabling a Telnet Connection Between AIconnect and a Remote Location In this scenario, you will complete the following:! Append a rule to the PREROUTING chain that accepts packets from a remote location and to AIconnect. The packets must be from a tcp protocol and have a telnet destination port.! Append a rule to the PREROUTING chain that accepts TCP protocol packets from an established connection. To enable a Telnet connection between AIconnect and a remote location: 1. Append a rule to the PREROUTING chain that accepts packets from a remote location (destination address ) and to AIconnect (source address ). The packets must be from a tcp protocol and have a telnet destination port. config iptables t mangle A PREROUTING -j ACCEPT -d s p tcp -dport telnet 2. Append a rule to the PREROUTING chain that accepts TCP protocol packets from an established connection (one that has seen packets in both directions). config iptables t mangle A PREROUTING -j ACCEPT -p tcp m state --state ESTABLISHED 5-6 AIconnect Configuration Guide