Yamaha Router Configuration Training ~ console ~

Size: px

Start display at page:

Download "Yamaha Router Configuration Training ~ console ~"

Asher Alexander
6 years ago
Views:

1 Yamaha Router Configuration Training ~ console ~

2 Contents Console operation Log in Set Login & Admin password Basic Command Interface Addressing DHCP Static Routing NAT PPPoE IPsec VPN Static/Dynamic Packet Filtering 2

3 Before training Please disable Windows firewall. [Start menu] [Control Panel] [Windows Firewall] Select Turn Windows Firewall on or off. 3

4 Access into the Router Basic method of the access RTX810 Console(Tera Term) 4

5 Setup the console environment 1. Install the driver of the USB-Serial 2. Install the Tera Term software 3. Setup the Tera Term parameter Menu Setup Serial port Parameter Baud rate Data Parity Stop Flow control Value 9600 bit/s 8 bit None 1 bit Xon/Xoff 4. Start the router 5

6 1. Login from Serial Sample: The router will start automatically in 10 seconds. No password is set in the beginning. 6

7 2. How to configure Sample: Enter the administrator mode to configure the router. Use command administrator to enter the administrator mode. No password is set in the beginning. 7

8 3. How to change passwords Sample: Use command login password to change login password. Use command administrator password to change admin password. Use command save to save running configuration to FlashROM. Login password yamaha Administrator password router 8

9 4. Logout Use command exit to logout from login user and admin. Enter login password. Enter admin password. 9

10 5. Basic commands Show Command 1 show config 5 show log 2 show ip route 6 show status <interface> 3 show arp 7 show ipsec sa 4 show environment 8 show techinfo Maintenance 1 save 2 restart 3 cold start Network Command 1 ping 2 traceroute 3 telnet 10

11 5. Basic commands (1) Sample: show status lan1 shows the status of LAN1. show log shows the syslog of the router. 11

12 5. Basic commands (2) Sample: show techinfo shows all information of the router. 12

13 6. Command help Sample: Use key? to show command list. Use key? after word to show command help or other command list. 13

These domains are name as number 0 ~ 4 and it is possible to do following operations for each

14 7. Configuration control (1) Yamaha router has 5 domains for the configuration files on internal memory. These domains are name as number 0 ~ 4 and it is possible to do following operations for each domain. - Copy the configuration file - Delete the configuration file - Show the configuration file list - Show the saved configuration file content Internal memory (Flash ROM) 0 (default)

15 7. Configuration control (2) Sample: Use command save NUM to save running-configuration to specific domain on FlashROM. Use command show config list to show saved config list. Use command copy config P1 P2 to copy configuration from P1 to P2. Use command delete config to delete configuration on FlashROM. 15

16 8. Interface addressing Configure IP Address to LAN Interface / ::/64.1(LAN2).1(LAN1) / ::/64 16

17 8. Interface addressing (1) Command ip <interface> address <IPv4address/mask> ipv6 <interface> address <IPv6address/mask> 1 2 Sample: 1 Configure IPv4 address to each LAN address. // 1 2 Configure IPv6 address to each LAN address. // 2 Use command save to save running configuration to FlashROM. 17

18 8. Interface addressing (2) Sample: show status lan1 shows the status of LAN1. show status lan2 shows the status of LAN2. 18

19 8. Interface addressing (3) show ipv6 address shows IPv6 address information. 19

20 9. Delete command Sample: Use word no to clear followed command. 20

21 10. DHCP server setting Enable DHCP Server and Assign DHCP Address to DHCP Clients(PC).1(LAN1) / ~

22 10. DHCP server setting (1) Command dhcp service server dhcp scope <scope_id> <scope/mask> 1 2 Sample: //1 //2 1 Enable DHCP Server 2 Configure the scope range of DHCP IP addresses. 22

23 10. DHCP server setting (2) Sample: : show status dhcp shows the status of DHCP lease. 23

24 11. Router Advertisement Configure the Router Advertisement and send to host. Router Advertisement.1(LAN1) 2000::/64 The computer creates ipv6 address from Router Advertisement 2000::XXXX /64 24

25 11. Router Advertisement (1) Command ipv6 prefix <prefix_id> <prefix/mask> ipv6 <interface> rtadv send <prefix_id> 1 2 Sample: 1 Configure IPv6 prefix. //1 //2 2 Configure the Router Advertisement. 25

26 11. Router Advertisement (2) The computer create IPv6 address from prefix on RA. 26

27 Return to factory default setting //1 //2 1 Use command cold start to return to factory default. 2 Router restarts automatically. //3 Push Enter in 10 seconds counting. 3 Restart from config0. 27

28 12. Static route setting Configure Static Route for Networking / ::/ / ::/64 Router-A /2 4 Router-B ::/ (LAN1) (LAN2) (LAN2) (LAN1) ping 28

29 12. Static route setting (1) Command ip route <network/mask> gateway <nexthop> 1 ipv6 route <network/mask> gateway <nexthop>%<interface> 2 Sample: Router-A 1 Set static route for /24 2 Set static route for 3000::/64 //1 //2 default means

30 12. Static route setting (2) Command ip route <network/mask> gateway <nexthop> 1 ipv6 route <network/mask> gateway <nexthop>%<interface> 2 Sample: Router-B 1 Set static route for /24 2 Set static route for 2000::/64 //1 //2 default means

31 12. Static route setting (3) Sample: Router-A show ip route shows the ipv4 routing table of the Router. 31 show ipv6 route shows the ipv6 routing table of the Router.

32 Configuration Change //1 //2 1 Save configuration to config0. 2 Restart Router. Push Enter in 10 seconds counting. //3 3 Restart from config1. 32

33 13. Network Address Translation (NAT) NAT the process of modifying IP address information in IP packet headers. the process for private address group to use 1 global IP address. NAT table internet Source Source Port : : : X : 6000X X /24 33

34 13. NAT (1) Configure NAT for IP Networking Web server /24 NAT (LAN2).1 (LAN1) /24 Your computer

13. NAT (2) Command nat descriptor type <nat_id> masquerade nat descriptor address outer <nat_id> <Outer IP Address> nat descriptor address inner <nat_id> <Inner IP Address> ip <interface> nat

35 13. NAT (2) Command nat descriptor type <nat_id> masquerade nat descriptor address outer <nat_id> <Outer IP Address> nat descriptor address inner <nat_id> <Inner IP Address> ip <interface> nat descriptor <nat_id> Sample: 1 Enable NAT Select masquerade to use NAPT. //4 //1 //3 //2 2 Put Global IP Address for translation. 3 Put any private IP Address. auto means all. 4 Set NAT to the interface. 35

36 13. NAT (3) Sample: show nat descriptor address shows the nat table of the Router. 36

2.16.1.1 internet NAT table Destination Port Destination Port 172.

37 14. Static masquerade Static masquerade the process of forwarding the packets which coming to specific port number internet NAT table Destination Port Destination Port : : Web server on private network /24 37

38 14. Static masquerade (1) Your computer /24 NAT :80.1 (LAN2) :80.1 (LAN1) /24 Web server

14. Static masquerade (2) Command nat descriptor type <nat_id> masquerade nat descriptor address outer <nat_id> <Outer IP Address> nat descriptor address inner <nat_id> <Inner IP Address> nat

39 14. Static masquerade (2) Command nat descriptor type <nat_id> masquerade nat descriptor address outer <nat_id> <Outer IP Address> nat descriptor address inner <nat_id> <Inner IP Address> nat descriptor masquerade static <nat_id> <table_num> <Inner IP> <Proto> <Port> ip <interface> nat descriptor <nat_id> Sample: 1 Enable NAT Select masquerade to use NAPT. //1 //3 //2 //4 2 Put Global IP Address for translation. 3 Put any private IP Address. auto means all. //5 4 Set Inner IP and Port for port forward. 5 Set NAT to the interface. 39

40 14. Static masquerade (3) Sample: show nat descriptor address shows the routing table of the Router. 40

41 Configuration Change //1 //2 1 Save configuration to config1. 2 Restart Router. Push Enter in 10 seconds counting. //3 3 Restart from config2. 41

42 15. Static packet filtering Configure Static Packet Filtering Web server Static Packet Filtering Condition : /24 : Reject /24 : Pass /24.1 (LAN2) Filtering (tcp 80 = HTTP).1 (LAN1) /24 Your computer 42

15. Static packet filtering (1) Command ip filter <Filter_NUM> <Type> <Src_Add> <Dst_Add> <Protocol <Src_Port> <Dst_Port>> 1 ip <Interface> secure filter <Direction> <Filter_Num> 2 * To record the

43 15. Static packet filtering (1) Command ip filter <Filter_NUM> <Type> <Src_Add> <Dst_Add> <Protocol <Src_Port> <Dst_Port>> 1 ip <Interface> secure filter <Direction> <Filter_Num> 2 * To record the result of Packet Filtering, Configure the filter type such as pass-log and reject-log And also, configure syslog notice on to show the record on the syslog. Sample: 1 Create Packet Filtering. 2 //1 2 Set filter to the interface. //3 //2 3 Configure this command to record the result of packet filtering. 43

44 15. Static packet filtering rule Sample filtering configuration: ip filter 1 reject tcp 80 * ip filter 2 reject udp * * ip filter 3 pass * * * * * ip lan2 secure filter in Filter1 Received packet TCP src:80 From: To: YES In case of above configuration, packets received on LAN2 interface are evaluated in right sequence. The received packet that does not match any filtering are discard. If you want to reject specific packet, you should set all-pass filtering at the last of filter configuration. YES Filter2 Filter3 NO UDP From: To: all NO YES NO Pass Discard 44

45 15. Static packet filtering (2) PASS-LOG show log shows the syslog and results of Packet Filtering. REJECT-LOG 45

46 16. Dynamic packet filtering Configure Dynamic Packet Filtering (Stateful Inspection) Web server.100 Dynamic Filtering Condition LAN1 LAN2 : Pass LAN2 LAN1 : Reject Reply packets of LAN1 LAN2 : Pass /24 Filtering (tcp 80 = HTTP).1 (LAN2).1 (LAN1) /24 Your computer 46

47 16. Dynamic packet filtering (1) Command ip filter <Filter_Num> <Type> <Src_Add> <Dst_Add> <Protocol <Src_Port> <Dst_Port>> 1 ip flter dynamic <Dynamic_Filter_Num> <Src_Add> <Dst_Add> <Protocol> 2 ip <interface> secure filter <Direction> <Filter_Num> dynamic <Dynamic_Filter_Num> 3 *NOTE To enable Dynamic Filter, Static Packet Filter is needed to be configured in advance. The first packet should be filtered by static filter. Once the packet is filtered by Static Filter, then, Dynamic Filter becomes active. ex} ip lan1 secure filter out 1 dynamic 1 For Dynamic Filter, the parameter of <Protocol> is such as ftp, www, domain, smtp, pop3, tcp and udp. 47

48 16. Dynamic packet filtering (2) Sample: 1 Create Static Packet Filtering. //1 2 Create Dynamic Packet Filtering. //2 3 Set inbound filter to the Interface. //5 //3 //4 4 Set dynamic filter for outbound filter to the interface. 5 Configure this command to record the result of packet filtering. 48

49 16. Dynamic packet filtering (3) Sample: show ip connection shows the session information of Dynamic Filtering. 49

50 16. Dynamic packet filtering (4) Sample: show log shows the syslog and results of Packet Filtering. INSPECT means that Packets are filtered by Dynamic Filtering. 50

51 Configuration Change //1 //2 1 Save configuration to config2. 2 Restart Router. Push Enter in 10 seconds counting. 3 Restart from config3. //3 51

52 17. Internet Accessing (PPPoE) Configure PPPoE Setting for Internet Access Internet Router-A (WAN) (WAN) Router-B.1 (LAN).1 (LAN) / /24 PC1 PC2 52

53 17. PPPoE (1) Command pp select <pp_num> 1 pppoe use <interface> 2 pp always-on <on/off> 3 pp auth accept <auth mthod> 4 pp auth myname <user_id> <user_pass> 5 ppp lcp mru <on/off> <frame size> 6 ip pp mtu <mtu size> 7 ppp ccp type <type> 8 ppp ipcp ipaddress <on/off> 9 (*1) ppp ipcp msext <on/off> 10 ip pp nat descriptor <nat_id> 11 ip pp tcp mss limit <length> 12 pp enable <pp_num> 13 dns server pp <pp_num> 14 ip route <network address/mask> gateway pp <pp_num> 15 *1 ) this parameter is for dynamic IP Address which assigned from ISP. If you want to use static IP Address, set ip pp <IP Address/Mask> instead. 53

54 PPPoE (2) Sample: (Dynamic Global Address) //1 //13 //2 //3 //14 //6 //7 //8 //9 //4 //5 //10 //11 //12 //15 1 Create pp interface 2 Choose physical interface 3 Enable always-on connections 4 Choose authentication 5 Set USER-ID and Password 6 Set LCP MRU parameter 7 Set MTU parameter 8 Choose compression type 9 Enable dynamic IP address 10 Enable dynamic DNS address 11 Enable nat descriptor for pp 12 Enable optimization of MSS 13 Enable pp interface 14 Set DNS server from Set static routing Router A ID: user1, PASS: pass1 Router B ID: user2, PASS: pass2

55 17. PPPoE (3) Sample: show status pp 1 shows the status of pp 1 interface. 55

56 18. IPsec VPN (Main mode) Configure IPsec VPN (Main Mode) via Internet Router-A PSK: secret.201 Internet ( /24).202 Router-B PSK: secret IPSec.1.1 PC /24 PC /24 56

57 18. IPsec VPN (Main mode) (1) Command:(Center and Branch) tunnel select <Tunnel_Num> tunnel encapsulation <Type> ipsec tunnel <Policy_ID> ipsec sa policy <Policy_ID> <Tunnel_Num> esp <Algorithm> <Authentication> ipsec ike keepalive use <Tunnel_Num> <on/off> ipsec ike keepalive log <Tunnel_Num> <on/off> ipsec ike local address <Tunnel_Num> <Local_Gateway_Address> ipsec ike remote address <Tunnel_Num> <Remote_Gateway_Address> ipsec ike pre-shared-key <Tunnel_Num> text <Text_Key> tunnel enable <Tun_Num> ip route <network address/mask> gateway <Tun_Num> ipsec auto refresh <on/off>

58 18. IPsec VPN (Main mode) (2) Sample: Router-A //1 //9 //13 //2 //4 //5 //12 //6 //7 //8 //3 //10 //11 1 Create Tunnel Interface 2 Select IPsec Policy-ID 3 Create IPsec Policy 4 Enable use of keepalive 5 Disable keepalive log 6 Set IP address of local GW 7 Set IP address of remote GW 8 Set pre shared key 9 Enable Tunnel Interface 10 Set port forwarding for IPsec 11 Set port forwarding for IKE 12 Set static routing 13 Enable Initiation of KeyExchange 58

18. IPsec VPN (Main mode) (3) Sample: Router-B //1 //2 //9 //13 //4 //5 //12 //6 //7 //8 //3 //10 //11 1 Create Tunnel Interface 2 Select IPsec Policy-ID 3 Create IPsec Policy 4 Enable use of

59 18. IPsec VPN (Main mode) (3) Sample: Router-B //1 //2 //9 //13 //4 //5 //12 //6 //7 //8 //3 //10 //11 1 Create Tunnel Interface 2 Select IPsec Policy-ID 3 Create IPsec Policy 4 Enable use of keepalive 5 Disable keepalive log 6 Set IP address of local GW 7 Set IP address of remote GW 8 Set pre shared key 9 Enable Tunnel Interface 10 Set port forwarding for IPsec 11 Set port forwarding for IKE 12 Set static routing 13 Enable Initiation of KeyExchange 59

60 18. IPsec VPN (Main mode) (4) Sample: show status tunnel 1 shows the status of tunnel 1 interface. show ipsec sa shows the status of ISAKMP SA and IPsec SA. 60

61 19. IPsec VPN (Aggressive mode) Configure IPsec VPN (Aggressive Mode) via Internet Router-A PSK: secret Remote Name: test Internet ( /24) Dynamic IP Address Router-B PSK: secret Local Name: test.201 IPSec / /24 PC1 PC2 61

62 19. IPsec VPN (Aggressive mode) (1) Command:(Center) Router-A tunnel select <Tunnel_Num> tunnel encapsulation <Type> ipsec tunnel <Policy_ID> ipsec sa policy <Policy_ID> <Tunnel_Num> esp <Algorithm> <Authentication> ipsec ike keepalive use <Tunnel_Num> <on/off> ipsec ike keepalive log <Tunnel_Num> <on/off> ipsec ike local address <Tunnel_Num> <Local_Gateway_Address> ipsec ike remote address any ipsec ike remote name <Tunnel_Num> <Tex_key> key-id ipsec ike pre-shared-key <Tunnel_Num> text <Text_Key> tunnel enable <Tun_Num> ip route <network address/mask> gateway <Tun_Num>

63 19. IPsec VPN (Aggressive mode) (2) Command:(Branch) Router-B tunnel select <Tunnel_Num> tunnel encapsulation <Type> ipsec tunnel <Policy_ID> ipsec sa policy <Policy_ID> <Tunnel_Num> esp <Algorithm> <Authentication> ipsec ike keepalive use <Tunnel_Num> <on/off> ipsec ike keepalive log <Tunnel_Num> <on/off> ipsec ike local address <Tunnel_Num> <Local_Gateway_Address> ipsec ike remote address <Remote_Gateway_Address> ipsec ike local name <Tunnel_Num> <Tex_key> key-id ipsec ike pre-shared-key <Tunnel_Num> text <Text_Key> tunnel enable <Tun_Num> ip route <network address/mask> gateway <Tun_Num> ipsec auto refresh <on/off>

64 19. IPsec VPN (Aggressive mode) (3) Sample: Router-A //1 //2 //10 //4 //5 //13 //6 //7 //8 //9 //3 //11 //12 1 Create Tunnel Interface 2 Select IPsec Policy-ID 3 Create IPSec Policy 4 Enable use of keepalive 5 Disable keepalive log 6 Set IP address of local GW 7 Accept any IP as remote GW 8 Set name of remote GW 9 Set pre shared key 10 Enable Tunnel Interface 11 Set port forwarding for IPsec 12 Set port forwarding for IKE 13 Set static routing 64

65 19. IPsec VPN (Aggressive mode) (4) Sample: Router-B //1 //2 //10 //14 //4 //5 //13 //6 //7 //8 //9 //3 //11 //12 1 Create Tunnel Interface 2 Select IPsec Policy-ID 3 Create IPsec Policy 4 Enable use of keepalive 5 Disable keepalive log 6 Set IP address of local GW 7 Set IP address of remote GW 8 Set name of local GW 9 Set pre shared key 10 Enable Tunnel Interface 11 Set port forwarding for IPsec 12 Set port forwarding for IKE 13 Set static routing 14 Enable Initiation of Key- Exchange 65

66 19. IPsec VPN (Aggressive mode) (5) Sample: show status tunnel 1 shows the status of tunnel 1 interface. show ipsec sa shows the status of ISAKMP SA and IPsec SA. 66

67 19. IPsec VPN (Aggressive mode) (6) Sample: show ipsec sa gateway 1 detail shows the specific information about ISAKMP and IPsec SA. 67

68 Website for Yamaha product We will update the information such as new firmware, sample configuration etc. 68

YAMAHA RTX??????? L2TPv3???? VPN???? (IPv4, IPv6??)

YAMAHA RTX??????? L2TPv3???? VPN???? (IPv4, IPv6??) SoftEther VPN Server? Build 9582??????????YAMAHA????? (RTX????)????? L2TPv3 over IPsec VPN????? (?????? 2??????)?????????????????????????????????????