Section 6.2, IP Routing. Section 6.4, IP/VPN Policy. Section 6.5, IP Quality of Service. Section 6.6, The BANDIT as Firewall

Transcription

1 Chapter 6 IP Routing and IPX Routing This chapter discusses IP routing, IP/VPN Policy, and related features in the BANDIT products. It also discusses IPX routing. See the following sections: Section 6.2, IP Routing Section 6.4, IP/VPN Policy Section 6.5, IP Quality of Service Section 6.6, The BANDIT as Firewall Section 6.7, Address Translation Section 6.8, IPX Routing 6.1 The Routing Menu In all the routing sections, you start from the Routing menu. To see the Routing menu, use the following procedure.

2 6-2 Chapter 6: IP Routing and IPX Routing How to Use the Routing Menu 1 After you have started the BANDIT model and have connected it to a control terminal, press Enter (on the terminal s keyboard) to get the BANDIT s attention. The Main Menu is displayed. 2 On the Main Menu, select Advanced Configurations. The Advanced Configurations menu appears. 3 On the Advanced Configurations menu, select Routing. The Configure Routing menu appears. Configure Routing ) IP Routing 2) IPX Routing 3) Frame Relay Routing 4) X.25 Routing Enter Choice : 4 On the Configure Routing menu, select the following to configure different types of routing: a b c d IP Routing: See Section 6.2, IP Routing. IPX Routing: See Section 6.8, IPX Routing. Frame Relay Routing: See Section 7.2.4, Frame Relay Routing. X.25 Routing: See Section 7.3, X.25 Routing. e SNA Routing: See Section 7.5, SNA Routing for 1490.

3 IP Routing IP Routing This section discusses the following topics: Section 6.2.1, Configuring IP Routing Section 6.2.2, RIP Routing Section 6.2.4, Static Routing Section 6.2.5, Primary and Secondary BootP/DHCP Addresses (DHCP Settings) Section 6.2.6, IP Name List Configuring IP Routing 1 To configure IP routing, do the following: a b c d Log in to the BANDIT. (See Section 3.2, Connecting a Supervisory Terminal and Logging in to the BANDIT.) On the Main Menu, select Advanced Configurations. (See Section 3.3, The Main Menu.) On the Advanced Configurations Menu, select Routing. (See Section 3.3.4, The Advanced Configurations Menu.) On the Routing menu, select IP Routing. (See Section 6.1, The Routing Menu.) The IP Routing Configuration menu appears. IP Routing Configuration ) IP Routing Method : RIP 2) Static Routing 3) RIP Routing 4) IP/VPN Routing 5) IP Quality Of Service 6) Network Address Translation (NAT) 7) Primary BOOTP/DHCP Server : No BOOTP/DHCP Server Configured 8) Secondary BOOTP/DHCP Server : No BOOTP/DHCP Server Configured 9) IP Name List A) Primary DNS Server : B) Secondary DNS Server : Enter Choice :

4 6-4 Chapter 6: IP Routing and IPX Routing 2 There are two types of IP routing: Static Routing and RIP Routing. You must select one of these methods before you can configure the remaining IP Routing parameters. To configure IP Routing, do the following: a Select IP Routing Method. The following options are displayed. IP Routing Method 1) Static 2) RIP Enter Choice: Static Routing: This option is a manually updated IP routing method. For more information, see Section 6.2.4, Static Routing. This method should typically be used only if there are devices connected to the network that are not capable of RIP routing. RIP Routing: This option is an automatically updated IP routing method. For more information (see Section 6.2.2, RIP Routing). b Select either method. (Only one method can operate at a time.) To use RIP tables, go to Section 6.2.2, RIP Routing. To use static routing, go to Section 6.2.4, Static Routing. 3 For each remaining parameter you wish to configure, do the following. a b c On the IP Routing Configuration menu, select the item. On the menu that appears, configure the elements of the item. When you have finished configuring the item, press Escape to return to IP Routing Configuration menu. 4 When you have finished configuring IP routing, press Escape to return to the Routing menu. (See Section 6.1, The Routing Menu.)

5 IP Routing RIP Routing When you select RIP Routing for the IP routing table, the RIP Interface Table allows you to specify the nature of the interfaces through which RIP updates should be broadcast. The RIP Interface Table contains interface information for each of the unit s IP interfaces. With the Routing Information Protocol (RIP), a router broadcasts RIP packets that advertise the router s ability to reach a particular network or set of networks. The hosts (routers) that receive this broadcast can then dynamically update their own routing tables. These routing updates are sent at specified time intervals. An alternative to assigning an IP address to every interface is to use unnumbered IP interfaces (interfaces with no IP address assigned) for all point-to-point links. This reduces the number of addresses that must be purchased from the ISP, thus lowering costs as well as conserving IP addresses. When you have a point-to-point link in your network, you can use unnumbered IP interfaces on either side of the link. Note: You cannot ping an unnumbered IP interface, nor can you Telnet to it. Ethernet interfaces should never be set up as unnumbered because it is not a point-to-point link Subnet Mask When an interface is configured as unnumbered, it is assigned an IP address of , which identifies it to other routers as an unnumbered interface. When a broadcast is sent over this interface, the BANDIT automatically inserts the router s local management IP address into the broadcast s source IP address field. When routers receive the broadcast, they update their routing tables in the same manner as they do for traditional RIP routing. However, they recognize from the path information that it is from an unnumbered interface (with an IP address of ) and that the source IP address is therefore not directly linked to the interface. Therefore, they ignore the source IP address field, and route packets to this interface using its associated Global Paths information, such as port number and DLCI. When an IP address arrives at your network, it comprises a network number, which identifies your network, and a host number, which represents an individual host (device) within your network.

6 6-6 Chapter 6: IP Routing and IPX Routing Within your network, the host number is subdivided into a subnet number and a subnet host number. The subnet number identifies which subnetwork should receive the packet. The subnet host number identifies which device within that subnetwork should receive the packet. For the router to identify which portion of the IP address host number is the subnet number and which portion is the individual device s number, you must establish a subnet mask. The subnet mask is a 32-bit binary scheme, which looks like an IP address in that it has four segments divided by decimal points (such as ). The first three segments (24 bits in a Class C IP address) represent the network number, and are represented in decimal format as The first 24 bits are set to all 1s (ones) in the subnet mask. The fourth segment of the subnet mask is comprised of 8 binary digits. The number of consecutive 1s in these 8 digits (counting from the left) is the final number in the subnet mask number, when converted to decimal format. This can best be exemplified by reviewing Table 6-1. This table identifies the 8-bit sequence of every possible subnet mask for a Class C address. Notice that the number of 1s increments once for each entry. Note: Mask 128 cannot be used because it provides for no subnets or hosts. Mask 254 is not used because it provides for no devices on its subnets. This leaves five valid subnet masks. A mask with all 1s is only for broadcasting. Table 6-1. Subnet Masks and Binary Schemes Mask Binary Subnets Hosts 128 a a a. This subnet mask is not used.

7 IP Routing 6-7 Note: If you need only two subnets, but want to have up to 62 devices on each subnet, your subnet mask should be The 192 lets the router know to use only the first two binary digits for the subnet number, and use the remaining numbers for host numbers. If you need six subnets, but have fewer than 30 devices on each subnet, your subnet mask should be The 224 lets the router know to use the first three binary digits for the subnet number, and use the remaining numbers for host numbers RIP Modes When establishing a subnet mask, select the combination of hosts to devices that is optimal for your network needs. RFC-1388 details three RIP modes: RIPv1 Compatibility mode allows the router to broadcast packets formatted for RIPv2. This mode ensures full compatibility but no advantage. The capacity is installed but not used until a sufficient proportion of the routers has been upgraded. This mode can be used on a network that has both RIPv1 and v2 routers. RIPv1 mode allows the router to transmit packets that are formatted for RIPv1. This mode corresponds to the transition and is used as long as some routers in the system remain RIPv1-only. These routers will see the RIPv2 packets and will occasionally reject parts of them, such as the authentication entries or the subnet information. RIPv2 mode allows the router to send packets formatted for RIPv2. In this mode, all routers in the network must be RIPv2 compliant. RIPv2 defines a set of improvements to RIPv1, such as subnet routing, support for CIDR, authentication, and multibroadcast transmission. These improvements are summarized below: - Whereas RIPv1 supports RIP entries only within the subnetted network, RIPv2 allows routing on the subnet outside the network by passing mask information along with the address. It also allows support of variable-length masks within the same network or aggregation of several class C addresses within one address group (as in CIDR).

8 6-8 Chapter 6: IP Routing and IPX Routing - Whereas RIPv1 is not a secure protocol, RIPv2 includes an authentication procedure. It specifies that the first entry in a packet can be replaced by an authentication segment. The packet will thus contain an initial 32-bit command specification, followed by an authentication segment, and then up to 24 destination-metric pairs. - RIPv2 introduces a next-hop concept. It sends not only the addressmetric pair, but also a next-hop indication, telling routers that the distance to X is Y, but the best relay is not me, but rather A. Thus routers will be able to direct packets bound to a given destination, without going through a particular router. RIPv1 uses a broadcast address to send routing advertisements to all packets on a wire. These packets are received not only by routers but also by all hosts on the wire. There is no practical way to filter all broadcast packets. To enable this filtering, you must use a MAC layer multicast address to which only routers will listen. RIPv2 does not exactly define a MAC address. However, it achieves the same result by defining an IP class D address to be used for periodic multicasts. The IP multicast address is No particular multicast networking is needed for RIPv2, as packets are multicast on the local network and are not forwarded. The group management protocol IGMP is not needed. Select the protocol you will use for the router Configuring RIP Routing Consult the following sections when configuring RIP routing: Section , Configuring the RIP Interface Table Section , Virtual Router Redundancy Protocol Section , RIP Static Routing Table Section , Access Lists for Route-Updating Rules Section , RIP v2 Password Section , Dynamic Physical Link Support Configuring the RIP Interface Table Use the following procedure to set up the RIP Interface Table. How to Configure the RIP Interface Table 1 On the Main Menu, select Advanced Configurations.

9 IP Routing 6-9 Main Menu ) QuickStart Config Builder 2) Typical Configurations 3) Advanced Configurations 4) Tools V) View Current Unit Status L) Load Factory Defaults P) Load Plug and Play Defaults W) Write Configuration R) Reset Unit X) exit Session S) Statistics Y) system Administration Enter Choice : The Advanced Configurations menu is displayed. Advanced Configurations ) Physical Configurations 2) Data Configurations 3) Local Address 4) Routing 5) Global Paths Enter Choice : 2 On the Advanced Configurations menu, select Routing. The Configure Routing menu is displayed. Configure Routing ) IP Routing 2) Frame Relay Routing 3) X.25 Routing Enter Choice : 3 On the Configure Routing menu, select IP Routing.

10 6-10 Chapter 6: IP Routing and IPX Routing The IP Routing Configuration menu is displayed. IP Routing Configuration ) IP Routing Method : RIP 2) Static Routing 3) RIP Routing 4) IP/VPN Routing 5) IP Quality Of Service 6) Network Address Translation (NAT) 7) Primary BOOTP/DHCP Server : No BOOTP/DHCP Server Configured 8) Secondary BOOTP/DHCP Server : No BOOTP/DHCP Server Configured 9) IP Name List A) Primary DNS Server : B) Secondary DNS Server : Enter Choice : 4 On the IP Routing Configuration menu, select RIP Routing. Note: The menu allows this selection only if the IP Routing Method is RIP. The IP Routing Parameters menu is displayed. RIP Routing Parameters ) RIP Interface Table 2) RIP Static Routing Table 3) Access Lists 4) RIPv2 Password 5) Dynamic Physical Link Support : Enabled Enter Choice : 5 On the RIP Routing Parameters menu, select RIP Interface Table. If the RIP Interface table has entries, the table is displayed. Go to Step 27.

11 IP Routing 6-11 If the RIP Interface table has no entries, the unit displays a message confirming that the table is empty, and then displays the prompt for the first record s IP address. Empty RIP Interface Table Add RIP Interface Table Entry Enter Interface IP Address (N.N.N.N or = Unnumbered) : 6 Enter the IP Address for this interface, and press Enter. The following prompt is displayed: Enter Interface Subnet Mask (N.N.N.N or ) : 7 Enter the subnet mask. The following prompt is displayed: Enter Path Name (1 to 10 Characters): Note: The Global Path name identifies the path this traffic will take. A Global Path entry contains information such as port numbers, path types, channel numbers, DLCIs, and X.121 addresses. This option is accessed from the Main Menu. 8 Type the Global Path Name and press Enter. If you type a name already in the Global Path Table, the path is assigned to this interface, and the following prompt is displayed. Go to Step 10.

12 6-12 Chapter 6: IP Routing and IPX Routing Enter Next Hop Router Address. <ESC> for Broadcast (N.N.N.N) : If you type a name that is not already associated with a Global Path, you are prompted to configure the new path now. Path Name Does Not Exist In GPT Table. To Add Global Path Entry, Press 'Y'. Press Escape Otherwise. 9 Do one of the following: a b Type y to open the Global Path option and configure a path with the path name that you typed. Press Escape to return to the GPT prompt and enter a different name. Note: You cannot save this record unless you enter or create a valid path name in this step. When you have completed the Global Path entry, the following prompt is displayed. Enter Next Hop Router Address. <ESC> for Broadcast (N.N.N.N) : 10 Enter the IP address for the router that will be an IP packet s next hop. (Press Escape to broadcast the transmission.) When you press Enter, the following prompt is displayed: Enter RIP Mode ((1) On) ((2) Send) ((3) Listen) ((4) Off):

13 IP Routing Select the RIP mode for the port: On enables the unit to both listen for (receive) and send RIP updates. Send enables the unit only to send RIP updates. Listen enables the unit only to receive RIP updates. Off disables both the Send and the Listen functions. Note: If you set the RIP mode to Off, some of the subsequent fields do not appear for configuration. The following prompt is displayed: Note: If the RIP Mode is Off, you will not see this prompt. Enter Extra Receive Hops (0 to 10): Note: The Extra Receive Hops option allows the device to record more hops than the actual hop count that exists between this device and a particular router. This is appropriate when using the closest router is more costly than using other routes. This can also be used for a backup interface, so that the primary interface is used first. (That is, so that the backup interface is used only when the primary interface experiences congestion.) 12 Enter the number of extra receive hops. The following prompt is displayed. Note: If the RIP Mode is Off, you will not see this prompt.

14 6-14 Chapter 6: IP Routing and IPX Routing Enter Router Protocol ( (1)RIPv1-Compatibility ) ( (2)RIPv1 ) ( (3)RIPv2 ): 13 Select the Router Protocol this unit will use. (For information on the modes, see Section , RIP Modes.) RIPv1-Compatibility RIPv1 RIPv2 The following prompt is displayed: Note: If the RIP Mode is Off, you will not see this prompt. Enter Router Receive Mode ( (1)Both ) ( (2)RIPv1 Only ) ( (3)RIPv2 Only ): 14 Select the Router Receive Mode this router will use: RIPv1 Only mode allows the router to receive only RIPv1 packets, while discarding any incoming RIPv2 packets on this interface. RIPv2 Only mode allows the router to receive only RIPv2 packets, while discarding any incoming RIPv1 packets on this interface. Both mode allows the router to receive and process both RIPv1 and RIPv2 packets on this interface. The following prompt is displayed. Note: If the RIP Mode is Off, you will not see this prompt.

15 IP Routing 6-15 Enter Incoming Access List Number ( 0 - None ) : Note: See Section , Access Lists for Route-Updating Rules, for a definition of Access Lists. You can create rules for governing the networks and subnets the router is allowed to send routing information to or learn routing information from. Each rule consists of a list of up to 30 networks/ subnets, which are assigned an Allow/Deny tag to indicate whether the networks/subnets in that list will be allowed to send/receive routing information to/from this interface. The lists and Allow/ Deny tags are assigned in the Access Lists option. The rules are completed in this and the next field, where, for example, you could specify that Access List 1 and its assigned Allow/Deny tag apply to the interface being configured. If Access List 1 consists of Networks A, B, and C, and has a Deny tag assigned to it, then this interface will not receive updates from those networks. (This does not prohibit this interface from sending updates to those networks.) If you enter 0, no access list is applied to traffic. Note: You can assign the same or different Access Lists to the Incoming and Outgoing fields. 15 Enter the number of the access list to be used on traffic coming into this interface. The following prompt is displayed. Note: If the RIP Mode is Off, you will not see this prompt. Enter Outgoing Access List Number ( 0 - None ) :

16 6-16 Chapter 6: IP Routing and IPX Routing Note: See Section , Access Lists for Route-Updating Rules, for a definition of Access Lists. You can specify a particular access list to be used for outgoing traffic on this interface. If you assign Access List 1 to the Outgoing Access List Number field, then this interface will not send updates to those networks. If you enter 0, no access list is applied to traffic. Note: You can assign the same or different Access Lists to the Incoming and Outgoing fields. 16 Enter the number of the access list to be used for traffic leaving this interface. The following prompt is displayed: Enter NAT Configuration Number ( 0 = None ) : This option allows you to specify whether this interface is using: NAT Configuration 1 NAT Configuration 2 NAT Configuration 3 No NAT configuration (Type 0, zero, and press Enter.) The following prompt is displayed: For dynamic IP addresses, please use = modem, = modem over SERIAL or = modem over EXPANSION. Enter BackUp Interface IP Address ( = Modem)[None]:

17 IP Routing If the primary link in the RIP Interface Table goes down, the link can be automatically backed up by an ISDN line or a modem. Enter the IP address of the port to be used as a backup, or enter if there is no ISDN or modem backup. The following prompt appears: Enter the MTU (256 to 1500)[1500] : 18 Enter the Maximum Transit Unit (MTU), and press Enter. The following prompt is displayed. Enable Dynamic MTU adjustment based upon priorities?(y/n), [N]: 19 Indicate whether to enable dynamic MTU adjustment. If you answered no, the following prompt is displayed. Go to Step 21. Enter remote ping address(n.n.n.n, = NONE),[NONE]: If you answered yes, the following prompt is displayed. Enter the minimum dynamic MTU (256 to 1500)[1500] : 20 Type the minimum dynamic MTU, and press Enter. The following prompt is displayed.

18 6-18 Chapter 6: IP Routing and IPX Routing Enter remote ping address(n.n.n.n, = NONE),[NONE]: 21 Enter the remote address to ping (when ping is used), and press Enter. The following prompt is displayed. Enable VRRP(Yes/No),[N]?: 22 Indicate whether this router will participate in a setup using the Virtual Router Redundancy Protocol (VRRP), and press Enter. Note: For information about VRRP, see Section , Virtual Router Redundancy Protocol. If you answered no, the following prompt is displayed, confirming that the record has been added to the RIP Interface Table. Go to Step 26. Entry Added If you answered yes, the following prompt is displayed. Enter VRRP IP Address (N.N.N.N or = Unnumbered) : 23 Type the IP address for the virtual router, and press Enter.

19 IP Routing 6-19 Note: All routers in this VRRP set use the same virtual router IP address. The following prompt is displayed. Enter VRRP Priority(1 to 255)[100] : 24 Type the virtual router priority (where 255 is the highest priority) for this router, and press Enter. Note: The active router with the highest priority in the VRRP set is elected master router. The following prompt is displayed. Enter VRRP VRID(1 to 255)[1] : 25 Type this router s ID in the VRRP set, and press Enter. Note: The VRID does not affect election as master router. The following prompt is displayed, confirming that the record has been added to the RIP Interface Table. Entry Added

20 6-20 Chapter 6: IP Routing and IPX Routing 26 When you have finished entering a record and the record has been added to the RIP Interface Table, a prompt asks for information for another record. Enter Interface IP Address (N.N.N.N or = Unnumbered) : Do one of the following: a To enter another record, go to Step 6. b If you have finished entering new records, press Escape. The RIP Interface Table is displayed. Entry IP Address Net Mask Gpt Name Next Router Mode MTU 1 Unnumbered N/A MODEM N/A Off LAN broadcast Send LAN Off WAN Off 1500 Add, Modify, or Delete an Entry? (Enter A, M, or D): 27 Do one of the following: a To add another record, type a. The following prompt is displayed. Go to Step 6. Enter VRRP IP Address (N.N.N.N or = Unnumbered) : b To modify a record, type m. Then type the line number of the record (entry) you wish to modify. Then select the field to modify.

21 IP Routing 6-21 When you have finished modifying the record, press Enter to see the RIP Interface Table. Repeat Step 27. Note: For an example of modifying a record in the RIP Interface Table, see the procedure How to Modify a BANDIT Product s VRRP Configuration, in Section , Virtual Router Redundancy Protocol. c To delete a record, type d. Then enter the line number of the record you wish to delete. The RIP Interface Table is displayed again, minus the deleted record. Repeat Step 27. d When you have finished making changes, press Escape to return to the RIP Routing Parameters menu Virtual Router Redundancy Protocol The BANDIT products support the Virtual Router Redundancy Protocol (VRRP) as specified in IETF RFC This RFC implementation provides for two or more routers in the same subnet to share an IP address. In this setup, the IP address identifies a virtual router; the routers provide redundancy in case one goes out of service. When you configure any router, you assign it its unique IP address or you specify that it gets its IP address via DHCP. (See Section 6.2.5, Primary and Secondary BootP/DHCP Addresses (DHCP Settings).) When you configure a router for VRRP, you also assign it the virtual router IP address that will be shared by the routers in the VRRP set. Each router using the virtual router IP address can also be given a virtual router ID (VRID) unique within the VRRP set of routers. To the other hosts in the network, the routers in the VRRP set appear to be just one router. Only one of the routers in the VRRP set is active. As specified in the protocol, the routers elect a router to be active for the IP address. If the active router is disabled, another one in the VRRP set takes control, using the same IP address. To facilitate the election, all routers bearing the same IP address may have different priorities assigned to them. The router having the highest priority wins the election. If there are two or more routers with the same priority, the

22 6-22 Chapter 6: IP Routing and IPX Routing one that sends its advertisement first has a greater chance of winning the election. If a lower-priority router is functioning as the master router, it will become dormant when a higher-priority router in the VRRP set becomes available. To set up VRRP during the initial configuration of a BANDIT product, see Step 22 of the procedure How to Configure the RIP Interface Table, in Section , Configuring the RIP Interface Table. To reconfigure a product for VRRP, or to modify VRRP settings, use the following procedure. How to Modify a BANDIT Product s VRRP Configuration 1 On the Main Menu, select Advanced Configurations. The Advanced Configurations menu is displayed. 2 On the Advanced Configurations menu, select Routing. The Configure Routing menu is displayed. 3 On the Configure Routing menu, select IP Routing. The IP Routing Configuration menu is displayed. 4 On the IP Routing Configuration menu, select RIP Routing. The RIP Routing Parameters menu is displayed. 5 On the RIP Routing Parameters menu, select RIP Interface Table. If the RIP Interface Table does not yet contain any records, the prompt for the first field in a record is displayed. (See Step 6 of the procedure How to Configure the RIP Interface Table, in Section , Configuring the RIP Interface Table.) If the RIP Interface Table contains records, the table is displayed. Entry IP Address Net Mask Gpt Name Next Router Mode MTU MODEM Off 1500 Add, Modify, or Delete an Entry? (Enter A, M, or D):

23 IP Routing 6-23 Note: You cannot use static routing for BANDIT devices in a VRRP set. Other devices not acting as VRRP routers can use either static routing or RIP routing, even if there are VRRP routers in the same subnet visible to the non-routers. 6 In the RIP Interface Table, do one of the following: a If you wish to add an entry, type a. The prompt for the new record s first field is displayed. (See Step 6 of the procedure How to Configure the RIP Interface Table, in Section , Configuring the RIP Interface Table.) b If you wish to modify an entry, type m. The following prompt is displayed. Go to Step 7 of this current procedure. Enter Number of Entry to be Modified: c If you wish to delete an entry, type d. When requested, specify the record to delete. The record is removed from the table. Repeat Step 6 of this current procedure. d When you have finished configuring VRRP, press Escape. The RIP Routing Parameters menu is displayed. Go to Step 11 of this current procedure. 7 Type the number of the line (Entry) you wish to modify. The record s detail screen is displayed.

24 6-24 Chapter 6: IP Routing and IPX Routing 1) IP Address : ) Net Mask : ) GPT Name : MODEM 4) Next Hop : ) Mode : Off 6) Extra Receive Hops : 1 7) Router Protocol : RIPv1-Compatibility 8) Router Receive Mode : RIPv1 and RIPv2 9) NAT Configuration Number : None 10) Backup Interface IP Address : None 11) Incoming Access List Number : None 12) Outgoing Access List Number : None 13) MTU Configuration : ) Dynamic MTU adjustment : Disabled 15) Minimum Dynamic MTU: ) Ping Address: None 17) VRRP Parameters: Disabled Enter Choice : 8 On the record s detail screen, select VRRP Parameters. The VRRP Parameters menu is displayed. 1) VRRP: Disabled 2) VRRP Address : Unnumbered 3) VRRP Priority: 100 4) VRID: 1 5) Advertisement time interval(sec): 1 Enter Choice : 9 On the VRRP Parameters menu, do the following: a Select VRRP. The following prompt is displayed: Enable VRRP(Yes/No),[N]?: Type y to enable VRRP, and press Enter.

25 IP Routing 6-25 The VRRP Parameters menu is redisplayed. b Select VRRP Address. The following prompt is displayed: Enter VRRP IP Address (N.N.N.N) : Type the IP address for the Virtual Router, and press Enter. Note: This is the IP address the router uses when it is the master router. The VRRP Parameters menu is redisplayed. c Select VRRP Priority. The following prompt is displayed: Enter VRRP Priority(1 to 255)[100] : Type the priority this router will have when vying to be the master router, and press Enter. Note: The highest priority is 255. The active router with the highest priority is elected master router. The VRRP Parameters menu is redisplayed. d Select VRID. The following prompt is displayed:

26 6-26 Chapter 6: IP Routing and IPX Routing Enter VRID(1 to 255)[1] : Type the Virtual Router ID to identify this router in the virtual router pool, and press Enter. Note: The VRID does not influence election as master router. The VRRP Parameters menu is redisplayed. e Select Advertisement Time Interval. The following prompt is displayed: Enter Advertisement interval(1 to 30)[1] : Type the number of seconds between advertisements this router sends to be elected master router, and press Enter. Note: If two routers have the same priority, the one with the shorter ad interval has a better chance to be elected master router. The VRRP Parameters menu is redisplayed. f Press Escape to return to the record detail screen. 10 On the record detail screen, press Escape to exit from the record. The RIP Interface Table is redisplayed. Go to Step 6 of this current procedure. 11 When you have finished configuring this BANDIT device for VRRP, press Escape until you return to the Main Menu. Then Write the configuration and Reset the device.

27 IP Routing RIP Static Routing Table Note: You cannot use static routing for BANDIT devices in a VRRP set. Other devices not acting as VRRP routers can use either static routing to RIP routing, even if there are VRRP routers in the same subnet visible to the nonrouters. Entries can be made in the RIP Static Routing Table for devices that do not have the RIP capability. How to Configure the RIP Static Routing Table 1 On the BANDIT device s Main Menu, select Advanced Configurations. BANDIT Plus Main Menu ) QuickStart Config Builder 2) Typical Configurations 3) Advanced Configurations 4) Tools V) View Current Unit Status L) Load Factory Defaults P) Load Plug and Play Defaults W) Write Configuration R) Reset Unit X) exit Session S) Statistics Y) system Administration Enter Choice : 3 The Advanced Configurations menu is displayed.

28 6-28 Chapter 6: IP Routing and IPX Routing BANDIT Plus Advanced Configurations ) Physical Configurations 2) Data Configurations 3) Local Address 4) Routing 5) Global Paths Enter Choice : 4 2 On the Advanced Configurations menu, select Routing. The Configure Routing menu is displayed. BANDIT Plus Configure Routing ) IP Routing 2) Frame Relay Routing 3) X.25 Routing 4) SNA Routing Enter Choice : 1 3 On the Configure Routing menu, select IP Routing. The IP Routing Configuration menu is displayed. BANDIT Plus IP Routing Configuration ) IP Routing Method : RIP 2) Static Routing 3) RIP Routing 4) IP/VPN Routing 5) IP Quality Of Service 6) Network Address Translation (NAT) 7) Primary BOOTP/DHCP Server : No BOOTP/DHCP Server Configured 8) Secondary BOOTP/DHCP Server : No BOOTP/DHCP Server Configured 9) IP Name List A) Primary DNS Server : B) Secondary DNS Server : Enter Choice : 3

29 IP Routing On the IP Routing Configuration menu, select RIP Routing. The RIP Routing Parameters menu is displayed. BANDIT Plus RIP Routing Parameters ) RIP Interface Table 2) RIP Static Routing Table 3) Access Lists 4) RIPv2 Password 5) Dynamic Physical Link Support : Enabled Enter Choice : 2 1 On the RIP Routing Parameters menu, select RIP Static Routing Table. The following prompt is displayed: Empty RIP Static Routing Table Add RIP Static Table Entry Enter Destination IP Address / Network (N.N.N.N) : 2 Enter the IP Address of the remote device. When you press <ENTER>, the following prompt is displayed: Enter Subnet Mask (N.N.N.N) : a Revise the subnet mask, if necessary, and press Enter. The following prompt is displayed.

30 6-30 Chapter 6: IP Routing and IPX Routing Enter Next Hop Router Address (N.N.N.N or = Unnumbered) : Enter the IP Address of the next router (hop) through which packets must pass to reach the destination. Number of Hops to Destination: When you press Enter, the following prompt is displayed: Enter Number of Hops to destination: 4 Enter the maximum number of hops allowed for reaching the remote device. Enter Path Name (1 to 10 Characters): Note: Path name: This option allows you to identify the Global Path entry that corresponds to the path this traffic will take through the network. You do this by entering the name you assigned to the Global Path. A Global Path entry contains information such as port numbers, path types, channel numbers, DLCIs, and X.121 addresses. This option is accessed from the Main Menu. 5 Enter the Global Path Name and press Enter. If you enter a name that is not already associated with a Global Path, you are prompted to enter the path now:

31 IP Routing 6-31 Path Name Does Not Exist In GPT Table. To Add Global Path Entry, Press 'Y'or <enter>. Press Escape Otherwise.y Note: You will not be able to save this record in the RIP Static Routing Table if a valid GPT Name is not entered or created. 6 Do one of the following: a b Press Escape to return to the GPT prompt and enter a different name. Return to Step 5. Enter Y to open the Global Path option and configure a path with that name. Global Path Types ) X25 SVC 2) X25 PVC 3) Frame Relay PVC 4) Port Type 5) IP/UDP 6) FR Multicast Path Enter Choice : (1 to 6)[1] : 5 7 Select IP/UDP. The following prompt is displayed. Enter Destination IP Address (N.N.N.N) : 8 Type the destination s IP address, and press Enter. The following prompt is displayed.

32 6-32 Chapter 6: IP Routing and IPX Routing Enter Destination UDP Port ( 100 to 10,000 ): 9 Type the destination s UDP port number, and press Enter. A message indicates that the path has been added to the Global Path table. A second message indicates that the record has been added to the RIP Static Routing Table. Then a prompt is displayed for the next record in the table. GPT Entry added. Entry Added Enter Destination IP Address / Network (N.N.N.N) : 10 Do one of the following: a b Type the IP address for the next record. (Go to Step 2 to complete this information.) Press Escape to view the addresses you have entered for the RIP Static Routing Table. The RIP Static Routing Table is displayed. Entry IP Address Net Mask Next Router Path Name Hops Unnumbered ip1 1 Add, Modify, or Delete an Entry? (Enter A, M, or D): 11 You can add, delete, or change the entries as needed. When you are finished making changes, press Escape to return to the menu. RIP Static Table Handling Complete

33 IP Routing 6-33 Note: To Telnet or PING the unit, you must enter the Unit IP Address under Local Address on the Main Menu. This IP Address must be on the same Subnet as any one of the unit s interfaces Access Lists for Route-Updating Rules 1 Select Access Lists from the RIP Routing Parameters menu. This option allows you to create up to five rules that govern which networks and subnets this unit is allowed to autodetect routing information from or send routing updates to. Note: Within each Access List option, you must complete a table, wherein you can specify up to 30 networks or subnets to be used in a rule. To complete this rule, you must specify whether routing information to/from this list of networks should be allowed or denied. The conditions for these rules are established in this section, Access Lists. However, they are implemented by configuring the Incoming/Outgoing Access List Number fields in the RIP Interface Table. When you select Access Lists, the following options are displayed: Access Lists 1) Access List 1 2) Access List 2 3) Access List 3 4) Access List 4 5) Access List 5 Enter Choice : 2 Enter the number of an access list for which you want to create a rule.

34 6-34 Chapter 6: IP Routing and IPX Routing 3 Access List Table and Action: This option allows you to set up a list of networks and subnets in a table, and specify whether routing updates to/from this list of networks should be allowed or denied. Select an access list. The following prompts are displayed: Access List : 1) Table 2) Action : Deny Enter Choice : Network Number: If you select Table, the following prompt is displayed: Enter NetWork Number (N.N.N.N) : 4 Enter the number of a network you want to include in this rule and press Enter. Network Mask: When you press Enter, the following prompt is displayed: Enter Network Mask:

35 IP Routing 6-35 Note: The IP address you entered above consists of a network number, which represents your network, and a host number, which represents a device attached to your network. The network mask identifies which portion of the IP address is the network number and which portion is the host number for the router. The router is concerned only with the network number. In the following classes of addresses, 255 reflects the segments of an IP address that make up the network number; 0 reflects the segments that make up the host number. Class A: Class B: Class C: Enter the Network Mask number assigned to your class of IP address. 6 Repeat this process for up to 30 table entries. Press Escape to return to the menu. 7 Access List Action. This option allows you to specify whether routing information to/from this list of routers should be allowed or denied. Select Action from the Access List menu. The following prompt is displayed: Enter Access List Action (Allow/Deny - A/D) 8 Select Allow or Deny to implement the rule you are setting up. 9 Press Escape to return to the menu RIP v2 Password 1 Select RIPv2 Password from the RIP Routing Parameters menu. This option allows you to assign a password, which is required when using RIPv2. The password is embedded in IP RIPv2 packets. The unit will automatically detect routes only from routers whose RIP v2 passwords are identical.

36 6-36 Chapter 6: IP Routing and IPX Routing Note: RIPv1 packets are discarded when the unit is configured with a password. The following prompt is displayed: Enter Password: 2 If desired, enter a password up to 16 characters in length and press Enter. Note: You are not required to enter a password Dynamic Physical Link Support 1 Select Dynamic Physical Link Support. Note: When enabled, this option allows the unit to delete from the RIP Interface Table any path that includes a router that is down. When disabled, the router uses regular RIP standards. The following prompt is displayed: Dynamic Physical Link Support Setting 1) Enabled 2) Disabled Enter Choice : 2 Select Enabled or Disabled.

37 IP Routing Static Routing Note: You cannot use static routing for BANDIT devices in a VRRP set. Other devices not acting as VRRP routers can use either static routing or RIP routing, even if there are VRRP routers in the same subnet visible to the nonrouters. When you configure a static routing table for a device, you must create an entry for each port on the device that carries IP data Configuring the Static Routing Table All IP addressing for SLIP, PPP, and Ethernet ports is done in the IP Routing Table. The IP Routing Table prompts you for a range of addresses (low to high). When a packet falling within the specified address range is received, it is passed to the configured port. For instance, any IP packet with a destination address between and can be mapped to the network port once the Global Path table has been established. IP addresses do not include DLCIs. If Frame Relay is required, any mapping of an IP address through a Frame Relay DLCI is done via the Global Path table. Note: To configure IP routing entries, you must first configure the ports. (See Section 4.1, Configuring and Routing Ports.) Considerations: Because the Global Path Table lets you associate a specific IP address with a Frame Relay DLCI, IP traffic can be routed to enter the BANDIT on a given Frame Relay port with one DLCI and exit the unit via the same port with a different DLCI. This is useful for Frame Relay carried over IP. In general, BANDITs accept 20 or more entries in the routing tables for IP. The BANDIT offers static routing to fixed address ranges entered in the routing table. (For more information on address ranges, see Section , Overlapping and Duplicate Address Ranges.)

38 6-38 Chapter 6: IP Routing and IPX Routing How to Configure the Static Routing Table 1 On the Main Menu, select Advanced Configurations. BANDIT Plus Main Menu ) QuickStart Config Builder 2) Typical Configurations 3) Advanced Configurations 4) Tools V) View Current Unit Status L) Load Factory Defaults P) Load Plug and Play Defaults W) Write Configuration R) Reset Unit X) exit Session S) Statistics Y) system Administration Enter Choice : 3 The Advanced Configurations menu is displayed. BANDIT Plus Advanced Configurations ) Physical Configurations 2) Data Configurations 3) Local Address 4) Routing 5) Global Paths Enter Choice : 4 2 On the Advanced Configurations menu, select Routing. The Configure Routing menu is displayed.

39 IP Routing 6-39 BANDIT Plus Configure Routing ) IP Routing 2) Frame Relay Routing 3) X.25 Routing 4) SNA Routing Enter Choice : 1 3 On the Configure Routing menu, select IP Routing. The IP Routing Configuration menu is displayed. BANDIT Plus IP Routing Configuration ) IP Routing Method : RIP 2) Static Routing 3) RIP Routing 4) IP/VPN Routing 5) IP Quality Of Service 6) Network Address Translation (NAT) 7) Primary BOOTP/DHCP Server : No BOOTP/DHCP Server Configured 8) Secondary BOOTP/DHCP Server : No BOOTP/DHCP Server Configured 9) IP Name List A) Primary DNS Server : B) Secondary DNS Server : Enter Choice : 2 4 On the IP Routing Configuration menu, select IP Routing Method. The IP Routing Method menu is displayed. BANDIT Plus IP Routing Method ) Static 2) RIP Enter Choice : 1 Static

40 6-40 Chapter 6: IP Routing and IPX Routing 5 On the IP Routing Method menu, select Static. The IP routing method is set as static, and the IP Routing Configuration menu is redisplayed. BANDIT Plus IP Routing Configuration ) IP Routing Method : Static 2) Static Routing 3) RIP Routing 4) IP/VPN Routing 5) IP Quality Of Service 6) Network Address Translation (NAT) 7) Primary BOOTP/DHCP Server : No BOOTP/DHCP Server Configured 8) Secondary BOOTP/DHCP Server : No BOOTP/DHCP Server Configured 9) IP Name List A) Primary DNS Server : B) Secondary DNS Server : Enter Choice : 2 6 On the IP Routing Configuration menu, select Static Routing. The Static Routing Parameters menu is displayed. BANDIT Plus Static Routing Parameters ) IP Proxy ARP : Proxy ARP Enabled 2) IP Default Router : No IP Default Router 3) IP Routing Table Enter Choice : 3 7 Select IP Proxy ARP: This option allows you to enable or prohibit the unit from responding to a Proxy ARP request a request for a nonlocal IP address. If IP Proxy ARP is set to Enabled (the default), the unit responds to ARP requests for any device connected to it. If Proxy ARP is set to Disabled, the unit responds to ARP requests only for its own (i.e., management) IP address.

41 IP Routing 6-41 IP Proxy ARP 1) IP Proxy ARP Enabled 2) IP Proxy ARP Disabled Enter Choice: 8 Select Enabled or Disabled mode. When you make a selection, you are returned to the Static Routing Parameters menu. 9 To enter an address for a default router, select IP Default Router. The following prompt is displayed: Enter IP Default Router Address (N.N.N.N): Note: If the unit s local IP address is (the factory default) and the IP Routing Table is empty, the unit is in default routing mode. A new, unconfigured unit is in this default routing mode. When you place a call to the unit through Telnet and dial into the unit s port 23, the unit retrieves and learns its own address from the destination address of the Telnet call. The unit can also learn its address in the same manner from an ICMP PING request or a UDP message to the SNMP port (161) on a network port configured for Frame Relay. When the unit receives one of these message types, it stores the DLCI and source IP address of the message in its IP Routing Table. These changes allow remote configuration of a unit via the default configuration. (See Section 3.5, FastCONNECT.)

42 6-42 Chapter 6: IP Routing and IPX Routing Note: If a unit has a LAN interface, you can configure an IP address for a default router to which the Ethernet or Token Ring port sends otherwise unroutable IP messages. The default router continues to attempt to deliver the packets. Note: The existence of the default router depends on the unit s success at maintaining a MAC address for it by issuing periodic ARP requests to the router. If no ARP information is available, the Ethernet or Token Ring port driver temporarily holds IP packets while issuing an ARP request over the Ethernet or Token Ring. If a valid ARP response arrives within one second, the original packet is sent using the MAC address retrieved from the ARP response. If no ARP response arrives within one second, the message is either discarded or sent to the default router if a default router is available. Note: Neither the local IP address nor the IP routing entries assigned in this default mode are stored in the database. You must fully configure the unit for normal use before addresses and IP entries can be saved. 10 Enter the IP address for the default router and press Enter. When you make a selection, you are returned to the Static Routing Parameters menu. 11 To configure the routing table, select IP Routing Table. The following prompt is displayed: Empty IP Routing Table Add IP Routing Table Entry Enter Low IP Address (N.N.N.N) : 12 Enter the low IP address in the format displayed, and press Enter.

43 IP Routing 6-43 The following prompt is displayed: Enter High IP Address (N.N.N.N) : 13 High IP Address: After entering the Low IP Address, you are prompted to enter the high IP address. The low address is displayed as a default after the prompt. You can backspace to remove one character at a time, then type the new entry, or press CTRL and Z at the same time to clear the entire entry. Enter the high IP address in the format displayed and press Enter. The following prompt is displayed: Enter Path Name (1 to 10 Characters): Note: A Global Path Table (GPT) record contains information such as ports, path types, and addresses. The table cannot save this record unless a valid GPT name is used or created. 14 The Global Path entry specifies the path this traffic will take, within the BANDIT device, to reach the network. Type the Global Path Name and press Enter. One of the following occurs: If the Global Path name already exists, it is assigned to this record in the routing table. Then the following prompt is displayed. Go to Step 16. Enter NAT Configuration Number ( 0 = None ) : 0

44 6-44 Chapter 6: IP Routing and IPX Routing If you entered a name that is not already associated with a Global Path, you are prompted to enter the path information now: Path Name Does Not Exist In GPT Table. To Add Global Path Entry, Press 'Y'or <enter>. Press Escape Otherwise. 15 Do one of the following: Press Escape to return to the Static Routing Parameters menu. Go to Step 11. Type Y to configure a global path. See Section 4.3, Defining Global Paths. After you have entered or created a valid global path for this record, the following prompt is displayed. Enter NAT Configuration Number ( 0 = None ) : 0 16 Specify the network address translation (NAT) scheme this record will use. Values can be 1, 2, or 3 for a specific NAT scheme; or 0 (zero) if no NAT will be used. The following prompt is displayed. Enter the MTU (256 to 4096)[256] : 17 Type the maximum transmission unit (MTU) and press Enter. (The standard MTU for Ethernet ports is 1500.) The following prompt is displayed.

45 IP Routing 6-45 Enable Dynamic MTU adjustment based upon priorities?(y/n), [N]: 18 Answer y or n. The following prompt is displayed. Enter remote ping address(n.n.n.n, = NONE),[NONE]: 19 Enter the remote ping address, if any will be used for pinging. A message indicates that the record has been added to the routing table. Entry Added Then a prompt is displayed for the next record. Enter Low IP Address (N.N.N.N) : Do one of the following: To enter another record into the routing table, go to Step 12. To quit entering records into the routing table, press Escape. The Routing Table is displayed.