Introduction

Abstract

Today, large-scale communication network development projects are becoming increasingly common. One of the main tasks in implementation of large multiservice networks is the creation of reliable high-performance transport network that will serve as a backbone in multilayer architecture of next-generation networks.

ESR series firewalls could be used in large enterprise networks, SMB networks and operator's networks. Devices provide high performance and bandwidth, and feature protection of transmitted data.

This operation manual describes intended use, specifications, features, design, installation, first time setup, and firmware update guidelines for the ESR series service router (next, the router or the device).

Target Audience

This user manual is intended for technical personnel that performs device installation, configuration and monitoring via command line interface (CLI) as well as the system maintenance and firmware update procedures. Qualified technical personnel should be familiar with the operation basics of TCP/IP protocol stacks and Ethernet networks design concepts. 

Notes and warnings

Product Description

Purpose

ESR series devices are the high performance multi-purpose network routers. Device combines traditional network features with a complex multi-tier approach to routing security, and ensures robust corporate environment protection.

Device has a built-in firewall that enables protection of your and organization network environment and supports latest data security, encryption, authentication and anti-intrusion features.

Device contains software and hardware means of data processing. Top performance is achieved through optimal distribution of data processing tasks between different subsets of the device.

Functions

Interfaces functions

Table 1 lists interface functions of the device.

Table 1 – Device interface functions

Functions for MAC address processing

Table 2 lists MAC address processing functions of the device.

Table 2 – MAC address processing functions

Second-layer functions of OSI model

Table 3 lists second-layer functions and special aspects (OSI Layer 2).

Table 3 – Second-layer functions description (OSI Layer 2)

¹  In the current firmware version, this functionality is supported only by ESR-1000 router

Third-layer functions of OSI model

Table 4 lists third-layer functions (OSI Layer 3).

Table 4 – Third-layer functions description (OSI Layer 3)

Traffic tunnelling functions

Table 5 – Traffic tunnelling functions

Management and configuration functions

Table 6 – Basic management and configuration functions

Network security functions

Table 7 lists network security functions of the device.

Table 7 – Network security functions

Main specifications

Table 8 lists main specifications of the router.

Table 8 — Main Specifications

Design

This section describes the design of the device. Depicted front, rear, and side panels of the device, connectors, LED indicators and controls.

The device has a metal housing available for 19” form-factor rack mount; housing size is 1U.

ESR-1700 design

ESR-1700 front panel

The front panel layout is depicted in Figure 1.

Figure 1 – ESR-1700 front panel

Table 9 lists connectors, LEDs and controls located on the front panel of ESR-1700.

Table 9 – Description of ESR-1700 connectors, LEDs and front panel controls

ESR-1700 rear panel

The rear panel of ESR-1700 is shown in the picture below.

Figure 2 – ESR-1700 rear panel

Table 10 lists rear panel connectors of the router.

Table 10 – Rear panel connectors description

ESR-1700 side panels

Figure 3 – ESR-1700 right side panel

Figure 4 – ESR-1700 left side panel

Side panels of the device have air vents for heat removal. Do not block air vents. This may cause the components to overheat, which may result in device malfunction. For recommendations on device installation, see section Installation and connection.

ESR-1510, ESR-1500 design

ESR-1510, ESR-1500 front panel

The front panel layout is depicted in 5.

Figure 5 – ESR-1510, ESR-1500 front panel

Table 11 lists connectors, LEDs and controls located on the front panel of ESR-1510 and ESR-1500 routers.

Table 11 – Description of connectors, LEDs and controls located on ESR-1510, ESR-1500 front panel

ESR-1510, ESR-1500 rear panel

The rear panel layout of ESR-1510 and ESR-1500 routers is depicted in figure 6.

Figure 6 – ESR-1510, ESR-1500 rear panel

Table 12 lists rear panel connectors of the router.

Table 12 – Rear panel connectors description

ESR-1510, ESR-1500 side panels

Figure 7 – ESR-1500, ESR-1510 right side panel

Figure 8 – ESR-1500, ESR-1510 left side panel

Side panels of the device have air vents for heat removal. Do not block air vents. This may cause the components to overheat, which may result in device malfunction. For recommendations on device installation, see section Installation and connection.

ESR-1200, ESR-1000 design

ESR-1200 front panel

The front panel layout of ESR-12V is depicted in figure 9.

Figure 9 – ESR-1200 front panel

Table 13 lists connectors, LEDs and controls located on the front panel of ESR-1200.

Table 13 – Description of connectors, LEDs and controls located on the front panel of ESR-1200

ESR-1000 front panel

The front panel layout is depicted in figure 10.

Figure 10 – ESR-1000 front panel

Table 14 lists sizes, LEDs and controls located on ESR-1000 front panel.

Table 14 – Description of connectors, LEDs and controls located on ESR-1000 front panel

ESR-1200,1000 rear panel

The rear panel of ESR-1000 is depicted in the figure below.

Figure 11 – ESR-1000 rear panel

Table 15 lists rear panel connectors of the router.

Table 15 – Rear panel connectors description

ESR-1200, ESR-1000 side panels

Figure 12 – ESR-1200, 1000 right side panel

Figure 13 – ESR-1200, 1000 left side panel

Side panels of the device have air vents for heat removal. Do not block air vents. This may cause the components to overheat, which may result in device malfunction. For recommendations on device installation, see section Installation and connection.

ESR-200, ESR-100 design

ESR-100, ESR-200 front panel

The front panel layout of ESR-200 is depicted in figure 14.

Figure 14 – ESR-200 front panel

The front panel layout of ESR-100 is depicted in figure 15.

Figure 15 – ESR-100 front panel

Table 16 lists connectors, LEDs and controls located on the front panel of ESR-100 and ESR-200 routers.

Table 16 – Description of connectors, LEDs and controls located on ESR-200, ESR-100 front panel

ESR-200, ESR-100 rear panel

The rear panel layout of ESR-100 and ESR-200 routers is depicted in figure 16.

Figure 16 – ESR-200, 100, rear panel

Table 17 lists rear panel connectors of the router.

Table 17 – Rear panel connectors description

ESR-100, ESR-200 side panels

Figure 17 – ESR-100 and ESR-200 right side panel

Figure 18 – ESR-100 and ESR-200 left side panel

ESR-21 design

The device has a metal housing available for 19” form-factor rack mount; housing size is 1U.

ESR-21 front panel

The front panel layout is depicted in figure 19.

Figure 19 – ESR-21 front panel

Table 18 lists sizes, LEDs and controls located on ESR-21 front panel.

Table 18 – Description of connectors, LEDs and controls located on ESR-21 front panel

ESR-21 rear panel

The rear panel layout of ESR-21 is depicted in figure 20.

Figure 20 – ESR-21 rear panel

Table 19 lists rear panel connectors of the router.

Table 19 – Rear panel connectors description

ESR-21 side panels

The side panel layout of ESR-21 is depicted in figures 21 and 22.

Figure 21 – ESR-21 left side panel

Figure 22 – ESR-21 right side panel

ESR-20 design

The device has a metal housing available for 19” form-factor rack mount; housing size is 1U.

ESR-20 front panel

The front panel layout is depicted in figure 23.

Figure 23 – ESR-20 front panel

Table 20 lists connectors, LEDs and controls located on the front panel of ESR-20.

Table 20 – Description of connectors, LEDs and controls located on ESR-20 rear panel

ESR-20 rear panel

The rear panel layout of ESR-20 is depicted in figure 24.

Figure 24 – ESR-20 rear panel

Table 21 lists rear panel connectors of the router.

Table 21 – Rear panel connectors description

ESR-20 side panels

The side panel layout of ESR-20 is depicted in figures 25 and 26.

Figure 25 – ESR-20 left side panel

Figure 26 – ESR-20 right side panel

ESR-12VF, ESR-14VF design

The device has a metal housing available for 19” form-factor rack mount; housing size is 1U.

ESR-12VF, ESR-14VF front panel

The front panel layout is depicted in figure 27.

ESR-12VF, ESR-14VF front panel

Table 22 lists connectors, LEDs and controls located on the front panel of ESR-12VF and ESR-14VF routers.

Table 22 – Description of connectors, LEDs and controls located on ESR-12VF, ESR-14VF front panel

ESR-14VF, ESR-12VF rear panel

The rear panel layout of ESR-12VF, ESR-14-VF is depicted in figure 28.

Figure 28 – ESR-12VF, ESR-14VF rear panel

Table 23 lists rear panel connectors of the router.

Table 23 – Rear panel connectors description

ESR-12VF, ESR-14VF side panels

The side panel layout of ESR-12VF, ESR-14VF is depicted in Figures 29 and 30.

Figure 29 – ESR-12VF, ESR-14VF left side panel

Figure 30 – ESR-12VF, ESR-14VF right side panel

ESR-12V design

The device has a metal housing available for 19” form-factor rack mount; housing size is 1U.

ESR-12V front panel

The front panel layout of ESR-12V is depicted in figure 31.

Figure 31 – ESR-12V front panel

Table 24 lists connectors, LEDs and controls located on the front panel of ESR-12VF router.

Table 24  – Description of connectors, LEDs and controls located on ESR-12V front panel

ESR-12V rear panel

The rear panel layout of ESR-12V is depicted in 32.

Figure 32 – ESR-12V rear panel

Table 25 lists rear panel connectors of the router.

Table 25 – Rear panel connectors description

ESR-12V side panels

The side panel layout of ESR-12V is depicted in figures 33 and 34.

Figure 33 – ESR-12V left side panel

Figure 34 – ESR-12V right side panel

ESR-10 design

ESR-10 rear panel

The rear panel layout of the device is depicted in figure 35.

Figure 35 – ESR-10 rear panel

Table 26 lists connectors, LEDs and controls located on the rear panel of ESR-10.

Table 26 – Description of connectors, LEDs and controls located on ESR-10 rear panel

ESR-10 side panels

The side panel layout of ESR-10 is depicted in figure 36.

Figure 36 – ESR-10 side panel

Table 27 lists right panel controls of the router.

Table 27 – Right panel connectors description

ESR-10 top panel

The top panel layout of ESR-10 is depicted in figure 37.

Figure 37 – ESR-10 top panel

Table 28 lists LEDs located on ESR-10 top panel.

Table 28 – Description of front panel LEDs

Light Indication

ESR-1700, ESR-1510, ESR-1500, ESR-1200, ESR-1000 light indication

Gigabit Ethernet copper interface statuses are represented by two LEDs – green LINK/ACT LED and amber SPEED LED. Location of the copper interface LEDs is depicted in figure 38. SFP interface status is represented by two LEDs – RX/ACT and TX/ACT – depicted in figure 39. For light indication meaning, see Tables 29 and 30 respectively.

Figure 38 – Location of RJ-45 connector indicators

Figure 39 – Location of optical interface indicators

Table 29 – Light indication of copper interface status

Table 30 – Light indication of SFP/SFP+ interface status

The following table lists description of system indicator statuses and meanings.

Table 31 – Status of system indicators

ESR-200/ESR-100 light indication

Gigabit Ethernet copper interface and SFP interface statuses are represented by two LEDs – green LINK/ACT LED and amber SPEED LED. Location of the copper interface LEDs is depicted in figure 38. SFP interface status is depicted in figure 40. For light indication meaning, see Table 32.

Figure 40 – Location of optical interface indicators

Table 32 – Light indication of copper and SFP interface status

The following table lists description of system indicator statuses and meanings.

Table 33 – Status of system indicators

¹  Not supported in the current firmware version

ESR-21/ESR-20 light indication

Gigabit Ethernet copper interface statuses are represented by two LEDs – green LINK/ACT LED and amber SPEED LED.

Table 34 – Light indication of copper and SFP interface status

Figure 41 – Location of SFP connector indicators

Figure 42 – Location of RJ-45 connector indicators

The following table lists description of system indicator statuses and meanings.

Table 35 – Status of system indicators

ESR-12V(F) light indication

Gigabit Ethernet copper interface statuses are represented by two LEDs – green LINK/ACT LED and amber SPEED LED.

Table 36 – Light indication of copper and SFP interface status

Figure 43 – Location of SFP connector indicators (only for ESR-12VF, ESR-14VF)

Figure 44 – Location of RJ-45 connector indicators

The following table lists description of system indicator statuses and meanings.

Table 37 – Status of system indicators

ESR-10 light indication

Gigabit Ethernet copper interfaces statuses are represented by amber SPEED LED.

Table 38 – Light indication of copper interface status

Delivery Package

ESR-10 standard delivery package includes:

• ESR-10 router;
• External 12V power block;
• Documentation.

ESR-12V standard delivery package includes:

• ESR-12V router;
• Power cable;
• 19” rack mounting kit;
• Documentation.

ESR-12VF standard delivery package includes:

• ESR-12VF router;
• Power cable;
• 19” rack mounting kit;
• Documentation.

ESR-14VF standard delivery package includes:

• ESR-14VF router;
• Power cable;
• 19” rack mounting kit;
• Documentation.

ESR-20 standard delivery package includes:

• ESR-20 router;
• Power cable;
• 19” rack mounting kit;
• Documentation.

ESR-21 standard delivery package includes:

• ESR-21 router;
• Power cable;
• 19” rack mounting kit;
• Documentation.

ESR-100 standard delivery package includes:

• ESR-100 router;
• Power cable;
• 19” rack mounting kit;
• Documentation.

ESR-200 standard delivery package includes:

• ESR-200 router;
• Power cable;
• 19” rack mounting kit;
• Documentation.

ESR-1000 standard delivery package includes:

• ESR-1000 router;
• 19” rack mounting kit;
• Documentation.

ESR-1200 standard delivery package includes:

• ESR-1200 router;
• 19” rack mounting kit;
• Documentation.

ESR-1500 standard delivery package includes:

• ESR-1500 router;
• 19” rack mounting kit;
• Documentation.

ESR-1510 standard delivery package includes:

• ESR-1510 router;
• 19” rack mounting kit;
• Documentation.

ESR-1700 standard delivery package includes:

• ESR-1700 router;
• 19” rack mounting kit;
• Documentation.

Installation and configuration

This section describes installation of the device into a rack and connection to a power supply.

Support brackets mounting

The delivery package includes support brackets for rack installation and mounting screws to fix the device case on the brackets. To install the support brackets:

Figure 45  – Support brackets mounting

1. Align four mounting holes in the support bracket with the corresponding holes in the side panel of the device.
2. Use a screwdriver to screw the support bracket to the case.
3. Repeat steps 1 and 2 for the second support bracket.

Device rack installation

To install the device to the rack:

1. Attach the device to the vertical guides of the rack.
2. Align mounting holes in the support bracket with the corresponding holes in the rack guides. Use the holes of the same level on both sides of the guides to ensure the device horizontal installation.
3. Use a screwdriver to screw the router to the rack.

Figure 46 – Device rack installation

ESR-1000, ESR-1200, ESR-1500, ESR-1510, ESR-1700 power module installation

ESR-1000/1200/1500/1510/1700 router can operate with one or two power modules. The second power module installation is necessary when the device operates under strict reliability requirements.

From the electric point of view, both places for power module installation are identical. In the context of device operation, the power module located closer to the edge is considered as the main module, and the one closer to the centre – as the backup module. Power modules can be inserted and removed without powering the device off. When additional power module is inserted or removed, the router continues operation without reboot.

Figure 47 – Power module installation

Figure 48 – Plug installation

You can check the state of power modules by the indication on the front panel of the router (see Section Light indication) or by diagnostics, available through the router management interfaces.

Connection to Power Supply

1. Ground the case of the device prior to connecting it to the power supply. An insulated multiconductor wire should be used for earthing. The device grounding and the earthing wire cross-section should comply with Electric Installation Code.
2. If a PC or another device is supposed to be connected to the router console port, the device should be also securely grounded.
3. Connect the power supply cable to the device. Depending on the delivery package, the device can be powered by AC or DC electrical network. To connect the device to AC power supply, use the cable from the delivery package. To connect the device to DC power supply, use wires with a minimum cross-section of 1 mm².
4. Turn the device on and check the front panel LEDs to make sure the terminal is in normal operating conditions.

SFP transceiver installation and removal

Transceiver installation

1. Insert the top SFP module into a slot with its open side down, and the bottom SFP module with its open side up.

Figure 49 – SFP transceivers installation

2. Push the module into the device housing until it is secured with a clicking sound.

Figure 50 – Installed SFP transceivers

Transceiver removal

1. Flip the module handle to unlock the latch.

Figure 51 – Opening SFP transceiver latch

2. Remove the module from the slot.

Figure 52 – SFP transceivers removal

Management interfaces

You may use various management interfaces in order to control and monitor the device.

To access the device, you may use network connection via Telnet or SSH as well as direct connection via RS-232 compliant console port. For Telnet, SSH or console port connections, the command line interface is used for device management.

For each management interface provided, there are unified configuration operating principles. When modifying and applying the configuration, you should follow the specific sequence described herein that is intended to protect the device from misconfiguration.

Command Line Interface (CLI)

Command Line Interface (CLI) allows to perform the device management and monitor its operation and status. You will require the PC application supporting Telnet or SSH protocol operation or direct connection via the console port (e.g. HyperTerminal).

Command line interface enables user authorization and restricts access to commands depending on their access level, provided by the administrator.

You can create as many users as you like, access rights will be assigned individually to each user.

To ensure command line interface security, all commands are divided into 2 categories–privileged and unprivileged. Privileged commands basically include configuration commands. Unprivileged commands include monitoring commands.

The system allows multiple users to connect to the device simultaneously.

Types and naming procedure of router interfaces

Network interfaces of various types and purposes are used for the router operation. The naming system allows you to uniquely address the interfaces by their functional purpose and location in the system. The following table contains the list of interfaces types.

Table 39 – Types and naming procedure of router interfaces

Types and naming procedure of router tunnels

Network tunnels of various types and purposes are used for the router operation. The naming system allows you to uniquely address the tunnels by their functional purpose. The following table contains the list of tunnels types.

Table 40 – Types and naming procedure of router tunnels

Initial router configuration

ESR router factory settings

The device is shipped to the consumer with the factory configuration installed that includes essential basic settings. Factory configuration allows you to use the router as a gateway with SNAT without applying any additional settings. Also, factory configuration contains settings that allow you to obtain network access to the device for advanced configuration.

Description of factory settings

To establish network connection, the configuration features 2 security zones named 'Trusted' for local area network and 'Untrusted' for public network. All interfaces are divided between two security zones:

1. 'Untrusted' zone is meant for a public network (WAN) connection. In this zone, DHCP ports are open in order to obtain dynamic IP address from the provider. All incoming connections from this zone to the router are blocked.
   

   This security zone includes the following interfaces:

   For ESR-10/12V: GigabitEthernet 1/0/1;

   for ESR-12VF/ESR-14VF: GigabitEthernet 1/0/1; GigabitEthernet 1/0/9;

   for ESR-20: GigabitEthernet 1/0/1;

   for ESR-21: GigabitEthernet 1/0/1;

   For ESR-100/200: GigabitEthernet 1/0/1;

   for ESR-1000/1500/1510: GigabitEthernet 1/0/1, TengigabitEthernet 1/0/1-2;

   for ESR-1200/1700: GigabitEthernet 1/0/1, TengigabitEthernet 1/0/1, TengigabitEthernet 1/0/2.

   Zone interfaces are grouped into a single L2 segment via Bridge 2 network bridge.

2. 'Trusted' zone is meant for a local area network (LAN) connection. In this zone, the following ports are open: Telnet and SSH ports for remote access, ICMP ports for router availability test, DHCP ports for clients obtaining IP addresses from the router. Outgoing connections from this zone into the Untrusted zone are allowed.
   

   This security zone includes the following interfaces:

   For ESR-10: GigabitEthernet 1/0/2-6;

   for ESR-12V(F)/ESR-14VF: GigabitEthernet 1/0/2-8;

   for ESR-20: GigabitEthernet 1/0/2-4;

   for ESR-21: GigabitEthernet 1/0/2-12;

   for ESR-100: GigabitEthernet 1/0/2-4;

   for ESR-200: GigabitEthernet 1/0/2-8;

   for ESR-1000: GigabitEthernet 1/0/2-24;

   for ESR-1200: GigabitEthernet 1/0/2-16, TengigabitEthernet 1/0/3-8;

   for ESR-1500/1510: GigabitEthernet 1/0/2-8, TengigabitEthernet 1/0/3-4;

   for ESR-1700: GigabitEthernet 1/0/2-4, TengigabitEthernet 1/0/3-12.

   Zone interfaces are grouped into a single L2 segment via Bridge 1 network bridge.

On the Bridge 2 interface, DHCP client is enabled to obtain dynamic IP address from the provider. On Bridge 1 interface, static IP address 192.168.1.1/24 is configured. Created IP address acts as a gateway for LAN clients. For LAN clients, DHCP address pool 192.168.1.2-192.168.1.254 is configured with the mask 255.255.255.0. For clients in order to access the Internet, the router should have Source NAT service enabled.

Security zone policies have the following configuration:

Table 41 – Security zone policy description

Router connection and configuration

ESR series routers are intended to perform border gateway functions and securing the user network when it is connected to public data networks.

Basic router configuration should include:

• Assigning IP addresses (static or dynamic) to the interfaces that participate in data routing;
• Creation of security zones and distribution of interfaces between these zones;
• Creation of policies governing data transfer through these zones;
• Configuration of services that accompany the data routing (NAT, Firewall, etc.).

Advanced settings depend on the requirements of the specific device application pattern and may be easily added or modified with the existing management interfaces.

Connection to the router

There are several device connection options:

Ethernet LAN connection

Connect the network data cable (patch cord) to any port within the 'Trusted' zone and to the PC intended for management tasks.

In the router factory configuration, DHCP server is enabled with IP address pool in 192.168.1.0/24 subnet.

When network interface is connected to the management computer, the latter should obtain the network address from the server.

If IP address is not obtained for some reason, assign the interface address manually using any address except for 192.168.1.1 in 192.168.1.0/24 subnet.

RS-232 console port connection

Using RJ-45/DBF9 cable included into device delivery package, connect the router 'Console' port to the computer RS-232 port.

Launch terminal application (e.g. HyperTerminal or Minicom) and create a new connection. VT100 terminal emulation mode should be used.

Specify the following settings for RS-232 interface:

Applying the configuration change

Any changes made in the configuration will take effect only after applying the command:

esr# commit
Configuration has been successfully committed

After applying the command above, the configuration rollback timer is started. To stop the timer and rollback mechanism, use the following command:

esr# confirm
Configuration has been successfully confirmed

The default 'rollback' timer value is 600 seconds. To change this timer, use the command:

esr(config)# system config-confirm timeout <TIME>

<TIME> – time period of configuration confirmation pending, takes value in seconds [120..86400].

Basic router configuration

Upon the first startup, the router configuration procedure includes the following steps:

• Changing password for "admin" user.
• Creation of new users.
• Assigning device name (Hostname).
• Setting parameters for public network connection in accordance with the provider requirements.
• Configuring remote connection to router.
• Applying basic settings.

Changing password for "admin" user

To ensure the secure system access, you should change the password for the privileged 'admin' user.

Username and password are required for login during the device administration sessions.

To change 'admin' password, use the following commands:

esr# configure
esr(config)# username admin
esr(config-user)# password <new-password>
esr(config-user)# exit

Creation of new users

Use the following commands to create a new system user or configure the username, password, or privilege level:

esr(config)# username <name>
esr(config-user)# password <password>	
esr(config-user)# privilege <privilege>
esr(config-user)# exit

Example of commands, that allow you to create user 'fedor' with password '12345678' and privilege level 15 and create user 'ivan' with password 'password' and privilege level '1':

esr# configure
esr(config)# username fedor
esr(config-user)# password 12345678
esr(config-user)# privilege 15
esr(config-user)# exit
esr(config)# username ivan
esr(config-user)# password password
esr(config-user)# privilege 1
esr(config-user)# exit

Example of commands, that allow you to create user 'fedor' with password '12345678' and privilege level 15 and create user 'ivan' with password 'password' and privilege level '1':

esr# configure
esr(config)# username fedor
esr(config-user)# password 12345678
esr(config-user)# privilege 15
esr(config-user)# exit
esr(config)# username ivan
esr(config-user)# password password
esr(config-user)# privilege 1
esr(config-user)# exit

Assigning device name

To assign the device name, use the following commands:

esr# configure
esr(config)# hostname <new-name>	

When a new configuration is applied, command prompt will change to the value specified by <new-name> parameter.

Configuration of public network parameters

To configure router network interface in the public network, you should assign parameters defined by the network provider – default IP address, subnet mask and gateway address – to the device.

Example of static IP address configuration commands for GigabitEthernet 1/0/2.150 sub-interface used for obtaining access to the router via VLAN 150.

Interface parameters:

• IP address: 192.168.16.144;
• Subnet mask: 255.255.255.0;
• Default gateway IP address: 192.168.16.1.

esr# configure
esr(config)# interface gigabitethernet 1/0/2.150
esr(config-subif)# ip address 192.168.16.144/24
esr(config-subif)# exit
esr(config)# ip route 0.0.0.0/0 192.168.16.1 

To ensure the correct IP address assigning for the interface, enter the following command when the configuration is applied:

esr# show ip interfaces

IP address            Interface                           Type
-------------------   ---------------------------------   -------
192.168.16.144/24     gigabitethernet 1/0/2.150           static

Provider may use dynamically assigned addresses in their network. If the there is DHCP server in the network, you can obtain the IP address via DHCP.

Configuration example for obtaining dynamic IP address from DHCP server on GigabitEthernet 1/0/10 interface:

esr# configure
esr(config)# interface gigabitethernet 1/0/10
esr(config-if)# ip address dhcp
esr(config-if)# exit

To ensure the correct IP address assigning for the interface, enter the following command when the configuration is applied:

esr# show ip interfaces

IP address            Interface                           Type
-------------------   ---------------------------------   -------
192.168.11.5/25       gigabitethernet 1/0/10              DHCP

Configuring remote connection to router

In the factory configuration, remote access to the router may be established via Telnet or SSH from the 'trusted' zone. To enable remote access to the router from other zones, e.g. from the public network, you should create the respective rules in the firewall.

When configuring access to the router, rules should be created for the following pair of zones:

• source-zone – zone that the remote access will originate from;
• self – zone which includes router management interface.

Use the following commands to create the allowing rule:

esr# configure
esr(config)# security zone-pair <source-zone> self
esr(config-zone-pair)# rule <number>
esr(config-zone-rule)# action permit
esr(config-zone-rule)# match protocol tcp
esr(config-zone-rule)# match source-address <network object-group>
esr(config-zone-rule)# match destination-address <network object-group>
esr(config-zone-rule)# match destination-port <service object-group>
esr(config-zone-rule)# enable
esr(config-zone-rule)# exit
esr(config-zone-pair)# exit

Example of commands that allow users from 'untrusted' zone with IP addresses in range 132.16.0.5-132.16.0.10 to connect to the router with IP address 40.13.1.22 via SSH:

esr# configure
esr(config)# object-group network clients
esr(config-addr-set)# ip address-range 132.16.0.5-132.16.0.10
esr(config-addr-set)# exit
esr(config)# object-group network gateway
esr(config-addr-set)# ip address-range 40.13.1.22
esr(config-addr-set)# exit
esr(config)# object-group service ssh
esr(config-port-set)# port-range 22
esr(config-port-set)# exit
esr(config)# security zone-pair untrusted self
esr(config-zone-pair)# rule 10
esr(config-zone-rule)# action permit
esr(config-zone-rule)# match protocol tcp
esr(config-zone-rule)# match source-address clients
esr(config-zone-rule)# match destination-address gateway
esr(config-zone-rule)# match destination-port ssh
esr(config-zone-rule)# enable
esr(config-zone-rule)# exit
esr(config-zone-pair)# exit

Firmware update

Updating firmware via system resources

To update the firmware for the device running the operating system, follow procedure described below.

1. Prepare the selected server for operation. You should know the server address; also firmware distributive file should be loaded onto the server.
2. The router should be prepared for operation according to the documentary requirements. Router configuration should allow for data exchange with the server via TFTP/FTP/SCP and ICMP protocols. At that, you should take into account the server inherence to the router security zones.
3. Connect to the router locally via Console port or remotely via Telnet or SSH.
   Check the server availability for the router using ping command on the router. If the server is not available, check the router settings and the status of the server network interfaces.
4. To update the router firmware, enter the following command. Specify IP address of the server being used as <server> For updates that utilize FTP or SCP server, you should enter a username (<user> parameter) and a password (<password> parameter). Specify the name of the firmware file loaded onto the server as <file_name> parameter (when using SCP, the full path must be as <folder> parameter). When the command is executed, router will copy the file into its internal memory, perform data integrity check and save it into non-volatile memory.

   TFTP:

   esr# copy tftp://<server>:/<file_name> system:firmware 

    FTP:

   esr# copy ftp://[<user>[:<password>]@]<server>:/<file_name> system:firmware

   SCP:

   esr# сору scp://[<user>[:<password>]@]<server>://<folder>/<file_name> system:firmware

   For example, let's update basic firmware via SCP:

   esr# сору scp://adm:password123@192.168.16.168://home/tftp/firmware system:firmware

5. To start the device with the new firmware version, you have to switch the active image. With show bootvar command, locate the image number, containing updated firmware.

   esr# show bootvar
   Image   Version                      Date                   Status         After reboot   
   -----  --------------               --------------------    ------------   ------------   
   1       1.0.7 build 141[f812808]     date 18/02/2015 time    Active         *
                                        16:12:54             
   
   2       1.0.7 build 141[f812808]     date 18/02/2015 time   Not Active
                                        16:12:54             

   Use the following command to select the image:

   esr# boot system image-[1|2] 

6. To update the secondary bootloader (U-Boot), enter the following command: Specify IP address of the server being used as <server> parameter. For updates that utilize FTP or SCP server, you should enter a username (<user> parameter) and a password (<password> parameter). Specify the name of the secondary bootloader onto the server as <file_name> parameter (when using SCP, the full path must be as <folder> parameter). When the command is executed, router will copy the file into its internal memory, perform data integrity check and save it into non-volatile memory.
   TFTP:

   esr# copy tftp://<server>:/<file_name> system:boot 

   FTP:

   esr# copy ftp://<server>:/<file_name> system:boot

   SCP:

   esr# copy scp://[<user>[:<password>]@]<server>://<folder>/<file_name> system:boot

Updating firmware via bootloader

Router firmware may be updated via the bootloader as follows:

1. When U-Boot finishes the router initialization, break the device startup with the <Esc> key.

   Configuring PoE...
   distribution 1 dest_threshold 0xa drop_timer 0x0
   Configuring POE in bypass mode
   NAE configuration done!
   initializing port 0, type 2.
   initializing port 1, type 2.
   SMC Endian Test:b81fb81f
   nae-0, nae-1
     =======Skip: Load SYS UCORE for old 8xxB1/3xxB0 revision on default.
   Hit any key to stop autoboot:  2

2. Specify TFTP server address:

   BRCM.XLP316Lite Rev B0.u-boot# setenv serverip 10.100.100.1
   Для версии 1.5 и выше: BRCM.XLP316Lite Rev B0.u-boot# serverip 10.100.100.1

3. Specify router IP address:

   BRCM.XLP316Lite Rev B0.u-boot# setenv ipaddr 10.100.100.2
   Для версии 1.5 и выше: BRCM.XLP316Lite Rev B0.u-boot# ipaddr 10.100.100.2

4. Specify the name of the frimware file on the TFTP server:

   Для версии 1.5 и выше: BRCM.XLP316Lite Rev B0.u-boot# firmware_file firmware

5. You may save the environment using 'saveenv' command for future updates.
6. Launch firmware update procedure

   BRCM.XLP316Lite Rev B0.u-boot# run tftp_update_image1
   

   Using nae-0-3 device
   TFTP from server 10.100.100.1; our IP address is 10.100.100.2
   Filename 'esr1000/firmware'.
   Load address: 0xa800000060000000
   Loading: TftpStart:TftpTimeoutMsecs = 10000, TftpTimeoutCountMax = 6
   #################################################################
   ################################################################# #################################################################
   #########################
   ####################################
   done
   Bytes transferred = 64453909 (3d77d15 hex)
   Device 0: MT29F8G08ABBCAH4 ... is now current device
   
   NAND erase: device 0 offset 0x1440000, size 0x6400000
   Bad block table found at page 262080, version 0x01
   Bad block table found at page 262016, version 0x01
   Erasing at 0x7800000 -- 1895825408% complete..
   OK
   
   NAND write: device 0 offset 0x1440000, size 0x6400000
   104857600 bytes written: OK

7. Install the downloaded firmware as an image to start the system and reboot the router:
   

   BRCM.XLP316Lite Rev B0.u-boot# run set_bootpart_1

   For version 1.5 and newer: BRCM.XLP316Lite Rev B0.u-boot# boot_system image1

   BRCM.XLP316Lite Rev B0.u-boot# reset

Secondary bootloader update (U-Boot)

Secondary bootloader initializes NAND and the router. During the update, a new file of the secondary bootloader is saved to the flash

To view the current version of the load file operating on the device, execute 'version' command in U-Boot CLI. Also, the version is displayed during the router startup:

BRCM.XLP316Lite Rev B0.u-boot# version

BRCM.XLP.U-Boot:1.1.0.47 (29/11/2016 – 19:00:24)

Firmware update procedure:

1. When U-Boot finishes the router initialization, break the device startup with the <Esc> key.

   Configuring PoE...
   distribution 1 dest_threshold 0xa drop_timer 0x0
   Configuring POE in bypass mode
   NAE configuration done!
   initializing port 0, type 2.
   initializing port 1, type 2.
   SMC Endian Test:b81fb81f
   nae-0, nae-1
     =======Skip: Load SYS UCORE for old 8xxB1/3xxB0 revision on default.
   Hit any key to stop autoboot:  2

2. Specify TFTP server address:
   

   BRCM.XLP316Lite Rev B0.u-boot# setenv serverip 10.100.100.1

   For version 1.5 and newer: BRCM.XLP316Lite Rev B0.u-boot# serverip 10.100.100.2

3. Specify router IP address:

   BRCM.XLP316Lite Rev B0.u-boot# setenv ipaddr 10.100.100.2

   For version 1.5 and newer: BRCM.XLP316Lite Rev B0.u-boot# ipaddr 10.100.100.2

4. Specify the name of the bootloader file on the TFTP server:
   

   For version 1.5 and newer: BRCM.XLP316Lite Rev B0.u-boot# uboot_ file u- boot. bin

5. You may save the environment using 'saveenv' command for future updates.
6. Launch firmware update procedure:
   

   BRCM.XLP316Lite Rev B0.u-boot# run upd_uboot

   For version 1.5 and newer: BRCM.XLP316LiteRevB0.u-boot# run tftp_update_uboot

   Using nae-1 device
   TFTP from server 10.100.100.1; our IP address is 10.100.100.2
   Filename 'esr1000/u-boot.bin'.
   Load address: 0xa800000078020000
   Loading: ###########################################################
   done
   Bytes transferred = 852648 (d02a8 hex)
   SF: Detected MX25L12805D with page size 256, total 16777216 bytes
   16384 KiB MX25L12805D at 0:0 is now current device

7. Reboot the router:
   

   BRCM.XLP316Lite Rev B0.u-boot# reset