...
- default-router – IP address of the router used as default gateway;
- domain-name – domain name which will be used by client while solving host names via domain name system (DNS);
- dns-server – list of domain name server addresses for the current network that should be known by the client. Server addresses are listed in descending order of their preference.
Configuration algorithm
Step | Description | Command | Keys |
---|---|---|---|
1 | Enable IPv4/IPv6 DHCP server. | esr(config)# ip dhcp-server [vrf <VRF>] | <VRF> – VRF instance name, set by the string of up to 31 characters, within which the NTP server will operate. Set by the string of up to 31 characters. |
esr(config)# ipv6 dhcp-server [vrf <VRF>] | |||
2 | Set the DSCP code value for the use in IP headers of DHCP server egress packets (optional). | esr(config)# ip dhcp-server dscp <DSCP> | <DSCP> – DSCP code value, takes values in the range of [0..63]. Default value: 61. |
3 | Create pool of DHCP server IPv4/IPv6 addresses and switch to its configuration mode. | esr(config)# ip dhcp-server pool <NAME> [vrf <VRF>] | <NAME> – IPv4/IPv6 server profile name, set by the string of up to 31 characters. <VRF> – VRF instance name, within which the NTP server will operate. Set by the string of up to 31 characters. |
esr(config)# ipv6 dhcp-server pool <NAME> [vrf <VRF>] | |||
4 | Specify IPv4/IPv6 address and mask for the subnet from which IPv4/IPv6 addresses pool will be allocated. | esr(config-dhcp-server)# network <ADDR/LEN> | <ADDR/LEN> – IP address and prefix of a subnet, defined as AAA.BBB.CCC.DDD/EE where each part AAA-DDD takes values of [0..255] and EE takes values of [1..32]. |
esr(config-ipv6-dhcp-server)# network <IPV6-ADDR/LEN> | <IPV6-ADDR/LEN> – IP address and prefix of a subnet, defined as X:X:X:X::X/EE where each X part takes values in hexadecimal format [0..FFFF] and EE takes values of [1..128]. | ||
5 | Add IPv4/IPv6 addresses range to the address pool of configurable DHCP server. | esr(config-dhcp-server)# address-range <FROM-ADDR>-<TO-ADDR> | <FROM-ADDR> – range starting IP address; <TO-ADDR> – range ending IP address; The addresses are defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]. You can specify up to 32 IP addresses separated by commas. |
esr(config-ipv6-dhcp-server)# address-range <FROM-ADDR>-<TO-ADDR> | <FROM-ADDR> – range starting IP address; <TO-ADDR> – range ending IP address; The addresses are defined as X:X:X:X::X where each part takes values in hexadecimal format [0..FFFF]. | ||
6 | Add IPv4/IPv6 address for a specific physical address to the address pool of configurable DHCP server (optional). | esr(config-dhcp-server)# address <ADDR> | <ADDR> – client IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]; <MAC> – MAC address of the client, which will be given the IP address, is defined as XX: XX: XX: XX: XX: XX where each part takes the values of [00..FF]. <CI> – client identifier according to DHCPOption61. Can be specified as follows:
|
esr(config-ipv6-dhcp-server)# address <ADDR> mac-address <MAC> | <IPV6-ADDR> – client IPv6 address, defined as X:X:X:X::X where each part takes values in hexadecimal format [0..FFFF]; <MAC> – MAC address of the client, which will be given the IP address, defined as XX: XX: XX: XX: XX: XX where each part takes the values of [00..FF]. | ||
7 | Specify the list of default gateway IPv4 addresses which will be transmitted by DHCP server to clients through DHCP option 3. | esr(config-dhcp-server)# default-router <ADDR> | <ADDR> – default gateway IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]. Up to 8 IP addresses can be specified separated by commas. |
8 | Specify network domain DNS name. Domain name is transmitted to clients as part of DHCP option 15 (optional). | esr(config-dhcp-server)# domain-name <NAME> | <NAME> – router domain name, set by the string from 1 to 255 characters. |
esr(config-ipv6-dhcp-server)# domain-name <NAME> | |||
9 | Specify DNS server IPv4/IPv6 addresses list. The list is transmitted to clients as part of DHCP option 6 (optional). | esr(config-dhcp-server)# dns-server <ADDR> | <ADDR> – DNS server IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]. Up to 8 IP addresses can be specified separated by commas. |
esr(config-ipv6-dhcp-server)# dns-server <IPV6-ADDR> | <IPV6-ADDR> – DNS server IPv6 address, defined as X:X:X:X::X where each part takes values in hexadecimal format [0..FFFF]. Up to 8 IP addresses can be specified separated by commas. | ||
10 | Specify maximum IP addresses lease time (optional). If DHCP client requests the lease time that exceeds a maximum value, the time specified by the command will be set. | esr(config-dhcp-server)# max-lease-time <TIME> | <TIME> – maximal IP address lease time, sets in format DD:HH:MM, where:
Default value: 1 day. |
esr(config-ipv6-dhcp-server)# max-lease-time <TIME> | |||
11 | Specify the lease time for which a client will be given IP address (optional). This time will be used if a client did not request the certain lease time. | esr(config-dhcp-server)# default-lease-time <TIME> | <TIME> – maximal IP address lease time, sets in format DD:HH:MM, where:
Default value: 12 hours. |
esr(config-ipv6-dhcp-server)# default-lease-time <TIME> | |||
12 | Create supplier class identifier (DHCP Option 60) (optional). | esr(config)# ip dhcp-server vendor-class-id <NAME> | <NAME> – carrier class identifier, set by the string of up to 31 characters. |
esr(config)# ipv6 dhcp-server vendor-class-id <NAME> | |||
13 | Specify specific supplier information (DHCP Option 43). | esr(config-dhcp-vendor-id)# vendor-specific-options <HEX> | <HEX> – vendor-specific information, specified in hexadecimal format up to 128 symbols. |
esr(config-ipv6-dhcp-vendor-id)# vendor-specific-options <HEX> | |||
14 | Specify NetBIOS server IP address (DHCP option 44) (optional). | esr(config-dhcp-server)# netbios-name-server <ADDR> | <ADDR> – NetBIOS server IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]. Up to 4 IP addresses can be specified. |
15 | Specify TFTP server IP address (DHCP option 150) (optional). | esr(config-dhcp-server)# tftp-server <ADDR> | <ADDR> – DNS server IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]. |
Configuration example
Objective:
...
DNAT is used for redirection of traffic, coming to a specific 'virtual' address in a public network, to a 'real' server in LAN located behind the network gateway. This function may be used for establishing a public access to servers located within the private network without any public network address.
Configuration algorithm
Step | Description | Command | Keys |
---|---|---|---|
1 | Switch to the configuration mode of destination address translation service. | esr(config)# nat destination | |
2 | Create a pool of IP addresses and/or TCP/UDP ports with a specific name (optional). | esr(config-dnat)# pool <NAME> | <NAME> – NAT addresses pool name, set by the string of up to 31 characters. |
3 | Set the internal IP address which will replace a destination IP address. | esr(config-dnat-pool)# ip address <ADDR> | <ADDR> – IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]. |
4 | Set the internal TCP/UDP port which will replace a destination TCP/UDP port. | esr(config-dnat-pool)# ip port <PORT> | <PORT> – TCP/UDP port, takes values of [1..65535]. |
5 | Create a rule group with a specific name. | esr(config-dnat)# ruleset <NAME> | <NAME> – rule group name, set by the string of up to 31 characters. |
6 | Specify VRF instance, in which the given rule group will operate (optional). | esr(config-dnat-ruleset)# ip vrf forwarding <VRF> | <VRF> – VRF name, set by the string of up to 31 characters. |
7 | Set the rule group scope. The rules will be applied only to traffic coming from a certain zone or interface. | esr(config-dnat-ruleset)# from { zone <NAME> | <NAME> – isolation zone name; <IF> – device interface name; <TUN> – device tunnel name; default – denotes a group of rules for all traffic, the source of which did not fall under the criteria of other groups of rules. |
8 | Specify a rule with a certain number. The rules are proceeded in ascending order. | esr(config-dnat-ruleset)# rule <ORDER> | <ORDER> – rule number, takes values of [1..10000]. |
9 | Specify the profile of IP addresses {sender | recipient} for which the rule should work. | esr(config-dnat-rule)# match [not] | <OBJ-GROUP-NETWORK-NAME> – IP addresses profile name, set by the string of up to 31 characters. 'Any' value points at any source IP address. |
10 | Specify the profile of services (TCP/UDP ports) {sender | recipient} for which the rule should work (optional). | esr(config-dnat-rule)# match [not] | <PORT-SET-NAME> – port profile name, set by the string of up to 31 characters. 'Any' value points at any source TCP/UDP port. |
11 | Set name or number of IP for which the rule should work (optional). | esr(config-dnat-rule)# match [not] | <TYPE> – protocol type, takes the following values: esp, icmp, ah, eigrp, ospf, igmp, ipip, tcp, pim, udp, vrrp, rdp, l2tp, gre. 'Any' value points at any protocol type. <ID> – IP identification number, takes values of [0x00-0xFF]. |
12 | Specify the type and code of ICMP messages for which the rule should work (if ICMP is selected as protocol) (optional). | esr(config-dnat-rule)# match [not] | <ICMP_TYPE> – ICMP message type, takes values of [0..255]. <ICMP_CODE> – ICMP message code, takes values of [0..255]. 'Any' value points at any message code. <TYPE-NAME> – ICMP message type name. |
13 | Specify the action 'translation of source address and port' for the traffic meeting the requirements of 'match' commands. | esr(config-dnat-rule)# action destination-nat | off – translation is disabled; pool<NAME> – name of the pool that contains IP addresses and/or TCP/UDP ports set; netmap <ADDR/LEN> – subnet IP address and mask used during translation. The parameter is defined as AAA.BBB.CCC.DDD/EE where each part AAA-DDD takes values of [0..255] and EE takes values of [1..32]. |
14 | Activate a configured rule. | esr(config-dnat-rule)# enable | |
15 | Enable application layer session tracking for FTP, SIP, H323, netbios-ns, PPTP protocols (optional). | esr(config)# ip firewall sessions tracking {<PROTOCOL> | sip [ port <OBJECT-GROUP-SERVICE> ] | all} | all – enables application layer session tracking for all available protocols; <PROTOCOL> – application layer protocol whose sessions need to be monitored, takes values of [ftp, h323, pptp, netbios-ns]; <OBJECT-GROUP-SERVICE> – profile name of the TCP/UDP ports of the sip session, specified as a string of up to 31 characters. If the group is not specified, then sip sessions will be monitored for port 5060. |
16 | Enable IP address translation in application level headers (optional). | esr(config)# nat alg {<PROTOCOL> | all} | all – enables IP address translation in headers of all available protocols; <PROTOCOL> – application layer protocol in whose headers address translation should work, takes values of [ftp, h323, pptp, netbios-ns]. |
Якорь | ||||
---|---|---|---|---|
|
Примечание |
---|
When using the not key, the rule will work for values which are not included in a specified profile. Each 'match' command may contain 'not' key. When using the key, packets that do not meet the given requirement will fall under the rule. For more information about router configuration, see 'CLI command reference guide'. |
Destination NAT configuration example
...
Establish access from the public network, that belongs to the 'UNTRUST' zone, to LAN server in 'TRUST' zone. Server address in LAN – 10.1.1.100. Server should be accessible from outside the network–address 1.2.3.4, access port 80.
Scroll Pagebreak |
---|
Create 'UNTRUST' and 'TRUST' security zones. Specify the inherence of the network interfaces being used to zones. Assign IP addresses to interfaces simultaneously.
...
Якорь | ||||
---|---|---|---|---|
|
Configuration algorithm
Step | Description | Command | Keys |
---|---|---|---|
1 | Switch to the configuration mode of source address translation service. | esr(config)# nat source | |
2 | Create a pool of IP addresses and/or TCP/UDP ports with a specific name (optional). | esr(config-snat)# pool <NAME> | <NAME> – NAT addresses pool name, set by the string of up to 31 characters. |
3 | Set the range of IP addresses which will replace a source IP address. | esr(config-snat-pool)# ip address-range <IP>[-<ENDIP>] | <IP> – IP address of the beginning of the range, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]; <ENDIP> – IP address of the end of the range, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]. If IP address of the end of the range is not specified, only IP address of the beginning of the range is used as IP address for translation. |
4 | Specify the range of external TCP/UDP ports which will replace a source TCP/UDP port. | esr(config-snat-pool)# ip port-range <PORT>[-<ENDPORT>] | <PORT> – TCP/UDP port of the beginning of range, takes values of [1..65535]; <ENDPORT> – TCP/UDP port of the end of range, takes values of [1..65535]. If TCP/UDP port of the end of the range is not specified, only TCP/UDP port of the beginning of the range is used as TCP/UDP port for translation. |
5 | Set external TCP/UDP port which will replace a source TCP/UDP port. | esr(config-snat-pool)# ip port <PORT> | <PORT> – TCP/UDP port, takes values of [1..65535]. |
6 | Enable NAT persistent functions. | esr(config-snat-pool)# persistent | |
7 | Create a rule group with a specific name. | esr(config-snat)# ruleset <NAME> | <NAME> – rule group name, set by the string of up to 31 characters. |
8 | Specify VRF instance, in which the given rule group will operate (optionally). | esr(config-snat-ruleset)# ip vrf forwarding <VRF> | <VRF> – VRF name, set by the string of up to 31 characters. |
9 | Set the rule group scope. The rules will be applied only to traffic coming to a certain zone or interface. | esr(config-snat-ruleset)# to { zone <NAME> | | <NAME> – isolation zone name; <IF> – device interface name; <TUN> – device tunnel name |
10 | Specify a rule with a certain number. The rules are proceeded in ascending order. | esr(config-snat-ruleset)# rule <ORDER> | <ORDER> – rule number, takes values of [1..10000]. |
11 | Specify the profile of IP addresses {sender | recipient} for which the rule should work. | esr(config-snat-rule)# match [not] | <OBJ-GROUP-NETWORK-NAME> – IP addresses profile name, set by the string of up to 31 characters. 'Any' value points at any source IP address. |
12 | Specify the profile of IP addresses {sender| recipient} for which the rule should work (optional). | esr(config-snat-rule)# match [not] | <PORT-SET-NAME> – port profile name, set by the string of up to 31 characters. 'Any' value points at any source TCP/UDP port. |
13 | Set name or number of IP for which the rule should work (optional). | esr(config-snat-rule)# match [not] | <TYPE> – protocol type, takes the following values: esp, icmp, ah, eigrp, ospf, igmp, ipip, tcp, pim, udp, vrrp, rdp, l2tp, gre. 'Any' value points at any protocol type. <ID> – IP identification number, takes values of [0x00-0xFF]. |
14 | Specify the type and code of ICMP messages for which the rule should work (optional). | esr(config-snat-rule)# match [not] | <ICMP_TYPE> – ICMP message type, takes values of [0..255]. <ICMP_CODE> – ICMP message code, takes values of [0..255]. 'Any' value points at any message code. <TYPE-NAME> – ICMP message type name |
15 | Specify the action 'translation of source address and port' for the traffic meeting the requirements of 'match' command. | esr(config-snat-rule)# action source-nat { off | | off – translation is disabled; pool<NAME> – name of the pool that contains IP addresses and/or TCP/UDP ports set; netmap <ADDR/LEN> – subnet IP address and mask used during translation; static – option for static NAT organization. The parameter is defined as AAA.BBB.CCC.DDD/EE where each part AAA-DDD takes values of [0..255] and EE takes values of [1..32]. interface [FIRST_PORT – LAST_PORT] – specify the translation to the interface IP address. If the range of TCP/UDP ports is additionally specified, the translation will occur only for the sender TCP/UDP ports included in the specified range. |
16 | Activate a configured rule. | esr(config-snat-rule)# enable | |
17 | Enable application layer session tracking for FTP, SIP, H323, netbios-ns, PPTP protocols (optional). | esr(config)# ip firewall sessions tracking {<PROTOCOL> | sip [ port <OBJECT-GROUP-SERVICE> ] | all} | all – enables application layer session tracking for all available protocols; <PROTOCOL> – application layer protocol whose sessions need to be monitored, takes values of [ftp, h323, pptp, netbios-ns]; <OBJECT-GROUP-SERVICE> – profile name of the TCP/UDP ports of the sip session, specified as a string of up to 31 characters. If the group is not specified, then sip sessions will be monitored for port 5060. |
18 | Enable IP address translation in application level headers (optional). | esr(config)# nat alg {<PROTOCOL> | all} | all – enables IP address translation in headers of all available protocols; <PROTOCOL> – application layer protocol whose sessions need to be monitored, takes values of [ftp, h323, pptp, netbios-ns]. |
Якорь Source_NAT_desc Source_NAT_desc
...
Якорь | ||||
---|---|---|---|---|
|
Configuration algorithm
Step | Description | Command | Keys |
---|---|---|---|
1 | Create an object with a URL. | esr(config)# object-group url <NAME> | |
2 | Specify the set. | esr(config-object-group-url)# url <URL> | <URL> – web page, site address. |
3 | Create proxy profile. | esr(config)# ip http profile <NAME> | <NAME> – profile name. |
4 | Choose default action. | esr(config-profile)# default action {deny|permit|redirect} | <URL> – address of the host to which requests will be sent. |
5 | Specify description (optional). | esr(config-profile)# description <description> | <description> – up to 255 characters. |
6 | Specify a remote or local URL list and type of operation (block/traffic pass/redirect) (optional). | esr(config-profile)# urls {local|remote} <URL_OBJ_GROUP_NAME> | <URL_OBJ_GROUP_NAME> – specify the name of the object containing the URL set. |
7 | Specify the remote server where the necessary URL lists are (optional). | esr(config)# ip http proxy server-url <URL> | <URL> – server address where remote url lists will be taken from. |
8 | Specify a listening port for proxying (optional). | esr(config)# ip http proxy listen-ports <OBJ_GROUP_NAME> | <OBJ_GROUP_NAME> – port profile name, set by string of up to 31 characters. |
9 | Specify a listening port for proxying (optional). | esr(config)# ip https proxy listen-ports <OBJ_GROUP_NAME> | <OBJ_GROUP_NAME> – port profile name, set by string of up to 31 characters. |
10 | Specify a base port for proxying (optional). | esr(config)# ip https proxy redirect-port <PORT> | <PORT> – port number, set in the range of [1..65535]. Default value: 3128. |
11 | Enable proxying on the interface based on the selected HTTP profile. | esr(config-if)# ip http proxy <PROFILE_NAME> | <PROFILE_NAME> – profile name. |
12 | Enable proxying on the interface based on the selected HTTPS profile. | esr(config-if)# ip https proxy <PROFILE_NAME> | <PROFILE_NAME> – profile name. |
13 | Create services lists which will be used during filtration. | esr(config)# object-group service <obj-group-name> | <obj-group-name> – service profile name, set by the string of up to 31 characters. |
14 | Specify services list description (optional). | esr(config-object-group-service)# description <description> | <description> – profile description, set by the string of up to 255 characters. |
15 | Add necessary services (TCP/UDP ports) to the list. | esr(config-object-group-service)# port-range 3128-3135 | ESR proxy server uses for its operation the ports starting from the base port defined in step 10. The http proxy uses ports from base port to base port + the number of cpu of this ESR model - 1. For https proxy, the ports used are from base port + number of cpu of the given ESR model to base port + number of cpu of the given ESR model * 2 - 1. |
16 | Create an interzone interaction rule set. | esr(config)# security zone-pair <src-zone-name1> self | <src-zone-name> – security zone in which the interfaces with the ip http proxy or ip https proxy function are located. self – a predefined security zone for traffic entering the ESR itself. |
17 | Create an interzone interaction rule set. | esr(config-zone-pair)# rule <rule-number> | <rule-number> – 1..10000. |
18 | Specify rule description (optional). | esr(config-zone-rule)# description <description> | <description> – up to 255 characters.. |
19 | Specify the given rule force. | esr(config-zone-rule)# action <action> [ log ] | <action> – permit. log – activation key for logging of sessions established according to this rule. |
20 | Set name of IP protocol for which the rule should work. | esr(config-zone-rule)# match protocol <protocol-type> | <protocol-type> – TCP. ESR proxy server uses ESR protocol. |
21 | Set the destination TCP/UDP ports profile for which the rule should work (if the protocol is specified). | esr(config-zone-rule)# match [not] | <obj-group-name> – name of the service profile created in step 12. |
22 | Create an interzone interaction rule. | esr(config-zone-rule)# enable |
Примечание |
---|
If the Firewall function on the ESR is not forcibly disabled, create an allow rule for the Self zone. |
...
NTP (Network Time Protocol) — network protocol for synchronizing the internal clock of equipment using IP networks, uses the UDP protocol for its operation, takes into account transmission times and uses algorithms to achieve high precision time synchronization.
Configuration algorithm
Step | Description | Command | Keys |
---|---|---|---|
1 | Enable NTP. | esr(config)# ntp enable | |
2 | Set the IP address of the NTP server or NTP synchronization participant. | esr(config)# ntp { server | peer } { <IP> } | <IP> – destination IP address (gateway), defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]. |
3 | Set authentication key (optional). | esr(config-ntp)# key <ID> | <ID> – key identifier, set in the range of [1..255]. |
4 | Set the maximum time interval between sending messages to the NTP server (optional). | esr(config-ntp)# maxpoll <INTERVAL> | <INTERVAL> – maximum value of poll interval. The command parameter is used as an indicator of the power of two when calculating the interval durability in seconds; it is calculated by raising two to power that is specified by the command parameter, takes the value of [10..17]. Default value: 10 (210 = 1024 seconds or 17 minutes 4 seconds). |
5 | Set the minimum time interval between sending messages to the NTP server (optional). | esr(config-ntp)# minpoll <INTERVAL> | <INTERVAL> – minimum value of poll interval in seconds; it is calculated by raising two to power that is specified by the command parameter, takes the value of [4..6]. Default value: 6 (26 = 64 seconds or 1 minutes 4 seconds). |
6 | Mark this NTP server as preferred (optional). | esr(config-ntp)# prefer | |
7 | Define a list of trusted IP addresses with which ntp packets can be exchanged (optional). | esr(config)# ntp access-addresses <NAME> | <NAME> – IP addresses profile name, set by the string of up to 31 characters. |
8 | Specify the key ID from the key binding profile (optional). | esr(config)# ntp authentication trusted-key <ID> | <ID> – key ID from the key binding profile. |
9 | Specify the key binding profile name (optional). | esr(config)# ntp authentication key-chain <WORD> | <WORD> – key binding profile name. |
10 | Activate key-based authentication for NTP (optional). | esr(config)# ntp authentication enable | |
11 | Enable the mode of receiving broadcast messages from NTP servers for the global configuration and all existing VRFs (optional). | esr(config)# ntp broadcast-client enable | |
12 | Set the DSCP code value for the use in IP headers of NTP server egress packets (optional). | esr(config)# ntp dscp <DSCP> | <DSCP> – DSCP code value, takes values in the range of [0..63] Default value: 46. |
13 | Enable query-only mode that limits interaction via NTP for a certain profile of IP addresses (optional). | esr(config)# ntp object-group query-only <NAME> | <NAME> – IP addresses profile name, set by the string of up to 31 characters. |
14 | Enable serve-only mode that limits interaction via NTP for a certain profile of IP addresses (optional). | esr(config)# ntp object-group serve-only <NAME> | <NAME> – IP addresses profile name, set by the string of up to 31 characters. |
15 | Specify source-IP addresses for NTP packets for all peers (optional). | esr(config)# ntp source address <ADDR> | <ADDR> – IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]. |
16 | Set the current time and date manually (optional). | esr# set date <TIME> [<DAY> <MONTH> [ <YEAR> ] ] | <TIME> – system timer, defined as HH:MM:SS, where:
<MONTH> – month, takes the following values [January/February/March/April/May/June/July/August/September/October/November/December]; <YEAR> – year, takes values of [2001..2037]. |
Configuration example
Objective:
...