The device is shipped to the consumer with the factory configuration installed that includes essential basic settings. Factory configuration allows using the router as a gateway with SNAT without applying any additional settings. Also, factory configuration contains settings that allow you to obtain network access to the device for advanced configuration.
To establish network connection, the configuration features 2 security zones named 'Trusted' for local area network and 'Untrusted' for public network. All interfaces are divided between two security zones:
This security zone includes the following interfaces:
for ESR-10/12V: GigabitEthernet 1/0/1;
for ESR-12VF/ESR-14VF: GigabitEthernet 1/0/1; GigabitEthernet 1/0/9;
for ESR-20: GigabitEthernet 1/0/1;
for ESR-21: GigabitEthernet 1/0/1;
for ESR-100/200: GigabitEthernet 1/0/1;
for ESR-1000/1500/3100: GigabitEthernet 1/0/1, TengigabitEthernet 1/0/1-2;
for ESR-1200/1700: GigabitEthernet 1/0/1, TengigabitEthernet 1/0/1, TengigabitEthernet 1/0/2;
This security zone includes the following interfaces:
for ESR-10: GigabitEthernet 1/0/2-6;
for ESR-12V(F)/ESR-14VF: GigabitEthernet 1/0/2-8;
for ESR-20: GigabitEthernet 1/0/2-4;
for ESR-21: GigabitEthernet 1/0/2-12;
for ESR-100: GigabitEthernet 1/0/2-4;
for ESR-200: GigabitEthernet 1/0/2-8;
for ESR-1000: GigabitEthernet 1/0/2-24;
for ESR-1200: GigabitEthernet 1/0/2-16, TengigabitEthernet 1/0/3-8;
for ESR-1500: GigabitEthernet 1/0/2-8, TengigabitEthernet 1/0/3-4;
for ESR-1700: GigabitEthernet 1/0/2-4, TengigabitEthernet 1/0/3-12;
for ESR-3100: GigabitEthernet 1/0/2-8, TengigabitEthernet 1/0/3-8;
for ESR-3200: Twentyfivegigabitethernet 1/0/3-12.
Zone interfaces are grouped into a single L2 segment via Bridge 2 network bridge.
On the Bridge 2 interface, DHCP client is enabled to obtain dynamic IP address from the provider. On Bridge 1 interface, static IP address 192.168.1.1/24 is configured. Created IP address acts as a gateway for LAN clients. For LAN clients, DHCP address pool 192.168.1.2-192.168.1.254 is configured with the mask 255.255.255.0. For clients in order to access the Internet, the router should have Source NAT service enabled.
Security zone policies have the following configuration:
Table 65 – Security zone policy description
Traffic origin zone | Traffic destination zone | Traffic type | Action |
|---|---|---|---|
Trusted | Untrusted | TCP, UDP, ICMP | enabled |
Trusted | Trusted | TCP, UDP, ICMP | enabled |
Trusted | self | TCP/22 (SSH), ICMP, UDP/67 (DHCP Server), UDP/123 (NTP) | enabled |
Untrusted | self | UDP/68 (DHCP Client) | enabled |
To enable device configuration on the first startup, 'admin' user with 'password' password has been created in the router configuration. The user will be prompted to change administrator password during the initial configuration of the router. |
To enable network access to the router on the first startup, static IP address 192.168.1.1/24 has been configured on Bridge 1 interface. |
ESR series routers and WLC controllers are intended to perform border gateway functions and securing the user network when it is connected to public data networks.
Basic router configuration should include:
Advanced settings depend on the requirements of the specific device application pattern and may be easily added or modified with the existing management interfaces.
There are several device connection options:
Upon the initial startup, the device starts with the factory configuration. |
Connect the network data cable (patch cord) to any port within the 'Trusted' zone and to the PC intended for management tasks.
In the router factory configuration, DHCP server is enabled with IP address pool in 192.168.1.0/24 subnet.
When network interface is connected to the management computer, the latter should obtain the network address from the server.
If IP address is not obtained for some reason, assign the interface address manually using any address except for 192.168.1.1 in 192.168.1.0/24 subnet.
Using RJ-45/DBF9 cable included into device delivery package, connect the router 'Console' port to the computer RS-232 port.
Launch terminal application (e.g. HyperTerminal or Minicom) and create a new connection. VT100 terminal emulation mode should be used.
Specify the following settings for RS-232 interface:
Data rate: 115200 bps |
Any changes made in the configuration will take effect only after applying the command:
esr# commit Configuration has been successfully committed |
After applying the command above, the configuration rollback timer is started. To stop the timer and rollback mechanism, use the following command:
esr# confirm Configuration has been successfully confirmed |
The default 'rollback' timer value is 600 seconds. To change this timer, use the command:
esr(config)# system config-confirm timeout <TIME> |
Upon the first startup, the device configuration procedure includes the following steps:
To ensure the secure system access, you should change the password for the privileged 'admin' user.
'techsupport' account ('eltex' up to version 1.0.7) is required for service centre specialist remote access. 'remote' account – RADIUS, TACACS+, LDAP authentication. 'admin', 'techsupport', 'remote' users cannot be deleted. Only passwords and a privilege level can be changed. |
If information about 'admin' user is not displayed in the configuration, then the parameters of this user are configured by default ('password' password, privilege level 15). |
Username and password are required for login during the device administration sessions.
To change 'admin' password, use the following commands:
esr# configure esr(config)# username admin esr(config-user)# password <new-password> esr(config-user)# exit |
Use the following commands to create a new system user or configure the username, password, or privilege level:
esr(config)# username <name> esr(config-user)# password <password> esr(config-user)# privilege <privilege> esr(config-user)# exit |
Privilege levels 1–9 allow accessing the device and viewing its operation status, but the device configuration is disabled. Privilege levels 10-14 allow both the access to the device and configuration of majority of its functions. Privilege level 15 allows both the access to the device and configuration of all its functions. |
Example of commands, that allow you to create user 'fedor' with password '12345678' and privilege level 15 and create user 'ivan' with password 'password' and privilege level '1':
esr# configure esr(config)# username fedor esr(config-user)# password 12345678 esr(config-user)# privilege 15 esr(config-user)# exit esr(config)# username ivan esr(config-user)# password password esr(config-user)# privilege 1 esr(config-user)# exit |
To assign the device name, use the following commands:
esr# configure esr(config)# hostname <new-name> |
When a new configuration is applied, command prompt will change to the value specified by <new-name> parameter.
To configure router network interface in the public network, you should assign parameters defined by the network provider – default IP address, subnet mask and gateway address – to the device.
Example of static IP address configuration commands for Gigabit Ethernet 1/0/2.150 sub-interface used for obtaining access to the device via VLAN 150.
Interface parameters:
esr# configure esr(config)# interface gigabitethernet 1/0/2.150 esr(config-subif)# ip address 192.168.16.144/24 esr(config-subif)# exit esr(config)# ip route 0.0.0.0/0 192.168.16.1 |
To ensure the correct IP address assigning for the interface, enter the following command when the configuration is applied:
esr# show ip interfaces IP address Interface Type ------------------- --------------------------------- ------- 192.168.16.144/24 gigabitethernet 1/0/2.150 static |
Provider may use dynamically assigned addresses in their network. If the there is DHCP server in the network, you can obtain the IP address via DHCP.
Configuration example for obtaining dynamic IP address from DHCP server on Gigabit Ethernet 1/0/10 interface:
esr# configure esr(config)# interface gigabitethernet 1/0/10 esr(config-if)# ip address dhcp esr(config-if)# exit |
To ensure the correct IP address assigning for the interface, enter the following command when the configuration is applied:
esr# show ip interfaces IP address Interface Type ------------------- --------------------------------- ------- 192.168.11.5/25 gigabitethernet 1/0/10 DHCP |
In the factory configuration, remote access to the router or controller may be established via Telnet or SSH from the 'trusted' zone. To enable remote access to the router or controller from other zones, e.g. from the public network, you should create the respective rules in the firewall.
When configuring access to the router or controller, rules should be created for the following pair of zones:
Use the following commands to create the allowing rule:
esr# configure esr(config)# security zone-pair <source-zone> self esr(config-zone-pair)# rule <number> esr(config-zone-rule)# action permit esr(config-zone-rule)# match protocol tcp esr(config-zone-rule)# match source-address <network object-group> esr(config-zone-rule)# match destination-address <network object-group> esr(config-zone-rule)# match destination-port <service object-group> esr(config-zone-rule)# enable esr(config-zone-rule)# exit esr(config-zone-pair)# exit |
Example of commands that allow users from 'untrusted' zone with IP addresses in range 132.16.0.5-132.16.0.10 to connect to the device with IP address 40.13.1.22 via SSH:
esr# configure esr(config)# object-group network clients esr(config-addr-set)# ip address-range 132.16.0.5-132.16.0.10 esr(config-addr-set)# exit esr(config)# object-group network gateway esr(config-addr-set)# ip address-range 40.13.1.22 esr(config-addr-set)# exit esr(config)# object-group service ssh esr(config-port-set)# port-range 22 esr(config-port-set)# exit esr(config)# security zone-pair untrusted self esr(config-zone-pair)# rule 10 esr(config-zone-rule)# action permit esr(config-zone-rule)# match protocol tcp esr(config-zone-rule)# match source-address clients esr(config-zone-rule)# match destination-address gateway esr(config-zone-rule)# match destination-port ssh esr(config-zone-rule)# enable esr(config-zone-rule)# exit esr(config-zone-pair)# exit |