Home

FireBrick FB6202 User Manual

1. Value Description KERN Kernel messages USER User level messges MAIL Mail system DAEMON System Daemons AUTH Security auth SYSLOG Internal to syslogd LPR Printer NEWS News UUCP UUCP CRON Cron deamon AUTHPRIV private security auth FTP File transfer 12 Unused 13 Unused 14 Unused 15 Unused LOCALO Local 0 LOCAL1 Local 1 LOCAL2 Local 2 LOCAL3 Local 3 LOCAL4 Local 4 136 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects LOCALS Local 5 LOCAL6 Local 6 LOCAL7 Local 7 H 3 6 month Month name 3 letter Table H 70 month Month name 3 letter Value Description Jan January Feb February Mar March Apr April May May Jun June Jul July Aug August Sep September Oct October Nov November Dec December H 3 7 day Day name 3 letter Table H 71 day Day name 3 letter Value Description Sun Sunday Mon Monday Tue Tuesday Wed Wednesday Thu Thursday Fri Friday Sat Saturday H 3 8 radiuspriority Options for controlling platform RADIUS response priority tagging Table H 72 radiuspriority Options for controlling platform RADIUS response priority tagging Value Description equal All the same priority strict random In order specified Random order
2. bgp bgpmode false BGP announce mode for routes comment string Comment ip List of IPPrefix Not optional One or more network prefixes localpref unsignedInt 4294967295 Localpref of network highest wins name string Name profile NMTOKEN Profile name source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable tag List of Community List of community tags H 2 33 loopback Locally originated networks Loopback addresses define local IP addresses Table H 42 loopback Attributes H 2 34 bgp Overall BGP settings Attribute Type Default Description as path List up to 10 Custom AS path as if network received unsignedInt bgp bgpmode BGP announce mode for routes comment string Comment ip List of IPAddr Not optional One or more local network addresses localpref unsignedInt 4294967295 Localpref of network highest wins name string Name profile NMTOKEN Profile name source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable tag List of Community List of community tags The BGP element defines general BGP settings and a list of peer definitions for the individual BGP peers Table H 43 bgp Attributes Attribute Type Default Description as unsignedInt Our AS cluster id IP4Ad
3. name List of string Not optional Host names can use as a partof a domain profile NMTOKEN Profile name restrict List of List of IP ranges to which this is served IPNameRange source string Source of data used in automated config management ttl unsignedInt 60 Time to live H 2 15 radius service RADIUS service definition RADIUS server and proxy definitions Table H 20 radius service Attributes Attribute Type Default Description acct port unsignedShort 1813 Accounting UDP port auth port unsignedShort 1812 Authentication UDP port lauthenticator boolean Require message authenticator backup ip List of IPNameAddr Target IP s or hostname for backup L2TP connection class string Class field to send comment string Comment Jcontext name string J Juniper Context Name SIN502 control port unsignedShort 3799 Control UDP port CoA DM dummy ip boolean true Send dummy framed IP response log NMTOKEN Not logging Log events llog debug NMTOKEN log deba gt log error NMTOKEN Log as event Log errors nsn conditional boolean Only send NSN settings if username is not same as calling station id nsn tunnel override unsignedByte Additional response for GGSN usage username Jnsn tunnel user funsignedmt Additional response for GGSN usage auth method order radiuspriority Priority tagging of endpoin
4. med unsignedInt Set MED prefix List of 1PFilter Drop all that are not in this prefix list source string Source of data used in automated config management tag List of Community List of community tags to add Table H 48 bgpmap Elements Element Type Instances Description match bgprule Optional unlimited List rules in order of checking H 2 37 bgprule Individual mapping filtering rule An individual rule for BGP mapping filtering Table H 49 bgprule Attributes Attribute Type Default Description comment string Comment community Community Community that must be present to match detag List of Community List of community tags to remove drop boolean Do not import export this prefix localpref unsignedInt Set localpref highest wins med unsignedInt Set MED name string Name no community Community Community that must not be present to match pad unsignedByte Pad prefix stuff our AS on export by this many can be zero to not send our AS prefix List of 1PFilter Prefixes that this rule applies to source string Source of data used in automated config management tag List of Community List of community tags to add H 2 38 cqm Constant Quality Monitoring settings Constant quality monitoring graphs and data have a number of settings Most of the graphing settings can be ove
5. Not supported ignored D 14 Set Link Info Table D 14 SLI AVP No Incoming Outgoing 83 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported L2TP Attribute Value Pairs Message Type 0 Value 16 Value 16 Not supported ignored D 15 Notes D 15 1 BT specific notes The L2TP and PPP specifications are clear that the HDLC framing bytes are not sent or received within the L2TP packet However BT send type bytes FFO3 on the start of all PPP frames This is silently discarded Also BT will not process packets if these type bytes are not included in outgoing packets Sending the HDLC framing can be controlled in the config and on a per session basis using a Filter Id in RADIUS authentication response BT sometimes negotiate incorrect MRUs on behalf of the LNS Where the L2TP proxy details indicate and incorrect MRU has been negotiated then LCP negotiation is restarted and the correct MRU negotiates This helps avoid various issues with fragmentation on some services on the internet when the broadband fully supports 1500 byte MTU This is also relevant where the FB6000 is deliberately configured to use a smaller MRU for example when the L2TP connection is remote via a 1500 MTU link There are options using Filter Id from RADIUS to force LCP restart However this does confuse some ppp implementations as it is after authentication is complete This can be us
6. www voipon co uk sales voipon co uk 137 Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects calling Hashed on calling station id called Hashed on called station id username Hashed on full username user Hashed on username before realm Hashed on username after prefix Hashed on username initial letters and numbers only H 3 9 radiustype Type of RADIUS server Table H 73 radiustype Type of RADIUS server Value Description authentication Authentication server accounting Accounting server control Allowed to send control CoA DM H 3 10 port Physical port Table H 74 port Physical port Value Description 0 Port 0 left 1 Port 1 right H 3 11 Crossover Crossover configuration Physical port crossover configuration Table H 75 Crossover Crossover configuration Value Description auto Crossover is determined automatically MDI Force no crossover H 3 12 LinkSpeed Physical port speed Table H 76 LinkSpeed Physical port speed Value Description 10M 10Mbit sec 100M 100Mbit sec 1G 1Gbit sec auto Speed determined by autonegotiation H 3 13 LinkDuplex Physical port duplex setting Table H 77 LinkDuplex Physical port duplex setting Value Description 138 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299
7. Whilst the bootloader is waiting for an active Ethernet connection the green and yellow LEDs built into the physical port connectors flash in a continual left to right then right to left sequence The port LEDs on the panel on the opposite side to the physical ports also flash in a clock wise sequence Note The same port LED flashing sequences are observed if the app is running and none of the Ethernet ports are connected to an active link partner Note that the app continues to run and the power LED will still be on solid When connected to an active link partner these flashing sequences will stop and the port LEDs will start indicating physical port status with various status indications possible controllable via the configuration see Section 6 3 27 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 5 Event Logging 5 1 Overview Many events in the operation of the FireBrick create a log entry These are a one line string of text saying what happened This could be normal events such as someone logging in to the web interface or unusual events such as a wrong password used or DHCP not being able to find any free addresses to allocate 5 1 1 Log targets A log target is a named destination initially internal to the FB6000 for log entries you can have multiple log targets set up which you can use to separate out log event messages according to some criteria for exampl
8. www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Getting Started Figure 2 3 Setting up a new user Admin users user 1 of 1 New Erase Help User names passwords and abilities for admin users name E comment profile User name Comment Profile name password E full name E otp User password Full name OTP serial number M timeout E config E level Login idle timeout zero to stay logged in Config access level Login level 5 00 full ADMIN E allow Tip You may also want to increase the login session idle time out from the default of 5 minutes especially if you are unfamiliar with the user interface To do that tick the checkbox next to timeout and enter an appropriate value as minutes colon and seconds e g 15 00 for 15 minutes Click on the Save button near the top of the screen which will save a new configuration that includes your new user definition You should now see a page showing the progress of storing the new configuration in Flash memory Figure 2 4 Configuration being stored Loading config No errors found Erasing flash page Programming flash page Flashed 1789 bytes Config loaded Please login to make any further changes Login On this page there is a Login link in red text click on this link and then log in using the username and password you chose We recommend you read Chapter 3 to understand the design of the FB6000 s
9. 102 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Constant Quality Monitoring technical details The recommended command to run just after midnight is wget m http host port cqm date F z as this will create a directory for the server cqm date and z and then the files The use of z clears text off the graphs to make them clean G 4 1 Full URL format The full URL format allows several variations These are mainly to allow sensible directory structures in overnight archiving Table G 5 URL formats URL Meaning cqm All CQM URLs start with this 32 hex Optional authentication string needed for untrusted access Can be used with trusted access characters to test the authentication is right YYYY MM Optional date to restrict output Can also be in the form YY YY MM DD YY Y Y MM DD DD YYYY MM DD if preferred Can also have HH or HH on the end to get data for just one hour and HH HH or HH HH on the end for a specific range of hours Can end HH MM SS or MM MM SS for data for one hour from a specific time options Optional graph colour control options Useful when extracting a list of images as the all must have the same options as the list is just graphname png as a relative link thereby ensuring all graphs appear in this directory The options list can include separators rather amp separators to make apparent subdirectories ext The file e
10. 4 3 3 Internet based upgrade process If automatic installs are allowed the FB6000 will check for new software on boot up and approximately every 24 hours thereafter your FB6000 should therefore pick up new software at most 24 hours after it is released You can choose to allow this process to install only new factory releases factory or beta releases or any release which then includes alpha releases if your FB6000 is enabled for alpha software see Section 4 3 1 refer to Section 4 3 3 2 for details on how to configure auto upgrades 24 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration Caution Alpha releases may be unstable and so we do not generally recommend setting your FB6000 to automatically install alpha releases 4 3 3 1 Manually initiating upgrades Whenever you browse to the main Status page the FB6000 checks whether there is newer software available given the current software version in use and whether alpha releases are allowed If new software is available you will be informed of this as shown in Figure 4 2 Figure 4 2 Software upgrade available notification Upgrade This FireBrick automatically upgrades to new factory releases Software upgrade Upgrade available A FireBrick is a registered trademark of FireBrick Ltd Copyright 2009 11 FireBrick Ltd All Rights Reserved To see what new software is available click on the
11. Users may choose to start out using the User Interface and as experience with the object model and the XML language develops increasingly make changes in the XML environment For information on using XML to configure the FB6000 please refer to Section 3 5 3 4 Web User Interface Overview This section provides an overview of how to use the web based User Interface We recommend that you read this section if you are unfamiliar with the FB6000 so that you feel comfortable with the design of the User Interface Later chapters cover specific functionality topics describing which objects are relevant any underlying operational principles that are useful to understand and what effect the attributes and their values have The web based User Interface provides a method to create the objects that control operation of the FB6000 Internally the User Interface uses a formal definition of the object model to determine where in the hierarchy objects may be created and what attributes may exist on each object so you can expect the User Interface to always generate valid XML i If the User Interface does not generate valid XML i e when saving changes to the configuration the FireBrick reports XML errors then this may be a bug please check this via the appropriate support channel s 10 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Additionally the web User Interface prov
12. e Calling Station Id from L2TP e User name in RADIUS athentication response e Proxy Auth Name from L2TP e Negotiated user name from PAP CHAP If a second session starts with the same graph name as an existing session then the existing session is cleared with cause 13 Preempted It is recommended that a unique circuit ID is passed as the Chargeable User Identity in the authentication response to allow simple location of graphs 92 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported RADIUS Attribute Value Pairs for L2TP operation E 9 3 IP over LCP IP over LCP is a non standard coding of PPP packets for IPv4 and IPv6 The coding uses the LCP code C021 instead of the IPv4 0021 or IPv6 0057 code The first byte which would normally be the LCP type is 0x4X IPv4 or 0x6X IPv6 The FireBrick assumes any such LCP codes are IPv4 IPv6 when received and using a RADIUS response can send IP packets using LCP This is specifically to bypass any carrier IP specific shaping or DPI E 9 4 Closed User Group Each session can have a CUG defined 1 32768 which may be allow or restrict Interfaces port VLAN may also be defined in the same way A packet from an interface session with a CUG is tagged with that packet If the source is restricted that packet can only leave via an interface session with the same CUG Similarly if the target interface session is restricted than only a packet ta
13. www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Interfaces and Subnets In a factory reset configuration there are no ethernet objects and all ports assume the following defaults e Link auto negotiation is enabled both speed and duplex mode are determined via auto negotiation which should configure the link for highest performance possible for the given link partner which will need to be capable of and participating in auto negotiation for this to happen e Auto crossover mode is enabled the port will swap Receive and Transmit pairs if required to adapt to cable link partner configuration e The green port LED is configured to show combined Link Status and Activity indication the LED will be off if no link is established with a link partner When a link is established at any speed the LED will be on steady when there is no activity and will blink when there is activity e The yellow port LED is configured to show Transmit activity When you first create an ethernet object you will see that none of the attribute checkboxes are ticked and the defaults described above apply Ensure that you set the port attribute value correctly to modify the port you intended to The FB6000 configuration contains a number of port settings which are not possible and will not save e g 10M and 100M modes These are included for compatibility with FB2500 and FB2700 products The FB6000 only operates at
14. you will see the list of existing subnet child objects if any and an Add link Note In a factory reset configuration there are two temporary subnets defined on the LAN interface 2001 DB8 1 64and10 0 0 1 24 These subnet definitions provide a default IP address that the FB6000 can initially be accessed on regardless of whether the FB6000 has been able to obtain an address from an existing DHCP server on the network Once you have added new subnets to suit your requirements and tested that they work as expected these temporary definitions should be removed To create a new subnet click on the Add link to take you to a new subnet object defintion Tick the ip checkbox and enter the appropriate CIDR notation Editing an existing subnet works similarly click the Edit link next to the subnet you want to modify 6 2 1 1 Using DHCP to configure a subnet You can create a subnet that is configured via DHCP by clearing the ip checkbox the absence of an IP address prefix specification causes the FB6000 to attempt to obtain an address from a DHCP server which must be 34 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Interfaces and Subnets in the same broadcast domain It may help to use the Comment field to note that the subnet is configured via DHCP In its simplest form a DHCP configured subnet is created by the following XML lt subnet gt Tip It is possible to spec
15. 161 12 8 RADIUS configuration 12 8 1 RADIUS server platform RADIUS Chapter 16 provides details of how the platform RADIUS service can be used to steer incoming sessions from a carrier for L2TP 12 8 2 RADIUS client RADIUS is used for authentication and accounting for incoming L2TP connections Chapter 16 provides details of how RADIUS is used for L2TP Appendix E provides details of the specific AVPs used with RADIUS for L2TP 55 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 13 Network Diagnostic Tools Various network diagnostic tools are provided by the FB6000 accessible through either the web user interface or the CLI e Packet dump low level diagnostics to for detailed examination of network traffic passing through the FB6000 e Ping standard ICMP echo request reply ping mechanism e Traceroute classical traceroute procedure ICMP echo request packets with increasing TTL values soliciting TTL expired responses from routers along the path e Access check check whether a specific IP address is allowed to access the various network services described in Chapter 12 Each tool produces a textual result and can be accessed via the CLI where the same result text will be shown Caution The diagnostic tools provided are not a substitute for external penetration testing they are intended to aid understanding of FB6000 configuration assist in development
16. 94 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Command line reference F 1 8 Logout logout Guat exit You can also use Ctrl D to exit or close the connection if using telnet F 1 9 See XML configuration show run show configuration Dumps the full XML configuration to the screen F 1 10 Load XML configuration import configuration You then send the XML configuration ending with a blank line You would not normally import a configuration using this command as you can use the web interface and tools like curl to load configtations This command is provided as a last resort for emergency use so use with care F 1 11 Show profile status show profiles Shows profiles and current status F 1 12 Enable profile control switch enable profile lt string gt Turns a named profile control switch on F 1 13 Disable profile control switch disable profile lt string gt Turns a named profile control switch off F 1 14 Show RADIUS servers show radius show radius lt IPAddr gt Shows details of RADIUS servers currently in use F 1 15 Show DNS resolvers show dns 95 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Command line reference Shows current DNS resolver list and status F 2 Networking commands F 2 1 Subnets
17. Attributes Attribute Type Default Description comment string Comment profile NMTOKEN Not optional Profile name rx unsignedInt Rx rate limit target b s rx max unsignedInt Rx rate limit max rx min unsignedInt Rx rate limit min rx min burst duration Rx minimum allowed burst time rx step unsignedInt Rx rate reduction per hour source string Source of data used in automated config management tx unsignedInt Tx rate limit target b s tx max unsignedInt Tx rate limit max tx min unsignedInt Tx rate limit min tx min burst duration Tx minimum allowed burst time tx step unsignedInt Tx rate reduction per hour H 2 48 ip group IP Group Named IP group www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 134 Configuration Objects Table H 64 ip group Attributes H 3 Data types Attribute Type Default Description comment string Comment ip List of IPRange One or more IP ranges or IP len name string Not optional Name source string Source of data used in automated config management users List of NMTOKEN Include IP of time limited logged in web users H 3 1 autoloadtype Type of s w auto load Table H 65 autoloadtype Type of s w auto load Value Description false Do no auto load factory Load factory releases beta Load beta test releases a
18. H52 Pip Elements it AAA Ss 129 H53 12tpoincomine Atte DUES secsc 638 aean won tescasegaercewe td cea toilet acaesb sneha E 129 54 J2tp ncoming Elements A ace eile ee Oe A eee ieee 131 H39 J2tp relay SA eo E EE soapeueedss ph eecmis bi tuseds putea sean sunage e RENSE 131 H S6 profile Attributes oie n Wei Sas Lob be R se en naz ah end tae ee I E AENA 132 E A ONO 132 H38 profile date ATtbDUteS ci ia A ias 133 H 59 lt protile time Att DUtes secos alicia iii 133 1 60 profil pine Attributes Sii A A a 133 B61 Shaper Attributes 3 ics rociera Uno IAN tenir dada 133 62 shaper Elements O ale a Ae Sg Be Sh AGEs Ae SAS Ok TU ails 134 xiv www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6202 User Manual 63 Shaper Override AUIDUTES peraire ennie ee Disp oun cent tontos uber son det pbontebebeneamespe tees 134 H 04 1P 8TOUD Attributes itis ics discipulado Paita 135 H 65 autoloadtype Type of s w auto load oooocooccnnccnnocnncnnncnnncnnccnnconnccnnconnconnconncnnncnnnrnnncnareninanos 135 H 66 config access Type of access user has to config oocoooccccncccnnccnnnnccnnncnnnnccnonaconnncnnnnccnnnacinncons 135 B67 usertlevel User login veloc td ile ts 135 H08 syslog severlty Syslog Severity cia A ide 136 H69 syslog facilitys Syslog facility cosccesae seta ssgebussonssewtd a a AS tine 136 H 70 month Month name 3 letter 2 0 00 e cece ee cece eee ne cence eee e ce
19. RRGGBB RGBA RRGGBBAA defining red green blue alpha or some simple colour names Table G 4 Text Key Meaning L Defines a number of pixels to be provided on the left of the graph Bandwidth and scale axis shown based on space provided left and right R Defines a number of pixels to be provided on the right of the graph Bandwidth and scale axis is shown based on space provided left and right T Defines a number of pixels to be provided on the top of the graph Time axes is show based on space at top and bottom B Defines a number of pixels to be provided on the bottom of the graph Time axes is show based on space at top and bottom Y Defines Y bandwidth scale starting point 0 is lowest 1 is next etc y Defines Y ms scale max level in ms I Defines colour for graticule Defines colour for axis lines m Defines colour for background within axis Defines colour for background outside axis 2 O Defines colour for writing text G 4 Overnight archiving The system is designed to make it easy to archive all graphs or png xml etc files over night The graphs hold 1000 data points which is 27 hours 46 minutes This means you can access a full day s data for the previous day in the first 3 hours 46 minutes of the new day 2 hours 46 or 4 hours 46 when clocks change in previous day As such it is recommended that over night archiving is done of the previous day just after midnight
20. and then loads the app It is possible for only one of these types of software or neither of them to be present in the Flash but when shipped from the factory the unit will contain a bootloader and the latest factory release application software The FB6000 can store multiple app software images in the Flash and this is used with an automatic fall back mechanism if a new software image proves unreliable it is demoted and the unit falls back to running older software The show flash contents CLI command can be used to see what is stored in the Flash see Appendix F 4 4 1 LED indications 4 4 1 1 Power LED status indications The green power LED has three defined states as shown in Table 4 5 below Table 4 5 Power LED status indications Indication Status Off No AC power applied to unit or possibly hardware fault Flashing with approximately 1 second period Bootloader running waiting for network connection On Main application software running After power up the normal power LED indication sequence is therefore to go through the 1 second period flashing phase and then if at least one Ethernet port is connected to an active device change to solid once the app is running From power up a FB6000 will normally boot and be operational in under five seconds 4 4 1 2 Port LEDs 26 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration
21. attributes control logging of events related to the operation of the system itself For details on event logging please refer to Chapter 5 and for details on the logging control attributes on system object please refer to Section 5 7 4 2 4 Home page web links The home page is the first page you see after logging in to the FB6000 or when you click the Home main menu item The home page displays the system name and if defined the text specified by the int ro attribute on the system object Additionally you can define one or more web links to appear on the home page These are defined using Link objects which are child objects of the system object To make a usable link you must specify the following two attributes on the 1ink object e text the text displayed as a hyperlink e url link destination URL Additionally you can name a link specify a comment and make the presence of the link on the home page conditional on a profile 4 3 Software Upgrades FB6000 users benefit from FireBrick s pro active software development process which delivers fast fixes of important bugs and implementation of many customer enhancement requests and suggestions for improvement As a matter of policy FireBrick software upgrades are always free to download for all FireBrick customers To complement the responsive UK based development process the FB6000 is capable of downloading and installing new software directly from Firebrick s servers
22. given by 24M where M 32 prefix_length Routing destinations As well as being used to define a network subnet the CIDR notation is used to define the destination in a routing table entry which may encompass multiple networks with longer prefixes that are reachable by using the associated routing information This therefore provides the ability to create aggregated routing table entries For example a routing table entry with a destination of 10 1 2 0 23 specifies the address range 10 1 2 0 to 10 1 3 255 inclusive As an example it might be that in practice two 24 subnets are reachable via this 75 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 CIDR and CIDR Notation routing table entry 10 1 2 0 24 and 10 1 3 0 24 routing table entries for these subnets would appear in a downstream router Note that in either a network subnet or routing destination specification the address will be the starting address of the IP address range being expressed such that there will be M least significant bits of the address set to zero where M 32 prefix_length Combined interface IP address and subnet definitions Another common use of the CIDR notation is to combine the definition of a network with the specification of the IP address of an end system on that network this form is used in subnet definitions on the FB6000 and in many popular operating systems For example the default IPv
23. note the MAC address is written without any colons and is therefore a string of twelve hexadecimal digits 48 bits This allocation also supplies DNS resolver information to the client lt interface gt lt dhcp name laptop TS SIS lee mac 0090F59E4F12 dans Si iS Sih WS OO log default gt lt imeerrace Tip If you are setting up a static allocation but your client has already obtained an address from your FB6000 from a pool you will need to clear the allocation and then force the client to issue another DHCP request e g unplug ethernet cable do a software repair connection procedure or similar etc See the show dhcp and clear dhcp CLI commands in the Appendix F for details on how to clear the allocation Chapter 17 covers the CLI in general You can also Jock an existing dynamic allocation to prevent it being re used for a different MAC address even if it has expired 6 2 2 1 1 Special DHCP attributes For each pool you can list specific DHCP attributes specified as a string IPv4 address or number or even as raw data in hexadecimal You can force sending of an attribute even if not requested For vendor specific attributes ID 43 you can either specify in hex as ID 43 or you can specify the code to use and set the vendor flag this adds an attribute type 43 with the code and length for the attribute which can be string IPv4 address number or hexadecimal 6 2 2 2 Partial MAC address
24. only accept peer AS internal IBGP allowing own AS reflector IBGP allowing own AS and working in route reflector mode confederate EBGP confederate ixp Internet exchange point peer on route server 141 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects H 3 26 switch Profile manual setting Manual setting control for profile Table H 90 switch Profile manual setting Value Description false Profile set to OFF true Profile set to ON control switch Profile set based on control switch on home page H 4 Basic types Table H 91 Basic data types Type Description string text string token text string hexBinary hex coded binary data integer integer 2147483648 2147483647 positiveInteger positive integer 1 4294967295 unsignedInt unsigned integer 0 4294967295 unsignedShort unsigned short integer 0 65535 byte byte integer 128 127 unsignedByte unsigned byte integer 0 255 boolean Boolean dateTime YYYY MM DDTHH MM SS date time time HH MM SS time NMTOKEN String with no spaces void Internal use IPAddr IP address IPNameA ddr IP address or name IP4Addr IPv4 address IP6Addr IPv6 address IPPrefix IP address bitlen IPRange IP address bitlen or range IPNameRange IP address bitlen or range or name IP4Range IPv4 address bitlen or range IP
25. release references in this manual to external resources such as the FireBrick website may be out of date You can find the latest revision of a manual for a specific software version on the FB6000 software downloads website http www firebrick co uk software php PRODUCT 6000 This includes the revision history for all software releases 1 2 2 Intended audience This manual is intended to guide FB6000 owners in configuring their units for their specific applications We try to make no significant assumption about the reader s knowledge of FireBrick products but as might be expected given the target market for the products it is assumed the reader has a reasonable working knowledge of common IP and Ethernet networking concepts So whether you ve used FireBrick products for years or have purchased one for the very first time and whether you re a novice or a network guru this Manual sets out to be an easy to read definitive guide to FireBrick product configuration for all FireBrick customers 1 2 3 Technical details There are a number of useful technical details included in the apendices These are intended to be a reference guild for key features 1 2 4 Document style At FireBrick we appreciate that different people learn in different ways some like to dive in hands on working with examples and tweaking them until they work the way they want referring to documentation as required Other people prefer to build their knowledge
26. show subnets show subnet lt integer gt You can list all current subnets or details of a specific subnet This shows the same information as the web status pages for subnets F 2 2 Ping and trace ping lt IPNameAddr gt table lt routetable gt source lt IPAddr gt gateway lt IPAddr gt flow lt unsignedshort gt count lt positivelnteger gt ttl lt unsignedByte gt size lt unsignedShort gt xml lt boolean gt traceroute lt IPNameAddr gt table lt routetable gt source lt IPAddr gt gateway lt IPAddr gt flow lt unsignedShort gt count lt positivelnteger gt ttl lt unsignedByte gt size lt unsignedShort gt xml lt boolean gt This sends a series of ICMP echo requests ping to a specified destination and confirms a response is received and the round trip time For the traceroute variant the TTL Hopcount is increased by one each time to show a series of response hops There are a number of controls allowing you to fine tune what is sent Obviously you should only send from a source address that will return to the FB6000 correctly You can also ask for the results to be presented in an XML format Where possible the reverse DNS name is shown next to replies but there is deliberately no delay waiting for DNS responses so you may find it useful to run a trace a second time as results from the first attempt will be cached F 2 3 Show a route from the routing tab
27. to have access from outside e g the FireBrick support team F 6 5 Show command sessions show command sessions The FB6000 can have multiple telnet connections at the same time This lists all of the current connections F 6 6 Kill command session kin command session lt IPAddr gt You can kill a command session by IP address This is useful if you know you have left a telnet connected from somewhere else Telnet sessions usually have a timeout but this can be overridden in the configuration for each user F 6 7 Flash memory list show flash contents Lists the content of flash memory this includes various files such as software releases configuration and so on Multiple copies are usually stored allowing you to delete a later version if needed and roll back to an older version F 6 8 Delete block from flash delete config lt unsignedInt gt confirm lt string gt delete data lt unsignedInt gt confirm lt string gt delete image lt unsignedInt gt confirm lt string gt Delete a block from flash memory This cannot be undone You have to specify the correct type of block and specify confirm yes for the command to work F 6 9 Boot log show boot log lt unsignedInt gt Show log of recent boots You can specify the number of bytes of recent log to show F 6 10 Flash log show flash log lt unsignedInt gt The logging system can log to flash for a
28. 3 1 autoloadtype Type of s w auto load ooocooccnnccnoccnncnnocnnocnnccnnconoconnccnnconnconaconncos 135 H 3 2 config access Type of access user has to config occcoocccnncccnnoccnnnccnnnconnnacinnninnnnos 135 H 3 3 user level User login levelei nienie reae EEE a RE N EEO EO ERa TENSE 135 H 3 4 syslog severity Syslog SeVerity ocoocccoccccccnccnnccnnconnccnncnnncnnnconnconcnnacnncnnnronicnnos 136 H 3 5 syslog facility Syslog facility 2 0 0 0 cece cece cece eee ence nce n een eeeeeeeeeeeeeeeeeeeeaees 136 H 3 6 month Month name 3 letter 2 0 0 0 cece ecec cece cece ec ee ence ence eeneceeeeeeeeeeeeneeeeeensaees 137 4 37 day Day name Sletter ss civ rer ds dra E RENE 137 H 3 8 radiuspriority Options for controlling platform RADIUS response priority tagging 137 H 3 9 radiustype Type of RADIUS server 00 0 0 cece cece eee ce ence eeceeecaeeeaeeea sean eeaes 138 H3 10 pott Physical A as eadas at wed taza dee sown E a A ees 138 H 3 11 Crossover Crossover configuration coooconoccnccnnccnnonnnccnocnnccnnconnccnncnnnconnconicinnes 138 H 3 12 LinkSpeed Physical port Speeder cece eee cece eee epe a EERS p EEE n 138 H 3 13 LinkDuplex Physical port duplex setting oooooccoccncccnnconccnnccnnccnnccnnccnnconacinncos 138 H 3 14 LinkFlow Physical port flow control setting coooccocccnconnconnccnnccnnconaconaconiconnns 139 H 3 15 LinkClock Physical port Gigabit clock master slave setting ooocoooccnoconoco
29. 38 Accepted used in RADIUS and passed Passed on incoming value on if relaying Sequencing Required 39 Accepted on honoured Not sent Table D 9 OCRQ AVP No Incoming Outgoing 82 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported L2TP Attribute Value Pairs Message Type 0 Value 7 Value 7 Not supported ignored D 10 Outgoing Call Reply Table D 10 OCRP AVP No Incoming Outgoing Message Type 0 Value 8 Value 8 Not supported ignored D 11 Outgoing Call Connected Table D 11 OCCN AVP No Incoming Outgoing Message Type 0 Value 9 Value 9 Not supported ignored D 12 Call Disconnect Notify Table D 12 CDN AVP No Incoming Outgoing Message Type 0 Value 14 Value 14 Result Code 1 Ignored logged Sent as appropriate for tunnel close Q 931 Cause Code 12 Ignored Not sent Assigned Session ID 14 Expected see note Sent if assigned Note that a CDN may have a zero session ID in the header If this is the case the tunnel ID and assigned session ID are used to identify the session If an unknown session ID on a known tunnel ID is received on any any incoming packet a CDN is generated with header session ID 0 and specified assigned session ID D 13 WAN Error Notify Table D 13 WEN AVP No Incoming Outgoing Message Type 0 Value 15 Value 15
30. Fax 44 0 1245 808299 FireBrick FB6202 User Manual A A A O 22 414 3 Restrict by profiles Ages ies o ie a dhs as 22 4 2 General System Sets sanesna down ss oia de saws eden ates nseugeato heeds da ri doce 22 4 2 1 System name hostname cceceeeeeeeeecneceeeeeeeeeeeceeeeeeeeeseceeeaeeeeeaeeeeeaeeeeaeeeeeas 22 ADD Administrativo details vcd stores ir ara das 22 4 2 3 System level event logging control ooooocnoncnocnnccnnccnnccnnccnnccnnconnconnconnconaronccnnronose 23 4 2 4 Home page web links tiritas iria 23 4 3 oftware Uporades id A de eae ae ren 23 43 A Software release types so ssc susaesnyootdietyseecesuoes R kee e A obese Soop itn IEn Et 23 4 3 1 Breakpomt releases onr ero e italia dla 24 4 3 2 Identifying current software version ooocccooccccnoccnnocnnnnccnnnncnonccnnnnccnnnrnnnnccnnnncnoninns 24 4 3 3 Internet based upgrade Process oocoocccnccnnccnnccnnconnconeconnconncnnnnnnronnronncnnccnnccnnccnnions 24 4 3 3 1 Manually initiating upgrades ooccooccnccnnccnnconnconnccnnccnnconnconnconncnnncnnncnnrnnoss 25 4 3 3 2 Controlling automatic software updates 0 0 0 0 cece cece eee cece eee eeneeen scans 25 43 4 ManualcUparade decidi reinar samen dy E N cvs 25 4 4 BOO POC Sii id lator cashes endear reed eee es 26 4 4 TBD ndiCatlons sos cusacsetes cee oeseecs eh Seedisp eee aespa ven dheh deeds pep age gees eek tees venlenonseteeceene 26 4 4 1 1 Power LED status indications coooccncc
31. H 85 dhcpv6control Control for RA and DHCPV6 bits 2 0 0 cece cece ce ne cence ence eeeeeeeeeeeeeeaees 140 H 86 bgpmode BGP announcement mode 1 0 0 0 cece cece eeceeeceeece neces eeeeeeeeeeeeeaecea seas seus eean esas 141 H 87 sfoption Source filter opti Oni pe senne e an E A ANER Pe EEA AEA SES EE SE 141 H 88 pppoe mode Type of PPPoE connection ssssessssserssessrrrrssrerrsrreersrrsrrrrerreresrrerrerrerreresrt 141 1 89 peertype BGE peer type deerne ee a a sade distin 141 H 90 switch Profile manual setting ooooconocnnccnnccnnncnnccnnconoronccnn ceca cena cena E EEE a T E in 142 91 Basic data types ssn epn e a ltd e AE ayer a E ES EE 142 Xv www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Preface The FB6000 device is the result of several years of intensive effort to create products based on state of the art processing platforms featuring an entirely new operating system and IPv6 capable networking software written from scratch in house by the FireBrick team Custom designed hardware manufactured in the UK hosts the new software and ensures FireBrick are able to maximise performance from the hardware and maintain exceptional levels of quality and reliability The result is a product that has the feature set performance and reliability to handle mission critical functions effortlessly handling huge volumes of traffic supporting thousands of customer connections Th
32. NMTOKEN VRRP state any of these is master Table H 57 profile Elements Element Type Instances Description date profile date Optional unlimited Test passes if within any date range specified ping profile ping Optional Test passes if address is answering pings time profile time Optional unlimited Test passes if within any time range specified 132 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects H 2 43 profile date Test passes if within any of the time ranges specified Time range test in profiles Table H 58 profile date Attributes Attribute Type Default Description comment string Comment start dateTime Start YY Y Y MM DDTHH MM SS stop dateTime End Y YY Y MM DDTHH MM SS H 2 44 profile time Test passes if within any of the date time ranges specified Time range test in profiles Table H 59 profile time Attributes Attribute Type Default Description comment string Comment days Set of day Which days of week apply default all start time Start HH MM SS stop time End HH MM SS H 2 45 profile ping Test passes if any addresses are pingable Ping targets Table H 60 profile ping Attributes Attribute Type Default Description flow unsignedShort Flow label IPv6 gateway IPAddr Ping via specific gateway bypasses sess
33. Objects H 3 22 bgpmode BGP announcement mode BGP mode defines the default advertisement mode for prefixes based on well known community tags Table H 86 bgpmode BGP announcement mode Value Description false Not included in BGP at all no advertise Not included in BGP not advertised at all no export Not normally exported from local AS confederation local as Not exported from local AS no peer Exported with no peer community tag true Exported as normal with no special tags added H 3 23 sfoption Source filter option Table H 87 sfoption Source filter option Value Description false No source filter checks blackhole Check replies have any valid route true Check replies down same port vlan H 3 24 pppoe mode Type of PPPoE connection Table H 88 pppoe mode Type of PPPoE connection Value Description client Normal PPPoE client connects to access controller bras 12tp PPPoE server mode linked to L2TP operation H 3 25 peertype BGP peer type Peer type controls many of the defaults for a peer setting It allows typical settings to be defined with one attribute that reflects the type of peer Table H 89 peertype BGP peer type Value Description normal Normal BGP operation transit EBGP Mark received as no export peer EBGP Mark received as no export only accept peer AS customer EBGP Allow export as if confederate
34. Upgrade available link This will take you to a page that will show Release notes that are applicable given your current software version and the latest version available On that page there is an Upgrade button which will begin the software upgrade process 4 3 3 2 Controlling automatic software updates There are two attributes on the system object see Section 4 2 that affect the automatic software upgrade process Table 4 4 Attributes controlling auto upgrades Attribute Description sw update Controls what types of software releases the auto upgrade process will download install This attribute can also be used to disable the auto upgrade process use the value of false to achieve this false Disables auto upgrades factory Only download install factory releases this is the default if the attribute is not specified beta Download install factory or beta releases alpha Download install factory beta or alpha releases sw update profile Specifies the name of a profile to use to control when software upgrades are attempted see Chapter 8 for details on profiles The current setting of sw update in descriptive form can be seen on the main Status page adjacent to the word Upgrade as shown in Figure 4 2 in that example sw update is set to or is defaulting to factory 4 3 4 Manual upgrade This method is entirely manual in the sense that the brick itself does not download new softwar
35. Vendor Name 8 Ignored FireBrick Ltd Assigned Tunnel ID 9 Mandatory Mandatory our tunnel ID Receive Window Size 10 Accepted assumed 4 if not present or Value 4 less than 4 is specified Challenge 11 Accepted if a configured secret is Not sent at present defined a response is sent in the SCCRP D 2 Start Control Connection Reply Table D 2 SCCRP AVP No Incoming Outgoing Message Type 0 Value 2 Value 2 Protocol Version 2 Value 1 expected Value 1 Framing Capabilities 3 Ignored Value 3 Bearer Capabilities 4 Ignored Not sent Firmware Revision 6 Ignored FireBrick s w ID number Host Name 7 Logged as hostname for tunnel Configured hostname if defined Vendor Name 8 Ignored FireBrick Ltd Assigned Tunnel ID 9 Expected as far end ID Mandatory our tunnel ID Receive Window Size 10 Accepted assimed 4 if not present or Not sent assume 4 less than 4 80 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported L2TP Attribute Value Pairs Challenge 11 Accepted if a configured secret is Not sent at present defined a response is sent in the SCCCN Challenge Response 13 Not expected at present Sent if SCCRQ contained a challenge and we have a secret defined D 3 Start Control Connection Connected Table D 3 SCCCN AVP No Incoming Outgoing Message Type 0 Value 3 Value 3 Challenge R
36. a specific destination IP address or address range using the CLI command show route You can also see a list of all routes in a routing table using the CLI command show routes There is also a routing display on the Diagnostics control web pages 38 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Routing 7 2 Routing targets A route can specify various targets for the packet Table 7 1 Example route targets Target Notes an Ethernet interface locally atached subnet requires ARP or ND to find the device on the LAN to which the traffic is to be sent a specific IP address a gateway the packet is forwarded to another router gateway routing is then determined based on the gateway s IP address instead tunnel interface such as L2TP PPPoE or FB105 such routes are created as part of the config for the tunnels interface and relate to the specific tunnel special targets e g the FB6000 itself or to a black hole causes all traffic to be dropped These are covered in more detail in the following sections 7 2 1 Subnet routes Whenever you define a subnet or one is created dynamically e g by DHCP an associated route is automatically created for the associated prefix Packets being routed to a subnet are sent to the Ethernet interface that the subnet is associated with Traffic routed to the subnet will use ARP or ND to find the final MAC address
37. access so for ADMIN or DEBUG level user s the default of fu11 is suitable Table 4 2 Configuration access levels Level Description none No access unless explicitly listed view View only access no passwords read Read only access with passwords full Full view and edit access DEFAULT 4 1 3 Login idle timeout To improve security login sessions to either the web user interface or to the command line interface via telnet see Chapter 17 will time out after a period of inactivity This idle time out defaults to 5 minutes and can be changed by setting the timeout attribute value The time out value is specified using the syntax for the XML fb duration data type The syntax is hours minutes and seconds or minutes and seconds or just seconds E g 5 00 To set a user s time out in the user interface tick the checkbox next to timeout and enter a value in the format described above Setting a timeout to 0 means unlimited and shoudl obviously be used with care 4 1 4 Restricting user logins 4 1 4 1 Restrict by IP address You can restrict logins by a given user to be allowed only from specific IP addresses using the a11ow attribute This restriction is per user and is distinct from and applies in addition to any restrictions specified on either the web or telnet for command line interface access services see Section 12 3 and Section 12 4 or any firewall rules that affect web or telnet access
38. aden as 66 15 2 9 lt route gt lt subnet gt and other elements ooooococccncncncncncncnrnnononononononononononononononos 66 15 2 10 Route feasibility testing ninen eee cence cece cece cena EEE a RE E EE r 67 A Dia f nostis Sorpen e swans sey ted yes E sbeed eines E E users RAEE E Sena 67 15 2 12 Router Shutdown ria a a is 67 15 213 TT SEU Mercadona rio oriente seek dads opioides 67 16 Internet Service Providers cscceccsecocesesoveneceversceseesoverssevenssssenereveneraserssevenesssenssaveneseves 68 A sragies Sausacsey a ph nus e eben ass Sed dbssted agus benedict E 68 16 1 Bow itall besan aci Ae At ee OR Eb ehh Sesh Gate Ca ae 68 16 1 2 Pomt toPomt Protocol oidor nai can a aae on eewet E 68 MER DA h siege eect irae E E sae ee At wh cigvek uae ed tule een wea teal eaten obs 68 161 4 Broadband cur aida 69 16 RADIUS 0 A A A A E 69 16 167 ON 69 16 2 Incoming L2TP connections eoin aea E AEE S EE AEE EE EE E Esaa 69 16 3 The importance of CQM graphs sssrinds onena E e pa EEE E t 70 16 4 Auth ntication a Sele ce o A id 70 16 37 ACCOUDLIN rl 71 16 6 RADIUS Control messages enine ere eE E T EE E nono E o E S AER iioi 71 167S PPPOE seyor o e oy a e RE ss Sanaa aed E E fits 71 16 82 Typical CONTROLA OM rse A A E de 71 16 8 1 Interlink OD tiraera 71 10 8 2 BOP with Carrier 3 O A ato 71 16 83 RADIUS SESSION Steering siperi stems cseyese stops tendespanee shah ENEE EEEO EEES 72 16 8 4 E
39. an always Inactive profile 4 2 General System settings The system top level object can specify attributes that control general global system settings The available attributes are described in the following sections and can be configured in the User Interface by choosing the Setup category then clicking the Edit link under the heading System settings The software auto upgrade process is controlled by system objects attributes these are described in Section 4 3 3 2 4 2 1 System name hostname The system name also called the hostname is used in various aspects of the FB6000 s functions and so we recommend you set the hostname to something appropriate for your network The hostname is set using the name attribute 4 2 2 Administrative details The attributes shown in Table 4 3 allow you to specify general administrative details about the unit Table 4 3 General administrative details attributes Attribute Purpose comment General comment field contact Contact name intro Text that appears on the home page the home page is the first page you see after logging in to the FB6000 This text is also displayed immediately after you login to a command line session location Physical location description 22 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration 4 2 3 System level event logging control The log and log
40. applied if you have made configuration changes that have resulted in loss of access to the web user interface or any other situation where it 1s appropriate to start from scratch for example commissioning an existing unit for a different role or where you ve forgotten an administrative user password Itis also possible to temporarily reset the FB6000 to allow you to recover and edit a broken configuration though you still need to know the password you had You can also go back one step in the config The remainder of this chapter provides an overview of the FB6000 s capabilities and covers your product support options Tip The latest version of the QuickStart guide for the FB6000 can be obtained from the FireBrick website at http www firebrick co uk pdfs quickstart 6000 pdf 1 1 2 What can it do The FB6000 series of products is a family of high speed ISP telco grade routers and firewalls providing a range of specific functions Key features of the FB6000 family e 1U 19 rack mount e Very low power consumption typical 20W all important with today s power charges in data centres e Two small fans are the only moving parts for high reliability e Dual 120 230V AC power feed IPv6 built in from the start www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Introduction e Gigabit performance The FB600 series are provided in a number of variants This manual is for the FB6202 This
41. based allocations In addition to specifying a full 48 bit 12 hexadecimal character MAC address in a dhcp object it 1s also possible to specify part of a MAC address specifically some number of leading bytes The dhcp object will then apply for any client whose MAC address has the same leading bytes For example as discussed in Appendix B the first three octets bytes of a MAC address identify the organization often the end product manufacturer that can allocate that MAC address to an Ethernet device By specifying only these first three bytes six hexadecimal characters no colon delimiters in the mac attribute you could ensure that all devices from the associated manufacturer are allocated addresses from a particular address pool This is helpful if you have some common firewalling requirements for such a group of devices for example if all your VoIP phones are from one manufacturer as you can have appropriate firewall rule s that apply to addresses in that pool 6 3 Physical port settings The detailed operation of each physical port can be controlled by creating ethernet top level objects one for each port that you wish to define different behaviour for vs default behaviour To create anew ethernet object or edit an existing object select the Interface category from the top level icons Under the section headed Ethernet port settings you will see the list of existing ethernet objects if any and an Add link 36
42. begin with the already typed characters for example typing tr causes the CLI to respond as shown below marty Cr traceroute lt IPNameAddr gt table lt routetable gt source lt IPAddr gt EOE EEOM marty Er After listing the possible commands the CLI re displays the command line typed so far which you can then complete Please refer to Appendix F for command details 74 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix A CIDR and CIDR Notation Classless Inter Domain Routing CIDR is a strategy for IP address assignment originally specified in 1993 that had the aims of conserving the address space and limiting the growth rate of global routing state The current specification for CIDR is in RFC4632 http tools ietf org html rfc4632 The pre CIDR era CIDR replaced the original class based organisation of the IP address space which had become wasteful of address space and did not permit aggregation of routing information In the original scheme only three sizes of network were possible e Class A 128 possible networks each with 16 777 216 addresses e Class B 16384 possible networks each with 65 536 addresses e Class C 2097152 possible networks each with 256 addresses Every network including any of the large number of possible Class C networks required an entry in global routing tables those used by core Internet routers since it
43. debug log error NMTOKEN Log as event Log errors profile NMTOKEN Profile name resolvers List of IPAddr Recursive DNS resolvers to use source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable Table H 17 dns service Elements Element Type Instances Description block dns block Optional unlimited Fixed local DNS host blocks host dns host Optional unlimited Fixed local DNS host entries H 2 13 dns host Fixed local DNS host settings DNS forwarding resolver service Table H 18 dns host Attributes Attribute Type Default Description comment string Comment ip List of IPAddr Our IP IP addresses to serve or our IP if omitted name List of string Not optional Host names can use as a part of a domain profile NMTOKEN Profile name restrict List of List of IP ranges to which this is served IPNameRange reverse boolean Map reverse DNS as well source string Source of data used in automated config management ttl unsignedInt 60 Time to live H 2 14 dns block Fixed local DNS blocks DNS forwarding resolver service Table H 19 dns block Attributes Attribute Type Default Description comment string Comment 112 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects
44. e g 192 168 1 100 199 You do not however have to be careful of either the FireBrick s own addresses or subnet broadcast addresses as they are automatically excluded When using the default 0 0 0 0 0 range network addresses are also omitted as are any other addresses not within a subnet on the same interface Every allocation made by the DHCP server built in to the FB6000 is stored in non volatile memory and as such will survive power cycling and or rebooting The allocations can be seen using the DHCP item in the Status menu or using the show dhcp CLI command If a client does not request renewal of the lease before it expires the allocation entry will show expired Expired entries remain stored and are used to lease the same IP address again if the same client as identified by its MAC address requests an IP address However if a new MAC address requests an allocation and there are no available IPs excluding expired allocations in the allocation pool then the oldest expired allocation IP address is re used for the new client 6 2 2 1 Fixed Static DHCP allocations Fixed or static allocations can be achieved by creating a separate dhcp object for each such allocation and specifying the client MAC address via the mac attribute on the dhcp object 35 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Interfaces and Subnets The XML below shows an example of a fixed allocation
45. egress tx This is unique to that object unlike named shapers which are shared between all objects using the same named shaper It is also possible to set graph and speed attributes to create a named shaper with the specified speed without having to create a separate shaper object If you set a graph attribute without a speed attribute or creating a shaper object then that simply creates a graph without traffic shaping Multiple objects can share the same graph Graphs can sometimes be created automatically and may have speeds applied For L2TP sessions the circuit ID which may be overridden by RADIUS auth responses is used to make a graph for the session 9 1 4 Long term shapers If defining a shaper using the shaper object there are a number of extra options which allow a long term shaper to be defined A long term shaper is one that changes the actual speed applied dynamlically to ensure a long term usage level that is within a defined setting The key parameters for the long term shaper are the target speed e g tx the minimum speed e g tx min and maximum speed e g tx max The target speed is what is normally used if nothing else is set but if a min and max are set then the shaper will actually use the max speed normally However if the usage exceeds the target speed then this is considered to be bursting and this continues until the average speed since the bursting started drops below the target speed When bursting init
46. for using the FB6000 with VLAN capable network switches In this case a single physical connection can be made between a VLAN capable switch and the FB6000 and with the switch configured appropriately this physical connection will carry traffic to from multiple VLANs and the FB6000 can do Layer 3 processing routing firewalling etc between nodes on two or more VLANs 1 1 4 Product variants in the FB6000 series e FB6102 High capacity ping monitoring box e FB6202 Gigabit L2TP LNS with detailed monitoring of all lines e FB6302 Gigabit BGP router e FB6402 Gigabit stateful firewall e FB6502 Gigabit core VoIP SIP switch for ISTP use e FB6602 Mobile GTPv1 GGSN L2TP gateway 1 2 About this Manual 1 2 1 Version Every major FB6000 software release is accompanied by a release specific version of this manual This manual documents software version V1 27 001 please refer to Section 4 3 to find out more about software releases and to see how to identify which software version your FB6000 is currently running www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Introduction If your FB6000 is running a different version of system software then please consult the version of this manual that documents that specific version as there may be significant differences between the software versions Also bear in mind that if you are not reading the latest version of the manual and using the latest software
47. if the expired F 2 10 Name DHCP allocations name dhcp ip lt IP4Addr gt name lt string gt table lt routetable gt Allows you to set a name for a DHCP allocation overridding the clientname that was sent F 2 11 Show ARP ND status show arp show arp lt IPAddr gt Shows details of ARP and Neighbour discovery cache F 2 12 Show VRRP status show VELO Lists all VRRP in use and current status F 2 13 Send Wake on LAN packet wol interface lt string gt mac lt hexBinary gt Send a wake on LAN packet to a specific interface 97 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Command line reference F 2 14 Check access to services check access lt IPAddr gt table lt routetable gt Reports access control checks for a source address to various internal services This is separate from any firewalling F 3 L2TP commands Note This command summary is not yet complete please see www firebrick co uk for details F 4 BGP commands Note This command summary is not yet complete please see www firebrick co uk for details F 5 PPPoE commands Note This command summary is not yet complete please see www firebrick co uk for details F 6 Advanced commands Some commands are only available when logged in as a user set with DEBUG level access F 6 1 Panic panic string Leontirm lt stri
48. lt system gt lt user name peter O full name Peter Smith password FB105 4D42454D2 6F 8BF5480F07DFALE41AE47410154F6 timeout PT3H20M conti ful tee eG iy lt log name default gt lt log name fb support gt lt email to crashlogltfirebrick l1td uk comment Crash logs emailed to FireBrick Support gt lt log gt lt services gt O lt ntp timeserver pool ntp org gt lt telnet log default gt Sa lt dns domain watchfront co uk resolvers 81 187 42 42 81 187 96 96 gt lt services gt lt port name WAN ports IE eS lt port name LAN ports 2 gt lt interface name WAN port WAN gt lt subnet name ADSL o Ns SS lt interface gt lt interface name LAN 6 port LANT lt subnet name LAN 1p 81 187 96 94 28 gt lt dhcp name LAN ip er 187 96 887927 log default gt lt interface gt Sois sets some general system parameters see Section 4 2 defines a single user with the highest level of access DEBUG see Section 4 1 defines a log target see Chapter 5 configures key system services see Chapter 12 defines physical port group see Section 6 1 000008 18 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration O defines an interface with one subnet and a DHCP allocation pool see Chapter 6 3 6 Downloading Uploading the configuration The XML file may be ret
49. of the unit that must be done via the web interface Whilst most commands can be carried out via the web interface there are a few that can only be performed via the CLI The CLI has the following features e full line editing capabilities that cursor keys backspace key and delete key function as expected allowing you to go back and insert delete characters You can press Enter at any point in the command line text and the full command text will be processed command history memory the CLI remembers a number of previously typed commands and these can be recalled using the Up and Down cursor keys Once you ve located the required command you can edit it if needed and then press Enter supports entering abbreviated commands you only need to type sufficient characters to make the command un ambiguous for example show dhcp and show dns can be abbreviated to sh dh and sh dn respectively show is the only command word that begins sh and two characters of the second command word are sufficient to make it un ambiguous built in command help you can list all the available commands and the CLI will also show the synopsis for each command Typing the character at the command prompt immediately displays this list you do not have to press Enter Alternatively you can list all the possible completions of a part typed command in this case typing the character after typing part of a command will list only commands that
50. of your configuration and for diagnosing problems with the behaviour of the FB6000 itself 13 1 Access check For each network service implemented by the FB6000 see Chapter 12 this command shows whether a specific IP address will be able to access or utilise the service based on any access restrictions configured on the service For example the following shows some service configurations expressed in XML and the access check result when checking access for an external address 1 2 3 4 lt http local only false gt Web control page access via http This address is allowed access to web control pages subject to username password being allowed lt telnet allow admin ips local only false gt Telnet access This address is not allowed access due to the allow list on telnet service in this example admin ips is the name of an IP address group that does not include 1 2 3 4 lt dns local only true gt 56 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Network Diagnostic Tools DNS resolver access This address is not on a local Ethernet subnet and so not allowed access 13 2 Packet Dumping The FireBrick includes the ability to capture packet dumps for diagnostic purposes This might typically be used where the behaviour of the FB6000 is not as expected and can help identify whether other devices are cor
51. pass 8 2 2 2 Time date tests Time and or date tests are specified by date and or time objects which are child objects of the profile object You can define multiple date ranges via multiple date objects the date test will pass if the current date is within any of the defined ranges Similarly you can define multiple time ranges via multiple t ime objects the time test will pass if the current time is within any of the defined ranges Tip Unlike other tests the chanhe of state because of a date time test takes effect immediately rather than waiting for several seconds to confirm it is still Saturday or some such 8 2 2 3 Ping tests Like time date tests a Ping test is specified by a ping object as a child of the profile object At most one Ping test can be defined per profile logical combinations of profiles can be used to combine Ping tests if necessary 8 2 3 Inverting overall test result The tests described in the previous section are used to form an overall test result Normally this overall result is used to determine the profile state using the mapping Pass gt Active and Fail gt Inactive By setting the invert attribute to t rue the overall result is inverted Pass changed to Fail and vice versa first before applying the mapping 8 2 4 Manual override You can manually override all tests and force the profile state using the set attribute a value of t rue forces the state to Active and false forces it to In
52. purpose computers and routers Conventional routing determines where to send a packet based only on the packet s destination IP address and is applied on a per packet basis i e each packet that arrives is processed independently from previous packets Note that with this routing system it does not matter where the packet came from either in terms of source IP address or which interface tunnel etc the packet arrived on A route consists of e a target specifying where to send the packet to this may be a specialised action such as silently dropping the packet a black hole e an IP address range that this routing information applies to the routing destination A routing table consists of one or more routes Unlike typical IP stacks the FB6000 supports multiple independent routing tables Routing destinations are expressed using CIDR notation if you are not familiar with this notation please refer to Appendix A for an overview Note that ip groups cannot be used when defining subnets or routes IP groups allow arbitrary ranges and not just prefixes but routes can only use prefixes There are two cases that deserve special attention e A routing destination may be a single IP address in which case it is a 32 in CIDR notation for IPv4 The 32 part for IPv4 or 128 for IPv6 is not shown when displaying such prefixes e A routing destination may encompass the entire IPv4 or IPv6 address space written as 0
53. response The effect of this is that multiple lines that are connected to the same LNS and have the same IPs routed to the lines will automatically per packet bond traffic down those lines 41 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 8 Profiles Profiles allow you to enable disable various aspects of the FB6000 s configuration and thus functionality based on things such as time of day or presence absence of Ping responses from a specified device 8 1 Overview A profile is a two state control entity it is either Active or Inactive On or Off like a switch Once a profile is defined it can be referenced in various configuration objects where the profile state will control the behaviour of that object A profile s state is determined by one or more defined tests which are performed periodically If multiple tests are specified then the overall test result will be pass only if all the individual test results are pass Assuming the profile s state is Active then when the overall test result has been fail for a specified duration the profile transitions to Inactive Similary once the overall test result has been pass for a specified duration the profile transitions to Active These two durations are controlled by attributes and provide a means to filter out short duration blips that are of little interest An example of a test that can be performed is a Ping tes
54. server to find what address has been assigend to the FB6000 2 2 Accessing the web based user interface If you used Method 1 you should browse to the FireBrick s web interface as follows or you can use the IP addresses detailed Table 2 2 IP addresses to access the FireBrick URL http my firebrick co uk If you used Method 2 you should browse to the FireBrick s IP address as listed below Table 2 3 IP addresses to access the FireBrick IPv6 IPv4 http 2001 DB8 1 http 10 0 0 1 If you used Method 3 you will need to be able to access a list of allocations made by the DHCP server in order to identify which IP address has been allocated to the FB6000 and then browse this address from your computer If your DHCP server shows the client name that was supplied in the DHCP request then you will see FB6000 in the client name field assuming a factory reset configuration if you only have one FB6000 in factory reset state on your network then it will be immediately obvious via this client name Otherwise you will need to locate the allocation by cross referring with the MAC address range used by the FB6000 you are www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Getting Started interested in if necessary refer to Appendix B to see how to determine which MAC address you are looking for in the list of allocations Once you are connected to the FB600
55. set these differently for each log target There is inevitably a slight lag between the event happening and the log message being sent on and in some cases such as email you can deliberately delay the sending of logs to avoid getting an excessive number of emails If an external logging system cannot keep up with the rate logs are generated then log entries can be lost The fastest type of external logging is using syslog which should manage to keep up in pretty much all cases 5 3 1 Syslog The FB6000 supports sending of log entries across a network to a syslog server Syslog is described in RFC5424 http tools ietf org html rfc5424 and the FB6000 includes microsecond resolution time stamps the hostname from system settings and a module name in entries sent via syslog Syslog logging is very quick as there is no reply and syslog servers can be easily setup on most operating systems particularly Unix like systems such as Linux Note Older syslog servers will typically show time and hostname twice and will need upgrading 29 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Event Logging The module name refers to which part of the system caused the log entry and is also shown in all other types of logging such as web and console To enable log messages to be sent to a syslog server you need to create a syslog object that is a child of the log target 1og object You must then specif
56. standards ieee org develop regauth oui MAC addresses are commonly written as six groups of two hexadecimal digits separated by colons or hyphens FB6000s currently ship with an OUI value of 00 03 97 In principle the FireBrick could have a single MAC address for all operations However practical experience has led to the use of multiple MAC addresses on the FireBrick A unique block of addresses is assigned to each FireBrick with the size of the block dependent on the model Most of the time FB6000 users do not need to know what MAC addresses the product uses However there are occasions where this information is useful such as when trying to identify what IP address a DHCP server has allocated to a specific FB6000 For information on how MAC addresses are used by the FB6000 please refer to this article on the FireBrick website http www firebrick co uk fb2700 mac php The label attached to the bottom of the FB6000 shows what MAC address range that unit uses using a compact notation as highlighted in Figure B 1 Figure B 1 Product label showing MAC address range FireBrick FB2x00 E E aC 3 mu Made in UK e Serial 2X00 XXXX XXXX Bee 110 240VAC 50 60Hz 0 2 0 TA In this example the range is specified as 000397 147C F this is interpreted as e All addresses in the range start with 00 03 97 14 7 e the next digit then ranges from C through to F e the first address in the range has zero for the remaining d
57. the IP addresses to use It is also possible for RADIUS to provide relay tunnel endpoint details to pass the connection on to another LNS In addition to RADIUS based authentication it is also possible to pre set local authentication details based on circuit ID and or username and password This bypasses RADIUS and can be used to handle individual lines or patterns of login e g use of a realm to steer to another LNS for a wholesale customer 70 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Internet Service Providers In an ISP scenario this is typically used for special cases test lines etc The main use of this feature is for a corporate LNS handling direct point to point tunnels e g from other offices or roaming users 16 5 Accounting RADIUS can also be used for accounting This involves a RADIUS message at start and end of each connection and also interim accounting updates Interim accounting is done on a snapshot basis Normally this is hourly On the hour within a second the details are recorded and then sent by RADIUS The RADIUS updates may take many minutes to be sent and confirmed by a RADIUS server but the timestamp on the messages is the hourly snapshot This is useful where an ISP is charging differently at different times of day Interim updates can also be sent based on reaching a pre set time or data usage level defines in the authentication RADIUS response 16 6
58. the comment attribute is an optional general comment field lt log name fb support comment Log target for sending logs to FireBrick support team gt lt email to crashlog firebrick 1td uk comment Crash logs emailed to FireBrick Support team gt 30 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Event Logging lt log gt A profile can be used to stop emails at certain times and when the email logging is back on an active profile it tries to catch up any entries still in the RAM buffer if possible 5 3 2 1 E mail process logging Since the process of e mailing can itself encounter problems it is possible to request that the process itself be logged via the usual log target mechanism This is done by specifying one or more of the log 1og debug and log error attributes Note We recommend that you avoid setting these attributes such that specify the log target containing the email object otherwise you are likely to continually receive e mails as each previous e mail process log will trigger another e mail the hold off will limit the rate of these mails though 5 4 Factory reset configuration log targets A factory reset configuration has a log target named default which only logs to RAM Provided this log target has not been deleted you can therefore simply set 1og default on any appropriate object to immediately enable logging to this default log target wh
59. to the FB6000 itself 21 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration 4 1 4 2 Logged in IP address The FireBrick allows a general definition of JP groups which allow a name to be used in place of a range of IP addresses This is a very general mechanism that can be used for single IP addresses or groups of ranges IPs e g admin machines may be a list or range of the IP addresses from which you want to allow some access The feature can also be useful even where only one IP is in the group just to give the IP a meaningful name in an access list These named IP groups can be used in the allow list for a user login along with specific IP addresses or ranges if needed However IP groups can also list one or more user names and implicitely include the current IP address from which those users are logged in to the web interface This can be useful for firewall rules where you may have to log in to the FireBrick even as a NOBODY level user just to get your IP address in an access list to allow further access to a network from that IP 4 1 4 3 Restrict by profile By specifying a profile name using the profile attribute you can allow logins by the user only when the profile is in the Active state see Chapter 8 You can use this to for example restrict logins to be allowed only during certain times of the day or you can effectively suspend a user account by specifying
60. up from first principles and gain a thorough understanding of what they re working with Most people we suspect fall somewhere between these two learning styles This Manual aims to be highly usable regardless of your learning style material is presented in an order that starts with fundamental concepts and builds to more complex operation of your FireBrick At all stages we hope to provide a well written description of how to configure each aspect of the FireBrick and where necessary provide enough insight into the FireBrick s internal operation that you understand why the configuration achieves what it does 1 2 5 Document conventions Various typefaces and presentation styles are used in this document as follows e Text that would be typed as is for example a command or an XML attribute name is shown in monospaced_font e Program including XML listings or fragments of listings are shown thus this s an example program listing printi hello World nu e Text as it would appear on screen is shown thus This is an example of some text that would www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Introduction appear on screen Note that for documentation purposes additional line breaks may be present that would not be in the on screen text Notes of varying levels of significance are represented thus colour schemes may differ depending
61. user interface and then start working with your FB6000 s factory reset configuration Once you are familiar with how the user interface is structured you can find more detail on setting up users in Section 4 1 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 3 Configuration 3 1 The Object Hierarchy The FB6000 has at its core a configuration based on a hierarchy of objects with each object having one or more attributes An object has a type which determines its role in the operation of the FB6000 The values of the attributes determine how that object affects operation Attributes also have a type or datatype which defines the type of data that attribute specifies This in turn defines what the valid syntax is for a value of that datatype for example some are numeric some are free form strings others are strings with a specific format such as a dotted quad IP address Some examples of attribute values are e IP addresses and subnet definitions in CIDR format e g 192 168 10 0 24 e free form descriptive text strings e g a name for a firewall rule e Layer 4 protocol port numbers e g TCP ports e data rates used to control traffic shaping e enumerated values used to control a feature e g defining Ethernet port LED functions The object hierarchy can be likened to a family tree with relationships between objects referred to using terms such as Parent Child Sibling Ancestor a
62. using the same prefix on a username ensures all of the connections are steered to the same LNS for bonding If you have a lot of LNSs we recommend an N 1 arrangement E g if you have 4 LNSs you may set your RADIUS session steering to reply with one of three active LNSs as the first choice perhaps ussing a hash and the 4th backup LNS as a second choice This keeps one LNS as a hot standby for failure and also allows maintenance on it such as s w updates You can then change which of the there LNSs are active and either wait for lines to move when the reconnect or clear lines on the new backup LNS This makes it easy to do rolling upgrades on s w or other maintenance Session steering also allows specific configurations to be based on username and circuit and so on so allowing different responses for different carriers and different end users to be customised if necessary It is also possible to send a copy of the session steering RADIUS to your own RADIUS server for logging 16 8 4 L2TP endpoints The FB6000 will accept L2TP connections on any of its IP addresses but again we recommend allocating a loopback address or using the address from the LAN rather than the interlink address as we know some carriers cannot handle that Unlike RADIUS where any request can go to any LNS the L2TP connections have a state and so you will want the address to stay with the particular LNS Do not have a loopback that floats between LNSs via BGP as this wo
63. various places in the config Table H 56 profile Attributes Attribute Type Default Description and List of NMTOKEN Active if all specified profiles are active as well as all other tests passing including not comment string Comment control switch users List of NMTOKEN Any users Restrict users that have access to control switch initial boolean true Defines state at system startup if not using set interval duration 1 Time between tests invert boolean Invert final result of testing log NMTOKEN Not logging Log target log debug NMTOKEN Not logging Log additional information name NMTOKEN Not optional Profile name not NMTOKEN Active if specified profile is inactive as well as all other tests passing including and or List of NMTOKEN Active if any of these other profiles active regardless of other tests including not or and ppp List of NMTOKEN PPP link state any of these are up recover duration 1 Time before recover i e how long test has been passing route List of IPAddr Test passes if all specified addresses are routeable set switch Manual override ignore ALL other settings source string Source of data used in automated config management table unsignedByte 0 99 Routing table for ping route routetable timeout duration 10 Time before timeout i e how long test has been failing virp List of
64. 0 you should see a page with Configuration needed prominently displayed as shown below Figure 2 1 Initial web page in factory reset state E FireBrick FB2500 Z Test Brick Configuration needed This is a factory reset configuration No usernames and passwords have been configured to access the system Please edit the configuration and add a user and password You can also edit XML Click on the edit the configuration link red text which will take you to the main user interface page for managing the configuration 2 2 1 Add a new user You now need to add a new user with a password in order to gain full access to the FireBrick s user interface Click on the Users icon then click on the Add link to add a user The Users page is shown below with the Add link highlighted Figure 2 2 Initial Users page E FireBrick FB2500 aseaseeae E me E E ES Ed E EJ El Save Cancel There are unsaved changes that have not yet been sent to the FireBrick The config has been changed during your edit if you save now those changes will be replaced by yours Admin users Enter a suitable username in the Name box and enter a password passwords are mandatory as shown below Leave all other checkboxes un ticked but see the Tip below regarding the timeout setting Note Take care to enter the password carefully as the FB6000 does not prompt you for confirmation of the password
65. 0 0 0 0 for IPv4 or 0 for IPv6 in CIDR notation Since the prefix is zero length all destination IP addresses will match this route however it is always the shortest prefix route present and so will only match if there are no more specific routes Such routes therefore acts as a default route The decision of where to send the packet is based on matching the packet s destination IP address to one or more routing table entries If more than one entry matches then the longest most specific prefix entry is used The longest prefix is assumed to be associated with the optimal route to the destination IP address since it is the most specific i e it covers a smaller IP address range than any shorter matching prefix For example if you have two routes one for 10 0 1 32 27 and another for 10 0 0 0 8 which encompasses 10 0 1 32 27 then a destination IP address of 10 0 1 35 will match the longest prefix smallest address range 27 route The order in which routes are created does not normally matter as you do not usually have two routes that have the same prefix However there is an attribute of every route called the 1localpref which decides between identical routes the higher localpref being the one which applies If you have identical routes with the same localpref then one will apply you cannot rely on which one but it can in some cases mean you are bonding multiple links Tip You can show the route s that apply for
66. 0 second sample has a score which is included in the csv and xml lists for any graph The score is also totalled for a graph as a whole and included in the csv 103 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Constant Quality Monitoring technical details and xml list of all graphs This total is done by multiplying the last score by 864 the previous by 863 and so on for the previous 24 hours G 6 Creating graphs and graph names Graph names are text and up to 20 characters Only letters numbers and are allowed All other characters are removed It is recommended that names complying with this are used Any graph name that you try and use that is too long will be replaced with one that uses part of the name and a hash to try and ensure a consistent unique graph name is applied Graphs can be defined in some configuration settings such as interface names Graphs can also be created dynamically in some cases e g L2TP based graphs are made based on the Chargeable User Id Calling Station Id or User Name for a connected line and so can be defined from the RADIUS authentication response It is recommended that the circuit ID is used where available e g from BT platform RADIUS The number of graphs is limited depending on memory but the design is to allow for 100 000 distinctly named graphs Dynamic circuits simply do not have graphs on them if this number is exceeded Graphs not u
67. 2 TP endpoints cuts ia 72 16 857 ISP RADIUS cusco idilio tal ekes Seb0d tit logia 73 17 Command Line Interface cuina aang aio de sects 74 As CIDR and CIDR Notations yp ecaadssencosehe cate ss deena aE Ee drive 75 Be MAC Addresses USA Gi A A blate sat cas leon E ee 77 COVIEANS 2 Av PRMD O 79 D Supported L2TP Attribute Value Pairs 2 0 0 0 cece cee ceeeceeeceeeeaeeea seca eeea cess eeae een eeneeeeeeeees 80 vii www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6202 User Manual D 1 Start Control Connection Request oocoooccncconccnnncnncnnncnnnrnnccnnccnnccnnocnnconnconncnnncnnncnnnenarenose 80 D 2 Start Control Connection Reply scce hrn e EA EE EE E E S E aN i 80 D 3 Start Control Connection Connected coooconncnnccnnccnnnnnnconocnnccnnconnccnncnnnconnconncnnnrnnncnnrnnicnnss 81 D 4 Stop Control Connection Notification 2 0 0 0 cece cece eee eeceeeceeecaeeeaeesaeeae eeu eeneeeeeeennees 81 DS HEM NS 81 D6 Incomms Call Request sco cuss vedios a Gy Mu bad das aoe Uae a ASR Bese 81 D7 Incoming Call Reply ceoosoicianiin itinerante rin incline guna darasweens 82 D 8 Incoming Call Connected 2 0 0 0 cece cece cece a E ceca E EE E EER NE EE ERNS 82 D9 Outeomg Call REquest peon e E E R E a E E dore n 82 D L0 Outgoms Call Reply relser il E E A R E E 83 DAT Outgoms Call Connected are near a e N E a AE E N A S 83 D 12 Call Disconnect Notify rie ee a E e ep a E O TE TE
68. 20 Using the Web interface 2 oroe cus sox po oes des sawangs EEE E p don EEO NEY 59 13 2 7 Usme an HTTP Chente a ls ii ede 59 13 2 7 1 Example using curl and tcpdump oooconoccnccnnncnnccnncnnocnnccnnconnccnnccnnccnncnnnios 59 TASA RRA NONE ALIADO owas E ae eed sty 60 TAT Virtual ROUTES enon Senate decom co de aE ee Sangee te Cate TE Coase eng en teehee net 60 14 2 Contigurino VRR Pia i 61 14 25 Advertisement Intervalo ita 61 VALDES A e ria AS Eds 61 14 3 Using a virtual Toute 3350 05 o5cy cen ass ceca side eons see stersborssusaes eh ice Argos pete capese encase pheen ban iems 61 14 4 VRRP Versions iii ai e da idad 61 14 41 WRRP VersiOn Zeene ee it lil sea AE thes 61 14 42 VRRP Version a A A tada 62 14 5 Compatibility asocio contri lo traders 62 l5 BOP A A Ai 63 E AO A O 63 IS 2 BGP Setup id e II e 63 HZ LAON EW Sorna a A ias 63 1522 Stam dard 2 355 A EME Ae 63 15 23 Simple example Setup circo leader ii maaan eies 64 15 24 Peer iPod 64 15 23 ROULE A O ESE EENI AE AS e 65 15 2 3 1 Matching attributes coo a 65 15 2 3 2 Action attr DUtes Sereni ove dacnnt vet hecdeee igen deeet dacs enbdaewsdougacadentigeneguet ND 65 15 2 6 Well known community tags 0 0 00 cece cece cn ee cee ce eeee cen eeneeeeeeeeeeeeeaeeeaeeenes 66 15 2 7 Bad optional path attributes oooconoccnccnnccnncnnoconoconccnnccnnccnnccnnconncnnncnnnrnnannncnnoss 66 15 2 8 2 lt network gt element OL odor name fad as eee ceeded
69. 4 subnet on the LAN interface after factory reset is 10 0 0 1 24 the address of the FB6000 on this subnet is therefore 10 0 0 1 and the prefix length is 24 bits leaving 8 bits for host addresses on the subnet The subnet address range is therefore 10 0 0 0to10 0 0 255 A prefix length of 32 is possible and specifies a block size of just one address equivalent to a plain IP address specification with no prefix notation This is not the same as a combined subnet and interface IP address definition as it only specifies a single IP address General IP address range specifications CIDR notation can also be used in the FB6000 to express general IP address ranges such as in session rules trusted IP lists access control lists etc In these cases the notation is the same as for routing destinations or subnets i e the address specified is the starting address of the range and the prefix length determines the size of the range 76 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix B MAC Addresses usage Ethernet networks use 48 bit MAC addresses These are globally unique and allocated by the equipment manufacturer from a pool of addresses that is defined by the first three octets bytes which identify the organization and are known as the Organizationally Unique Identifier OUT OUIs are issued by the IEEE more information and a searchable database of existing OUIs are available at http
70. 4Prefix IPv4 address bitlen IPSubnet IP address bitlen IPFilter Route filter Password Password Community XXX XXX community 142 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects PortRange XXX XXX port range Colour rgb rrggbb rgba rrggbbaa colour Secret Secret passphrase duration Period HH MM SS username Login name NMTOKEN ipnamerangelist List of IPranges or ip groups PNameRange routetable Route table number 0 99 unsignedByte ipnamelist List of IP addresses or domain names JPNameAddr datenum Day number in month 1 31 unsignedByte stringlist List of strings string iplist List of IP addresses IPAddr subnetlist List of subnets IPSubnet ra max Route announcement max interval seconds 4 1800 unsignedShort ra min Route announcement min interval seconds 3 1350 unsignedShort ip6list List of IPv6 addresses IP6Addr mtu Max transmission unit 576 2000 unsignedShort vlan VLAN ID O untagged 0 4095 unsignedShort ip4rangelist List of IP4ranges IP4Range macprefixlist List of strings macprefix macprefix MAC prefix hexBinary ip4list List of IPv4 addresses IP4Addr graphname Graph name token cug CUG ID 1 32767 unsignedShort prefixlist List of IP Prefixes IPPrefix nmtokenlist List of NMTOKEN NMTOKEN aslist Li
71. 6000 configurations for you although this will typically be chargeable you may well find this cost effective especially if you are new to FireBrick products If you are not satisfied with the support you are getting from your reseller please contact us http www firebrick co uk contact php 1 3 2 IRC Channel A public IRC channel is available for FireBrick discussion the IRC server is irc z je and the channel is firebrick 1 3 3 Application Notes FireBrick are building a library of Application Note documents that you can refer to each Application Note describes how to use and configure a FireBrick in specific scenarios such as using the device in a multi tenant Serviced Office environment or using the FireBrick to bond multiple WAN connections together www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Introduction 1 3 4 White Papers FireBrick White Papers cover topics that deserve specific discussion they are not related to specific Applications rather they aim to educate interested readers regarding networking protocols common best practice and real world issues encountered 1 3 5 Training Courses FireBrick provide training courses for the FB2x00 series products and also training course on general IP networking that are useful if you are new to networking with IP To obtain information about upcoming courses please contact us via e mail at training firebrick co u
72. 95 Localpref of network highest wins name string Name profile NMTOKEN Profile name source string Source of data used in automated config management speed unsignedInt Egress rate limit b s table unsignedByte 0 99 0 Routing table number routetable H 2 31 network Locally originated networks Network blocks that are announced but not actually added to internal routes note that blackhole and nowhere objects can also announce but add routing Table H 40 network Attributes Attribute Type Default Description as path List up to 10 Custom AS path as if network received unsignedInt bgp bgpmode true BGP announce mode for routes comment string Comment ip List of IPPrefix Not optional One or more network prefixes localpref unsignedInt 4294967295 Localpref of network highest wins name string Name profile NMTOKEN Profile name source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable tag List of Community List of community tags H 2 32 blackhole Dead end networks Networks that go nowhere Table H 41 blackhole Attributes www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Attribute Type Default Description as path List up to 10 Custom AS path as if network received unsignedInt 123 Configuration Objects
73. A a 42 A AA OA 42 SL MOSES A a ee a da 43 A AA O 43 9 2 2 2 Time date testa da a 43 IAS A 43 8 2 3 Inverting overall test result oooocnoncnccnnccnnccnnccnnccnnccnnccnnccnnconnconncnnncnnncnnccnncnnninnns 43 8 2 4 Manual override A sueeos pouaveue gh setae sng tea nish vetoes deeded ee Saude E EEA 43 9 Traffic Shaping mt A a 45 9 1 Grapbhs and Shapers jaissgesesassgswead aes teu snext suet hes qeved tons ead Leauge R E E ENS 45 OA dh Graphs A Seite Agta weed wud teas IU es 45 DVD SHAPERS soen errn r E vocrsdonysdawcsevtedetops e e Eea Sa EE IRE RASER 46 O11 Be Ad hoc Shapers ia id A AS 46 9 14 Lons term Shapers grons ne sot at des siii 46 9 2 Multiple shapers ii A aos woe ea 47 9 3 BASIC PHNCIPleS sss rdar fowatences sumac sup an s usd ole See ENSA EE ete seni 47 10 PPROE ii Al Wes ii 48 10 1 Types of DSL line and router in the United Kingdom oooccoccnncnnccnnccnnconnccnncnnncnnnconncinncos 48 10 2 Definining PPPOE Like A A A IA a 49 10 21 NO 49 10 2 2 Additional OPlOOS dior ri ii Dados Me ee as 49 AA MTU and TER fik ienee e a a otuecaesstoen gus daue tees nyeubaas ayvedaeboueenees 49 10 2 2 2 Service and ac name titi il TE ES 50 IAS A E RN 50 10 2 2 4 Speedsand graphs ii tassel a Nubia de debs ee ce ee ea 50 E O AN 51 12 System EVACUADO Si 52 12 1 Protecting the EBO000 i5 ccs aces emacs seecesionss A R E tue conphbee dings sean sseawed EE ERNE PEA NES S 32 12 2 COMMON sete A A DA IRE 52 12 3 HT
74. B105 tunnels or PPP links the ability to actually send traffic to the route target will depend on the state of the link For such links you can specify route s to automatically create each time the link comes up when the link goes down these routes are removed automatically Refer to Chapter 11 for details on how to achieve this via the routes attribute on the tunnel definition objects This can be useful where a link such as PPPoE is defined with a given localpref value and a separate route is defined with a lower localpref value i e less preferred and therefore acts as a fallback route if the PPPoE link drops 7 4 Routing tables The conventional routing logic described above operates using one of possibly many routing tables that the FB6000 can support simultaneously Routing tables are numbered with the default being routing table 0 zero The various ways to add routes allow the routing table to be specified and so allow completely independent routing for different routing tables The default table table zero is used when optional routing table specification attributes or CLI command parameters are omitted Each interface is logically in a routing table and traffic arriving on it is processed based on the routes in that routing table Tunnels like FB105 and L2TP allow the wrapped tunnel packets to work on one routing table and the tunnel payload packets to be on another Routing tables can be very useful when working with tunn
75. Configuration Objects half Half duplex full Full duplex auto Duplex determined by autonegotiation H 3 14 LinkFlow Physical port flow control setting Table H 78 LinkFlow Physical port flow control setting Value Description none No flow control symmetric Can support two way flow control send pauses Can send pauses but does not support pause reception any Can receive pauses and may send pauses if required H 3 15 LinkClock Physical port Gigabit clock master slave setting Table H 79 LinkClock Physical port Gigabit clock master slave setting Value Description prefer master Master status negotiated preference for master prefer slave Master status negotiated preference for slave force master Master status forced force slave Slave status forced H 3 16 LinkLED y Yellow LED setting Table H 80 LinkLED y Yellow LED setting Value Description Duplex On when full duplex blink when half duplex and collisions detected Collision Activity Blink when Tx or Rx activity Fault On when autonegotiation mismatch Tx Blink when Tx activity Off Permanently off On Permanently on Cycling Cycling pattern H 3 17 LinkLED g Green LED setting Table H 81 LinkLED g Green LED setting Value Link Activity Description On when link up blink when Tx or Rx activity 139 www voip
76. E E E a aa 7 2 2 Amitial Users page cat id A AAA rl es EEE E 7 2 3 Setin up A oe eoa s a ar a E ESEE E PEPON EEE SEPAN TESTE EEO AEOS NESA E EPRS 8 2 4 Configuration being stored 0 00 0 ee cee EEEE EEEE ceca EEE EEEE EAEEREN EE EEEE IKES 8 3 1 Main Menu wis irene r a a lo IU pa a E a batwah ATE aE 11 3 2 Icons Tor layout Controls visiaci orein eee E e E e E E E iSe 12 3 3 Icons for configuration Categories sscosoosssosioniioccio ninas roisse ians sE aTi ESEE EE PEIRES S NEOS EEES aE e 12 3 4 The Setup Category ieska r E EE EE E EEO E EAE EK EEES OES 13 33 Editins an Interface OBJECT deerant e ea o e ts E E E E T a EE ESES 14 3 6 Show hidden attributeS oscri he E EEEE EE EEE EE ES E E 14 3 72 Attribute definitions cocos e oreson iii EE EENES ETSE EESTE SEESE SPEEN TEES iii 14 3 8 Navigati n controls Leo EEVEE EEE EEA EEEE EOE EE KEE EEEIEE 15 4 1 Settna up NEW USER oras cirios nnne EE E e e a E E EE E a 20 4 2 Software upgrade available notification oooooocconcnnccnnconnconncnnncnnnconoconconnconrnnnronncnnccnnccnnccnnioos 25 4 3 Manual Software uplod issos orii eere es s isene nse EE e Rap I EIE a K ES eE EESE EaI SEE spa PESAS 26 B 1 Product label showing MAC address range ooococcconccnccnnconnconnconnconnccnncnnnconncnnncnnnrnnncnnronarenicnnos 77 xii www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 List of Tables 2 1 Praddresses for cOMpuUter 4 j2iss
77. E S 83 DiI WAN Error Notify en ne o N E A E e E TR EERST NNE e eii 83 DAA Set Link Infoe fein aie Ai Aid 83 DS NOLES ao ienee ina e E EAA S a Ea A E r RE Ee 84 DIAS T BT E ate Dotes da 84 A NO A O 84 E Supported RADIUS Attribute Value Pairs for L2TP operation ocoocccoccnccnnccnnconnconncnnnccnnconaconncnnnos 85 Bel Authentication AAA becdca desu duwes even tes tesh abet r a SEs ae areas 85 E 2 Authentication responsen enere e pios tia 86 E21 Accepted authentication sisya e S ges be san ss sh wed tess dto Deben 86 E 2 11 1 Pref1x Dele gation cns snena A a I 87 E 2 2 Rejected Authentication ace svecs Sac seh sacwabensheogere iter stunt EE E RE EEAS 87 E3 Accounting ataca Ed tate ee ued ta RI eed a et eo a 87 E4 ACCountn e iterii escote corralito E spo sem aes abana shoes tuedebsetey RE EAEE erties 88 ES Accounting Stop ducto di pat 89 El6 DISCONMECE ssessceu she n ne Mea Seo teehee abn aned aa voba densa pino Ea snespano de thse E EiS 90 E 7 Change of Authorisation y ta a a ls 90 ES Filter 1D ieoa tase somdee e sete coe nodes seh Suma e Sea he by Seanad nied EE A EE e sete cee 91 EYI NOES aiii iii is 92 NI A O wed tae due sbeccueuS hana seus dso a aes 92 E 9 2 LCP echo and COM graphs 0 0 00 re oa ea cece ceeca cece cece E EEEE E E NENS 92 B93 Pover ECP A NON 93 E 9 4 Closed User COTO ote le Res ob ae BSNS a a ce ER 93 B95 Routing table io sssesiciaies case ireland tesis 93 E Command sine reference mia tt litio
78. FireBrick FB6202 User Manual 3 FB6000 Versatile Network Appliance www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6202 User Manual This User Manual documents Software version V1 27 001 Copyright O 2012 2013 FireBrick Ltd www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Table of Contents O xvi T Introd ton il A E EEEE E TS Bee eee esos ees 1 LV Fhe EBO0000 EEE EE T TEET 1 1 1 1 Where dop Start iii oeei S E EEEE EEE E ESSE EEES 1 1 1 2 What canit do cusgia lts rates 1 1 1 2 1 FB6202 Gigabit L2TP LNS with detailed monitoring of all lines 2 1 1 3 Ethernet port Capabilities s src assier ks seinar tep Er Er E eE canina estra 2 1 1 4 Product variants in the FB6000 series oocoooccnoccnccnnccnnnnnncnnncnnccnnccnnccnnccnnccnnconnconncos 2 1 2 About this Mayal sissors aa e sr E E E raros ERT 2 1 22 Tice Version veshe A A E E a 2 1 2 2 Intended audience sesos ticas sons igshones fs sera sdseessesdessoveagebeoseessanvearg eae 3 1 23 Technical detallo lapso pide necedad 3 1 2 4 Document Style cres ses cios Is rare bette amighas poros press 3 1 2 5 Document CONVENLONS os cess odes see erre EE Aden ende ER ARO eds 3 1 2 6 Comments and feedback c 0 5cc00 sisesscessssesscabeesteop seventies dheeSansdsevete edi vesdene
79. OKEN Profile name source string Source of data used in automated config management H 2 20 interface Port group VLAN interface settings The interface definition relates to a specific physical port group and VLAN It includes subnets and VRRP that apply to that interface Table H 26 interface Attributes Attribute Type Default Description 116 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects comment string Comment cug unsignedShort Closed user group ID 1 32767 cug cug restrict boolean Closed user group restricted traffic only to from same CUG ID graph token graphname Graph name link NMTOKEN Interface to which this is linked at layer 2 log NMTOKEN Not logging Log events including DHCP and related events log debug NMTOKEN Not logging Log debug log error NMTOKEN Log as event Log errors mtu unsignedShort 1500 MTU for this interface 576 2000 mtu name NMTOKEN Name ping IPAddr Ping address to add loss latency to graph for interface port NMTOKEN Not optional Port group name profile NMTOKEN Profile name ra client boolean true Accept IPv6 RA and create auto config subnets and routes restrict mac boolean Use only one MAC on this interface source string Source of data used in automated config management source filter sfoption Source filter traffic received vi
80. PoE header The PPPoE header has the session PPPoE ID that is the local end L2TP session ID The faked protocol header has target MAC of 00 00 00 00 00 00 and source MAC of 00 00 00 00 00 01 for received packets and these reversed for sent packets 58 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Network Diagnostic Tools 13 2 5 Snaplen specification The snaplen argument specifies the maximum length captured but this applies at the protocol level As such PPP packets will have up to the snaplen from the PPP protocol bytes and then have fake PPPoE and Ethernet headers added A snaplen value of O has special meaning it causes logging of just IP TCP UDP and ICMP headers as well as headers in ICMP error payloads This is primarily to avoid logging data carried by these protocols 13 2 6 Using the web interface The web form is accessed by selecting the Packet dump item under the Diagnostics main menu item Setup the dump parameters with reference to Table 13 1 and click the Dump button Your browser will ask you to save a file which will take time to save as per the timeout requested 13 2 7 Using an HTTP client To perform a packet dump using an HTTP client you first construct an appropriate URL that contains standard HTTP URL form style parameters from the list shown in Table 13 1 Then you retreive the dump from the FB6000 using a tool such as curl The URL is htt
81. RADIUS Control messages The FireBrick also supports RADIUS control messages These can be used to disconnect a connection or to update the details of the connection including line speed time or data limits and routing apart from the PPP endpoint and DNS The update can also include change of routing table This can be useful to move an active connection in to a walled garden and back without ever dropping the PPP connection itself This can be useful for credit control systems 16 7 PPPoE In addition to working as a conventional LNS the FireBrick can also be configured to operate as a PPPoE endpoint as a BRAS The PPPoE connections appear as if they has arrived via L2TP so can have local IP termination or relay via L2TP to another LNS The FireBrick supports baby jumbo frame negotiation to allow full 1500 byte MTU operation 16 8 Typical configuration The FB6000 is very felxible but a typical configuration for L2TP as an ISP connected to a carrier generally follows a standard set up Some carriers need specific extra settings and the FireBrick support team can provide examples if you require 16 8 1 Interlink subnet A carrier will normally have an interlink this could be a dedicated port on the FB6000 or a VLAN perhaps via a suitable switch In any case this is an interface in the configuration Some carriers use a 30 IPv4 interlink per LNS and some use a larger subnet covering several LNSs 16 8 2 BGP with carrier T
82. Session steering gives a lot of control to the ISP and is ideal if you operate bonding connections where multiple links need to use the same LNS The carrier will typically expect you to have two RADIUS endpoints to which they can send requests One for master and one for backup Whilst the FB6000 will answer RADIUS on any of its IP addresses we know some carriers have issues using the interlink IP addresses We recommend you create two additional loopback addresses for session steering RADIUS These addresses are configured as a BGP announced loopback address You can use MEDs to steer which IP is on which LNSs If you have more than two LNSs you can ensure that the same IPs are announced from more than one LNS and let BGP decide which LNS gets the RADIUS requests RADIUS is a simple question and answer protocol so it does not matter which LNS gets the request The session steering configuration Platform RADIUS is very flexible We suggest you use the same configuration on each LNS so that the replies are consistent regardless of where the request goes The reply says where to connect the session as well as hostname and password to use The reply can be a single LNS or can be more than one reply with a priority tagging if the carrier supports this The FB6000 can pick an LNS randomly from a set or pick one based on a hash of the username part of the username or circuit ID This can be useful when multiple lines are in a bonded arrangement where
83. TP Server Configuration 5 5c08h ease yeeass e co agebeden seuuh oad gausaen dy nadaa N st tone 53 12 3 L ACCEss COMO ii sce Gea cee leek a a DA A E E tebe ds 53 123 1 Trusted Address numerito iii 53 12 4 Telnet Server CONTISUCAON tias E R E Madde a ine ae ad 54 12 41 ACCESS COMO sod sega snstoee tendon idee sees hess sob Ren ndort beaten a orden pi ANER 54 12 5 DNS Conti stration ii iO DEE ada 54 129 1 Blocking DNS NAMES ea ops E ERE REEN O EA EE NRE RNE S 54 12 5 2 Local DNS responses sr rE aE ee nek ee Mee aT E RAS 54 12 33 Auto DHCP PNS ren nea e a e tons tue a shone a a Ne aae 55 12 6 NTP Contre Uration ne it rain 55 12 7 SNMP c nfic tation 23 cess K E AE eae E E AE E YE S SS 55 12 8 RADIUS confi curation Sua ro r E O E AE R a E E E Ree apts 55 12 8 1 RADIUS server platform RADIUS oocooccoccncnnconococonocnconococonanocononoconanoconannconanos 55 12 8 2 RADIUS Cent E E E E N ae es 55 13 Network AAA IT 56 15 1 Access Check orseson is eee faa E a i 56 A IN O een hseaceesaent ovules dese ea N 57 15 21 Dump parameters von te io fis 57 13 22 Security settings TEQUITEM sossen sre nn EPen e Sue n py veda EEEIEE san Santee pra se 58 13 2 3 JP address matching An A 58 1322 42 Packet types cs sige oegd oe doi eric 58 13 2 5 Snaplen Speci Caton svc sh oi ois ile O A ts Re ee ts 59 vi www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6202 User Manual 13
84. US server settings 0c ccc ceee cece eee ce teen cece eens eeneeneeennees 115 H 2 18 ethernet Physical port controls snese inr nsn a E E SE 116 H 2 19 portdef Port grouping and naming cccoooccnncccnnnccnnnnconnncnnnnconnnncnnnccnnnncinnninnnnss 116 H 2 20 interface Port group VLAN interface settings oocococcnnccnnconoconiconaconnnnnccnnconinnnos 116 H 2 2 1 s bnet Subnet setings usne a ANE R a ths E EN A E NES 117 2 22 Vrrp VRRP settings cis ala led Gad AVE E SO E oa S EE 118 H223 dheps DHCP Server setting Sanne ean R E a EE a EE ARa 119 H 2 24 dhcp attr hex DHCP server attributes hex ooocoococcnonocononocononoconacoconococonanoconos 120 H 2 25 dhcp attr string DHCP server attributes string ooooccooccnnconoconncnnncnnncnnccnanonoss 120 H 2 26 dhcp attr number DHCP server attributes numeric occoococononocononocononoconanocononos 120 H 2 27 dhcp attr ip DHCP server attributes IP ooooooonccnccnnconnccnnconnconoconoconacnnncnnronoso 121 H2 28 pppoe PPPoE settimgsi s 2 0 ac ile cati os tect eects Bea tae ht ee eee eee 121 4 2 29 ppp route PPP Toutes ieres ee REE EERE EEE E AEA RE EEES ERENER 122 B23 0 routes Statie TOUTES sua di ir 122 H 2 31 network Locally originated networks ocoooccnoconoconoccnonnnocnncnnoronccnnconnconnccnnioos 123 H 2 32 blackhole Dead end networks oooccocccnccnnccnnconnconoconoconoconaconocnnconaconccnnrinncnnns 123 H 2 33 loopback Locally or
85. a pair of routers as 1t allows all outbound traffic to continue while stopping inbound traffic 15 2 13 TTL security The FireBrick supports RFC5082 standard TTL security Simply setting ttl security 1 on the peer settings causes all of the BGP control packets to have a TTL of 255 and expects all received packets to be TTL 255 as well You can configure multiple hops as well setting ttl security 2 for example still sends TTL 255 but accepts 254 or 255 This works up to 127 You can also configure a non standard forced TTL mode by setting a negative TTL security 1 to 128 which forces a specific TTL on sending packets but does not check received packets For example setting ttl security 1 causes a TTL of 1 on outgoing packets This simulates the behaviour of some other routers in IBGP mode Using 2 3 etc will simulate the behaviour of such routers in EBGP multi hop mode This is non standard as RFCs recommend a much higher TTL and BGP does not require TTLs to be set differently Without ttl security set or set to 0 the RFC recommended default TTL us used on all sent packets and not checked on received packets 67 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 16 Internet Service Providers The FireBrick can be used by Internet Service Providers ISPs to provide Internet connectivity by acting as a gateway between a carrier network e g Broadband or mobile carrier and
86. a this interface table unsignedByte 0 99 0 Routing table applicable routetable vlan unsignedShort 0 VLAN ID O untagged 0 4095 vlan Table H 27 interface Elements Element Type Instances Description dhcp dhcps Optional unlimited DHCP server settings subnet subnet Optional unlimited IP subnet on the interface virp virp Optional unlimited VRRP settings H 2 21 subnet Subnet settings Subnet settings define the IP address es of the FireBrick and also allow default routes to be set Table H 28 subnet Attributes www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Attribute Type Default Description accept dns boolean true Accept DNS servers specified by DHCP arp timeout unsignedShort 60 Max lifetime on ARP and ND bgp bgpmode BGP announce mode for routes 117 Configuration Objects broadcast boolean false If broadcast address allowed comment string Comment gateway List of IPAddr One or more gateways to install ip List of IPSubnet Automatic by DHCP One or more IP len localpref unsignedInt 4294967295 Localpref for subnet highest wins mtu unsignedShort As interface MTU for subnet 576 2000 mtu name string Name profile NMTOKEN Profile name proxy arp boolean false Answer ARP ND by proxy if we have routing ra ramode false If to announce IPv6 RA for this subnet ra dns List of IP6Addr Lis
87. active You can also configure the set attribute with a value of cont rol switch This causes the profile to be set manually based on a control switch which is not stored in the configuration itself The switch appears on 43 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Profiles the home web page allowing it to be turned on or off with one click It can also be changed from the command line You can restrict each switch to one or more specific users to define who has control of the switch This control applies even if the user has no access to make configuration changes as the switch is not part of the config The switch state is automatically stored in the dynamic peristent data along with DHCP settings etc so survives a power cycle restart Note that the value of the invert attribute is ignored when manual override is requested These fixed state profiles can be used as simple on off controls for configuration objects The following shows an example of two such profiles expressed in XML lt profile name 0ff set false gt lt profile name 0n set true gt lt profile name IT Support comment Allow IT support company access to server set control switch gt 44 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 9 Traffic Shaping The FB6000 includes traffic shaping functionality that allows you to control the
88. ad traffic routetable pppdns1 IP4Addr PPP DNS1 IPv4 default pppdns2 IP4Addr PPP DNS2 IPv4 default pppip IP4Addr Local end PPP IPv4 profile NMTOKEN Profile name radius string Name for RADIUS server config to use relay nas ip boolean true Pass remote L2TP endpoint as NAS IP require platform boolean false All sessions require a platform RADIUS first require radius acct boolean Close session if cannot do RADIUS accounting retry timeout unsignedB yte 60 Interval to retry sending control messages before fail secret Secret Shared secret shutdown boolean false Refuse all new sessions or tunnels source string Source of data used in automated config management 130 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects speed unsignedInt Default egress rate limit b s table unsignedByte 0 99 0 Routing table number for L2TP session routetable tcp mss fix boolean false Adjust MSS option in TCP SYN to fix session MSS test List of IPAddr List of IPs to which routing must exist else tunnel dropped deprecated Table H 54 12tp incoming Elements Element Type Instances Description match 12tp relay Optional unlimited Rules for relaying connections and local authentication H 2 41 I2tp relay Relay and local authentication rules for L2TP Rules for relaying L2TP or local auth
89. ader for cross site javascript allow origin allow List of Allow from List of IP ranges from which service can be IPNameRange anywhere accessed comment string Comment css url string Additional CSS for web control pages local only boolean true Restrict access to locally connected Ethernet subnets only log NMTOKEN Not logging Log events log debug NMTOKEN Not logging Log debug log error NMTOKEN Log as event Log errors port unsignedShort 80 Service port profile NMTOKEN Profile name source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable trusted List of List of allowed IP ranges from which IPNameRange additional access to certain functions is available H 2 12 dns service DNS service settings DNS forwarding resolver service Table H 16 dns service Attributes Attribute Type Default Description allow List of Allow from List of IP ranges from which service can be IPNameRange anywhere accessed 111 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects auto dhcp boolean Forward and reverse DNS for names in DHCP using this domain comment string Comment domain string Our domain local only boolean true Restrict access to locally connected Ethernet subnets only log NMTOKEN Not logging Log events log debug NMTOKEN Not logging Log
90. an be used where it is necessary to communicate with devices on two different subnets and it is acceptable that the subnets exist in the same broadcast domain For example it may not be possible to reassign machine addresses to form a single subnet but the machines do not require firewalling from each other Note As discussed in Section 6 1 an interface is associated with a broadcast domain therefore multiple subnets existing in a single broadcast domain are not isolated at layer 2 from each other Effective firewalling at layer 3 cannot be established between such subnets to achieve that subnets need to exist in different broadcast domains and thus be on different interfaces An example of this is seen in the factory default configuration which has two interfaces WAN and LAN allowing firewalling of the LAN from the Internet You may also have both IPv4 and IPv6 subnets on an interface where you are also using IPv6 networking The primary attributes that define a subnet are the IP address range of the subnet the IP address of the FB6000 itself on that subnet and an optional name The IP address and address range are expressed together using CIDR notation if you are not familiar with this notation please refer to Appendix A for an overview To create or edit subnets select the Interface category in the top level icons then click Edit next to the appropriate interface under the section headed IP subnet on the interface
91. an see there would be almost no configuration needed all packets would find the best route accross the Internet automatically To some extent this is what happens between major transit providers in the Internet backbone In practice things are not that simple and you will have some specific relationships with peers when using BGP For most people there will be transit providers with which you peer You can receive a full table from each transit provider containing routes to everywhere in the Internet via that provider The FB6000 can then decide which provider has the best route to any destination You can advise the transit provider of your own routes for your own network so that they can route to you and they tell their peers that they can route to you via that provider This only works if you have IP address space of your own that you can announce to the world unless you are an ISP then this is not commonly the case Even though IPv4 address space has already run out it is possible to obtain IPv6 PI address space and an AS number to announce your own IPv6 addresses to multiple providers for extra resilience You can use BGP purely as an internal routing protocol to ensure parts of your network know how to route to other parts of your network and can dynamically reroute via other links when necessary In most cases unless you are an ISP of somesort you are not likely to need BGP 15 2 BGP Setup 15 2 1 Overview The FB6000 series rou
92. and source e Route matching attributes allowing specific routes to be selected e Action attributes defining changes to the route e A continuation attribute stop defining if the matching stops at this rule default or continues to check further rules The rules are considered in order The first rule to match all of the matching attributes is used If no rules match then the default actions from the import export object are used In addition the top level import export has a prefix list If present then this will limit the prefixes processed at a top level dropping any that do not match the list without even considering the rules 15 2 5 1 Matching attributes The actual attributes are listed in the XML XSD documentation for the software version The main ones are e A list of prefixes filters defining which prefixes to match e There will be community tag checking and AS path checking in future You can have arule with no matching attribute which will always be applied but this is generally pointless as no later rules will be considered If you want to define defaults then set them in the top level import export object 15 2 5 2 Action attributes The actual attributes are listed in the XML XSD documentation for the software version The main ones are e Adding specific community tags e Removing specific community tags including defaults added by the peer type e Dropping the route completely e Changing the MED e Changing the lo
93. and state information which are useful for debugging Note that there are some system events such as startup and shutdown which are always logged to all log targets and to the console and flash by default regardless of these logging attributes 5 8 Using Profiles The log target itself can have a profile which stops logging happening when the profile is disabled Also each of the external logging entries can have a profile Some types of logging will catch up when their profile comes back on e g email but most are immediate such as syslog and SMS and will drop any entries when disabled by an Inactive profile 32 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 6 Interfaces and Subnets This chapter covers the setup of Ethernet interfaces and the definition of subnets that are present on those interfaces For information about other types of interfaces refer to the following chapters e Point to Point Protocol over Ethernet PPPoE Chapter 10 e Tunnels including FB105 tunnels Chapter 11 6 1 Relationship between Interfaces and Physical Ports The FB6000 features two Gigabit Ethernet 1Gb s ports These ports only work at gigabit speeds Each port features a green and amber LED the functions of which can be chosen from a range of options indicating link speed and or traffic activity The exact function of the ports is flexible and controlled by the configurati
94. as a graph and shaper based on the circuit ID which is specifc to that session This is important for bonding multiple sessions as it controls the levels of traffic sent via each session Obviously traffic could come in via one L2TP tunnel and go back out via another incurring yet another set of shapers as above e PPPoE links can also have a defined shaper which is important when bonding multiple links as it is used to decide how much traffic goes via each link It is possible to create a bonded gateway route where multiple routes exist for the same target typically a default gateway and each route as a speed set which is itself a shaper This is used to control how much traffic goes via each of the bonded routes You simply create more than one route object with a speed or graph setting The egress interface can have a defined shaper 9 3 Basic principles Each shaper tracks how far ahead the link has got with traffic that has been recently sent This depends on the length of packets sent and the speed of the shaper This is essentially tracking how much is likely to be queued at a bottleneck further on The FB6000 does not delay sending packets and assumes something with a lower speed is probably queuing them up later This record of how far ahead the traffic is gets used in two ways If the shaper is too far ahead then packets are dropped causing the link to be rate limited to the selected speed Exactly how much is too far dep
95. assword profile NMTOKEN Profile name source string Source of data used in automated config management table unsignedByte 0 99 0 Restrict login to specific routing table routetable timeout duration 5 00 Login idle timeout zero to stay logged in H 2 4 log Log target controls Named logging target Table H 7 log Attributes Attribute Type Default Description colour Colour Colour used in web display comment string Comment console boolean Log immediately to console flash boolean Log immediately to slow flash memory use with care jtag boolean Log immediately jtag development use only name NMTOKEN Not optional Log target name profile NMTOKEN Profile name source string Source of data used in automated config management Table H 8 log Elements Element Type Instances Description 107 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects email log email Optional unlimited Email settings syslog log syslog Optional unlimited Syslog settings H 2 5 log syslog Syslog logger settings Logging to a syslog server Table H 9 log syslog Attributes Attribute Type Default Description comment string Comment facility syslog facility LOCALO Facility setting port unsignedShort 514 Server port profile NMTOKEN Pro
96. at type defined Tip Since the attribute name is a compact concise and un ambiguous way of referring to an attribute please quote attribute names when requesting technical support and expect technical support staff to discuss your configuration primarily in terms of attribute and object element names rather than descriptive text or physical location on your screen both of which can vary between software releases 3 4 3 Navigating around the User Interface You navigate around the hierarchy using one or more of the following e configuration category icons e the breadcrumbs each part of the breadcrumbs delimited by the symbol is a clickable link e the in page navigation buttons shown in Figure 3 8 Up move one level up in the object hierachy Prev Previous object in a list and Next Next object in a list Figure 3 8 Navigation controls Interface interface 2 of 3 LAN Up Prev Next New Erase Help Caution The configuration pages are generated on the fly using JavaScript within your web browser environment i e client side scripting As such the browser is essentially unaware of changes to page content and cannot track these changes this means the browser s navigation buttons Back Forward will not correctly navigate through a series of configuration pages Please take care not to use the browser s Back button whilst working through configuration pages navigation between such pages mu
97. ax 44 0 1245 808299 Event Logging All log targets can be viewed via the web User Interface regardless of whether they specify any external logging or logging to Flash memory 5 6 2 Viewing logs in the CLI environment The command line allows logs to be viewed and you can select which log target or all targets The logging continues on screen until you press a key such as RETURN In addition anything set to log to console shows anyway see Section 5 1 1 2 unless disabled with the troff command 5 7 System event logging Some aspects of the operation of the overall system have associated events and messages that can be logged Logging of such events is enabled via the system object attributes shown in Table 5 2 below Table 5 2 System Event Logging attributes system object attribute Event types log General system events log debug System debug messages log error System error messages log eth General Ethernet hardware messages log eth debug Ethernet hardware debug messages log eth error Ethernet hardware error messages log panic System Panic events log stats One second stats messages Specifying system event logging attributes is usually only necessary when diagnosing problems with the FB6000 and will typically be done under guidance from support staff For example log stats causes a log message to be generated every second containing some key system statistics
98. ax The metric is used as localpref in routing Delegated IPv6 123 IPv6 prefix to be routed to line Maximum localpref used Prefix Framed IPv6 Prefix 97 IPv6 prefix to be routed to line Maximum localpref used Framed IPv6 Route 99 May appear more than once Text format is Pv6 Address Bits metric The target IP is ignored but must be valid IPv6 syntax The metric is used as localpref in routing Alternative format Pv6 Bits IPv4 Address metric defines that prefix is to be protocol 41 IPv4 tunneled to specified target via this link Rh User Name Username may be specified this replaces the username already present and is then used on accounting start and relay L2TP CHAP Password 3 CHAP Password may be specified this replaces the CHAP ID and response that is then sent on to a tunnel Called Station Id 30 Called number may be specified this replaces the number already present and is then used on the accounting start and relay L2TP Calling Station Id 31 Calling number may be specified this replaces the number already present and is then used on the accounting start and relay L2TP Chargeable User 89 This is used as the preferred CQM graph name Identity Class 25 Secondary CQM graph name to group sessions allowing group logging or shaping Session Timeout 27 Absolute limit on session in seconds Filter Id 11 See filter ID section Framed MTU 12 Set MTU for sessio
99. be sent as an authentication reject message The reply Try another causes the L2TP session to be closed with result error 2 7 Try another without sending an authentication reply on PPP E 3 Accounting Start Table E 4 Accounting Start AVP No Usage Acct Status Type 40 1 Start 87 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported RADIUS Attribute Value Pairs for L2TP operation User Name 1 Username from authentication PAP CHAP or proxy authentication received on L2TP or received in authentication response Class 25 From authentication response if present Chargeable User 89 Graph name that applies sanitised to comply with CQM graph name rules Identity Called Station Id 30 Called number as received on L2TP Calling Station Id 31 Calling number as received on L2TP Service Type 6 Framed Framed Protocol 7 PPP Framed MTU 12 Final MTU being used for session Filter Id 11 Filters in use Session Timeout 27 Absolute limit on session in seconds if specified in authentication reply Framed Interface ID 96 Peer IPv6 Interface ID from PPP IPV6CP Framed IP Address 8 Peer IPv4 address negotiated in PPP normally from authentication response Connect Info 77 Text Tx speed Rx speed in use Acct Delay Time 41 Seconds since session started Acct Event 55 Session start time unix timestam
100. calpref 65 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 BGP You can have a rule with no action attributes If matched then this means none of the actions are taken and communities localpref med etc are all unchanged 15 2 6 Well known community tags Specific well known communities are supported natively Some of these are set automatically based on peer type and can be explicitly removed using the detag action These rules are automatically checked for exporting routes unless overridden on the peer attributes Table 15 2 Communities Community Name Meaning FFFFFFO1 no export The route is not announced on any EBGP session other than confederation or where allow export is set FFFFFF02 no advertise The route is not considered part of BGP Whilst it is applied and used for routing internally it is not announced at all or considered to have been received for the purposes of BGP FFFFFF03 local as The route is only advertised on IBGP same AS sessions FFFFFF04 no peer This tag is passed on to peers but does not have any special meaning internally 15 2 7 Bad optional path attributes The BGP specification is clear that receipt of a path attribute that we understand but is in some way wrong should cause the BGP session to be shut down This has a problem if the attribute is one that is not known to intermediate routers in the internet which mean
101. ccess is allowed from everywhere Note that if Local only is specified the allow list allows access from addresses that are not local if they are in the al low list local only This normally defaults to true but not in all cases If true then access is only allowed from machines on IPs on the local subnet and any addresses in the allow list if specified log The standard log log error and log debug settings can be used to specified levels of logging for the service A locally attached subnet is one which can be directly reached via one of the defined interfaces i e is not accessed via a gateway Tip Address ranges in allow can be entered using either lt first address gt lt last_address gt syntax or using CIDR notation lt start address gt lt prefix length gt If a range entered using the first syntax can be expressed using CIDR notation it will be automatically converted to that format when the configuration is saved You can also use name s of defined IP address group s which are pre defined ranges of IPs 12 3 HTTP Server configuration The HTTP server s purpose is to serve the HTML and supporting files that implement the web based user interface for the FB6000 It is not a general purpose web server that can be used to serve user documents and so there is little to configure 12 3 1 Access control By default the FB6000 will allow access to the user interface from any machine although obvi
102. ce e a een ene cea ee Eee GE EE Ee Ee EEE EEE 137 H 71 day Day tame 3 letter mociones hal sana A captive E EESE eee EEN 137 H 72 radiuspriority Options for controlling platform RADIUS response priority tagging 4 137 H 73 radiustype Type of RADIUS server seeria cece ec cece cece cece E EA E eE Ee 138 E74 port Physical port oi ata lends bluse td eid tos 138 H 75 Crossover Crossover Configuration sss eka y e seca ceca cece cena eens eens EREN a Ee aE 138 H 76 LinkSpeed Physical port speed 20 0 0 eee cee cee cee ce eeee teen ceca E E EE T 138 H 77 LinkDuplex Physical port duplex setting coooccnoccncconocnnccnnocnnncnoronoronncnnccnnccnncconccnnconnconncos 138 H 78 LinkFlow Physical port flow control setting 2 0 0 0 cece cece cece cn ee cece cece nee neeeneeeeeeeeeseeeeaeeeaes 139 H 79 LinkClock Physical port Gigabit clock master slave setting ooocococcnnconoconccnnccnnncnnncnnroninnnns 139 H 80 LinkLED y Yellow LED setting oriona eee E cece cece cenn eens E AE E SENTO 139 B81 EmkEED 9 Green LED Setting seres ocre sues foe coun sted oars ts ina oe E dane eos soeedaassaeestee tees 139 H 82 LinkPower PHY power saving Options ocoooccnoconoconccnnncnnncnncnnnronconccnnccnnccnnccnnconncnnncnnncnnnes 140 H 83 LinkFault Link fault type to send eee ccc n ee EEn E p Ep IS 140 H 84 ramode IPv6 route announce level cece cece cence eee eceeeeeeeeeeeeeeeeeeeeaeseaeeea sean seas eeaes 140
103. ce string Source of data used in automated config management 115 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects table unsignedByte 0 99 Routing table number routetable type Set of radiustype All Server type H 2 18 ethernet Physical port controls Physical port attributes Table H 24 ethernet Attributes Attribute Type Default Description autoneg boolean auto negotiate unless Perform link auto negotiation manual 10 100 speed and duplex are set clocking LinkClock prefer slave Gigabit clock setting crossover Crossover auto Port crossover configuration duplex LinkDuplex lauto Duplex setting for this port C flow LinkFlow none Flow control setting green LinkLED g Link Activity Green LED setting optimise boolean true enable PHY optimisations port port Not optional Physical port power saving LinkPower full enable PHY power saving send fault LinkFault Send fault status shutdown boolean false Power down this port speed LinkSpeed fauto Speedsettingforthisport yellow LinkLED y Tx Yellow LED setting H 2 19 portdef Port grouping and naming Port grouping and naming Table H 25 portdef Attributes Attribute Type Default Description comment string Comment name NMTOKEN Not optional Name ports Set of port Not optional Physical port s profile NMT
104. ce will reply with this MAC address when an ARP request is sent for the virtual router s IP address Since the MAC address associated with the virtual IP address does not change ARP cache entries in other devices remain valid throughout the master backup switch over and other devices are not even aware that the switch has happened apart from a short black hole period until the backup starts routing When there is a switch over the VRRP packets that are multicast are sent from this special MAC so network switches will automatically modify internal MAC forwarding tables and start switching traffic to the appropriate physical ports for the physical router that is taking up the active routing role Note You can disable the use of the special MAC if you wish and use a normal FireBrick MAC However this can lead to problems in some cases 60 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 VRRP 14 2 Configuring VRRP VRRP operates within a layer 2 broadcast domain so VRRP configuration on the FB6000 comes under the scope of an interface definition As such to set up your FB6000 to participate in a Virtual Router group you need to create a vrrp object as a child object of the interface that is in the layer 2 domain where the VRRP operates 14 2 1 Advertisement Interval A master indicates that it still alive by periodically sending an advertisement multicast packet to the group me
105. ch provide their own routes only internal peers making an IBGP mesh customers to which transit is provided and customer routes may be accepted To make this set up simple the lt peer gt definition contains a type attribute This allows simple BGP configuration such as lt bgp as 12345 gt lt peer as 666 name transitl type transit ip 1 2 3 4 gt lt peer as 777 Name transii2 tyoe transit ip 2 3 4 0 2 3 4 6 gt lt peer type internal ip 5 6 7 8 gt lt bgp gt This example has two transit providers the second of which is actually two peer IP addresses and one internal connection Note that the peer AS is optional and unnecessary on internal type as it has to match ours The exact elements that apply are defined in the XML XSD documentation for your software release 15 2 4 Peer type The type attribute controls some of the behaviour of the session and some of the default settings as follows Table 15 1 Peer types Type Meaning normal Normal mode no special treatment Follows normal BGP rules transit Used when talking to a transit provider or a peer that provides more than just their own routes Peers only with different AS The community no export is added to imported routes unless explicitly de tagged peer Used when talking to a peer providing only their own routes Peers only with different AS The community no export is added to imported routes unless explicitly de ta
106. ckets to 74 bytes if length fields appears to be less needed to work around bug in BT 20CN BRAS for IPv6 in IP over LCP mode C Send all IPv4 and IPv6 using the LCP type code only works if FireBrick doing PPP at far end O Mark session as low priority see shaper and damping P Mark session as premium see shaper and damping Sn Set LCP echo rate to n seconds default 1 sn Set LCP timeout rate to n seconds default 10 bn Disable anti spoofing source filtering 91 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported RADIUS Attribute Value Pairs for L2TP operation q n Specify or add to quota for tx bytes Use either q or Q Action depends on Terminate Action Q n Specify or add to quota for total tx rx bytes For change of authorisation the absence of a filter has no effect To set normal routing table 0 zero send TO To set not a member of a CUG send AO E 9 Notes E 9 1 L2TP relay L2TP relay means that an incoming call ICRQ is relayed to another L2TP endpoint The decision of which calls to relay to what endpoint can be made in one of two ways e Configured pattern match based on calling number called number or login e RADIUS response to initial authentication request advising new endpoint for connection A test is made against the config on the initial connection based on known data This is calling number if pres
107. connection is a member of a closed user group n 1 32767 and is restricted to sending traffic to from connections in the same CUG H Sets the connection to send HDLC framing headers on all PPP packets This adds 2 extra byte to the packet This is the default setting h Sets the connection not to send HDLC framing headers on all PPP packets This is in accordance with the L2TP PPP RFCs This does not work on BT 21CN BRASs Sets TCP MTU fix flag which causes the MTU option in TCP SYN to be adjusted if necessary to fit MTU f Sets no TCP MTU fix M Sets the connection to ignore the MRU Actually the MRU is used to generate ICMP errors for IPv6 and IPv4 with DF set but otherwise full size packets are sent on the connection even if a lower MRU was advised This is in accordance with the PPP RFC but breaks some routers that do not accept 1500 byte packets e g PPPoE m Sets the connection to fragment IPv4 packets with DF not set that are too big for the advised MRU This is teh default i L This is not a filter and not confirmed back on accounting start and not valid on Change of Authorisation It forces a restart of LCP negotiation This is useful when BRASS lie about negotiated LCP such as BTs 21CN BRASs This is not a filter and not confirmed back on accounting start and not valid on Change of Authorisation It stops an LCP negotiation restart that may be planned e g due toan MRU mismatch X Pad pa
108. dByte 0 99 0 Routing table number routetable H 2 9 ntp service NTP service settings The NTP settings define how the system clock is set from what servers and controls for daylight saving summer time The defaults are those that apply to the EU www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 109 Configuration Objects Table H 13 ntp service Attributes Attribute Type Default Description allow List of Allow from List of IP ranges from which service can be IPNameRange anywhere accessed comment string Comment local only boolean true Restrict access to locally connected Ethernet subnets only log NMTOKEN Not logging Log events log debug NMTOKEN Not logging Log debug log error NMTOKEN Log as event Log errors ntpserver List of IPNameAddr ntp firebrick Itd uk List of time servers IP or hostname from which time may be set by ntp poll duration 1 00 00 NTP poll rate profile NMTOKEN Profile name source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable tz1 name string GMT Timezone name tz1 offset duration 0 Timezone 1 offset from UTC tz12 date unsignedByte 1 31 25 Timezone 1 to 2 earliest date in month datenum tz12 day day Sun Timezone 1 to 2 day of week of change tz12 month month Mar Timezone 1 to 2 month tz12 time
109. dem which supports PPPoE directly so no extra equipment is needed to connect to the FireBrick BT FTTP lines terminate on an active NTE which supports PPPoE directly so no extra equipment is needed to connect to the FireBrick For other types of lines in the UK or those in other countries you need to know what they can do on the wire PPPoA or PPPoE and have a suitable modem router to talk that protocol and convert to PPPoE on the LAN link to the FB6000 It seems most DSL routers will bridge PPPoE on the wire to PPPoE on the LAN but few will act as a PPPoE access concentrator The Vigor V 120 is one of the few that handle PPPoA on the wire and PPPoE link to the FB6000 48 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 PPPoE A significant benefit of the Vigor V 120 is that it works with no configuration on BT 20CN and 21CN lines as well as Be O2 PPPoA lines and TalkTalk lines you just plug it in to the line and the FB6000 and it just works There are also modems that work in bridged mode and support baby jumbo frames allowing PPPoE through to the carrier BRAS with full size MTU For fibre to the cabinet FTTC and fibre to the premises FTTP service you connect the FB6000 directly to the service BT supplied modem with no extra equipment 10 2 Definining PPPOE links A PPPoE link is defined by a ppp top level object To create or edit PPPoE links in the web user interface select the Int
110. displays a general page related to that item for example clicking on Status shows some overall status information whereas sub menu items under Status display specific categories of status information Figure 3 1 Main menu 3 FireBrick FB2700 Home Status Diagnostics Graphs Config Logout The user interface pages used to change the device configuration are referred to as the config pages in this manual these pages are accessed by clicking on the Edit item in the sub menu under the Config main menu item Note The config pages utilise JavaScript for their main functionality you must therefore have JavaScript enabled in your web browser in order to configure your FB6000 using the web interface 3 4 1 1 Customising the layout The following aspects of the user interface layout can be customised The banner area can be reduced in height or removed all together e The main menu strip can be positioned vertically at the left or right hand sides or horizontally at the top under the banner if present Additionally you can choose to use the default fonts that are defined in your browser setup or use the fonts specified by the user interface 11 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration These customisations are controlled using three icons on the left hand side of the page footer as shown in Figure 3 2 below Figure 3 2 Icons for layout contr
111. dr Our cluster ID comment string Comment 1d IP4Addr Our router ID log NMTOKEN Not logging Log events name string Name 124 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable Table H 44 bgp Elements Element Type Instances Description peer bgppeer Optional up to 500 List of peers neighbours H 2 35 bgppeer BGP peer definitions The peer definition specifies the attributes of an individual peer Multiple IP addresses can be specified typically for IPv4 and IPv6 addresses for the same peer but this can be used for a group of similar peers Table H 45 bgppeer Attributes Attribute Type Default Description add own as boolean Add our AS on exported routes allow export boolean Ignore no export community and export anyway allow only their as boolean Only accept routes that are solely the peers AS allow own as boolean Allow our AS inbound as unsignedInt Peer AS capability as4 boolean true If supporting AS4 capability graceful boolean true If supporting Graceful Restart restart capability mpe ipv4 boolean true If supporting MPE for IPv4 capability mpe ipv6 boolean true If supporting MPE for IPv6 capability route bool
112. e you could log all firewalling related log events to a log target specifically for that purpose This makes it easier to locate events you are looking for and helps you keep each log target uncluttered with un related log events this is particularly important when when you are logging a lot of things very quickly A log target is defined using a 1og top level object when using the web User Interface these objects are in the Setup category under the heading Log target controls Every log entry is put in a buffer in RAM which only holds a certain number of log entries typically around 1MB of text once the buffer is full the oldest entries are lost as new ones arrive Since the buffer is stored in volatile memory RAM buffer contents are lost on reboot or power failure This buffer can be viewed via the web interface or command line which can show the history in the buffer and then follow the log in real time even when viewing via a web browser with some exceptions see Section 5 6 1 In some cases it is essential to ensure logged events can be viewed even after a power failure You can flag a log target to log to the non volatile Flash memory within the FB6000 where it will remain stored even after a power failure You should read Section 5 5 before deciding to log events to Flash memory Each log target has various attributes and child objects defining what happens to log entries to this target However in the simplest case
113. e LAN at the same time so there is a Virtual Router Identifier VRID that is used to distinguish them The default VRID used by the FB6000 is 42 You must set all devices that are part of the same group virtual router to the same VRID and this VRID must differ from that used by any other virtual routers on the same LAN Typically you would only have one virtual router on any given LAN so the default of 42 does not normally need changing Note You can use the same VRID on different VLANs without a clash in any way in the FB6000 however you may find some switches and some operatings systems do not work well and get confused about the same MAC appearing on different interfaces and VLANs As such it is generally a good idea to avoid doing this unless you are sure your network will cope i e use different VRIDs on different VLANs At any one time one physical device is the master and is handling all the traffic sent to the virtual IP address If the master fails a backup takes over and this process is transparent to other devices which do not need to be aware of the change The members of the group communicate with each other using multicast IP packets The transparency to device failure is implemented by having group members all capable of receiving traffic addressed to the same single MAC address A special MAC address is used 00 00 5E 00 01 XX where XX is the VRID or VRRPv2 and 00 00 5E 00 02 XX for VRRPv3 The master devi
114. e NAS IP Address as this is often more useful If the remote Ip is used the NAS Port is set to the far end L2TP session ID rather than the local end session ID The NAS Identified remains the name of the FB6000 This option is separately available for accounting messages 85 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported RADIUS Attribute Value Pairs for L2TP operation Note that the Calling Station Id is included even if not present in L2TP connection if a cache platform RADIUS request matched the L2TP connection and had a Calling Station Id E 2 Authentication response E 2 1 Accepted authentication Table E 2 Access Accept AVP No Usage Reply Message 18 Reply message sent on PPP authentication response MS Primary DNS 311 28 Primary DNS address used in PPP IPCP Vendor 311 specific Server MS Secondary DNS 311 29 Secondary DNS address used in PPP IPCP Vendor 311 specific Server Framed Interface ID 96 Peer IPv6 Interface ID expected in PPP IPV6CP Framed IP Address oo Peer IPv4 address expected in PPP IPCP does not support 255 255 255 255 or 255 255 255 254 yet Maximum localpref used NAS IP Address 4 Our end IPv4 address to in IPCP negotiation Does not add loopback route This is non standard Framed Route 22 May appear more than once Text format is Pv4 Address Bits 0 0 0 0 metric The target IP is ignored but must be valid IPv4 synt
115. e from the FireBrick servers and responsibilty for loading breakpoint releases as required lies with the user 25 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration In order to do this you will first need to download the required software image file which has the file extension img from the FB6000 software downloads website http www firebrick co uk software php PRODUCT 6000 onto your PC The next step is the same as you would perform when manually initiating an Internet based upgrade i e you should browse to the main Status page where if there is new software is available you will be informed of this as shown in Figure 4 2 This step is necessary since the manual upgrade feature currently shares the page used for Internet based manual upgrades which is reached by clicking Upgrade available link After clicking this link you will find the manual upgrade method at the bottom of the page as shown in Figure 4 3 Figure 4 3 Manual Software upload Manual software upload WRAS asenon CODES Use this to upgrade software for the boot loader or main application as required Tick the box to force a reboot once new software is loaded 4 4 Boot Process The FB6000 contains internal Flash memory storage that holds two types of software e main application software generally referred to as the app e a bootloader runs immediately on power up initialises system
116. e line If the ISP handles ICMPv6 prefix delegation then an IPv6 block will automatically be assigned to you LAN If not then you could manually configure the IPv6 prefix the ISP is providing There are options to control which interfaces get automatic prefix delegations in this way 10 2 2 Additional options 10 2 2 1 MTU and TCP fix Normally PPPoE operates with a maximum packet size of 1492 bytes this is due to the 8 byte PPPoE header that is used and the normal 1500 byte payload limit of an Ethernet packet The FB6000 includes an option to set the PPPoE MTU so that when used with equipment capable of jumbo frames such as BT FITC and FTTP services and with appropriate ADSL bridging modems this allows use of slightly larger frames to provide a 1500 byte MTU To achieve this simply set the mtu attribute to a value of 1500 By default the tcp mss fix attribute is also set which means when working with a smaller MTU such as 1492 any connections that try and establish 1500 byte links are adjusted on the fly to be the lower MTU This avoids problems with a lot of corporate and bank web sites that do not handle MTU and ICMP correctly Typically your ISP will be doing this TCP fix for you as well 49 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 PPPoE Testing has been done which confirms setting mtu 1500 works correctly on BT FTTC and FTTP lines as well as BT 21CN and TalkTalk lines via a
117. e process to be recursive until a real destination is found Example lt route ip 0 0 0 0 0 gateway 192 168 0 100 gt creates a default IPv4 route that forwards traffic to 192 168 0 100 The routing for 192 168 0 100 then has to be looked up to find the final target e g it may be to an Ethernet interface in which case an ARP is done for 192 168 0 100 to find the MAC to send the traffic There is logic to ensure that the next hop is valid the gateway specified must be routable somewhere and if that is via an Ethernet interface then the endpoint must be answering ARP or ND packets If not then the route using the gateway is supressed and other less specific routes may apply 39 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Routing 7 2 3 Special targets It is possible to define two special targets e black hole packets routed to a black hole are silently dropped Silent refers to the lack of any ICMP response back to the sender nowhere also called Dead End packets routed to nowhere are also dropped but the FB6000 generates ICMP error responses back to the sender The blackhole and nowhere top level objects are used to specify prefixes which are routed to these special targets In the User Interface these objects can be found under the Routes category icon 7 3 Dynamic route creation deletion For data links that have an Up Down state such as L2TP or F
118. e providing access to shared resources such as printers 6 2 Defining an interface To create or edit interfaces select the Interface category in the top level icons under the section headed Ethernet interface port group vlan and subnets you will see the list of existing interface top level objects if any and an Add link The primary attributes that define an interface are the name of the physical port group it uses an optional VLAN ID and an optional name If the VLAN ID is not specified it defaults to 0 which means only untagged packets will be received by the interface 33 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Interfaces and Subnets To create a new interface click on the Add link to take you to a new interface defintion Select one of the defined port groups If the interface is to exist in a VLAN tick the vlan checkbox and enter the VLAN ID in the text field Editing an existing interface works similarly click the Edit link next to the interface you want to modify An interface object can have the following child objects e One or more subnet definition objects e Zero or more DHCP server settings objects e Zero or more Virtual Router Redundancy Protocol VRRP settings objects refer to Chapter 14 6 2 1 Defining subnets Each interface can have one or more subnets definitions associated with it The ability to specify multiple subnets on an interface c
119. e software is constantly being improved and new features added so please check that you are reading the manual appropriate to the version of software you are using This manual is for version V1 27 001 xvi www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 1 Introduction 1 1 The FB6000 1 1 1 Where do start The FB6000 is shipped in a factory reset state This means it has a default configuration that allows the unit to be attached directly to a computer or into an existing network and is accessible via a web browser on a known IP address for further configuration Besides allowing initial web access to the unit the factory reset configuration provides a starting point for you to develop a bespoke configuration that meets your requirements A printed copy of the QuickStart Guide is included with your FB6000 and covers the basic set up required to gain access to the web based user interface If you have already followed the steps in the QuickStart guide and are able to access the FB6000 via a web browser you can begin to work with the factory reset configuration by referring to Chapter 3 Initial set up is also covered in this manual so if you have not already followed the QuickStart Guide please start at Chapter 2 Tip The FB6000 s configuration can be restored to the state 1t was in when shipped from the factory The procedure requires physical access to the FB6000 and can be
120. ean true If supporting Route Refresh refresh comment string Comment drop default boolean false Ignore default route received export med unsignedInt Set MED on exported routes unless export filter sets it holdtime unsignedInt 30 Hold time ignore bad optional boolean true Ignore routes with a recognised badly partial formed optional that is flagged partial import localpref unsignedInt Set localpref on imported routes unless import filter sets it import tag List of Community List of community tags to add in addition to any import filters in soft boolean Mark received routes as soft ip List of IPAddr One or more IPs of neighbours omit to allow incoming log debug NMTOKEN Not logging Log debug max prefix unsignedInt Limit prefixes IPv4 IPv6 125 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects md5 Secret MDS signing secret name string Name next hop self boolean false Force us as next hop outbound no fib boolean Don t include received routes in packet forwarding pad unsignedByte Pad prefix stuff our AS on export by this many profile NMTOKEN Profile name same ip type boolean true Only accept send IPv4 routes to IPv4 peers and IPv6 routes to IPv6 peers send default boolean false Send a default route to this peer send no routes boolean false Don t send an
121. eeaeenneeuneees 100 G 1 Broadband back haul providers cece cece eeec cece ce cece cen ceneceeeeeeeceeeeeeeeaeeeaeeea seas eeaes 100 G 2 Access to Sraphs and CSVS ui ni Ea Seed ae tee th e cidos 100 E TRUSTED ACCESS v 22 wend veces teens e e de dened teeta seuanne Bea eo E sade T Same ete E 100 G 2 2 Dated information cocina ida 101 G23 Authenticated ACCESS tion wedges eeredd aagavbdacneeeetheaaeetetenteesbererts 101 G 3 Graph display Options e a eda beheld ii dio 101 G3 Data points wines ree nre a shee vomedeybncvatees tua deo eh sod dhe phoeme sag R E A EE Deseas 101 E 32 Additional textil poi uae lated eee wa hal ia Saga dey ir 102 G 3 3 Other colours and Spacimh 3 csacceses a coagetaces A e Eaa e AEE o S gasugaeette 102 G4 Overmipht archiyine ad A eee sume ester ube dis 102 GAL Full ORE format esos op eat Sea see penweans oh vad pi tit 103 G42 load handling ita ti i n 103 Gd Graph Score NO 103 G 6 Creating graphs and graph names ooocccoccnnconnconncnnncnnocnnonnncnnncnnncnnconnccnnccnnconnconncnnncnnnes 104 H Configuration OD OCts 0 8024554 eveugentos a E ova shee seases very stones uedes ys codees EE EAE ESES AEn 105 H k Top level ti ria sonda 105 FT contigs Top level COM idiotas tens ebne Eaa AE tete 105 HERODES a E O AN ad 106 1 2 1 System Systemi Settings soen Sones dee lor nE e E a E EE e Seance pp eumectee sey 106 H 2 2 link Web Links voi ias is 106 1 2 3 users AMI USCOS iaa a ota ceb sv
122. eeeeeeeeeeeeeeaeeaaes 12 3 4 22 Object SCHINGS erson eee vented ri Uri De Vath daa es ri 13 3 4 3 Navigating around the User Interface ocoooccnoccncconocnnccnnncnncnnnrcnorcnccnnconnccnnccnnioos 15 3 4 4 Backing up restoring the configuration oocoocccoccnncnnccnnconnconnconncnnnccnnconnconnconiconoss 16 3 5 Configuration using XML oir nee 16 3 521 Introduction to XML sess eer e rr matty aos radiata rajas 16 3 5 2 The root element lt cOnfig gt oieri ceo ceee eee ce ceca cece cena EEEE EEEE E EEEE 17 3 5 3 Viewing or editing XML oss s cess ig cvetasass seboesoveceeadeneccasguacosesessusvaadsbevsacsaseoedaneeee 17 3 5 4 Example XML configuration 0 cece cece cece ce eece ence eeceeeceeecaeseaesea sean eee eeneeees 17 3 6 Downloading Uploading the configuration ocoocconccnccnnconnconnconnconnconnconncnnncnnronronccnncinncinns 19 3 6 1 DOWnlOdd neseni oyini re teva ses Se a di ote ase ele 19 3 02 A A 19 4 System Administration ii seais 20 4 1 User Managment ensisi red tibia diaria aora dicto baa E patria 20 ALL Eogin level ui A a A eas 20 4 1 2 Configuration access level sssrini sinees rre uine EE EE EEEE PESE RS RSE T ERIS ENST 21 4 1 3 Login idle timeout inisio ap ES EEE onde cos Mac eden ag Duchess KEE EEE EREE EESE iaa 21 414 Restrictme User logins soria i e E E E a a EES E T EE ee 21 4 1 4 1 Restrict by IP address onca a a e a a raSi 21 iv www voipon co uk sales voipon co uk Tel 44 0 1245 808195
123. eful where BT have provided an incorrect MRU for the end user another bug There is also an option to forward 1500 byte packets rather than fragmenting them When enabled ICMP is still generated for DF and IPv6 D 15 2 IP over LCP IP over LCP is a non standard coding of PPP packets for IPv4 and IPv6 The coding uses the LCP code C021 instead of the IPv4 0021 or IPv6 0057 code The first byte which would normally be the LCP type is 0x4X IPv4 or 0x6X IPv6 The FireBrick assumes any such LCP codes are IPv4 IPv6 when received and using a RADIUS response can send IP packets using LCP This is specifically to bypass any carrier IP specific shaping or DPI 84 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix E Supported RADIUS Attribute Value Pairs for L2TP operation RADIUS is used for authentication and accounting of L2TP connections If no authentication servers are configured then authentication is not performed If no accounting servers are configured then no accounting is generated Multiple servers can be configured and they are processed in order Each can have multiple IP addresses The IP addresses are tried based on the previous performance response time etc If a server does not respond a number of times as configured then it is blacklisted for a configurable period It is possible to configure local configurations which are checked before any RADIUS authentication It i
124. eldname is specified then the default colour is applied The text on the right shows what fields are included and their colour key Table G 2 Colours Key Colour Defines colour for minimum latency Defines colour for average latency Defines colour for max latency Defines colour for upload rate Defines colour for download rate Defines colour for sent echos Defines colour for rejected echos Defines colour for failed no response echos Oo zm oo 4 x gt z Defines colour for off line 101 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Constant Quality Monitoring technical details G 3 2 Additional text Additional text is shown on the graph based on the values in the configuration if not specified There are 4 lines on the top left in small text and two heading lines top right in large text Table G 3 Text Key Text Z Clean output clears all additional text fields Clean and clear as z but also sets inside background and off line colours to transparent so graphs are easy to merge with those other LNSs C Line 1 top left text default if not set in config is system name c Line 2 top left text N Line 3 top left text n Line 4 top left text H Main heading text default if not set in config is graph name h Sub heading text G 3 3 Other colours and spacing Colours can be in the form of RGB
125. els of any sort placing the wrappers in one routing table allowing DHCP clients and so on without taking over the default route for all traffic The payload can then be in the normal routing table 0 7 5 Bonding A key feature of the FB6000 is the ability to bond multiple links at a per packet level Bonding works with routing and shapers together See Chapter 9 for details of shapers The basic principle is that you have two or more routes that are identical same target IP prefix and have the same localpref so that there is nothing to decide between them As described above this normally means one of the routes is picked However where the two or more routes are the same type of interface and there are shapers applied to those routes then a decisions is made on a per packet basis as to which interface to used The shapers are used to decide which link is least far ahead This means that traffic is sent down each link at the speed of that link 40 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Routing To make this work to the best effect set the tx speed of the shapers on the links to match the actual link speed E g for broadband lines set the speed to match the uplink from the FB6000 For L2TP use as an LNS the graph created for each L2TP session has an agress speed automatically set based on the speed details sent on the L2TP connection These can also be overridden by a RADIUS
126. ember to delete the object before you navigate away the Erase button see Figure 3 8 is used to delete the object you are viewing 3 4 4 Backing up restoring the configuration To back up save or restore the configuration start by clicking on the Config main menu item This will show a page with a form to upload a configuration file in XML to the FB6000 also on the page is a link Download save config that will download the current configuration in XML format 3 5 Configuration using XML 3 5 1 Introduction to XML An XML file is a text file i e contains human readable characters only with formally defined structure and content An XML file starts with the line lt xma version 1 0 encoding UTF 8 gt This defines the version of XML that the file complies with and the character encoding in use The UTF 8 character coding is used everywhere by the FireBrick The XML file contains one or more elements which may be nested into a hiearchy Note In XML the configuration objects are represented by elements so the terms object and element are used interchangeably in this manual Each element consists of some optional content bounded by two tags a start tag AND an end tag A start tag consists of the following sequence of characters e a lt character e the element name e optionally a number of attributes e a gt character An end tag consists of the following sequence of characters e a l
127. en ae Arial 107 H 2 4 log Log target controls 2 0 0 0 cece a E AE E EEN eeae een ERS EEEa 107 H 2 5 log syslog Syslog logger settings ooooccooccnccnnocnncnnnccnoconccnnccnnccnnccnnconnconnconncos 108 H 2 6 log email Email logger settings oooocccnccnccnnccnnccnnconncnnnconnconoconoconncnnncnnroniccnns 108 1 27 services SYStEMeSCLVICES che oc ee fe hese bas Gow cauaes fad a we Bee Meee Bawden a a E ERSE 109 H 2 8 snmp service SNMP service settings coooccnnconcconoconocnnncnnncnnronoconccnnconnccnnccnnioos 109 H 2 9 ntp service NTP service Settings ponie r E E ee IE e AE EENES TEER EE ESON 109 H 2 10 telnet service Telnet service settings cooocooccnnccnncnnocnnocnnccnnconnconnccnnconnconnconncos 110 H 2 11 http service HTTP service settings miii e E E E E ATINS 111 H 2 12 dns service DNS service settings ooooccooccnccnnconnconnccnnconnconoconaconarcnncnnncnnronncnnns 111 ix www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6202 User Manual H 2 13 dns host Fixed local DNS host settings ooooccocccccccnccnnconnconnccnnccnnconnconncnnncnnnos 112 H 2 14 dns block Fixed local DNS blocks oocococonoccnccnnccnnccnoconoconccnnccnncconccnnconaconncos 112 H 2 15 radius service RADIUS service definition 1 0 0 0 cece cece eee ceeeeeeea concen eens 113 H 2 16 radius service match Matching rules for RADIUS service n 114 H 2 17 radius server RADI
128. ency label max string Max Label for maximum latency label min string Min Label for minimum latency label off string Off Label for off line seconds label period string Period Label for period label poll string Polls Label for polls label rej string Reject Label for rejected seconds label rx string Rx Label for Rx traffic level label score string Score Label for score label sent string Sent Label for seconds polled label shaper string Shaper Label for shaper label time string Time Label for time label traffic string Traffic bit s Label for traffic level label tx string Tx Label for Tx traffic level latency level unsignedInt 100000000 Latency level not expected on low usage latency levell unsignedInt 100000000 Latency level 1 ns latency level2 unsignedInt 500000000 Latency level 2 ns latency score unsignedByte 200 Score for high latency and low usage latency scorel unsignedByte 10 Score for on above level 1 latency score2 unsignedByte 20 Score for on above level 2 latency usage unsignedInt 128000 Usage below which latency is not expected left unsignedByte 0 Pixels space left of main graph log NMTOKEN Not logging Log events max Colour green Colour for maximum latency min Colour 008 Colour for minimum latency 128 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects ms max positiveInteger 500 ms max height off Colour c8f Colour f
129. ends on the packet size with small packets less than 1000 bytes allowed more margin than large packets This has the effect of prioritising DNS interactive traffic VoIP etc Where there are two or more links with shapers a link is picked based on which is the least far ahead This has the effect of balancing the traffic levels between multiple links based on the speed of each link exactly 47 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 10 PPPoE The FB6000 can operate as a PPPoE client This is typically used to connect to an Internet service provider either via a suitable PPPoE modem bridging router or direct connection The typical usage is to use one or more ports on the FB6000 each connected directly to a suitable PPPoE device such as a bridging router The PPPoE device is usually very dumb and may not need any configuration at all The FireBrick is responsible for the login to the ISP using the PPPoE link and the configuration for this is part of the FB6000 s configuration and not the router This makes it very easy to make use of spare routers etc without the complication of configuring additional devices It is possible to connect more than one PPP device to a single FB6000 port using an Ethernet switch If you do this then you ideally need a switch that handles VLANs see Appendix C if you are not familiar with VLANs so that each router can be logically connected to a d
130. ent called number if present and login proxy_auth_name if present If a match is found the call is relayed with no additional PPP packets exchanged If there is no proxy LCP provided or the provided negotiation conflicts with the configuration then LCP negotiation is completed If there is no proxy authentication PPP authentication is start until a response login is received from the peer assuming authentication is required in the config At this point a further check is made for a configured relay which can now be based on a login if one was not present before RADIUS authentication is completed and if the response indicates a relay then the call is relayed The relayed call includes the incoming call parameters and any LCP and authentication parameters that may have been negotiated at that point E 9 2 LCP echo and CQM graphs Depending on configuration LCP echos are faked both ways from the FireBrick and LCP echos are generated by the FireBrick and responses checked This allows the CQM graphs to be created The graph is only created for the outgoing part of the connection If not configured to fake LCP echos then these are passed through as normal and no graph is created Each session gets a CQM graph which uses one second LCP requests and produces detailed loss latency graphs for the session The graph name is picked based on the first available of e Chargeable User Identity sent in the RADIUS authentication response
131. ent then they are ignored E 7 Change of Authorisation A change of authorisation message is accepted as per RFC5176 Table E 8 Change of Authorisation AVP No Usage Acct Session Id 44 Unique ID for session Chargeable User 89 This is used as CQM graph name Identity Framed Route 22 May appear more than once Text format is Pv4 Address Bits 0 0 0 0 metric The target IP is ignored but must be valid IPv4 syntax The metric is used as localpref in routing Delegated IPv6 123 IPv6 prefix to be routed to line Maximum localpref used Prefix Framed IPv6 Prefix 97 IPv6 prefix to be routed to line Maximum locapref used Framed IPv6 Route 99 May appear more than once Text format is Pv6 Address Bits metric The target IP is ignored but must be valid IPv6 syntax The metric is used as localpref in routing Alternative format Pv6 Bits IPv4 Address metric defines that prefix is to be protocol 41 IPv4 tunneled to specified target via this link Session Timeout 27 Absolute limit on session in seconds Terminate Action 29 If not specified or O then terminate on Session Timeout or Quota reached else send RADIUS Interim accounting update not an Access Request Connect Info 77 Text tx speed limit to apply to session Filter Id 11 See filter ID section The session is identified by Acct Session Id if present else by Chargeable User Identity No other identification pa
132. ented in Chapter 17 and in the Appendix F 12 4 1 Access control Access control can be restricted in the same way as the HTTP web service including per user access restrictions Note By default the FB6000 will only allow telnet access from machines that are on one of the locally attached Ethernet subnets This default is used since the CLI offers a degree of system control that is not available via the web interface for example software images stored in the on board Flash memory can be deleted via the CLI The example XML below shows the telnet service configured this way lt telnet allow 10007072A L051 03 938 10 100 1008s 10 99 9907 24 comment telnet service access restricted by IP address local only falet 12 5 DNS configuration The DNS service provides name resolution service to other tasks within the app software and can act as a relay for requests received from client machines DNS typically means converting a name like www firebrick co uk to one or more IP addresses but it can also be used for reverse DNS finding the name of an IP address DNS service is normally provided by your ISP The DNS service on the FB6000 simply relays requests to external DNS servers and caches replies You can configure a list of external DNS servers using the resolvers attribute However DNS resolvers are also learned automatically via various systems such as DHCP and PPPoE In most cases you do not need to set the
133. entication Table H 55 12tp relay Attributes Attribute Type Default Description called station id List of string One or more patterns to match called station id calling station id List of string One or more patterns to match calling station id comment string Comment graph token graphname Graph name ip over lcp boolean Send IP over LCP local auth localpref unsignedInt 4294967295 Localpref for remote ip routes highest wins name string Name password Secret Password check profile NMTOKEN Profile name relay hostname string Hostname for L2TP connection relay ip List of IPAddr Target IP s for L2TP connection relay pick boolean If set try one of the relay IPs at random first relay secret Secret Shared secret for L2TP connection remote ip IP4Addr Remote end PPP IPv4 local auth remote netmask IP4Addr Remote end PPP Netmask local auth routes List of IPPrefix Additional routes when link up local auth source string Source of data used in automated config management test List of IPAddr List of IPs that must have routing for this target to be valid deprecated username List of string One or more patterns to match username 131 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects H 2 42 profile Control profile General on off control profile used in
134. erall test must have been failing for before the profile state changes to Inactive e recover the duration that the overall test must have been passing for before the profile state changes to Active 42 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Profiles The timeout and recover parameters do not apply to manually set profiles see Section 8 2 4 and those based on time of day see Section 8 2 2 2 8 2 2 Tests 8 2 2 1 General tests General tests are provided for the following e PPPoE connection state the ppp attribute lists one or more PPPoE connection names see Chapter 10 if any of the specified connections are up this pppoe state test will pass Routable addresses the route attributes lists one or more IP addresses full addresses not CIDR prefix ranges only if all the addresses are routable i e there is an entry in the routing table that will match that address will this test pass Refer to Chapter 7 for discussion of routing tables and the routing logic used by the FB6000 e VRRP state the vrrp attribute lists one or more Virtual Router group membership definitions see Chapter 14 by name if the FB6000 is not the master device in any of these Virtual Routers this test will fail If more than one of these general tests is selected corresponding attribute specified then they must all pass along with all other tests defined for the overall result to be
135. erface category icon under the section headed PPPoE settings you will see the list of existing ppp objects if any and an Add link For most situations configuring a PPPoE link only requires that you specify the physical port number that the router modem is connected to and the login credentials i e username and password The port number or port group name is specified via the port attribute on the ppp object and credentials are specified via the username and password attributes If you are connecting multiple routers modems via a VLAN capable switch to a single FB6000 port you will also need to specify the VLAN used for the FB6000 to router modem layer 2 connection this is done by setting the value of the vlan attribute too As an example if you were to connect a single modem router directly to port 4 on your FB6000 i e not using VLANs then the configuration needed shown as an XML fragment would be lt ppp port 4 username password gt You may also want to give the PPPoE link a name by setting the name attribute you can then reference the link in for example a profile see Section 8 2 2 1 There are a number of additional options see below but for most configurations this is all you need It causes the FB6000 to connect and set a default route for internet access via the PPP link 10 2 1 IPv6 If your ISP negotiates IPv6 on the link then a default route is set for IPv6 traffic down th
136. esponse 13 Not expected Sent if was challenged D 4 Stop Control Connection Notification Table D 4 StopCCN AVP No Incoming Outgoing Message Type 0 Value 4 Value 4 Result Code 1 Ignored logged Sent as appropriate for tunnel close Assigned Tunnel ID 9 Expected see note Sent if a tunnel has been allocated Note that a StopCCN may not have a zero tunnel ID in the header If this is the case the source IP port and assigned tunnel are used to identify the tunnel If an unknown tunnel ID is received on any any incoming packet a StopCCN is generated once per 10 seconds with header tunnel ID 0 and specified assigned tunnel ID D 5 Hello Table D 5 HELLO AVP No Incoming Outgoing Message Type 0 Value 6 Value 6 Always responded to Sent periodically if no other messages sent D 6 Incoming Call Request Table D 6 ICRQ AVP No Incoming Outgoing Message Type ofVaue10 Valuel0 Assigned Session ID 14 Mandatory Mandatory our session ID Call Serial Number 15 Accepted and passed on if relaying Passed on incoming value Bearer Type 18 Ignored Not sent Called Number 21 Accepted used in RADIUS and passed Passed on incoming value on if relaying 81 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported L2TP Attribute Value Pairs Cal
137. file name server IPNameAddr Not optional Syslog server severity syslog severity NOTICE Severity setting source string Source of data used in automated config management source ip IPAddr Use specific source IP table unsignedByte 0 99 0 Routing table number for sending syslogs routetable H 2 6 log email Email Logging to email Table H 10 log email Attributes logger settings Attribute Type Default Description comment string Comment delay duration 1 00 Delay before sending since first event to send from string One made up using Source email address serial number hold off duration 1 00 00 Delay before sending since last email log NMTOKEN Not logging Log emailing process log debug NMTOKEN Not logging Log emailing debug log error NMTOKEN Not logging Log emailing errors port unsignedShort 25 Server port profile NMTOKEN Profile name retry duration 10 00 Delay before sending since failed send server IPNameAddr Smart host to use rather than MX source string Source of data used in automated config management subject string From first line being Subject logged 108 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects table unsignedByte 0 99 0 Routing table number for sending email routetable to string Not optional Target email address H 2 7 services System services System se
138. for live circuits and archived data to your back haul provider when discussing faults with them FireBrick are working with several ISPs to ensure back haul providers are aware of the CQM graphs and how to use them to assist in diagnosis G 2 Access to graphs and csvs Graphs can be accessed by http using the normal web management interface This can be used as a direct link from a web browser or using common tools such as curl and wget The web management interface services http define the port and allowed user list and also a trusted IP access list The CQM config defines a secret which is used to authorise untrusted access using an SHA1 hash in the URL All CQM URLs are in the cqm path G 2 1 Trusted access To access a graph you simply need to request the URL that is the graph name followed by the file extension E g http host port cqm circuit png Table G 1 File types Extn Format png PNG image CSV COMMA separated values list tsv TAB separated values list txt SPACE separated values list xml XML data 100 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Constant Quality Monitoring technical details G 2 2 Dated information Without any date the data returned is the latest For csv it is all data points available For graph it is the last 24 to 25 hours You can display data for a specific date This only makes sense for today and du
139. form RADIUS This allows the ISP to decide on a per connection basis the tunnel endpoint details and steer sessions The FireBrick can act as a platform RADIUS server answering all queries to steer sessions to the correct LNS and hostname 16 3 The importance of CQM graphs The FireBrick has Constant Quality Monitoring When used with the FireBrick acting as an LNS the CQM graphs play an important role Per connection monitoring Each connection is assigned a CQM graph name This is normally set based on the circuit ID passed by the carrier or if not present the username used A long graph name over 20 characters is reduced to a hash The name can also be set by RADIUS response Chargeable User Identity attribute Each graph shows the send and receive throughput for each 100 seconds The graph also shows the loss and latency with minimum average and maximum per 100 seconds This is based on an LCP echo sent every second on every connection The interval can be configured to be lower if you wish either in the config or by RADIUS The per connection graphs also have a downlink speed setting This is set based on the connection speed from L2TP connection This can also be set in the RADIUS response This limits the speed of traffic to the line This 1s usually done so that the LNS is in control of the speed of the line as the FireBrick will drop larger packets before smaller packets which helps VoIP and many other protocols work well even on a
140. full link The speed control can also be used to provide slower services In addition to the per connection graphs there is also an aggregate graph based on the incoming L2TP connection settings e g typically for a whole carrier This tracks the overall throughput for all of the lines This is useful simply for reporting and tracking but the aggregate graph can also have a speed setting This allows rate limiting to meet commit levels with carriers which can be very important where for example there 1s 100th percentile billing This also allows a damping setting to used Where the aggregate is hitting the limit all lines within that aggregate are reduced in their shaper settings by a percentage to damp the overall throughput The continued hitting of the aggregate increaes the percentage level Individual lines can be tagged high or low priority by RADIUS which affects the level of damping applied and so allows three grades of service when an aggregate link is full At each stage aggregate and per line the shaping still drops larger packets first making for a very effective way to manage overall traffic levels It is also possible to set a third level of aggregation where each connection can be placed in a group which is itself another CQM graph This can be useful for tracking and shaping at a per wholesale customer or customer grouping in some way 16 4 Authentication Normally an incoming connection uses RADIUS to obtain details of
141. g 20 login level 20 restricting logins by IP address 21 V Virtual Router Redundancy Protocol VRRP 60 virtual router definition of 60 VRRP versions 61 VLANs introduction to 79 X XML introduction to 16 XML Schema Document XSD file 10 145 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299
142. g 29 overview 28 viewing logs 31 G Graphs 45 H Hostname setting 22 HTTP service configuration 53 Interfaces defining 33 Ethernet 33 relationship with physical ports 33 Internet Service Providers overview 68 L LEDs Power LED status indications 26 Log targets 28 Logging see Event logging N Navigation buttons in user interface 15 NTP Network Time Protocol configuring time servers to use 55 O Object Hierarchy overview 9 Object Model definition of 9 formal definition 10 P Packet dumping 57 Example using curl and tcpdump 59 PPPoE configuring 49 overview 48 Profiles defining 42 overview 42 viewing current state 42 R RADIUS configuring service 55 Route definition of 38 Routing route targets 39 S Shapers 46 SNMP configuring service 55 Software identifying current version 24 Software upgrades breakpoint releases 24 controlling auto upgrade behaviour 25 overview 23 software release types 23 System name see Hostname 144 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Index System services checking access to 56 configuring 52 definition of 52 list of 52 T Telnet service configuration 53 Time out login sessions 21 Traffic shaping overview 45 U User Interface customising layout 11 general layout 11 navigation 15 overview 10 Users creating configurin
143. g established name NMTOKEN Name preempt boolean true Whether pre empt allowed priority unsignedByte 100 Normal priority profile NMTOKEN Profile name source string Source of data used in automated config management test List of IPAddr List of IPs to which routing must exist else low priority deprecated use vmac boolean true Whether to use the special VMAC or use normal MAC version3 boolean v2 for IPv4 v3 for Use only version 3 IPv6 vrid unsignedB yte 42 VRID H 2 23 dhcps DHCP server settings Settings for DHCP server Table H 30 dhcps Attributes www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Attribute Type Default Description boot IP4Addr Next boot server boot file string Boot filename class string Class match client name string Client name match comment string Comment dns List of IP4Addr Our IP DNS resolvers domain string From system settings DNS domain force boolean Send all options even if not requested gateway List of 1IP4Addr Our IP Gateway ip List of TP4Range 0 0 0 0 0 Address pool lease duration 2 00 00 Lease length log NMTOKEN Not logging Log events allocations mac List up to Partial or full MAC addresses 12 hexBinary macprefix name string Name ntp List of IP4Addr From system settings NTP server profile NMTOKEN Profile name source string Source of data used in automated c
144. gged allow only their as defaults to true customer Used when talking to customers routers expecting transit feed and providing their own routes Peers only with different AS allow only their as defaults to true allow export defaults to true The community no export is added to exported routes unless explicitly de tagged internal For IBGP links Peers only with same AS allow own as defaults to true 64 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 BGP reflector For IBGP links that are a route reflector Route reflector rules apply Peers only with same AS allow own as defaults to true confederate For EBGP that is part of a confederation Confederation rules apply Peers only with different AS ixp Must be EBGP and sets default of no fib and not add own as Routes from this peer are marked as IXP routes which affects filtering on route announcements 15 2 5 Route filtering Each peer has a set of import and export rules which are applied to routes that are imported or exported from the peer In future there will be named peer groups route maps and prefix lists The objects import and export work in exactly the same way checking the routes imported or exported against a set of rules and then possibly making changes to the attributes of the routes or even choosing to discard the route Each of these objects contain e Cosmetic attributes such as name comment
145. gged with the same CUG can be sent to it E 9 5 Routing table The FireBrick operates independent routing cores allowing a totally independent routing table to be used for L2TP wrapper traffic and payload traffic It is also possible to set the payload table in use on a per session basis from RADIUS thus allowing a walled garden to be set up or a private network or simple an unusable session 93 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix F Command line reference F 1 General commands F 1 1 Trace off Dror t Stop interactive logging to this CLI session lasts until logout or tron F 1 2 Trace on tron Restart interactive logging to this CLI session Some types of logging can be set to log to console which shows on the CLI F 1 3 Uptime uptime show uptime Shows how long since the FB6000 restarted F 1 4 General status show status Shows general status information including uptime who owns the FireBrick etc This is the same as the Status on the web control pages F 1 5 Memory usage show memory Shows memory usage summary F 1 6 Process task usage show tasks Shows internal task list This is mainly for diagnostics purposes F 1 7 Login Login Normally when you connect you are prompted for a username and password If this is incorrect you can use the login to try again
146. gigabit port speeds 6 3 1 Setting duplex mode If auto negotiation is enabled the FB6000 port will normally advertise that it is capable of either half or full duplex operation modes if you have reason to restrict the operation to either of these modes you can set the duplex attribute to either half or full This will cause the port to only advertise the specified mode if the auto negotiate capable link partner does not support that mode the link will fail to establish If auto negotiation is disabled the duplex attribute simply sets the port s duplex mode Note If you do not set the autoneg attribute checkbox is unticked and you set both port speed and duplex mode to values other than aut o auto negotiation will be disabled this behaviour is to reduce the potential for duplex mis match problems that can occur when connecting the FB6000 to some vendors notably Cisco equipment that has auto negotation disabled by default 6 3 2 Defining port LED functions Each port has options to control the way the yellow and green LEDs are displayed based on the state of the port The default is yellow for Tx and green for link activity 37 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 7 Routing 7 1 Routing logic The routing logic in the FB6000 operates primarily using a conventional routing system of most specific prefix which is commonly found in many IP stacks in general
147. gle vrrp object by listing one or more IPv4 addresses and one or more IPv6 addresses VRRP3 is used by default for any IPv6 addresses or where an interval of below one second is selected It can also be specifically set in the config by setting the attribute version3 to the value true Caution If you have devices that are meant to work together as VRRP but one is version 2 and one is version 3 then they will typically not see each other and both become master The FB6000 s VRRP Status page shows if VRRP2 or VRRP3 is in use and whether the FireBrick is master or not 14 5 Compatibility VRRP2 and VRRP3 are standard protocols and so the FB6000 can work alongside other devices that support VRRP2 or VRRP3 Note that the FB6000 has non standard support for some specific packets sent to the VRRP virtual addresses This includes answering pings configurable and handling DNS traffic Other VRRP devices may not operate in the same way and so may not work in the same way if they take over from the FireBrick 62 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 15 BGP 15 1 What is BGP BGP Border Gateway Protocol is the protocol used between ISPs to advise peers of routes that are available Each ISP tells its peers the routes it can see being the routes it knows itself and those that it has been advised by other peers In an ideal world everyone would tell everyone else the routes they c
148. guration you later save you will need to click Erase Simply going back Up or moving to another part of the config will leave this newly created empty object and that could have undesirable effects on the operation of your FireBrick if saved 3 4 2 2 Object settings The details of an object are displayed as a matrix of boxes giving the appearance of a wall of bricks one for each attribute associated with that object type Figure 3 5 shows an example for an interface object covered in Chapter 6 13 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Figure 3 5 Editing an Interface object MW comment 8 profile Comment Profile name m port 8 vian 8 mtu Port group name VLAN ID O untagged l arr MTU for this interface WAN y 0 8 ra client 8 ping Accept IPv6 RA and create auto config subnets and routes true 8 log error 8 log debug Log errors Log debug Log as event Not logging By default more advanced or less frequently used attributes are hidden if this applies to the object being edited you will see the text shown in Figure 3 6 The hidden attributes can be displayed by clicking on the link Show all Figure 3 6 Show hidden attributes There are additional attributes which have not been shown Show all Each brick in the wall contains the following e a checkbox if the checkbox is checked an appropriate value entry widget is displayed other
149. h es 96 F 25 ist routine NEXt OPS imois sob dt fon tao 96 F 2 6 See DHCP allocations state iii llei theta ds ogee AEN 97 F 2 7 Clear DHCP allocations mei o eiae a ER EERE EEEE leusuwccusup endieeseveeens 97 E2 8 Lock DHCP allocations ie 97 E 2 9 Unlock DHCP allocations rarena AA 97 E 2 10 Name DHCP allocations acciona ibid ie ene 97 F 2 11 Show ARP ND status ceini r ee i pe E EEE EEEE E EE EEEE EETA EUNN 97 F212 SHOW VRRP Statis sspe een eon E E E ER NEE 97 F 2 13 Send Wake on LAN packet epi ineno ooe a E E OE E SE 97 F2 AAs Check access ito ServiCES mni er a der ventas cece R E Ae EE ETSEN 98 F3 E2TP commands A TEE R 98 F4 BGP commands pasen e ie 98 E 5 PPPoE Command se sssini a n vag i e eaten sede i a a 98 F6 Adyanc d Commands ei reene a A RA RE A RE dered dans REA 98 F651 PaM eea i O AN 98 F6 2 ON 98 E 6 3 Screen Wide Gad an See 98 F 6 4 Make outbound command session eceeeceeeeeceeeneceeeeeceeeeeaeeeeeaeeeeaeeeeaeeneras 99 F 6 5 Show command SeSSions sesir ie eenn EE ceca eens eens ceeceeeeeeeeeeseeeseaeeeaeeaues 99 F 6 6 Kill command SeSS10M AAA ve E ERE ees p EEEE 99 F677 Flash memory stars ai A 99 F 6 8 Delete block from ash sosiaa en e riera eaten sted hes a EE E sine 99 F629 Boot loa O sd weed a een ek Rah ee AO 99 F 6 VO Flash Jog sic dire soadbes puugseseenes shape neadesatwed dbs e EE ES EEN 99 G Constant Quality Monitoring technical details 0 0 0 cece cee cc eeceeece teen eeeae
150. he interface e g interface WAN also applies for name of PPPoE on an interface 12tp L2TP session Where L2TP is available one or more sessions using the full hex accounting ID can be specified e g 12tp 002132D94AE297DFF51E01 or you can use 12tp followed by a calling line ID this sets up logging for a session based on calling line id when it next connects snaplen Snaplen The maximum capture length for a packet can be specified in bytes Default O auto See notes below timeout Timeout The maximum capture time can be specified in seconds Default 10 57 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Network Diagnostic Tools ip IP address 2 off Up to two IPs can be specified to filter packets self Include my IP By default any traffic to or from the IP which is connecting to the web interface to access pcap is excluded This option allows such traffic Use with care else you dump your own dump traffic 13 2 2 Security settings required The following criteria must be met in order to use the packet dump facility e You must be accessing from an IP listed as trusted in the HTTP service configuration see Section 12 3 e You must use a user and password for a DEBUG level user the user level is set with the Level attribute on the user object Note These security requirements are the most likely thing to cause your attempts t
151. hence specifying no buffer on the curl command to tcpdump and asked it to take capture data from the standard input stream via the r options We have additionally asked for no DNS resolution n and verbose output v Consult the documentation provided with the client e g Linux box system for details on the extensive range of tcpdump options these can be used to filter the dump to better locate the packets you are interested in 59 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 14 VRRP The FB6000 supports VRRP Virtual Router Redundancy Protocol which is a system that provides routing redundancy by enabling more than one hardware device on a network to act as a gateway for routing traffic Hardware redundancy means VRRP can provide resilience in the event of device failure by allowing a backup device to automatically assume the role of actively routing traffic 14 1 Virtual Routers VRRP abstracts a group of routers using the concept of a virtual router which has a virtual IP address The IP address is virtual in the sense that it is associated with more than one hardware device and can move between devices automatically The virtual IP address normally differs from the real IP address of any of the group members but it can be the real address of the master router if you prefer e g if short of IP addresses You can have multiple virtual routers on the sam
152. his interlink is usually ised soley for the purpose of a BGP link to the carrier and all other IPs used by the ISP or carrier are announced via that BGP connection You may want to configure filters on the BGP connection to limit the prefixes accepted from the carrier or announced to the carrier An alternative approach is to configure the interlink interface on a separate routing table The FB6000 can have separate routing tables which act as completely separate internets Using a separate table means you do not have to worry about what prefixes are announced on the BGP link as they will only apply to that routing table 71 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Internet Service Providers Whilst we would recommend using a BGP connection like this if the carrier does not handle BGP then you will need static routes Using a separate routing table can make this much simpler as you can set a default route to the carrier gateway on the interlink subnet Tf using a separate routing table you have to take care to correctly configure the routing table on the interface BGP RADIUS L2TP and loopback configuration elements 16 8 3 RADIUS session steering We recommend using RADIUS session steering with the carrier if they support it Session steering means that the carerier sends a RADIUS request to the ISP before connecting each session by L2TP The reply steers the connection to a specific LNS
153. hows that the current page is showing a rule which exists within a rule set which in turn is in the Firewall mapping rules category see below 3 4 2 1 Configuration categories Configuration objects are grouped into a number of categories At the top of the config pages is a set of icons one for each category as shown in Figure 3 3 Figure 3 3 Icons for configuration categories 3 FireBrick FB2700 Home Status Diagnostics Graphs Config Logout E E E 6 E EJ E E E Within each category there are one or more sections delimited by horizontal lines Each of these sections has a heading and corresponds to a particular type of top level object and relates to a major part of the configuration that comes under the selected category See Figure 3 4 for an example showing part of the Setup category which includes general system settings the system object and control of system services network services provided by the FB6000 such as the web interface web server telnet server etc controlled by the services object 12 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Figure 3 4 The Setup category System System settings name contact location intro comment Edit ruby Mike Chambers WF Ryde Office General system services Edit General system services Constant Quality Monitoring config Each section is displayed as a tabulated list showing an
154. iall a time is allowed with no change of speed e g tx min burst and after that the speed drops This can be automatic or using a rate of drop per hour e g tx step The rate will drop down to the defined minimum speed Once the average since bursting started drops below the target and the restrictions are lifted returning to the maximum speed If the minimum speed is below the target speed then this will happen eventually even if the link is used solidly at the maximum it is allowed If the minimum is at the target or higher then the usage will have to drop below the target for a time before the average speed drops low enough to restore full speed The overall effect of this means that you can burst up to a specified maximum but ultimately you cannot transfer more than if the target speed had been applied the whole time 46 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Traffic Shaping 9 2 Multiple shapers A packet that passes through the FB6000 can pass through multiple shapers for example e The ingress interface can have a defined shaper If the packet is carrier via an L2TP tunnel of any sort there can be an aggregate shaper for the tunnel e g the broadband carrier There can also be a class applied to the session which is an aggregate shaper for an arbitrary group of sessions often used when reselling broadband e When passing through an L2TP tunnel the session typically h
155. ibute that is intended for use by automated configuration management tools Neither of these attributes have a direct effect on the operation of the FB6000 Many objects have a name attribute which is non optional and often needs to be unique within the list of object This allows the named object to be referenced from other attributes The data type for these is typically an NMTOKEN which is a variant of a string type that does not allow spaces If you include spaces then they are removed automatically This helps avoid any problems referencing names in other places especially where the reference may be a space separated list Many objects have a graph attribute This allows a graph name to be specified However the actual graph name will be normalised to avoide spaces and limit the number of characters Try to keep graph names as basic characters letters numbers to avoid confusion 3 3 Configuration Methods The configuration objects are created and manipulated by the user via one of two configuration methods e web based graphical User Interface accessed using a supported web browser e an XML eXtensible Markup Language file representing the entire object hierarchy editable via the web interface or can be uploaded to the FB6000 The two methods operate on the same underlying object model and so it is possible to readily move between the two methods changes made via the User Interface will be visible as changes to the XML and vice versa
156. ich can then be viewed from the web User Interface or via the CLI A factory reset configuration also has a log target named fb support which is referenced by the 1og panic attribute of the system object see Section 5 7 This allows the FireBrick to automatically email the support team if there is a panic crash you can of course change or delete this if you prefer Caution Please only set things to log to fb support if requested by support staff 5 5 Performance The FireBrick can log a lot of information and adding logs can causes things to slow down a little The controls in the config allow you to say what you log in some detail However logging to flash will always slow things down a lot and should only be used where absolutely necessary 5 6 Viewing logs 5 6 1 Viewing logs in the User Interface To view a log in the web User Interface select the Log item in the Status menu Then select which log target to view by clicking the appropriate link You can also view a pseudo log target All which shows log event messages sent to any log target The web page then continues showing log events on the web page in real time i e as they happen Note This is an open ended web page which has been known to upset some browsers but this is rare However it does not usually work with any sort of web proxy which expects the page to actually finish 31 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 F
157. ides access to the following items e status information such as DHCP server allocations FB105 tunnel information and system logs e network diagnostic tools such as Ping and Traceroute there are also tools to test how the FB6000 will process particular traffic allowing you to verify your firewalling is as intended e traffic graphs By default access to the web user interface is available to all users from any IP address If you don t require such open access you may wish to restrict access using the settings described in Section 12 3 3 4 1 User Interface layout The User Interface has the following general layout e a banner area at the top of the page containing the FireBrick logo model number and system name e amain menu with sub menus that access various parts of the user interface the main menu can be shown vertically or horizontally sub menu appearance depends on this display style if the main menu is vertical sub menus are shown by expanding the menu vertically if the main menu is horizontal sub menus are shown as pull down menus a footer area at the bottom of the page containing layout control icons and showing the current software version e the remaining page area contains the content for the selected part of the user interface Figure 3 1 shows the main menu when it is set to display horizontally Note that the main menu items themselves have a specific function when clicked clicking such items
158. ier networks so that the BRAS can check to where it is to send an L2TP connection The RADIUS response can contain the tunnel details it needs including the authentication within L2TP RADIUS is also used between carrier and an ISP The carrier will send a RADIUS request to the ISP asking the ISP for details of the LNS to which the connection is to be sent This allows the ISP to steer sessions as they need Once the LNS gets the L2TP connection RADIUS is used to obtain the IP address details to be assigned to the specific connection RADIUS is also used for accounting to provide details of connections in progress and volumes of data transferred Appendix E provides details of the specific AVPs used with RADIUS for L2TP 16 1 6 BGP Once a connection is made to an LNS the end user is assigned IP addresses Obviously there is a need to ensure that the IP addresses are routed within the ISPs network to the correct LNS OSPF and BGP are the main routing protocols used for this though back in dialup days RIP and RIP2 were often used and a bits slow OSPF is not ideal for this as it means the whole OSPF network tracking every connection of every user The FireBrick supports use of BGP to announce connected IP addresses in to an ISPs internal network as connections are made via L2TP 16 2 Incoming L2TP connections To allow a connection to the FireBrick you have to decide on a hostname This is not a DNS hostname and can be anything you l
159. ifferent interface on the FireBrick It is also a good idea to have a switch that supports jumbo frames where the endpoint supports them FTTC FTTP and via suitable modems BT 21CN and TalkTalk Note This section contains information relating to access network services such as DSL and Fibre To The Cabinet available in the United Kingdom Although this information will not be directly applicable to services available in other countries the concepts are the same with appropriate knowledge of your ISP service and suitable equipment the FB6000 should work equally well with services that are available in other countries 10 1 Types of DSL line and router in the United Kingdom In the UK there are various types of DSL line and router than can be used Any device that supports PPPoE can work with the FireBrick but some options are only available with some devices as listed below e BT 20CN or 21CN lines can support PPPoE and PPPoA on the wire This means you can use them with a PPPoE A modem such as a Vigor V 120 out of the box or with a bridging router such as the Zyxel P660 configured in bridge mode BT support baby jumbo frames too Be O2 PPPoA lines only support PPPoA in theory In practice they also support PPPoE This means you can use a PPPoE A modem or a bridging modem TalkTalk lines support both PPPoA and PPPoE and so can work with a bridging modem They support baby jumbo frames too BT FTTC lines come with a VDSL mo
160. ify multiple DHCP client subnets like this and the FB6000 will reserve a separate MAC address for each This allows the FB6000 to aquire multiple independant IP addresses by DHCP on the same interface if required 6 2 2 Setting up DHCP server parameters The FB6000 can act as a DHCP server to dynamically allocate IP addresses to clients Optionally the allocation can be accompanied by information such as a list of DNS resolvers that the client should use Since the DHCP behaviour needs to be defined for each interface specifically each broadcast domain the behaviour is controlled by one or more dhcp objects which are children of an interface object Address allocations are made from a pool of addresses the pool is either explicitly defined using the ip attribute or if ip is not specified it consists of all addresses on the interface i e from all subnets but excluding network or broadcast addresses or any addresses that the FB6000 has seen ARP responses for i e addresses already in use perhaps through a static address configuration on a machine The XML below shows an example of an explicitly specified DHCP pool lt interface gt lt dhcp name LAN ip 172 30 16 50 80 log default gt neer rrace Tip When specifying an explicit range of IP addresses if you start at the network then the FB6000 will allocate that address Not all devices cope with this so it is recommended that an explicit range is used
161. iginated networks 0 cece cece cece nee ce ee ce eeee een eeneeneeeenees 124 H 2 34 bep Overall BGP settings iii iii 124 H 2 35 bgppeer BGP peer definitions soisissa e a E E A E NE aS 125 H 2 36 bgpmap Mapping and filtering rules of BGP prefixes oooccooccncconoconccnnccnnnnnanonoso 126 H 2 37 bgprule Individual mapping filtering rule ooonccoccnnccnnccnnconnconnconicnnaconccnnccnoro 127 H 2 38 cqm Constant Quality Monitoring settings oooconoccnccnnccnncnnncnnncnnncnnccnnccnnccnninos 127 H239 W2tp L2T Ps settn gs contesto tor poortecrda heen A dealer der 129 H 2 40 12tp incoming L2TP settings for incoming L2TP connections csseeee neers 129 H 2 41 12tp relay Relay and local authentication rules for L2TP cece cece eee 131 H 2 42 profile Control profile o occcoonccnnccncnoccnnoccnnnocnnnncnnnccnnnnccnnnncnonccnnnnccnnnrnnnnios 132 H 2 43 profile date Test passes if within any of the time ranges specified oooccconnccnncccc 133 H 2 44 profile time Test passes if within any of the date time ranges specified 133 H 2 45 profile ping Test passes if any addresses are pingable oooooccnoncccnnccnnnccnnnccnnnns 133 H 2 46 shaper Traffic shaper coc rennir a a e a E a A EE a 133 H 2 47 shaper override Traffic shaper override based on profile oooocccoccnnccnnccnnccnncono 134 E1 2 48 1p proup IP Group repii ee a rita aaa ta da 134 O NN 135 H
162. igits C 00 e the last address in the range has F for the remaining digits F FF Therefore this range spans 00 03 97 14 7C 00 to 00 03 97 14 7F FF inclusive 1024 addresses If you trying to identify an IP address allocation note that the exact address used within this range depends on a number of factors generally you should look for an IP address allocation against any of the addresses in the range Alternatively if the range specification doesn t include a hyphen it specifies that all addresses in the range start with this prefix the first address in the range will have zero for all the remaining digits and the last address in the range will have F for all the remaining digits For example 77 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 MAC Addresses usage 000397 147C is interpreted as e All addresses in the range start with 00 03 97 14 7C e the first address in the range has zero for the remaining digits 00 e the last address in the range has F for the remaining digits FF Therefore this range spans 00 03 97 14 7C 00 to 00 03 97 14 7C FF inclusive 256 addresses If your DHCP server shows the name of the client FB6000 that issued the DHCP request then you will see a value that depends on whether the system name is set on the FB6000 as shown in Table B 1 Refer to Section 4 2 1 for details on setting the system name Table B 1 DHCP client names used Sys
163. ike You can pre agree with your carrier the hostname they will use and the IP address of your LNS When the connection arrives the protocol includes the hostname and a password The hostname allows the FireBrick to check which connection details apply and the password confirms that the connection is authentic The FireBrick can be configured with many hostnames which would typically be used for different carriers to connect You can also use the hostname to separate different types of connection for example in the UK BT have 20CN IPStream and 21CN WBC connections which typically need separate monitoring and traffic 69 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Internet Service Providers shaping You could even use the hostname to separate different grades of service or if the ISP is providing wholesale connections for different ISP customers The incoming connection configuration includes the password and the RADIUS servers to use to validate the users and various defaults that apply to the PPP connections Most of these defaults can be set by the RADIUS server as well but it can be useful to make the RADIUS configuration simple to hav defaults in the FireBrick config Taking one step back the choice of LNS and hostname that the carrier uses when sending the connection to the ISP can eitehr be pre configured or more usefully it can be based on a RADIUS request sometimes called plat
164. innss 58 1571 Perry pesto iran 64 15 2 COMMONS ti A A Sea ees A AS 66 15 3 Network attributes posse retara aE on ears EE EROA SEEE ROA EPOE EEE PETEERE EE PTEN GEEET SEESE E 66 Bel DHCP chent names Used ia ens eoe ESEE EEEa O E N EEE inca ist 78 A A O E S 80 D2 SCCRP nui A An 80 O es sss E oe tees blots Ssh cg sb udies seat gs evashngsavoess cia eosaseas saves shoes Metvas totes aia cd sdeae seaman aay 81 DAs StopCEN vistes li talas iii 81 DS HELLO ss tes coris ap podriais 81 D6 TORO vii AA A NIA EE 81 Dil O O 82 D S ICON aim ia coedia ire bl geste evs 82 D9 A saa boites santas ba sbenh eee cteh as bovceke eataelss batty ban eatts ast bai Saha eantaa bea E atv ses E ES 82 DIO OQCRP ion A A soe gages dee iia 83 DAT OCON E otet SSNS ses voted chs dag was nate ese vag Send ons oa saa E aia sdeauses seneeuaeea sees 83 D125 CDN roio en tes oes tech sted tal 83 DAS WEN uti 83 DAS A A AA A ewes 83 ET Access requests cris lenin ri iii 85 O A Y NAS 86 E 3 Acc ss Rejelbse siente ir tri iras 87 EA ACCO0ODUN bicis ie A D A EErEE E O O EEE E EEE 87 A II AAA TO 88 E0 Accounting Stp ini aii 89 E T Disconnect 55 metoni E Actes S 90 E 8 Change of Authorisation ssion n sees a OES EEE T EEEE E S EEEE ET E E 90 E98 A e l D o E EEE tiro dees oa ade gests sdaaetewsdeabsoaesteeene 91 EL Pile Pess arias de EE E E ES RSS 100 G2 COlOU S ike Ses e a a a e a a E E E panes ses S AE a E E G 101 Gd TORT NOS 102 GAL O O 102 G5 URL formatie ita eds
165. ion tracking if set ip IPAddr Not optional Target IP source ip IPAddr Source IP ttl unsignedB yte Time to live Hop limit H 2 46 shaper Traffic shaper Settings for a named traffic shaper Table H 61 shaper Attributes Attribute Type Default Description comment string Comment name token graphname Not optional Graph name 133 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects rx unsignedInt Rx rate limit target b s rx max unsignedInt Rx rate limit max rx min unsignedInt Rx rate limit min rx min burst duration Rx minimum allowed burst time rx step unsignedInt Rx rate reduction per hour share boolean If shaper is shared with other devices source string Source of data used in automated config management tx unsignedInt Tx rate limit target b s tx max unsignedInt Tx rate limit max tx min unsignedInt Tx rate limit min tx min burst duration Tx minimum allowed burst time tx step unsignedInt Tx rate reduction per hour Table H 62 shaper Elements Element Type Instances Description override shaper override Optional unlimited Profile specific variations on main settings H 2 47 shaper override Traffic shaper override based on profile Settings for a named traffic shaper Table H 63 shaper override
166. is is not set It checks these in order Each RADIUS configuration can have multiple servers Only if all of the services in a configuration entry are blacklisted will later configuration entries be considered Having picked a RADIUS configuration entry the servers listed are considered based on their previous response time and reliability The requests are then sent to serves in order allowing enough time for a response based on previous performance There are settings to fine tune these timings Once a response is received then the L2TP connection can proceed The same process is followed for RADIUS accounting Each config can say if 1t is used for authentication or accounting or both 73 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 17 Command Line Interface The FB6000 provides a traditional command line interface CLI environment that can be used to check status information and control some aspects of the unit s operation The CLI is accessed via the telnet protocol the FB6000 implements a telnet server which you can connect to using any common telnet client program To learn how to enable the telnet server and to set up access restrictions please refer to Section 12 4 The CLI is also available via the serial interface on the rear of the unit This is normally set to 9k600 1N8 A USB serial lead is supplied Note The CLI is not normally used to change the configuration
167. its coverage of the full object model Some more obscure attributes may not be covered at all some of these may be attributes that are not used under any normal circumstances and used only under guidance by support personnel If you encounter attribute s that are not documented in this manual please refer in the first instance to the documentation described in Section 3 2 1 below If that information doesn t help you and you think the attribute s may be relevant to implementing your requirements please consult the usual support channel s for advice www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration 3 2 1 Formal definition of the object model The object model has a formal definition in the form of an XML Schema Document XSD file which is itself an XML file normally intended for machine processing A more readable version of this information is available in Appendix H Note however that this is reference material containing only brief descriptions and intended for users who are familiar with the product and in particular for users configuring their units primarily via XML The XSD file is also available on the software downloads website by following the XSD link that is present against each software release 3 2 2 Common attributes Most objects have a comment attribute which is free form text that can be used for any purpose Similarly most objects have a source attr
168. ix session MSS username string User name vlan unsignedShort 0 VLAN ID O untagged 0 4095 vlan Table H 37 pppoe Elements Element route Type Instances ppp route Optional unlimited Description Routes to apply when ppp link is up H 2 29 ppp route PPP routes Routes that apply when link is up Table H 38 ppp route Attributes Attribute Type Default Description bgp bgpmode BGP announce mode for routes comment string Comment ip List of IPPrefix Not optional One or more network prefixes localpref unsignedInt 4294967295 Localpref of network highest wins name string Name profile NMTOKEN Profile name source string Source of data used in automated config management H 2 30 route Static routes Static routes define prefixes which are permanently in the routing table and whether these should be announced by routing protocols or not www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 122 Configuration Objects Table H 39 route Attributes Attribute Type Default Description bgp bgpmode BGP announce mode for routes comment string Comment gateway List of IPAddr Not optional One or more target gateway IPs graph token graphname Graph name ip List of IPPrefix Not optional One or more network prefixes localpref unsignedInt 42949672
169. k www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 2 Getting Started 2 1 IP addressing You can configure your FireBrick using a web browser to do this you need IP connectivity between your computer and the FireBrick For a new FB6000 or one that has been factory reset there are three methods to set this up as described below select the method that you prefer or that best suits your current network architecture e Method 1 use the FireBrick s DHCP server to configure a computer If your computer is already configured as many are to get an IP address automatically you can connect your computer to port 1 on the FireBrick and the FireBrick s inbuilt DHCP server should give it an IPv4 and IPv6 address Method 2 configure a computer with a fixed IP address Alternatively you can connect a computer to port 1 on the FireBrick and manually configure your computer to have the fixed IP address es shown below Table 2 1 IP addresses for computer IPv6 IPv4 2001 DB8 2 64 10 0 0 2 subnet mask 255 255 255 0 e Method 3 use an existing DHCP server to configure the FireBrick If your LAN already has a DHCP server you can connect port 4 of your FireBrick to your LAN and it will get an address Port 4 is configured by default not to give out any addresses and as such it should not interfere with your existing network You would need to check your DHCP
170. le show route lt IPPrefix gt table lt routetable gt Shows details of a route in the routing table Where an individual IP is used the route that would be used is shown but if a specifiy prefix is used then that specific route is shown even if there may be more specific routes in use F 2 4 List routes show routes lt IPFilter gt table lt routetable gt Lists routes in the routing table limited to those that match the filter if specified F 2 5 List routing next hops show route nexthop lt IPAddr gt List the next hop addresses currently in use and their status 96 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Command line reference F 2 6 See DHCP allocations show dhcp lt IP4Addr gt table lt routetable gt Shows DHCP allocations with option to show details for specific allocation F 2 7 Clear DHCP allocations clear dhcp ip lt IP4Range gt table lt routetable gt Allows you to remove one or more DHCP allocations F 2 8 Lock DHCP allocations lock dhcp ip lt IP4Addr gt table lt routetable gt Locks a DHCP allocation This stops the allocation being used for any other MAC address even if long expired F 2 9 Unlock DHCP allocations unlock dhcp ip lt IP4Addr gt table lt routetable gt Unlocks a DHCP allocation allowing the address to be re used
171. ling Number 22 Accepted used in RADIUS and passed Passed on incoming value on if relaying Sub Address 23 Ignored Not sent Physical Channel ID 25 Ignored Not sent Table D 7 ICRP AVP No Incoming Outgoing Message Type 0 Value 11 Value 11 Assigned Session ID 14 Mandatory Mandatory D 8 Incoming Call Connected Table D 8 ICCN AVP No Incoming Outgoing Message Type 0 Value 12 Value 12 Framing Type 19 Ignored 1 Tx Connect Speed 24 Accepted used in RADIUS and passed Passed on incoming value on if relaying Initial Received LCP 26 Ignored Not sent CONFREQ Last Sent LCP 27 Accepted used in RADIUS and passed Passed on incoming value CONFREQ on if relaying Last Received LCP 28 Accepted used in RADIUS and passed Passed on incoming value CONFREQ on if relaying Proxy Authen Type 29 Accepted used in RADIUS and passed Passed on incoming value on if relaying Proxy Authen Name 30 Accepted used in RADIUS and passed on if relaying Passed on incoming value Proxy Authen 31 Accepted used in RADIUS and passed Passed on incoming value Challenge on if relaying Proxy Authen ID 32 Accepted used in RADIUS and passed Passed on incoming value on if relaying Proxy Authen Response 33 Accepted used in RADIUS and passed Passed on incoming value on if relaying Private Group ID 37 Ignored Not sent Rx Connect Speed
172. low you to visual connections in terms of their state traffic rates and patterns etc By setting the graph attribute you can cause the state of the line data transferred each way and current packet loss and latency to be recorded on a graph Once you are graphing the PPPoE connection you can set traffic shaping to control speed see Section 9 1 2 Alternatively a PPPoE connection is something you can set a speed limit on directly setting the speed attribute will control the speed of traffic sent to the Internet this is mainly used when bonding PPP links 50 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 11 Tunnels The FB6000 supports the following tunnelling protocols e L2TP L2TP client functionality enables tunnelled connections to be made to an L2TP server 51 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 12 System Services A system service provides general functionality and runs as a separate concurrent process alongside normal traffic handling Table 12 1 lists the services that the FB6000 can provide Table 12 1 List of system services Service Function SNMP server provides clients with access to management information using the Simple Network Management Protocol NTP client automatically synchronises the FB6000 s clock with an NTP time server usually using an Internet public NTP
173. lpha Load test releases H 3 2 config access Type of access user has to config Table H 66 config access Type of access user has to config Value Description none No access unless explicitly listed view View only access no passwords read Read only access with passwords full Full view and edit access H 3 3 user level User login level User login level commands available are restricted according to assigned level Table H 67 user level User login level Value Description NOBODY Unknown or not logged in user GUEST Guest user USER Normal unprivileged user ADMIN System administrator DEBUG System debugger 135 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects H 3 4 syslog severity Syslog severity Log severity different loggable events log at different levels Table H 68 syslog severity Syslog severity Value Description EMERG System is unstable ALERT Action must be taken immediately CRIT Critical conditions ERR Error conditions WARNING Warning conditions NOTICE Normal but significant events INFO Informational DEBUG Debug level messages NO LOGGING No logging H 3 5 syslog facility Syslog facility Syslog facility usually used to control which log file the syslog is written to Table H 69 syslog facility Syslog facility
174. mbers A failure to receive a multicast packet from the master router for a period longer than three times the advertisement interval timer causes the backup routers to assume that the master router is down The interval is specified in multiples of 10ms so a value of 100 represents one second The default value if not specified is one second If you set lower than one second then VRRP3 is used by default see below VRRP2 only does whole seconds and must have the same interval for all devices VRRP3 can have different intervals on different devices but typically you would set them all the same The shorter the advertisement interval the shorter the black hole period but there will be more multicast traffic in the network Note For IPv6 VRRP3 is used by default whereas for IPv4 VRRP2 is used by default Devices have to be using the same version IPv4 and IPv6 can co exist with one using VRRP2 and the other VRRP3 Setting the same config apart from priority on all devices ensures they have the same version 14 2 2 Priority Each device is assigned a priority which determines which device becomes the master and which devices remain as backups The working device with the highest priority becomes the master If using the real IP of the master then the master should have priority 255 Otherwise pick priorities from 1 to 254 It is usually sensible to space these out e g using 100 and 200 We suggest not setting priority 1 see
175. n Connect Info 77 Text tx speed limit to apply to session Tunnel Type 64 If specified must be 3 L2TP L2TP is assumed 86 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported RADIUS Attribute Value Pairs for L2TP operation Tunnel Medium Type 65 If specified must be 1 IPv4 or 2 IPv6 syntax of endpoint is used if this is not specified Tunnel Server 67 Text IPv4 or IPv6 address of endpoint FQDN is not accepted Endpoint Tunnel Client Auth 90 Hostname to quote on outgoing tunnel if omitted then configured FireBrick ID hostname is used Tunnel Password 69 Shared secret to use on outgoing tunnel encrypted if omitted then assumed no secret Tunnel Assignment 81 Name of outgoing tunnel shaper graph Also groups sessions together in a ID tunnel as per RFC Only use valid text graph names Tunnel Preference 83 Specifies preference order when multiple tagged endpoints sent Note that whilst a RADIUS response is normally relatively small in can get larger when multiple tunnel endpoints are included Fragmented responses are handled but there is an internal limit to the size of response that can be processed as such we recommend keeping the response to a single un fragmented packet of up to 1500 bytes You can use tag 0 for common settings such as Tunnel Client Auth ID or Tunnel Password when using multiple endpoints in order to reduce the size of the
176. n allow List of List of IP ranges from which connects can IPNameRange be made 129 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects bgp bgpmode BGP announce mode for routes comment string Comment damping boolean false Apply damping to sessions if limiting on shaper dhcpv6dns List of IP6Addr List of IPv6 DNS servers dos limit unsignedInt 10000 Per second per session tx packet drop limit for DOS protection fail lockout unsignedByte 60 Interval kept in failed state graph string Graph name hdlc boolean true Send HDLC header FFO03 on all PPP frames hello interval unsignedByte 60 Interval between HELLO messages hostname string Hostname quoted on incoming tunnel icmp ppp boolean false Use PPP endpoint for ICMP ipv6ep IP4Addr Local end IPv4 for IPv6 tunnels Icp mru fix boolean false Restart LCP if RAS negotiated MRU is too high Icp rate unsignedByte 1 LCP interval seconds Icp timeout unsignedB yte 10 LCP timeout seconds log NMTOKEN Not logging Log events log debug NMTOKEN Not logging Log debug log error NMTOKEN Log as event Log errors mtu unsignedShort Default MTU for sessions in this tunnel 576 2000 mtu name string Name open timeout unsignedByte 60 Interval before OPEN considered failed payload table unsignedByte 0 99 0 Routing table number for paylo
177. n co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration software php PRODUCT 6000 please follow the read the instructions link that you will find just above the list of software versions Note In order to be able to run alpha releases your FB6000 must be enabled to run alpha software this 1s done by changing the entry in the FireBrick capabilities database hosted on FireBrick company servers for your specific FB6000 as identified by the unit s Serial Number Normally your FB6000 will be running factory or possibly beta software with alpha software only used under advice and guidance of support personnel while investigating fixing possible bugs or performance issues You can see whether your FB6000 is able to run alpha releases by viewing the main Status page click the Status main menu item and look for the row labelled Allowed if the text shows Alpha builds for testing then your FB6000 can run alpha releases 4 3 1 1 Breakpoint releases Occasionally a software release will introduce a change to the object model that means the way specific functionality is configured in XML also changes for example an attribute may have been deprecated and a replacement attribute should be used instead A release where such an change has been made and existing configurations will need modifying are termed Breakpoint software releases Breakpoint releases are special as they are able to automatically update a
178. n co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 4 System Administration 4 1 User Management You will have created your first user as part of the initial setup of your FB6000 as detailed in either the QuickStart Guide or in Chapter 2 in this manual To create edit or delete users browse to the config pages by clicking the Edit item in the sub menu under the Config main menu item then click on the Users category icon Click on the Edit link adjacent to the user you wish to edit or click on the Add link to add a user To delete a user click the appropriate Edit link then click the Erase button in the navigation controls see Figure 3 8 As with any such object erase operation the object will not actually be erased until the configuration is saved Once you have added a new user or are editing an existing user the object editing page will appear as shown in Figure 4 1 Figure 4 1 Setting up a new user Admin users user 1 of 1 Up New Erase Help User names passwords and abilities for admin users name E comment profile User name Comment Profile name password E full name E otp User password Full name OTP serial number E timeout E config E level Login idie timeout zero to stay logged in Config access level Login level 5 00 full ADMIN LECI Restrict logins to esses The minimum attributes that must be specified are name which is the user
179. n existing configuration used with the previous software release so that it is compatible with the new release and functionality is retained where ever possible When using the Internet based upgrade process the FB6000 will always upgrade to the next available breakpoint version first so that the configuration is updated appropriately If your current software version is several breakpoint releases behind the latest version the upgrade process will be repeated for each breakpoint release and then to the latest version if that is later than the latest breakpoint release On the FB6000 software downloads website breakpoint releases are labelled Breakpoint immediately under the version number Note If you have saved copies of configurations for back up purposes always re save a copy after upgrading to a breakpoint issue If you use automated methods to configure your FB6000 check documentation to see whether those methods need updating 4 3 2 Identifying current software version The current software version is displayed on the main Status page shown when you click the Status main menu item itself 1 e not a submenu item The main software application version is shown next to the word Software e g Software mB OO Hermia Valle OF 200d AON SAO 2s 180 The software version is also displayed in the right hand side of the footer area of each web page and is shown immediately after you login to a command line session
180. name that you type in when logging in and password passwords are mandatory on the FB6000 You can optionally provide a full name for the specified username and a general comment field value 4 1 1 Login level A user s login level is set with the level attribute and determines what CLI commands the user can run The default if the level attribute is not specified is ADMIN you may wish to downgrade the level for users who are not classed as system administrators 20 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration Table 4 1 User login levels Level Description NOBODY No access to any menu items GUEST Guest user access to some menu items USER Normal unprivileged user ADMIN System administrator DEBUG System debugging user 4 1 2 Configuration access level The configuration access level determines whether a user has read only or read write access to the configuration as shown in Table 4 2 below This mechanism can also be used to deny all access to the configuration using the none level but still allowing access to other menus and diagnostics This setting is distinct from and not connected with the login level described above You can use the access level to define for example whether a USER login level user can modify the configuration Typically an ADMIN or DEBUG login level user would always be granted full
181. nccnnnos 139 H 3 16 LinkLED y Yellow LED setting 2 0 0 0 eee cece ce eeceeeceeecaeeea seca sean sean cease 139 H 3 17 LinkLED g Green LED setting aan cece cece cence ence E A seen eenaeeaes 139 H 3 18 LinkPower PHY power saving Options ooccocccnccnocnnncnnccnnconnconnccnnccnncnnnconaconose 140 H 3 19 LinkFault Link fault type to send eee cece eee ceeeceeeeeeeeeeeeaeeea sean eeaes 140 x www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6202 User Manual H 3 20 ramode IPv6 route announce level o oooooccnnccncconcconocnnocnnccnncnnncnnncnnccnncinncnno 140 H 3 21 dhcpv control Control for RA and DHCPV bits ooccoccccccccccncccnccnnccnnccnniccnnions 140 H 3 22 bgpmode BGP announcement mode ooooccoccnnccnnccnnconconccnnccnnconnccnnccnnccnnconncnnnios 141 H 3 23 sfoption Source filter Option 2 0 0 0 cece cece cc ence ence eeeeeeeeeeeaeeeaeeeaeeaeeeaneegs 141 H 3 24 pppoe mode Type of PPPoE connection coooccncccncnnncnnccnnccnnconnccnnccnncnnnconaconncos 141 H 3 29 peertype BGP peer type tias e died 141 H 3 26 switch Profile manual setting ooocoooccnnconccnnccnnncnnnnnnronoconccnnccnnccnnccnnccnncnnnoss 142 HA Basiesty DES Gi A A A di 142 IN OX O 144 xi www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 List of Figures 2 1 Initial web page in factory reset State amoran i a E E E E
182. nd icmp error networks port portdef Optional up to 2 Port grouping and naming ppp pppoe Optional up to 10 PPPOE settings profile profile Optional unlimited Control profiles route route Optional unlimited Static routes services services Optional General system services shaper shaper Optional unlimited Named traffic shapers system system Optional System settings user user Optional unlimited Admin users www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 105 Configuration Objects H 2 Objects H 2 1 system System settings The system settings are the top level attributes of the system which apply globally Table H 3 system Attributes Attribute Type Default Description comment string Comment contact string Contact name dos delay unsignedInt 2 Interrupt DoS restoration counter leave at default dos limit unsignedInt 1000 Interrupt DoS packet limit leave at default intro string Home page text location string Location description log NMTOKEN Web console Log system events log debug NMTOKEN Not logging Log system debug messages log error NMTOKEN Web Flash console Log system errors log eth NMTOKEN Web console Log Ethernet messages log eth debug NMTOKEN Not logging Log Ethernet debug log eth error NMTOKEN Web Flash co
183. nd Descendant This tree like structure is used to e group a set of related objects such as a set of firewall rules the parent object acts as a container for a group of child objects and may also contribute to defining the detailed behaviour of the group e define a context for an object for example an object used to define a locally attached subnet is a child of an object that defines an interface and as such defines that the subnet is accessible on that specific interface Since multiple interfaces can exist other interface objects establish different contexts for subnet objects Additional inter object associations are established via attribute values that reference other objects typically by name e g a firewall rule can specify one of several destinations for log information to be sent when the tule is processed 3 2 The Object Model The term object model is used here to collectively refer to e the constraints that define a valid object hiearchy i e which object s are valid child objects for a given parent object how many siblings of the same type can exist etc e for each object type the allowable set of attributes whether the attributes are mandatory or optional their datatypes and permissible values of those attributes The bulk of this User Manual therefore serves to document the object model and how it controls operation of the FB6000 Tip This version of the User Manual may not yet be complete in
184. nd of the username to steer the connection to the right LNS 68 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Internet Service Providers 16 1 4 Broadband In a typical broadband network we don t have dialup modems in the same The modems are jumpered to the phone line at the exchanged and are part of an Access Node usually called a DSLAM or MSAN This then passes PPP packets on to a Remote Access Server usually called a BRAS The link from DSLAM to BRAS is typically PPPoE The BRAS acts as the LAC and connects to an ISPs LNSs PPPoE is PPP over Ethernet Some access networks use DSL to carry PPP packets directly PPPoA and some use the ADSL as an Ethernet Bridge PPPoE There are access networks which provide Ethernet by some means to the end user equipment which then commincations via PPPoE to the BRAS All of these work in much the same way at the BRAS as it sees PPPoE connections Typically the BRAS provides the initial proxy negotiation and then establishes an L2TP connection after which it is no longer involved in any negotiation but just passes on PPP packets each way 16 1 5 RADIUS Remote Access Dlual Up Server is a system that allows the authentication decisions and allocation of IP addresses to be passed on to separate servers rather than being configured in to the various equipment RADIUS uses UDP to send a request to a server and send a reply back RADIUS is used within carr
185. nee 116 H29 porde Atri Dutess x 6 55 trials ocio o en oh aaae a Di codes isis a sia Snaly 116 26 mtertace Ati bUteS da tai ados 116 4 27 1ntertace Elements ecuestre np sumeed sever desehtemessee EEE E S 117 B28 Subnet Ati DUES missien en Digit ede tia one Mua eRe de vce Rass Mia ek Nitin Seeded nde cea 117 B29 vrrp NN 118 H307 dheps Attr butes ti A dd 119 H31 dhcps Elements 0 30 s2dccovssastes suede seeder shes eseadssetees ish A petieaseed seuasenbeeadtes ERE EESE OES 120 H 32 dhep attr hex gt Attributes 2s scacsec se n de a eA iia E 120 BH 33 dhep attr s tring Atri DUES seen toni dent aden A E a eadasdabeades SE den dal Riad 120 H 34 dhcp attr number Attributes sese ee rone EE EE EE ra ESEA TEE EAE 120 H33 dhep attr ip A aE e EER RE E e E ESS EEEE E EE EE S 121 B36 PPpoe Attributes iii o A A A Sela eee 121 A A 122 H 38 ppp toutes Attributes ib 122 H39 foute A RON 123 H40 network Atte DUIES isis A A E 123 H4 Dlackhole Attributes coneccion haces bated pcia ido E ss droit pili iodo 123 H 42 loopback Attributes osrin ei ion EE ER 124 H43 Dep Att DUtes Jonesina eiii Roi 124 HAA Dep Elements Vlad 125 IS Deppeer A A NO edasestens 125 11 46 Deppeer D LA 0 a Cea i SA E E E N IS A aad oe 126 H47 Depmap RA RA 126 H48 bepmap Elements vais A A gah NS A eS 127 O 127 ELSOcqm Attributes a ade 127 H31 Pip A MniDUtes ver sioess a a A cigs Senge np somes caved dees Sonus sd NEE cute ce avee teed setae 129
186. ng gt This causes the FB6000 to crash causing a panic event with a specified message You need to specify confirm yes for the command to work This can be useful to test fallback scenarios by simulating a fatal error Note that panic crash logs are emailed to the FireBrick support by default so please use a meaningful string e g panic testing fallback confirm yes F 6 2 Reboot reboot lt unsignedInt gt hard confirm lt string gt A reboot is a more controlled shutdown and restart unlike the panic command The first argument is a block number see show flash contents and forces reboot to run a specific software stored in flash Normally the reboot will run the latest valid code The hard option forces the reboot to clear the Ethernet ports and other hardware so takes a couple of seconds You must specify confirm yes for this to work F 6 3 Screen width set command screen width lt unsignedInt gt This allows you to set the screen width 98 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Command line reference F 6 4 Make outbound command session start command session lt IPAddr gt port lt unsignedShort gt table lt routetable gt This allows a reverse telnet connection to be made A TCP connection is made to the IP address and port where a user can login This can be useful where a firewall policy prevents incoming access to allow someone
187. ng table and restrict the source IP addresses from which connections are accepted In the case of the web interface you can also define trusted IP addresses which are given priority access to the login page even When using the FB6000 as an LNS you may be allowing access to CQM graphs linked from control systems as an ISP and so have to have the web interface open to the world You should make use of the trusted IP settings to ensure you still have access even if there is a denial of service attack against the web interface You should also set up access restrictions for users see Section 4 1 4 for details 12 2 Common settings Most system service have common access control attributes as follows Tip You can verify whether the access control performs as intended using the diagnostic facility described in Section 13 1 52 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Services Table 12 2 List of system services Attribute Function table If specified then the service only accepts requests connections on the specified routing table If not specified then the service works on any routing table Where the service is also a client then this specifies the routing table to use default 0 allow If specified then this is a list of ranges of IP addresses and ip group names from which connections are allowed If specified as an empty list then no access is allowed If omitted then a
188. nnccnncnnncnnocnnccnnconnccnnccnncnnnconncnnncnnnes 26 AAV POr LEDS triana ia ita in 26 dy Event TOs pine RA A Ea a 28 De Mc OVERVISW see O 28 Dells LOS tar Pets A Mask ae a E e Saves Sai ae ben ek Mee a RWG ae A etal 28 1 1 1 Eoggimg to Flash memory srs isee e a E EES ES 28 5 1 1 2 Logging to the Console teenie a ee EE E EE E SE 29 3 23 Enabling Jor SIN greer orr R e e E E A EO EROR EEEE ESE EEEE 29 5 3 Logging to external destinations 2 0 0 0 cece n E E a E a sE eh 29 SA IO 29 D3 2s Email AA tinct E E ys avast en tielign eb ete devetvecunoaes tantieeb S 30 SA E mail process lOPSIN gS ppsa sevedee sth svdeasne tea gessesoness ET eeaesen gwen ses 31 5 4 Factory reset configuration log targets 1 0 0 0 cece cece cee cence eeceeeeeeeea ceca eeaeeeae eeu eeneeeneeeenees 31 D D PETLOLIMANCE aise O Ses dawed SEAS 31 DOA VIEWS NORS ieee iN E wed ede ated reat A Mabeboed eer east 31 5 6 1 Viewing logs in the User Interface 2 0 0 0 cece t ennienni iore ere api ooe iE pano ps 31 5 6 2 Viewing logs in the CLI environment 0 cece cece scence ence eceeeceeeeeeeeaeeeaes 32 NA SUS OS 32 5 8 Using Profiles ai A iia 32 6 Interfaces and SubnetS smilies 33 6 1 Relationship between Interfaces and Physical Ports ooooccoccnnconnconnccnnconnconocnnncnnncnnocaninnnss 33 O 33 e BSA Intertaces A A io eee 33 DN A O 33 6 2 1 Defining SUDNE S 2 ii iio aia dos 34 6 2 1 1 Using DHCP to configure a subnet oocccoccnccnnco
189. nnccnncnnnconnconoconanonocnnccnarnnns 34 6 2 2 Setting up DHCP server parameters oooccoccnnccnnccnnconoconnconnconncnnncnnnnnnrnnncnnccnnccnnicnns 35 6 2 2 1 Fixed Static DHCP allocations 20 0 0 eee ec cece eee ece eee eeeeeeeeseeeeaeeeaes 35 6 2 2 1 1 Special DHCP attributes 2 0 00 cece e cena eeneeeneeennees 36 6 2 2 2 Partial MAC address based allocations ocoooccnocnnccnnccnncnnnconccnnccnnccnnccnncons 36 6 3 Physical port Stun a A ad ye ec dg EEE E eee 36 6 3 0 Setting duplex mode c0 o52s cose sesues oesh oun ass priista nostre EEREN I 37 6 3 2 Defining port LED functions oocccooccnnnccnnnoccnnccnnnnccnnnncnonocnnnnccnnnncnoncnnnnncinnnrcnnnose 37 TROUDE O veut edacene sees ee E decors E a AE E EES 38 Tol Routing lOGIC erste eeen E R E A E ES 38 T 27 Routing targets resoa a e E EE E E EEN E RAE EERIE SE E A EE ES ERR 39 TZ LS UDC TOUS SS AA ds 39 7 2 2 Routing to an IP address gateway route ooccooccnnconnconoconconacnnncnnncnaronoronccnnrinninnno 39 9223 Special targets ti deste tee eis dele Rea as IO ie tou ey Ia 40 v www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6202 User Manual 7 3 Dynamic route creation deletion ooocccoccnnccnnccnnconnconeconncnnncnnncnnnnnnronnrnnccnnccnnccnnccnnioos 40 TA Routino tables cia A e Aia 40 PDs BOONE beg toe ind aii dede ones adan 40 O E RT 42 Beli OVERVIEW st a 42 2 Creating editin gs proves sia
190. nsole Log Ethernet errors log panic NMTOKEN Web logs Log system panic messages log stats NMTOKEN Not logging Log one second stats name string System hostname source string Source of data used in automated config management sw update autoloadtype false Load new software automatically sw update profile NMTOKEN Profile name for when to load new s w Table H 4 system Elements Element Type Instances Description link link Optional unlimited Home page links H 2 2 link Web links Links to other web pages Table H 5 link Attributes Attribute Type Default Description comment string Comment name string Link name profile NMTOKEN Profile name source string Source of data used in automated config management 106 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects text string Link text url string Link address H 2 3 user Admin users User names passwords and abilities for admin users Table H 6 user Attributes Attribute Type Default Description allow List of Restrict logins to be from specific IP IPNameRange addresses comment string Comment config config access full Config access level full name string Full name level user level ADMIN Login level name NMTOKEN Not optional User name username otp string OTP serial number password Password Not optional User p
191. nt diodes 103 Bile contigs Attributes osito te E E passa dets 105 H 2 config Elements ci A TAI RR A 105 H 3 systems O A 106 H4 System Elements csi niiae e erae pede EA EE a peonedebccecesap Se Mead EEEE ES EEE E hi aky 106 HS mk ATEIDUtES ceiien pitt 106 6 USE Attributes uu in iii dad 107 xiii www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6202 User Manual HF log Attributes so dose cused aa atar capota EE tue doses one E goon eee ahes eee dgepheedabsbe sete seats 107 H 8 logs Blements i ne ciate ee ai a ate ee aA eR Se Se He ama sy Sa Se ad 107 H9 log syslog Atti Dutes nn ista besa den aea a E ii apto 108 H 10 dog email Attributes ea ct tec eal eta sae ect eho eects AA den weenie hoes dee 108 Htl services Elements 2 torio ocean swans shy Sea ges fit tirita 109 H12 SHMpP Service Attributes vit A Cite ads Aas ce een de aE ESS 109 AA LO 110 B14 teln t service Attributes id isedein teed eth ow A 110 H13 Attp services A O 111 H 16 dns service Attributes cito dial 111 H17 dnseservice Elements ersi ee dene gaer soothes a vegaweat ou sendero li inerte 112 BLS dns hosti A te bute si it 112 H19 dns block Atti Dutes ener opi tropa sy sumed Rene 112 H 20 Fadius service ATTIDU OS leo ll A Ao 113 A e A OS 114 H 22 radius service match Attributes miesa oenen E EN EE EEEa EE SEE A EES 114 H 23 SAA IN 115 B24 ethernet Attrib teS senie IS Pease eee dah ages
192. nt for relayed L2TP local end hostname quoted by outgoing tunnel ID Tunnel Server Auth 91 Present for relayed L2TP far end hostname quoted by outgoing tunnel ID E 5 Accounting Stop As accounting interim update plus Table E 6 Accounting Stop AVP No Usage Acct Terminate 49 Cause code as appropriate Cause Cause codes of note are 2 Lost Carrier which is sent if LCP echos do not reply for several seconds and 14 Port Suspended which is sent if the dos limit is exceeded on a session For DOS handling is is recommended that subsequent authentication requests are rejected for several minutes or a fake accept is and session timeout is used as DOS attacks usually continue until the customer is off line 89 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported RADIUS Attribute Value Pairs for L2TP operation E 6 Disconnect A disconnect message is accepted as per RFC5176 if the session can be disconnected and ACK is sent else a NAK Table E 7 Disconnect AVP No Usage Acct Session Id 44 Unique ID for session Chargeable User 89 This is used as CQM graph name Identity Acct Terminate 49 Cause code as appropriate to be used in accounting stop message Cause The session is identified by Acct Session Id if present else by Chargeable User Identity No other identification parameters are supported If s
193. nt messages in RAM the e mail that is sent after the hold off period will contain any messages that were generated during the hold off period The following aspects of the e mail process can be configured e subject you can either specify the subject by setting the subject attribute value or you can allow the FB6000 to create a subject based on the first line of the log message e mail addresses as to be expected you must specify a target e mail address using the to attribute You can optionally specify a From address by setting the from atttribute or you can allow the FB6000 to create an address based on the unit s serial number outgoing mail server the FB6000 normally sends e mail directly to the Mail eXchanger MX host for the domain but you can optionally specify an outgoing mail server smart host to use instead by setting the server attribute SMTP port number the FB6000 defaults to using TCP port 25 to perform the SMTP mail transfer but if necessary you can set the port attribute to specify which port number to use retry delay if an attempt to send the e mail fails the FB6000 will wait before re trying the default wait period is 10 minutes but you can change this by setting the ret ry attribute An example of a simple log target with e mailing is available in a factory reset configuration the associated XML is shown below from which you can see that in many cases you only need to specify the to attribute
194. o packet dump to fail If you are getting a simple 404 error response and think you have specified the correct URL if using an HTTP client please check security settings are as described here 13 2 3 IP address matching You may optionally specify upto two IP address to be checked for a match in packets on the interface s and or L2TP session s specified If you do not specify any IP addresses then all packets are returned If you specify one IP address then all packets containing that IP address as source or destination are returned If you specify two IP addresses then only those packets containing both addresses each address being either as source or destination are returned IP matching is only performed against ARP IPv4 or IPv6 headers and not in encapsulated packets or ICMP payloads If capturing too much some packets may be lost 13 2 4 Packet types The capture can collect different types of packets depending on where the capture is performed All of these are presented as Ethernet frames with faked Ethernet headers where the packet type is not Ethernet Table 13 2 Packet types that can be captured Type Notes Ethernet Interface based capture contains the full Ethernet frame with any VLAN tag removed IP IP only currently not possible to capture at this level An Ethernet header is faked PPP PPP from the protocol word HDLC header is ignored if present An Ethernet header is faked and also a PP
195. oipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported RADIUS Attribute Value Pairs for L2TP operation Acct Status Type 40 3 Interim Update Acct Delay Time 41 Seconds since accounting data collected Acct Event 55 Data collected time unix timestamp Timestamp Acct Session Id 44 Unique ID for session Chargeable User 89 Graph name that applies sanitised to comply with CQM graph name rules Identity Connect Info 77 Text Tx speed Rx speed in use NAS Identifier 32 Configured hostname of FireBrick NAS IP Address 4 NAS IPv4 address if using IPv4 NAS IPv6 Address 95 NAS IPv6 address if using IPv6 NAS Port 5 L2TP session ID Acct Input Octets 42 Rx byte count Acct Input 52 Rx byte count high 4 bytes Gigawords Acct Output Octets 43 Tx byte count Acct Output 53 Tx byte count high 4 bytes Gigawords Acct Input Packets 47 Rx packet count Acct Output Packets 48 Tx packet count Tunnel Type 64 Present for relayed L2TP sessions L2TP Tunnel Medium Type 65 Present for relayed L2TP 1 IPv4 or 2 IPv6 Tunnel Client 66 Present for relayed L2TP text IPv4 or IPv6 address of our address on the Endpoint outbound tunnel Tunnel Server 67 Present for relayed L2TP text IPv4 or IPv6 address of the far end address of Endpoint the outbound tunnel Tunnel Assignment 82 Present for relayed L2TP text local L2TP tunnel ID ID Tunnel Client Auth 90 Prese
196. ols t A0 FireBrick is a registered trademark of FireBrick Ltd The first icon an up down arrow controls the banner size visibility and cycles through three settings full size banner reduced height banner no banner The next icon a left right arrow controls the menu strip position and cycles through three settings menu on the left menu on the right menu at the top The last icon the letter A toggles between using browser specified or user interface specified fonts Layout settings are stored in a cookie since cookies are stored on your computer and are associated with the DNS name or IP address used to browse to the FB6000 this means that settings that apply to a particular FB6000 will automatically be recalled next time you use the same computer browser to connect to that FB6000 It is also possible to configure an external CSS to use with the FireBrick web control pages which allows a great deal of control over the overall layout and appearance This can be usful for dealers or IT support companies to set up FireBricks in a style and branding of their choice 3 4 2 Config pages and the object hierarchy The structure of the config pages mirrors the object hierachy and therefore they are themselves naturally hierachical Your postition in the hierachy is illustrated in the breadcrumbs trail at the top of the page for example Firewall mapping rules rule set 1 of 3 filters rule 7 of 19 ICMP This s
197. on signficance Note This is an example note The significance is identified by the heading text and can be one of Tip general hints and tips for example to point out a useful feature related to the current discussion Note a specific but not critical point relating to the surrounding text Caution a potentially critical point that you should pay attention to failure to do so may result in loss of data security issues loss of network connectivity etc 1 2 6 Comments and feedback If you d like to make any comments on this Manual point out errors make suggestions for improvement or provide any other feedback we would be pleased to hear from you via e mail at docs firebrick co uk 1 3 Additional Resources 1 3 1 Technical Support Technical support is available in the first instance via the reseller from which you purchased your FireBrick FireBrick provide extensive training and support to resellers and you will find them experts in FireBrick products However before contacting them please ensure you have e upgraded your FB6000 to the latest version of software see Section 4 3 and e are using the latest revision of the manual applicable to that software version and e have attempted to answer your query using the material in this manual Many FireBrick resellers also offer general IT support including installation configuration maintenance and training You may be able to get your reseller to develop FB
198. on co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects Duplex On when full duplex blink when half duplex and collisions detected Collision Rx Blink when Rx activity Off Permanently off On Permanently on Cycling Cycling pattern H 3 18 LinkPower PHY power saving options Table H 82 LinkPower PHY power saving options Value Description none No power saving full Full power saving H 3 19 LinkFault Link fault type to send Table H 83 LinkFault Link fault type to send Value Description false No fault true Send fault off line Send offline fault 1G ane Send ANE fault 1G H 3 20 ramode IPv6 route announce level IPv6 route announcement mode and level Table H 84 ramode IPv6 route announce level Value Description false Do not announce low Announce as low priority medium Announce as medium priority high Announce as high priority true Announce as default medium priority H 3 21 dhcpv6control Control for RA and DHCPv6 bits Table H 85 dhcpv6control Control for RA and DHCPv6 bits Value Description false Don t set bit or answer on DHCPv6 true Set bit but do not answer on DHCPv6 dhcpv6 Set bit and do answer on DHCPv6 140 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration
199. on of the FB6000 6 1 1 Port groups As the FB6000 only has two phisical ports the port group configuration on the FB6000 has no options only two groups are possible each with the one physical interface Port group configuration is provided only for consistency and some degree of configuration file portability with the FB2500 and FB2700 products 6 1 2 Interfaces In the FB6000 an interface is a logical equivalent of a physical Ethernet interface adapter Each interface normally exists in a distinct broadcast domain and is associated with at most one port group Each port can operate simply as an interface with no VLANs or can have one or more tagged VLANs which are treated as separate logical interfaces Using VLAN tags and a VLAN capable switch you can effectively increase the number of physical ports If you are unfamiliar with VLANs or the concept of broadcast domains Appendix C contains a brief overview By combining the FB6000 with a VLAN capable switch using only a single physical connection between the switch and the FB6000 you can effectively expand the number of distinct physical interfaces with the upper limit on number being determined by switch capabilities or by inherent IEEE 802 1Q VLAN or FB6000 MAC address block size An example of such a configuration is a multi tenant serviced office environment where the FB6000 acts as an Internet access router for a number of tenants firewalling between tenant networks and mayb
200. onfig management syslog List of IP4Addr Syslog server time List of IP4Addr Our IP Time server 119 Configuration Objects Table H 31 dhcps Elements Element Type Instances Description send dhcp attr hex Optional unlimited Additional attributes to send hex send ip dhcp attr ip Optional unlimited Additional attributes to send IP send number dhcp attr number Optional unlimited Additional attributes to send numeric send string dhcp attr string Optional unlimited Additional attributes to send string H 2 24 dhcp attr hex DHCP server attributes hex Additional DHCP server attributes hex Table H 32 dhcp attr hex Attributes Attribute Type Default Description comment string Comment force boolean Send even if not requested 1d unsignedB yte Not optional Attribute type code name string Name value hexBinary Not optional Value vendor boolean Add as vendor specific option under option 43 H 2 25 dhcp attr string DHCP server attributes string Additional DHCP server attributes string Table H 33 dhcp attr string Attributes Attribute Type Default Description comment string Comment force boolean Send even if not requested 1d unsignedByte Not optional Attribute type code name string Name value string Not optional Value vendor boolean Add as vendor specific option under
201. option 43 H 2 26 dhcp attr number DHCP server attributes numeric Additional DHCP server attributes numeric Table H 34 dhcp attr number Attributes Attribute Type Default Description comment string Comment force boolean Send even if not requested 120 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects 1d unsignedB yte Not optional Attribute type code name string Name value unsignedInt Not optional Value vendor boolean Add as vendor specific option under option 43 H 2 27 dhcp attr ip DHCP server attributes IP Additional DHCP server attributes IP Table H 35 dhcp attr ip Attributes Attribute Type Default Description comment string Comment force boolean Send even if not requested id unsignedByte Not optional Attribute type code name string Name value IP4Addr Not optional Value vendor boolean Add as vendor specific option under option 43 H 2 28 pppoe PPPoE settings PPPoE endpoint settings Table H 36 pppoe Attributes Attribute Type Default Description ac name string Any a c name Access concentrator name accept dns boolean true Accept DNS servers specified by far end bgp bgpmode BGP announce mode for routes comment string Comment cug unsignedShort Cl
202. or off line seconds outside Colour transparent Colour for outer border rej Colour f8c Colour for off line seconds right unsignedByte 50 Pixels space right of main graph TX Colour 800 Colour for Rx traffic level secret Secret Secret for MD5 coded URLs sent Colour ff8 Colour for polled seconds share interface NMTOKEN Interface on which to broadcast data for shaper sharing share secret string Secret to validate shaper sharing subheading string Subheading of graph text Colour black Colour for text textl string Text line 1 text2 string Text line 2 text3 string Text line 3 text4 string Text line 4 timeformat string Y Yom d H Time format M S top unsignedByte 4 Pixels space at top of graph tx Colour 080 Colour for Tx traffic level H 2 39 I2tp L2TP settings L2TP settings for incoming L2TP connections Table H 51 12tp Attributes Attribute Type Default Description accounting interval duration 1 00 00 Periodic interim accounting interval send acct delay boolean Send Acct Delay as well as Event Timestamp on accounting Table H 52 l2tp Elements Element Type Instances Description incoming 12tp incoming Optional unlimited Incoming L2TP connections H 2 40 I2tp incoming L2TP settings for incoming L2TP connections L2TP tunnel settings for incoming L2TP connections Table H 53 I2tp incoming Attributes Attribute Type Default Descriptio
203. osed user group ID 1 32767 cug cug restrict boolean Closed user group restricted traffic only to from same CUG ID fast retry boolean Aggressive re connect graph token graphname Graph name ip over lcp boolean auto Sends all IP packets as LCP Icp rate unsignedByte 10 LCP interval seconds Icp timeout unsignedByte 61 LCP timeout seconds local IP4Addr Local IPv4 address localpref unsignedInt 4294967295 Localpref for route highest wins log NMTOKEN Not logging Log events log debug NMTOKEN Not logging Log debug log error NMTOKEN Not logging Log as events www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 121 Configuration Objects mode pppoe mode client PPPoE server client mode mtu unsignedShort 1492 MTU for link 576 2000 mtu name NMTOKEN Name password Secret User password pd interface List of NMTOKEN Auto Interfaces for IPv6 prefix delegation port NMTOKEN Physical port number or port group name profile NMTOKEN Profile name remote IP4Addr Remote IPv4 address routes List of 1PPrefix Default gateway Routes when link up service string Any service Service name source string Source of data used in automated config management speed unsignedInt Default egress rate limit b s table unsignedByte 0 99 Routing table number for payload routetable tcp mss fix boolean true Adjust MSS option in TCP SYN to f
204. ounced or not 66 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 BGP 15 2 10 Route feasibility testing The FB6000 has an aggressive route feasibility test that confirms not only routability of each next hop but also that it is answering ARP ND requests Whenever a next hop is infeasible then all routes using that next hop are removed When it becomes feasible the routes are re applied This goes beyond the normal BGP specification and minimises any risk of announcing a black hole route 15 2 11 Diagnostics The web control pages have diagnostics allowing routing to be show either for a specific target IP finding the most specific route which applies or for a specified prefix This lists the routes that exist in order and indicates if they are supressed e g route feasibility has removed the route There are command line operation to show routing as well It is also possible using the command line to confirm what routes are imported from or exported to any peer The diagnostics also allow ping and traceroute which can be useful to confirm correct routing 15 2 12 Router shutdown One router shutdown e g for software load all established BGP sessions have all announced routes cleanly withdrawn and the session closes cleanly However all received routes are retained in the routing table until the final shutdown and restart This minimises the impact of the shutdown when operating
205. ously access to the user interface normally requires the correct login credentials to be provided However if you have no need for your FB6000 to be accessed from arbitrary machines then you may wish to lock down access to the user interface to one or more client machines thus removing an attack vector Access can be restricted using allow and 1ocal only controls as with any service If this allows access then a user can try and login However access can also be restricted on a per user basis to IP addresses and using profiles which block the login even if the passord is correct Additionally access to the HTTP server can be completely restricted to all clients under the control of a profile This can be used for example to allow access only during certain time periods 12 3 1 1 Trusted addresses Trusted addresses are those from which additional access to certain functions is available They are specified by setting the t rusted attribute using address ranges or IP address group names This trusted access allows visibility of graphs without the need for a password and is mandatory for packet dump access 53 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Services 12 4 Telnet Server configuration The Telnet server allows standard telnet protocol clients available for most client platforms to connect to the FB6000 and access a command line interface CLI The CLI is docum
206. p Timestamp Acct Session Id 44 Unique ID for session NAS Identifier 32 Configured hostname of FireBrick NAS IP Address 4 NAS IPv4 address if using IPv4 NAS IPv6 Address 95 NAS IPv6 address if using IPv6 NAS Port 5 L2TP session ID Tunnel Type 64 Present for relayed L2TP sessions L2TP Tunnel Medium Type 65 Present for relayed L2TP 1 IPv4 or 2 IPv6 Tunnel Client 66 Present for relayed L2TP text IPv4 or IPv6 address of our address on the Endpoint outbound tunnel Tunnel Server 67 Present for relayed L2TP text IPv4 or IPv6 address of the far end address of Endpoint the outbound tunnel Tunnel Assignment 82 Present for relayed L2TP text local L2TP tunnel ID ID Tunnel Client Auth 90 Present for relayed L2TP local end hostname quoted by outgoing tunnel ID Tunnel Server Auth 91 Present for relayed L2TP far end hostname quoted by outgoing tunnel ID Note that most parameters are not included in interim and stop accounting records The acct session id should be used by accounting servers to correlate interim and stop records with the start record The graph name could be used but is only available where there is a graph If too many different graphs then that is not present Some exceptions apply as they can be changed by a change of authorisation RADIUS request such as Connect Info E 4 Accounting Interim Table E 5 Accounting Interim AVP No Usage 88 www voipon co uk sales v
207. p lt FB6000 IP address or DNS name gt pcap parameter_name value amp parameter_name value The URL may include as many parameter name and value pairs as you need to completely specify the dump parameters Packet capturing stops if the output stream HTTP transfer fails This is useful if you are unable to determine a suitable timeout period and would like to run an ongoing capture which you stop manually This is achieved by specifying a very long duration and then interrupting execution of the HTTP client using Ctrl C or similar Only one capture can operate at a time The HTTP access fails if no valid interfaces or sessions etc are specified or if a capturing is currently running 13 2 7 1 Example using curl and tcpdump An example of a simple real time dump and analysis run on a Linux box is shown below eur silent no buffer user name pass http 1 2 3 4 pcap interface LAN amp timeout 300 amp snaplen 1500 ere Alea Areas o e mv Note Linebreaks are shown in the example for clarity only they must not be entered on the command line In this example we have used username name and password pass to log in to a FireBrick on address 1 2 3 4 obviously you would change the IP address or host name and credentials to something suitable for your FB6000 We have asked for a dump of the interface named LAN with a 5 minute timeout and capturing 1500 byte packets We have then fed the output in real time
208. paves 94 Fil General commands 3 2 csr gasetanesh sed ossntedevsnseuness duwodsyeth een ersnsSedeeonvernectdenalavess ARNE E 94 Boll Trace off ai cos A A aS See ee 94 UA Trace oi OS 94 EJ UPME A e adic edits dd te 94 Ful AS General Status perse eea e R E EE E E R EEN EENE EEAS 94 F deed Memory USE aia Do ias 94 E 1 6 Process task Usage instando itinere da iones ines 94 FELEO A A A di 94 O SOUL a sne reas Seesetavede np seme ces vnndeucgh owes va Seedels ee E os wed tess wetasste senaren redness 95 F 1 9 See XML CON BUTONi as 95 E 1 10 Load XME Configuration sortedosorice cis ge vedaoe pintada door E EE 95 Be Show profile status isere AT E ted IO dl eee 95 F 1 12 Enable profile control switch isso ienser saspi pna esea e s E EEES 95 F 1 13 Disable profile control switch coooconccnnccnnccnnccnncnnncnnncnnccnnconnccnncconconnconacinncos 95 F114 Show RADIUS servers moere nae tot E E Ea hes eaae 95 F 1 15 Show DNS TesOl VelSid it ia SS 95 F 2 Networking Commands possesens porcion gh ninia ro E EE EENS ones setae en oi 96 EZ SUD Sn ISO UN A Wu eRe aria 96 A A yobs cad dey nn den ssdes sera dass guest on pg oetdaa eaa tea dee tace eeutanadts 96 F 2 3 Show a route from the routing table 2 0 0 0 cece cee ce ee ce eeceeeceeeeneeea essa sean eeaes 96 viii www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6202 User Manual FZ A O ten aed eb Sav ehete comm ce getter seereti
209. permanent record This is done automatically for some system events and when booting You can specify the number of bytes of recent log to show 99 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix G Constant Quality Monitoring technical details The FireBrick provides constant quality monitoring The main purpose of this is to provide a graphical representation of the performance of an interface or traffic shaper typically used for broadband lines on L2TP e 100 second interval statistics available graphically as png and in text as csv covering at least the last 25 hours one day e Loss latency stats where available e g LCP echos on L2TP broadband lines including minimum average and maximum latency for the 100 second sample and percentage packet loss e Throughput stats where available e g interfaces shapers L2TP broadband lines including average tx and rx rate for 100 second sample Graphs can be loss latency or throughput of both A ping only system would only have loss latency An L2TP broadband line has both An interface or shaper normally has only throughput data G 1 Broadband back haul providers When using the FB6000 as an LNS the CQM graphs are invaluable for diagnosing line faults They are useful to the ISP but also useful to the back haul provider which is often a separate company e g BT or Be We recommend that you consider providing access to graphs
210. phs menu This will display all the graphs that are currently configured itis not currently possible to show a single graph within the web User Interface environment It is possible to access the graph data in many ways using the URL to control what information is shown labels and colours and also allowing graphs to be archived See Appendix G for more details Note You may find images shown for graph names that are no longer specified anywhere in the configuration Over time these graphs will disappear automatically Alternatively the underlying graph data is available in XML format again via the FB6000 s built in HTTP server The XML version of the data can be viewed in the web User Interface by clicking the XML item in the Graphs menu and then clicking on the name of the graph you re interested in Both directions of traffic flow are recorded and are colour coded on the PNG image generated by the FB6000 The directions are labelled tx and rx but the exact meaning of these will depend on what type of object the graph was referenced from for example on a graph for an interface tx will be traffic leaving the FB6000 and rx will be traffic arriving at the FB6000 Each data point on a graph corresponds to a 100 second interval where a data point is showing a traffic rate the rate is an average over that interval For each named graph the FB6000 stores data for the last 24 hours Note Specifying a graph does not i
211. plete then IP packets can be passed using PPP As networks became more complex a separation of the Access Concentrator in to a L2TP Access Concentrator LAC which has the modems and the L2TP Network Server LNS was sensible The LAC accepted the call on the modem and established a Layer 2 Tunnelling Protocol L2TP connection to the LNS This allowed PPP to be passed from the end user computer to the LNS The LNS is responsible for the PPP negotiations and passing IP packets to and from the Internet 16 1 3 L2TP L2TP provides a simple means for PPP packets to be passed over an IP network It uses a small header and UDP to pass packets between the LAC and LNS Some times it because sensible for the LAC to decide to which LNS it should connect by some means A good example is where a carrier with LACs will route connections to wholesale customers LNSs This would allow ISPs to make use of providers that have modems This is actually the way it works on broadband access Networks For example BT 02 and TalkTalk have LACs in their network which pass L2TP to their ISP customers To achieve this the LAC does some of the initial PPP negotiations It handles the LCP and starts the authentication It then establishes the L2TP connection passing these proxy details on to the LNS The choice of LNS is done using the username which is why it has to start the authentication Typically a realm is included in the user name using an and a string at the e
212. profiles and test below 14 3 Using a virtual router A virtual router is used by another device simply by specifying the virtual router s virtual IP address as the gateway in a route rather than using a router s real IP address From an IP point of view the upstream device is completely unaware that the IP address is associated with a group of physical devices and will forward traffic to the virtual IP address as required exactly as it would with a single physical gateway 14 4 VRRP versions 14 4 1 VRRP version 2 VRRP version 2 works with IPv4 addresses only 1 e does not support IPv6 and whole second advertisement intervals only The normal interval is one second since the timeout is three times that this means the fastest a backup can take over is just over 3 seconds You should configure all devices in a VRRP group with the same settings apart from their priority 61 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 VRRP 14 4 2 VRRP version 3 VRRP version 3 works in much the same way but allows the advertisement interval to be any multiple of 10ms 1 100th of a second The default interval is still 1 second but it can now be set much faster so although the timeout is still 3 times the interval this means the backup could take over in as little as 30ms VRRP3 also works with IPv6 Whilst IPv4 and IPv6 VRRP are completely independent you can configure both at once in a sin
213. providing the unit has Internet access This Internet based upgrade process can be initiated manually refer to Section 4 3 3 1 or the FB6000 can download and install new software automatically without user intervention If the unit you want to upgrade does not have Internet access then new software can be uploaded to the unit via a web browser instead see Section 4 3 4 Caution Software upgrades are best done using the Internet based upgrade process if possible this ensures the changes introduced by Breakpoint releases are automatically accounted for see Section 4 3 1 1 Software upgrades will trigger an automatic reboot of your FB6000 this will cause an outage in routing and can cause connections that are using NAT to drop However the FB6000 reboots very quickly and in many cases users will be generally unaware of the event You can also use a profile to restrict when software upgrades may occur for example you could ensure they are always done over night The reboot will close all L2TP connections first The reboot will close all BGP sessions first For this reason on the FB6000 factory reset config does not have automatic s w upgrades enabled 4 3 1 Software release types There are three types of software release factory beta and alpha For full details on the differences between these software releases refer to the FB6000 software downloads website http www firebrick co uk 23 www voipon co uk sales voipo
214. rameters are supported If sent then they are ignored Parameters are left unchanged if not specified e If any route entries IPv4 or IPv6 are present then the existing routing apart from the PPP endpoint address are all removed and replaced with what has been sent To clear all routes send a framed route with a blank string The Framed IP Addreess cannot be changed 90 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported RADIUS Attribute Value Pairs for L2TP operation e To clear the session timeout send a value of 0 e To clear outbound shaping send connect speed of 0 No other parameters are supported and if sent then they are ignored E 8 Filter ID The Filter ID can be set in authentication response and change of authorisation There can be many records Each can have many filters Each filter is of the form of a letter possibly followed by number digits The accounting start lists relevant filters that have been set each in a separate filter id AVP Unknown filters are ignored Table E 9 Filter ID Filter meaning Tn Set routing table for payload traffic This can be used for private routing and for walled garden credit control An Specify this connection is a member of a closed user group n 1 32767 but has normal IP access as well This connection is not filtered by traffic can go to from connections that are filtered in the same CUG Rn Specify this
215. rectly implementing network protocols if they are then you should be able to determine whether the FB6000 is responding appropriately The packet dumping facility may also be of use to you to debug traffic and thus specific network protocols between two hosts that the brick is routing traffic between This feature is provided via the FB6000 s HTTP server and provides a download of a pcap format file old format suitable for use with t cpdump or Wireshark A packet dump can be performed by either of these methods e via the user interface using a web page form to setup the dump once the capture data has been downloaded it can be analysed using t codump or Wireshark e using an HTTP client on another machine typically a command line client utility such as cur1 The output is streamed so that when used with curl and tcpdump you can monitor traffic in real time Limited filtering is provided by the FB6000 so you will normally apply any additional filtering you need via tcpdump 13 2 1 Dump parameters Table 13 1 lists the parameters you can specify to control what gets dumped The Parameter name column shows the exact parameter name to specify when constructing a URL to use with an HTTP client The Web form field column shows the label of the equivalent field on the user interface form Table 13 1 Packet dump parameters Parameter name Web form field Function interface Interface One or more interfaces as the name of t
216. request secret Secret Shared secret for RADIUS requests needed for replies source string Source of data used in automated config management tagged boolean Tag all attributes that can be target hostname string Hostname for L2TP connection target ip target secret List of TPNameAddr Secret Target IP s or hostname for primary L2TP connection Shared secret for L2TP connection test List of IPAddr List of IPs that must have routing for this target to be valid deprecated username List of string tunnel assignment string Tunnel Assignment ID to send id tunnel client return boolean Return tunnel client as radius IP One or more patterns to match username H 2 17 radius server RADIUS server settings Server settings for outgoing RADIUS Table H 23 radius server Attributes Attribute Type Default Description comment string Comment host List of IPNameAddr Not optional One or more hostname IPs of RADIUS servers max timeout duration 20 Maximum final timeout min timeout duration 5 Minimum final timeout name string Name port unsignedShort From services radius UDP port settings profile NMTOKEN Profile name queue unsignedInt Concurrent requests over all of these servers per type scale timeout unsignedByte 2 Timeout scaling factor secret Secret Not optional Shared secret for RADIUS requests sour
217. resolvers 12 5 1 Blocking DNS names You can configure names such that the FB6000 issues an NXDOMAIN response making it appear that the domain does not exist This can be done using a wildcard e g you could block xxx Tip You can also restrict responses to certain IP addresses on your LAN making it that some devices get different responses You can also control when responses are given using a profile e g time of day 12 5 2 Local DNS responses Instead of blocking names you can also make some names return pre defined responses This is usually only used for special cases and there is a default for my firebrick co uk which returns the FireBrick s own IP Faking DNS responses will not always work and new security measures such as DNSSEC will mean these faked responses will not be accepted 54 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Services 12 5 3 Auto DHCP DNS The FB6000 can also look for specific matching names and IP addresses for forward and reverse DNS that match machines on your LAN This is done by telling the FireBrick the domain for your local network Any name that is within that domain which matches a client name of a DHCP allocation that the FireBrick has made will return the IP address assigned by DHCP This is applied in reverse for reverse DNS mapping an IP address back to a name You can enable this using the auto dhcg attribute 12 6 NTP config
218. response E 2 1 1 Prefix Delegation The RADIUS authentication response can include Delegated IPv6 Prefix Framed IPv6 Prefix and Framed IPv6 Route in order to route native IPv6 prefixes to the line If there are any native IPv6 routes or the Framed IPv6 Interface attribute was specified then IPV6CP negotiation is started Framed IPv6 Route can also be used to added IPv4 tunneled routes to the line The FE80 10 link local address negotiated with IPV6CP is not added to the routing for the line The client can send a Router solicitation to which the FireBrick will reply advising to use DHCPv6 for addressing Once a router solicitation is sent periodic Router Advertisements will then be sent on the connection by the Firebrick The client can use DHCPv6 to request an IA_NA 128 link address IA_TA 128 temp link address IA_PD Prefic delegation and DNS servers Prefixes are delegated based on the order in the DHCPv6 request and the order of Delegated IPv6 Prefix Framed IPv6 Prefix and then Framed IPv6 Route with multiple such entries in the order that they appeared in the RADIUS response Such prefixes are not split up if a smaller prefix is requested but the first part of a prefix is delegated E 2 2 Rejected authentication Table E 3 Access Reject AVP No Usage Reply Message 18 Reply message sent on PPP authentication response Note that an authentication reject will normally cause the reply message to
219. rieved from the FireBrick or uploaded to the FireBrick using HTTP transfers done via tools such as curl Using these methods configuration of the FB6000 can be integrated with existing administrative systems Note Linebreaks are shown in the examples below for clarity only they must not be entered on the command line 3 6 1 Download To download the configuration from the FB6000 you need to perform an HTTP GET of the following URL http lt FB6000 IP address or DNS name gt config config An example of doing this using cur 1 run on a Linux box is shown below curl http lt FB6000 IP address or DNS name gt config config user username password output filename Replace username and password with appropriate credentials The XML configuration file will be stored in the file specified by filename you can choose any file extension you wish or none at all but we suggest that you use xm1 for consistency with the file extension used when saving a configuration via the User Interface see Section 3 4 4 3 6 2 Upload To upload the configuration to the FB6000 you need to send the configuration XML file as if posted by a web form using encoding MIME type multi part form data An example of doing this using cur 1 run on a Linux box is shown below curl http lt FB6000 IP address or DNS name gt config config user username password form config ft filename 19 www voipo
220. ring the first couple of hours of the day you can get yesterday in full The syntax is that of a date first in the form YYYY MM DD e g http host port cqm Y Y Y Y MM DD circuit png G 2 3 Authenticated access Authenticate access requires a prefix of a hex shal string e g http host port cqm longhexsha1 circuit png or http host port cqm longhexsha1 Y Y YY MM DD circuit png The SHA 1 is 40 character hex of the SHA 1 hash made from the graph name the date and the http secret The date is in the form YY Y Y MM DD and is today s date for undated access based on local time This means a graph URL can be composed that is valid for a specific graph name for a specific day Note that an MDS can also be used instead but the SHA 1 is the preferred method G 3 Graph display options The graphs can have a number of options which define the colours text and layout These are defined as http form get attributes on the URL e g http host port cqm circuit png H a heading Note that they can also be included in the path before the graph name e g http host port cqm H a heading circuit png in which case they can be separated by rather than amp The attributes are processed in order G 3 1 Data points The data point controls can be included as either fieldname or fieldname colour To make a valid URL either escape the prefix or omit it If any of these are included then only those that are included are shown If just fi
221. roadcast domains with shared physical switch hardware The switch es used must support VLANs and this is now common in cost effective commodity Ethernet switches Inter working of VLAN switch hardware requires that all hardware support the same VLAN standard the dominant standard being IEEE 802 1Q Such switches can seggregate physical switch ports into user defined groups with one VLAN associated with each group Switching of traffic only occurs between the physical ports in a group thus isolating each group from the others Where more than one switch is used with an uplink connection between switches VLAN tagging is used to multiplex packets from different VLANs across these single physical connections A TEEE 802 1Q VLAN tag is a small header prefixed to the normal Ethernet packet payload includes a 12 bit number range 1 4095 that identifies the tagged packet as belonging to a specific VLAN When a tagged packet arrives at another switch the tag specifies which VLAN it is in and switching to the appropriate physical port s occurs In addition to VLAN support in switches some end devices incorporate VLAN support allowing them to send and receive tagged packets from VLAN switch infrastructure and use the VLAN ID to map packets to multiple logical interfaces whilst only using a single physical interface Such VLAN support is typically present in devices that are able to be multi homed have more than one IP interface such as route
222. ron command The FB6000 also has a serial console to which console log entries are sent if logged in 5 2 Enabling logging Event logging is enabled by setting one of the attributes shown in Table 5 1 on the appropriate object s in the configuration which depends on what event s you are interested in The attribute value specifies the name of the log target to send the event message to The events that cause a log entry will naturally depend on the object on which you enable logging Some objects have additional attributes such as log error for unusual events and 1og debug for extra detail Table 5 1 Logging attributes Attribute Event types log This is normal events Note that if 1og error is not set then this includes errors log error This is when things happen that should not It could be something as simple as bad login on telnet Note that if 1og error is not set but 1og is set then errors are logged to the log target by default log debug This is extra detail and is normally only used when diagnosing a problem Debug logging can be a lot of information for example in some cases whole packets are logged e g PPP It is generally best only to use debug logging when needed 5 3 Logging to external destinations Entries in the buffer can also be sent on to external destinations such as via email or syslog Support for triggering SNMP traps may be provided in a future software release You can
223. rridden when a graph is collected so these define the defaults in many cases Table H 50 cqm Attributes Attribute Type Default Description ave Colour 08f Colour for average latency axis Colour black Axis colour background Colour white Background colour bottom unsignedByte 11 Pixels space at bottom of graph dateformat string Y Yom od Date format dayformat string Joa Day format 127 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects fail Colour red Colour for failed dropped seconds fail level unsignedInt 1 Fail level not expected on low usage fail levell unsignedByte 3 Loss level 1 fail level2 unsignedByte 50 Loss level 2 fail score unsignedByte 200 Score for fail and low usage fail scorel unsignedB yte 100 Score for on above level 1 fail score2 unsignedByte 200 Score for on above level 2 fail usage unsignedInt 128000 Usage below which fail is not expected fblogo Colour bd 1220 Colour for logo graticule Colour grey Graticule colour heading string Heading of graph hourformat string H Hour format key unsignedByte 90 Pixels space for key label ave string Av Label for average latency label damp string Damp Label for shaper damping label fail string Fail Label for seconds failed label latency string Latency Label for lat
224. rs and firewalls and general purpose network capable operating systems such as Linux The FB6000 supports IEEE 802 1Q VLANs and will accept and send packets with 802 1Q VLAN tags It can therefore work with any Ethernet switch or other equipment that also supports 802 1Q VLANs and therefore allows multiple logical interfaces to be implemented on a single physical port VLAN tagged switching is now also used in Wide Area Layer 2 Ethernet networks where a Layer 2 circuit is provided by a carrier over shared physical infrastructure The conventional concept of a LAN occupying a small geographic area is thus no longer necessarily true 79 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix D Supported L2TP Attribute Value Pairs This appendix details the L2TP protocol messages supported and the attribute value pairs AVPs which are sent and expected for each message D 1 Start Control Connection Request Table D 1 SCCRQ AVP No Incoming Outgoing Message Type 0 Value 1 Value 1 Protocol Version 2 Mandatory value 1 expected Value 1 Framing Capabilities 3 Ignored Value 3 Bearer Capabilities 4 Ignored Not sent Tie Breaker 5 Ignored as FireBrick only accepts Not sent connections for inbound calls Firmware Revision 6 Ignored FireBrick s w version string Host Name 7 Used to select which incoming L2TP As per config RADIUS request configuration applies
225. rvices are various generic services that the system provides and allows access controls and settings for these to be specified The service is only active if the corresponding element is included in services otherwise it is disabled Table H 11 services Elements Element Type Instances Description dns dns service Optional DNS service settings http http service Optional HTTP server settings ntp ntp service Optional NTP client settings server not implemented yet radius radius service Optional RADIUS server proxy settings snmp snmp service Optional SNMP server settings telnet telnet service Optional Telnet server settings H 2 8 snmp service SNMP service settings The SNMP service has general service settings and also specific attributes for SNMP such as community Table H 12 snmp service Attributes Attribute Type Default Description allow List of Allow from List of IP ranges from which service can be IPNameRange anywhere accessed comment string Comment community string public Community string local only boolean false Restrict access to locally connected Ethernet subnets only log NMTOKEN Not logging Log events log debug NMTOKEN Not logging Log debug log error NMTOKEN Log as event Log errors port unsignedShort 161 Service port profile NMTOKEN Profile name source string Source of data used in automated config management table unsigne
226. s a bad content is propagated to multiple routers on the internet and they will drop their session This can cause a major problem in the internet To work around this have by default ignore bad optional partial set to true The effect is that if a path attribute we understand is wrong and it is optional and trhe router that sent it to us did not understand or check it partial bit is set we 1gnore the specific route rather than dropping the whole BGP session 15 2 8 lt network gt element The network element defines a prefix that is to be announced by BGP but has no internal on routing Table 15 3 Network attributes Attribute Meaning ip One or more prefixes to be announced as path Optional AS path to be used as if we had received this prefix from another AS with this path localpref Applicable localpref to announce bgp The bgp mode one of the well known community tags or true the default which is announced by BGP with no extra tags 15 2 9 lt route gt lt subnet gt and other elements Subnet and route elements used for normal set up of internal routing can be announced by BGP using the bgp attribute with the same values as the well known community tags please true meaning simply announce with no tags and false meaning the same as no advertise Many other objects in the configuration which can cause routes to be inserted have a bgp attribute which can be set to control whether the routes are ann
227. s possible to configure L2TP so that RADIUS accounting must respond and if not then the sessions are disconnected E 1 Authentication request Table E 1 Access request AVP No Usage Message 80 Message signature as per RFC2869 Authenticator User Name 1 Username from authentication PAP CHAP or proxy authentication received on L2TP Called Station Id 30 Called number as received on L2TP Calling Station Id 31 Calling number as received on L2TP Acct Session Id 44 Unique ID for session as used on all following accounting records NAS Identifier 32 Configured hostname of FireBrick NAS IP Address 4 NAS IPv4 address if using IPv4 NAS IPv6 Address 95 NAS IPv6 address if using IPv6 NAS Port 5 L2TP session ID Service Type 6 Framed Framed Protocol 7 PPP CHAP Password 3 CHAP ID and response CHAP Challenge 60 CHAP challenge only present if not the same as RADIUS authenticator Framed MTU 12 MTU requested by PPP if one was requested even if 1500 Connect Info 77 Text Tx speed Rx speed from L2TP connection if known Tunnel Client 66 Indicates the L2TP tunnel configured name attribute allowing connections via Endpoint different L2TP incoming configurations to be identified Note that the NAS IP Address is normally the local end of the L2TP connection for the incoming connection However there is a configuration option to pass the remote end of the L2TP as th
228. sed for more than the data retention time are discarded automatically 104 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix H Configuration Objects This appendix defines the object definitions used in the FireBrick FB6202 L2TP configuration Copyright 2008 13 FireBrick Ltd H 1 Top level H 1 1 config Top level config The top level config element contains all of the FireBrick configuration data Table H 1 config Attributes Attribute Type Default Description patch integer Internal use for s w updates that change config syntax timestamp dateTime Config store time set automatically when config is saved Table H 2 config Elements Element Type Instances Description bgp bgp Optional up to 100 BGP config blackhole blackhole Optional unlimited Black hole dropped packets networks cqm cqm Optional Constant Quality Monitoring config ethernet ethernet Optional unlimited Ethernet port settings interface interface Optional up to 8192 Ethernet interface port group vlan and subnets ip group ip group Optional unlimited Named IP groups 12tp 12tp Optional L2TP settings log log Optional up to 50 Log target controls loopback loopback Optional unlimited Extra local addresses network network Optional unlimited Locally originated networks nowhere blackhole Optional unlimited Dead e
229. server Telnet server provides an administration command line interface accessed over a network connection HTTP server serves the web user interface files to a user s browser on a client machine DNS relays DNS requests from either the FB6000 itself or client machines to one or more DNS resolvers RADIUS Configuration of RADIUS service for platform RADIUS for L2TP Configuration of RADIUS client accessing external RADIUS servers Services are configured under the Setup category under the heading General system services where there 1s a single services object XML element lt services gt The services object doesn t have any attributes itself all configuration is done via child objects one per service If a service object is not present the service is disabled Clicking on the Edit link next to the services object will take you to the lists of child objects Where a service object is not present the table in that section will contain an Add link A maximum of one instance of each service object type can be present 12 1 Protecting the FB6000 The FB6000 does not have a firewall as such However the design of the FB6000 is that it should be able to protect itself sensibly without the need for a separate firewall Each service has specific access control settings and these default to not allowing external access i e traffic not from locally Ethernet connected devices You can also lock down access to a specific routi
230. ses odon 4 1 3 Additional Resources olores ire be cneds bac EE EET E EE EEEE EENS 4 13 1 Technical Support osisssa a a athate sss pit E E me batiante dotted bates 4 1 3 2 IRC Chantel osc eed ec ohio RE RAE A A EA es 4 1 3 3 Application Notes sssri copsesdseesccugssocus des veses EE ei EET cease recuse RES RESETE SERS 4 1 3 4 White Papers onecie it EA ere EE AEE EEE ETES EES EEEE EE SEES 5 1 3 3 Traine COUrSeS costra ot E E E E T EA E E E 5 25 Getting NN 6 SSA O 6 2 2 Accessing the web based user interface cooocooccnnccnnccnncnnoconccnnccnnconnconncnnnconnconncnnnrnnnnnnnonnss 6 2 2 t Adda MEW USER state datos abate apra rape a a crespo DRAE 7 3s Configuration or A Eee see eee Ei 9 3 1 The Object Hierarchy ctas rin rre tess od sedanens 9 3 2 The Object Model soci isis bradicardia des 9 3 2 1 Formal definition of the object model ooooccnoccnnconccnnccnnccnnncnnconoconocnnccnnccnnccnnioos 10 3 2 2 RN 10 3 3 Configuration Methods piiris siriarren is enana EPE EERE SISE PTE E iones ie 10 3 4 Web User Interface OvervieW i6 25sseeccebsse eee cctp eves cos bec end EEE EEEIEE EEES 10 3 4 1 User Intertace layout adsl 11 3 4 1 1 Customising the layout ooocoooccnccnccnnncnncconccnnconnconnccnnconnconnconncnnncnnncnnronass 11 3 4 2 Config pages and the object hierarchy ooocoooccnocnnccnnccnnocnncnnncnnnonnconnconnccnnccnnccnnoos 12 3 4 2 1 Configuration categories cece cece ence cece ceca cena ceneeneeee
231. sis secs dario sora vinieran Ear aria s 6 2 2 IP addresses to access the FireBrick sissies c esoe ire e EESE EEE EEE EEE 6 2 3 IP addresses to access the FireBrick vissi sssrnas iir sissesse airas enes s sa riep E PESA EN SAEPE EE ITET 6 3 1 Special character Sequences ioiii iers tnus sers voce ces reader Edna ESEE EEE RE EEEE ERANTS 17 AV User losin JeyelS ereit otn a E toi 21 4 2 Configuration access levels i sc ccesece cose eo e EE E S O S E t 21 4 3 General administrative details attributes ocoooccnnconoconccnnocnncnnncnnnronocnnconnconnccnnocnnccnncnnncnnncnnnes 22 4 4 Attributes controlling auto upgrades ocoooccoccnnccnncnnccnnccnnccnnccnnccnnocnncrnncnnncnnncnnnnnnrnncnncinnrinninnn 25 4 5 Power LED status Indications comiernrionia soportes va die ea E E a E T e E AE a E 26 Dl Logging attributes ioii arose o A AD TEES G 29 3 2 System Ev nt Logging attributes cirri osi ssorodpa tines ss suiker esep EEPE O EESTE ados ooo i EMERE E EEP cad 32 7 1 Example Toute targets csser oeei eitean EE as adas oie SEE EES EES EEE REE SEESE 39 12 1 List of system Services rinitis i e a E EEA E A E E E A REE 52 12 2 List Of system SCLVICES ojensi gules EES E EIEE EEEE EEVEE GEEA EEEE E EOE RSE 53 13 1 Packet dump parameters mister irisa sae seisa rn oysa s E Ee tae Seeegessste ssh vecteoss sures Ron EE EEEE 57 13 2 Packet types that can be captured ooooocccoccnnconnconnconnconnconncononononnnronnrnnnrnnconnccnnccnnconncnnncnnnc
232. speed of specific traffic flows through the FB6000 The FB6000 also provides graphing functionality allowing specific traffic flows to be plotted on a graph image PNG format that the FB6000 generates Within the FB6000 traffic shaping and graphing are closely associated and this is reflected in how you configure traffic shaping in order to be able to perform traffic shaping you must first graph the traffic flow 9 1 Graphs and Shapers 9 1 1 Graphs Several objects in the FB6000 s configuration allow you to specify the name of a graph by setting the value of the graph attribute This causes the traffic flow that is associated with that object a firewall rule an interface or whatever the attribute is attached to to be recorded on a graph with the specified name For connections that have a defined state such as a PPP link the graph will also show the link state history Other information such as packet loss and latency may also be displayed depending on whether it can be provided by the type of object you are graphing For example the XML snippet below shows the graph attribute being set on an interface As soon as you have set a graph attribute and saved the configuration a new graph with the specified name will be created lt interface name LAN port LAN graph LAN gt The graph is viewable directly as a PNG image from the FB6000 via the web User Interface to view a graph click the PNG item in the Gra
233. st be done via the buttons provided on the page Prev Next and Up Navigating away from an object using the supported navigation controls doesn t cause any modifications to that object to be lost even if the configuration has not yet been saved back to the FB6000 All changes are initially held in memory in the web browser itself and are committed back to the FireBrick only when you press the Save button The navigation button area shown in Figure 3 8 also includes three other buttons e New creates a new instance of the object type being edited the new object is inserted after the current one this is equivalent to using the Add link one level up in the hierarchy e Erase deletes the object being edited note that the object will not actually be erased until the configuration is saved e Help browses to the online reference material as desribed in Section 3 2 1 for the object type being edited 15 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Caution If you Add a new object but don t fill in any parameter values the object will remain in existence should you navigate away You should be careful that you don t inadvertently add incompletely setup objects this way as they may affect operation of the FireBrick possibly with a detrimental effect If you have added an object perhaps for the purposes of looking at what attributes can be set on it rem
234. st of AS numbers unsignedIntList unsignedIntList List of integers unsignedInt communitylist List of BGP communities Community filterlist List of IP Prefix filters IPFilter iprangelist List of IPranges IPRange userlist List of user names username prefix4list List of IPv4 Prefixes 1P4Prefix portlist List of protocol port ranges PortRange protolist List of IP protocols unsignedByte routetableset Set of routetables routetable vlan nz VLAN ID 1 4095 unsignedShort dates Set of dates datenum tun id Local tunnel ID 1 20000 unsignedShort ses id Local session ID 1 65535 unsignedShort 143 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Index B BGP overview 63 Boot process 26 Breadcrumbs 12 C Configuration backing up and restoring 16 categories user interface 12 methods 10 overview 9 overview of using XML 16 transferring using HTTP client 19 using web user interface 10 Configuration Basic data types 142 Configuration Data types 135 Configuration Field definitions 105 D DHCP configuring server 35 configuring subnet with DHCP client 34 Diagnostics Access check 56 Packet dumping 57 DNS configuring resolver s to use 54 E Ethernet Ports configuring LED indication modes 36 configuring speed and or duplex modes 36 relationship with interfaces 33 sequenced flashing of LEDs 26 Event logging external loggin
235. suitable bridging modem Dlink 320B Note Testing using a Zyxel P660R in bridge mode confirms that BT 21CN ADSL lines will negotiate 1500 byte MTU but it seems the Zyxel will not bridge more than 1496 bytes of PPP payload If you select more than 1492 MTU and have problems it could be that some device connecting you to the access concentrator cannot handle the larger packets such as a bridge or a switch For this reason the default MTU is 1492 10 2 2 2 Service and ac name The PPPoE protocol allows multiple services to be offered and the service setting can be used to select which 1s available This is rarely needed and should be ignored unless you know what you are doing If specified even as an empty string then only matching services will be selected The name specified via the ac name attribute is the name of the PPPoE endpoint access controller In some cases there may be a choice of endpoints and setting this causes one to be selected by name Again this is rarely needed and if specified will only match the name you specify On Be O2 PPPoE lines for example you could select a specific LAC by name if you wanted to 10 2 2 3 Logging The PPP connection status and PPP negotiation can be logged by setting the 1og attribute to a valid log target The 10g debug will log the whole PPP negotiation which is particularly useful when debugging connection problems 10 2 2 4 Speed and graphs As discussed in Chapter 9 graphs al
236. t ICMP echo request packets are sent and replies are expected If replies are not being received the test fails Profiles can be logically combined using familiar boolean terminology i e AND OR and NOT allowing for some complex profile logic to be defined that determines a final profile state from several conditions By combining profiles with the FB6000 s event logging facilities they can also be used for automated monitoring and reporting purposes where profile state changes can be e mailed direct from the FB6000 For example a profile using a Ping test can be used to alert you via e mail when a destination is unreachable The current state of all the profiles configured on your FB6000 can be seen by choosing the Profiles item in the Status menu Tip You can also define dummy profiles that are permanantly Active or Inactive which can be useful if you wish to temporarily disable some functionality without deleting configuration object s For example you can force an FB105 tunnel to be Down preventing traffic from being routed through it Refer to Section 8 2 4 for details 8 2 Creating editing profiles In the web user interface profiles are created and edited by clicking on the Profiles category icon A profile is defined by a profile top level object 8 2 1 Timing control The following timing control parameters apply e interval the interval between tests being performed e timeout the duration that the ov
237. t character e a character e the element name e a gt character 16 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration If an element needs no content it can be represented with a more compact self closing tag A self closing tag 1s the same as a start tag but ends with gt and then has no content or end tag Since the lt gt and characters have special meaning there are special escape character sequences starting with the ampersand character that are used to represent these characters They are Table 3 1 Special character sequences Sequence Character represented amp 1lt lt amp gt gt amp quot samp amp Note that since the ampersand character has special meaning it too has an escape character sequence Attributes are written in the form name value or name value Multiple attributes are separated by white space spaces and line breaks Generally the content of an element can be other child elements or text However the FB6000 doesn t use text content in elements all configuration data is specified via attributes Therefore you will see that elements only contain one or more child elements or no content at all Whilst there is generally not any text between the tags white space is normally used to make the layout clear 3 5 2 The root element lt config gt At the top level an XML file normally onl
238. t of recursive DNS servers in route announcements ra managed dhcpv6control RA M managed flag ra max unsignedShort 600 Max RA send interval 4 1800 ra max ra min unsignedShort Min RA send interval 3 1350 ra min ra mtu unsignedShort As subnet MTU to use on RA ra other dhcpv6control RA O other flag ra profile NMTOKEN Profile if inactive then forces low priority RA source string Source of data used in automated config management test IPAddr Test link state using ARP ND for this IP ttl unsignedByte 64 TTL for originating traffic via subnet H 2 22 vrrp VRRP settings VRRP settings provide virtual router redundancy for the FireBrick Profile inactive does not disable vrrp but forces vrrp low priority Table H 29 vrrp Attributes Attribute Type Default Description answer ping boolean true Whether to answer PING to VRRP IPs when master comment string Comment delay unsignedInt 60 Delay after routing established before priority returns to normal interval unsignedShort 100 Transit interval centiseconds ip List of IPAddr Not optional One or more IP addresses to announce log NMTOKEN Not logging Log events log error NMTOKEN log as event Log errors www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 118 Configuration Objects low priority unsignedByte 1 Lower priority applicable until routin
239. tem name Client name used not set e g factory reset configuration FB6000 set Main application software running If the FB6000 s system name is set and your DHCP server shows client names then this is likely to be the preferred way to locate the relevant DHCP allocation in a list rather than trying to locate it by MAC address If the FB6000 is in a factory reset state then the system name will not be set and you will have to locate it by MAC address 78 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix C VLANs A primer An Ethernet Layer 2 broadcast domain consists of a group of Ethernet devices that are interconnected typically via switches such that an Ethernet broadcast packet which specifies a reserved broadcast address as the destination Ethernet address of the packet sent by one of the devices is always received by all the other devices in the group A broadcast domain defines the boundaries of a single Local Area Network When Virtual LANs VLANs are not in use a broadcast domain consist of devices such as PCs and routers physical cables switches or hubs and possibly bridges In this case creating a distinct Layer 2 broadcast domain requires a distinct set of switch hub bridge hardware not physically interconnected with switch hub bridge hardware in any other domain A network using Virtual LANs is capable of implementing multiple distinct Layer 2 b
240. ter provides BGP routing capabilities The aim of the design is to make configurationm simple for a small ISP or corporate BGP user defining key types of BGP peer with pre set rules to minimise mistakes Caution Misconfiguring BGP can have a serious impact on the Internet as a whole In most cases your transit providers will have necessary filtering in place to protect from mistakes but that is not always the case If you are an ISP and connect to peering points you can cause havoc locally or even internationally by misconfiguring your BGP Take care and get professional advice if you are unsure 15 2 2 Standards The key features supported are e Simple pre set configurations for typical ISP corporate setup e RFC4271 Standard BGP capable of handling multiple full internet routing tables e RFC4893 32 bit AS number handling e RFC2858 Multi protocol handling of IPv6 63 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 BGP RFC1997 Community tagging with in build support of well known communities RFC2385 TCP MDS protection RFC2796 Route reflector peers RFC3392 Capabilities negotiation RFC3065 Confederation peers RFC5082 TTL Security Multiple independent routing tables allowing independent BGP operations Multiple AS operation 15 2 3 Simple example setup A typical installation may have transit connections from which a complete internet routing table is received peers whi
241. the Internet This chapter covers the ISP use of a FireBrick including L2TP and PPPoE L2TP can also be used on a smaller scale to creat point to point tunnels 16 1 Background 16 1 1 How it all began Once upon a time end users would use a computer and a modem to dial a provider The provider would have a modem connected to a server and this would allow simple text access to a computer system This was then used to provide bulletin boards This moved on and providers started to allow direct Internet Protocol 1P access to end users The modem would connect and the computer would authenticate and pass IP packets using protocols such as SLIP and PPP This allowed the computer to authenticate and be allocated an IP address 16 1 2 Point to Point Protocol Point to Point Protocol PPP worked well and is still in use today in broaband access networks The modem at the provider would connect to the providers network and the Internet Typically there would be one device an Access Concentrator which connected IP on one side and modems on the other The IPs would be fixed for each modem so dynamic for the end user as depends which port they hit and routing could be static to each Access Concentrator PPP is quite a simple protocol that allows packets to be marked with their type but it also provides negotiation protcols for Link Control LCP authentication CHAP and PAP and IP level negotiations IPCP and IPV6CP Once negotiation is com
242. time 01 00 00 Timezone 1 to 2 local time of change tz2 name string BST Timezone 2 name tz2 offset duration 1 00 00 Timezone 2 offset from UTC tz21 date unsignedByte 1 31 25 Timezone 2 to earliest date in month datenum tz21 day day Sun Timezone 2 to day of week of change tz21 month month Oct Timezone 2 to 1 month tz21 time time 02 00 00 Timezone 2 to local time of change H 2 10 telnet service Telnet service settings Telnet control interface Table H 14 telnet service Attributes www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Attribute Type Default Description allow List of Allow from List of IP ranges from which service can be IPNameRange anywhere accessed comment string Comment local only boolean true Restrict access to locally connected Ethernet subnets only 110 Configuration Objects log NMTOKEN Not logging Log events log debug NMTOKEN Not logging Log debug log error NMTOKEN Log as event Log errors port unsignedShort 23 Service port profile NMTOKEN Profile name source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable H 2 11 http service HTTP service settings Web management pages Table H 15 http service Attributes Attribute Type Default Description access control string Additional he
243. to send the packet to In addition a subnet definition creates a very specific single IP a 32 for IPv4 or a 128 for IPv6 route for the IP address of the FB6000 itself on that subnet This is a separate loop back route which effectively internally routes traffic back into the FB6000 itself i e it never appears externally A subnet can also have a gateway specified either in the config or by DHCP or RA This gateway is just like creating a route to 0 0 0 0 0 or 0 as a specific route configuration It is mainly associated with the subnet for convenience If defined by DHCP or RA then like the rest of the routes created by DHCP or RA it is removed when the DHCP or RA times out Example lt subnet ip 192 168 0 1 24 gt creates a route for destination 192 168 0 0 24 to the interface associated with that subnet A loop back route to 192 168 0 1 the FB6000 s own IP address on that subnet is also created 7 2 2 Routing to an IP address gateway route Routes can be defined to forward traffic to another IP address which will typically be another router often also called a gateway For such a routing target the gateway s IP address is then used to determine how to route the traffic and another routing decision is made This subsequent routing decision usually identifies an interface or other data link to send the packet via in more unusual cases the subsequent routing decision identifies another gateway so it is possible for th
244. tributes Attribute Type Default Description allow List of Match source IP address of RADIUS IPNameRange request authenticator boolean Require message authenticator backup ip List of IPNameAddr Target IP s or hostname for backup L2TP connection called station id List of string One or more patterns to match called station id calling station id List of string One or more patterns to match calling station id class string Class field to send comment string Comment context name string Juniper Context Name SIN502 dummy ip boolean true Send dummy framed IP response ip List of Match target IP address of RADIUS IPNameRange request name string Name nsn conditional boolean Only send NSN settings if username is not same as calling station id nsn tunnel override unsignedByte Additional response for GGSN usage username nsn tunnel user unsignedInt Additional response for GGSN usage auth method 114 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects order radiuspriority Priority tagging of endpoints sent profile NMTOKEN Profile name Irelay ip Listof IPAddr AddresstocopyRADIUS request relay port unsignedShort 1812 Authentication UDP port for copy RADIUS request relay table unsignedByte 0 99 Routing table number for copy of RADIUS routetable
245. ts sent profile NMTOKEN Profile name relay ip List of IPAddr Address to copy RADIUS request relay port unsignedShort 1812 Authentication UDP port for copy RADIUS request relay table unsignedByte 0 99 Routing table number for copy of RADIUS routetable request secret Secret Shared secret for RADIUS requests needed for replies source string Source of data used in automated config management jtageed boolean Tagallattributes thatcanbe 113 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects target hostname string Hostname for L2TP connection target ip target secret List of IPNameAddr Secret Target IP s or hostname for primary L2TP connection Shared secret for L2TP connection test List of IPAddr List of IPs that must have routing for this target to be valid deprecated tunnel assignment string Tunnel Assignment ID to send id tunnel client return boolean Return tunnel client as radius IP Table H 21 radius service Elements Element Type Instances Description match radius service Optional unlimited Matching rules for specific responses match server radius server Optional unlimited RADIUS server settings H 2 16 radius service match Matching rules for RADIUS service Rules for matching incoming RADIUS requests Table H 22 radius service match At
246. tself cause any traffic shaping to occur but is a pre requisite to specifying how the associated traffic flow should be shaped 45 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Traffic Shaping 9 1 2 Shapers Once you have graphed a possibly bi directional traffic flow you can then also define speed restrictions on those flows These can be simple Tx and Rx speed limits or more complex settings allowing maximum average speeds over time You define the speed controls associated with the graphed traffic flow s by creating a shaper top level object To create or edit a shaper object in the web User Interface first click on the Shape category icon To create a new object click the Add link To edit an existing object click the appropriate Edit link instead The shaper object specifies the parameters primarily traffic rates to use in the traffic shaping process and the shaper is associated with the appropriate existing graph by specifying the name attribute of the shaper object to be the same as the name of the graph 9 1 3 Ad hoc shapers You can define a shaper object and set the speed controls for that shaper and then define the graph attribute on something e g an interface to apply that shaper to the interface It is also possible in most cases to simply set a speed attribute on some object This creates an un named shaper so no graph which has the specified speed for
247. uld mean existin connections trying to talk to another LNS It is better for the a failure to cause a clean timeout on the failed LNS and reconnect via RADIUS session steering than to have active sessions traffic go to a different LNS where the session IDs could match and existing session unlikely but possible The L2TP connection is matched to an incoming L2TP configuration The RADIUS session steering can be used to specify the hostname and password that is sent so that the correct incoming configuration can be matched 72 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Internet Service Providers This can the select specific RADIUS servers to use at the ISP for authorising the connection though typically a single set of RADIUS servers is used for all connections It can also specify defaults for DNS PPP endpoint addresses and so on 16 8 5 ISP RADIUS Once the L2TP connection arrives you can use RADIUS in your own network to control the connection accepting it or rejecting it and defining IP addressing DNS traffic speeds routing table and much more Appendix E provides details of the specific AVPs used with RADIUS for L2TP You would normally have more than one RADIUS server You can set these in a priority order a set of main servers and a set of backup The FB6000 will find a config line for RADIUS based on the named RADIUS server in the L2TP incoming configuration or pick any 1f th
248. uration The NTP service automatically sets the FB6000 s real time clock using time information provided by a Network Time Protocol NTP server There are public NTP servers available for use on the Internet and a factory reset configuration does not specify an NTP server which means a default of ntp firebrick ltd uk You can set your preferred NTP server instead The NTP service is currently only an NTP client A future software version is likely to add NTP server functionality allowing other NTP clients typically those in your network to use the FB6000 as an NTP server Configuration of the NTP client service typically only requires setting the t imeserver attribute to specify one or more NTP servers using either DNS name or IP address 12 7 SNMP configuration The SNMP service allows other devices to query the FB6000 for management related information using the Simple Network Management Protocol SNMP As with the HTTP server access can be restricted to e specific client IP addresses and or e clients connecting from locally attached Ethernet subnets only See Section 12 3 1 for details The SNMP service defaults to allowing access from anywhere The remaining SNMP service configuration attributes are community specifies the SNMP community name with a default of public port specifies the port number that the SNMP service listens on this typically does not need setting as the default is the standard SNMP port
249. variant includes e Layer 2 Tunnelling Protocol L2TP to terminate PPP connections e g broadband lines e Border Gateway Protocol to allow routes to be announced and accepted from peering BGP routers 1 1 2 1 FB6202 Gigabit L2TP LNS with detailed monitoring of all lines The FB6202 provides the key component for an Internet Servuice Provider ISP to terminate data connections from broadband or dial up or similar service carriers that use L2T P RADIUS is used to authenticate and account for data and BGP is used to announce connected routes The FB6202 has unique features that provide invaluable levels of monitoring of connected circuits There is also support for per packet line bonding IPv6 including DHCPv6 and RA over PPP and L2TP relay With the FB6202 you can handle thousands of broadband connections from a variety of carriers up to a gigabit throughput You can pool multiple FB6102 s to provide to handle much higher capacity even where links to carriers need aggregate traffic shaping 1 1 3 Ethernet port capabilities The FB6000 has two Ethernet network ports that operate at 1Gb s The ports implement auto negotiation by default but operation can be fine tuned to suit specific circumstances The function of these ports is very flexible and defined by the device s configuration The ports implement one or more interfaces Multiple interfaces can be implemented on a single physical port via support for IEEE 802 1Q VLANs ideal
250. was not possible to aggregate entries that had the same routing information The inability to aggregate routes meant global routing table size was growing fast which meant performance issues at core routers The position and size of the network ID and host ID bitfields were implied by the bit pattern of some of the most significant address bits which segmented the 32 bit IPv4 address space into three main blocks one for each class of network CIDR The prefix notation introduced by CIDR was in the simplest sense to make explicit which bits in a 32 bit IPv4 address are interpreted as the network number or prefix associated with a site and which are the used to number individual end systems within the site In this sense the prefix is the N most significant bits that comprise the network ID bitfield CIDR notation is written as IPv4 Traditional IPv4 dotted quad number followed by the slash character followed by a decimal prefix length value between 0 and 32 inclusive IPv6 IPv6 address followed by the slash character followed by a decimal prefix length value between 0 and 128 inclusive Where formerly only three network sizes were available CIDR prefixes may be defined to describe any power of two sized block of between one and 2432 end system addresses that begins at an address that is a multiple of the block size This provides for far less wasteful allocation of IP address space The size of the range is
251. where you do not require non volatile storage or external logging see Section 5 3 the log object will only need a name attribute and will have no child objects In XML this will look something like loo name tmy logi 5 1 1 1 Logging to Flash memory The internal Flash memory logging system is separate from the external logging It applies if the log target object has flash true It causes each log entry to be written to the internal non volatile Flash log as it is created The flash log is intended for urgent permanent system information only and is visible using the show flash log CLI command see Appendix F for details on using this command Chapter 17 covers the CLI in general Caution Flash logging slows down the system considerably only enable Flash logging where absolutely necessary The flash log does have a limit on how much it can hold but it is many thousands of entries so this is rarely an issue Oldest entries are automatically discarded when there is no space 28 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Event Logging 5 1 1 2 Logging to the Console The console is the command line environment described in Chapter 17 You can cause log entries to be displayed as soon as possible on the console assuming an active console session by setting console true on the log target You can stop the console logging with trof f command or restart it with t
252. wise a default value is shown and applied for that setting If the attribute is not optional then no checkbox is show e the attribute name this is a compact string that exactly matches the underlying XML attribute name e a short description of the attribute Tip Tf there is no default shown for an attribute then its value if needed is zero blank null empty string false internally it is zero bits In some cases the presence of an attribute will have meaning even 1f that attribute is an empty string or zero value In some cases the default for an attribute will not be a fixed value but will depend on other factors e g it may be auto or set if using xyz The description of the default value should make this clear Where an optional attribute is not ticked the attribute does not appear in the XML at all These can be seen in Figure 3 7 Figure 3 7 Attribute definitions Attribute name m name Name Attribute WAN fo descriptions port Port group name Attribute values 14 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration If the attribute value is shown in a strike through font with a horizontal line through it mid way vertically this illustrates that the attribute can t be set this will happen where the attribute value would reference an instance of particular type of object but there are not currently any instances of objects of th
253. xtension can be included on the end of the options this is used only for making the index of all graphs for that type see below graphname Graph name For XML this can be just to produce one XML file with all graphs ext Extension for file type required options Options can alternatively be included as a html form get field list Where no graph name or ext are provided i e the index page of a directory then an html page is served An ext can be included after any options to make a list of files of that type Otherwise the index is an html page explaining the options A blank graph is available by accessing simply png i e no graph name An xml list of all graphs is available as xml A csv list of graph name and score is available as csv and similarly for txt and tsv A special case exists for extracting the xml files for all graphs in one request using the name xml G 4 2 load handling The graphs and csv files are generated on the fly and only one is generated at a time Connection requests are queued As part of the normal web management system the trusted IPs queue is always processed first so constant access from untrusted sources will not stop access from trusted sources If the queue is full the connection is not accepted The most load applies when archiving but tools like wget fetch one linked file at a time which is ideal G 5 Graph scores Graphs are scored based on settings in the config Each 10
254. y existing objects of the associated type Each row of the table corresponds with one object and a subset typically those of most interest at a glance of the object s attributes are shown in the columns the column heading shows the attribute name If no objects of that type exist there will be a single row with an Add link Where the order of the objects matter there will be an Add link against each object clicking an Add link for a particular object will insert a new object before it To add a new object after the last existing one click on the Add link on the bottom or only row of the table Tip If there is no Add link present then this means there can only exist a limited number of objects of that type possibly only one and this many already exist The existing object s may have originated from the factory reset configuration You can push down into the hierarchy by clicking the Edit link in a table row This takes you to a page to edit that specific object The page also shows any child objects of the object being edited using the same horizontal line delimited section style used in the top level categories You can navigate back up the hierarchy using various methods see Section 3 4 3 Caution Clicking the Add link will create a new sub object which will have blank default settings This can be useful to see what attributes an object can take but if you do not want this blank object to be part of the confi
255. y has one element the root element which contains the entire element hierarchy In the FB6000 the root element is lt config gt and it contains top level configuration elements that cover major areas of the configuration such as overall system settings interface definitions firewall rule sets etc In addition to this User Manual there is reference material is available that documents the XML elements refer to Section 3 2 1 3 5 3 Viewing or editing XML The XML representation of the configuration can be viewed and edited in text form via the web interface by clicking on XML View and XML Edit respectively under the main menu Config item Viewing the configuration is as you might expect read only and so is safe in as much as you can t accidentally change the configuration 3 5 4 Example XML configuration An example of a simple but complete XML configuration is shown below with annotations pointing out the main elements lt xml version 1 0 encoding UTF 8 gt lt config xmlns http firebrick 1ltd uk xml fb2700 xmlns xsi http www w3 org 2001 XMLSchema instance xsi schemaLocation http firebrick 1td uk xml fb2700 timestamp 2011 10 14T12 24 072 patch 8882 gt 17 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration lt system name gateway O contact Peter smith location The Basement Tog pante bs uppore gt
256. y normal routes shutdown boolean Shutdown this neighbour deprecated use profile source string Source of data used in automated config management timer idle unsignedInt 60 Idle time after error timer openwait unsignedInt 10 Time to wait for OPEN on connection timer retry unsignedInt 10 Time to retry the neighbour ttl security byte Enable RFC5082 TTL security if ve 1 to 127 i e 1 for adjacent router If ve 1 to 128 set forced sending TTL i e 1 for TTL of 1 sending and not checking type peertype normal Type of neighbour affects some defaults use vrrp as self boolean true if customer Use VRRP address as self if possible transit type Table H 46 bgppeer Elements Element Type Instances Description export bgpmap Optional Mapping and filtering rules of announcing prefixes to peer import bgpmap Optional Mapping and filtering rules of accepting prefixes from peer H 2 36 bgpmap Mapping and filtering rules of BGP prefixes This defines the rules for mapping and filtering of prefixes to from a BGP peer Table H 47 bgpmap Attributes Attribute Type Default Description comment string Comment detag List of Community List of community tags to remove drop boolean Do not import export this prefix localpref unsignedInt Set localpref highest wins 126 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects
257. y the DNS name or IP address of your syslog server by setting the server attribute on the syslog object You can also set the facility and or severity values using these attributes facility the facility to be used in the syslog messages when syslog entries are generated by subsystems or processes in a general purpose operating system the facility typically identifies the message source where the commonly used facility identifiers are not suitable the local0 thru local7 identifiers can be used If the facility attribute is not set it defaults to LOCALO e severity the severity value to be used in the syslog messages if not set the severity defaults to NOTICE The FB6000 normally uses the standard syslog port number of 514 but if necessary you can change this by setting the port attribute value 5 3 2 Email You can cause logs to be sent by e mail by creating an email object that is a child of the log target 10g object An important aspect of emailed logs is that they have a delay and a hold off The delay means that the email is not sent immediately because often a cluster of events happen over a short period and it is sensible to wait for several log lines for an event before e mailing The hold off period is the time that the FB6000 waits after sending an e mail before sending another Having a hold off period means you don t get an excessive number of e mails since the logging system is initially storing eve

FireBrick FB6202 User Manual

Contents

Download Pdf Manuals

Related Search

Related Contents