Page is loading ...
Nokia Network Voyager
for IPSO 4.0
Reference Guide
Part No. N451818001 Rev A
Published October 2005
2 Nokia Network Voyager for IPSO 4.0 Reference Guide
COPYRIGHT
©2005 Nokia. All rights reserved.
Rights reserved under the copyright laws of the United States.
RESTRICTED RIGHTS LEGEND
Use, duplication, or disclosure by the United States Government is subject to restrictions as set
forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at
DFARS 252.227-7013.
Notwithstanding any other license agreement that may pertain to, or accompany the delivery of,
this computer software, the rights of the United States Government regarding its use,
reproduction, and disclosure are as set forth in the Commercial Computer Software-Restricted
Rights clause at FAR 52.227-19.
IMPORTANT NOTE TO USERS
This software and hardware is provided by Nokia Inc. as is and any express or implied
warranties, including, but not limited to, implied warranties of merchantability and fitness for a
particular purpose are disclaimed. In no event shall Nokia, or its affiliates, subsidiaries or
suppliers be liable for any direct, indirect, incidental, special, exemplary, or consequential
damages (including, but not limited to, procurement of substitute goods or services; loss of use,
data, or profits; or business interruption) however caused and on any theory of liability, whether in
contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use
of this software, even if advised of the possibility of such damage.
Nokia reserves the right to make changes without further notice to any products herein.
TRADEMARKS
Nokia is a registered trademark of Nokia Corporation. Other products mentioned in this document
are trademarks or registered trademarks of their respective holders.
050110
Nokia Contact Information
Corporate Headquarters
Web Site http://www.nokia.com
Telephone 1-888-477-4566 or
1-650-625-2000
Nokia Network Voyager for IPSO 4.0 Reference Guide 3
Regional Contact Information
Nokia Customer Support
Fax 1-650-691-2170
Mail
Address
Nokia Inc.
313 Fairchild Drive
Mountain View, California
94043-2215 USA
Americas Nokia Inc.
313 Fairchild Drive
Mountain View, CA 94043-2215
USA
Tel: 1-877-997-9199
Outside USA and Canada: +1 512-437-7089
email: [email protected]
Europe,
Middle East,
and Africa
Nokia House, Summit Avenue
Southwood, Farnborough
Hampshire GU14 ONG UK
Tel: UK: +44 161 601 8908
Tel: France: +33 170 708 166
email: [email protected]
Asia-Pacific 438B Alexandra Road
#07-00 Alexandra Technopark
Singapore 119968
Tel: +65 6588 3364
email: [email protected]
Web Site: https://support.nokia.com/
Email: [email protected]
Americas Europe
Voice: 1-888-361-5030 or
1-613-271-6721
Voice: +44 (0) 125-286-8900
Fax: 1-613-271-8782 Fax: +44 (0) 125-286-5666
Asia-Pacific
Voice: +65-67232999
Fax: +65-67232897
050602
4 Nokia Network Voyager for IPSO 4.0 Reference Guide
Nokia Network Voyager IPSO 4.0 Reference Guide 5
Contents
About the Nokia Network Voyager Reference Guide . . . . . . . . .19
Conventions This Guide Uses . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Text Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Menu Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Related Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
1 About Network Voyager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Software Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Logging In to Network Voyager . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Logging Off . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Obtaining a Configuration Lock. . . . . . . . . . . . . . . . . . . . . . . . . . 25
Navigating in Network Voyager . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Reloading Pages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Accessing Documentation and Help . . . . . . . . . . . . . . . . . . . . . . 26
Viewing Hardware and Software Information for Your System . . . 28
2 Configuring Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Interface Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
IP2250 Management Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Configuring Network Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Configuring IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Interface Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
6 Nokia Network Voyager IPSO 4.0 Reference Guide
Configuring Tunnel Interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Ethernet Interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Configuring Ethernet Interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . 34
Link Aggregation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Managing Link Aggregation Using SNMP. . . . . . . . . . . . . . . . . . 36
Configuring Switches for Link Aggregation . . . . . . . . . . . . . . . . . 36
Static Link Aggregation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Link Aggregation on the IP2250 . . . . . . . . . . . . . . . . . . . . . . . . . 37
Configuring Link Aggregation . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Gigabit Ethernet Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Point-to-Point Over Ethernet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Configuring PPPoE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Configuring MSS Clamping . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Virtual LAN Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
FDDI Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
ISDN Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Configuring Calling Line-Identification Screening . . . . . . . . . . . . 56
Dial-on-Demand Routing (DDR) Lists. . . . . . . . . . . . . . . . . . . . . 58
ISDN Network Configuration Example . . . . . . . . . . . . . . . . . . . . 61
ISDN Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Token Ring Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Token Ring Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Point-to-Point Link over ATM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
ATM Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
IP over ATM (IPoA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
IPoA Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Serial (V.35 and X.21) Interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . 83
Serial Interface Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
T1(with Built-In CSU/DSU) Interfaces . . . . . . . . . . . . . . . . . . . . . . 88
T1 Interface Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
E1 (with Built-In CSU/DSU) Interfaces. . . . . . . . . . . . . . . . . . . . . . 96
HSSI Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Unnumbered Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Nokia Network Voyager IPSO 4.0 Reference Guide 7
Configuring Unnumbered Interfaces . . . . . . . . . . . . . . . . . . . . . 107
Configuring OSPF over Unnumbered Interface . . . . . . . . . . . . 110
OSPF over Unnumbered Interfaces Using Virtual Links. . . . . . 110
Cisco HDLC Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Point-to-Point Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Frame Relay Protocol. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
Loopback Interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
GRE Tunnels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Configuring GRE Tunnels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
GRE Tunnel Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
High Availability GRE Tunnels . . . . . . . . . . . . . . . . . . . . . . . . . 122
HA GRE Tunnel Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
DVMRP Tunnels. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
DVMRP Tunnel Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
ARP Table Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Configuring ARP for ATM Interfaces . . . . . . . . . . . . . . . . . . . . . . 130
Transparent Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Limitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Transparent Mode Processing Details . . . . . . . . . . . . . . . . . . . 133
Configuring Transparent Mode in VPN Environments . . . . . . . 134
Example of Transparent Mode . . . . . . . . . . . . . . . . . . . . . . . . . 135
Configuring Transparent Mode . . . . . . . . . . . . . . . . . . . . . . . . . 136
Monitoring Transparent Mode Groups . . . . . . . . . . . . . . . . . . . 139
Transparent Mode and Check Point NGX . . . . . . . . . . . . . . . . 139
Virtual Tunnel Interfaces (FWVPN) for Route-Based VPN . . . . . 140
Creating Virtual Tunnel Interfaces. . . . . . . . . . . . . . . . . . . . . . . 142
3 Configuring System Functions . . . . . . . . . . . . . . . . . . . . . . . . 145
Configuring DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Configuring DHCP Client Interfaces . . . . . . . . . . . . . . . . . . . . . 146
DHCP Client Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Configuring the DHCP Server. . . . . . . . . . . . . . . . . . . . . . . . . . 147
DHCP Server Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
8 Nokia Network Voyager IPSO 4.0 Reference Guide
Changing DHCP Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
Adding DHCP Address Pools . . . . . . . . . . . . . . . . . . . . . . . . . . 149
Enabling or Disabling DHCP Address Pools. . . . . . . . . . . . . . . 150
Assigning a Fixed-IP Address to a Client . . . . . . . . . . . . . . . . . 150
Creating DHCP Client Templates . . . . . . . . . . . . . . . . . . . . . . . 151
Configuring Dynamic Domain Name System Service. . . . . . . . 153
Configuring the Domain Name Service . . . . . . . . . . . . . . . . . . . . 154
Configuring Disk Mirroring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
Using an Optional Disk (Flash-Based Systems Only) . . . . . . . . . 155
Mail Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
System Failure Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Configuring Mail Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Sending Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
Setting the System Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
Configuring Host Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Configuring System Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Configuring Logging on Disk-Based Systems. . . . . . . . . . . . . . 160
Configuring Logging on Flash-Based Systems. . . . . . . . . . . . . 161
Configuring Audit Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Remote Core Dump Server on Flash-Based Systems. . . . . . . . . 165
Changing the Hostname . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Managing Configuration Sets. . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Scheduling Jobs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Backing Up and Restoring Files. . . . . . . . . . . . . . . . . . . . . . . . . . 168
Creating Backup Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Transferring Backup Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
Restoring Files from Locally Stored Backup Files. . . . . . . . . . . 172
Managing Nokia IPSO Images. . . . . . . . . . . . . . . . . . . . . . . . . . . 173
Changing Current Image. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
Deleting Images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
Installing New Images. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Testing a New Image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Upgrading Nokia IPSO Images for a Cluster. . . . . . . . . . . . . . . 176
Nokia Network Voyager IPSO 4.0 Reference Guide 9
Downgrading Nokia IPSO Images. . . . . . . . . . . . . . . . . . . . . . . 176
Configuring Monitor Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
Managing Packages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
Installing and Enabling Packages . . . . . . . . . . . . . . . . . . . . . . . 178
Advanced System Tuning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Tuning the TCP/IP Stack. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Router Alert IP Option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
4 Virtual Router Redundancy Protocol (VRRP) . . . . . . . . . . . . . 183
VRRP Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
How VRRP Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Understanding Monitored-Circuit VRRP. . . . . . . . . . . . . . . . . . . . 186
Configuring VRRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
Selecting Configuration Parameters . . . . . . . . . . . . . . . . . . . . . 187
Before you Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Configuring Monitored-Circuit VRRP. . . . . . . . . . . . . . . . . . . . . 192
Configuring VRRPv2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Configuring Check Point NGX for VRRP . . . . . . . . . . . . . . . . . . . 197
Configuring VRRP Rules for Check Point NGX . . . . . . . . . . . . 199
Link Aggregation (IP2250 Systems Only) . . . . . . . . . . . . . . . . . 201
Monitoring VRRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Monitoring the Firewall State. . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Troubleshooting VRRP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
General Configuration Considerations . . . . . . . . . . . . . . . . . . . 203
Firewall Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
Access Control Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
Switched Environments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
5 Configuring Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
IP Clustering Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Using Flash-Based Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Example Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Cluster Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
10 Nokia Network Voyager IPSO 4.0 Reference Guide
Cluster Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
Clustering Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
Considerations for Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . 214
If You Do Not Use a Dedicated Primary Cluster
Protocol Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Upgrading IPSO in a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
For All Upgrades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Upgrading from IPSO 3.7 or Later. . . . . . . . . . . . . . . . . . . . . . . 218
Upgrading from IPSO 3.6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Creating and Configuring a Cluster . . . . . . . . . . . . . . . . . . . . . . . 220
Configuration Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
Creating a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
Selecting the Cluster Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Configuring the Work Assignment Method . . . . . . . . . . . . . . . . 221
Configuring an Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
Configuring Firewall Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . 223
Supporting Non-Check Point Gateways and Clients. . . . . . . . . 223
Configuring Join-Time Shared Features . . . . . . . . . . . . . . . . . . 226
Making the Cluster Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Adding a Node to a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Recommended Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Joining a System to a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Managing a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Using Cluster Voyager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Synchronizing the Time on Cluster Nodes . . . . . . . . . . . . . . . . 239
Configuring NGX for Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . 241
Clustering Example (Three Nodes) . . . . . . . . . . . . . . . . . . . . . . . 243
Configuring the Cluster in Voyager . . . . . . . . . . . . . . . . . . . . . . 244
Configuring the Internal and External Routers . . . . . . . . . . . . . 245
Clustering Example With Non-Check Point VPN . . . . . . . . . . . 246
Nokia Network Voyager IPSO 4.0 Reference Guide 11
6 Configuring SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
SNMP Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
SNMP Proxy Support for Check Point MIB . . . . . . . . . . . . . . . . . 252
Using the Check Point MIB . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Using cpsnmp_start. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Enabling SNMP and Selecting the Version . . . . . . . . . . . . . . . . . 254
Configuring the System for SNMP . . . . . . . . . . . . . . . . . . . . . . . . 255
Setting an Agent Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
Configuring Traps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256
Interpreting Error Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
Configuring SNMPv3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
Request Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Managing SNMP Users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
7 Configuring IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
IPv6 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268
IPv6 and IPv4 Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
Configuring IPv6 in IPv4 Tunnels . . . . . . . . . . . . . . . . . . . . . . . 270
Configuring IPv6 to IPv4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Configuring IPv6 over IPv4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Configuring IPv4 in IPv6 Tunnels . . . . . . . . . . . . . . . . . . . . . . . 272
Configuring an IPv6 Default or Static Route . . . . . . . . . . . . . . . 272
Routing Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Configuring OSPFv3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Configuring RIPng. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Creating IPv6 Aggregate Routes. . . . . . . . . . . . . . . . . . . . . . . . 273
Creating Redistributed Routes . . . . . . . . . . . . . . . . . . . . . . . . . 274
Router Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
Configuring ICMPv6 Router Discovery . . . . . . . . . . . . . . . . . . . 275
VRRP for IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
Configuring VRRP for IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
Creating a Virtual Router for an IPv6 Interface
12 Nokia Network Voyager IPSO 4.0 Reference Guide
Using VRRPv3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
Creating a Virtual Router to Back Up Another VRRP
Router Addresses Using VRRPv3 . . . . . . . . . . . . . . . . . . . . . 278
Monitoring the Firewall State. . . . . . . . . . . . . . . . . . . . . . . . . . . 279
Setting a Virtual MAC Address for a Virtual Router. . . . . . . . . . 280
Changing the IP Address List of a Virtual Router in VRRPv3. . 281
Removing a Virtual Router in VRRPv3 . . . . . . . . . . . . . . . . . . . 281
Creating a Virtual Router in Monitored Circuit Mode for IPv6 . . 282
Setting Interface Dependencies for a Monitored Circuit
Virtual Router for IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
Changing the List of Addresses in a Monitored Circuit
Virtual Router for IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Traffic Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Security and Access Configuration . . . . . . . . . . . . . . . . . . . . . . . 285
8 Managing Security and Access . . . . . . . . . . . . . . . . . . . . . . . . 287
Managing Passwords. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
Managing User Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
Adding and Deleting Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Managing and Using S/Key. . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
Managing Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
Role-Based Administration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
Managing Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
Assigning Roles and Access Mechanisms to Users. . . . . . . . . 295
Creating Cluster Administrator Users . . . . . . . . . . . . . . . . . . . . 296
Configuring Network Access and Services . . . . . . . . . . . . . . . . . 297
Configuring a Modem on COM2, COM3, or COM4. . . . . . . . . . 298
Configuring Nokia Network Voyager Access . . . . . . . . . . . . . . . . 300
Configuring Basic Nokia Network Voyager Options . . . . . . . . . 301
Generating and Installing SSL/TLS Certificates . . . . . . . . . . . . 302
Secure Shell (SSH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
Initial SSH Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
Configuring Advanced Options for SSH . . . . . . . . . . . . . . . . . . 306
Nokia Network Voyager IPSO 4.0 Reference Guide 13
Configuring Secure Shell Authorized Keys . . . . . . . . . . . . . . . . 308
Changing Secure Shell Key Pairs. . . . . . . . . . . . . . . . . . . . . . . 309
Managing User RSA and DSA Identities. . . . . . . . . . . . . . . . . . 310
Tunneling HTTP Over SSH. . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
Network Voyager Session Management . . . . . . . . . . . . . . . . . . . 311
Enabling Enabling or Disabling Session Management . . . . . . . 312
Configuring Session Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . 312
Authentication, Authorization, and Accounting (AAA) . . . . . . . . . 313
Creating an AAA Configuration. . . . . . . . . . . . . . . . . . . . . . . . . 313
Configuring RADIUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319
Configuring TACACS+ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321
Deleting an AAA Authentication Server Configuration . . . . . . . 322
Changing an AAA Configuration . . . . . . . . . . . . . . . . . . . . . . . . 323
Deleting an AAA Configuration . . . . . . . . . . . . . . . . . . . . . . . . . 327
Encryption Acceleration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327
Enabling Encryption Accelerator Cards. . . . . . . . . . . . . . . . . . . 328
Monitoring Cryptographic Acceleration . . . . . . . . . . . . . . . . . . . 328
IPSec Tunnels (IPSO Implementation) . . . . . . . . . . . . . . . . . . . . 328
Using PKI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332
IPSec Implementation in IPSO . . . . . . . . . . . . . . . . . . . . . . . . . 332
IPSec Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
Creating an IPSec Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335
Creating an IPSec Tunnel Rule. . . . . . . . . . . . . . . . . . . . . . . . . 341
Transport Rule. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342
IPSec Tunnel Rule Example . . . . . . . . . . . . . . . . . . . . . . . . . . . 344
IPSec Transport Rule Example. . . . . . . . . . . . . . . . . . . . . . . . . 346
Changing the Local/Remote Address or Local/Remote
Endpoint of an IPSec Tunnel . . . . . . . . . . . . . . . . . . . . . . . . . 348
Removing an IPSec Tunnel. . . . . . . . . . . . . . . . . . . . . . . . . . . . 348
Miscellaneous Security Settings. . . . . . . . . . . . . . . . . . . . . . . . . . 349
9 Configuring Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
Routing Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
14 Nokia Network Voyager IPSO 4.0 Reference Guide
Routing Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
Route Maps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353
OSPF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353
Types of Areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354
Area Border Routers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355
High Availability Support for OSPF . . . . . . . . . . . . . . . . . . . . . . 355
Configuring OSPF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356
RIP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365
RIP 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365
RIP 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366
Virtual IP Address Support for VRRP . . . . . . . . . . . . . . . . . . . . 366
Configuring RIP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
Configuring RIP Timers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368
Configuring Auto-Summarization . . . . . . . . . . . . . . . . . . . . . . . 369
RIP Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369
PIM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370
Configuring Virtual IP Support for VRRP. . . . . . . . . . . . . . . . . . 371
PIM Support for IP Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . 371
Configuring Dense-Mode PIM. . . . . . . . . . . . . . . . . . . . . . . . . . 373
Disabling PIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374
Setting Advanced Options for Dense-Mode PIM (Optional) . . . 375
Configuring Sparse-Mode PIM . . . . . . . . . . . . . . . . . . . . . . . . . 376
Configuring High-Availability Mode . . . . . . . . . . . . . . . . . . . . . . 377
Configuring this Router as a Candidate Bootstrap and
Candidate Rendezvous Point. . . . . . . . . . . . . . . . . . . . . . . . . 379
Configuring a PIM-SM Static Rendezvous Point. . . . . . . . . . . . 380
Setting Advanced Options for Sparse-Mode PIM (Optional). . . 381
Debugging PIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383
IGRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
Generation of Exterior Routes. . . . . . . . . . . . . . . . . . . . . . . . . . 387
Aliased Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388
IGRP Aggregation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388
Nokia Network Voyager IPSO 4.0 Reference Guide 15
Configuring IGRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388
DVMRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 390
Configuring DVMRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
Configuring DVMRP Timers . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
IGMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392
Configuring IGMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393
Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394
Adding and Managing Static Routes Example . . . . . . . . . . . . . 397
Backup Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398
Route Aggregation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398
Route Aggregation Example . . . . . . . . . . . . . . . . . . . . . . . . . . . 400
Route Rank . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401
Rank Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401
Routing Protocol Rank Example . . . . . . . . . . . . . . . . . . . . . . . . 402
BGP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403
Support for BGP-4++. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403
BGP Sessions (Internal and External). . . . . . . . . . . . . . . . . . . . 404
BGP Path Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404
BGP Multi-Exit Discriminator. . . . . . . . . . . . . . . . . . . . . . . . . . . 406
BGP Interactions with IGPs. . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
Inbound BGP Route Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407
Redistributing Routes to BGP . . . . . . . . . . . . . . . . . . . . . . . . . . 407
Communities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407
Route Reflection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408
Confederations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409
EBGP Multihop Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410
Route Dampening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411
TCP MD5 Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411
BGP Support for Virtual IP for VRRP . . . . . . . . . . . . . . . . . . . . 412
BGP Support for IP Clustering . . . . . . . . . . . . . . . . . . . . . . . . . 413
BGP Memory Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . 413
BGP Neighbors Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415
Path Filtering Based on Communities Example . . . . . . . . . . . . 418
16 Nokia Network Voyager IPSO 4.0 Reference Guide
BGP Multi Exit Discriminator Example . . . . . . . . . . . . . . . . . . . 419
Changing the Local Preference Value Example . . . . . . . . . . . . 421
BGP Confederation Example . . . . . . . . . . . . . . . . . . . . . . . . . . 423
Route Reflector Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426
BGP Community Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428
EBGP Load Balancing Example: Scenario #1 . . . . . . . . . . . . . 430
EBGP Load Balancing Example: Scenario #2 . . . . . . . . . . . . . 432
Adjusting BGP Timers Example . . . . . . . . . . . . . . . . . . . . . . . . 433
TCP MD5 Authentication Example . . . . . . . . . . . . . . . . . . . . . . 434
BGP Route Dampening Example . . . . . . . . . . . . . . . . . . . . . . . 435
BGP Path Selection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436
BGP-4++ Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436
Route Redistribution. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 438
Redistributing Routes to BGP . . . . . . . . . . . . . . . . . . . . . . . . . . 439
Redistributing Routes to RIP and IGRP . . . . . . . . . . . . . . . . . . 440
Redistributing OSPF to BGP Example . . . . . . . . . . . . . . . . . . . 443
Redistributing Routes with OSPF . . . . . . . . . . . . . . . . . . . . . . . 444
Inbound Route Filters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445
BGP Route Inbound Policy Example. . . . . . . . . . . . . . . . . . . . . 446
BGP AS Path Filtering Example . . . . . . . . . . . . . . . . . . . . . . . . 448
10 Configuring Traffic Management . . . . . . . . . . . . . . . . . . . . . . . 449
Traffic Management Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . 449
Packet Filtering Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . 449
Traffic Shaping Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . 449
Traffic Queuing Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . 450
Configuring Access Control Lists . . . . . . . . . . . . . . . . . . . . . . . . . 450
Configuring ACL Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452
Modifying a Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453
Configuring Aggregation Classes. . . . . . . . . . . . . . . . . . . . . . . . . 455
Configuring Queue Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457
Configuring ATM QoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
Configuring Common Open Policy Server. . . . . . . . . . . . . . . . . . 461
Nokia Network Voyager IPSO 4.0 Reference Guide 17
Configuring a COPS Client ID and Policy Decision Point . . . . . 462
Configuring Security Parameters for a COPS Client ID . . . . . . 462
Assigning Roles to Specific Interfaces . . . . . . . . . . . . . . . . . . . 463
Activating and Deactivating the COPS Client . . . . . . . . . . . . . . 464
Changing the Client ID Associated with Specific Diffserv
Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464
Deleting a Client ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464
Example: Rate Shaping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465
Example: Expedited Forwarding . . . . . . . . . . . . . . . . . . . . . . . . 466
11 Configuring Router Services . . . . . . . . . . . . . . . . . . . . . . . . . . 469
BOOTP/DHCP Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469
Configuring BOOTP/DHCP Relay. . . . . . . . . . . . . . . . . . . . . . . 470
IP Broadcast Helper. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471
Router Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472
Router Discovery Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . 473
Configuring Router Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . 473
Network Time Protocol (NTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . 475
Configuring NTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 476
12 Monitoring System Configuration and Hardware . . . . . . . . . . 479
Viewing System Utilization Statistics . . . . . . . . . . . . . . . . . . . . . . 479
CPU-Memory Live Utilization . . . . . . . . . . . . . . . . . . . . . . . . . . 479
Disk and Swap Space. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 480
Monitoring Process Utilization. . . . . . . . . . . . . . . . . . . . . . . . . . 480
IPSO Process Management . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
Generating Monitor Reports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 482
Monitoring System Health . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483
Monitoring System Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484
Viewing Cluster Status and Members . . . . . . . . . . . . . . . . . . . . . 485
Viewing Routing Protocol Information . . . . . . . . . . . . . . . . . . . . . 486
Displaying the Kernel Forwarding Table . . . . . . . . . . . . . . . . . . 486
Displaying Route Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486
18 Nokia Network Voyager IPSO 4.0 Reference Guide
Displaying Interface Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . 487
Hardware Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487
Using the iclid Tool. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488
iclid Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488
Preventing Full Log Buffers and Related Console Messages . . . 494
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497
Nokia Network Voyager for IPSO 4.0 Reference Guide 19
About the Nokia Network
Voyager Reference Guide
This guide provides information about how to configure and monitor Nokia
IPSO systems. This guide provides conceptual information about system
features and instructions on how to perform tasks using Nokia Network
Voyager, the Web-based interface for IPSO. All of the tasks that you perform
with Network Voyager you can also perform with the command-line interface
(CLI), allowing you to choose the interface you are most comfortable with.
For information specific to the CLI, see the CLI Reference Guide for Nokia
IPSO.
This guide is intended for experienced network administrators who configure
and manage Nokia IP security platforms. It assumes a working knowledge of
networking and TCP/IP protocol principals and some experience with
UNIX-based systems.
This guide is organized into the following chapters:
Chapter 1, “About Network Voyager” describes the IPSO operating
system, Nokia Network Voyager, how to use Network Voyager, and how
to access documentation and help pages.
Chapter 2, “Configuring Interfaces” describes how to configure and
monitor interfaces.
Chapter 3, “Configuring System Functions” describes how to configure
basic system functions such as DHCP, DNS, disk mirroring, mail relay,
system failure notification, system time, host entries, system logging, and
About the Nokia Network Voyager Reference Guide
20 Nokia Network Voyager for IPSO 4.0 Reference Guide
the hostname . It also describes how to save configuration sets, schedule
jobs, backup and restore files, manage and upgrade system images, reboot
the system, manage packages, and advanced system tuning.
Chapter 4, “Virtual Router Redundancy Protocol (VRRP)” describes how
to provides dynamic failover of IP addresses using VRRP.
Chapter 5, “Configuring Clustering” describes how to provide fault
tolerance and dynamic load balancing using clustering.
Chapter 6, “Configuring SNMP” describes how to configure Simple
Network Management Protocol (SNMP), the protocol used to exchange
management information between network devices.
Chapter 7, “Configuring IPv6” describes how to configure features that
use the IPv6 protocol.
Chapter 8, “Managing Security and Access” desribes how to manage
passwords, user accounts and groups, assign privileges using role-based
administration, and how to configure network access, services, and
Network Voyager session management. It also describes how to configure
AAA for a new service, encryption acceleration, and virtual tunnel
interfaces (VTI), which support Check Point route-based VPN..
Chapter 9, “Configuring Routing” describes the IPSO routing subsystem,
how to configure the various routing protocols that are supported, route
aggregation, and route redistribution.
Chapter 10, “Configuring Traffic Management” describes traffic
management functionality, including access control lists and aggregation
classes.
Chapter 11, “Configuring Router Services” describes how to enable your
system to forward broadcast traffic by enabling the IP Broadcast Helper,
forward BOOTP/DHCP traffic by enabling BOOTP relay, how to enable
router discovery, and how to configure for Network Time Protocol (NTP).
Chapter 12, “Monitoring System Configuration and Hardware” provides
information on monitoring your system.
/