Nokia IPSO 4.0 User manual

Nokia Network Voyager

for IPSO 4.0

Reference Guide

Part No. N451818001 Rev A

Published October 2005

2 Nokia Network Voyager for IPSO 4.0 Reference Guide

COPYRIGHT

Rights reserved under the copyright laws of the United States.

RESTRICTED RIGHTS LEGEND

Use, duplication, or disclosure by the United States Government is subject to restrictions as set

forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at

DFARS 252.227-7013.

Notwithstanding any other license agreement that may pertain to, or accompany the delivery of,

this computer software, the rights of the United States Government regarding its use,

reproduction, and disclosure are as set forth in the Commercial Computer Software-Restricted

Rights clause at FAR 52.227-19.

IMPORTANT NOTE TO USERS

This software and hardware is provided by Nokia Inc. as is and any express or implied

warranties, including, but not limited to, implied warranties of merchantability and fitness for a

particular purpose are disclaimed. In no event shall Nokia, or its affiliates, subsidiaries or

suppliers be liable for any direct, indirect, incidental, special, exemplary, or consequential

damages (including, but not limited to, procurement of substitute goods or services; loss of use,

data, or profits; or business interruption) however caused and on any theory of liability, whether in

contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use

of this software, even if advised of the possibility of such damage.

Nokia reserves the right to make changes without further notice to any products herein.

TRADEMARKS

Nokia is a registered trademark of Nokia Corporation. Other products mentioned in this document

are trademarks or registered trademarks of their respective holders.

050110

Nokia Contact Information

Corporate Headquarters

Web Site http://www.nokia.com

Telephone 1-888-477-4566 or

1-650-625-2000

Nokia Network Voyager for IPSO 4.0 Reference Guide 3

Regional Contact Information

Nokia Customer Support

Fax 1-650-691-2170

Mail

Address

Nokia Inc.

313 Fairchild Drive

Mountain View, California

94043-2215 USA

Americas Nokia Inc.

313 Fairchild Drive

Mountain View, CA 94043-2215

USA

Tel: 1-877-997-9199

Outside USA and Canada: +1 512-437-7089

email: [email protected]

Europe,

Middle East,

and Africa

Nokia House, Summit Avenue

Southwood, Farnborough

Hampshire GU14 ONG UK

Tel: UK: +44 161 601 8908

Tel: France: +33 170 708 166

email: [email protected]

Asia-Pacific 438B Alexandra Road

#07-00 Alexandra Technopark

Singapore 119968

Tel: +65 6588 3364

email: [email protected]

Web Site: https://support.nokia.com/

Email: [email protected]

Americas Europe

Voice: 1-888-361-5030 or

1-613-271-6721

Voice: +44 (0) 125-286-8900

Fax: 1-613-271-8782 Fax: +44 (0) 125-286-5666

Asia-Pacific

Voice: +65-67232999

Fax: +65-67232897

050602

4 Nokia Network Voyager for IPSO 4.0 Reference Guide

Nokia Network Voyager IPSO 4.0 Reference Guide 5

Contents

About the Nokia Network Voyager Reference Guide . . . . . . . . .19

Conventions This Guide Uses . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Text Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Menu Items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

Related Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

1 About Network Voyager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Software Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Logging In to Network Voyager . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Logging Off . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Obtaining a Configuration Lock. . . . . . . . . . . . . . . . . . . . . . . . . . 25

Navigating in Network Voyager . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Reloading Pages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Accessing Documentation and Help . . . . . . . . . . . . . . . . . . . . . . 26

Viewing Hardware and Software Information for Your System . . . 28

2 Configuring Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Interface Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

IP2250 Management Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Configuring Network Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Configuring IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Interface Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

6 Nokia Network Voyager IPSO 4.0 Reference Guide

Configuring Tunnel Interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Ethernet Interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Configuring Ethernet Interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . 34

Link Aggregation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Managing Link Aggregation Using SNMP. . . . . . . . . . . . . . . . . . 36

Configuring Switches for Link Aggregation . . . . . . . . . . . . . . . . . 36

Static Link Aggregation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Link Aggregation on the IP2250 . . . . . . . . . . . . . . . . . . . . . . . . . 37

Configuring Link Aggregation . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Gigabit Ethernet Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Point-to-Point Over Ethernet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Configuring PPPoE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Configuring MSS Clamping . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Virtual LAN Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

FDDI Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

ISDN Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Configuring Calling Line-Identification Screening . . . . . . . . . . . . 56

Dial-on-Demand Routing (DDR) Lists. . . . . . . . . . . . . . . . . . . . . 58

ISDN Network Configuration Example . . . . . . . . . . . . . . . . . . . . 61

ISDN Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Token Ring Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Token Ring Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Point-to-Point Link over ATM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

ATM Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

IP over ATM (IPoA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

IPoA Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

Serial (V.35 and X.21) Interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . 83

Serial Interface Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

T1(with Built-In CSU/DSU) Interfaces . . . . . . . . . . . . . . . . . . . . . . 88

T1 Interface Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

E1 (with Built-In CSU/DSU) Interfaces. . . . . . . . . . . . . . . . . . . . . . 96

HSSI Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Unnumbered Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Nokia Network Voyager IPSO 4.0 Reference Guide 7

Configuring Unnumbered Interfaces . . . . . . . . . . . . . . . . . . . . . 107

Configuring OSPF over Unnumbered Interface . . . . . . . . . . . . 110

OSPF over Unnumbered Interfaces Using Virtual Links. . . . . . 110

Cisco HDLC Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

Point-to-Point Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

Frame Relay Protocol. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

Loopback Interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

GRE Tunnels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

Configuring GRE Tunnels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

GRE Tunnel Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

High Availability GRE Tunnels . . . . . . . . . . . . . . . . . . . . . . . . . 122

HA GRE Tunnel Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

DVMRP Tunnels. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

DVMRP Tunnel Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

ARP Table Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

Configuring ARP for ATM Interfaces . . . . . . . . . . . . . . . . . . . . . . 130

Transparent Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

Limitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

Transparent Mode Processing Details . . . . . . . . . . . . . . . . . . . 133

Configuring Transparent Mode in VPN Environments . . . . . . . 134

Example of Transparent Mode . . . . . . . . . . . . . . . . . . . . . . . . . 135

Configuring Transparent Mode . . . . . . . . . . . . . . . . . . . . . . . . . 136

Monitoring Transparent Mode Groups . . . . . . . . . . . . . . . . . . . 139

Transparent Mode and Check Point NGX . . . . . . . . . . . . . . . . 139

Virtual Tunnel Interfaces (FWVPN) for Route-Based VPN . . . . . 140

Creating Virtual Tunnel Interfaces. . . . . . . . . . . . . . . . . . . . . . . 142

3 Configuring System Functions . . . . . . . . . . . . . . . . . . . . . . . . 145

Configuring DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

Configuring DHCP Client Interfaces . . . . . . . . . . . . . . . . . . . . . 146

DHCP Client Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146

Configuring the DHCP Server. . . . . . . . . . . . . . . . . . . . . . . . . . 147

DHCP Server Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

8 Nokia Network Voyager IPSO 4.0 Reference Guide

Changing DHCP Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Adding DHCP Address Pools . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Enabling or Disabling DHCP Address Pools. . . . . . . . . . . . . . . 150

Assigning a Fixed-IP Address to a Client . . . . . . . . . . . . . . . . . 150

Creating DHCP Client Templates . . . . . . . . . . . . . . . . . . . . . . . 151

Configuring Dynamic Domain Name System Service. . . . . . . . 153

Configuring the Domain Name Service . . . . . . . . . . . . . . . . . . . . 154

Configuring Disk Mirroring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

Using an Optional Disk (Flash-Based Systems Only) . . . . . . . . . 155

Mail Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

System Failure Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

Configuring Mail Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

Sending Mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

Setting the System Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

Configuring Host Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

Configuring System Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

Configuring Logging on Disk-Based Systems. . . . . . . . . . . . . . 160

Configuring Logging on Flash-Based Systems. . . . . . . . . . . . . 161

Configuring Audit Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Remote Core Dump Server on Flash-Based Systems. . . . . . . . . 165

Changing the Hostname . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

Managing Configuration Sets. . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

Scheduling Jobs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

Backing Up and Restoring Files. . . . . . . . . . . . . . . . . . . . . . . . . . 168

Creating Backup Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

Transferring Backup Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

Restoring Files from Locally Stored Backup Files. . . . . . . . . . . 172

Managing Nokia IPSO Images. . . . . . . . . . . . . . . . . . . . . . . . . . . 173

Changing Current Image. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

Deleting Images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

Installing New Images. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

Testing a New Image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

Upgrading Nokia IPSO Images for a Cluster. . . . . . . . . . . . . . . 176

Nokia Network Voyager IPSO 4.0 Reference Guide 9

Downgrading Nokia IPSO Images. . . . . . . . . . . . . . . . . . . . . . . 176

Configuring Monitor Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

Managing Packages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

Installing and Enabling Packages . . . . . . . . . . . . . . . . . . . . . . . 178

Advanced System Tuning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

Tuning the TCP/IP Stack. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

Router Alert IP Option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181

4 Virtual Router Redundancy Protocol (VRRP) . . . . . . . . . . . . . 183

VRRP Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

How VRRP Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

Understanding Monitored-Circuit VRRP. . . . . . . . . . . . . . . . . . . . 186

Configuring VRRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Selecting Configuration Parameters . . . . . . . . . . . . . . . . . . . . . 187

Before you Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

Configuring Monitored-Circuit VRRP. . . . . . . . . . . . . . . . . . . . . 192

Configuring VRRPv2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

Configuring Check Point NGX for VRRP . . . . . . . . . . . . . . . . . . . 197

Configuring VRRP Rules for Check Point NGX . . . . . . . . . . . . 199

Link Aggregation (IP2250 Systems Only) . . . . . . . . . . . . . . . . . 201

Monitoring VRRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

Monitoring the Firewall State. . . . . . . . . . . . . . . . . . . . . . . . . . . 203

Troubleshooting VRRP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

General Configuration Considerations . . . . . . . . . . . . . . . . . . . 203

Firewall Policies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204

Access Control Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204

Switched Environments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

5 Configuring Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

IP Clustering Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

Using Flash-Based Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . 207

Example Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208

Cluster Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

10 Nokia Network Voyager IPSO 4.0 Reference Guide

Cluster Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

Clustering Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

Considerations for Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . 214

If You Do Not Use a Dedicated Primary Cluster

Protocol Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

Upgrading IPSO in a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

For All Upgrades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

Upgrading from IPSO 3.7 or Later. . . . . . . . . . . . . . . . . . . . . . . 218

Upgrading from IPSO 3.6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

Creating and Configuring a Cluster . . . . . . . . . . . . . . . . . . . . . . . 220

Configuration Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

Creating a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

Selecting the Cluster Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

Configuring the Work Assignment Method . . . . . . . . . . . . . . . . 221

Configuring an Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222

Configuring Firewall Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . 223

Supporting Non-Check Point Gateways and Clients. . . . . . . . . 223

Configuring Join-Time Shared Features . . . . . . . . . . . . . . . . . . 226

Making the Cluster Active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229

Adding a Node to a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229

Recommended Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

Joining a System to a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . 231

Managing a Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231

Using Cluster Voyager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232

Synchronizing the Time on Cluster Nodes . . . . . . . . . . . . . . . . 239

Configuring NGX for Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . 241

Clustering Example (Three Nodes) . . . . . . . . . . . . . . . . . . . . . . . 243

Configuring the Cluster in Voyager . . . . . . . . . . . . . . . . . . . . . . 244

Configuring the Internal and External Routers . . . . . . . . . . . . . 245

Clustering Example With Non-Check Point VPN . . . . . . . . . . . 246

Nokia Network Voyager IPSO 4.0 Reference Guide 11

6 Configuring SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

SNMP Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

SNMP Proxy Support for Check Point MIB . . . . . . . . . . . . . . . . . 252

Using the Check Point MIB . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Using cpsnmp_start. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Enabling SNMP and Selecting the Version . . . . . . . . . . . . . . . . . 254

Configuring the System for SNMP . . . . . . . . . . . . . . . . . . . . . . . . 255

Setting an Agent Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255

Configuring Traps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256

Interpreting Error Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260

Configuring SNMPv3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262

Request Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263

Managing SNMP Users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263

7 Configuring IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

IPv6 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

IPv6 and IPv4 Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270

Configuring IPv6 in IPv4 Tunnels . . . . . . . . . . . . . . . . . . . . . . . 270

Configuring IPv6 to IPv4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

Configuring IPv6 over IPv4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

Configuring IPv4 in IPv6 Tunnels . . . . . . . . . . . . . . . . . . . . . . . 272

Configuring an IPv6 Default or Static Route . . . . . . . . . . . . . . . 272

Routing Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273

Configuring OSPFv3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273

Configuring RIPng. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273

Creating IPv6 Aggregate Routes. . . . . . . . . . . . . . . . . . . . . . . . 273

Creating Redistributed Routes . . . . . . . . . . . . . . . . . . . . . . . . . 274

Router Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

Configuring ICMPv6 Router Discovery . . . . . . . . . . . . . . . . . . . 275

VRRP for IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

Configuring VRRP for IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

Creating a Virtual Router for an IPv6 Interface

12 Nokia Network Voyager IPSO 4.0 Reference Guide

Using VRRPv3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278

Creating a Virtual Router to Back Up Another VRRP

Router Addresses Using VRRPv3 . . . . . . . . . . . . . . . . . . . . . 278

Monitoring the Firewall State. . . . . . . . . . . . . . . . . . . . . . . . . . . 279

Setting a Virtual MAC Address for a Virtual Router. . . . . . . . . . 280

Changing the IP Address List of a Virtual Router in VRRPv3. . 281

Removing a Virtual Router in VRRPv3 . . . . . . . . . . . . . . . . . . . 281

Creating a Virtual Router in Monitored Circuit Mode for IPv6 . . 282

Setting Interface Dependencies for a Monitored Circuit

Virtual Router for IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283

Changing the List of Addresses in a Monitored Circuit

Virtual Router for IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284

Traffic Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284

Security and Access Configuration . . . . . . . . . . . . . . . . . . . . . . . 285

8 Managing Security and Access . . . . . . . . . . . . . . . . . . . . . . . . 287

Managing Passwords. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287

Managing User Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288

Adding and Deleting Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

Managing and Using S/Key. . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

Managing Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292

Role-Based Administration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

Managing Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294

Assigning Roles and Access Mechanisms to Users. . . . . . . . . 295

Creating Cluster Administrator Users . . . . . . . . . . . . . . . . . . . . 296

Configuring Network Access and Services . . . . . . . . . . . . . . . . . 297

Configuring a Modem on COM2, COM3, or COM4. . . . . . . . . . 298

Configuring Nokia Network Voyager Access . . . . . . . . . . . . . . . . 300

Configuring Basic Nokia Network Voyager Options . . . . . . . . . 301

Generating and Installing SSL/TLS Certificates . . . . . . . . . . . . 302

Secure Shell (SSH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304

Initial SSH Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305

Configuring Advanced Options for SSH . . . . . . . . . . . . . . . . . . 306

Nokia Network Voyager IPSO 4.0 Reference Guide 13

Configuring Secure Shell Authorized Keys . . . . . . . . . . . . . . . . 308

Changing Secure Shell Key Pairs. . . . . . . . . . . . . . . . . . . . . . . 309

Managing User RSA and DSA Identities. . . . . . . . . . . . . . . . . . 310

Tunneling HTTP Over SSH. . . . . . . . . . . . . . . . . . . . . . . . . . . . 311

Network Voyager Session Management . . . . . . . . . . . . . . . . . . . 311

Enabling Enabling or Disabling Session Management . . . . . . . 312

Configuring Session Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . 312

Authentication, Authorization, and Accounting (AAA) . . . . . . . . . 313

Creating an AAA Configuration. . . . . . . . . . . . . . . . . . . . . . . . . 313

Configuring RADIUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

Configuring TACACS+ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321

Deleting an AAA Authentication Server Configuration . . . . . . . 322

Changing an AAA Configuration . . . . . . . . . . . . . . . . . . . . . . . . 323

Deleting an AAA Configuration . . . . . . . . . . . . . . . . . . . . . . . . . 327

Encryption Acceleration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327

Enabling Encryption Accelerator Cards. . . . . . . . . . . . . . . . . . . 328

Monitoring Cryptographic Acceleration . . . . . . . . . . . . . . . . . . . 328

IPSec Tunnels (IPSO Implementation) . . . . . . . . . . . . . . . . . . . . 328

Using PKI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332

IPSec Implementation in IPSO . . . . . . . . . . . . . . . . . . . . . . . . . 332

IPSec Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334

Creating an IPSec Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335

Creating an IPSec Tunnel Rule. . . . . . . . . . . . . . . . . . . . . . . . . 341

Transport Rule. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342

IPSec Tunnel Rule Example . . . . . . . . . . . . . . . . . . . . . . . . . . . 344

IPSec Transport Rule Example. . . . . . . . . . . . . . . . . . . . . . . . . 346

Changing the Local/Remote Address or Local/Remote

Endpoint of an IPSec Tunnel . . . . . . . . . . . . . . . . . . . . . . . . . 348

Removing an IPSec Tunnel. . . . . . . . . . . . . . . . . . . . . . . . . . . . 348

Miscellaneous Security Settings. . . . . . . . . . . . . . . . . . . . . . . . . . 349

9 Configuring Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351

Routing Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351

14 Nokia Network Voyager IPSO 4.0 Reference Guide

Routing Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351

Route Maps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353

OSPF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353

Types of Areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354

Area Border Routers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355

High Availability Support for OSPF . . . . . . . . . . . . . . . . . . . . . . 355

Configuring OSPF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356

RIP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365

RIP 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365

RIP 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366

Virtual IP Address Support for VRRP . . . . . . . . . . . . . . . . . . . . 366

Configuring RIP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367

Configuring RIP Timers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368

Configuring Auto-Summarization . . . . . . . . . . . . . . . . . . . . . . . 369

RIP Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369

PIM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370

Configuring Virtual IP Support for VRRP. . . . . . . . . . . . . . . . . . 371

PIM Support for IP Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . 371

Configuring Dense-Mode PIM. . . . . . . . . . . . . . . . . . . . . . . . . . 373

Disabling PIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374

Setting Advanced Options for Dense-Mode PIM (Optional) . . . 375

Configuring Sparse-Mode PIM . . . . . . . . . . . . . . . . . . . . . . . . . 376

Configuring High-Availability Mode . . . . . . . . . . . . . . . . . . . . . . 377

Configuring this Router as a Candidate Bootstrap and

Candidate Rendezvous Point. . . . . . . . . . . . . . . . . . . . . . . . . 379

Configuring a PIM-SM Static Rendezvous Point. . . . . . . . . . . . 380

Setting Advanced Options for Sparse-Mode PIM (Optional). . . 381

Debugging PIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383

IGRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385

Generation of Exterior Routes. . . . . . . . . . . . . . . . . . . . . . . . . . 387

Aliased Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388

IGRP Aggregation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388

Nokia Network Voyager IPSO 4.0 Reference Guide 15

Configuring IGRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388

DVMRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 390

Configuring DVMRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391

Configuring DVMRP Timers . . . . . . . . . . . . . . . . . . . . . . . . . . . 391

IGMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392

Configuring IGMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393

Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394

Adding and Managing Static Routes Example . . . . . . . . . . . . . 397

Backup Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398

Route Aggregation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398

Route Aggregation Example . . . . . . . . . . . . . . . . . . . . . . . . . . . 400

Route Rank . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401

Rank Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401

Routing Protocol Rank Example . . . . . . . . . . . . . . . . . . . . . . . . 402

BGP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403

Support for BGP-4++. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403

BGP Sessions (Internal and External). . . . . . . . . . . . . . . . . . . . 404

BGP Path Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404

BGP Multi-Exit Discriminator. . . . . . . . . . . . . . . . . . . . . . . . . . . 406

BGP Interactions with IGPs. . . . . . . . . . . . . . . . . . . . . . . . . . . . 406

Inbound BGP Route Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407

Redistributing Routes to BGP . . . . . . . . . . . . . . . . . . . . . . . . . . 407

Communities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407

Route Reflection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408

Confederations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409

EBGP Multihop Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410

Route Dampening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411

TCP MD5 Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411

BGP Support for Virtual IP for VRRP . . . . . . . . . . . . . . . . . . . . 412

BGP Support for IP Clustering . . . . . . . . . . . . . . . . . . . . . . . . . 413

BGP Memory Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . 413

BGP Neighbors Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415

Path Filtering Based on Communities Example . . . . . . . . . . . . 418

16 Nokia Network Voyager IPSO 4.0 Reference Guide

BGP Multi Exit Discriminator Example . . . . . . . . . . . . . . . . . . . 419

Changing the Local Preference Value Example . . . . . . . . . . . . 421

BGP Confederation Example . . . . . . . . . . . . . . . . . . . . . . . . . . 423

Route Reflector Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426

BGP Community Example. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428

EBGP Load Balancing Example: Scenario #1 . . . . . . . . . . . . . 430

EBGP Load Balancing Example: Scenario #2 . . . . . . . . . . . . . 432

Adjusting BGP Timers Example . . . . . . . . . . . . . . . . . . . . . . . . 433

TCP MD5 Authentication Example . . . . . . . . . . . . . . . . . . . . . . 434

BGP Route Dampening Example . . . . . . . . . . . . . . . . . . . . . . . 435

BGP Path Selection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436

BGP-4++ Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436

Route Redistribution. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 438

Redistributing Routes to BGP . . . . . . . . . . . . . . . . . . . . . . . . . . 439

Redistributing Routes to RIP and IGRP . . . . . . . . . . . . . . . . . . 440

Redistributing OSPF to BGP Example . . . . . . . . . . . . . . . . . . . 443

Redistributing Routes with OSPF . . . . . . . . . . . . . . . . . . . . . . . 444

Inbound Route Filters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445

BGP Route Inbound Policy Example. . . . . . . . . . . . . . . . . . . . . 446

BGP AS Path Filtering Example . . . . . . . . . . . . . . . . . . . . . . . . 448

10 Configuring Traffic Management . . . . . . . . . . . . . . . . . . . . . . . 449

Traffic Management Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . 449

Packet Filtering Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . 449

Traffic Shaping Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . 449

Traffic Queuing Description. . . . . . . . . . . . . . . . . . . . . . . . . . . . 450

Configuring Access Control Lists . . . . . . . . . . . . . . . . . . . . . . . . . 450

Configuring ACL Rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452

Modifying a Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453

Configuring Aggregation Classes. . . . . . . . . . . . . . . . . . . . . . . . . 455

Configuring Queue Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457

Configuring ATM QoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459

Configuring Common Open Policy Server. . . . . . . . . . . . . . . . . . 461

Nokia Network Voyager IPSO 4.0 Reference Guide 17

Configuring a COPS Client ID and Policy Decision Point . . . . . 462

Configuring Security Parameters for a COPS Client ID . . . . . . 462

Assigning Roles to Specific Interfaces . . . . . . . . . . . . . . . . . . . 463

Activating and Deactivating the COPS Client . . . . . . . . . . . . . . 464

Changing the Client ID Associated with Specific Diffserv

Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464

Deleting a Client ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464

Example: Rate Shaping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465

Example: Expedited Forwarding . . . . . . . . . . . . . . . . . . . . . . . . 466

11 Configuring Router Services . . . . . . . . . . . . . . . . . . . . . . . . . . 469

BOOTP/DHCP Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469

Configuring BOOTP/DHCP Relay. . . . . . . . . . . . . . . . . . . . . . . 470

IP Broadcast Helper. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471

Router Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472

Router Discovery Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . 473

Configuring Router Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . 473

Network Time Protocol (NTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . 475

Configuring NTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 476

12 Monitoring System Configuration and Hardware . . . . . . . . . . 479

Viewing System Utilization Statistics . . . . . . . . . . . . . . . . . . . . . . 479

CPU-Memory Live Utilization . . . . . . . . . . . . . . . . . . . . . . . . . . 479

Disk and Swap Space. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 480

Monitoring Process Utilization. . . . . . . . . . . . . . . . . . . . . . . . . . 480

IPSO Process Management . . . . . . . . . . . . . . . . . . . . . . . . . . . 481

Generating Monitor Reports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 482

Monitoring System Health . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483

Monitoring System Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484

Viewing Cluster Status and Members . . . . . . . . . . . . . . . . . . . . . 485

Viewing Routing Protocol Information . . . . . . . . . . . . . . . . . . . . . 486

Displaying the Kernel Forwarding Table . . . . . . . . . . . . . . . . . . 486

Displaying Route Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486

18 Nokia Network Voyager IPSO 4.0 Reference Guide

Displaying Interface Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . 487

Hardware Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487

Using the iclid Tool. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488

iclid Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488

Preventing Full Log Buffers and Related Console Messages . . . 494

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497

Nokia Network Voyager for IPSO 4.0 Reference Guide 19

About the Nokia Network

Voyager Reference Guide

This guide provides information about how to configure and monitor Nokia

IPSO systems. This guide provides conceptual information about system

features and instructions on how to perform tasks using Nokia Network

Voyager, the Web-based interface for IPSO. All of the tasks that you perform

with Network Voyager you can also perform with the command-line interface

(CLI), allowing you to choose the interface you are most comfortable with.

For information specific to the CLI, see the CLI Reference Guide for Nokia

IPSO.

This guide is intended for experienced network administrators who configure

and manage Nokia IP security platforms. It assumes a working knowledge of

networking and TCP/IP protocol principals and some experience with

UNIX-based systems.

This guide is organized into the following chapters:

 Chapter 1, “About Network Voyager” describes the IPSO operating

system, Nokia Network Voyager, how to use Network Voyager, and how

to access documentation and help pages.

 Chapter 2, “Configuring Interfaces” describes how to configure and

monitor interfaces.

 Chapter 3, “Configuring System Functions” describes how to configure

basic system functions such as DHCP, DNS, disk mirroring, mail relay,

system failure notification, system time, host entries, system logging, and

About the Nokia Network Voyager Reference Guide

20 Nokia Network Voyager for IPSO 4.0 Reference Guide

the hostname . It also describes how to save configuration sets, schedule

jobs, backup and restore files, manage and upgrade system images, reboot

the system, manage packages, and advanced system tuning.

 Chapter 4, “Virtual Router Redundancy Protocol (VRRP)” describes how

to provides dynamic failover of IP addresses using VRRP.

 Chapter 5, “Configuring Clustering” describes how to provide fault

tolerance and dynamic load balancing using clustering.

 Chapter 6, “Configuring SNMP” describes how to configure Simple

Network Management Protocol (SNMP), the protocol used to exchange

management information between network devices.

 Chapter 7, “Configuring IPv6” describes how to configure features that

use the IPv6 protocol.

 Chapter 8, “Managing Security and Access” desribes how to manage

passwords, user accounts and groups, assign privileges using role-based

administration, and how to configure network access, services, and

Network Voyager session management. It also describes how to configure

AAA for a new service, encryption acceleration, and virtual tunnel

interfaces (VTI), which support Check Point route-based VPN..

 Chapter 9, “Configuring Routing” describes the IPSO routing subsystem,

how to configure the various routing protocols that are supported, route

aggregation, and route redistribution.

 Chapter 10, “Configuring Traffic Management” describes traffic

management functionality, including access control lists and aggregation

classes.

 Chapter 11, “Configuring Router Services” describes how to enable your

system to forward broadcast traffic by enabling the IP Broadcast Helper,

forward BOOTP/DHCP traffic by enabling BOOTP relay, how to enable

router discovery, and how to configure for Network Time Protocol (NTP).

 Chapter 12, “Monitoring System Configuration and Hardware” provides

information on monitoring your system.

Page is loading ...

Nokia IPSO 4.0 User manual

Nokia IPSO 4.0 User manual

Related papers

Other documents