Specifications

ManualsBrandsEnterasys ManualsNetworkingEnterasys XSR-3020

8.5x11-inch cover with bleed on 4 sides

X-Pedition

™

Security Router

XSR-3020 Getting Started Guide

Version 3.0

P/N 9033866-05

Summary of content (110 pages)

PAGE 1
8.5x11-inch cover with bleed on 4 sides X-Pedition™ Security Router XSR-3020 Getting Started Guide Version 3.
PAGE 2
PAGE 3
Electrical Hazard: Only qualified personnel should perform installation procedures. Riesgo Electrico: Solamente personal calificado debe realizar procedimientos de instalacion. Elektrischer Gefahrenhinweis: Installationen sollten nur durch ausgebildetes und qualifiziertes Personal vorgenommen werden. Notice Enterasys Networks reserves the right to make changes in specifications and other information contained in this document and its web site without prior notice.
PAGE 4
Product Product Identifier NIM-T1/E1-xx, NIM-CT1E1/PRI-xx US: 5N5DENANET1 NIM-BRI-U-xx US: 5N5DENANEBU NIM-ADSL-AC-xx US: 5N5DL02NEAA NIM-DIRELAY-xx US: 5N5DENANEDI NIM-TE1-xx, NIM-CTE1-PRI-xx US: 5N5DENANECT A plug and jack used to connect the XSR to the premises wiring and telephone network must comply with the applicable FCC Part 68 rules and requirements adopted by ACTA. Refer to the following table and installation instructions for details.
PAGE 5
Users should ensure for their own protection that the electrical ground connections of the power utility, telephone lines and internal metallic water pipe system, if present, are connected together. This precaution may be particularly important in rural areas. Caution: Users should not attempt to make such connections themselves, but should contact the appropriate electric inspection authority, or electrician, as appropriate.
PAGE 6
European Waste Electrical and Electronic Equipment (WEEE) Notice In accordance with Directive 2002/96/EC of the European Parliament on waste electrical and electronic equipment (WEEE): 1. The symbol above indicates that separate collection of electrical and electronic equipment is required and that this product was placed on the European market after August 13, 2005, the date of enforcement for Directive 2002/96/EC. 2.
PAGE 7
Declaration of Conformity Application of Council Directive(s): Manufacturer’s Name: Manufacturer’s Address: European Representative Address: Conformance to Directive(s)/Product Standards: 89/336/EEC 73/23/EEC Enterasys Networks, Inc. 50 Minuteman Road Andover, MA 01810 USA Enterasys Networks, Ltd.
PAGE 8
Independent Communications Authority of South Africa This product complies with the terms of the provisions of section 54(1) of the Telecommunications Act (Act 103 of 1996) and the Telecommunications Regulation prescribed under the Post Office Act (Act 44 of 1958). TE-2002/195 TE-2002/190 APPROVED APPROVED TE-2003/112 TE-2003/113 APPROVED APPROVED SS/366.
PAGE 9
Enterasys Networks, Inc. Firmware License Agreement BEFORE OPENING OR UTILIZING THE ENCLOSED PRODUCT, CAREFULLY READ THIS LICENSE AGREEMENT. This document is an agreement (“Agreement”) between the end user (“You”) and Enterasys Networks, Inc.
PAGE 10
4. EXPORT RESTRICTIONS. You understand that Enterasys and its Affiliates are subject to regulation by agencies of the U.S. Government, including the U.S. Department of Commerce, which prohibit export or diversion of certain technical products to certain countries, unless a license to export the Program is obtained from the U.S. Government or an exception from obtaining such license may be relied upon by the exporting party.
PAGE 11
10. ENFORCEMENT. You acknowledge and agree that any breach of Sections 2, 4, or 9 of this Agreement by You may cause Enterasys irreparable damage for which recovery of money damages would be inadequate, and that Enterasys may be entitled to seek timely injunctive relief to protect Enterasys’ rights under this Agreement in addition to any and all remedies available at law. 11. ASSIGNMENT.
PAGE 12
x
PAGE 13
Contents Preface Contents of the Guide .......................................................................................................................................xv Conventions Used in This Guide (Convenciones Usadas en Esta Guía) .........................................................xv Getting Help .................................................................................................................................................... xvii Chapter 1: Overview System Description ..
PAGE 14
Configuring the WAN Ports ............................................................................................................................ 3-8 PRI Configuration ..................................................................................................................................... 3-8 BRI Configuration ..................................................................................................................................... 3-9 BRI Leased Line .............................
PAGE 15
bu ........................................................................................................................................................... 3-36 bU ........................................................................................................................................................... 3-36 cd ........................................................................................................................................................... 3-36 copy ...............
PAGE 16
xiv
PAGE 17
Preface This guide provides a general overview of the XSR-3020 hardware and software features and describes how to quickly install and configure the XSR. Refer to the XSR CLI Reference Guide and XSR User’s Guide for information not contained in this document. This guide is written for administrators who want to configure the X-Pedition Security Router or experienced users who are knowledgeable of basic networking principles.
PAGE 18
Electrical Hazard: Warns against an action that could result in personal injury or death due to an electrical hazard. Riesgo Electrico: Advierte contra una acción que pudiera resultar en lesión corporal o la muerte debido a un riesgo eléctrico. Elektrischer Gefahrenhinweis: Installationen sollten nur durch ausgebildetes und qualifiziertes. Personal vorgenommen werden. Warning: Warns against an action that could result in personal injury or death.
PAGE 19
Getting Help For additional support related to the XSR, contact Enterasys Networks by one of these methods: World Wide Web http://www.enterasys.com Phone (978) 684-1000 1-800-872-8440 (toll-free in U.S. and Canada) For the Enterasys Networks Support toll-free number in your country: http://www.enterasys.com/support/gtac-all.html Internet mail support@enterasys.com To expedite your message, please type [xsr] in the subject line. FTP ftp://ftp.enterasys.
PAGE 20
xviii
PAGE 21
1 Overview This chapter introduces the key features of the XSR-3020 and briefly describes hardware installation. System Description The XSR is a networking device designed for enterprise regional offices that provides IP routing over GigabitEthernet LAN and T1/E1, Serial (RS232, X.21, V.35, RS422/530, RS449), Dial Services via POTS, ISDN (BRI/PRI) or Frame Relay WAN connections. Virtual Private Network (VPN) support is also provided in Site-to-Site or Remote Access applications.
PAGE 22
System Description Figure 1-1 Typical XSR-3020 Topology XSR-3020 Regional site backup: modem pool (3rd party RAS) PSTN (for PPP) Network Primary link: T1/E1 or serial interface running PPP XSR-3020 IP subnet PSTN Link backup with PPP via external async modem Authenticate incoming PPP connection with local authentication database XSR-3020 IP subnet Hardware Features The semi-modular XSR, shown in Figure 1-2, comes equipped with the following features: 1-2 Overview • Standard 1U chassis (1 11/16
PAGE 23
System Description Figure 1-2 SE CU RITY XS R-3 XSR-3020 RO UT ER S 02 0 NIM 1 NIM 2 NIM 1 NIM 2 SY S PW R VP N CO M CO M Lin k 10 00 TX GB 10 /10 0/1 00 0 10 IC /10 ET H1 ET H2 • 0/1 00 0 ET H3 Two Network Interface Module (NIM) slots for these optional cards: • 1, 2, or 4 full, fractional and channelized T1/E1 WAN NIM with integral CSU/DSU or Primary Rate Interface (PRI) ports (RJ-48C). • 1-port T3/E3 channelized/unchannelized WAN NIM with BNC ports.
PAGE 24
System Description • 14 diagnostic LEDs to display port, and system status as well as indicate a Flash upgrade in progress. • Five system fans with failure detection capability and three fans dedicated to power supply cooling.
PAGE 25
System Description • Simple Network Time Protocol (SNTP) server • OS fallback IP Routing • Static and multiple routes to the same destination • Redistribution of routes from RIP, OSPF, BGP, connected, or static into RIP, OSPF, and BGP • RIP-1 & RIP-2 • Open Shortest Path First Protocol (OSPF) • OSPF over Generic Routing Encapsulation (GRE): RFC-2784 • Virtual Router Redundancy Protocol (VRRP) • Configurable administrative distance (route preference) per protocol for RIP, OSPF and BGP, and
PAGE 26
System Description Security • Stateful inspection firewall engine • FTP, H.
PAGE 27
System Description • Periodic Keep-Alive messages to learn of connection problems • Multi-protocol interconnect over Frame Relay - RFC-2427 • RFC-2390 Frame Relay Inverse ARP to discover IP address of remote peer when used in multipoint mode and responds to incoming Inverse ARP requests independent of P2P or MP2P • Multiple logical interfaces over the same physical Frame Relay port: sub-interfaces • Quality of Service: standard FIFO queuing, or IP QoS on DLCIs.
PAGE 28
System Description • Bandwidth optimization (BoD) & Dial on Demand (DoD) • Bandwidth Allocation Protocol (BAP) • Security: PAP/CHAP • Call monitoring • Multilink PPP (MLPPP) • Per call activation for NTT switches • Frame Relay over ISDN Quality of Service (QoS) • Traffic classification using IP Precedence and DiffServ Code Point (DSCP) bits, and multiplefield (L3, L4 and other headers) inspection. Match-any and match-all options also define a classmap.
PAGE 29
System Description Certificates (embedded/smart cards) – Microsoft only • Encryption • Advanced Encryption Standard (AES), Triple Data Encryption Standard (3DES), Data Encryption Standard (DES) • 3DES/DES acceleration • Data Integrity • MD5 & SHA-1 algorithms • Internet Protocol Security (IPsec) • Encapsulating Security Payload (ESP), Authentication Header (AH) & IPComp • Tunnel & Transport mode • Diffie-Hellman Groups 1 & 2 • Mode Config for IP address assignment • NAT Traversal via UDP encapsulation
PAGE 30
System Description Asynchronous Digital Subscriber Line (ADSL) • POTS and ISDN circuit support • ATM Frame UNI (FUNI) data framing format • OAM cells: AIS, RDI, CC, Loopback over F4 and F5 flows • Up to 30 ATM Permanent Virtual Circuits (PVCs) • ATM UBR traffic class • ATM Adaption Layers 0, 5 • PDU encapsulation types: • PPP over ATM (PPPoA) (routed) • IP over ATM (routed) • PPP over Ethernet over ATM (PPPoE) (routed) • Responds to inverse ARP requests • Maintenance of SNMP Interface and
PAGE 31
Installation Overview • Switched PPP Multilink connections • Backup using ISDN & MLPPP connections • Dialer interface spoofing • Dialer watch Installation Overview Installing the XSR consists of performing the following general steps. For detailed instructions, refer to Chapters 2 and 3 of this manual. 1. Unpack the XSR from the shipping box. Remove accessories. Items included in the shipping box are shown in Chapter 2 of this manual.
PAGE 32
Installation Overview 1-12 Overview
PAGE 33
2 Hardware Installation Introduction This chapter provides a checklist to verify your shipment, suggestions for the installation site, and describes how to install the following XSR hardware: • NIM cards • Optional - CompactFlash card (standard with ADSL NIM) • Connecting cables Note: For instructions on installing a balun and grounding shunt/terminal strip on E1 NIM cards only, refer to Appendix A: Specifications on page 1.
PAGE 34
Installing NIM Cards and Rack Mounting • Each XSR AC power supply requires a three-pronged power receptacle capable of delivering the current and voltage specified in Appendix A. An AC outlet on a separately fused circuit is required for each XSR to provide power redundancy, and must be located within 182 centimeters (6 feet) from the site. The power cord used and type of outlet is dependent on the country. In the United States, a power cord with a NEMA 5-15P plug is provided with each XSR.
PAGE 35
Installing NIM Cards and Rack Mounting 4. Remove the NIM slot cover, as shown in Figure 2-2, by grasping the handle and pulling it to the side before taking it out. Figure 2-2 Removing NIM Slot Cover SE CU RIT YR OU TE RS XS R- 30 20 NIM 1 NIM 5. 2 Gently attach the NIM card(s) to the connector on the motherboard and secure with four screws, as shown in Figure 2-3.
PAGE 36
Installing NIM Cards and Rack Mounting 7. Attach the rack brackets to the chassis with the screws supplied, as shown in Figure 2-4. Figure 2-4 SE CU Fastening Rack Brackets Y RO XS R-3 UTERS 02 0 RIT NIM 1 NIM 2 NIM1 NIM2 SY S PW R VP N CO M Lin k CO M 10 00 10 TX GB /100 /100 0 10 IC ET H1 /100 ET H2 8. /100 Mount the bracketed XSR to your rack, as shown in Figure 2-5.
PAGE 37
Installing a CompactFlash Memory Card Installing a CompactFlash Memory Card An optional CompactFlash (CF) memory card provides additional non-volatile storage capabilities in various increments. The CF’s controller interfaces with a host system allowing data to be written to and read from the CF’s flash memory module. The XSR supports Type I and II CompactFlash card types. Refer to Figure 2-6 for a generic illustration of the card. The CF’s memory is large enough to store image files.
PAGE 38
Installing a CompactFlash Memory Card 2. Seat the card in the PCMCIA interface as shown in Figure 2-8. Gently insert the CF into the slot, taking care that the CF’s wider grooved edge fits into the wider track of the PCMCIA interface. If the card does not seat easily but stops halfway into the slot, do not force it in - the card was inserted incorrectly. Flip it over and re-insert. Note that the XSR’s CF eject mechanism pops out for easy removal when you install the card.
PAGE 39
Connecting Cables Connecting Cables Perform any of the following steps to connect your cabling to optional WAN or LAN NIMs, GigabitEthernet ports, and power supply: 1. Connect the serial COM cable provided in the packing box to your PC connector, as shown in Figure 2-9. Figure 2-9 CO Connecting Serial COM (Console) Cable Lin M k 10 00 TX 10 /10 0/1 00 GB 0 10 /10 IC ET H1 0/1 00 0 ET H2 ET H3 2.
PAGE 40
Connecting Cables Figure 2-11 Connecting High Speed Serial Connector SE CU RIT YR OU TE RS XS R- 30 20 NIM 1 NIM Figure 2-12 Attaching T3/E3 BNC Connectors SE CU RIT XS R- YR OU T 30 20 ER S Tx NIM AL 1 AR M LO S EN AB LE LO F Rx id NIM 2-8 Hardware Installation 2 2
PAGE 41
Connecting Cables Figure 2-13 SE XS CU R- RIT YR OU 30 TE 20 Connecting ADSL Connector RS NIM STATUS 1 DATA NIM ADSL-AC-01 NIM 2 A CompactFlash card is provided with the XSR ADSL NIM. It is loaded with the Digital Signal Processing (DSP) firmware (adsl.fls) required to communicate with your DSLAM. When inserted into the Compact Flash slot - upon first configuring an ATM interface - the XSR’s ADSL driver will copy adsl.fls into host memory where it will remain available for use on demand.
PAGE 42
Connecting Cables 3. Connect the Ethernet port(s) to your LAN connectors with a cable, as shown in Figure 2-15. Figure 2-15 CO M Lin k 10 00 TX 10 /10 Attaching Ethernet Connector 0/1 00 0 GB 10 /10 IC 0/1 ET H1 00 0 ET H2 ET H3 4. Insert the Mini-GBIC module in the GBIC slot then connect the optical cable, as shown in Figure 2-16.
PAGE 43
Connecting Cables Attach either the Ethernet or Fiber Ethernet LAN NIM, as shown in Figure 2-17 and Figure 2-18, respectively. Figure 2-17 SE CU XS Attaching Ethernet LAN NIM Connector RIT R- YR OU TE 30 20 RS NIM 1 NIMETHR01 LINK ACT NIM CU R- RIT YR OU 30 TE 20 RS NIM 1 NIMFIBR01 SE XS Attaching Ethernet Fiber LAN NIM Connector ACT Figure 2-18 2 LINK 5.
PAGE 44
Connecting Cables 6. Attach the power supply cord to the connector at the rear of the XSR, as shown in Figure 2-19 and plug in the country-specific power cord connects to a wall socket. The XSR will power up. Figure 2-19 Connecting Power Supply Cord 10 LIN 0 20 ~125 E 0~ V 24 ~1 .2 0 50 V~0 5A /60 .65 Hz A You are now ready to configure the software and initialize the XSR. Continue with Chapter 3, Software Configuration.
PAGE 45
3 Software Configuration This chapter describes how to initialize, quickly set up and verify your configuration for the XSR. Refer to the XSR CLI Reference Guide for a more thorough explanation of commands and parameter options. The chapter also includes sample configuration scripts, detailed XSR rebooting characteristics and Bootrom Monitor mode instructions.
PAGE 46
Initializing XSR Software • ETH 10/100/1000 LEDs turn ON and OFF a few times during initialization as the XSR proceeds from bootrom to power up diagnostics to software image, then they remain ON or OFF depending on the LAN type. • ETHERNET Activity LEDs blink when frames pass on the LAN. • COM Activity LED is OFF until the CLI comes up. Then it blinks ON/OFF during console keyboard input or output. • NIM LEDs are OFF until the CLI comes up.
PAGE 47
Opening a COM (Console) Session first error will be reported, along with a count of the sum of errors incurred. In the case of a single error, only the error line will be reported. Error messages will be logged as well. Because the result of continuing to process a flawed startup-config is not predictable, the nature and position of the syntax error may cause the erroneous configuration of the XSR. • Router ports and protocol stacks are initialized based on startup configuration.
PAGE 48
Optional: Configuring Remote Auto Install same node - 10.10.1.2 (configuration of DNS and TFTP servers are not shown here). In short, the DNS server should map IP addresses 133.133.1.2 and 133.133.1.3 to hostnames. On the TFTP server, you should create a startup-config file with names -config in a directory accessible by TFTP. XSR(config)#interface serial 1/0.1 multi-point XSR(config-if)#ip helper-address 10.10.1.2 XSR(config-if)#ip address 133.133.1.1 XSR(config-if
PAGE 49
Optional: Configuring Remote Auto Install ****************** REMOTE AUTO INSTALL TERMINATING***************** + The RAI process is complete and is preoceding to system initialization where it will process the new startupconfig file. Configuring RAI for DHCP over LAN The following example configures DHCP server to be used with RAI over Ethernet. Note that there is no need for a DNS server because the startup-config name is provided by the DHCP server.
PAGE 50
Optional: Configuring Remote Auto Install virtual-template 1 pppoe limit per-mac 10 + This is an optional command. pppoe limit max-sessions 32000 + This is an optional command. interface GigabitEthernet1/0/0 no ip address negotiation auto ! interface GigabitEthernet1/0/0.10 encapsulation dot1Q 20 pppoe enable pppoe max-sessions 10 + Optional. This command enables PPPoE and allows PPPoE sessions to be created through this sub-interface.
PAGE 51
Configuring the XSR Name and User Information + The XSR waits one minute for the PPPoE connection to come up. Phase 4 - ADSL - IP is connected on 0/35, prepare to load startup config + The XSR starts downloading the startup-file. Phase 6 - ATM/ADSL - retrieving file 0000019876543210-confg from tftp server 25 5.255.255.255 + The startup-config name is the serial number of the XSR. Phase 7 - preparing node to execute startup-config Configuring the XSR Name and User Information 1.
PAGE 52
Configuring the LAN Ports XSR(config)#sntp-server enable Remember to save your configuration after all edits. Configuring the LAN Ports 1. Enter interface gigabitethernet <1 | 2 | 3> to acquire Interface mode and select the first, second or third GigabitEthernet port. 2. Enter ip address where x is the IP address and y is the subnet mask of this GigabitEthernet port. 3. Enter no shutdown to keep the interface enabled. 4.
PAGE 53
Configuring the WAN Ports The value you set must match the type and format offered by your service provider and must correlate with the NIM card you are configuring: sf or esf for T1 cards, and crc4 or no-crc4 for E1 cards. 7. Enter linecode to configure the encoding type. This setting must match your service provider’s linecode type and type of NIM card installed: B8ZS for T1 only, HDB3 for E1 only, and AMI for both T1/E1. 8.
PAGE 54
Configuring the WAN Ports 3. Enter no shutdown to keep the BRI interface enabled. 4. Enter frame-relay lmi-type to select the Local Management Interface type. 5. Enter interface bri 0:<1 | 2>.<1-30> multi-point to acquire BRI Sub-interface mode and select the BRI port, channel, and sub-interface. 6. Enter ip address /24 to set an IP address for the BRI interface. 7.
PAGE 55
Configuring the WAN Ports ADSL Configuration ADSL can be configured using three different types of encapsulation: PPPoA, PPPoE, and IPoA. Continue configuration with the ADSL type of your choice. PPPoE The following commands configure a sample PPPoE topology. The first set configures the LAN interface with directed broadcasts prohibited. XSR(config)#interface XSR(config-if)#ip XSR(config-if)#no XSR(config-if)#no FastEthernet 1 address 192.168.1.1 255.255.255.
PAGE 56
Firewall Sample Configuration The commands below configure the ATM interface and sub-interface with a negotiated IP address, CHAP username and password, and bans keepalives. XSR(config)#interface ATM 0 XSR(config-if)#no shutdown XSR(config-if)#interface ATM 0.1 XSR(config-if)#no shutdown XSR(config-if)#encapsulation snap pppoa XSR(config-if)#ip address negotiated XSR(config-if)#ip mtu 1492 XSR(config-if
PAGE 57
Firewall Sample Configuration Figure 3-1 XSR with Firewall Topology 220.150.2.32/28 Internet Frame Relay S1 206.12.44.16/28 XSR-3020 FE2 220.150.2.17 220.150.2.35 FE1 220.150.2.37 Internal 220.150.2.36 220.150.2.16/28 DMZ Mail server (SMTP) 220.150.2.18 Web server (HTTP) 220.150.2.19 In this configuration, the firewall provides protected access from the private to dmz networks. That is, access is restricted to Web and mail traffic only.
PAGE 58
Setting Up RIP Routing Trial load the completed configuration into the firewall engine, and if successful, load the configuration: XSR(config)#ip firewall load trial XSR(config)#ip firewall load Complete LAN and WAN interface configuration: XSR(config)#interface gigabitethernet 1 XSR(config-if)#ip address 220.150.2.35 255.255.255.0 XSR(config-if)#no shutdown XSR(config)#interface gigabitethernet 2 XSR(config-if)#ip address 220.150.2.17 255.255.255.
PAGE 59
Configure OSPF Routing 12. Enter network (IP address) of the network to be advertised. Repeat the command to configure additional networks. 13. Enter passive-interface type num if you want to prevent RIP transmissions on the interface. 14. Enter no receive-interface if you want to disable reception of RIP updates on the interface. Remember to save your configuration after all edits. For more RIP configuration examples, refer to the XSR User’s Manual.
PAGE 60
Setting Up an SNMP Community String, Traps and V3 Values 7. Enter map-class frame-relay to designate this map-class and acquire Map-Class mode. 8. Enter frame-relay cir out to set the outgoing CIR (the default is 56000 bps). Refer to the XSR User’s Guide for more details. 9. Enter frame-relay bc out to set the Burst size for this map-class. Refer to the XSR User’s Manual for further directions. 10. Enter frame-relay be out to set the excess Burst site for this map-class.
PAGE 61
Configuring Message Logging and Severity Level Groups offer users authorization choices and read/write privileges. Note: Because only one operator can set the XSR at any time, you must exit Global mode to perform SNMPv3 configuration. Otherwise, the SNMP set request will fail with the “resource unavailable” message. This rule applies to configuration values, not image downloads. 6. Optional. For SNMPv3, enter snmp-server view {oid-tree | treeEntryName}{included | excluded} to specify a view.
PAGE 62
Connecting Remotely via the Web Connecting Remotely via the Web 1. Enter configure to acquire Configuration mode. 2. Enter ip http server enable to access the XSR over the Web. 3. Point your terminal’s Web browser at the XSR’s IP address. Enter http://. The initial Web access window appears as shown in Figure 3-2. Figure 3-2 Initial Web Access Window STATUS * Product Version * X-Pedition Products X-Pedition Security Router XSR © 2004 Enterasys Networks.
PAGE 63
Connecting Remotely via the Web Click on Product Version to bring up the Product Version window for a host of hardware, bootrom, and software information as shown in Figure 3-3. Figure 3-3 Web Product Version Window Product Version Copyright 2004 by Enterasys Networks, Inc. Hardware: Processor board ID: 9002854-02 REV0A Serial Number: (not displayed) Processor: IBM PowerPC 405GP Rev.
PAGE 64
LAN-PPP Services Sample Configuration LAN-PPP Services Sample Configuration The sample configuration below, see Figure 3-4, creates a PPP, fractional T1 leased line connection from the XSR branch node to the Central Site router and a backup serial dialup link to the Backup Site regional router. Figure 3-4 Hostname: Username: Password: Sample LAN-PPP Services Configuration branch1 mainsite Toronto Hostname: Username: Password: mainsite branch1 Toronto 192.168.1.100/24 XSR-3020 154.168.1.
PAGE 65
Frame Relay WAN Link with PPP Backup Sample Configuration XSR(config-controller)#no shutdown + Enables T1 controller XSR(config)#interface serial 1/0:0 + Configures Serial interface 1, port 1 using channel group 0 and acquires Interface mode XSR(config-if)#encapsulation ppp + Enables PPP encapsulation XSR(config-if)#ppp authentication chap + Configures CHAP authentication on the interface XSR(config-if)#ip address 154.68.1.47 255.255.255.
PAGE 66
Frame Relay WAN Link with PPP Backup Sample Configuration Configure Users and Passwords XSR(config)#username bob password cleartext bobspassword + Adds a user and unencrypted password Configure LAN Interface XSR(config)#interface gigabitethernet 1 + Configures the local LAN port and acquires Interface mode XSR(config-if)#ip address 192.168.1.100 255.255.255.
PAGE 67
Frame Relay WAN Link with PPP Backup Sample Configuration XSR(config-pmap-c)#priority medium 20 6400 + Gives medium priority queue a peak 20% of bandwidth & burst size of 6400 bits per second XSR(config)#policy-map data_policy + Adds a policy map and acquires Policy Map mode XSR(config-pmap)#class data_class + Adds a queue for this policy map and acquires Class sub-mode XSR(config-pmap-c)#police 24000 2400 4800 conform-action transmit exceed-action set-dscp-transmi
PAGE 68
Frame Relay WAN Link with PPP Backup Sample Configuration Apply QoS XSR(config)#map-class frame-relay CLASS-FRP + Adds a FR map class and acquires FR Map Class mode XSR(config-map-class)#frame-relay cir out 48000 + Sets this map class’ CIR rate at 48000 bits per second XSR(config-map-class)#frame-relay bc out 4000 + Sets this map class’ committed burst size to 4000 bits XSR(config-map-class)#frame-relay be out 3000 + Sets this map class’ excess burst size to 3000 bits XSR(c
PAGE 69
Frame Relay WAN Link with PPP Backup Sample Configuration XSR(config)#access-list 125 deny ip host 192.168.1.15 any XSR(config)#access-list 125 permit ip 192.162.2.0 0.0.0.255 any XSR(config)#access-list 125 permit ip 192.162.2.0 0.0.0.
PAGE 70
VPN Site-to-Site Sample Configuration Configure SNMP The previously configured ACL will be applied to all SNMP requests. Stricter ACLs can be written if tighter security controls are required.
PAGE 71
VPN Site-to-Site Sample Configuration Generate Master Encryption Key If you have not already generated a master encryption key, you must do so now to configure the VPN. A master key need only be generated once. Caution: The master encryption key is stored in hardware, not Flash, and you cannot read the key - only overwrite the old key by writing a new one. To ensure router security, it is critical not to compromise the key.
PAGE 72
VPN Site-to-Site Sample Configuration Create a Transform Set The following transform-set specifies the specified encryption/data integrity choices, 768-bit Diffie-Hellman, and an SA lifetime expressed in kilobytes. The SA seconds lifetime value is disabled. Some commands are abbreviated.
PAGE 73
VPN Sample Configuration with Network Extension Mode XSR(config)#interface vpn 57 multi-point XSR(config-int-vpn)#ip address 192.168.2.1 255.255.255.0 XSR(config)#router rip XSR(config-router)#network 112.16.10.0 XSR(config-router)#passive-interface gigabitethernet 2 XSR(config-router)#no receive-interface gigabitethernet 2 XSR(config-router)#distribute-list 1 out vpn 1 XSR(config)#ip XSR(config)#ip XSR(config)#ip XSR(config)#ip route route route route 0.0.0.0 0.0.0.0 112.16.244.9 112.16.72.0 255.255.
PAGE 74
VPN Sample Configuration with Network Extension Mode Figure 3-6 VPN Topology with NEM, EZ-IPSec and Internet Access GigabitEthernet 1: 172.16.10/24 Gigabitethernet 2: 26.26.26.10/24 Virtual IP Pool: 172.16.10.0/24 eth0: 10.11.11.1/24 eth1: 26.26.26.11/24 XSR 3020 26.26.26.0/24 XSR 3020 172.16.10.0 eth0: 10.12.12.1/24 eth1: 26.26.26.12/24 XSR 3020 If you have not already generated a master encryption key, you must do so now to configure the VPN. A master key need only be generated once.
PAGE 75
VPN Sample Configuration with Network Extension Mode Configure AAA authentication by assigning a virtual subnet to the DEFAULT AAA group, associate it with DNS and WINs servers, and add two AAA users with passwords. When a remote XSR tunnels into the local XSR, it will be assigned these DNS, WINS and PPTP values and be assigned dynamically to the IP pool virtual_subnet.
PAGE 76
XSR Rebooting Characteristics XSR(config)#access-list 103 permit ip any 10.10.10.0 0.0.0.255 Create crypto map statements for each ACL entry with the more protective tunnel mode set by default.
PAGE 77
XSR Rebooting Characteristics CPU: Broadcom BCM1250 Rev 2 VxWorks version: VxWorks5.4.2 Bootrom version: 1.5 Creation date: Aug 26 2003, 10:12:36 Warm Start : from cli Testing Bootrom Integrity << PASSED >> auto-booting... Verifying flash:xsr3000.fls file ...
PAGE 78
XSR Rebooting Characteristics Table 1 Reboot Triggers (continued) Cause Boot Type SNMP reload Cold or Warm Watchdog Expiration Warm Software Crash Warm Repetitive Software Crash Cold ROM Monitor Cold or Warm Invalid SW text checksum Warm Power-Up Reboot If you power cycle the XSR by flipping the switch on the back panel, the XSR will cold reboot. The startup-config file stored in Flash becomes the running configuration.
PAGE 79
Bootrom Monitor Mode Commands • Bootrom is valid. • The software image in Flash is valid. Bootrom Monitor Mode Commands Bootrom monitor mode offers special user access when the XSR lacks valid software or runs abnormally. Enter the mode by pressing the key combination (CTRL-C) during the first five seconds of initialization.
PAGE 80
Bootrom Monitor Mode Commands XSR-3020:bp Enter current password: Enter new password: ****** Re-enter new password: ****** Password has changed. bu This command updates the bootrom from a local file. You are prompted to enter data by the following script. When the “Proceed with erasing Bootrom in flash ...” statement appears, enter y. Be sure not to interrupt the process or power down the XSR or it may be affected adversely.
PAGE 81
Bootrom Monitor Mode Commands copy This command copies a file using the syntax copy . You can copy files from flash: to cflash: and vice versa. da This command shows system date/time with the sample output below: XSR-3020:da Date: Thursday, 29-MAY-2003. Time: 10:14:07 df This command shows free disk space. Sample output is shown as follows: XSR-3020: df Free space on flash: is 3383296 bytes (0x33a000). del This command removes a file from flash: or cflash: memory.
PAGE 82
Bootrom Monitor Mode Commands ff This command formats the Flash file system. We recommend that you first save any .dat, .cert, .cfg, and your startup-config files to cflash: or a PC since any files in flash: will be deleted. You are prompted to enter data by the following script: XSR-3020: ff You will lose all files in the “flash:” file system. Are you sure you want to format the “flash:” file system? (y/n) y Unlocking flash file sectors Initializing DOS file system. Formatting flashrom file system .......
PAGE 83
Bootrom Monitor Mode Commands Local target name (robo1) Autoboot (yes) Quick boot (no) : : : Permanently save the network parameters? (y/n) ns This command saves a file over the network using a remote IP address/file path. remove This command removes a file using the syntax remove rename This command renames a file using the syntax rename sb This command displays boot values.
PAGE 84
Bootrom Monitor Mode Commands BadVAddr=08112233 PP - Crashed Task Stack 0x85feb790 ffffffff 0x85feb7a0 00000000 0x85feb7b0 00000000 0x85feb7c0 ffffffff 0x85feb7d0 00000000 0x85feb7e0 ffffffff (sp=85febb90): 00000000 00000008 00000001 00000000 8214ab00 0000000a 85feb7c0 ffffffff 00000002 ffffffff 82154b50 00000000 ffffffff 00000001 82142ee0 bf3285a4 85feb7e0 00000017 ......
PAGE 85
Bootrom Monitor Mode Commands Local target name Autoboot Quick boot : XSR1 : enabled : no Current GigabitEthernet 0 MAC address is: 00:01:f4:2b:3e:1b Current GigabitEthernet 1 MAC address is: 00:01:f4:2b:3e:1c Current GigabitEthernet 1 MAC address is: 00:01:f4:2b:3e:1d sv This command shows the bootrom version with sample output below: XSR-3020: sv X-Pedition Security Router Bootrom Copyright 2003 Enterasys Networks Inc.
PAGE 86
Bootrom Monitor Mode Commands 3-42 Software Configuration
PAGE 87
A Specifications System Specifications This appendix details XSR data about hardware functionality including: • Processor, system memory, chassis, power supply, interfaces • Required cabling, optional CompactFlash and other accessories • Pinout assignments for WAN and LAN interfaces • LED behavior Refer to tables throughout this appendix for specific information.
PAGE 88
Cable, CompactFlash and Accessory Specifications Table A-1 Category XSR Hardware Specifications (continued) Parameters Power Consumption Typical values: Motherboard: 75 watts (maximum) Serial NIM card: 4 watts T1/E1/ISDN-PRI NIM card: 3 watts ISDN BRI-S/T NIM card: 1 watt Internal Power Supply Type Universal (110/220 VAC) unit Input AC Voltage & Frequency 100 - 240 VAC (50-60 Hz) +5V output1 20A maximum; continuous output power not exceeding 20 watts +12V output2 1A maximum +3.
PAGE 89
Cable, CompactFlash and Accessory Specifications Table A-2 XSR Cabling/Accessory Guide (continued) Part Description Connector Part # Function .
PAGE 90
Cable, CompactFlash and Accessory Specifications COM (Console) Port The XSR comes equipped with a COM serial port useful for initial configuration and management. Using a serial (null modem) cable, you can attach the router’s DB-9 COM port to a data terminal port and directly configure the XSR over the asynchronous connection. Then, open a communications or Telnet session to communicate with the router.
PAGE 91
Cable, CompactFlash and Accessory Specifications GigabitEthernet Ports The XSR comes equipped with three GigabitEthernet (LAN) ports that support full-duplex 10, 100, or 1000 Mbps transmission. The ports conform to IEEE 802.3 standards with 8-pin modular RJ-45 connectors.
PAGE 92
Cable, CompactFlash and Accessory Specifications Copper/Fiber-optic Ethernet NIMs The single-port Copper or Fiber-optic Ethernet NIMs, shown in Figure A-3 and Figure A-4, provide interfaces for half and full-duplex 10/100Base-T or fiber-optic 100Base-F transmission over LAN or WAN networks, respectively. The Copper Ethernet NIM incorporates a standard 8pin modular RJ-45 connector and the Fiber-optic Ethernet NIM has an MT-RJ multi-mode interface. Both NIMs conform to IEEE 802.3 and PCI 2.2 standards.
PAGE 93
Cable, CompactFlash and Accessory Specifications 2/4-Port Serial NIM Card Port The High Speed Serial NIM card, as shown in Figure A-6, provides a WAN interface supporting a serial link to four different types of DTEs: DB-15, 25, 37, and V.35. This interface supports dual and quad traffic up to 8 Mbps. Figure A-6 High Speed Serial NIM Port 68-pin Serial Pin 1 Pin 68 Refer to Figure A-7 through Figure A-11 for pinout assignments. Figure A-7 J1 3 11 5 10 4 7 6 8 15 16 9 14 X.21 DTE Pin Assignments X.
PAGE 94
Cable, CompactFlash and Accessory Specifications Figure A-8 J1 1 2 3 11 5 10 4 7 EIA-232/530 DTE Pin Assignments J2 DSR0+ 6 DSR0- 22 RxD0+ 3 RxD0- 16 TxD0+ 2 TxD0- 14 RTS0+ 4 RTS0- 19 DTR0+ 20 DTR06 8 12 13 15 16 9 14 CTS0TxC0+ 36 37 45 39 44 38 41 42 46 47 49 50 43 48 7 Signal GND 1 J3 DSR1+ DSR1RxD1+ RxD1TxD1+ TxD1RTS1+ RTS1DTR1+ CTS1TxC1RxC1+ A-8 51 52 3 53 16 61 2 55 14 60 4 54 19 57 56 13 58 15 62 12 63 9 Signal GND 7 Signal GND 65 66 59 64 Shield
PAGE 95
Cable, CompactFlash and Accessory Specifications Figure A-9 J1 1 2 3 11 5 10 4 7 EIA-449 DTE Pin Assignments J2 ON0+ 11 ON0- 29 RD0+ 6 RD0- 24 SD0+ 4 SD0- 22 RS0+ 7 RS0TR0+ 25 12 TR06 8 12 13 15 16 9 14 CS0ST0+ ST0RT0+ 36 37 45 39 44 38 41 42 46 47 49 50 43 48 18 28 29 1 J3 11 ON1- 29 RD1+ RD1SD1+ SD1RS1+ RS1TR1+ 31 32 No tes: 1 25- Ind icates Twiste d Pair . 30 is braid on braid ed cable 2. Shield GND 3. Shield GND is drain wire o n foil shield cab 4.
PAGE 96
Cable, CompactFlash and Accessory Specifications Figure A-10 J1 1 2 3 11 5 10 4 7 PORT 3 (EIA-232/530) 6 8 12 13 15 16 9 14 35 37 45 39 44 38 40 46 47 49 50 43 48 Combined V.35/EIA-232/530 DTE Pin Assignments J2 DSR3+ DSR3RxD3+ RxD3TxD3+ TxD3RTS3+ RTS3DTR3+ DTR3CTS3+ CTS3TxC3+ TxC3RxC3+ RxC3Signal GND Signal GND 6 22 3 16 2 14 4 19 20 23 5 13 15 12 17 9 7 Shield GND PORT 2 (V.35) E R T P S C H D Y AA V X B Shield GND J1: 68-pin male SCSI III-type connector J3, J5: V.35-type male connector J2.
PAGE 97
Cable, CompactFlash and Accessory Specifications Figure A-11 J1 1 3 11 5 10 4 6 12 13 15 16 9 14 V.
PAGE 98
Cable, CompactFlash and Accessory Specifications T1/E1/ISDN PRI NIM Card Ports The T1/E1/ISDN PRI NIM comes equipped with either 1, 2 or 4 Ethernet (WAN) ports that support fractional T1/E1 transmission in full-channel, fractional or unchannelized format with 8pin modular RJ-48C connectors and include a built-in DSU/CSU, as shown in Figure A-12. Cables required for these ports must be 100-ohm, straight-through, twisted-pair for T1 lines and a 120-ohm version for E1 lines.
PAGE 99
Cable, CompactFlash and Accessory Specifications Balun for E1 or PRI NIM Cards Some overseas electrical systems require that you use a balun and grounding shunt when utilizing an E1 or PRI NIM card on the XSR. A balun is an adapter employed to connect a 75-ohm coaxial cable pair (2 BNC connectors) to a 120-ohm twisted pair cable (RJ-48C connector). The balun and its connectors are shown in Figure A-14. The grounding shunt is also required to insulate (ground) unused pins of the RJ-48C connector.
PAGE 100
Cable, CompactFlash and Accessory Specifications Installing Shunt/Terminal Strip To install the shunt or terminal strip, attach two dual-pin units vertically to each four-pin jumper (P2, P3, P4, or P5) corresponding to the RJ-48C port using a balun, as shown in Figure A-16. Any other RJ-48C ports on the NIM card connected to 120-ohm lines do not require shunts.
PAGE 101
Cable, CompactFlash and Accessory Specifications T3/E3 NIM Card The T3/E3 full and sub-rate NIM, as shown in Figure A-17, is equipped with 1 Ethernet (WAN) port that supports fractional T3/E3 transmission in un-channelized or clear channel mode with BNC connectors. User data are encapsulated in HDLC packets before being sent to the line. Figure A-17 Tx 1-Port T3/E3 NIM Card ALARM LOS Rx ENABLE LOF id Cables required for this NIM must be 75-ohm, DS3 Type 734 or 735 coaxial.
PAGE 102
Cable, CompactFlash and Accessory Specifications 1/2-Port BRI-S/T NIM Card Ports The XSR offers a serial NIM card for 1 or 2 WAN interfaces over an ISDN-S/T BRI line, as shown in Figure A-18. Port 0 and 1 LEDs shine when the lines are active and ready to receive traffic. Refer to Figure A-19 for pinout assignments.
PAGE 103
Cable, CompactFlash and Accessory Specifications Termination Shunt for the ISDN BRI-S/T NIM Card ISDN BRI-S/T terminal equipment devices may be connected at random points of the cable in point-to-point or point-to-multipoint configurations. Line termination resistors must be provided at both ends of the transmit/receive lines only. The XSR’s BRI NIM card provides an option to terminate receive as well as transmit lines using 100 Ohm resistors.
PAGE 104
Cable, CompactFlash and Accessory Specifications 1/2-Port BRI-U NIM Card Ports The XSR provides a serial NIM card for 1 or 2 WAN interfaces over an ISDN BRI-U line, as shown in Figure A-21. The Port 0 and 1 LEDs shine when the lines are active and ready to receive traffic. Figure A-21 ISDN BRI-U NIM Card (RJ-49C ports shown) Port 0 Activation LED Port 1 Activation LED Refer to Figure A-22 for pinout assignments.
PAGE 105
Cable, CompactFlash and Accessory Specifications 1-Port ADSL NIM Card Port The XSR’s Asymmetric Digital Subscriber Line (ADSL) NIM card, as shown in Figure A-23, provides 1 WAN port on an ADSL over POTS (Annex A/C) or ISDN (Annex B) line with a 6-pin RJ-11 connector. The ADSL NIM supports both G.dmt and G.lite standards. ADSL NIMs are shipped with a CompactFlash card containing DSP firmware. This driver software copies the Flash file into host memory where it provides on-demand use by the DSP.
PAGE 106
Cable, CompactFlash and Accessory Specifications T1/E1 Drop & Insert (D&I) NIM The XSR’s 2-port T1/E1 D&I NIM card, as shown in Figure A-25, is designed as an intermediary between the Central Office T1/E1 line and a PBX. It de-couples Channel Associated Signaling (CAS) and Voice DS0 timeslots and redirects them to a PBX, and conversely, reintegrates Voice DS0 timeslots from the PBX with the T1/E1 data stream. Both ports are functionally equivalent.
PAGE 107
Cable, CompactFlash and Accessory Specifications CompactFlash Memory Card The optional plug-in CompactFlash (CF) memory card, shown in Figure A-27, comprises a single chip controller and flash memory modules in a matchbook-sized package with a 50-pin, PCMCIA connector consisting of two rows of 25 female contacts each. The PCMCIA male interface supports both Type I and Type II CF cards. Note that the CF release mechanism pops out when you install the card.
PAGE 108
Cable, CompactFlash and Accessory Specifications Table A-3 LED State Function PWR ON XSR is powered up and Bootrom initialized OFF XSR is powered down VPN ON/OFF VPN tunnel is up/No tunnel connected COM(munication) Blinking/OFF Port is transmitting or receiving data/idle Ethernet Port 1, 2, 3 Amber only ON 10Base-T link is auto-detected Green only ON 100Base-T link is auto-detected Both ON 1000Base-T link is auto-detected Blinking Port is transmitting or receiving data OFF Link is d
PAGE 109
Index B Balun description A-13 Balun adapter A-3 BRI S/T card part numbers A-3 BRI S/Tpin assignments A-16 BRI U card part numbers A-3 BRI-U pin assignments A-18, A-19, A-20 Broadcom 1250 processor 1-2 C port pinouts A-5 Grounding shunt description A-13 specifications A-3 H hardware accelerator 1-3 High Speed Serial NIM port pinouts A-7 how to configure the COM port A-4 I initializing the XSR software 3-1 R L RJ-45 connector pin assignments A-5, A-12, A-15 cable/accessory guide A-2 cabling part numb
PAGE 110
how to attach the serial COM (console) cable 2-7 how to attach the WAN cables 2-7 how to configure Frame Relay 3-15 how to configure IP routing 3-14 how to configure the COM port A-4 how to enable Web access 3-18 how to install a CompactFlash card 2-5 how to install NIM cards 2-2 how to install the hardware 2-1 how to rack mount the XSR 2-2 how to set LAN ports 3-8 how to set up message logging 3-17 how to set up SNMP 3-16 how to set WAN ports 3-8 initial login 3-3 installation overview 1-11 LED initializat