Foundry AR-Series Router User Guide For AR1202, AR1204, AR1208, AR1216, AR3201-CH/CL, and AR3202-CH/CL Routers 2100 Gold Street P.O. Box 649100 San Jose, CA 95164-9100 Tel 408.586.1700 Fax 408.586.1900 June 2004 June 2004 © 2004 Foundry Networks, Inc.
Copyright © 2004 Foundry Networks, Inc. All rights reserved. No part of this work may be reproduced in any form or by any means – graphic, electronic or mechanical, including photocopying, recording, taping or storage in an information retrieval system – without prior written permission of the copyright owner. The trademarks, logos and service marks (“Marks”) displayed herein are the property of Foundry or other third parties.
Contents CHAPTER 1 GETTING STARTED...................................................................................... 1-1 INTRODUCTION ...........................................................................................................................................1-1 AUDIENCE ..................................................................................................................................................1-1 NOMENCLATURE ..........................................................
Foundry AR-Series Router User Guide .....................................................................................................................................3-1 CONFIGURE POLICY AS_PATH ......................................................................................................................3-2 CONFIGURE POLICY COMMUNITY_LIST ..........................................................................................................
Contents CHAPTER 7 BGP4 CONFIGURE COMMANDS ................................................................... 7-1 ............................................................................................................................7-1 .........................................................................................7-2 CONFIGURE ROUTER BGP ALWAYS_COMPARE_MED ......................................................................................7-4 CONFIGURE ROUTER BGP DEFAULT_METRIC .........
Foundry AR-Series Router User Guide ...............................................................................................................................8-10 SHOW IP BGP SUMMARY ............................................................................................................................8-11 SHOW IP BGP TABLE ..................................................................................................................................8-12 SHOW POLICY .............................
Contents ...............................................................................9-37 CONFIGURE ROUTER OSPF REDISTRIBUTE RIP ............................................................................................9-38 CONFIGURE ROUTER OSPF REDISTRIBUTE STATIC .......................................................................................9-39 CONFIGURE ROUTER OSPF REF_BW ...........................................................................................................
Foundry AR-Series Router User Guide ........................................................................................11-10 CONFIGURE ROUTER RIP INTERFACE PASSIVE ...........................................................................................11-11 CONFIGURE ROUTER RIP INTERFACE SPLIT_HORIZON ................................................................................11-12 CONFIGURE ROUTER RIP MODE ........................................................................................
Contents GENERIC ROUTING ENCAPSULATION (GRE) ..............................................................................................14-7 CHAPTER 15 SECURITY FEATURES ................................................................................ 15-1 INTRODUCTION TO SECURITY ....................................................................................................................15-1 ENABLING SECURITY FEATURES ..............................................................................
Chapter 1 Getting Started Introduction This guide describes how to configure the AccessIron routers in typical scenarios using information presented in the configurations and user guides. Audience This manual is designed for system administrators with a working knowledge of Layer 2 and Layer 3 switching and routing. If you are using a Foundry Layer 3 Switch, you should be familiar with the following protocols if applicable to your network – IP, RIP, OSPF, BGP4, PIM, and VRRP.
Foundry AR-Series Router User Guide Related Publications The following Foundry Networks documents supplement the information in this guide. • Release Notes Printed release notes provide the latest information. If release notes are provided with your product, follow the instructions contained within them instead of those provided in other documentation.
Getting Started Table 1.1: Feature Supported in AccessIron Devices (Continued) Category Feature AR1202 AR1204 AR1208 AR1216 AR3201-T-CL AR3202-T-CL AR3201-T-CH AR3202-T-CH PPP, PAP, Multilink PPP, Frame Relay, Multilink Frame Relay, (FRF.15, FRF.16.1) BCP, HDLC Layer 2 Features 802.
Foundry AR-Series Router User Guide Table 1.
Getting Started Table 1.1: Feature Supported in AccessIron Devices (Continued) Category Feature AR1202 AR1204 AR1208 AR1216 AR3201-T-CL AR3202-T-CL AR3201-T-CH AR3202-T-CH Timed Access List How to Get Help Foundry Networks technical support will ensure that the fast and easy access that you have come to expect from your Foundry Networks products will be maintained. Web Access • http://www.foundrynetworks.
Foundry AR-Series Router User Guide 1-6 © 2004 Foundry Networks, Inc.
Chapter 2 Command Line Interface This chapter introduces the Command Line Interface (CLI) hierarchy and the conventions used to describe it. It also introduces the CLI navigation keys and methods, as well as the available help screens. Command Types This guide contains two types of commands: transition, or mode change, commands and standard commands. Transition commands do not affect the system configuration, they are used to gain access to lower- or next-level commands in the CLI hierarchy.
Foundry AR-Series Router User Guide NOTE: Command strings that require identification of a specific interface are context-sensitive. Command Conventions Each command is briefly described and then followed by the complete syntax, which is essentially a map of the command that shows mandatory and optional parameters. The following tables provide details of the conventions used for syntaxes and examples. Table 2.
Command Line Interface Table 2.2: Syntax Conventions (Continued) [a|b|c] Normal brackets “[ ]” indicate optional keywords or arguments. A vertical bar “ | “ separates individual settings. Example: In this example, the user enters the word “timeout;” must specify either for “tcp” or “udp” for a protocol type; and optionally enters a timeout value “n.” Syntax: timeout protocol_type < tcp | udp > [ seconds < n > ] Command execution: timeout udp 3600 < # Angled brackets.
Foundry AR-Series Router User Guide CLI Navigation The Tab, Esc, and Ctrl keyboard keys may be used to: • Move backwards or forwards in the CLI • Edit entered command strings • Or accelerate the command entry process Navigation Keys You may use the Tab key to quickly enter each word of a command without typing its full name. For example, to enter the configure command, you may type its first two letters and then press Tab to complete the entire word.
Command Line Interface Figure 2.
Foundry AR-Series Router User Guide Figure 2.
Command Line Interface Figure 2.5 Global show Command # show configuration : Select type of 'configuration' ( Hit Tab ) # dir CONTENTS OF /flash1: size -------6467513 6771268 1908 0 6500329 date -----FEB-04-2004 APR-01-2004 APR-01-2004 FEB-05-2004 APR-01-2004 time -----13:51:22 11:38:42 11:56:18 07:12:30 11:49:22 name -------AR0x_###x AR0x_###y system.cfg oldsystem.cfg AR0x_###z Total bytes: 19741018 Bytes Free: 12713984 # NOTE: The CLI commands show and display can be used interchangeably.
Foundry AR-Series Router User Guide 2-8 © 2004 Foundry Networks, Inc.
Chapter 3 Policy Commands This chapter provides information about routing policy commands that are supported by Foundry. configure policy This command provides access to the next-level commands. related commands: configure policy as_path configure policy community_list configure policy ip_access_list configure policy route_map June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure policy as_path This command configures the autonomous system path filter for BGP. AS path access lists are used for matching the AS path attribute in a BGP route. An AS path access list succeeds if any “permit” line in the list matches, or fails if any “deny” line matches. Matching proceeds sequentially and stops at the first match. The regular expression parameter is an as path regular expression.
Policy Commands configure policy community_list This command accesses next-level commands for adding extended or standard community lists. Community lists are used for matching the “community” attribute in a BGP route. A community list succeeds if any “permit” line in the list matches, or fails if any “deny” line matches. Matching proceeds sequentially and stops at the first match.
Foundry AR-Series Router User Guide configure policy community_list extended_community This command configures an extended community list as part of the policy. Parameter Description community_list Extended community list number The range is 100 - 199. community_index Community index number The range is 0 - 65535. action deny Specify a community to reject. permit Specify a community to permit. community A list of community numbers The range is 1 - 4294967295.
Policy Commands configure policy community_list standard_community This command configures a standard community list as part of the routing policy. Parameter Description community_list Extended community list number The range is 100 - 199. community_index Community index number The range is 0 - 65535. action deny Specify a community to reject. permit Specify a community to permit. community A list of community numbers The range is 1 - 4294967295. This list can contain a maximum of 32 numbers.
Foundry AR-Series Router User Guide configure policy ip_access_list This command configures the IP access list for routes. Ip access lists are used for matching any type of route prefix. An IP access list is said to succeed if any “permit” line in the list matches, or fails, if any “deny” line matches. Matching proceeds sequentially and stops at the first match. A line in an IP access list is said to match according to the rules listed below.
Policy Commands example: Foundry-AR1208/configure# policy ip_access_list 1 1 permit network 10.0.0.0 netmask 0.255.255.255 mask 255.0.0.0 maskmask 0.255.255.255 This example restricts the prefixes to 10.0.0.0/8 only. applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure policy route_map This command configures the policy for router route maps. Route maps are used for general-purpose matching of routes and setting of route attributes. Each route_map is comprised of one or more route_map clauses, of the form shown below. route_map name number [ permit | deny ] match statements set statements A route_map clause is said to match if each of its match statements matches, according to the rules given below.
Policy Commands related commands: configure policy route_map commit configure policy route_map match configure policy route_map set applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure policy route_map match This command accesses next-level commands for configuring the policy for matching parameters of the routes. related commands: configure policy route_map match as_path configure policy route_map match community configure policy route_map match ip 3 - 10 © 2004 Foundry Networks, Inc.
Policy Commands configure policy route_map match as_path This command matches any of the specified BGP AS path access lists. Parameter Description path_list AS path access list The range is 1 - 199; the maximum list size is 32. syntax: [ no ] policy match as_path path_list < n > example: Foundry-AR1208/configure#/policy/route_map Block100 1# match as_path 1 related commands: configure policy route_map match ip configure policy route_map match community applicable systems: All models.
Foundry AR-Series Router User Guide configure policy route_map match community This command matches any of the specified BGP community lists. syntax: [ no ] policy match community example: Foundry-AR1208/configure/policy/route_map Block100 1# match community related commands: configure policy route_map match as_path configure policy route_map match ip applicable systems: All models. 3 - 12 © 2004 Foundry Networks, Inc.
Policy Commands configure policy route_map match ip ip_address This command distributes routes matching the prefix against any of the specified IP access lists. Parameter Description ip_list Ip access list number(s) Enter a list of numbers. The range is 1 - 199. A maximum of 32 numbers can be in the list. syntax: [ no ] match ip ip_address ip_list < n > example: Foundry-AR1208/configure/policy/route_map Block100 1# match ip ip_address 20 applicable systems: All models.
Foundry AR-Series Router User Guide configure policy route_map set This command provides access to next-level commands to set parameters for the routes. related commands: configure policy route_map set as_path configure policy route_map set community configure policy route_map set distance configure policy route_map set local_preference configure policy route_map set metric configure policy route_map set metric_type configure policy route_map set origin 3 - 14 © 2004 Foundry Networks, Inc.
Policy Commands configure policy route_map set as_path This command configures a character string for a BGP AS-path attribute. Parameter Description prepend AS path access list Enter a list of numbers. The range is 1 - 65535; the maximum list size is 32. tag Set tag as an AS path attribute. Enter a number.
Foundry AR-Series Router User Guide configure policy route_map set community This command configures the policy for community attributes. Set the community attribute to the given value or list of values. If the additive keyword is specified, the list of values augments any communities already present. If the additive keyword is not specified, the list of values overwrites any communities already present.
Policy Commands configure policy route_map set distance This command sets the BGP protocol preference for the path attribute. Parameter Description distance Default preference value The range is 0 - 255.
Foundry AR-Series Router User Guide configure policy route_map set local_preference This command configures the BGP local preference path attribute. Parameter Description local_preference Preference value The range is 1 - 4292967294.
Policy Commands configure policy route_map set metric This command configures the metric value for the destination routing protocol. Parameter Description metric Metric value The range is 1 - 4294967294.
Foundry AR-Series Router User Guide configure policy route_map set metric_type This command configures the metric type for a route. Parameter Description type Internal internal Use the IGP metric as the MED for BGP.
Policy Commands configure policy route_map set origin This command configures the origin value for the BGP route. Parameter Description origin egp EGP protocol igp IGP protocol incomplete Unknown protocol type syntax: [ no ] set origin origin < egp | igp | incomplete > example: Foundry-AR1208/configure/policy/route_map Block100 1# set origin igp applicable systems: All models.
Foundry AR-Series Router User Guide 3 - 22 © 2004 Foundry Networks, Inc.
Chapter 4 Protocols Overview BGP4 Border Gateway Protocol Version 4 (also referred to as simply BGP) is an exterior routing protocol used for the global Internet. Once configured, BGP peers first exchange complete copies of their routing tables (including BGP version, router ID, and keep alive hold time), which are usually very large. Thereafter, only incremental updates (deltas) are sent as changes occur to the routing tables.
Foundry AR-Series Router User Guide RFC Compliance The following table provides Foundry Network’s BGP RFC compliance information. Table 4.
Protocols Overview RFC Compliance The following table provides Foundry Network’s OSPF RFC compliance information. Table 4.2: OSPF RFC Compliance RFC Description 2328 OSPF version 2 1587 OSPF NSSA option 1850 OSPF Version 2 Management Information Base RIP Routing Information Protocol (RIP) is an interior gateway protocol (IGP), i.e., it routes traffic within a single autonomous system (AS).
Table 4.3: RIP RFC Compliance 2082 RIP-II MD5 Authentication Multicasting Traditional multicast routing mechanisms such as Distance Vector Multicast Routing Protocol (DVMRP) and Multicast Open Shortest Path First (MOSPF) were intended for use within regions where groups are densely populated or bandwidth is universally plentiful. When groups, and senders to these groups, are distributed sparsely across a wide area, these “dense mode” schemes do not perform efficiently.
Chapter 5 BGP4 Clear Commands Use BGP clear commands to clear bgp configuration settings. clear ip bgp This command provides access to the following next-level commands. syntax: clear ip bgp related commands: clear ip bgp all clear ip bgp group clear ip bgp neighbor example: Foundry-AR1208# clear ip bgp applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide clear ip bgp all This command removes all BGP neighbor connections. syntax: clear ip bgp all example: Foundry-AR1208# clear ip bgp all related commands: clear ip bgp group clear ip bgp neighbor applicable systems: All models. 5-2 © 2004 Foundry Networks, Inc.
BGP4 Clear Commands clear ip bgp group This command removes all connections for a BGP group. Parameter Description group_name Name of the group syntax: clear ip bgp group group_name < name > example: Foundry-AR1208# clear ip bgp group north In this example, all BGP connections that belong to neighbor group north will be cleared. related commands: clear ip bgp all clear ip bgp neighbor applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide clear ip bgp neighbor This command removes a specified BGP neighbor connection. Parameter Description ip_address The IP address of the neighbor Enter an IP address (in dotted notation) to be cleared. remote_as The AS number of the remote neighbor to be cleared. The range is from 1 - 65535. syntax: clear ip bgp neighbor ip_address < IP address > remote_as < n > example: Foundry-AR1208# clear ip bgp neighbor 10.1.1.
Chapter 6 Generic Routing Commands This chapter contains routing commands that are not protocol specific. These commands can be used interchangeably with the three routing protocols supported by Foundry. configure router This command provides access to next-level commands. related commands: configure router routerid June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure router routerid This command configures a router for routing operation. syntax: [ no ] router routerid < IP address# example: Foundry-AR1208/configure# router routerid 10.10.10.10 applicable systems: All models. 6-2 © 2004 Foundry Networks, Inc.
Generic Routing Commands show ip routes This command displays IP routing information for Ethernet ports. Parameter Description network Network IP address Enter an IP address.
Foundry AR-Series Router User Guide example: To display all routes, issue the show ip routes command. example: To display the route for a specific network and subnet, issue the show ip routes network 123.1.2.0 mask 255.255.255.0 command. example: To display the connected ip routes, issue the show ip routes connected command. example: To display static routes, issue the show ip routes static command. example: To display RIP routes, issue the show ip routes rip command.
BGP4 Configure Commands Chapter 7 BGP4 Configure Commands Use BGP configure commands to configure all BGP4 parameters. configure router bgp This command configures BGP routing protocol on a router and provides access to the next-level commands listed below. Parameter Description as_number The number of an autonomous system. The range is 1 - 65535.
Foundry AR-Series Router User Guide configure router bgp aggregate_address This command is used to aggregate routes.
BGP4 Configure Commands configure router bgp default_metric configure router bgp group configure router bgp neighbor configure router bgp redistribute applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure router bgp always_compare_med This command configures a router to allow the comparison of the multi-exit discriminator for paths from neighbors in different autonomous systems. Normally, MED comparison is done on paths within the same autonomous system. This command allows the comparison to be made for paths received from other autonomous systems.
BGP4 Configure Commands configure router bgp default_metric This command configures the default metric value for redistributed BGP routes. This command forces the routing protocol to use the same metric value for all redistributed routes. Parameter Description default_metric The default metric value. The range is 1 - 4294967294.
Foundry AR-Series Router User Guide configure router bgp distance This command changes the default distance value on a router. Higher values are preferred. Parameter Description distance Default preference value The range is 0-255; the default is 170. syntax: [ no ] distance distance < n > example: Foundry-AR1208/configure/router/bgp 10# distance 20 Table 7.
BGP4 Configure Commands configure router bgp group This command configures BGP groups. Neighbors with the same update policies are more easily managed when they are in groups. Group organization simplifies configuration and streamlines the update process. Neighbor group members inherit all configuration options of a group. The BGP group sub commands are similar to those found under the neighbor tree, but they are applied to all neighbors in the group.
Foundry AR-Series Router User Guide configure router bgp group distribute_list This command configures filter updates to this group. Parameter Description access_list IP access list number The range is 1-199.
BGP4 Configure Commands configure router bgp group filter_list This command configures BGP filters for a specified group. Parameter Description access list AS path access list The range is 1-199.
Foundry AR-Series Router User Guide configure router bgp group next_hop_self This command disables the next hop calculation for all peers in the group. syntax: next_hop_self example: Foundry-AR1208/configure/router/bgp 10/group blue external# next_hop_self related commands: configure router bgp group distribute_list configure router bgp group filter_list configure router bgp group password configure router bgp group remove_private_AS configure router bgp group route_map applicable systems: All models.
BGP4 Configure Commands configure router bgp group password This command configures the TCP MD5 password to enable MD5 authentication for a BGP group. Parameter Description md5_password TCP MD5 password (string) for the group Enter a word.
Foundry AR-Series Router User Guide configure router bgp group remove_private_AS This command removes the private AS number from updates that are sent out.
BGP4 Configure Commands configure router bgp group route_map This command configures a route map to a BGP group. This command can only be applied in the outbound direction.
Foundry AR-Series Router User Guide configure router bgp neighbor This command configures a BGP neighbor. Parameter Description IP address The IP address of the neighbor in dotted notation remote_as The AS number The range is 1 - 65535. syntax: [ no ] neighbor IP address < IP address > remote_as < n > example: Foundry-AR1208/configure/router/bgp 10# neighbor 101.101.1.
BGP4 Configure Commands configure router bgp redistribute applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure router bgp neighbor advertisement_interval This command configures the minimum time interval for sending BGP route updates. Parameter Description advertisement_interval Time, in seconds The range is 1 - 600 seconds. syntax: [ no ] advertisement_interval advertisement_interval < n > example: Foundry-AR1208/configure/router/bgp 10/neighbor 101.101.1.2 4# advertisement_interval 60 applicable systems: All models. 7 - 16 © 2004 Foundry Networks, Inc.
BGP4 Configure Commands configure router bgp neighbor allowbadid This command permits BGP sessions to be established with routers that represent their router ID as 0.0.0.0 or 255.255.255.255. syntax: [ no ] allowbadid example: Foundry-AR1208/configure/router/bgp 10/neighbor 101.101.1.2 4# allowbadid applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure router bgp neighbor default_originate This command sends the default route to the neighbor. Parameter Description route_map The name of the route map syntax: [ no ] default_originate [ route_map < name > ] example: Foundry-AR1208/configure/router/bgp 10/neighbor 101.101.1.2 4# default_originate altmap5 applicable systems: All models. 7 - 18 © 2004 Foundry Networks, Inc.
BGP4 Configure Commands configure router bgp neighbor description This command describes or identifies a neighbor router. Parameter Description neighbor_description Text string in quotes describing neighbor syntax: [ no ] description neighbor_description < “string” > example: Foundry-AR1208/configure/router/bgp 10/neighbor 101.101.1.2 4# description “foo1” applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure router bgp neighbor distribute_list This command configures filter updates to or from this neighbor. Parameter Description access_list The IP access list number. The range is 1 - 199. filter_option in Inbound filter list syntax: [ no ] distribute_list access_list < n > filter_option < in > example: Foundry-AR1208/configure/router/bgp 10/neighbor 101.101.1.2 4# distribute_list 101 in applicable systems: All models. 7 - 20 © 2004 Foundry Networks, Inc.
BGP4 Configure Commands configure router bgp neighbor ebgp_multihop This command configures multihop EBGP on a neighbor. syntax: [ no ] ebgp_multihop example: Foundry-AR1208/configure/router/bgp 10/neighbor 101.101.1.2 4# ebgp_multihop applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure router bgp neighbor filter_list This command configures BGP filters. Parameter Description access_list AS path access list The range is 1 - 199. access_list_option in Inbound filter list syntax: [ no ] filter_list access_list < n > access_list_option < in > example: Foundry-AR1208/configure/router/bgp 10/neighbor 101.101.1.2 4# filter_list 103 in applicable systems: All models. 7 - 22 © 2004 Foundry Networks, Inc.
BGP4 Configure Commands configure router bgp neighbor keep This command configures neighbor route storage options. Parameter Description keep_option all Keep all non-active routes none Don’t store non-active routes syntax: keep keep_option < all | none > example: Foundry-AR1208/configure/router/bgp 10/neighbor 10.10.20.1 2# keep all applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure router bgp neighbor logupdown This command configures logging of established state transition changes of a neighbor. syntax: [ no ] logupdown example: Foundry-AR1208/configure/router/bgp10/neighbor 101.101.1.2 4# logupdown applicable systems: All models. 7 - 24 © 2004 Foundry Networks, Inc.
BGP4 Configure Commands configure router bgp neighbor maximum_prefix This command configures the maximum number of BGP routes to be accepted. If the neighbor sends more prefixes than are configured, the connection to this neighbor will be broken. Parameter Description prefix_number Maximum prefix limit The range is 1 - 1000000. syntax: maximum_prefix prefix_number < n > example: Foundry-AR1208/configure/router/bgp 10/neighbor 101.101.1.2 4# maximum_prefix 100000 applicable systems: All models.
Foundry AR-Series Router User Guide configure router bgp neighbor neighbor_group This command configures a neighbor to a specific group. Parameter Description neighbor_group The name of a neighbor group. syntax: [ no ] neighbor_group neighbor_group < name > example: Foundry-AR1208/configure/router/bgp 10/neighbor 101.101.1.2 4# neighbor_group internal-group applicable systems: All models. 7 - 26 © 2004 Foundry Networks, Inc.
BGP4 Configure Commands configure router bgp neighbor next_hop_self This command disables the next hop calculation for this neighbor. syntax: next_hop_self example: Foundry-AR1208/configure/router/bgp 10/neighbor 10.10.20.1 2# next_hop_self applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure router bgp neighbor password This command configures a password for md5 authentication. Parameter Description md5_password TCP MD5 password for the BGP session Enter a word (maximum 80 characters). syntax: md5_password < string > example: Foundry-AR1208/configure/router/bgp 10/neighbor 10.10.20.1 2# md5_password asdf applicable systems: All models. 7 - 28 © 2004 Foundry Networks, Inc.
BGP4 Configure Commands configure router bgp neighbor route_map This command applies a route map to a neighbor. A similar command exists under the group tree for applying route_map to a group of neighbors in the outbound direction. Parameter Description route_map The name of a route map route_map_options Filter options in Inbound direction syntax: [ no ] route_map route_map < name > route_map_options < in > example: Foundry-AR1208/configure/router/bgp 10/neighbor 100.50.23.
Foundry AR-Series Router User Guide configure router bgp neighbor timers This command configure keepalive timers for a neighbor (peer). The holdtime timer value is calculated as three times the value of the keepalive timer. Parameter Description keepalive The keepalive interval The range is 2 - 21845; the default is 60. syntax: [ no ] timers keepalive < n > example: Foundry-AR1208/configure/router/bgp 10/neighbor 101.101.1.2 4# timers 120 applicable systems: All models.
BGP4 Configure Commands configure router bgp neighbor update_source This command configures the source of BGP TCP connections for a specified neighbor as the IP address specified, instead of the IP address of a physical interface. This address will be used as the source address for routing updates. syntax: [ no ] update_source < IP address > example: Foundry-AR1208/configure/router/bgp 10/neighbor 101.101.1.2 4# update_source 10.10.2.1 applicable systems: All models.
Foundry AR-Series Router User Guide configure router bgp redistribute This command provides access to the following next-level commands. Redistribution causes routes from other protocols to be exported via the current protocol. Routes from the current protocol are always exported, some protocols may provide additional policy features that allow the suppression of protocol routes.
BGP4 Configure Commands configure router bgp redistribute connected This command redistributes interface routes. Parameter Description metric Default metric The range is 0 - 4294967294.
Foundry AR-Series Router User Guide configure router bgp redistribute ospf This command configures the router to redistribute OSPF routes. Parameter Description metric The default metric The range is 0 - 4294967294.
BGP4 Configure Commands configure router bgp redistribute rip This command configures a router to redistribute RIP routes. Parameter Description metric The default metric The range is 0 - 4294967294.
Foundry AR-Series Router User Guide configure router bgp redistribute static This command configures a router to redistribute static routes. Parameter Description metric The default metric The range is 0 - 4294967294.
Chapter 8 BGP4 show Commands Use BGP show commands to display all configured BGP information. NOTE: The CLI commands “show” and “display” can be used interchangeably. show ip bgp This command accesses the following next-level display (show) commands. related commands: show ip bgp aggregate_address show ip bgp community show ip bgp groups show ip bgp neighbors show ip bgp paths show ip bgp regexp show ip bgp summary show ip bgp table June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide show ip bgp aggregate_address This command displays a list of configured aggregate addresses. Parameter Description address Aggregate address Enter an IP address. mask Aggregate mask Enter a subnet mask. syntax: show ip bgp aggregate_address [ address < IP address > [ mask < subnet mask > ] ] example: Foundry-AR1208# show ip bgp aggregate_address address 100.12.23.0 mask 255.255.255.0 applicable systems: All models. 8-2 © 2004 Foundry Networks, Inc.
BGP4 show Commands show ip bgp community This command displays routes that match BGP communities. Parameter Description number Community number (enter a list of unsigned numbers) The maximum list size is 10. The range is 1 - 4294967294 aa:nn Community number in aa:nn format Enter a list of strings separated by spaces. The maximum list size is 10 numbers.
Foundry AR-Series Router User Guide Table 8.1: Status and Origin Codes Status codes * ( valid ) The table entry is valid. # ( best ) The table entry is the best entry to use for that network. i ( internal ) The table entry was learned via an internal BGP session. Origin codes i ( IGP) Internal BGP e (EGP) External BGP ? ( incomplete) Protocol of unknown origin. Typically redistributed into BGP from an IGP. applicable systems: All models. 8-4 © 2004 Foundry Networks, Inc.
BGP4 show Commands show ip bgp groups This command provides information about BGP groups. syntax: show ip bgp groups [ < name > ] example: Foundry-AR1208# show ip bgp groups north applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide show ip bgp neighbors This command displays detailed information and status on all BGP neighbors, including: • peer group and AS affiliations • configured and negotiated timers • minimum times between advertisements • receive and transmit updates • BGP state status • TCP connection ( active or inactive) Parameter Description group Neighbors belonging to a group Enter a name or word. address Neighbor to display information about Enter an IP address.
BGP4 show Commands Table 8.2: Status and Origin Codes Status codes * ( valid ) The table entry is valid. # ( best ) The table entry is the best entry to use for that network. i ( internal ) The table entry was learned via an internal BGP session. Origin codes i ( IGP) Internal BGP e (EGP) External BGP ? ( incomplete) Protocol of unknown origin. Table 8.3: Other BGP show Descriptions BGP neighbor IP address of the BGP neighbor peer group Displays the name of the peer group.
Foundry AR-Series Router User Guide Table 8.3: Other BGP show Descriptions (Continued) updates Maximum prefixes Number of sent BGP updates The maximum number of prefixes that can be received from this neighbor. applicable systems: All models. 8-8 © 2004 Foundry Networks, Inc.
BGP4 show Commands show ip bgp paths This command shows all BGP paths in the database. syntax: show ip bgp paths example: Foundry-AR1208# show ip bgp paths # show ip bgp paths Hash Refcount Path 32 2 ? 96 1 i Foundry/configure# Table 2 Interpreting BGP Paths term hash An area where path IP addresses are stored refcount The number of routes using a specific path path The AS path and origin for that route.
Foundry AR-Series Router User Guide show ip bgp regexp This command displays routes matching the regular expression. Parameter Description reg_exp A regular expression to match the BGP AS paths. Strings must be enclosed by quotation marks. syntax: show ip bgp regexp reg_exp < “string” > example: Foundry-AR1208# show ip bgp regexp “.* 600 .*“ applicable systems: All models. 8 - 10 © 2004 Foundry Networks, Inc.
BGP4 show Commands show ip bgp summary This command shows the BGP router’s identifying number, local AS number, and connected neighbors. Neighbor information includes BGP version (v), AS number, messages received and transmitted, and operating status. syntax: show ip bgp summary example: Foundry-AR1208# show ip bgp summary # show ip bgp summary BGP router identifier 10.1.1.0, local AS member 200 Neighbor 192.168.123.1 172.10.16.
Foundry AR-Series Router User Guide show ip bgp table This command shows entries in the BGP route table. syntax: show ip bgp table example: Foundry-AR1208# show ip bgp table Table 8.5: Status and Origin Codes Status codes * ( valid ) The table entry is valid. i ( internal ) The table entry was learned via an internal BGP session. Origin codes i ( IGP) Internal BGP e (EGP) External BGP ? ( incomplete) Protocol of unknown origin. applicable systems: All models.
BGP4 show Commands show policy This command provides access to the following next-level policy display commands: related commands: show policy as_path show policy community_list show policy ip_access_list show policy route_map June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide show policy as_path This command displays the AS path access lists. Parameter Description access_list The access list number. The range is 1 - 199. syntax: show policy as_path [ access_list < n > ] example: Foundry-AR1208# show policy as_path # show policy as_path AS path access list 1 permit .* 699 .* permit .* 500 deny 40 .* AS path access list 2 deny 60.
BGP4 show Commands show policy community_list This command shows configured community lists. Parameter Description community The community list number. The range is 1 - 199. syntax: show policy community_list [ community < n > ] example: Foundry-AR1208# show policy community_list #show policy community_list Community extended access list 100 deny 0:44 .... permit 655: .... related commands: show policy as_path show policy ip_access_list show policy route_map applicable systems: All models.
Foundry AR-Series Router User Guide show policy ip_access_list This command show routes that comply with specific IP access rules. Parameter Description number IP access list number The range is 1 - 99. syntax: show policy ip_access_list [ number < n > ] example: Foundry-1450/show# policy ip_access_list # show policy ip_access_list IP access list 1 permit 10.0.0.0 255.255.255.255 0.255.255.255 255.255.255.255 permit 20.0.0.0 255.255.255.255 255.255.255.255 255.255.255.255 IP access list 2 permit 20.
BGP4 show Commands show policy route_map This command shows route map information. Parameter Description name The name of the route map. syntax: show policy route_map [ < name > ] example: Foundry-AR1208# show policy route_map # show policy route_map route-map Block100, deny, sequence 1 Batch clauses: as_path (as-path filter): 99 Set clauses: origin bgp # related commands: show policy as_path show policy community_list show policy ip_access_list applicable systems: All models.
Foundry AR-Series Router User Guide 8 - 18 © 2004 Foundry Networks, Inc.
Chapter 9 OSPF Configure Commands Use OSPF configure commands to configure all OSPF routing parameters. NOTE: See the command configure interface loopback in the Command Reference Guide: Domestic Products for important information about loopback interfaces. When configuring OSPF, keep the following in mind: • When you enable OSPF on bundles, make sure that both ends of the bundle are either “numbered” or “unnumbered.
Foundry AR-Series Router User Guide configure router ospf This command configures a router for OSPF routing. syntax: router ospf example: Foundry-AR1208/configure# router ospf related commands: configure router ospf 1583Compatability configure router ospf area configure router ospf distance configure router ospf interface configure router ospf redistribute configure router ospf ref_bw configure router ospf timers applicable systems: All models. 9-2 © 2004 Foundry Networks, Inc.
OSPF Configure Commands configure router ospf 1583 Compatibility This command establishes the route summary calculation method to be compatible with RFC 1583. The RFC compatibility of all routers in an OSPF domain should be configured the same. The default is 1583Compatibility disabled.
Foundry AR-Series Router User Guide configure router ospf area This command configures an OSPF area. Parameter Description area_id OSPF area id Enter either a decimal number or an IP address.
OSPF Configure Commands configure router ospf area area_type This command accesses the following next-level commands for configuring an area type. related commands: configure router ospf area area_type normal configure router ospf area area_type nssa configure router ospf area area_type stub related commands: configure router ospf area default_cost configure router ospf area range configure router ospf area virtual_link applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure router ospf area area_type normal This command specifies an area area type as normal. syntax: area_type normal example: Foundry-AR1208/configure/router/ospf/area 0# area_type normal related commands: configure router ospf area area_type nssa configure router ospf area area_type stub applicable systems: All models. 9-6 © 2004 Foundry Networks, Inc.
OSPF Configure Commands configure router ospf area area_type nssa This command specifies an area type as (nssa) not-so-stubby area. syntax: area_type nssa example: Foundry-AR1208/configure/router/ospf/area 1# area_type nssa related commands: configure router ospf area area_type nssa no_summary related commands: configure router ospf area area_type normal configure router ospf area area_type stub applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure router ospf area area_type nssa no_summary This command prevents an nssa area boundary router from sending summary link advertisements into an nssa area. syntax: no_summary example: Foundry-AR1208/configure/router/ospf/area 1/area_type/nssa# no_summary applicable systems: All models. 9-8 © 2004 Foundry Networks, Inc.
OSPF Configure Commands configure router ospf area area_type stub This command configures an area as a stub area. Stub areas are not flooded with AS external advertisements. Stub areas reduce the amount of memory required on stub area routers.
Foundry AR-Series Router User Guide configure router ospf area area_type stub no_summary This command prevents an area boundary router from sending summary link advertisements into the stub area. syntax: no_summary example: Foundry-AR1208/configure/router/ospf/area 1/area_type/stub# no_summary applicable systems: All models. 9 - 10 © 2004 Foundry Networks, Inc.
OSPF Configure Commands configure router ospf area default_cost This command specifies a cost for the default summary route sent into a stub area. Parameter Description default_cost Enter a number. The range is 0 - 16777215; the default is 1. syntax: default_cost < n > example: Foundry-AR1208/configure/router/ospf/area 1# default_cost 10 related commands: configure router ospf area area_type configure router ospf area range configure router ospf area virtual_link applicable systems: All models.
Foundry AR-Series Router User Guide configure router ospf area range This command summarizes routes at the area boundaries, producing a single route that is advertised by area border routers. Parameter Description networknumber IP address mask netmask advertise_enum advertise Advertise this range. not_advertise Do not advertise this range.
OSPF Configure Commands configure router ospf area virtual_link This command defines an OSPF virtual link for an area. Establishes a virtual connection to the backbone for an area border router that is not physically connected to the backbone. A virtual link requires that each virtual link neighbor must include the transit area ID and the virtual link neighbor’s router ID. Parameter Description virtual_link IP address for the virtual link. Enter an IP address.
Foundry AR-Series Router User Guide configure router ospf area virtual_link authentication This command configures authentication for an area virtual link. Authentication guarantees that only trusted routers send and receive traffic within an area. Each interface must use the same type of authentication. Parameter Description authentication type simple Uses a text password that is imbedded in the packet. md5 Creates an encoded checksum that is imbedded in the packet.
OSPF Configure Commands configure router ospf area virtual_link dead_interval This command sets the time, in seconds that an OSPF neighbor will wait for a hello packet. Once the user-defined time expires, the interface assumes that the neighbor is down. The value entered should be approximately four times the value of the hello_interval. Parameter Description dead_interval The time in seconds. The value configured must be the same for all routers and servers in the same network.
Foundry AR-Series Router User Guide configure router ospf area virtual_link hello_interval This command configures the time interval between transmission of hello packets. Parameter Description hello_interval The time in seconds. The value configured must be the same for all routers and servers in the same network. The range is 1 - 65535: the default is 10 seconds. syntax: [ no ] hello_interval < n > example: Foundry-AR1208/configure/router/ospf/area 1/virtual_link 100.10.1.
OSPF Configure Commands configure router ospf area virtual_link retransmit_interval This command configures the time between link state advertisement retransmissions on an interface. Parameter Description retransmit_interval The time in seconds. The configured value must be greater than the expected round-trip delay. The range is 1 - 65535; the default is 5. syntax: [ no ] retransmit_interval < n > example: Foundry-AR1208/configure/router/ospf/area 1/virtual_link 100.10.1.
Foundry AR-Series Router User Guide configure router ospf area virtual_link transmit_delay This command configures the estimated time to transmit a link state update packet on an interface. Parameter Description transmit_delay The time in seconds. Link state advertisements in the update packet are aged by this amount prior to transmission. The range is 1 - 65535; the default is 1. The value must be greater than zero.
OSPF Configure Commands configure router ospf distance This command accesses the following next-level commands to configure OSPF administrative distances for routes. related commands: configure router ospf distance ospf related commands: configure router ospf 1583Compatability configure router ospf area configure router ospf interface configure router ospf redistribute configure router ospf ref_bw configure router ospf timers applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure router ospf distance ospf This command accesses next-level commands that configure OSPF administrative distances based on route type. related commands: configure router ospf distance ospf external configure router ospf distance ospf non_external applicable systems: All models. 9 - 20 © 2004 Foundry Networks, Inc.
OSPF Configure Commands configure router ospf distance ospf external This command configures the distance parameter for external routes. Parameter Description external Type-5 and type-7 external routes The range is 1 - 255; the default is 150. syntax: [ no ] distance ospf external < n > example: Foundry-AR1208/configure/router/ospf# distance ospf external 25 Table 9.
Foundry AR-Series Router User Guide configure router ospf distance ospf non_external This command configures the distance parameter for inter- and intra-area routes. Parameter Description non_external Inter-area and intra-area routes The range is 1 - 255; the default is 10. syntax: [ no ] distance ospf non_external < n > example: Foundry-AR1208/configure/router/ospf# distance ospf non_external 25 Table 9.
OSPF Configure Commands configure router ospf interface This command configures an interface for OSPF routing. Parameter Description name Enter an interface name, such as ethernet0, ethernet1, or a bundle name. dlci Data link connection identifier of the pvc (for frame relay use). The range is 16 - 1022; there is no default. area_id OSPF area ID Enter either a decimal number or an IP address.
Foundry AR-Series Router User Guide configure router ospf interface authentication This command configures the authentication type on an interface. Parameter Description authentication type simple Simple password authentication md5 MD5 authentication md5_cisco Cisco compatible md5 authentication line A 16-character (maximum) password string beginning with an alpha character.
OSPF Configure Commands configure router ospf interface cost This command configures the OSPF metric cost for a specific interface. Parameter Description cost Metric cost of sending packets on a particular OSPF interface. The range is 1 - 65535; the default is computed based on the interface bandwidth.
Foundry AR-Series Router User Guide configure router ospf interface dead_interval This command sets the time, in seconds, that an OSPF neighbor will wait for a hello packet. Once the user-defined time expires, the interface assumes that the neighbor is down. The value entered should be approximately four times the value of the hello_interval. Parameter Description dead_interval Time, in seconds The range is 1- 65535; the default is 40.
OSPF Configure Commands configure router ospf interface hello_interval This command sets the time interval, in seconds, between the hello packets that are sent on the interface. Parameter Description hello_interval Time in seconds The default is 10; the range is 1 - 65535.
Foundry AR-Series Router User Guide configure router ospf interface neighbor This command sets up an OSPF neighbor router for an interface that is used on a non-broadcast network. Parameter Description ip address The IP address of the neighbor router priority Sets the router priority for a non-broadcast neighbor. The range is 0 - 255; the default is 1. syntax: [ no ] neighbor < IP address > [ priority < n > ] example: Foundry-AR1208/configure/router/ospf/interface toBoston# neighbor 100.22.12.
OSPF Configure Commands configure router ospf interface network This command configures the OSPF network type on an interface.
Foundry AR-Series Router User Guide applicable systems: All models. 9 - 30 © 2004 Foundry Networks, Inc.
OSPF Configure Commands configure router ospf interface poll_interval This command, used for nonbroadcast interfaces only, specifies how often the router sends hello packets from the interface before establishing adjacency with a neighbor. Parameter Description poll_interval The time, in seconds The range is 0 - 2147483647; the default is 120.
Foundry AR-Series Router User Guide configure router ospf interface priority This command configures the priority (which is used in the election of designated routes) to establish the designated router. Parameter Description priority Number that specifies the router priority. This is only used in non point-to-point networks. The range is 0 - 255; the default is 1.
OSPF Configure Commands configure router ospf interface retransmit_interval This command configures the retransmit time for the link state advertisement retransmission for neighbors belonging to the interface. When a router sends a link state advertisement to its neighbor, it keeps the LSA until it receives an acknowledgment. If an acknowledgment is not received in n seconds, the router will retransmit the LSA. Parameter Description seconds Time in seconds between retransmission.
Foundry AR-Series Router User Guide configure router ospf interface transmit_delay This command configures the approximate time it takes to transmit a link state advertisement update packet on the interface. Parameter Description seconds Time in seconds. Usage of this command is most appropriate for low speed links. The range is 1- 65535; the default is 1.
OSPF Configure Commands configure router ospf redistribute This command accesses next-level commands that are used to redistribute routes from other routers or routing protocols.
Foundry AR-Series Router User Guide configure router ospf redistribute bgp This command redistributes BGP routes. Parameter Description as_number Autonomous system number The range is 1 - 65535. metric OSPF default metric The range is 0 - 16777214; the default is 100. metric_type Ospf exterior metric type for redistribution The range is 1 - 2; the default is 2. route_map Pointer (name or word) to route map entries tag 32-bit tag value The range is 0 - 2147483647; the default is 0.
OSPF Configure Commands configure router ospf redistribute connected This command redistributes connected interface routes. Parameter Description metric OSPF default metric The range is 0 - 16777214; the default is 100. metric_type Ospf exterior metric type for redistribution The range is 1 - 2; the default is 2. route_map Pointer (name or word) to route map entries tag 32-bit tag value The range is 0 - 2147483647; the default is 0.
Foundry AR-Series Router User Guide configure router ospf redistribute rip This command redistributes RIP routes. Parameter Description metric OSPF default metric The range is 0 - 16777214; the default is 100. metric_type Ospf exterior metric type for redistribution The range is 1 - 2; the default is 2. route_map Pointer (name or word) to route map entries tag 32-bit tag value The range is 0 - 2147483647; the default is 0.
OSPF Configure Commands configure router ospf redistribute static This command redistributes static routes. Parameter Description metric OSPF default metric The range is 1 - 16777214; the default is 100. metric_type Ospf exterior metric type for redistribution The range is 1 - 2; the default is 2. route_map Pointer (name or word) to route map entries tag 32-bit tag value The range is 0 - 2147483647; the default is 0.
Foundry AR-Series Router User Guide configure router ospf ref_bw This command calculates OSPF interface cost according to bandwidth usage. Specifying a large number helps differentiate cost on multiple high bandwidth links. Parameter Description reference_bandwidth Reference bandwidth in Mbps The range is 1 - 4294967.
OSPF Configure Commands configure router ospf timers This command configures and adjusts ospf spf timers. Parameter Description timers spf_delay Delay between receiving a change to the SPF calculation. The range is 1 - 65535; the default is 5. spf_holdtime The hold time between consecutive SPF calculations. The range is 1 - 65535; the default is 10.
Foundry AR-Series Router User Guide 9 - 42 © 2004 Foundry Networks, Inc.
Chapter 10 OSPF Show Commands Use OSPF display/show commands to display all configured OSPF information. NOTE: The CLI commands “show” and “display” can be used interchangeably. show ip ospf area This command displays configuration information about an OSPF area. Parameter Description area_id OSPF area ID Enter either a decimal number or an IP address.
Foundry AR-Series Router User Guide related commands: show ip ospf global show ip ospf database show ip ospf interface show ip ospf neighbor show ip ospf retransmission_list show ip ospf request_list show ip ospf virtual_links applicable systems: All models. 10 - 2 © 2004 Foundry Networks, Inc.
OSPF Show Commands show ip ospf database This command provides access to commands that display information about an OSPF database.
Foundry AR-Series Router User Guide show ip ospf database all This command displays information related to the OSPF databases of the router. Parameter Description area_id OSPF area ID Enter either a decimal number or an IP address. advt_rtr OSPF advertisement router Enter an IP address. link_id OSPF link state ID Enter an IP address.
OSPF Show Commands show ip ospf database asbr_summary This command displays information about ASBR summary link states. Parameter Description area_id OSPF area ID Enter either a decimal number or an IP address. advt_rtr OSPF advertisement router Enter an IP address. link_id OSPF link state ID Enter an IP address.
Foundry AR-Series Router User Guide show ip ospf database database_summary This command displays OSPF database summary information.
OSPF Show Commands show ip ospf database external This command displays information about external LSAs in the OSPF database. Parameter Description area_id OSPF area ID Enter either a decimal number or an IP address. advt_rtr OSPF advertisement router Enter an IP address. link_id OSPF link state ID Enter an IP address.
Foundry AR-Series Router User Guide show ip ospf database network This command displays database information about the network LSAs. Parameter Description area_id OSPF area ID Enter either a decimal number or an IP address. advt_rtr OSPF advertisement router Enter an IP address. link_id OSPF link state ID Enter an IP address.
OSPF Show Commands show ip ospf database nssa_external This command shows OSPF database information about NSSA external LSAs. Parameter Description area_id OSPF area ID Enter either a decimal number or an IP address. advt_rtr OSPF advertisement router Enter an IP address. link_id OSPF link state ID Enter an IP address.
Foundry AR-Series Router User Guide show ip ospf database router This command shows information about router LSAs in the OSPF database. Parameter Description area_id OSPF area ID Enter either a decimal number or an IP address. advt_rtr OSPF advertisement router Enter an IP address. link_id OSPF link state ID Enter an IP address.
OSPF Show Commands show ip ospf database self_originate This command displays OSPF database information about self-originated LSAs in the router. Parameter Description area_id OSPF area ID Enter either a decimal number or an IP address.
Foundry AR-Series Router User Guide show ip ospf database summary This command displays information about summary LSAs in the OSPF database. Parameter Description area_id OSPF area ID Enter either a decimal number or an IP address. advt_rtr OSPF advertisement router Enter an IP address. link_id OSPF link state ID Enter an IP address.
OSPF Show Commands show ip ospf global This command displays global OSPF information. syntax: global example: Foundry-AR1208# show ip ospf global # show ip ospf global Routing Process 'ospf 30583' with ID 10.1.1.1 It is rfc1583 incompatible Summary Link update interval is 1800 SPF schedule delay 5 secs, Hold time between two SPFs 10 secs Reference bandwidth 100 Megabits per second Number of areas in this router is 1.
Foundry AR-Series Router User Guide show ip ospf interface This command provides access to commands that display information about configured OSPF interfaces.
OSPF Show Commands show ip ospf interface all This command displays configuration information about all configured OSPF interfaces. syntax: interface all example: Foundry-AR1208# show ip ospf interface all related commands: show ip ospf interface bundle show ip ospf interface ethernet applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide show ip ospf interface bundle This command displays configuration information about an OSPF bundle. syntax: interface bundle < name > [ pvc < n > ] example: Foundry-AR1208# show ip ospf interface bundle Boise related commands: show ip ospf interface all show ip ospf interface ethernet applicable systems: All models. 10 - 16 © 2004 Foundry Networks, Inc.
OSPF Show Commands show ip ospf interface ethernet This command displays OSPF configuration information about an Ethernet interface. syntax: interface ethernet < n > example: Foundry-AR1208# show ip ospf interface ethernet 1 related commands: show ip ospf interface all show ip ospf interface bundle applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide show ip ospf neighbor This command provides access to next-level commands that display configuration information about OSPF neighbors.
OSPF Show Commands show ip ospf neighbor detail This command displays detailed OSPF configuration information about all neighbors. syntax: neighbor detail example: Foundry-AR1208# show ip ospf neighbor detail related commands: show ip ospf neighbor id show ip ospf neighbor interface show ip ospf neighbor list applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide show ip ospf neighbor id This command displays OSPF configuration information about a specific neighbor. syntax: neighbor id < IP address > example: Foundry-AR1208# show ip ospf neighbor id 10.3.1.2 related commands: show ip ospf neighbor detail show ip ospf neighbor interface show ip ospf neighbor list applicable systems: All models. 10 - 20 © 2004 Foundry Networks, Inc.
OSPF Show Commands show ip ospf neighbor interface This command provides access to commands that display OSPF configuration information about all neighbors in an interface. syntax: neighbor interface ethernet < n > | bundle < name > [ pvc < n > ] example: Foundry-AR1208# show ip ospf neighbor interface ethernet 1 related commands: show ip ospf neighbor interface bundle show ip ospf neighbor interface ethernet applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide show ip ospf neighbor interface bundle This command displays information about an OSPF neighbors on a bundle interface. syntax: neighbor interface bundle < name > [ pvc < n > ] example: Foundry-AR1208# show ip ospf neighbor interface bundle Boise related commands: show ip ospf neighbor interface ethernet applicable systems: All models. 10 - 22 © 2004 Foundry Networks, Inc.
OSPF Show Commands show ip ospf neighbor interface ethernet This command displays configuration information about a neighbor on an Ethernet interface. syntax: neighbor interface ethernet < n > example: Foundry-AR1208# show ip ospf neighbor interface ethernet 1 related commands: show ip ospf neighbor interface bundle applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide show ip ospf neighbor list This command displays a list of neighbors attached to this router. syntax: neighbor list example: Foundry-AR1208# show ip ospf neighbor list related commands: show ip ospf neighbor detail show ip ospf neighbor id show ip ospf neighbor interface applicable systems: All models. 10 - 24 © 2004 Foundry Networks, Inc.
OSPF Show Commands show ip ospf request_list This command displays the LSAs in the request list of the specified neighbor. syntax: request_list < IP address > example: Foundry-AR1208# show ip ospf request_list 10.10.10.1 related commands: show ip ospf area show ip ospf global show ip ospf database show ip ospf interface show ip ospf neighbor show ip ospf retransmission_list show ip ospf virtual_links applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide show ip ospf retransmission_list This command displays the LSAs in the retransmission list of the specified neighbor. syntax: retransmission_list < IP address > example: Foundry-AR1208# show ip ospf retransmission_list 10.10.10.1 related commands: show ip ospf area show ip ospf database show ip ospf global show ip ospf interface show ip ospf neighbor show ip ospf request_list show ip ospf virtual_links applicable systems: All models.
OSPF Show Commands show ip ospf virtual_links This command displays information about configured OSPF virtual links. syntax: virtual_links [ < IP address > ] example: Foundry-AR1208# show ip ospf virtual_links related commands: show ip ospf area show ip ospf global show ip ospf database show ip ospf interface show ip ospf neighbor show ip ospf retransmission_list show ip ospf request_list applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide 10 - 28 © 2004 Foundry Networks, Inc.
Chapter 11 RIP Configure Commands Use RIP configure commands to configure all RIP parameters. NOTE: See the command configure interface loopback in the Command Reference Guide: Domestic Products for important information about loopback interfaces. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure router rip This command enables the Routing Information Protocol (RIP). syntax: [ no ] router rip example: Foundry-AR1208/configure# router rip related commands: configure router rip default_metric configure router rip distance configure router rip interface configure router rip mode configure router rip pacing configure router rip passive configure router rip redistribute configure router rip timers applicable systems: All models.
RIP Configure Commands configure router rip default_metric This command sets the global default metric values for RIP. Parameter Description metric Default metric The range is 1 - 4294967294; the default is 1. syntax: [ no ] default_metric < n > example: Foundry-AR1208/configure/router/rip# default_metric 4 This example configures the default metric to 4.
Foundry AR-Series Router User Guide configure router rip distance This command configures the distance value for RIP protocol on a router. Parameter Description distance Distance value (enter a number) The range is 1 - 255; the default is 100. syntax: distance < n > example: Foundry-AR1208/configure/router/rip# distance 25 Table 11.
RIP Configure Commands configure router rip interface This command enables RIP for an interface. The interface is identified by the interface name. Use ethernet0 for Ethernet 0 and ethernet1 for Ethernet 1. WAN interfaces are identified by bundle names. If no other RIP interface command is given, then the interface is configured with default RIP parameters. Parameter Description name ethernet0, ethernet1, or a bundle name dlci PVC identifier; enter a number. Use only for an encapsulated fr bundle.
Foundry AR-Series Router User Guide configure router rip interface authentication This command configures RIP-2 authentication for an interface. The type of authentication and the key value to be used can be specified, but this is only valid with RIP version 2 (mode 3). When authentication is configured, all subsequent RIP updates contain authentication information. In addition, all subsequent incoming RIP packets on that interface are accepted only if they carry a valid authentication header.
RIP Configure Commands configure router rip interface distribute_list This command configures the access list to be used to filter either incoming or outgoing routes for this interface. This command is used in conjunction with the redistribute command. Parameter Description access_list Access list number Enter a number.
Foundry AR-Series Router User Guide configure router rip interface metric This command configures the metric value for RIP routes for this interface. Parameter Description metric Default metric The range is 1 - 4294967294; the default is 1. syntax: [ no ] metric < n > example: Foundry-AR1208/configure/router/rip/interface ethernet0# metric 3 This example configures the RIP routes metric for interface Ethernet 0 to 3.
RIP Configure Commands configure router rip interface mode This command configures RIP mode for the specific interface. This command is similar to the global RIP mode command, but it is only applicable to the current interface. Use this command to override the global RIP mode settings. Parameter Description mode Enter a mode value.
Foundry AR-Series Router User Guide configure router rip interface neighbor This command specifies a RIP neighbor for a specific interface. Use this command multiple times to add multiple neighbors. When neighbors are specified, RIP updates are unicast to those neighbors (and not broadcast or multicast on that segment). Parameter Description ip_address Neighbor IP address syntax: [ no ] neighbor < ip_address > example: Foundry-AR1208/configure/router/rip/interface ethernet0# neighbor 192.168.31.
RIP Configure Commands configure router rip interface passive This command configures RIP mode for a specific interface to passive (listen-only) mode. Use this command to override a global RIP mode configured for an interface. syntax: [ no ] passive example: Foundry-AR1208/configure/router/rip/interface ethernet1# passive This example configures interface Ethernet 1 to listen-only mode.
Foundry AR-Series Router User Guide configure router rip interface split_horizon This command configures the split-horizon mechanism on an interface. By default, split horizon is enabled for all interfaces for poison-reverse. Parameter Description splitval Split horizon algorithm none Disables split horizon. simple Enables split horizon.
RIP Configure Commands configure router rip mode This command globally configures RIP mode for all interfaces. Use this command to override the global mode setting. Parameter Description mode Enter a mode value.
Foundry AR-Series Router User Guide configure router rip pacing This command enables RIP updates sent from this router to be released to the network in a controlled manner to avoid traffic bottlenecks. When enabled, RIP updates from this router will be sent in several small intervals instead on one burst. This is useful when the number of routes to be sent is large (more than 1000).
RIP Configure Commands configure router rip passive This command configures RIP passive (listen only) mode. All configured interfaces will only listen to RIP (version 1 and 2) updates, but will not send any updates. You can override the mode on a specific interface by configuring RIP mode for that specific interface. syntax: [ no ] passive example: Foundry-AR1208/configure/router/rip# passive This example configures all RIP interfaces to listen-only mode.
Foundry AR-Series Router User Guide configure router rip redistribute This command accesses the following next-level commands that configure the system to use RIP updates to redistribute routes learned from other routing protocols. related commands: configure router rip redistribute bgp configure router rip redistribute connected configure router rip redistribute ospf configure router rip redistribute static applicable systems: All models. 11 - 16 © 2004 Foundry Networks, Inc.
RIP Configure Commands configure router rip redistribute bgp This command configures RIP to redistribute bgp routes. Parameter Description as_number Autonomous system number The range is 1 - 65535. metric Default metric The range is 1 - 16; the default is 1.
Foundry AR-Series Router User Guide configure router rip redistribute connected This command configures RIP to redistribute connected routes. Parameter Description metric Default metric The range is 1 - 16; the default is 1. syntax: [ no ] redistribute connected [ metric < n > ] example: Foundry-AR1208/configure/router/rip# redistribute connected This example configures RIP to redistribute connected routes.
RIP Configure Commands configure router rip redistribute ospf This command configures RIP to redistribute OSPF routes. Parameter Description metric Default metric The range is 1 - 16; the default is 1. syntax: [ no ] redistribute ospf [ metric < n > ] example: Foundry-AR1208/configure/router/rip# redistribute ospf related commands: configure router rip redistribute bgp configure router rip redistribute connected configure router rip redistribute static applicable systems: All models.
Foundry AR-Series Router User Guide configure router rip redistribute static This command configures RIP to redistribute static routes. Parameter Description metric Default metric The range is 1 - 16; the default is 1. syntax: [ no ] redistribute static [ metric < n > ] example: Foundry-AR1208/configure/router/rip# redistribute static This example configures RIP to redistribute static routes.
RIP Configure Commands configure router rip timers This command accesses the following next-level commands that configure the global RIP timers. related commands: configure router rip timers flush configure router rip timers holddown configure router rip timers update applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide configure router rip timers flush This command configures the global RIP flush timer. This is the time interval in seconds that must pass before the route is removed from the routing table. This value should be configured to be greater than the configured holddown time value. Parameter Description time Flush timer value in seconds The range is 1 - 65535; the default is 180.
RIP Configure Commands configure router rip timers holddown This command configures the global RIP hold down timers. Hold down time is the interval in seconds during which routing information regarding better routes is suppressed. This should be configured to be at least twice the value of the update timers. Parameter Description time Holddown timer value in seconds The range is 1- 65535; the default is 180.
Foundry AR-Series Router User Guide configure router rip timers update This command configures the global RIP update timer. This timer specifies the interval in seconds for sending periodic RIP updates. Parameter Description time Update timer in seconds The range is 1 - 65536; the default is 120. syntax: [ no ] update time < n > example: Foundry-AR1208/configure/router/rip/timers# update 45 This example globally configures RIP updates to occur every 45 seconds.
Chapter 12 RIP show Commands Use RIP display/show commands to display all configured RIP information. NOTE: The CLI commands “show” and “display” can be used interchangeably. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide show ip rip This command accesses the following next-level commands that display more specific information. related commands: show ip rip global show ip rip interface show ip rip statistics applicable systems: All models. 12 - 2 © 2004 Foundry Networks, Inc.
RIP show Commands show ip rip global This command displays global configured information about mode, distance, default metric, and timers for RIP. syntax: show ip rip global example: Foundry-AR1208# show ip rip global # show ip rip global Router RIP is enabled Mode: RIP 2 Distance: 100 Default Metric: 1 Timers: Update: 30 seconds related commands: show ip rip interface show ip rip routes show ip rip statistics applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide show ip rip interface This command accesses the following next-level commands that display configuration information about mode, metric, authentication, split horizon, and routers for the RIP interface. related commands: show ip rip interface all show ip rip interface bundle show ip rip interface ethernet show ip rip interface statistics applicable systems: All models. 12 - 4 © 2004 Foundry Networks, Inc.
RIP show Commands show ip rip interface all This command displays information about all configured RIP interfaces. syntax: show ip rip interface all example: Foundry-AR1208# show ip rip interface all # show ip rip interface all RIP is configured for interface
Foundry AR-Series Router User Guide show ip rip interface bundle This command displays RIP information for a configured bundle. Parameter Description bundle_name The name of the desired bundle. Enter a string of up to a maximum of 8 characters. pvc PVC identifier Used only for an encapsulated fr bundle. The range is 16 - 1022.
RIP show Commands show ip rip interface ethernet This command displays RIP information about the Ethernet interface.
Foundry AR-Series Router User Guide show ip rip interface statistics This command displays global RIP interface statistics, such as the number of pad packets received, the number or bad routes received, and the number of triggered updates sent.
RIP show Commands show ip rip statistics This command shows global RIP statistics, such as route changes and queries. syntax: show ip rip statistics example: Foundry-AR1208# show ip rip statistics show ip rip statistics RIP Global Statistics: =============================== Number of Global Route Changes : <0# related commands: show ip rip global show ip rip interface show ip rip routes applicable systems: All models. June 2004 © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide 12 - 10 © 2004 Foundry Networks, Inc.
Chapter 13 AS Path Regular Expressions This appendix provides information about how to use and configure regular expressions for use with BGP4 routing protocol commands. Matching AS Paths An AS path regular expression is a regular expression with the alphabet used as the set of AS numbers defining a set of AS paths. Note that according to this definition, AS path regular expressions are implicitly anchored at the beginning and end.
Foundry AR-Series Router User Guide !AS Matches any AS number except the given one. AS1 -AS2 Is a range of ASs. It matches all AS numbers between AS1 and AS2 inclusive. !AS1 - AS2 This matches all numbers except the given one. . Matches any number. null Matches an empty (0 length) string, e.g., (AS1 empty AS2) is equivalent to (AS1 AS2). term {m, n} A term followed by {m, n} (where m and n are both non-negative integers and m <= n) means at least m and at most n repetitions.
Chapter 14 Multicasting Multicasting Overview Traditional multicast routing mechanisms such as Distance Vector Multicast Routing Protocol (DVMRP) and Multicast Open Shortest Path First (MOSPF) were intended for use within regions where groups are densely populated or bandwidth is universally plentiful. When groups, and senders to these groups, are distributed sparsely across a wide area, these “dense mode” schemes do not perform efficiently.
Foundry AR-Series Router User Guide TABLE 4 PIM COMMANDS (CONTINUED) Configure Join/Prune Holdtime Foundry/configure/ip/pim#join-prune-holdtime
Multicasting TABLE 4 PIM COMMANDS (CONTINUED) Configure as candidate RP period Foundry/configure/ip/pim/crp#period
Foundry AR-Series Router User Guide TABLE 5 PIM SHOW AND DEBUG COMMANDS (CONTINUED) Display PIM Candidate RP info Foundry#show ip pim crp-info Display PIM statistics Foundry#show ip pim statistics Display PIM RP set Foundry#show ip pim rp-set Display PIM Static RP Foundry#show ip pim rp Trace PIM packets Foundry# debug ip pim packet
Multicasting membership information enables the router to forward traffic only from those sources from which receivers requested the traffic. IGMPv3 supports applications that explicitly signal sources from which they want to receive traffic.
Foundry AR-Series Router User Guide TABLE 6 IGMP COMMANDS (CONTINUED) Configuring Send Router Alerts Foundry/configure/ip/igmp/interface ethernet0# [no] sendrouter-alert Configuring Require Router Alerts Foundry/configure/ip/igmp/interface ethernet0# [no] require-router-alert Assigning filter list for group filtering Foundry/configure/ip/igmp/interface ethernet0# group-filter
Multicasting Multicast traceroute uses any information available to it in the router to try to determine a previous hop to forward the trace towards. Multicast routing protocols vary in the type and amount of state they keep; multicast traceroute tries to work with all of them by using whatever is available. For example, if a DVMRP router has no active state for a particular source but does have a DVMRP route, it chooses the parent of the DVMRP route as the previous hop.
Foundry AR-Series Router User Guide When multipath is disabled, Foundry selects the nexthop address with lowest ip address. For equal cost routes the nexthops are stored in the increasing (ascending) order of IP address. show ip rpf command displays the selected path, based on the configured multipath method and the nexthops of the best route to the IP address passed.
Chapter 15 Security Features Introduction to Security Foundry introduces a wide range of robust industry-standard security features including: • Virtual Private Networking • IPSec encryption and tunneling • Generalized Router Encryption • Firewall with private network management (Network Address Translation and Port Address Translation) This chapter explains each of these features in detail.
Foundry AR-Series Router User Guide Foundry/configure# system licenses advance_vpn Enter Security Upgrade License key: 024f3bc296b4ea7265 Securing Remote Access Using IPSec VPN The features allow administrators to form a security tunnel to join two private networks over the Internet.
Security Features In tunnel mode, at each IKE end point, the IP traffic to be protected is completely encapsulated with another IP packet. In this, the inner IP header remains the same as seen in the original traffic to be protected. In the outer IP header, the source and destination addresses are the addresses of the tunnel end points. Typically, for a remote user, the source address of the outer IP header is the dynamic public IP address provided by the ISP.
Step 2: Configure the Ethernet interface with trusted network type: Router1/configure# interface ethernet 0 Configuring existing Ethernet interface Router1/configure interface/ethernet 0# ip address 10.0.1.
Security Features Step 6: Display the IKE policies: Router1# show crypto ike policy all Policy -----Router2 Peer ---172.16.0.2 Mode ---Main Transform --------P1 pre-g1-3des-sha1 Step 7: Display the IKE policies in detail: Router1# show crypto ike policy all detail Policy name Router2, Local addr 172.16.0.1, Peer addr 172.16.0.2 Main mode, Response and Initiate, PFS is not enabled, Shared Key is ***** Local ident 172.16.0.1 (ip-address), Remote Ident 172.16.0.
Foundry AR-Series Router User Guide Step 9: Display the IPSec policies: Router1# show crypto ipsec policy all Policy -----Router2 sha1-tunl Peer ---172.16.0.2 Match ----S 172.16.0.1/32/any Proto Transform ----- --------Any P1 esp-aes- INRouter2 172.16.0.2 D 10.0.2.0/24/any S 10.0.2.0/24/any Any P1 esp-aes- Step 10: Display IPSec policies in detail: Router1# show crypto ipsec policy all detail Policy name Router2 is enabled, Direction is outbound Peer Address is 172.16.0.
Security Features Step 11: Configure firewall policies to allow IKE negotiation through untrusted interface (applicable only if firewall license is also enabled): Router1/configure# firewall internet Router1/configure/firewall internet# policy 1000 in service ike self Router1/configure/firewall internet/policy 1000 in# exit Router1/configure/firewall internet# exit Step 12: Configure firewall policies to allow desired services through untrusted interface to manage the router (applicable only if firewall l
Foundry AR-Series Router User Guide Step 14: Display firewall policies in the internet map in detail (applicable only if firewall license is enabled): Router1# show firewall policy internet detail Policy with Priority 1000 is enabled, Direction is inbound Action permit, Traffic is self Logging is disable Source Address is any, Dest Address is any Source Port is any, Service Name is ike Schedule is disabled, Ftp-Filter is disabled Smtp-Filter is disabled, Http-Filter is disabled Rpc-Filter is disabled, Nat
Security Features Step 15: Enable SNMP on the Router1 router: Router1/configure/crypto/# exit Router1/configure# snmp Router1/configure/snmp# community public rw Router1/configure/snmp# exit Step 16: Display SNMP communities: Router1# show snmp communities Community = public, privilege=rw Step 17: Repeat steps 1 - 16 with suitable modifications on Router2 prior to managing Router1 from Router2’s LAN side. Step 18: Test the IPSec tunnel for managing the Router1 router from a host on Router2’s LAN.
Foundry AR-Series Router User Guide Router1# show crypto ipsec sa all detail Crypto Policy name: INRouter2 Protocol is Any Local ident(ip/mask/port): (10.0.2.0/255.255.255.0/any) Remote ident(ip/mask/port): (172.16.0.1/255.255.255.255/any) Peer Address is 172.16.0.
Security Features Figure 1 Tunnel Mode Between Two Foundry Security Gateways - Single Proposals Step 1: Configure a WAN bundle of network type untrusted: Router1/configure/interface/bundle Router1/configure/interface/bundle Router1/configure/interface/bundle Router1/configure/interface/bundle Router1/configure/interface/bundle wan1# wan1# wan1# wan1# wan1# link t1 1 encapsulation ppp ip address 172.16.0.
Foundry AR-Series Router User Guide Step 5: Configure IKE to the peer gateway: Router1/configure# crypto Router1/configure/crypto# ike policy Router2 172.16.0.2 Router1/configure/crypto/ike/policy Router2 172.16.0.2# localaddress 172.16.0.1 message: Default proposal created with priority1-des-sha1pre_shared-g1 message: Key String has to be configured by the user Router1/configure/crypto/ike/policy Router2 172.16.0.2# key secretkey Router1/configure/crypto/ike/policy Router2 172.16.0.
Security Features Step 8: Configure IPSec tunnel to the remote host: Router1/configure/crypto# ipsec policy Router2 172.16.0.2 Router1/configure/crypto/ipsec/policy Router2 172.16.0.2# match address 10.0.1.0 24 10.0.2.0 24 Default proposal created with priority1-esp-3des-sha1-tunnel and activated. Router1/configure/crypto/ipsec/policy Router2 172.16.0.2# proposal 1 Router1/configure/crypto/ipsec/policy Router2 172.16.0.
Foundry AR-Series Router User Guide Step 10: Display IPSec policies detail: Router1# show crypto ipsec policy all detail Policy name Router2 is enabled, Direction is outbound Peer Address is 172.16.0.2, Action is Apply Key Management is Automatic PFS Group is disabled Match Address: Protocol is Any Source ip address (ip/mask/port): (10.0.1.0/255.255.255.0/any) Destination ip address (ip/mask/port): (10.0.2.0/ 255.255.255.
Security Features Step 12: Display firewall policies in the internet map (applicable only if firewall license is enabled): Router1# show Advanced: S R E Pri --1000 1024 Dir --in out firewall policy Self Traffic, F Rpc-Filter, N Policy Enabled, Source Addr ----------any any internet - Ftp-Filter, H - Http-Filter, Nat-Ip/Nat-Pool, L - Logging, M - Smtp-Filter Destination Addr ---------------any any Sport Dport Proto ----------------ike any any any Action -----PERMIT PERMIT Advanced -------SE SE Ste
Foundry AR-Series Router User Guide Step 15: Display firewall policies in the corp map (applicable only if firewall license is enabled): Router1# show Advanced: S R E - firewall policy Self Traffic, F Rpc-Filter, N Policy Enabled, Pri Dir Source Addr Action Advanced --- --- ------------ -------- 15 - 16 corp - Ftp-Filter, H - Http-Filter, Nat-Ip/Nat-Pool, L - Logging, M - Smtp-Filter Destination Addr Sport Dport Proto ---------------- ----------------- ---- © 2004 Foundry Networks, Inc.
Security Features Step 16: Display firewall policies in the corp map in detail (applicable only if firewall license is enabled): Router1# show firewall policy corp detail Policy with Priority 1000 is enabled, Direction is inbound Action permit, Traffic is transit Logging is disable Source Address is 10.0.2.0/24, Dest Address is 10.0.1.
Foundry AR-Series Router User Guide Step17: Repeat steps 1 -16 with suitable modifications on Router2 prior to passing traffic. Step 18: Test the IPSec tunnel between Router1 and Router2 by passing traffic from the 10.0.1.0 to the 10.0.2.0 network. Step 19: After transit traffic is passed through the tunnel, display the IKE and IPSec SA tables. Router1# show crypto ike sa all Policy -----Router2 Peer ---172.16.0.
Security Features Router1# show crypto ipsec sa all detail Crypto Policy name: INRouter2 Protocol is Any Local ident(ip/mask/port): (10.0.2.0/255.255.255.0/any) Remote ident(ip/mask/port): (10.0.1.0/255.255.255.0/any) Peer Address is 172.16.0.
Foundry AR-Series Router User Guide Figure 2 Tunnel Mode Between Two Foundry Security Gateways - Multiple Proposals Step 1: Configure a WAN bundle of network type untrusted: Router1/configure/interface/bundle Router1/configure/interface/bundle Router1/configure/interface/bundle Router1/configure/interface/bundle Router1/configure/interface/bundle wan1# wan1# wan1# wan1# wan1# link t1 1 encapsulation ppp ip address 172.16.0.
Security Features Step 5: Configure IKE to the peer gateway: Router1/configure# crypto Router1/configure/crypto# ike policy Router2 172.16.0.2 Router1/configure/crypto/ike/policy Router2 172.16.0.2# localaddress 172.16.0.1 message: Default proposal created with priority1-des-sha1pre_shared-g1 message: Key String has to be configured by the user Router1/configure/crypto/ike/policy Router2 172.16.0.2# key secretkey Router1/configure/crypto/ike/policy Router2 172.16.0.
Foundry AR-Series Router User Guide Step 8: Configure IPSec tunnel to the remote host: Router1/configure/crypto# ipsec policy Router2 172.16.0.2 Router1/configure/crypto/ipsec/policy Router2 172.16.0.2# match address 10.0.1.0 24 10.0.2.0 24 Default proposal created with priority1-esp-3des-sha1-tunnel and activated. Router1/configure/crypto/ipsec/policy Router2 172.16.0.2# proposal 1 Router1/configure/crypto/ipsec/policy Router2 172.16.0.
Security Features Router1# show crypto ipsec policy all detail Policy name Router2 is enabled, Direction is outbound Peer Address is 172.16.0.2, Action is Apply Key Management is Automatic PFS Group is disabled Match Address: Protocol is Any Source ip address (ip/mask/port): (10.0.1.0/255.255.255.0/ any) Destination ip address (ip/mask/port): (10.0.2.0/ 255.255.255.
Foundry AR-Series Router User Guide Step 11: Display firewall policies in the internet map (applicable only if firewall license is enabled): Router1# show Advanced: S R E Pri --1000 1024 Dir --in out firewall policy Self Traffic, F Rpc-Filter, N Policy Enabled, Source Addr ----------any any internet - Ftp-Filter, H - Http-Filter, Nat-Ip/Nat-Pool, L - Logging, M - Smtp-Filter Destination Addr ---------------any any Sport Dport Proto ----------------ike any any any Action -----PERMIT PERMIT Advanced
Security Features Step 14: Display firewall policies in the corp map (applicable only if firewall license is enabled): Router1# show Advanced: S R E - firewall policy Self Traffic, F Rpc-Filter, N Policy Enabled, Pri Dir Source Addr Action Advanced --- --- ------------ -------- June 2004 corp - Ftp-Filter, H - Http-Filter, Nat-Ip/Nat-Pool, L - Logging, M - Smtp-Filter Destination Addr Sport Dport Proto ---------------- ----------------- ---- © 2004 Foundry Networks, Inc.
Foundry AR-Series Router User Guide Step 15: Display firewall policies in the corp map in detail (applicable only if firewall license is enabled): Router1# show firewall policy corp detail Policy with Priority 1000 is enabled, Direction is inbound Action permit, Traffic is transit Logging is disable Source Address is 10.0.2.0/24, Dest Address is 10.0.1.
Security Features Step16: Repeat steps 1 -15 with suitable modifications on Router2 prior to passing bidirectional traffic. Step 17: Test the IPSec tunnel between Router1 and Router2 by passing traffic from the 10.0.1.0 network to the 10.0.2.0 network. Step 18: After traffic is passed through the tunnel, display the IKE and IPSec SA tables. Router1# show crypto ike sa all Policy -----Router2 Peer ---172.16.0.
Foundry AR-Series Router User Guide Router1# show crypto ipsec sa all detail Crypto Policy name: INRouter2 Protocol is Any Local ident(ip/mask/port): (10.0.2.0/255.255.255.0/any) Remote ident(ip/mask/port): (10.0.1.0/255.255.255.0/any) Peer Address is 172.16.0.
Security Features Figure 15.2 IPSec Tunneling Using User Group Method Step 1: Configure a WAN bundle of network type untrusted: Router1/configure# interface bundle wan1 Configuring new bundle Router1/configure/interface/bundle wan1# Router1/configure/interface/bundle wan1# Router1/configure/interface/bundle wan1# Router1/configure/interface/bundle wan1# Router1/configure/interface/bundle wan1# link t1 1 encapsulation ppp ip address 172.16.0.
Foundry AR-Series Router User Guide Step 3: Display the crypto interfaces: Router1# show crypto interfaces Interface Name --------ethernet0 wan1 Network Type ------trusted untrusted Step 4: Configure dynamic IKE policy for a group of mobile users: Router1/configure# crypto Router1/configure/crypto# dynamic Router1/configure/crypto/dynamic# ike policy sales Router1/configure/crypto/dynamic/ike/policy sales# local-address 172.16.0.
Security Features Step 6: Display dynamic IKE policies in detail: Router1# show crypto dynamic ike policy all detail Policy name sales, User group name sales Aggressive mode, Response Only, PFS is not enabled, Shared Key is ***** Client authentication is Radius(PAP) Local addr: 172.16.0.1, Local ident 172.16.0.1 (ip-address) Remote idents are david@abc-corp.com (email-id), mike@abc-corp.
Foundry AR-Series Router User Guide Step 9: Display dynamic IPSec policies in detail: Router1# show crypto dynamic ipsec policy all detail Policy sales is enabled, User group name sales Direction is outbound, Action is Apply Key Management is Automatic PFS Group is disabled Match Address: Protocol is Any Source ip address (ip/mask/port): (10.0.1.0/255.255.255.
Security Features Step 11: Configure firewall policies to allow IKE negotiation through untrusted interface (applicable only if firewall license is also enabled): Router1/configure# firewall internet Router1/configure/firewall internet# policy 1000 in service ike self Router1/configure/firewall internet/policy 1000 in# exit Router1/configure/firewall internet# exit Step 12: Display firewall policies in the internet map (applicable only if firewall license is enabled): Router1# show Advanced: S R E - fi
Foundry AR-Series Router User Guide Step 14: Configure firewall policies for a group of mobile users to allow access to the local LAN (applicable only if firewall license is enabled): Router1/configure/firewall corp# Router1/configure/firewall corp# policy 1000 in user-group sales address any any 10.0.1.
Security Features Step 16: Display firewall policies in the corp map in detail (applicable only if firewall license is enabled): Router1# show firewall policy corp detail Policy with Priority 1000 is enabled, Direction is inbound Action permit, Traffic is transit User Group is sales, Logging is disable Source Address is any, Dest Address is 10.0.1.
Foundry AR-Series Router User Guide Step 17: Test the IPSec tunnel between the VPN client and the server by passing traffic from the client to the 10.0.1.0 network. Step 18: After passing traffic through the tunnel, display the list of clients logged onto the VPN server and the IKE and IPSec SA tables: Router1# show crypto dynamic clients Client Address Client Id ---------------------192.168.107.105 david@abc-corp...
Security Features T Router1# show crypto ipsec sa all detail Crypto Policy name: INsales Protocol is Any Local ident(ip/mask/port): (192.168.107.105/255.255.255.255/any) Remote ident(ip/mask/port): (10.0.1.0/255.255.255.0/any) Peer Address is 172.16.0.
Foundry AR-Series Router User Guide Figure 15.3 IPSec Tunneling Using Mode Configuration Method Step 1: Configure a WAN bundle of network type untrusted: Router1/configure# interface bundle wan1 Configuring new bundle Router1/configure/interface/bundle wan1# Router1/configure/interface/bundle wan1# Router1/configure/interface/bundle wan1# Router1/configure/interface/bundle wan1# Router1/configure/interface/bundle wan1# link t1 1 encapsulation ppp ip address 172.16.0.
Security Features Step 3: Display the crypto interfaces: Router1# show crypto interfaces Interface Name --------ethernet0 wan1 Network Type ------trusted untrusted Step 4: Configure dynamic IKE policy for a group of mobile users: Router1/configure# crypto Router1/configure/crypto# dynamic Router1/configure/crypto/dynamic# ike policy sales modecfg-group Router1/configure/crypto/dynamic/ike/policy sales# local-address 192.168.55.
Foundry AR-Series Router User Guide Step 6: Display dynamic IKE policies in detail: Router1# show crypto dynamic ike policy all detail Policy name sales, Modeconfig group Aggressive mode, Response Only, PFS is not enabled, Shared Key is ***** Local addr: 192.168.55.52, Local ident 192.168.55.52 (ip-address) Remote idents are david@abc-corp.com (email-id), mike@abc-corp.com (email-id) Address Pool: Pool# 1: 20.1.1.100 to 20.1.1.
Security Features Step 9: Display dynamic IPSec policies in detai:l Router1# show crypto dynamic ipsec policy all detail Policy sales is enabled, Modeconfig Group Action is Apply Key Management is Automatic PFS Group is disabled Match Address: Protocol is Any Source ip address (ip/mask/port): (10.0.1.0/255.255.255.
Foundry AR-Series Router User Guide Step 12: Display firewall policies in the internet map in detail (applicable only if firewall license is enabled): Router1# show firewall policy internet detail Policy with Priority 1000 is enabled, Direction is inbound Action permit, Traffic is self Logging is disable Source Address is any, Dest Address is any Source Port is any, Service Name is ike Schedule is disabled, Ftp-Filter is disabled Smtp-Filter is disabled, Http-Filter is disabled Rpc-Filter is disabled, Nat
Security Features Step 15: Display firewall policies in the corp map in detail (applicable only if firewall license is enabled): Router1# show firewall policy corp detail Policy with Priority 1000 is enabled, Direction is inbound Action permit, Traffic is transit Logging is disable Source Address is 20.1.1.100-20.1.1.150, Dest Address is 10.0.1.
Foundry AR-Series Router User Guide Step 16: Test the IPSec tunnel between the VPN client and the server by passing traffic from the client to the 10.0.1.0 network. Step 17: After passing traffic through the tunnel, display the list of clients logged onto the VPN server and the IKE and IPSec SA tables: Router1# show crypto dynamic clients Client Address Client Id Policy Advanced ---------------------------------192.168.107.105 david@abc-corp... sales:20.1.1.
Security Features Router1# show crypto ipsec sa all Policy Dest IP Spi Bytes -----------------INsales 172.16.0.1 0xbba97427 840 sales 192.168.107.105 0xcb0e23f3 560 Router1# Router1# show crypto ipsec sa all detail Transform --------esp-aes-sha1-tunl esp-aes-sha1-tunl Crypto Policy name: INsales Protocol is Any Local ident(ip/mask/port): (20.1.1.1/255.255.255.255/any) Remote ident(ip/mask/port): (10.0.1.0/255.255.255.0/any) Peer Address is 172.16.0.
Foundry AR-Series Router User Guide GRE Configuration Examples This example explains how to configure a basic GRE tunnel as shown in Figure 15.4. Figure 15.4 Simple GRE configuration 40.1.1.0 10.3.1.0 192.168.94.220 192.168.55.75 Configuring Site to Site Tunnel To configure GRE in a site to site tunnel configuration: 1.
Security Features Foundry/configure# ip route 0.0.0.0 0.0.0.0 192.168.94.254 Foundry/configure# ip route 40.1.1.0 24 t0 NOTE: The peer of a local WAN interface cannot be used as a tunnel destination. 4. Verify that the tunnel is up and running. (If it is not, check the Gateway and Source Address fields.) Foundry# show ip interface t0 t0 (unit number 5) Type: TUNNEL Flags: (0x74243) UP, RUNNING, MULTICAST-ROUTE Internet Address: 103.1.1.2 Internet Netmask: 255.255.255.0 Internet Broadcast: 103.1.1.
Foundry AR-Series Router User Guide 5. Configure the Cisco side: cisco > config t cisco(config)#interface Ethernet2/0 cisco(config-if)#ip address 192.168.55.75255.255.255.0 cisco(config-if)#exit cisco(config)#interface Tunnel 0 cisco(config-if)#ip address 103.1.1.1 255.255.255.0 cisco(config-if)#tunnel source 192.168.55.75 cisco(config-if)#tunnel destination 192.168.94.220 cisco(config-if)#exit cisco(config)#ip route 0.0.0.0 0.0.0.0 192.168.55.254 cisco(config)#ip route 10.3.1.0 255.255.255.
Security Features 3. Configure the routes: Foundry/ configure# ip route 0.0.0.0 0.0.0.0 192.168.94.254 Foundry/ configure# ip route 40.1.1.0 24 t0 4.
Foundry AR-Series Router User Guide NOTE: Using the redistribute connected command adds a recursive route to the tunnel destination. This will cause the tunnel to shut down. To prevent this, add a 32-bit static route for the tunnel destination. With the tunnel properly configured and working, users on one side of the tunnel can ping users on the other side. Firewalls Configuring firewalls allows administrators to adapt network protection policies to meet ever-changing hacker and intruder threats.
Security Features Step 1:Configure the Ethernet interfaces and the WAN interfaces with IP addresses: Foundry/configure# interface ethernet 0 Configuring existing Ethernet interface Foundry/configure/interface/ethernet 0# ip address 10.2.1.1 24 Foundry/configure/interface/ethernet 0# exit Foundry/configure# interface ethernet 1 Configuring existing Ethernet interface Foundry/configure/interface/ethernet 1# ip address 10.3.1.
Foundry AR-Series Router User Guide Foundry/configure# Foundry/configure/firewall Foundry/configure/firewall Foundry/configure/firewall Foundry/configure/firewall Foundry/configure/firewall Foundry/configure/firewall Foundry/configure/firewall Foundry/configure/firewall *.java Foundry/configure/firewall Foundry/configure/firewall 193.168.94.
Security Features Foundry/configure# firewall dmz Foundry/configure/firewall dmz# object Foundry/configure/firewall dmz/object# ftp-filter putdeny deny put mkdir Foundry/configure/firewall dmz/object# nat-pool ftpsrvr static 10.3.1.100 Foundry/configure/firewall dmz/object# exit Foundry/configure/firewall dmz# policy 100 in address any any 193.168.94.
Foundry AR-Series Router User Guide Step 11:Verify the system configuration by displaying the running configuration: Foundry/configure# show configuration running Please wait...
Security Features qos exit qos vrrp_mode 0 aaa exit aaa crypto trusted exit ethernet interface ethernet 1 ip address 10.3.1.1 255.255.255.0 ip multicast mode ospfrip2 exit multicast mtu 4000 icmp exit icmp qos exit qos vrrp_mode 0 aaa exit aaa crypto trusted exit ethernet interface bundle wan link t1 1 encapsulation ppp ip address 193.168.94.220 255.255.255.
Foundry AR-Series Router User Guide load_balance per_flow multicast exit multicast route 0.0.0.0 0.0.0.0 wan 1 exit ip policy community_list exit community_list crypto exit crypto firewall global exit firewall firewall internet interface wan policy 1024 out self exit policy exit firewall firewall corp interface ethernet0 object http-filter javadeny deny *.java exit object policy 1021 in deny exit policy policy 1022 out self exit policy policy 1023 in self exit policy policy 1024 out nat-ip 193.168.94.
Security Features Foundry# config term Foundry/configure# firewall global Foundry/configure/firewall global# dos-protect Foundry/configure/firewall global/dos-protect# enable-all Foundry/configure/firewall global/dos-protect# exit 2 Foundry/configure# Packet Reassembly To configure the firewall to perform IP reassembly of oversized packets that have been fragmented, enter: Foundry# config term Foundry/configure# firewall global Foundry/configure/firewall global# ip-reassembly Foundry/configure/firewall g
Foundry AR-Series Router User Guide NAT Configuration Examples Dynamic NAT (many to many) In dynamic (many-to-many) NAT type, multiple source IP addresses in the corporate network will be mapped to multiple NAT IP addresses (not necessarily of equal number). For a set of local IP address from 10.1.1.1 to 10.1.1.4 there will be a set of NAT IP address from 60.1.1.1 to 60.1.1.2. In case of many-to-many NAT, only IP address translation takes place, i.e., if a packet travels from 10.1.1.1 to yahoo.
Security Features Static NAT (one to one) Figure 15.7 Static NAT 10.1.1.1 OPAL INTERNET 10.1.1.2 50.1.1.1-50.1.1.3 10.1.1.3 In static (one-to-one) NAT type, for each IP address in the corporate network, one NAT IP address will be used. For example, for the three IP addresses from 10.1.1.1 to 10.1.1.3, there is a set of three NAT IP address from 50.1.1.1 to 50.1.1.3. In case of one-to-one NAT, only IP address translation takes place, that is, if a packet travels from 10.1.1.1 to yahoo.
Foundry AR-Series Router User Guide Figure 15.8 Mapping Multiple NAT Addresses to One Public IP Address 10.1.1.1 OPAL INTERNET 10.1.1.2 50.1.1.5 10.1.1.3 There are two methods to configure Port Address Translation (PAT) on the Foundry gateway. In the first method, specify the IP address to the nat-ip parameter in the policy command. In the second method, create a pool of type PAT and then attach it to the policy. In PAT, multiple hosts can share the same IP address.
Security Features Foundry/configure# firewall corp Foundry/configure/firewall corp# object Foundry/configure/firewall corp/object# nat-pool addresspoolPat pat 50.1.1.5 Foundry/configure/firewall corp/object# exit Foundry/configure/firewall corp# policy 2 out address 10.1.1.1 10.1.1.
Foundry AR-Series Router User Guide Table 15.3: Authentication Algorithms Authentication Algorithms for AH/ ESP Hash Size HMAC-MD5-96 96 bits HMAC-HSHA1-96 96 bits Table 15.4: Diffie-Hellman Groups Diffie-Hellman Groups for Authentication Key Size Group 1 768 bits Group 2 1024 bits Group 5 1536 bits Foundry IKE and IPSec Defaults To minimize configuration required by the user, default IKE and IPSec values have been implemented in Foundry’s encryption scheme.
Security Features IPSec Defaults Table 15.6: lists IPSec defaults. When the user creates an IPSec policy and provides the match address, an IPSec proposal with priority 1 is automatically created. When an outbound policy is specified, an inbound policy is automatically created. Table 15.
Foundry AR-Series Router User Guide Table 15.8: Firewall per policy defaults Direction No Default Action Permit Traffic type Transit Source Port Any Destination Port Any Schedule Disabled FTP Filter Disabled SMTP Filter Disabled HTTP Filter Disabled RPC Filter Disabled NAT Disabled Maximum Connections 1024 Connection Rate Disabled Policing Disabled Bandwidth Disabled Table 15.
Security Features Table 15.10: DoS Protection Defaults (Configured DoS Attacks) Win Nuke Attack Check Disabled IP Unaligned Time stamp check Disabled TCP Sequence Number Prediction Check Disabled TCP Sequence Number Range Check Disabled FTP Bounce Check Disabled Tunneling Default Values This section provides the IP-IP and GRE tunneling protocol default values. Table 15.
Foundry AR-Series Router User Guide 15 - 66 © 2004 Foundry Networks, Inc.
Index A Help,online 4-4 abbreviated commands 4-3 Audience 3-1 I Introduction 3-1 B bold type 4-3 N C navigation 4-4 nomenclature 3-1 normal type 4-2 command line interface conventions used 4-1 getting help 4-4 command navigation 4-4 command shortcuts 4-3 command tree 4-5 context-sensitive commands 4-1 control key combinations 4-4 conventions manual 3-1 D display/show command 4-7 displaying command tree 4-5 O online help, see Help S show/display command 4-7 spacebar 4-4 T Tab key 4-4 telephone A
Foundry AR-Series Router User Guide Index - 2 © 2004 Foundry Networks, Inc.
