Nokia IPSO 4.0 manual

Nokia Network V oyager for IPSO 4.0 Reference Guide Part No. N451818001 Rev A Published October 2005[...]

2 Nokia Network Voyager for IPSO 4.0 Referenc e Gu ide COPYRIGHT ©2005 Nokia. All rights reserved. Rights reserved under the copyright laws of the United S tates. RESTRICTED RIGHTS LEGEND Use, duplication, or disclosure by the United St at es Government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in T echnical [...]

Nokia N etwork Voyager fo r IPSO 4.0 Refer ence Guide 3 Regional Contact Information Nokia Customer Support Fax 1-650-691-2170 Mail Address Nokia Inc. 313 Fairchild Drive Mountain View , California 94043-2215 USA Americas Nokia Inc. 313 Fairchild Drive Mountain View , CA 94043-2215 USA T el: 1-877-997-9199 Outside USA and Canada: +1 512-437-7089 em[...]

4 Nokia Network Voyager for IPSO 4.0 Referenc e Gu ide[...]

Nokia Networ k Voya ger IPSO 4.0 Referenc e Guide 5 Content s About the Nokia Network Voyager Reference Guide . . . . . . . . . 19 Conventions This Guide Uses . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Text Conventions . . . . . . . . [...]

6 Nokia Network Voyager IPSO 4.0 Reference Guide Configuring Tunnel Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Ethernet Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Configuring Ethernet Interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . 34 Link Aggregation . . . . . . . [...]

Nokia Networ k Voya ger IPSO 4.0 Referenc e Guide 7 Configuring Unnumbered Interfaces . . . . . . . . . . . . . . . . . . . . . 107 Configuring OSPF over Unnumbered Interface . . . . . . . . . . . . 110 OSPF over Unnumbered In terfaces Using Virtual Links . . . . . . 110 Cisco HDLC Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

8 Nokia Network Voyager IPSO 4.0 Reference Guide Changing DHCP Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Adding DHCP Address Pools . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Enabling or Disabling DHCP Address Pools . . . . . . . . . . . . . . . 150 Assigning a Fixed-IP Address to a Client . . . . . . . . .[...]

Nokia Networ k Voya ger IPSO 4.0 Referenc e Guide 9 Downgrading Nokia IPSO Images. . . . . . . . . . . . . . . . . . . . . . . 176 Configuring Monitor Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 Managing Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178 Installing and Enabling Packages . . . [...]

10 Nokia Network Voyager IPSO 4.0 Reference Gu id e Cluster Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 Clustering Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 Considerations for Clustering . . . . . . . . . . . . . . . . . . . . . . . . . . 214 If You Do Not Use a Dedicated P[...]

Nokia Networ k Voya ger IPSO 4.0 Referenc e Guide 11 6 Configuring SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 SNMP Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 SNMP Proxy Support for Check Point MIB . . . . . . . . . . . . . . . . . 252 Using the Check Point MIB . . . .[...]

12 Nokia Network Voyager IPSO 4.0 Reference Gu id e Using VRRPv3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 Creating a Virtual Router to Back Up Another VRRP Router Addresses Using VRRPv3 . . . . . . . . . . . . . . . . . . . . . 278 Monitoring the Firewall State . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

Nokia Networ k Voya ger IPSO 4.0 Referenc e Guide 13 Configuring Secure Shell Authorized Keys . . . . . . . . . . . . . . . . 308 Changing Secure Sh ell Key Pairs . . . . . . . . . . . . . . . . . . . . . . . 309 Managing User RSA and DSA Identities . . . . . . . . . . . . . . . . . . 310 Tunneling HTTP Over SSH . . . . . . . . . . . . . . . . . . [...]

14 Nokia Network Voyager IPSO 4.0 Reference Gu id e Routing Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351 Route Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 OSPF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353 Types of A[...]

Nokia Networ k Voya ger IPSO 4.0 Referenc e Guide 15 Configuring IGRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388 DVMRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 390 Configuring DVMRP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391 Configuring DVMRP Ti[...]

16 Nokia Network Voyager IPSO 4.0 Reference Gu id e BGP Multi Exit Discriminator Example . . . . . . . . . . . . . . . . . . . 419 Changing the Local Preference Valu e Example . . . . . . . . . . . . 421 BGP Confederation Example . . . . . . . . . . . . . . . . . . . . . . . . . . 423 Route Reflector Example . . . . . . . . . . . . . . . . . . . . [...]

Nokia Networ k Voya ger IPSO 4.0 Referenc e Guide 17 Configuring a COPS Client ID and Po licy Decision Point . . . . . 462 Configuring Security Parameters for a COPS Client ID . . . . . . 462 Assigning Roles to Specific Interfaces . . . . . . . . . . . . . . . . . . . 463 Activating and Deactivating the COPS Client . . . . . . . . . . . . . . 464 C[...]

18 Nokia Network Voyager IPSO 4.0 Reference Gu id e Displaying Interface Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . 487 Hardware Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487 Using the iclid Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488 iclid Commands . . . [...]

Nokia N etwork Voyager fo r IPSO 4.0 Refer ence Guide 19 About the Nokia Network V oyager Reference Guide This guide provides information about how to configure and monitor Nokia IPSO systems. This guide p rovides co nceptual information about system features and instructions on how to perform tasks using Nokia Networ k V oyager , the W eb-based in[...]

About the Nokia Network Voyager Reference Guide 20 Nokia Network Voy ager for IPSO 4.0 Reference Guide the hostname . It also describes how to save configuration sets, schedule jobs, backup and restore files, manage and upgrade system images, reboot the system, manage packages, and advanced system tuning.  Chapter 4, “V irtual Route r Redundan[...]

Conventions This Guide Uses Nokia N etwork Voyager fo r IPSO 4.0 Refer ence Guide 21 Conventions This Guide Uses The following sections describe the co nventions this guide uses, including notices, text conventions, and command-line conventions. Notices Caution Cautions indicate potential equipment damag e, equipment malfunction, loss of performanc[...]

About the Nokia Network Voyager Reference Guide 22 Nokia Network Voy ager for IPSO 4.0 Reference Guide Menu Items Menu items in procedures are sepa rated by the greater than sign. For example, click Backup and Restore under Configuration > System Configuration indicates that you first cl ick Configuration to expand the menu if necessary , the n [...]

Nokia Network Voyager for IPSO 4.0 Reference Guide 23 1 About Network V oyager This chapter provides an overview of Network V oyager , the W eb-based interface that you can use to manage Nokia IPSO systems. Nokia Network V o yager is a W eb-b ased interface that you can use to manage IPSO systems from any authorized location. Network V oyage r come[...]

1 24 Nokia Network Voyager for IPSO 4.0 Reference Guide Logging In to Network V oyager When you log in to Network V oyager , the navigation tree you see depends on the role or ro les assigned to you. If the roles assigned to your us er account do not includ e access to a feature, you will not see a link to the feature in the tree. If th ey have rea[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 25 Obt aining a Configuration Lock When you log in with exclusive confi guration lock, no other user will be able to change the system configuration. Only users with read/wr ite access privileges are allowed to log in with exclusive configuration lock. If you acquire a configuratio n lo ck and the[...]

1 26 Nokia Network Voyager for IPSO 4.0 Reference Guide 4. Enter your user name and password. 5. Click Log In. Navigating in Network V oyager The following table explains the functions of th e buttons in Network V oyager . Other buttons are described in the inline help for each page. A void using your browser’ s Back and Forward bu ttons while in[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 27 This guide, the Nokia Network V oyager Refer ence Guide for IPSO , is the comprehensive reference source for IPSO ad ministration and using the Netw ork V oyager interface. Y ou can access this guide a nd the CLI Refer ence Guide from the following locations:  Network V oyager interface—Cl[...]

1 28 Nokia Network Voyager for IPSO 4.0 Reference Guide V iewing Hardware and Software Information for Y our System The asset management summary pa ge provides a summary of all system resources, including hardware, software and the operating system . The hardware summary includes information about the CPU, Disks, BIOS, and motherboard, including th[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide 29 2 Configuring Interfaces This chapter describes configuring and monitoring the various types of interfaces supported by Nokia IP security platforms, aggregating Ethernet ports, conf iguring GRE and DVMRP tunnels, using transparent mode to allow your IP SO appliance to behave like a Layer 2 devic[...]

2 30 Nokia Network Voyager for IPSO 4.0 Reference Guide IP2250 Management Port s The Ethernet management ports on IP2 250 system s are designed to be used for the following purposes:  Managing the appliance  Firewall synchronization traf fic  IP cluster protocol traf fic  Connection to a log server Caution The management p orts are no t[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 31 The loopback interface also has a physical interfa ce name d loop0 . Use Network V oyager to set attributes of interfa ces. For example, line speed and duplex mode are attributes of an Ethernet physical inte rface. Each communications port has exactly one physical interface. Configuring IP Addr[...]

2 32 Nokia Network Voyager for IPSO 4.0 Reference Guide For example, the logical inte rface of a physical interface eth-s2p1 is called eth-s2p1c0 . The logical interfaces for PVCs 17 and 24 on an A TM NIC in slot 3 are called atm-s3p1c17 and atm-s3p1c24 respectively . Once a logical interface exists for a device , yo u can assign an IP address to i[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 33 Events that can affect the status of interfaces:  If you hot-insert a device (not power down the unit first), it appea rs in the lists of interfaces immediately (after a page refre sh) on the configuration pages.  If you hot-pull a device, and no configuratio n ex ists for it, it disappea[...]

2 34 Nokia Network Voyager for IPSO 4.0 Reference Guide Ethernet Interfaces Y ou can configure a number of parameters for ea ch Ethernet interface, including the following:  Enable (make active) or disable the interface.  Change the IP address for the interface.  Change the speed and duplex mode. Configuring Ethernet Interfaces Ta b l e 3 [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 35 T o configure an Ethernet interface 1. Click Interfaces under Configuration > Inte rface Configuration in the tree view . 2. Click the name of the physical interface you want to co nfigure. Example: eth-s2p1 3. Specify the configuration paramete rs for speed add duplex mode. 4. Click Apply .[...]

2 36 Nokia Network Voyager for IPSO 4.0 Reference Guide balancing across the ports. For example, you can aggregate two 10/100 mbps ports so they function like a single port with a theoretical ba ndwidth of 200 mbps, and y ou can aggregate two Gigabit Ethernet ports so they function like a single port with a theoretical bandwidth of 2000 mbps. If yo[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 37  When you assign switch p orts to an EtherChannel group, set the channel mode to on to force the ports to form a ch annel without using the Link Aggregation Control Protocol (LACP) or Port Aggregation Protocol (P AgP).  If your switch supports it, configure the aggr egated ports to distri[...]

2 38 Nokia Network Voyager for IPSO 4.0 Reference Guide Note Use Ethernet crossover cables to con nect the manage ment port s tha t you aggr egate. Using a switch or a hub can result in incomple te synchronization. Because you should use crossove r cables for these connections, yo u should n ot co nfig ure more than two IP2250 appl iances in a VRRP[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 39  Do not combine any o f the built-in 10/100 Ethernet managemen t ports with ports on an I/O card to form an aggregation grou p. Caution Do not use the management port s of an IP2250 for productio n traffic, regardless of whether the por ts are aggregated. Configuring Link Aggregation T o set[...]

2 40 Nokia Network Voyager for IPSO 4.0 Reference Guide 4. Click Apply 5. Click Save to make the changes permane nt. 6. Perform step 2 through step 5 again to configure the other interfaces identically . Group Configuration Once the physical interfaces are configured, you need to create and configure link aggregation groups. On appliances other tha[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 41 Logical Configuration When you have completed the aggregation group, yo u must configure it wit h an IP address and so on. Navigate to the Interfaces Configuration page and cl ick the logical name of the gr oup. Network V oyager shows the lo gical name in the format ae xxx c0 . For example, the[...]

2 42 Nokia Network Voyager for IPSO 4.0 Reference Guide Note Link speed is fixed an d duple x mo d e is set to full at all times for Gigabit Ethernet interfaces. T o configure a Gigabit Ethernet interface 1. Click Interfaces under Configuration > Inte rface Configuration in the tree view . 2. Click the physical interface link to configure. Examp[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 43 Each IP addresses and mask length that you add are added to the table when you click Apply . The entry fields return to blank to allow you to add more IP addresses. Use the delete check box to dele te IP addresses from the table. 9. (Optional) Change the interface l ogical name to a more meanin[...]

2 44 Nokia Network Voyager for IPSO 4.0 Reference Guide 5. In the Ethernet Interface drop-down box, select the Ethernet interface you wish to associate with the PPPoE logical interface in the. 6. In the Mode drop-do wn box, select a connection mode. 7. In the T imeout text-box, enter a time in seconds. 8. (Optional) In the Peername text-box, enter [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 45 Note The PPPoE logical interface is on by default and the associated link trap is disabled by default. If you wish to change either setting , click the appropriate setting next to the feature you wish to enable or disable and click Apply . 20. Click Apply . 21. Click Save to make y our changes [...]

2 46 Nokia Network Voyager for IPSO 4.0 Reference Guide 5. Click Delete. 6. Click Apply . Configuring MSS Clamping When end devices use path MTU discovery , it can cause connectivity problems when their connections pass through PPPoE interfaces. Use the MSS Clamping field to prevent these problems by reducing the maximum segment size (M SS) that is[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 47 T o configure a VLAN Interface 1. Click Interfaces under Interface Co nfiguration in the tree view . 2. Click the link to the physical Ethernet interface for which you want to enable a VLAN interface. The physical interface page fo r that interface is displayed. 3. Enter a value to identify the[...]

2 48 Nokia Network Voyager for IPSO 4.0 Reference Guide 5. Click Save to make your change perman en t. The entry for the logical VLAN interface disappears from the Logical Interfaces table. T o define the maximum number of VLANs 1. Click Interfaces under Configuration > Inte rface Configuration in the tree view . 2. Enter a numb er in the Maximu[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 49 FDDI Interfaces T o configure an FDDI Interface 1. Click Interfaces under Configuration > Inte rface Configuration in the tree view . 2. Click the physical interface link yo u want to configure in the Physical column. Example: fddi-s2p1 3. Click Full or Half in the Physical Configuration tab[...]

2 50 Nokia Network Voyager for IPSO 4.0 Reference Guide T o change the duplex setting of an FDDI interface Note If the duplex setting of an FDDI interface is in correct, it might not rece ive data, or it might receive duplicates of the dat a it sends. 1. Click Interfaces under Configuration > Inte rface Configuration in the tree view . 2. Click [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 51 ISDN Interfaces Integrated Services Digital Network (ISDN) is a sy stem of dig ital phone connections that allows voice, digital network services, and video data to be transmitte d simultaneously using end-to- end digital connectivity . The Nokia IP security platform of fers support for an ISDN[...]

2 52 Nokia Network Voyager for IPSO 4.0 Reference Guide Example: isdn-s2p1 3. In the Switch T ype pull-down menu, in the Phys ical Configuration table, select the service provider-switch type that corresponds to the interface network co nnection. 4. In the Line T opology field in the Physical Configuration table, click Point-to-Point or MultiPoint [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 53 c. Use the Proxy interface pull-down menu to select the logical inte rface from which the address for this interface is taken. 7. Enter the IP address for the local end of the connection in the Local address text box in the Interface Information table. Y ou must enter a valid IP address. IPSO d[...]

2 54 Nokia Network Voyager for IPSO 4.0 Reference Guide 17. In the T o Remote Host section of the Authentication table, in the Password t ext box, enter the password to be returned to the remote host for P AP authentication, or the secret used to generate the challeng e respon se for CHAP authentication. Note The T o Remote Host information must be[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 55 A use period set to zero will cause the second B-channel to be brought into operation immediately; the utilization level has been exce eded. It will also caus e the second B-channel to be removed from operation; immediately the measured u tilization drops below the use level. 23. Click Apply . [...]

2 56 Nokia Network Voyager for IPSO 4.0 Reference Guide 12. In th e From Remote Host section of the Authen tication table select the authentication method used to authen ticate the remote host. 13. In the From Remote Host section of the Authentication table, in the Name text box, enter the name that is returned from the remote host when this host a[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 57 In the Number text box, enter the t elephone number on wh ich to accept incoming cal ls. An x is used to repre sent a wild-card charac ter . 5. Click Apply . 6. Click Y es in the Callback field for the incoming call to be di scon nected, and an outgoin g call attempted; otherwise, click No to h[...]

2 58 Nokia Network Voyager for IPSO 4.0 Reference Guide 9. Click Apply . Note Follow step s 8 through 21 i n “T o configure an ISDN logical interface to place calls” to set the information for outgoing calls. For more informati on about how to set up incoming numbers see “T o add an incoming number” . 10. Click Save to make your changes per[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 59 the packet is never sent over the ISDN interface. After the packet is checke d against the Access list, the DDR list applied to the interface (if any) is then checked. Note A DDR list, therefore, on ly affect s which p ackets will cause a connection to be established and maintained. If no DDR l[...]

2 60 Nokia Network Voyager for IPSO 4.0 Reference Guide T o modify a rule 1. Click Dial on Demand Routin g under Configur ation > T raffic Management in the tr ee view . 2. Locate the DDR list that cont ains the rule to modify . Y ou can modify the following items:  Action  Source IP address  Source mask length  Destination IP addres[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 61 3. Click Apply . 4. Under the Existing rules for No tRIP table, click the Add New Rul e Before check box. 5. Click Apply . 6. Enter 520 in the Dest Port Range text box in the Existing rules for NotRIP table. 7. Select ignore from the Action dro p-down wind ow in the Existing rules for NotRIP ta[...]

2 62 Nokia Network Voyager for IPSO 4.0 Reference Guide T o configure the IP330 to place an outgoing call 1. Click Interfaces under Configuration > Inte rface Configuration in the tree view . 2. Click isdn-s2p1 in the Phys ical column of the table. 3. Select PPP from the Encapsulation text box in the Create New Logical Interface table. Click App[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 63 9. Click Incoming. 10. Select CHAP as the authentication method i n the Authentication table. 11 . Enter User in the Name text box unde r the Fr om Remote Host section in the Authentication table. 12. Enter Password in the Password text box un der the From Remote Host section in the Authenticat[...]

2 64 Nokia Network Voyager for IPSO 4.0 Reference Guide The trace for connecting a call from the Nokia IP330 is: 06:23:45.186511 O > PD=8 CR= 23(Orig) SETUP:Bc:88 90. CalledNb:80 33 38 34 30 32 3 0.SendComp: 06:23:45.255708 I < PD=8 CR= 23(Dest) CALL-PROC:ChanId:89. 06:23:45.796351 I < PD=8 CR= 23(Dest) ALERT: 06:23:45.832848 I < PD=8 C[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 65 70bb91fa4688d417bf72a0bca572 c7e4e16, name=15:10:12.549898 I B1:response,value=dd379d2b5e 692b6afef2bee361e32bca, name=User 15:10:12.549968 O B1: succes s 15:10:12.550039 O B1: ppp-ip cp: conf_req (addr) 15:10:12.557258 I B1: ppp-ip cp: conf_req (addr) 15:10:12.557300 O B1: ppp-ip cp: conf_ack [...]

2 66 Nokia Network Voyager for IPSO 4.0 Reference Guide The most recent system log messages appear . T racing Y ou can use the tcpdump utility to trace ISDN D-channel traf fic (Q.921 and Q.931 protocols) and B-channel traf fic (PPP/multilink PPP and TCP/IP protocols). When running tcpdump on an ISDN interface, i f no options are given on the comman[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 67 ISDN Cause V alues Descriptions of the cause-value field of th e cause-information element are shown in the following ISDN cause value table. Cause-value numbers are not consecutive. z1 Class of cause value z2 V a lue of cause value a1 (Optional) Diagnostic field that is always 8. a2 (Optional)[...]

2 68 Nokia Network Voyager for IPSO 4.0 Reference Guide 30 Response to ST A TUS ENQUIR Y 31 Normal, unspecified 34 No circuit or channel available Note 10 38 Network out of order 41 T emporary failure 42 Switching-equipment congestion 43 Access information discarded Discard ed information-eleme nt identifier(s) (Note 6) 44 Requested circuit / chann[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 69 Notes for Ta b l e 6 :  Note 1 —The coding of facility identification is network dependent.  Note 2 —Incompatible parameter is composed of incompatible in formation el ement identifier .  Note 3 —The format of the diagnostic field fo r cause 57, 58, and 65 is sho wn in the ITU-T [...]

2 70 Nokia Network Voyager for IPSO 4.0 Reference Guide  Note 6 —Locking and non-locki ng sh ift pro cedures described in the ITU-T Q.931 specification apply . In principle, information element identifiers are in the same order as the information elements in the received message.  Note 7 —The following coding applies: Bit 8, extension bit[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 71 T oken Ring Interfaces T o configure a T oken Ring interface 1. Click Interfaces under Configuration > Inte rface Configuration in the tree view . 2. Click the physical interface link to configure in the Physical column. Example: tok-s3p1 The physical interface setup page ap pears. 3. In the[...]

2 72 Nokia Network Voyager for IPSO 4.0 Reference Guide 13. (Optional) Change th e interfaces logical name to a more meaningful name by typing the preferred name in the Logical na me text box. Click Apply . 14. (Optional) Add a comment to further define th e logical interfaces func tion in the Comments text box. Click Apply . 15. Click Save to make[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 73 If no change is desired, skip the step. a. T o change the IP address, enter the appropri ate IP address in the New IP address field,. There is no default. b. In the New mask length field, enter the approp riate value. The range is 8 to 30, and there is no default. c. T o delete an IP address , [...]

2 74 Nokia Network Voyager for IPSO 4.0 Reference Guide The following figu re shows the network config uration for this example. 1. Click Interfaces under Configuration > Inte rface Configuration in the tree view . 2. Select tok-s2p1 in the Physical column of the table. 3. Set the desired value in the Ring Speed co lumn of the Physical configura[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 75 10. In the New IP Address field, enter the appropriate IP address. 11 . In the New Mask Length field, enter the appropriate value. 12. Click Apply . 13. Click Save. Point-to-Point Link over A TM T o configure an A TM interface Note Y ou cannot configure an A TM interface with an IP address un t[...]

2 76 Nokia Network Voyager for IPSO 4.0 Reference Guide 7. Click Apply . A new logical interface appears in the Interface column. The new interfa ce is on by default. Y ou can add more A TM logical inte rfaces by repeating this action. 8. Click the logical interface name in the Interface column of the Logical Interfaces table to go to the Logical I[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 77 6. Select point-to-point in the T ype selection box in the Create a new LLC/SNokia Platform RFC1483 interface section. Enter the VPI/ VCI number in the VPI/VCI text box. 7. Click Apply . A new logical interface appears in the Interface column. The ne w interfa ce is turned on by default. 8. Cli[...]

2 78 Nokia Network Voyager for IPSO 4.0 Reference Guide Note The maximum p acket size must match the MTU of the link partne r . Packets longer than the length you specif y are fragmented bef or e tran sm issio n . 4. Click Apply . 5. Click Save to make your changes pe rmanent. AT M E x a m p l e This section describes how you might configure the in[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 79 T o configure the A TM interface on Nokia Platform A 1. Click Interfaces under Configuration > Inte rface Configuration in the tree view . 2. Select atm-s2p1 in the Phys ical column of the table. 3. Enter 93 in the VCI text box in the Create a new LLC/SNokia Platform RFC1483 interface sectio[...]

2 80 Nokia Network Voyager for IPSO 4.0 Reference Guide Loop timing derives the tran smit clock from the recovered receive clock. 5. Select the VPI/VCI range in the VP I/VCI Range Configuration list box. 6. Create a logical interface with the Create a new LLC/SNokia Platform RFC1483 interface section by selecting LIS in the T y pe list box and ente[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 81 The Physical Interface page appears. 3. Select the VPI/VCI range in the VPI/VCI Range Configuration list box. 4. Find the A TM logical interface to re configure in the Logical Interfaces ta ble and enter a new set of VPI/VCIs in the VPI/VCI field. 5. Click Apply . 6. Click Save to make your cha[...]

2 82 Nokia Network Voyager for IPSO 4.0 Reference Guide IPoA Example This section describes how you might configure the in terfaces of your IP security platform in an example network, using Network V oyager . The following figu re shows the network config uration for this example. A company has five Etherne t networks in thre e separate locations. [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 83 9. Click Apply . 10. (Optional) Change th e interfaces logical name to a more meaningful name by typin g the preferred name in the Logical na me text box. Click Apply . 11 . (Optional) Add a comment to further define th e logical interfaces func tion in the Comments text box. 12. Click Apply . [...]

2 84 Nokia Network Voyager for IPSO 4.0 Reference Guide 10. Click the logical interface name in the Inte rface column of the Logical interfaces table. The Interface page appears. 11 . Enter the IP address for the local end of the link in the Local address text box. 12. Enter the IP address of the remote end of the link in the Remote address te xt b[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 85 9. Click Apply . 10. Enter a number in the Ke epa live maximum failures text box. This value sets the number of times a remote system can fail to send a keepalive protocol message within a keepalive interval befo re the systems c onside r s the link down. 11 . Click Apply . 12. Click the Advanc[...]

2 86 Nokia Network Voyager for IPSO 4.0 Reference Guide 6. Click Full Duplex or L oopback radio in the Channel M ode field. Full duplex is the normal mode of operation. 7. Click the Frame relay radio button in the Encapsulation field. 8. Click Apply . 9. Enter a number in the Keepaliv e text box to configure the fra me relay keepalive interval. Thi[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 87 19. Click the logical interface name in the Interface column of the Logical interfaces ta ble to go the Interface page. 20. Enter the IP address for the local end of the PVC in the Loca l address te xt box. 21. Enter the IP address of the remote end of the PVC in the Remote address text box. Cl[...]

2 88 Nokia Network Voyager for IPSO 4.0 Reference Guide The branch of fic e co ntains Nok ia Platfo rm B, whic h routes traffic between a local Fast Ethernet network and A TM PVC 52. It provides access to the main office and the Internet. T o configure the serial interface on Nokia Pl atform A 1. Click Interfaces under Configuration > Inte rface[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 89 4. Click Apply . 5. Click the Full Duplex or Loopback ra dio button in the Channel Mode field. Full duplex is the normal mode of operation. 6. Click AMI or B8ZS in th e T1 Encoding field to select the T1 encoding. This setting must match the line encoding of th e CSU/DSU at the other end of the[...]

2 90 Nokia Network Voyager for IPSO 4.0 Reference Guide The T1 CSU/DSU Advanced Options page allows you to configure fractional T1 channels, line build-out values and other advanced settings for the T1 device. Th e values you enter on this page are dependent on the subs cription provided by your service provider . 16. From the Advanced T1 CSU/DSU O[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 91 Use T1 framing to divide the data stream into 64 Kbps channels and to synchronize with the remote CSU/DSU. This setting must match the frame format used by the CSU/DSU at the other end of the point-to-point link. 9. Click Apply . 10. Click 64bps or 56 bps in the T1 Channel Speed field to select[...]

2 92 Nokia Network Voyager for IPSO 4.0 Reference Guide 21. Click Y es or No in the Negotiate Magic Number field. Clicking Y es enables the interface to send a requ est to negotia te a magic number with a peer . 22. Click Y es or No in the Negotiate Maximum Receive Unit field. Clicking Y es enables the inte rface to send a request to negotiate an M[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 93 Use T1 framing to divide the data stream into 64Kb ps channels a nd to synchronize with the remote CSU/DSU. This setting must match the frame format used by the CSU/DSU at the other end of the point-to-point link. 8. Click Apply . 9. Click 64bps or 56bps in the T1 Channel Speed field to select [...]

2 94 Nokia Network Voyager for IPSO 4.0 Reference Guide The Frame Relay Ad vanced Options page allows you to configure frame relay protocol and LMI parameters for this device. Note The values you enter depend on the settin gs of the frame relay switch to which you are connected or to the subscription provided by your service provider . 21. From the[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 95 The following figu re shows the network config uration for this example. In a company’ s main office, Nokia Platform A te rminates a T1 line to an Internet service provider , running PPP with a keepal ive value of 10. The T1 line us es B8ZS line encoding, Extended Super Frame, T1 frami ng, an[...]

2 96 Nokia Network Voyager for IPSO 4.0 Reference Guide 10. Click Apply . 11 . Click ser -s1p1c0 in the l ogical interfaces table to go to the Interface page. 12. Enter 192.168.2.1 in the Local address text box. 13. Enter 192.168.2.93 in the Remote address text box. 14. Click Apply . 15. (Optional) Change th e interfaces logical name to a more mean[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 97 Use E1 framing to select whether timeslot-0 is used for exchanging signaling data. 7. Click On or Of f for th e E1 CRC-4 Framing field. Note This option appears only if you set the E1 Framing field to E1 (channel 0 framing). This option chooses the frami ng format for timeslot-0. On means that [...]

2 98 Nokia Network Voyager for IPSO 4.0 Reference Guide 14. Enter the IP address for the local end of the link in the Local Address text box. 15. Enter the IP address of the remote end of the link in the Remote Address text box. Click Apply . 16. (Optional) Change the interface’ s logical name to a more mea nin gful one by typing the preferred na[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 99 Note This option appears only if you have set th e E1 Framing field to E1 (channel 0 framing). This button chooses the frami ng format for timeslot-0. On means that CRC-multiframe format is used; the informatio n is protected by CRC-4. Of f m eans that double-frame format is used. This setting [...]

2 100 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 14. From the Advanced E1 CSU/DSU Options page, click Up to return to the physical interface page. 15. Click the Advanced PPP Options link. The PPP Advanced Options page appears. 16. Click Y es or No in the Negotiate Magic Number field. Clicking Y es enables the interface to send a requ est t[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 101 4. Click Full Duplex or Loopback in the Channel Mode field. Full duplex is the normal mode of operation. 5. Click AMI or HDB3 in the E1 Encoding field to select the E1 encoding. Click Apply . This setting must match the line encoding of th e CSU/DSU at the other end of the point-to - point lin[...]

2 102 Nokia Network Voyager for IPSO 4.0 Refe rence Guide DTE is the usual operating mode when the device is connected to a frame re la y switch. 12. Click On or Of f in the Active Status Monitor field. Click Apply . This value sets the monitoring of the connection-active status in the LMI status message. 13. (Optional) Click the Advanced E1 CSU/DS[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 103 Click Apply . 23. (Optional) Add a comment to further define th e logical interfaces func tion in the Comments text box. Click Apply . 24. Click Save to make y our changes permanent. Note T ry to ping the remote system from the comm and prompt. If the remote system does not work, contact your [...]

2 104 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 8. Click the logical interface name in the Interface column of the Logical interfaces table to go to the Interface page. 9. Enter the IP address for the local end of the link in the Local address text box. 10. Enter the IP address of the remote end of the link in the Remote address te xt box[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 105 Note This value must be identical to the keep alive value configured on th e system at the other end of a point-to-point link, or the link state fluctuates. 8. Enter a number in the Keepaliv e maximum failures text box to configure the PPP keepalive maximum failures. This value sets the number[...]

2 106 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Set the internal clock to On when you are connecting to a device or system that does not provide a clock source. Otherwise, set the internal clock to Off. 4. If you turned the internal clock on, enter a value in the Internal clock speed text box. If the device can generate only certain line [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 107 Click Apply . Each time you click Appl y after entering a DLCI, a new logical interface appears in the Interface column. The DLCI entry field remains blank to allow you to add more frame relay logical interfaces. 14. Click the logical interface name in the Interface column of th e Logical Inte[...]

2 108 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note Only point-to-point interfaces can be co n figured as unnumbered interfaces. T unnels cannot be configured as unnum bered interfaces. 3. Click Y es in the Unnumb ered Interface field. 4. Click Apply . Note If that interface was ass oc i at ed with eit he r a lo ca l or rem ote ad dr es [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 109 Note Only point-to-point interfaces can be conf ig ured as unnumbered interfaces. T u nnels cannot be configured as unnum bered interfaces. Note This interface must not be th e next hop of a st atic r oute. 3. Click No in the Unnumbered Interface field. Click Apply . 4. Click Save to make your[...]

2 110 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Configuring OSPF over Unnumbered Interface The following graphic represents an exampl e configur ation for running OSPF over an unnumbered interface. 1. Configure the interfaces on Nokia Platfo rm A and Nokia Platform B as in “T o configure an unnumber ed interface.” 2. For each Nokia Pl[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 111 connected to the backbone area. Both Nokia Plat form B and Nokia Platform C are configured with IP addresses (10.10.10.2 and 101.10.10.1 respectively). The interfaces that comprise th e virtual link between Nokia Platfo rm A and Nokia Platform C are both configured as unnumber ed. This link wi[...]

2 112 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Click Apply . This value sets the interval, in seconds, between keepalive protocol message trans missions. These messages are used periodically to test for an active remote system. Note This value must be identical to the keep aliv e value configured on the system at the other end of a point[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 113 Note This value must be identical to the keep alive value configured on th e system at the other end of a point-to-point link, or the link state fluctuates. 4. Click Save to make your changes permanent. T o change the keep alive maximum failures in PPP 1. Click Interfaces under Configuration &[...]

2 114 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Frame Relay Protocol T o change the keep alive interval in frame re lay 1. Click Interfaces under Configuration > Inte rface Configuration in the tree view . 2. Click the physical interface link to conf igure in the Physical colu mn. Example: ser-s2p1. 3. Enter a number in the Keepaliv e [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 115 9. (Optional) Change the interface’ s logical name to a mo re meaningful one by typi ng the preferred name in the Logical na me text box. Click Apply . 10. (Optional) Add a comment to further define th e logical interfaces func tion in the Comments text box. Click Apply . 11 . T o make your [...]

2 116 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o change the active st atus monitor setting in frame relay When connected to a Frame Relay switch or networ k, the interface type is usually set to DTE. Y ou may need to change the interfa ce type to DCE if it is connect ed point-to-point with another router . 1. Click Interfaces under Con[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 117 Loopback Interfaces By default, the loopback interface has 127.0.0.1 co nfigured as its IP address. Locally originated packets sent to this interface are sen t back to the originating process. Y ou might want to assign an address to the lo opback interface that is the same as the OSPF firewall[...]

2 118 Nokia Network Voyager for IPSO 4.0 Refe rence Guide GRE T unnels GRE tunnels encapsulate IP packets by using Generic Routing Encaps ulation (GRE) with no options. The encapsulated packets appear as uni cast IP pac kets. GRE tunnels provide redundant configuration between two sites for high availability . For each GRE tunnel you create, you mu[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 119  On means that all packets th at egress through the tunnel will exit through the outgoing interface (local endpoint). If the local endp oint link fails, traf fic does not egress through the tunnel.Y ou might use this setti ng to prevent possible routing loo ps.  Off means that packets th[...]

2 120 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 4. (Optional) Enter the IP address of the remote end of the GRE tunnel in the Remote address text box. The remote address cannot be one of the syst ems interface addresses and must be the local address configured for the GRE tunnel at the remote router . 5. (Optional) Enter the IP address of[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 121 GRE T unnel Example The following steps pro vide directions on how to configure a sample GRE tunnel. Th e following figure below shows the network confi guration for this example. 1. Click Interfaces under Configuration > Inte rface Configuration in the tree view . 2. Click T unnels in the [...]

2 122 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Click Apply . An entry field appears. 11 . (Optional) If you selected cu stom value fro m the T OS value drop-do wn window , enter a value in the range of 0 -255. 12. Click Apply . 13. (Optional) Change the interface’ s logical name to a more mea nin gful one by typing the preferred name i[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 123 of this reference guide, they ar e not individually repeated here . The following figure shows the network configuration for this example. Note Y ou must complete step 1 in th e following procedur e before you continue to o ther steps. Y ou can complete steps 2 throu gh 4 in an y order . 1. Pe[...]

2 124 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Enter 170.0.0.1 in the Local end point text box. Enter 171.0.0.1 in the Remote endpoin t text box. b. Configuring from IP Unit 2 to IP Unit 1: Enter 10.0.0.2 in the Local address text box. Enter 10.0.0.1 in the Remote address text box. Enter 171.0.0.1 in the Local endpoint text box. Enter 17[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 125 DVMRP T unnels DVMRP (Distance V ector Multicast Routing Protocol) tunnels encapsulate multicast packets IP unicast packets. This technique allows two multi cast routers to exchange multicast packets even when they are separated by routers that cannot forward multicast packets. For each DVMRP [...]

2 126 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note When the DVMRP tunnel inte rface is created, set all other DVMRP configuration parameter s from the DVMRP p age. T o change the local or remote addresses of a DVMRP t unnel 1. Click Interfaces under Configuration > Inte rface Configuration in the tree view . 2. In the Logical column,[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 127 A router forwards Multicast traffic to an adjacent router only if that router has a client that accepts multicast traffic. Nokia IP security platforms require Distance V e ctor Multicast Routing Protocol (DVMRP) to be enabled on the inte rfaces to which you forward multicast traffic. In the pr[...]

2 128 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 9. Click Apply . 10. Click Save to make changes permanent. Note St ep s 17 through 21 requi re that yo u us e the Rout in g Co nfiguration page by firs t completing steps 13 throug h 16. 11 . Click DVMRP under Configuration > Routing in the tree view . 12. For each interface to configure [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 129 The Retry Limit specifies the number of tim es to retry ARP requests until ho lding off requests for 20 seconds. Retry reques ts occur at a rate of up to once per seco nd. The range of retry limit is 1 to 100 and the defaul t value is 3. 4. If your network configuration re quires it, click the[...]

2 130 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note In VRRP config urations, co nfiguring pro xy ARP using static NA T addresses an d interface MAC addresses is not supported. T o delete a st atic ARP entry 1. Click ARP under Configuration > Interfa ce Configuration in the tree view . 2. Click the checkbox in the Delete column next to[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 131  Retry Limit specifies the number of times to retry InA TMARP requests after which the Holdoff T imer is started. The range of Retry Limit value i s 1 to 100 with a default value of 5.  Holdoff T ime specifies time, in seconds, to hold of f InA TMARP requests after the maximum number of [...]

2 132 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 3. Click the A TM ARP Entries link. Dynamic A TM ARP entries appear in a table at the bottom of the page. 4. Click the Delete check box next to the dynamic A TM ARP entry to delete. Click Apply . Note Deleting a dynamic entry tri ggers a transmission of an InA TMARP request on the PVC. If th[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 133 T ransp arent Mode Processing Det ails When you configure transparent mode, it is added to the IPSO kernel as a module situated between the layer 2 and the upper protocol layers. When a logical interface is configured for the transparent mode, transparent mode Address Resolution Protocols (ARP[...]

2 134 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Configuring T ransp arent Mode in VPN Environment s T o configure transparent mode in a virtual priva t e network environmen t, yo u must create a range or group of addresses that will be protected behi nd the IP address on the bridge. This must be done because addresses cannot be l earned d[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 135 Note For information on how to create group s, objects, and rules on the firewall, see yo ur Check Point document ation that was included with your Nokia IPSO software package. Example of T ransp arent Mode The following illustration shows a network connected to an Internet service provider (I[...]

2 136 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o configure transpa rent mode in the preceding network configuration 1. Click T ransparent Mode under Configuration > Interface Configuration in the tree view . 2. Enter any positive integer (an integer greater than 0) in the edit box, for example 100 and click Apply . 3. Click the link[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 137 Note In the disabled m ode, the tran sp arent mode group drop s all p acket s received on or d estined to the interfaces in that gr oup. Because transp are nt mode groups are disabled by d efault, do not associate interfaces to a trans parent mo de group that is in use or you will lose connect[...]

2 138 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o add or remove an interface to/from a transp arent mode group 1. Click T ransparent Mode under Configuration > Interface Configuration in the tree view . 2. Click the link of the appropriate transparent mode group. 3. T o add an interface to the transparent mode group, select it from t[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 139 Enabling or Disabling VRRP for a T ransparent Mode Group If you are enabling VRRP on a VRRP master , the node will perform transparent mode operations as describ ed in the s ection, “T ransparent Mode” on page 132. As a VRRP standby , it will drop all packets except t hose with local desti[...]

2 140 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o add nodes configured for transp arent mode to a cluster using SmartDashboard 1. Create a gateway object for each of the VRRP nodes. 2. Define the topology for each gateway object. Make sure that transparent mode is properly configured with the address ranges to the exte rnal and internal[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 141 VTIs appear in Nokia Network V oyager as unnumb ered interfaces and are given lo gical names in the form tun0c n . Y ou configure static or dy namic routes on VTIs the same way yo u configure them on other unnumbere d interfaces. The dynamic routing p r oto cols supported on VTIs are BGP4 and [...]

2 142 Nokia Network Voyager for IPSO 4.0 Refe rence Guide VRRP Support VRRP HA mode is supported fo r OSPFv2 over virtual tunnels. Only active-passive mode is supported: that is, only one gateway can have the master state. Because a VTI is an unnumbered interface, you ca nnot configure a virtual IP address on it. T o run in VRRP mode across the tun[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 143 Note If both domain-based VPN and route- ba sed VPN are configured, then domai n-based VPN takes p riority . Configuring a VTI does not override the domain-based VPN. The only way to configure no VPN domain is to create an empty VPN domain group. 3. Create a VPN community and add both gateways[...]

2 144 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o create the virtual tunnel interface 1. In Network V oya ger navigation tree , select Configuration > Interface Configuration > FWVPN tunnel. 2. Enter the name of the peer gateway in the Peer GW Object Name field. Use the same name you assigned the gateway when you created it in the[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide 145 3 Configuring System Functions This chapter describes how to config ure many basic sys te m functions. Configuring DHCP Dynamic Host Configu ration Protocol (DHCP) fo r Nokia IPSO provides comple te DHCP client and DHCP server capabilities for you r Nokia appliance. DHCP gives you the ability t[...]

3 146 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Configuring DHCP Client Interfaces T o configure the DHCP client interface 1. Click DHCP under Configuration > Syst em Configuration in the tree view . 2. Click the logical interface in the DHCP Inte rface Configuration table to be configured. Note The logical inte rface must be enabled. [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 147 6. Click Save to make your changes permanent. Configuring the DHCP Server T o configure the DHCP server process 1. Click DHCP under Configuration > Syst em Configuration in the tree view . 2. Click Server in the DHCP Service Selection box. 3. Click Apply . Note Y ou must configure an Ethern[...]

3 148 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 12. (Optional) Enter a path for cli ents to get add itional configuration options in the Extensions Path text box. Note Y ou must configure the TFTP option to us e the Extension Path option since clients will use TFTP to tr ansfer the configuration options from the server . 13. (Optional) En[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 149 Note Y ou must configure an Ethernet inter face an d enter the subnet address and the subnet mask length on which the interface is listening befor e you enable the DHCP Server Process. See “Configuring the DHCP Se rver” on page 147, step s 5, 6, and 7. For more information on how to config[...]

3 150 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note Make sure that Enabled is se lected in the S tate field. Th is is the default selection. Note If you are configuring a lar ge numbe r of VLANs, you migh t experience a delay in having IP addresses a ssigned to VLAN interface s. 4. Click Apply . 5. Click Save to maker you changes pe rman[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 151 7. (Optional) Enter the file name where diskless clie nts will find the boot file in the F ile Name text box. 8. (Optional) Enter a path for clients to get add itional configuration optio ns in the Extensions Path text box. Note Y ou must configure the TFTP option to us e the Extension Path op[...]

3 152 Nokia Network Voyager for IPSO 4.0 Refe rence Guide because you will only have to ente r IP address information when yo u configure subnets or fixed- ip entries. 1. Click DHCP under Configuration > Syst em Configuration in the tree view . 2. Click the T emplate for adding new client entries link. 3. (Optional) Enter the T rivial File T ran[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 153 Configuring Dynamic Domain Name System Service DDNS gives you the ability to co nfigure your DHCP server to automatically update DNS servers on your network. T o configure Dynamic Domain Name System (DDNS) 1. Click DHCP under Configuration > Syst em Configuration in the tree view . 2. Click[...]

3 154 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Configuring the Domain Name Service IPSO uses the Domain Name Service (DNS) to tran slate host names into IP addresses. T o ena ble DNS lookups, you must specify the primary DNS se rver for your system; you can also specify secondary and tertiary DNS servers. When resolvin g hostnames, the s[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 155 Note The source hard disk drive and the mirror ha rd disk drive should have identical geometries. Y ou can view hard-disk drive geometry in the Driver s Informatio n table. 3. Click Apply . T ext at the top of the Network V oyager win dow with a message indicates a mirror set was created, numb[...]

3 156 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o inst all and configure PC card flash memory 1. Insert the card into one of the PC ca rd slots in the front of the system. Make sure that the card is fully inserted. 2. Click Optional Disk under Config uration >System Configuration. Network V oyager displays information about the card [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 157  Presence of a sendmail-like replacement that relays mail to a mail hub by using SMTP  Ability to specify the defaul t recipient on the mail hub IPSO does not support the fo llowing mail relay features:  Support for incoming email  Support for mail transfer protocols o ther than ou[...]

3 158 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Sending Mail T o send mail from the firewall 1. Log in to the firewall as either the admin or monitor user . 2. At the prompt, type the mail command, follo wed by a space, and the username of the recipient: mail username@hostname 3. T ype the subject of your message at the subject prompt; th[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 159 T o set system time once 1. Click T ime under Configuration > System Configuration in the tree view . 2. Select the appropriate time zone in the T ime Zone list box. By default, the time zone is set to GMT . 3. Either set the time manually or specify a time server: a. T o set the date and t[...]

3 160 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o delete a st atic host 1. Click Host Address under Config uration > System Configuration in the tree view . 2. Select Off next to the host to delete. 3. Click Apply . 4. Click Save to make your changes pe rmanent. Configuring System Logging System logging is configured differently o n [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 161 storage or to reduce the ri sk of losing lo g in formation if y ou run out of disk space on your IPSO appliance. Y ou might also choose to send all of the logs from multiple computers to one centralized log server , possibly on e that is configured for high availability . Y o u can select the [...]

3 162 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Caution When you inse rt a PC card into a flash- based applian ce and select the card as an optional disk, any existing dat a on the card is erased. If you remove a PC card that contains log files and wa nt to permanently store the dat a, inser t the card into a PC or other computer and save[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 163 there are 256 messages in the buffer , the messag es are transferred to the remote server and the buf fer is cleared. 6. Use the Flush Frequency option as an ad ditional control for saving messages. When the Flush Frequency interval expires, log messages are transferred to the remote server an[...]

3 164 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o set logging of all Network V oyager Apply and Save actions 1. Click System Logging under Configuration > System Configuration in the tree view . 2. In the V oyager Audit Log field, select Ena bled or Disabled. 3. Click Apply . 4. Click Save to make your change perman en t. The V oyage[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 165 click the Management Activity Log link in the System Logs section. For more information, see “Monitoring System Logs.” Remote Core Dump Server on Flash-Based Systems Application co re files are sto red in memory in the directory /var/t mp/. When the f ile system is 95% filled, flash-based [...]

3 166 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 5. Click Apply . 6. Click Save to make your changes pe rmanent. Changing the Hostname Y ou set the hostname during in itial configuration. T o identify the hostname (system name) of your security platform, click Hos tname under Co nfiguration > System Configuration in the tree view . The [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 167 T o create a factory default configuration file 1. Click Configuration Sets unde r Configuration > System Conf iguration in the tree view . 2. Enter a name for the new file in t he Create a New Factory Default Config uration field. 3. Click Apply . The new file appears in the list of databa[...]

3 168 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 4. Select the T imezone under which yo u want to schedule the job, either Local or Universal, from the drop-down list. 5. Select the frequency (Daily , W eekly , or Monthl y) with which you want the job to execute from the Repeat drop -down list. 6. Click Apply . 7. Under Execution Detail, s[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 169 Creating Backup Files Y ou can create a backup file manually at any time (see “T o create a backup file manually ,” below), or configure the system to ru n scheduled backups automatically (see “T o configure scheduled backups” on page 170). By default, the backup fi le contains everyth[...]

3 170 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o configure scheduled backup s 1. Click Backup and Restore under Configuratio n > System Configuration in the tree view . 2. In the Scheduled Backup field, click the Freq uency drop-down list and select Daily , W eekly , or Monthly to configure ho w often to perform a regular backup . A[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 171 T o configure automatic transfers of archive files to a remote server 1. Click Backup and Restore under Configuration > System Configuration in the tree view . 2. Under Automatic T ransfer of Archive File, select a file transfer protocol, either TFTP or FTP . If you choose FTP , make sure t[...]

3 172 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Restoring Files from Locally S tored Backup Files T o restore files to the system, you must first create backup files as described in “Creating Backup Files” on page 169. Y ou can restore either from files stored locall y or from files stored on a remote machine. Caution Restoring from a[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 173 b. Click Apply . c. A list of available files in the directory you specify appears. Select the backup files you want to restore. 5. Click Apply . Repeat the previous two steps for each file you want to restore. 6. Do not click Save. Ignore any Unsaved changes will be lost messages. 7. Click Re[...]

3 174 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note Flash-based systems can store a maximum of two Nokia IPSO images. T o delete an Nokia IPSO image 1. Click Manage Images under Configuration > Sy stem Configuration > Im ages in the tree view . 2. Click Delete IPSO Images. 3. Click the delete button next to the image you want to de[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 175 b. (Optional) If the HTTP site on which the Nokia IPSO image is stored requires authentication, enter the HTTP realm to which authentication is needed. c. (Optional) If the server on which the Nokia IP SO image is stored requires authentication, enter the user name and password. 3. Specify whe[...]

3 176 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note When you click T est Boot, the system tests th e new ima ge for five mi nutes. If you let the five-minute test period ex pire without co mmitting to the new ima ge, the system automatically reboot s and reverts to the previou s image. A new page appears, and you see a message telling yo[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 177 Only when you are downgrad ing to a version that was never o n your appliance is the connectivity information from the already installed IPSO version carried over to the less recent version that you are installin g. The configuration informa tion carried over includes:  Interface configurat[...]

3 178 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Y ou can configure the options for monitor rep orts according to your networking and rep orting requirements. Ta b l e 7 shows the parameters that you can configure for monitor reports. T o configure these pa rameters, click Configure Monitor Reports un der Configuration > System Configur[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 179  CheckPoint VPN-1 Pro/Express NGX R60  CheckPoint CPinfo If your platform runs NG with Application Inte lligence (R55) for IPSO 3.8, the only packages you can install are:  Check Point VPN-1 NG with Application Intelligence (R55) for IPSO 3.8 (or later)  Check Point SVN Foundation [...]

3 180 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 12. (Optional) Click the button of the package from which you want to upgrade under Choose one of the following packages to upgrade fr om . 13. Click Apply . 14. Click Save to make your changes perman en t. T o enable or disable a p ackage 1. Click Manage Packa ges under Configur ation > [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 181  Only the remote terminating node responds to the MSS value yo u set; that is, intermediate nodes do not respond. Generally , however , in termediate notes can handle 1500-byte MTUs. Y our system advertises the MSS value you set, an d remote term inated nodes respond by sen ding segments in[...]

3 182 Nokia Network Voyager for IPSO 4.0 Refe rence Guide[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide 183 4 V irtual Router Redundancy Protocol (VRRP) This chapter describes the Nokia IPSO implemen tation of VRRP and how to configure it on your system. VRRP Overview V irtual Router Redundancy Protocol (VRRP) provides dynamic failover of IP addresses from one router to another in the event of failur[...]

4 184 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Nokia provides support for OSPF , BGP , RIP , and PIM (both sparse and dense mode) to advertise the virtual IP address of the VRRP virtu al ro uter . Y ou must use monitored-circuit VRRP , not VRRPv2, to configure virtual IP support for a dyn amic routing protocol. Y ou must also enable the [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 185 Figure 2 VRRP Configuration with Internal and External VRIDs In this example, Platform A acts as the master for both VRID 1 and VRID 2 while Platform B acts as the backup for both VRID 1 and VRID 2. Y ou can configure several platforms to be part of multiple VRIDs while they simultaneously bac[...]

4 186 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Underst anding Monitored-Circuit VRRP The Nokia implementation of VRRP includes additional functiona lity called monitored circuit. Monitor e d-cir cuit VRRP eliminates the black holes caused by asymm etric routes that can be created if only one interface on the master fails (as opposed t o [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 187 Use this method only if y ou do not have an extra IP address to use for mon itored-circuit VRRP . For more information see “Configuring VRRPv2” . Selecting Configuration Parameters Before you begin, plan your implementation by decid ing how you want to set th e following configuration para[...]

4 188 Nokia Network Voyager for IPSO 4.0 Refe rence Guide which to skew the Master _Down_Inte rval) is calcula ted as Skew_time = ( (256 - Priority) / 256) ) . Y ou can configure your VRID to specify one platform as the established master by assig ning it a higher priority , or you can assign equivalent priority to all platforms. If you specify an [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 189 Priority Delt a Choose a value for the priority delta that ensure s that the priority delta subtracted from the priority results in an effective priority that is lower than that of the backup routers (in case an interface fails). Y ou might find it useful to use a standard priority delta throu[...]

4 190 Nokia Network Voyager for IPSO 4.0 Refe rence Guide VMAC Mode For each VRID, a virtual MAC (V MAC) address is assigned to the backup address. The VMAC address is included in all VRRP packet transmissions as the so urce MAC address; the physic al MAC address is not used. When you configure a VRID, you specify which mode IPSO uses to select the[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 191 Before you Begin Before you begin, consider y our hardware and configuration. Are all backup routers able to handle the traf fic they will receive if the master fails? W ill you implement load-sharing? There are two global settings for VRRP as described in the following table. Plan values for [...]

4 192 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note Y ou set values for priority delta and backup add ress only when config uring moni tored-cir cuit VRRP . These parame te rs are not applicable to VRRPv2. Complete these additional step s before you configure VRRP .  Synchronize all platforms that are part of th e VRRP group to have t[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 193 configuration. Y ou do not have to separately specify settings for eac h interface. For more information, see “Configuring Monitored-Circuit V RRP using the Simplified Method” .  Full method—Use this method if you are wor king with a system on which VRRP has already been configured us[...]

4 194 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 8. Click Apply . 9. Click Save to make your changes pe rmanent. 10. Log on to each backup appliance in turn and repeat step 2 through step 5. Make sure you use the same values for VRID , hello interval, auth entication method, and backup address for all no des in the VRID. 11 . If you are us[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 195 Note Y ou cannot change the backup add ress from one interface to anoth er interface while a platform is in t he master state. T o modif y a virtual IP address, firs t cause a failover to the backup by reducing the priority or by pulling an interface, then dele te the VRID on the interface and[...]

4 196 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 5. Enter the value you want to use to iden tify the virtual router and click Apply . Additional fields appear . 6. Enter values for the configuration pa rameters for the virtual router . Most of these parameters are the same as those used in the simplified configuration method described in T[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 197 3. In the row for the interface yo u want to configure, select the VRRPv2 r adio button in the Mode column. 4. Click Submit. T ext boxes for Own VRID and Back up Router with VRID appear . 5. Configure the router as a master or a backup by doing one of the following.  If you want to configur[...]

4 198 Nokia Network Voyager for IPSO 4.0 Refe rence Guide When you use the Check Point cpconfig prog ram (at the command line or usi ng Network V oyager), follow these guidelines:  Install Check Point NGX as an en forcement module only on each node. Do not install Check Point NGX as a management server and enforcement module.  After you choos[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 199 tunnels do not fail over cor re ctly . If the en cr ypt i on /a u then tica tio n alg o rith m is supp or ted in the master and not suppor te d by the backup and you do not use NA T , tunnels fail over correctly , but they are no t accelerated after failover . If you use sequence validation in[...]

4 200 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note The object for VRRP is not the same as the ga teway cluster object fo r HA. Accordingly , in this example, the gateway cl uster object is designated fwcluster-object . Where:  cluster-all-ips is the W orkstation object you created with all IPs.  fwcluster-object is the Gateway Clu[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 201 Link Aggregation (IP2250 Systems Only) IP2250 appliances allow you to aggregate the built-in 10/100 mbps Ether net ports so that they function as one logical port with higher bandwi dth. These appliances offer link aggregation to accommodate fire wall sync hronization traffic in VRRP configura[...]

4 202 Nokia Network Voyager for IPSO 4.0 Refe rence Guide  Master —Forwarding IP packets addressed to the virtual router .  Backup —Eligible to become master and monito ring the state of the current master .  Initialize —Inactive; waiting for startup event. Note If a virtual router is in initialize state for lo nger than 20 seconds, [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 203 Monitoring the Firewall St ate By default, IPSO monitors the state of the fire wall and responds appropriately . If a VRRP master detects that the firewall is not re ady to handle traffic or is not functioning properly , the master fails over to a backup system. If all the firewalls on all the[...]

4 204 Nokia Network Voyager for IPSO 4.0 Refe rence Guide  If you are testing monitored-ci rcuit VRRP by pulling an inte rface, and the other interfaces do not release their IP addresses, check that the priority delta is large enough that the effective priority is lower than the master router .  If you use different encryption accelerator car[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 205 Switched Environment s Monitored-Circuit VRRP in Switched Environment s  When you use monito red-circuit VRRP , some Ethernet switches might not recogn ize the VRRP MAC address after a transition from the master to a backup. This is because many switches cache the MAC address associated wit[...]

4 206 Nokia Network Voyager for IPSO 4.0 Refe rence Guide[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide 207 5 Configuring Clustering This chapter describes IPSO’ s clustering featur e and provides instruc tions for configuring clusters. It includes information about upgrading from IP SO 3.6 to IPS O 3.7 or later if y ou have a cluster configured with IPSO 3.6, and it also presents information about[...]

5 208 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Y ou can create IP clusters by combining flash-b ased platforms other than the IP2250 with disk- based or different flash-based models. For ex ample, the following combinations are valid:  flash-based IP1260, disk-based IP1260, IP380  two flash-based IP1260 pla tforms  IP385, IP380,[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 209  The external router needs a static route to the internal networ k (192.168.1.0) with 192.168.2.10 as the gateway address.  The internal ro uter needs a static route to the external network (192.168.2.0) with 192.168.1.10 as the gateway address. The IP addresses shown in boldface are clu[...]

5 210 Nokia Network Voyager for IPSO 4.0 Refe rence Guide This diagram illustrates the dif ference. Any changes you make in V oyager or Clu ster V o yager are immediately reflected in the CLI and CCLI. The reverse is also true—settings made in the CLI or CCLI are immediately reflected in V oyager or Clus ter V oya ger . Cluster T erminology This [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 211  192.168.3.10 is the cluster IP addr ess of the primary cluster interface.  192.168.4.10 is the cluster IP addr ess of the secondary cluster interfa ce. Cluster MAC address: A MAC address that the cluster protoc ol installs on all nodes. Only the cluster master responds to ARP requests t[...]

5 212 Nokia Network Voyager for IPSO 4.0 Refe rence Guide using different switches). This configuration is preferable to using separate VLANs on one switch to separate them an d is the configuratio n shown in the exampl e cluster . If you do not use a dedica ted network as the primary network—that is, if the primary network also carries data traf[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 213  In multicast mode each cluster node receives every packet sent to the cluster and decides whether to process it based on information it receives from the master node. If the node decides not to process the pack et (beca use another node is pr ocessing it), it drops the packet. This mode us[...]

5 214 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Do not use this mode if you use PIM in the cluster . Caution Avoid changin g the cluster mode while a cluster is in service. If you change the cluste r mode of a single node, the nod e leaves the cluster . If you change the mode on all the nodes (using Cluster V oyage r or the CCLI), the clu[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 215 change ARP global parameters” in the information about configuring interfaces for instructions about how to configure a Nokia appliance to accept these replies. Note If there is no router between the cluster and host syste ms (PCs or workstations), the hosts must b e able to accept ARP r epl[...]

5 216 Nokia Network Voyager for IPSO 4.0 Refe rence Guide between the nodes with different MTU values.T o prevent this problem, make sure that the MTU values are the same on all cluster n odes with Gigabit Ethernet interfaces. Clustering IP2250 Platforms If you use IP2250 platforms to mak e a cl uster, observe th e following guidelines:  Do not [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 217 dropped in the event that th ere is a failover . The ADP I/ O ports should be used for production traffic.  Y ou can aggregate the ports on ADP I/O cards and use the aggregated links for production traffic. If you aggregate ports on ADP I/O cards, observe the following guidelines:  Y ou [...]

5 218 Nokia Network Voyager for IPSO 4.0 Refe rence Guide For All Upgrades When upgrading a cluster , make sure that all the nodes run the same versions of IPSO (and NGX, when appropriate). If you ar e upgrading bot h IPSO and NGX, you should first upgrade IPSO on all the nodes and then upgrade NGX. Th is approach provides the best continuity of se[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 219 Note Y ou should upgrade the master last. 1. Upgrade node A and restart it. B and C continue to function as a 3.6 cluster . Node A (running the later version of IPSO) rejoins the cluster as a member . 2. Upgrade node B and restart it. Node C continues to function as a 3.6 cluster . Node B (run[...]

5 220 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 6. Repeat this procedure on each of the other nodes that you upgraded from IPSO 3.6. Y ou can now manage the cluster using Cluster V oyager or the CCL I. Creating and Configuring a Cluster Configuration Overview T o create and configure a cluster 1. Create a cluster on the first node. 2. Sel[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 221 4. Enter a pas sword for the user ca dmin. The password must have at least six characters. Note Y ou must use the same p asswor d on ea ch nod e tha t you add to th e cluster . This is also the password th at you use to log into Cluster V oyager or the CCLI. 5. Enter the password for cadmin ag[...]

5 222 Nokia Network Voyager for IPSO 4.0 Refe rence Guide  Sequence V erifier .  Wo r m C a t c h e r  Delayed notification of connections  Security servers  IP pools (with non-Check Poin t gateways or clients). See “Supporting Non-Check Point Gateways and Clients” for related information. If any of the requirements for static wo[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 223 The secondary interfaces of all the cluster no des must belong to the same subnet. This subnet should not carry any other traffic unl ess you use it to carry firewall synchronization traffic. (See “Configuring NGX for Clustering” for information about selecting the firewall synchronization[...]

5 224 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Configuring VPN T unnels If you want the cluster to support VPN tunnels in which non-Check Point gateways participate, you must configure the tunnels in V oyager (on the Clustering Setup Configuration page) as well as in NGX. Perform the following procedure: 1. In the Network Address field u[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 225 VPN but not want to route unencrypted traf fic through the cluster . For this purpose, you can use a configuration similar to the one shown in the following diagram: The purpose of this configuratio n would be to route th e outgoing unencrypt ed traffic through the default gateway and route th[...]

5 226 Nokia Network Voyager for IPSO 4.0 Refe rence Guide cluster interfaces (192.168.1.2 and 192.168. 1.3) as gateway addre sses. In the example network, the internal router has the following static routes:  route: 10.1.2.0/24, g ateway: 192.168.1.10  route: 10.1.3.0/24, g ateway: 192.168.1.10 Configuring IP pools in Cluster V oyager If you [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 227 In addition to h elping you make sure that all cluster nodes are co nfigured consiste ntly , using this feature makes the configuration process easier and faster . The list of shared features should be specified only when you set up a cluster . Once the cluster is operational, yo u should avoi[...]

5 228 Nokia Network Voyager for IPSO 4.0 Refe rence Guide because of join-time sharing, you can reload the desired configuration on C from the saved configuration file. See “Managing Co nfig uration Sets” for information abou t saving and loading configuration files. If node C becomes th e master in the previous example, th en its settings for [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 229 After Y ou Create a Cluster Whenever you use Cluster V oyager (or the CCLI), you can rem ove features from the list of ones that are cluster sharable . Y ou can do this on any node. However , Nokia recommends that you avoid doing this. Y ou should set up the appropri ate feature sharing when y[...]

5 230 Nokia Network Voyager for IPSO 4.0 Refe rence Guide  Manual configuration. If you use th is method, you must supply more in formation so that the system can join the cluster . Ma nually addin g nodes is very si milar to the process of creating a cluster configuration on the first node, and you must make sure to enter the appropriate settin[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 231 Joining a System to a Cluster T o join a system to a cluster , perform this simple procedure: 1. Display the Interface Configuration page. 2. Configure interfaces with IP addresses in each of the networks used by the cluster and activate the interfaces. 3. Click T op. 4. Under T raf fic Manage[...]

5 232 Nokia Network Voyager for IPSO 4.0 Refe rence Guide  Y ou can make changes that are implemented on all the nodes simultaneou sly . T o make changes in this way , you use Clus ter V oyager or the CCLI. (See the IPSO CLI Refer ence Guide for information abou t using the CCLI.) Note Nokia recomme nds that you us e Cluster V o yager or the CCL[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 233  Someone else is logged into Cluster V oyager or the CCL I and has acquired an exclusive configuration lock If someone else has acquired an exclusive configuration lock when you attempt to log in and acquire a lock, V oyager will display a “permission denied” message and ask you to log [...]

5 234 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Cluster V oyager or the CCLI are als o implemented on node B. (Y ou can log into all nodes as cadmin because this user is created automatically on each node. ) Note If you assign the Clustering feature to a user with the role type System, that user can configure cluste ring on individual nod[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 235 performance rating to force a particular node to be the master (which will also have the ef fect of giving that node a lar ger share of work). T o change the performance rating, enter a number in the Performance Rating field (the range of values is 0 throu gh 65535), then click Apply and Save.[...]

5 236 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note Nokia recommends that you do not make change s to cluster settings or join-time shared features on individual nodes—use Clu ster V oyager or the CCLI to make these changes. This will help you ensure that all the nodes are configur ed consistently . When you log in as a cluster adminis[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 237 If you specify an invalid FTP server or an invalid path to a valid server as the source of the image, Cluster V oyage r does not respond with an error message and dis plays the follow ing messages instead: New Image installation in progress Please don't perform a cluster reboot until all [...]

5 238 Nokia Network Voyager for IPSO 4.0 Refe rence Guide The following is an illust ration of this process in a three node cl uster with nodes A, B, and C, in which C is the originating node. 1. If the node A restarts successfully and rejoins the cluster , node B restarts. If node A does not reboot and rejoin the clus ter successfully , the cluste[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 239 Changing Cluster Inte rface Configurations If you want to change the cluster interface config uration of a node—for ex ample, if y ou wan t to change the primary interface—you must log into the node as a system user . Y ou c annot use Cluster V oyager o r the CCLI. Note Any time you make a[...]

5 240 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Configuring NTP There are two approaches to c onfiguring NTP in a cluster:  Using a device outside the cluster as the NTP server . In this case you use the IP address of the ser ver when configuring NTP on the cluster nodes.  Using the cluster master node as the NTP server . In this ca[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 241 Using the Master Node as the NTP Server T o configure the cluster master as the NTP server, do the following steps on the NTP configuration page: 1. Log into Cluster V oyager . 2. Display the NTP Configuration page. 3. Enable NTP . After you enable NTP , you see, you see additional options. 4.[...]

5 242 Nokia Network Voyager for IPSO 4.0 Refe rence Guide  Configure state synchronization:  Enable state synchronization and configure interfaces for it.  The interfaces that you configure for state sync hronization shou ld not be part of a VLAN or have more than one IP address assigned to them.  Enable antispoofing on all the in terfa[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 243 T o enable sequence validation in the Chec k Po int management appli cation and IPSO, follow these steps: a. On the main Configuration pa ge in Nokia Network V oyager , click Advanced System T uning (in the Sy stem Configuration section). b. On the Advanced System Tuning page, click the button[...]

5 244 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Configuring the Cluster in V oyager 1. Using V oyager , log into node A. 2. Display the Interface Configuration page. 3. Configure interfaces with IP addresses in each of the networks shown in the example and activate the interfaces. For example, the IP address for inte rface eth-s1p1 woul d[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 245 17. Click Save. 18. Configure static routes from this node to the internal and external networks using 192.168.1.5 and 192.168.2.5 as gateway addresses (next hops). 19. On nodes B and C, configure interfaces with real IP addresses in each of the four networks shown in the example. 20. Join nod[...]

5 246 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Clustering Example With Non-Check Point VPN This section presents an example that shows how easy it is to configure an IPSO cluster to support a VPN with a non-Check Point gateway . The following diagram illustrates the example configuration: This example cluster is very similar to the previ[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 247 4. In the Add New VPN T unnel section, enter 10.1.1.0 in the Network Addres s field. 5. In the Mask field, enter 24. 6. In the T unnel End Point field, enter 10.1.2.5. 7. Click Apply . 8. Click Save. 9. Configure the same tunnel in NGX. For more information, see “Configuring NGX for Clusteri[...]

5 248 Nokia Network Voyager for IPSO 4.0 Refe rence Guide[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide 249 6 Configuring SNMP This chapter describes the Nokia IPSO impl ementation of Simple Network Management Protocol (SNMP) and how to con figure it on your sy stem. SNMP Overview The Simple Network M anagement Protocol (SNMP) is the In ternet standard protocol used to exchange manage ment informatio[...]

6 250 Nokia Network Voyager for IPSO 4.0 Refe rence Guide MIB Source Function Rate-Shape MIB propriet ary Moni toring rate-shaping stat istics and configuration. Monitoring system-specific parameters. IPSO System MIB prop rietary D efines the system MIB for IPSO. The IPSO chassis temperature, fan group, a nd power-supply group function only on cert[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 251 SNMPv2 TC RFC 854 Defines textual conventions for various value s reported in OIDs and Trap s. Dial-Control MIB RFC 2128 Describes peer information for demand access an d other kinds of interfaces. Note: The dialCtlPeerCallInformation and dialCtlPeerCallSetup tra ps ar e not supported by IPSO.[...]

6 252 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Both the proprietary MI Bs and the public MIBs are supplied with the system. T o view more detailed information about the MIBs, see the /etc/snmp/mibs directory . Note The SNMPv2-CONF MIB resides in the /etc/sn mp/mibs/unsupported dir ecto ry . The SNMP agent implemented in Nokia IPSO enable[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 253 Using the Check Point MIB Y ou must use the Check Point version of the Ch eck Point MIB (CP-MIB) text file in $FWDIR/ lib/snmp of your network management tool. Do not use the CheckPoint-MIB.txt included in releases before Nokia IPSO 3.7. Whenever IPSO SNMPd is started or restarted, it searches[...]

6 254 Nokia Network Voyager for IPSO 4.0 Refe rence Guide SNMP query operations. In this case, you mig ht have to delete the FloodGat e package fro m your system. Enabling SNMP and Selecting the V ersion The SNMP daemon is enabled by default. If yo u choose to use SNMP , configure it according to your security requirements. At minimum, you must ch [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 255 Note If you select the Disable checkbo x all com munity string s ar e di sable d a nd SNMPv1 and v2 do not function. This has the same ef fect as selecting only SNMPv3 in the previous step. 6. (Optional). Set a read-w rite community string. Caution Set a read-write community string only if you[...]

6 256 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note If no agent addresses are specified, the SNMP protocol resp ond s to requests from all interfaces. Configuring T rap s Managed devices use t rap messages to report events to the network management station (NMS). When certain types of events occur , the platform sends a trap to the manag[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 257 lamemberActive Supplies notification when a port is ad ded to a link aggrega tion group. lamemberInactive Supplies notification w hen a port is re moved from a link aggregation gr oup. Authorization Supplies notif ication when an SNMP opera tion is not properly authenticated. Although all impl[...]

6 258 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o configure traps, specif y the following information:  The location of the trap recei ver (manag ement station). See “Configuring T rap Receivers” on page 259.  Which types of traps to enable. See “Enabling or Disabling T rap T ypes” on page 259.  An agent address to be i[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 259 Configuring T rap Receivers Y ou must specify the management station that accepts traps from your appliance, and the community string used on your manageme nt station (receiver) to control access. T o configure trap receivers 1. Choose SNMP under Configurati on in the tree view . 2. Enter the [...]

6 260 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 4. Click Save to make your changes pe rmanent. Configuring Location an d Cont act Information The settings for location and cont act information provid e information to the management system about where your device is loca ted and who to contact about it. Set the location and contact strings[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 261 Note Y ou might not see the codes. The SNMP manager or utility interprets the codes and displays and logs th e appropr iate mess age. The subsequent, or fourth field, contains the erro r index when the error-status field is nonzero, that is, when the error -status field returns a valu e other [...]

6 262 Nokia Network Voyager for IPSO 4.0 Refe rence Guide GetNextRequest The only values that can be returned as the second element in the varia ble-bindings field to a GetNextReque st when an error -status code occurs are unSp ecified or endOfMib V iew . GetBulkRequest The GetBulkRequest minimizes the number of protocol exchanges by letting an SNM[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 263 and encryption, but you ca n em ploy them independently by spec ifyin g one or the other with your SNMP manager requests. The I PSO system responds accordingly . Note Nokia system s do not prot ect traps wi th authentication or encryption. Request Messages Y ou must configure your SNMP manager[...]

6 264 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o view existing SNMP users, click SNMP under Configuration > System Configuration in the tree view and click Manage SNMP Users. Altern atively , you can click the Manage SNMP User Access link located on the Configuration > Security and Access > Users page. The admin user or a user[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 265 T o delete a USM user 1. Click SNMP under Configuration in the t ree view . 2. Click Manage USM Users at the bottom of the page. The Manage SNMP Users page appears. 3. Select the appropriate Delete check box. 4. Click Apply . 5. Click Save to make your changes permanent.[...]

6 266 Nokia Network Voyager for IPSO 4.0 Refe rence Guide[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide 267 7 Configuring IPv6 This chapter describes the IPv6 features suppor ted by Nokia IPSO and how t o configure them on your system. IPv6 Overview IPv6 is the next generation IP proto co l and is expected to replace IPv4, th e current IP protocol. The Internet Engineering T ask Force (IETF) form all[...]

7 268 Nokia Network Voyager for IPSO 4.0 Refe rence Guide  IPv6 over IPv4 T unnel (RFC 2185)  IPv6 over Ethernet (RFC 2464)  IPv6 over FDDI (RFC 2467)  IPv6 over PPP (RFC 2472)  IPv6 over A TM (RFC 2492, PVC only)  IPv6 over ARCNET (RFC 2497)  IPv6 over T oken Ring (RFC 2470)  IPv6 over IPv4 (RFC 2529 )  IPv6 to IPv4 (Int[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 269 T o delete an IPv6 address 1. Click IPv6 Interfaces under Configuration > Sy stem Configuration > IPv6 Configuration in the tree view . 2. Click the logical interface link to configure in the Logical column for which you want to delete an IPv6 address. Example: eth-s1p1c0 3. Check the de[...]

7 270 Nokia Network Voyager for IPSO 4.0 Refe rence Guide represents the number of times to retry Dupl icate Address Detection Neighbor Discovery requests. 6. In the Permanent Ne ighbor Discove ry Entries field, enter the pe rmanent IPv6 address for the permanent neighbor discovery destination in the New Perman ent Neighbor Discovery Entry text box[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 271 Configuring IPv6 to IPv4 This feature allows you to co nnect an IPv6 domain throug h IPv4 clouds without configurin g a tunnel. T o configure IPv6 to IPv4 1. Click IPv6 to IPv4 und er Configuration > System Configuration > IPv6 Config uration in the tree view . 2. In the Enable IPv6 to I[...]

7 272 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 6. Click Apply . 7. Click Save to make your changes pe rmanent. Configuring IPv4 in IPv6 T unnels This feature allows you to set up a point-to-point link to pe rmit traffic from IPv4 domains to travel through IPv6 do mains. T o configure IPv4 in IPv6 tunnels 1. Click IPv6 in IPv4 T unnels un[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 273 6. T o specify the order in which next hops are se lected, enter a value from one to eight in the Preference text box. The lower the value the more preferred the link. The next preferred value is selected as the next hop onl y when an interface fails. A non- reachable link is not selected as t[...]

7 274 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 5. Scroll through the New Contribu ting Protocol List click th e protocol y ou want to use for the new aggregate route. 6. Click Apply . 7. Click Save to make your changes pe rmanent. 8. Click On in the Contribute All Routes from <Protocol> field. 9. (Optional) T o specify an IPv6 pref[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 275 6. T o redistribute a spec ific aggregate route or ro utes into RIPng, click On next to the IPv6 interface for the aggregate route to redistribute into RIP ng. 7. Enter a value in the Metric text box for the metric cost that the created RIPng route will have. 8. Click Apply . 9. Click Save to [...]

7 276 Nokia Network Voyager for IPSO 4.0 Refe rence Guide more information about configurin g VRRP for IPv6 interfaces, see “Configuring VRRP for IPv6.” 1. Click ICMPv6 Router Discovery u nder Configuration > System Configuration > IPv6 Configuration > Router Serv ices in the tree view . 2. T o enable ICMPv6 router discovery , click On[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 277 14. (Optional) T o specify that the IPv6 pref ix can be used for autonomous address configuration, click Y es in the Autonomous Fl ag field. 15. (Optional) Enter a value (in seconds) in the Pr efix V alid Lifetime text box for the prefix information options valid lifetime field. This value rep[...]

7 278 Nokia Network Voyager for IPSO 4.0 Refe rence Guide the new master begins to sen d out router disc overy advertisements. For more information about configuring Router Discovery for IPv6 interfaces, see “Configuring ICMPv6 Ro uter Discovery .” Creating a V irtual Router for an IPv6 Interface Using VRRPv3 Y ou must configure a virtual route[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 279 Use this procedure to configure virtual routers to back up the addresses of other routers on a shared media network. 1. Click VRRP for IPv6 under Configuration > System Configuration > IPv6 Configuration > Router Services in the tree view . 2. Click VRRPv3 button next to the in terfac[...]

7 280 Nokia Network Voyager for IPSO 4.0 Refe rence Guide This option does not affect the functioning of your system if a firewall is not installed. 1. Click VRRP for IPv6 under Configur ation > System Configuration > IPv6 Configuration > Router Serv ices in the tree view . 2. Click Enabled in the Monitor Firewall S tate field. 3. T o disa[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 281 Enter the IP address you want to assign to the virtual router back up in the Backup Address edit box. Click Apply . Note The IP address(es) associated with the monito red circuit virtual router must not match the real IP address of any host or r outer on the network of the interface. 3. T o se[...]

7 282 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Failover of the default router no longer occurs. When you disab le a virtual router , you must first remove the VRRP configuratio n for that virtual router fro m all of the backup routers. Y ou must not delete the virtual router on the de fault router first, as it stops sen ding VRRP adverti[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 283 configured. The default is 100 centisecon ds , that is, 1 second. 5. (Optional) Click Disabled n ext to Preempt Mode if you do not want virtual router with a higher priority to preempt the current master router and become the ne w mas ter . The default is Enabled, which me ans that a virtual r[...]

7 284 Nokia Network Voyager for IPSO 4.0 Refe rence Guide resulting in the ef fective priority value. T his effective priority value of the virtual router is used to determine the election of th e VRRP master rout er . Note Y ou must enter a priority delt a value for each interface you select to monitor . If you do not enter a priority delt a value[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 285 Security and Access Configuration T o enable FTP , TFTP , or T elnet access 1. Click Network Access Services under Co nfiguration > System Configuration > IPv6 Configuration > Security and Access Configuration in the tree view . 2. Select Y es next to the types of access you want to a[...]

7 286 Nokia Network Voyager for IPSO 4.0 Refe rence Guide[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide 287 8 Managing Security and Access This chapter desribes how to manage passwords, user accounts, and groups, how to assign privileges using role-based administration, and ho w to configure network access, services, and Network V oyager session management. It also describes how to con figure AAA for[...]

8 288 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o change another user ’ s p assword 1. Log in as a user who has read/write permissions for the Users feature. Note Admin users or any user with the User feature assigned to them can change a user’s password without providin g th e ex isting password. 2. Click Manage User under Configur[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 289 After you create a new user , go to Role-Base d Ad ministrati on > Assign Role to Users to grant the user additional access privileges. For more information, see “Role-Based Administration” on page 293 . Ta b l e 1 4 describes the attribute s associat ed with each user account. Adding a[...]

8 290 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o add a user 1. Click Users under Configuration > Security and Access Configuration in the tree view . 2. In the Add New User section, en ter the name of the user , a unique user ID, and the home directory for the new user . The home directory must be /var/emhome/< usernam e >. No[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 291 T o configure S/Key 1. Click Users under Configuration > Security and Access Configuration in the tree view . 2. Enable the Admin S/Key or Monitor S/Key by selecting either the Allowed or Required radio buttons.  Disabled—S/Key passwords are turned off and cannot be used.  Allowed?[...]

8 292 Nokia Network Voyager for IPSO 4.0 Refe rence Guide The server also returns a prompt for a password. 4. Copy the S/Key sequence number and seed into the S/Key calculator on your platfo rm. 5. Copy the S/Key challenge into the S/Key calculator on your local platform. 6. Enter the S/Key Secret Password. The calculator returns the OTP for this s[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 293  Control who can log in through SSH. For most other functions that are generally associated with groups, use the role-based administration feature, described in “Role-Based Administration” on page 293. T o add or edit a group 1. Click Groups under Configuration > Security and Access [...]

8 294 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Managing Roles T o view a list of existing roles on your system, click Manage Roles under Configuration > Security and Access >Role Based Administration in the tree view . The following roles are predefined on the system:  adminRole — Give s the user read/write access to every fea[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 295 4. Add features by moving them to the R W (Rea d/W rite) or RO (Read Only) columns, depending on the permission level yo u want to give to this role. Remove the features by moving them back to the A vailable column. Press Shift-click to select a range of features, or Ctrl-click to select multi[...]

8 296 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 3. Assign roles to or remove them for the user by selecting them and clicking Assign or Remove. Use Shift-click to select a range of roles, or Ctrl-click to select multiple roles at a time. Note Y ou cannot change the roles assigne d to the Admin, Cluster Admin, or Monitor users. 4. If you a[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 297 Configuring Network Access and Services Ta b l e 1 5 lists the options that you can configure for network acc ess. Ta b l e 1 6 lists the service s you can enable on the appliance or for the cluster . T able 15 Network Access Configuration Opt i ons Option Description FTP Access Enable or disa[...]

8 298 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o enable network access options and services 1. Click Network Access and Services under Configuration > Security and Access in the tree view . 2. Select the Y es radio button for the access op tions and services you want to enable. 3. If you are enabling login to COM2 , COM3, or COM4, c[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 299 T o configure a modem on COM2, COM3, or COM4 1. Click Network Access and Services under Conf iguration > Se curity and Acc ess in the tree view . 2. Click Modem Configuration next to the appropriate serial port. The Modem Configuration page appears. 3. Select the On radio butto n to turn on[...]

8 300 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Ta b l e 1 9 lists the country codes that you sele ct from wh en entering the code for an Ositech Five of Clubs II or III card in step 7 of the preced ing procedure. Configuring Nokia Network V oyager Access When you set up your system for the fi rst time, perform th e following tasks:  C[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 301 Configuring Basic Nokia Network V oyager Options Y ou can configure the following options for Nokia Network V oya ger access:  Allow Network V oyager access (enabled by default)  Enable session managem ent (enabled by default)  Specify a Network V oyager SSL/TLS port number  Requir[...]

8 302 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Generating and Inst alling SSL/TLS Certificates IPSO uses the Secure Sockets Layer/T ranspor t Layer Security (SSL/TLS) protocol to secure connections over the Internet from the Nokia Ne twork V oyager client to the IPSO system. SSL/ TLS, the industry standard for secure W eb conn ections, g[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 303 domain name (FQDN ) for your platform: fo r example, www .ship.wwwidgets.com. If you are generating a certificate signing request fo r a CA, that CA might impose a different standard. g. (Optional) In the Email Address field, ent er th e email address to use to contact the person responsible f[...]

8 304 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 5. If you entered a passphrase when you generate d the certificate and private key , you must enter the passphrase in the Passphrase field. 6. Click Submit. T roubleshooting SSL/TLS Configuration Y ou might have trouble accessing Nokia Networ k V oyager if SSL/TLS is not configured correctly[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 305 Y ou should use SSH, instead of utilities such as T elnet or rlogin that are not secure, to connect to the system . Y ou can also tunnel HTTP over SSH to use Network V oyage r to securely manage your platform. T o use SSH, you must obtain an SSH client for the other end of the connection. SSH [...]

8 306 Nokia Network Voyager for IPSO 4.0 Refe rence Guide can permit any combination of these methods. In all cases the default is Y es, except for rhost and rhost with RSA au thentication . The rhost authe ntication is insecure and Nokia does not recommended using it. 7. Click Apply 8. (Optional) In the Configure Server Protocol De tails field, cl[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 307 3. Click Apply . 4. (Optional) In the Configur e Server Acce ss Contr o l table, enter the group and user nam es in the appropriate text boxes . Y ou can use wild card characters when you spec ify multiple group or user names separated by spaces. Note If you specify users or group s, only thos[...]

8 308 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 13. Click Apply . 14. (Optional) In the Configur e Service Details fie ld, click the choices and enter appropriate values in the text boxes. 15. Click Apply . 16. (Optional) In the Configure Server Implemen tation Details table, select the appropriate setting from the drop-down list, and cli[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 309 T o configure authorized keys 1. Click SSH Authorized Keys under Config uration > Security and Access > Secure Shell (SSH) in the tree view . Note If you previously configur ed authorized keys for use r accounts, the informatio n appears in the View/Delete Per- User Authorized Keys table[...]

8 310 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 4. (Optional) T o generate an RSA host key (to us e with SSHv2), select the key size , listed in bits, from the Generate New RS A v2 Host Key drop-down list. 5. Click Apply . 6. (Optional) T o generate a DSA host key (to u se with SSHv2), select the key size, listed in bits, from the Generat[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 311 T unneling HTTP Over SSH T o tunnel HTTP over SSH 1. Generate a key . 2. Put authorized public keys on the system. 3. Log in and redirect a port on your platform to th e remote platfo rm. Depending on what type of terminal you are usin g complete the following.  From a UNIX terminal —Use [...]

8 312 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note Network V oyager uses cookies to keep track of HTTP sessions. Network V oyager cookie based session management does n ot store user names or passwords in any form in the cookies. Y ou should continue to access Network V oyager from a secu re worksta tion. For information about configura[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 313 Authentication, Authorization, and Accounting (AAA) Creating an AAA Configuration Use this procedure to crea te an AAA configuration for a new service. A serv ice is a name that is used by an application uses to invoking the Pluggable Authen tication Module (P AM) Application Programming Inter[...]

8 314 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Creating a Service Module Entry T o create a service module entry 1. Enter the name of the service in the New Service text bo x under the Service Module Configuration table. 2. In the Profile text box under the Serv ice Module Configuration table, en ter either an existing Profile Name from [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 315 For a description of the authentication algor ithms that the list items represent, see “Authentication Pr ofile T ypes.” 3. Select the item in the Control drop-down list that matches the service requirements. V alues other than required are effectiv e only when the service requir es more t[...]

8 316 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Creating an Accounting Pro file T o create an account profile 1. Enter the name of the accounting profile in th e New Acct. Profile text box under the Acct. Profile table; make sure that the name does not match any of the Nam es in the Acct. Profile table. 2. Select the item in the T ype dro[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 317 Accounting Profile T ypes The following table describes the account manageme nt algorithms that are represented by the values in the T ype drop-down lists unde r Acct. Profile. Note Modules in the Module column reside in the /usr/lib directory . Creating a Session Profile T o create a session [...]

8 318 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note Modules in the Module column resid e in the /usr/lib directory . Profile Controls Control values determine how the results of multiple authentica t ion, ac counting, or session algorithms are handled and when additional algor ithms in a list are invoked. Specifies lists of algorithms by[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 319 The screens following graphic shows an example of creating a new service. Configuring RADIUS RADIUS, or remote authentication dial-in us er service, is a client and server-based authentication software system th at supports remote-access appli cations. This service allows an organization to ma[...]

8 320 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 4. Click the Control drop-down list and select required, requisite, sufficient, optional or NOKIA-SER VER-AUTH-SUFFICIENT to determine the level of authentication to apply to a profile. For more information, see “Profile Controls.” 5. Click Apply , and then click Save to make your chan g[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 321 If all the attempts do not make a reliable conn ec tio n within t he timeout period, the client stops trying to contact the RADIUS server . The default is 3. Note The maximum tries value include s the first attempt. For example, a value of 3 means the client makes two additional attempts to co[...]

8 322 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 5. Click Apply , and then click Save to make your chan ges permanent. The name o f the T ACACS+ au thent ication profile appears in the Auth. Profile table. 6. Y ou must now config ure on e or more servers to use in a single authentication profile. In the Auth. Profile table, click the Serve[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 323 This action takes you to the page for AAA RAD IUS or T ACACS+ A uthentication Servers Configuration. 3. In the RADIUS or T ACACS+ Servers For Auth. Profile table, check the Delete check box next to the row for the RADIUS or T ACACS+ server to disable. Note Y ou must have at least one RADIUS or[...]

8 324 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note The algorit hm is added t o the end of the list. The order of algorithms in the list is th e order that they a re invoked. T o cha nge the orde r , dele te the algo rithms which a re out of order by using “Deleting an Item in a Service Profile Entry ,” and ad d them in t he desired [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 325 T o add an accounting profile 1. Enter the name of the profile in the Service Profile text box; th e name is shown in the Profile Name column of the Service Profile table. 2. Enter an item from the Name column of the Acct. Profile table into the Acct. Profile text box of the Service Profile ta[...]

8 326 Nokia Network Voyager for IPSO 4.0 Refe rence Guide  Select a different item i n the T ype list that matches the new requirements of the service. For a description of the authentication algor ithms that the list items represent, see Authentication Profile T ypes.  Select a diff erent item in the Control list that matches the new require[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 327 Deleting an Item in a Service Profile Entry  Highlight one of the entries in the lists under the Auth Profile, Acct Profile or Session Profile column in the Service Profile ta ble for the entry you want to change.  Select the Delete check box of the same entry . Deleting an AAA Configura[...]

8 328 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Enabling Encryption Accelerator Cards If you do not intend to use SecureXL, y ou must ma nually enable the encryption accelerator card after you install it. If you enab le SecureXL, the encryption accelerator card is automatically enabled—you do no t need to perform any ot her software tas[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 329  An encapsulation security payload (ESP) that provides auth entication and confidentiality through symmetric encryption, and an optional anti-replay ser vice. ESP does not include the IP header in the auth entication/confidentiality .  A protocol negotiation and key exchange pr otocol (I[...]

8 330 Nokia Network Voyager for IPSO 4.0 Refe rence Guide In tunnel mode, the original IP datagram is placed inside a new datagram, and AH or ESP are inserted between the IP header of the new packet and the original IP datagram. The new header points to the tunnel en dpoint, and the original header poin ts to the final destination of t he datagram.[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 331 way communication. T o secure bidirectional comm unication between two hosts or two security gateways, two SAs (one in eac h dire ction) are required. Processing the IPSec t raf fic is largely a questio n of local implementatio n on the IPSec system and is not a standardization subject. Howeve[...]

8 332 Nokia Network Voyager for IPSO 4.0 Refe rence Guide exchange must take place during Quick Mode . Consequently , the two pe ers generate a new Diffie-Hellman key pair . Using PKI For Phase 1 negotiation of IKE, the IPSec systems can use X.509 certificat es for authentication. X.509 certificates are issued by Certificat e Authoritie s (CA). IPS[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 333 The IPSec configura tion in Network V oyager is based on three IPSec objects: proposals, filters, and policies.  Proposals —Define the combination of encryption an d authentication algorithms that secure phase 1 negotiation (Ma in Mode) as well as phase 2 ne go tiations (Quick Mode) and I[...]

8 334 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note Native IPSO IPSec tunnels cannot coexist in the same machine with Check Point IPSec software. Be fore you use IPSO IPSec softw are, ensure that no Check Point software is running. Likewise, before you use Check Point IPSec software, ensure that no IPSO IPSec software is runn ing . Y ou [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 335  Some IPSec systems require that the SA lifetim es (seconds, as well as me gabytes) match on both devices. See “Putting It All T ogether” in “Creating an IPSec Policy” for more information.  IKE and PFS groups should match on both devices. See “Putting It All T ogether” in ?[...]

8 336 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Proposal and Filters 1. Under the Proposals table, enter a name for a new proposal in the New Proposal text box. Click either ESP or AH. Note If you click AH, the Encryption Alg (algorithm) must always be set to NONE. If this is not done, an error message appears when you click Apply . 2. Fr[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 337 3. Click on the new link with the sa me name that you entered in Step 1. This action takes you to the IPSec Certificate Addition page for that specific certificate. 4. On the Certificate Addition page, you have two choices:  If you have the PEM (base64 ) enc oded certifi cate, select the Pa[...]

8 338 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o enroll and inst all a device certificate 1. Under the Device Certificates table, enter a name in the New Certificate text box, then click Apply . 2. An Apply Successful message appe ars and the name of the CA you just entered appears in the Device Certificates table. 3. Click on the new [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 339 you can click on the link with the Ce rtif icat e name in the IPSec General Configuration page to install the certificate. 10. If you chose W ill do it later to make the cer tificate request, the link on the main IPSec General Configuration still points to the certificate request page. Y ou ca[...]

8 340 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Putting It All T ogether T o complete creating an IPSec policy 1. Under the Policies table, enter a name for a new policy in th e New Policy text box, then click Apply . An Apply Successful message appe ars and the policy name appears in the Policies table. 2. Click on the policy name in the[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 341 below the policy section. The link to more p ages appears on ly after you create more th an 10 policies. Creating an IPSec T unnel Rule T o create an IPSec tunnel rule 1. Click IPSec under Configuration > Security and Access in the tree view . 2. Click the IPSec link. 3. Under the IPSec T u[...]

8 342 Nokia Network Voyager for IPSO 4.0 Refe rence Guide The hello protocol determines the connectivity of an end-to-e nd logical tunnel. As a result, the hello protocol modifies the link status of the logical interface. If the connectivity of an unavailable tunnel is restored, the hello protocol brings up the link . 10. (Optional) If the hello pr[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 343 The new entry appears in the IPSec T ransport Rules table. 4. (Optional) T o change the policy entry without ch anging the name of th e associated transport rule, perform the following steps: a. Click in the blank square next to the current policy entry . Click Apply . The policy name is remov[...]

8 344 Nokia Network Voyager for IPSO 4.0 Refe rence Guide IPSec T unnel Rule Example The following steps tell how to configure a samp le IPSec tunnel. The following figure below shows the network config ur ation for this example. T o configure Nokia Platform 1 1. Click IPSec under Configuration > Security and Access in the tree view . 2. Under t[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 345 8. (Optional) From the drop-down list in the Log Level field, select Info. Click Apply . 9. (Optional) Click Up. 10. In the Policies table, enter rule_1 as the name for a new policy in the New Policy text box. Click Apply . 11 . In the policies table, click on rule_1 . The correspondin g Confi[...]

8 346 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Configure Nokia Platform 2 Now set up network application platform 2 (Nokia Platform 2). Perform the same steps that you performed to configure Nokia Platfo rm 1, with the following changes. 1. Ste p 1 8 ; e n t e r 192.68.26.74 in the Local Address text box. 2. Ste p 1 9 ; e n t e r 192.68.[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 347 Note In this example, the authen tication me th od is a preshar ed secret, so you do not ne ed to select a certificate. 7. (Optional) Click the IPSec Ad vanced Configuration link. 8. (Optional) From the drop-down list in the Log Level field, select Info. Click Apply . 9. (Optional) Click Up. 1[...]

8 348 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Configure PC1 Y ou now ne ed to set up PC1. Perform the sa me steps that you perform ed to configure Nokia Platform 1 (IPSO), with the following changes. 1. Step 6; for the local filter , enter 192.68.26.74 in the Address text box. 2. Step 7; for the remote filter , enter 192.68.26.65 in the[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 349 Miscellaneous Security Settings The Miscellaneous Security Settings page unde r Configuration > Secur ity and Access allows you to change the handling of TCP packets. Th e default b ehavior is for IPSO to drop TCP packets that have both SYN and FIN bits set. This behaviour addresses a CER T[...]

8 350 Nokia Network Voyager for IPSO 4.0 Refe rence Guide[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide 351 9 Configuring Routing This chapter describes the IPSO routing subs yste m, how to configure the various rou ting protocols that are supporte d, route aggregation, and route red i stribu tion. Routing Overview The Nokia routing subsystem, Ipsilon Scalable Routing Daemon (IPSRD), is an essential [...]

9 352 Nokia Network Voyager for IPSO 4.0 Refe rence Guide RIP RIP is a commonly used IGP . RIP version 1 is described in RFC 1058, and RIP version 2 is described in RFC 1723. IPSRD supports these ve rsion, as well as RIPng, which supports IPv6 interfaces. RIP uses a simple distance vector algorithm called Bellman Ford to calculate routes. In RIP , [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 353 BGP is also a path-vector routing protocol, which limits the distribution of a f irewall’ s reachability information to its peer or neighbor firewalls. BGP us es path attributes to provide more information about ea ch route. BGP maintains an AS pa th, which i ncludes the number of each AS th[...]

9 354 Nokia Network Voyager for IPSO 4.0 Refe rence Guide IPSO supports OSPF v2, which supports IPv4 ad dressing, and OSPFv3, wh ich supports IPv6 addressing. T ypes of Areas Routers using OSPF send packets called Link Stat e Advertisements (LSA) to all routers in an area. Ar eas are smaller groups within the AS that you can design to limit the flo[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 355 Area Border Routers Routers called Ar ea Bor der Routers (ABR) have interfaces to multip le areas. ABRs compact the topological information for an area and transm it it to the backbone ar ea. Nok ia supports the implementation of ABR behavior as outlined in the Internet draft of the Internet E[...]

9 356 Nokia Network Voyager for IPSO 4.0 Refe rence Guide IPSO also supports OSPF over VPN tunnels that terminates at a VRRP group. Only active- passive VRRP configurations ar e su pported, active-active config uratio ns are not. Clustering IPSO supports OSPF in a cluster . Each member of a cluster runs OSPF tasks, but only the master changes the s[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 357 Configuring OSPF Area s and Global Settings Ta b l e 2 1 lists the parameters for areas and global settings that you use when configuring OSPF on your system. As you add area s, each is displayed with its own configuration parame ters under the Areas section. T able 22 describ es the configura[...]

9 358 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o configure OSPF , use the following procedure . T able 23 NSSA (Not So Stubby Area) Pa rameters Parameter Description T ranslator Role Spec ifies whether this NSSA border rout er will unconditionally translate T ype-7 LSAs into T ype-5 LSAs. When role is Always , T ype-7 LSAs are translat[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 359 T o configure OSPF 1. Complete “Ethernet Interfaces” for the interface and assign an IP address to the interface. 2. Click OSPF under Config ur ation > Routing Configuration in the tree view . 3. Enter the router ID in the Router ID text box. 4. If you want to define additional OSPF are[...]

9 360 Nokia Network Voyager for IPSO 4.0 Refe rence Guide  Hello interval —Length of time, in seconds, between hello packets that the router sends on the interface. For a given link, this field must be the same on all routers or adjacencie s do not form. Default: 30.  Dead interval —Number of seconds after the router stops receiving hello[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 361 T able 24 Global Settings for OSPF Parameter Description RFC1583 Compatibility This implementation of OSPF is based on RFC2178, which fixed some looping problems in an earlier sp ecification of OSPF . If your implementation is running in an environment with OSPF implementations based on RFC158[...]

9 362 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Configuring OSPF Interfaces Ta b l e 2 5 lists the parameters for interfaces that you use when configuring OS PF on your platform. T able 25 Configuration Parameters for OSPF Interfaces Parameter Description Area The drop-down list displays all of the areas configu red and en abled on your p[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 363 T o configure an OSPF interface 1. Assign the appropriate area to each interface by selecting the OSPF area that this interface participates in from the Area drop-down lis t for the interface, then click Apply . The OSPF interface configur ation parameters are displayed sh owing the default se[...]

9 364 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 2. (Optional) Change any con figuration parame ters for the interface , then cl ic k Apply . Note The hello interval, d ead interval, and authent ication method must be the same for all routers on the link. 3. T o make your changes permanent, clic k Save. Configuring OSPF Example This exampl[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 365 5. In the Add New OSPF Area text box, enter 1 ; then click Apply . 6. In the Add new ad dress rang e: p ref ix text box for th e backbon e area, enter 192.16 8.24.0. 7. In the Mask Length text box, enter 24 ; then click Apply . 8. Click 1 area in the drop-down list for e2 ; then click Apply . [...]

9 366 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Authentication RIP 2 packets also can contain one of two types of authentication methods that can be used to verify the validity of th e supplied routing data. The first method is a simple pass word in which an auth entication key of up to 16 characters is included in the packet. If this pas[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 367 Note Nokia also provides support for BGP , OSPF , and PIM, both Sp arse-Mode an d Dense-Mode, to advertise the virtual IP address of th e VRRP virtual router , beginning with IPSO 3.8. Note Y ou must use Monitored Ci rcuit mode when conf iguring virtual IP supp ort for any dynamic routing prot[...]

9 368 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 5. (Optional) Enter a new cost in the Metric te xt box for each interface; then click Apply . 6. (Optional) T o configure the interface to not a ccept upda tes, click on the on radio button in the Accept updates fiel d; then click Apply . 7. (Optional) If you want to co nfigure the interface[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 369 Note By default, t he update int erval is set to 3 0 seconds and the expir e interval is s et to 180 seconds. 1. Click RIP under Configuration > Routin g Co nfig uration in the tree view . 2. T o modify the update interval, enter the new upda te interval in the Update Interval text box; the[...]

9 370 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Enabling RIP 2 on an Interface RIP 2 implements new capabilities to RIP 1: authentication—simple and MD5—and the ability to explicitly specify the network mask for e ach network in a packet. Because of these new capabilities, Nokia recommends RIP 2 over RIP 1. 1. First configure the inte[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 371 For Sparse-Mode PIM, see Protoc ol-Independen t Multicast —Sparse Mod e (PIM-SM) : Protocol Specification (Revised). Configuring V irtual IP Support for VRRP The virtual IP option lets you configure either a PIM sparse-mode or PIM dense-mode interface to advertise the VRRP virtual IP address[...]

9 372 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note The generation ID included in all PIM hello messages does not change whe n IP clustering is used, regard le ss of wh et he r an d ho w ma n y time s PIM is re-e na b led . W hen IP cluste rin g is implemented, the gener ation ID is ba sed on the clu ster IP add ress so that all members [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 373 designated router , it does not generated such a join message, but it pro pagates these join messages when sent by anothe r router . Configuring Check Point VPN-1 Pro/Express T o configure Check Point VPN-1 Pro/Express with IP clustering and either PIM-SM or PIM- DM, make sure you: 1. Use Chec[...]

9 374 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 4. (Optional) T o configure this interface to use the VRRP virtual IP address, in the V irtua l address field, click On. Note Y ou must use Monitored Ci rcuit mode when configuring virtual IP supp ort for dense- mode PIM. Do not use V RRPv 2 when conf ig uring virtual IP support for dense-mo[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 375 3. Click Apply; then click Save to make your change permanent. Setting Advanced Options for Dense-Mode PIM (Optional) 1. Click PIM under Configuration > Routin g Configuration in the tree view . 2. In the Interfaces section, click On fo r each interface on which to run PIM. Note The number [...]

9 376 Nokia Network Voyager for IPSO 4.0 Refe rence Guide The value represents the number of times per se cond at which the designated router sends assert messages. The upper limit is 10,000 assert messages per sec ond. 11 . In the General T i mers section, e nter a value (in seconds ) fo r the interval between sending join or prune messages in the[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 377 6. (Optional) T o configure this interface to use the VRRP virtual IP address, in the V irtua l address field, click On. Note Y ou must use Monitored Circ uit mode when co nfiguring virtual IP support for sp arse- mode PIM. Do not use VRRPv2 when configuring virtua l IP supp ort for sparse-mod[...]

9 378 Nokia Network Voyager for IPSO 4.0 Refe rence Guide all PIM-enabled interfaces become unavailable an d remain in that state until all interfaces are back up. Beginning with IPSO 3.8, yo u can configure either a PIM-SM or a PIM-DM interface to advertise the VRRP virtual IP ad dress if the router transitions to become VRRP master after a failov[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 379 Note T o verify whether a PIM neighbor supp orts DR Election Priority , use the following command, which you can executed from iclid and CLI: show pim neighbor <ip_address> For neighbor s that advertise a DR election priority value, the following message appears in the summary: DRPriorit[...]

9 380 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 7. In the Sparse Mode Rendezvou s Point (RP) Configuration section, to enable this router as a Candidate Rendezvous Point: a. Click On in the Candidate RP Router field. b. (Optional) Enter the local address of the Cand idate Rendezvous Point router in the Local Address field. This router sen[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 381 Note S tatic Rendezvous Point configuration over rides rendezvous point (RP) infor mation received from other RP-dissemination mechanisms, such as boot strap routers. 7. Enter the IP address of the router to config ure as the static rendezvous point in the RP Address text box. Click Ap ply . 8[...]

9 382 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 9. In the Sparse Mode T imers sec tion, enter a value for the shortest path tree threshold (in kilobits per second) in the Threshold (kpbs) text box. Enter an IP address for the multicast group to which the SP T threshold applies in the Multicast Group ID text box. En ter the mask length for[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 383 Note Assert rank values must be the same fo r all routers on a multiaccess LAN that are running the same protocol. 19. Click Apply . 20. (Optional) The checksum of the PIM register messages is calculated without including the multicast payload. Earlier releases of the Cisco IOS calculate the c[...]

9 384 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o log information about errors and event s. 1. Click Routing Options under Config uration > Routing Configuration in the tree view . 2. In the T race Options section, click on the Ad d Option drop-down window in the PIM field. Select each option for which you wa nt to log information. Y[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 385  Graft —T races graft and graft acknowledgment packets IGRP The Inter-Gateway Routing Pr otocol ( IGRP ) is a widely us ed interior gateway protocol (IGP). Like RIP , IGRP is an implementation of a distan ce-vector , o r Bellman-Ford, routing prot ocol for local networks. As spec ified, I[...]

9 386 Nokia Network Voyager for IPSO 4.0 Refe rence Guide  Request pack et  Update packet IGRP dynamically builds its routing table from in formation received in IGRP update messages. On startup, IGRP issues a request on all IGRP-e nabled interfaces. If a sy stem is configured to supply IGRP , it hears the request and responds w ith an update[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 387  V alid Neighbors— packets that have a source address from a non-local network are ignored. Y ou cannot disable thi s behavior .  Duplicate Entries in an Update— if an update mes sage contains duplicate new paths, holddowns are enabled, and if each of the duplicate composite metrics [...]

9 388 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Aliased Interfaces When an interface has multiple addresses config ured, e ach address is treated as a distinct interface since it represents a logical subnet. Such a configuration implies that an update is sent for each IGRP-configured address . In the configuration syntax, you can specify [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 389 8. (Optional) In the Protocol section, enter a new delay multiplier in th e K2 (delay multiplier) text box; then click Apply . K2 is used to globally influence delay over bandwidth. 9. (Optional) In the Proto col section, click No in the Holddo wn field; then click Apply . This action disables[...]

9 390 Nokia Network Voyager for IPSO 4.0 Refe rence Guide The load metric is a fraction of 255. 8. (Required) Enter the MTU metric in the metric text box for each inte rfa ce; then click Apply . A lar ger MTU reduces th e IGRP cost. 9. Click on for eth-s1p1 c0; then click Apply . DVMRP The Distance V ector Multicast Routing Protocol (DVMRP) is a di[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 391  Monitoring template  T racks the number of subordinate routers per route. Using Network V oyager , you can config ure the following options:  DVMRP interfaces  New minimum time to live (TTL) threshold for each interface  New cost metric for sending mul ticast packets for ea ch [...]

9 392 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 6. (Optional) Enter a value betwee n 20 and 4000 in t he Route expiration time text box to set the interval, in seconds, after wh ich a route that has not been re freshed is placed in the route hold-down queue. The default is 140 seconds. 7. (Optional) Enter a value between 0 and 8000 in the[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 393 implemented within IP SRD conforms to the traceroute facility for IP multicast draft specification. The IPSO implementation of IGMP supports the following features.  Complete IGMPv2 functionality  Multicast traceroute  Complete configurability of protocol timers  Administratively-b[...]

9 394 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note A router configured for IGMP ver s ion 2 can in te rope rate with host s running either IGMP version 1 or version 2. Nokia recommends that you use version 1 only on networks tha t include multicast routers that ar e not upgraded to IGMP version 2. 6. (Optional) Enter the loss robustness[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 395  Normal —A normal static route is one used to fo rward packets for a given destination in the direction indicated by the configured router .  Black hole —A black hole static route is a route that uses the loopback address as the next hop. This rout e discards packets that match the r[...]

9 396 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 4. Click Apply , and then click Save to make your chan ges permanent. T o add and configure many st atic routes at the same time 1. Click Static Routes under Configuration > Routing Configuration in the tree view . 2. In the Quick-add static routes field, click the Quick-add next hop type[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 397 Adding and Managing S t atic Routes Example The figure below shows the networ k configuration for the example. In this example, Nokia Platform A is connected to the Internet, with no routing occurring on the interface connected to the Internet (no OSPF or BGP). A corporate W AN is between Noki[...]

9 398 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 3. In the Mask Length text box enter 24. 4. In the Gateway text box enter 192.168 .26.70. 5. Click Apply . If you have configured OSPF o r RIP on your remote office network, you n ow have connectivity to the Internet. T o disable a st atic route 1. Click Static Routes under Configuration >[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 399 advertises. The aggregates are activate d by cont ributing routes. For e xample, if a router has many interface routes subnetted from a class C an d is running RIP 2 on another interface, the interface routes can be used to create an aggr egate route (of the class C) that can then be redistrib[...]

9 400 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Route Aggregation Example The figure below shows the n etwor k configuration for the example. In the preceding figure Nokia Platform B, Noki a Platform C, and Nokia Platform D are running OSPF with the backbone area. Nokia Platform A is running OSPF on one interface and RIP 1 on the backbone[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 401 Note If the backbone is running OSPF as well, yo u can enable aggregation only by co nfigu ring the 192.168.24.0 network in a d ifferent OSPF Are a. Route Rank The r oute rank is the value that the ro uting subsystem uses to o rder routes from different protocols to the same destination. Y ou [...]

9 402 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o set route rank 1. Click Routing Options under Config uration > Routing Configuration in the tree view . 2. Enter the route rank for each proto col; then click Apply . These numbers do not generally need to be changed from their defau lts. Be careful when you modify these numbers; stra[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 403 T o configure the routing preferences 1. Click Routing Options under Configuration > Routing Conf iguration in the tree view . 2. Enter 10 in the OSPF edit box. 3. Enter 40 in the RIP edit box; then click Apply . This configuration makes the OSPF rou te the preferred route. T o make the RIP[...]

9 404 Nokia Network Voyager for IPSO 4.0 Refe rence Guide  IPv4 unicast and IPv6 unicast For peering to be established, th e routers must share a capability . If your system is exchanging IPv4 routes over IP v6 or vice versa, use route map commands to set nexthop to match the family o f the routes bein g exchange d. If they do not m atch, the ro[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 405 loops in an arbitrary topology . Y ou can also us e path attributes to determine administrative preferences. BGP collapses routes with similar path attributes into a single update for advertise ment. Routes that are received in a single update are readve r tised in a single update . The churn [...]

9 406 Nokia Network Voyager for IPSO 4.0 Refe rence Guide attachment or made a policy decisio n to prefer another route to a networ k destination. Route withdrawals are sent when a router makes a new local decision that a network is no longer reachable. BGP Multi-Exit Discriminator Multi-exit Discriminator (MED) values are used to help ext ernal ne[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 407 Inbound BGP Route Filters BGP routes can be filtered, or redistributed by AS number or AS path regular expression, or both. BGP stores rejected routes in the routing table w ith a negative pref erence. A negative preference prevents a route from becomin g active and prevents it from being inst[...]

9 408 Nokia Network Voyager for IPSO 4.0 Refe rence Guide distributed to other neighbors. The following ta ble displays some spec ial community attributes that a BGP speaker ca n apply . For further details, refer to the commun ities documents, RFCs 1997 and 1998. Route Reflection Generally , all border routers in a single AS need to be internal pe[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 409 No special configuration is requir ed on the route reflection clients. From a client perspective, a route reflector is a normal IBGP peer . Any BG P version 4 speaker should be able to be a reflector client. for further details, refer to the route reflection specification document (RFC 2796 as[...]

9 410 Nokia Network Voyager for IPSO 4.0 Refe rence Guide For further details, refer to the confederations specification do cument (RFC 1965 as of this writing). AS1 has seven BGP-speaking routers grouped unde r different routing domains: RDI A, RDI B, and RDI C. Instead of having a full-mesh connection among all seven routers, you can have a full-[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 411 Caution Enabling multihop BGP connections is dangerous because BGP speakers might establish a BGP co nnection through a third-p arty AS. This can violate policy considerations and introduce forward ing loops. Router A and Router B ar e connected by two parallel serial lin ks. T o provide fault[...]

9 412 Nokia Network Voyager for IPSO 4.0 Refe rence Guide The TCP MD5 option allows BGP to protect its elf against the intro duction of spoofed TCP segments into the connection stream. T o spoo f a connection using MD5 signed sessions, the attacker not only has to guess TCP sequence numb ers, but also the passw ord included in the MD5 digest. Note [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 413 6. For the specific external or ro uting group, enter an IP address in the Local address text box. Note Y ou must configure a local IP address for the sp ecific external or routing grou p for virtual IP for VRRP support to function. 7. Click On in the V irtua l Address field to enable virtual [...]

9 414 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Memory Size  Base IPSRD is approximately 2 MB  Route entry in the local route table is 76 bytes  Inbound route entry in the BGP table is 20 bytes  Outbound route entry in the BGP table is 24 bytes T o calculate the amount of memory overhead on the routing daemon because of BGP pe[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 415 Note Make sure th at IPSRD is not swapping mem ory . Look at t he memory size s occupied by user-level daem on s like Ch ec k Poin t, ifm , xpand , et c. T o find out how much memory IPSRD occupies, run t he following command: ps -auxww | grep ipsrd The fourth column labeled, %M EM, displays t[...]

9 416 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 8. Enter 10.50.10.2 in the Add remote peer IP address edit box; then click Apply . 9. Configure an inbound route f ilter for AS 100 according to “BGP Route Inboun d Policy Example” on page 446 T o configure IBGP on Nokia Platform B 1. Configure the interface as in “Con figuring an Ethe[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 417 11 . Enter 10.50.10.1 in the Add remote peer IP address text box 12. Click Apply . T o configure Nokia Platform A as an IBGP peer to Nokia Platform C 1. Click Config on the home page. 2. Click the BGP link in the Ro uting Configuration section. 3. Enter 170.20.1.1 in the Add remote peer IP add[...]

9 418 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 6. Click External in the Peer g roup type drop -down window; then click Apply . 7. Enter 129.10.21.1 in the Add remote peer IP a ddress text box; then click Apply . 8. Configure route inboun d p olicy according to “BGP Route Inbound Policy Example.” 9. Configure route redistribu tion pol[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 419 3. Follow the steps described in the “T o configure route inbou nd po licy on Nokia Platform D based on an autonomous system number” example. 4. Enter the community ID or the name of one of the spec ial a ttributes in the Community ID/ Special community text box, then click Apply . 5. Clic[...]

9 420 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o configure MED V alues for all peers of AS200 1. Click BGP under Configuration > Routi ng Configuration in the tree view . 2. Configure EBGP peers in AS10 0 and AS200 according to the “BGP Neighbors Example.” 3. Click Advanced BGP Options link on the main BGP page. This action take[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 421 5. Enter 100 in MED edit bo x next to the Enable redistri bute bgp routes to AS100 field. 6. Enter necessary information for rout e redistribution according to the “BGP Multi Exit Discriminato r Example” ; then click Apply . 7. Click Save to make your changes permanent. Setting an MED valu[...]

9 422 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o configure an IBGP peer for Nokia Platform B 1. Enter 100 in the Peer Autonomous Syst em Number text box. 2. Click Internal in the Peer Group ty pe drop-down list; then click Apply . 3. Enter 20.10.10.2 in the Add Remote Peer IP Address text box; then click Apply . T o set the local prefe[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 423 BGP Confederation Example In the above diagram, all the routers belong t o the same Confederation 65525. No kia platform A and Nokia platform B belong to routing domain ID 6552 7, Nokia platform C an d Nokia platform D belong to routing do main ID 65528, and Nokia pl atform E belongs to routin[...]

9 424 Nokia Network Voyager for IPSO 4.0 Refe rence Guide f. Click On in the All Interfaces field; then click Apply . g. Enter 192.168.40.1 in the Add a new peer text bo x; then click Apply . 3. Create confederation group 6552 8. a. Click BGP under Configuration > Routi ng Configuration i n the tree view . b. Enter 65528 in the Peer Autonomous S[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 425 2. Create confederation group 6552 4. a. Click BGP under Configuration > Routi ng Configuration i n the tree view . b. Click the Advanced BGP Options link. c. Enter 65524 in the Peer Autono mous System Number text bo x. d. Click Confederation in the Peer Group T ype drop-down list; then cli[...]

9 426 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Route Reflector Example This example shows configuration for setting up route reflection for BGP . Route reflection is used with IBGP speaking routers that are not fully meshed. In the above diagram, route r Nokia platform A is on AS 65525, and ro ute rs Nokia platform B, Nokia platform C, a[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 427 d. Select Internal in the Peer group type drop-down list; then click Apply . 5. Configure parameters for the group. a. Click BGP under Configuration > Routi ng Configuration i n the tree view . b. Click Advanced BGP Options. c. Click On in the All field. This option covers all IGP and stati[...]

9 428 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 4. Enter 65526 in the Peer Autonomous System Number text box. 5. Click Internal in the Peer Group T y pe drop-down list; then click Apply . 6. Enter 192.168.30.1 in the Add remote peer IP address text box; then click Apply . 7. Click Save to make your changes pe rmanent. Configuring BGP Rout[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 429 Communities are used to simplify the BGP inbound and route redi stribution policies. Each community is identified by either an ID or one of the following special community names: no export, no advertise, no subconfed , or none. Note Specify the community ID and the AS number in order to genera[...]

9 430 Nokia Network Voyager for IPSO 4.0 Refe rence Guide EBGP Load Balancing Example: Scenario #1 Loopback interfaces are used to configure load balancing for EB GP between two ASes over two parallel links. This example consists of the following:  Enabling BGP function  Configuring loopback addresses  Adding static routes  Configuring [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 431 4. Enter 129.10.2.2 in the Additional Gateway ed it box; then click Apply . 5. Enter 129.10.1.2 in the Additional Gateway edit box; then click Apply . Configuring a S t atic Ro ute on Platform B 1. Click Static Routes under Configur ation > Routing in the tree view . 2. Enter 1.2.3.4 in the[...]

9 432 Nokia Network Voyager for IPSO 4.0 Refe rence Guide EBGP Load Balancing Example: Scenario #2 Configuring a Loopback Address on Platform A 1. Configure the interface as in “Ethernet Interfaces.” 2. Click Interfaces under Configuration > Inte rface Configuration in the tree view . 3. Click the Logical Address Loopback link. 4. Enter 1.2.[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 433 5. In the Nexthop field, click on next to EBGP Multihop to enable th e multihop option; then click Apply . 6. (Optional) Enter a value in the TTL text box to set the number of ho ps over which the EBGP multihop session is established. The default value is 64 and th e range is 1 to 255. Click A[...]

9 434 Nokia Network Voyager for IPSO 4.0 Refe rence Guide The default value is 60 sec onds. 5. T o make your changes permanent, clic k Save. TCP MD5 Authentication Example Configuring TCP MD5 Authentica tion on Nokia Platform A 1. Configure the interface as in “Ethernet Interfaces.” 2. Click BGP under Configuration > Routing in the tree view[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 435 6. Click External in the Peer group t ype drop-down list; then click Apply . The following steps co nfig ure an EB GP peer with MD5 authentication 7. Enter 10.10.10.1 in the Ad d remote peer ip address text box; t hen click Apply . 8. Click the 10.10.10.1 link to access the BGP peer configurat[...]

9 436 Nokia Network Voyager for IPSO 4.0 Refe rence Guide V erification T o verify that yo u h ave configured route da mpening correctly , run the following command in iclid.: s how route bgp suppressed For more information on this command, see “V iewing Routing Protocol Information.” BGP Path Selection The following rules will help you underst[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 437 T o configure configure a BGP4 session over IPv6 transport 1. Determine whether Route r 1 and Router 2 are directly conn ected. a. If Router 1 and Router 2 are directly connected, use IPv6 addresses of the interface through which they are connected. If they are directly connected, you can use [...]

9 438 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 4. On Router 1, use this route map by executing the following CLI comman d to send both IPv4 and IPv6 unicast route s to AS 2. set bgp external remote-as 2 export- routemap advertise_to_as2 preference 1 family inet-and -inet6 Note The actual routes sent w ill be based on the match cond ition[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 439  Refines —Matches a route only if it is more specific than the given prefix.  Range —Matches any route whose IP address equals the given prefix’ s IP address and whose mask length falls within the specified mask length range. A sample route re distribu tion examples follow . Note T[...]

9 440 Nokia Network Voyager for IPSO 4.0 Refe rence Guide BGP Route Redistribution Example Route redistribu tion allows you to redistribute routes from one autonomous system into anot her autonomous system. T o configure BGP route redistribution on Nokia Platform D 1. Click Route Redistribution und er Configuration > Routing in the tree view . 2[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 441  Protocol  Interface  Gateway If more than one parameter is specified, they are processed from most genera l (protocol) to most specific (gateway). It is not possible to set metrics for redistributin g RIP routes into RIP or for redistributing IGRP routes into IGRP . Attempts to do th[...]

9 442 Nokia Network Voyager for IPSO 4.0 Refe rence Guide categorized as a stub network, mea ning that a particular subne t does not send RIP routing updates. T o redistribute routes from the corporate RIP network to the Nokia OSPF network through Nokia Platform A Note Make sure th at the Corporate net RIP router is advertising RIP on the interface[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 443 5. T o prevent 192.168.22.0/24 an d other more specific routes from being redistribut ed into OSPF External, define a route filter to restrict only this route as follows: a. T o configure this filter , enter 192.168.22.0 in the New IP prefix to redistribute text box, and 24 in Mask lengt h tex[...]

9 444 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Nokia Platform E of AS 100 and Noki a Platform A of AS 4 are participating in an EBGP session. Nokia Platform F of AS 200 and Nokia Plat form D of AS 4 are also participating in an EBGP session. T o redistribute OSPF to BGP through Nokia Platform A 1. Click Route Redistribution und er Config[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 445 Inbound Route Filters Inbound route filters allow a network administrato r to restrict or constrain the set of routes accepted by a given routing protocol. The filters let an operator include or exclude ranges of prefixes from the routes that ar e accepted into RIP , IGRP , OS PF and BGP . The[...]

9 446 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 5. Enter the appropriate IP addre ss and mask length in the Ne w Route to Fil ter and Mask Length fields; then click Apply . A new set of fields is displayed adjacent to the newly entered IP address and mask length. 6. Click On or Of f to enable or disable filtering of this route. 7. From th[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 447 Note By default, all routes originating from the configur es ASes are accepted. Y ou can accept or reject all routes from a particul a r AS by enabling the accept or restrict option next to the All BGP routes from AS field. 1. Y ou also can accept or reject particular routes from AS 100 by spe[...]

9 448 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 7. T o configure this filter , enter 10.0.0.0 in New IP prefix to impo rt edit box, and 8 in Mask length edit box; then click Apply . 8. Select Refines in the Match type drop-down list. This specifies routes that are stric tly more specific than 10.0.0.0/8. 9. Finally , click Restrict in the[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide 449 10 Configuring T raf fic Management This chapter describes traffic management fu nctionality , including a ccess control lists and aggregation classes. T raffic Management Overview T raf fic management functionality allows packet st reams to be filtered, sh aped, or prioritized. The prioritizat[...]

10 450 Nokia Network Voyager for IPSO 4.0 Refe rence Guide by adding delay to packe ts th at must wait for more tokens to arrive in th e bucket. When more bursts arrive than can b e accommodate d by the shap ing queue, then that traf fic is drop ped. Both outgoing and inc oming traf fic streams can be shaped. T o configure a shaper , see “Configu[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 451 T o create or delete an ACL 1. Depending on whether you are usin g IPv4 or IPv6, click the following link. a. For IPv4 ACLs, click Access List unde r Conf iguration > T raf fic Management in the tree view . b. For IPv6 ACLs, click IPv6 Access List under Configuration > IPv6 Configuration[...]

10 452 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 4. T o remove an ACL from an interface: a. Select Delete for the appropriate inte rface in the Selected Interfaces table b. Click Apply . The interface disappears from th e Selected Interfaces section. 5. T o make your changes pe rmanent, clic k Save. Configuring ACL Rules An Access Control[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 453 Note The DSfield and QueueSpec field are used to mar k and select the priority level. Masks can be applied to most of these prop erties to allow wildca rding. The so urce and destination po rt properties can be edite d only when the IP protocol is UDP , TCP , or th e keyword "any ." [...]

10 454 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T able 27 ACL Rule Attributes Attribute Description Action A rule action can be one of the following six actions: • Accept—Forward this traffic stream. • Drop—Silently drop all traffic belonging to this stream. • Reject—Drop all traffic in this stream and atte mpt to deliver an [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 455 Configuring Aggregation Classes An Aggregation Class (AGC) is used to determ ine whether the traffic stream meets certain throughput goals. T raffic that meets these goals is conformant; traf fic that does not meet these goals is non-conformant. Depending on the config uration of the classifie[...]

10 456 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o create an Aggregation Class 1. Depending on whether you are usin g IPv4 or IPv6, click the following link. a. For IPv4 ACLs, click Aggregation Class unde r Configuration > Traf fic Management in the tree view . b. For IPv6 ACLs, click IPv6 Aggreg ation Class under Configuration > [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 457 Note A rule treats traffic as if it were configur ed for "skip, " if the traffic matches a rule whos e action has been set to "prioritize" or "sh ape " and no Aggregation Class is configured. 6. Click Apply . 7. Click Save to make your changes permanent. Configuri[...]

10 458 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o create or delete a queue class 1. Depending on whether you are usin g IPv4 or IPv6, click the following link. a. For IPv4 ACLs, click Queue Class under Configuration > T raffic Management in the tree view . b. For IPv6 ACLs, click IPv6 Queue Class under Con figuration > IPv6 Confi[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 459 T o associate a queue class with an interface 1. Depending on whether you are usin g IPv4 or IPv6, click the following link. a. For IPv4 ACLs, click Queue Class under Co nfiguration > T raffic Management in the tree view . b. For IPv6 ACLs, click IPv6 Queue Class under Configuration > IP[...]

10 460 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note The default A TM QoS Descriptor is set to unspecified bit rate (UBR) and can not be modified. 3. Enter a value for the maximum ce ll rate to be used in the output direction on a CBR channel in the Peak Cell Rate edit box. The Peak Cell Rate is rounde d down to a multiple of 64 k ilobit[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 461 6. Click the A T M QoS Descriptors link. 7. In the Existing A TM QoS Descriptors field, clic k the Delete check box next to the name of the A TM QoS Descriptor that you want to delete. 8. Click Apply . The A TM QoS Descriptor disappears from the Existing QoS Descriptors field. 9. Click Save to[...]

10 462 Nokia Network Voyager for IPSO 4.0 Refe rence Guide (Policy Enforcement Points). Th e PDPs are network-based servers that decide which types of traffic (such as voice or video) receive priority treatment. The PEPs are routers that implement the decisions made by the PDPs. In the Nokia im plementation, the Nokia platform functions as a PEP . [...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 463 4. In the Sequence Number edit box, enter a valu e between 1 and 21474 83647 to define the sequence number us ed for the COPS protocol. Click App l y . 5. In the Key ID field, enter a va lue between 1 and 214748364 7 in the Send edit box to define the send key ID used for the CO PS protocol. 6[...]

10 464 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Activating and Deactivating the COPS Client Y ou must activate the COPS client to impl ement the COPS module you configure. Y o u can deactivate the COPS client to ha lt the COPS module implementation. 1. Click COPS under Configuration > Tr af fic Management in the tree view . 2. Click t[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 465 4. In the COPS security configuration section, clic k the Delete check box next to the name of the client ID you want to delet e. 5. Click Apply . 6. Click Save to make your change permanent. Example: Rate Shaping The following example shows you ho w to limit ftp data traffic to 100 kilobits p[...]

10 466 Nokia Network Voyager for IPSO 4.0 Refe rence Guide 5. Click Apply . 6. Click Save to make your changes pe rmanent. Example: Expedited Forwarding This example illustrates the combined use of the Access Control List, T raffic Conditioning, and Queuing features. This example demonstrates how to improve the response time to T elnet sessions bet[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 467 Note The queue specifier associated with expe dited forwarding queu e is 6. 4. Associate the wan_1_ef queue clas s with the appropriate interface. a. Click Interfaces under Configuration > Inte rface Configuration in the tree view . b. Click on ser -s3p1 in the Physical column . c. In the Q[...]

10 468 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note 0xB8 is the IETF dif ferentiated-services codepoint (in hexadecimal) for exped i ted forwarding tr affic. m. Click Apply , and then click Save to make your chan ges permanent. T o test the configuration 1. Start a telnet session between the client and server . 2. Check the statistics o[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide 469 11 Configuring Router Services This chapter describes how to enable your system to forward broadcast traf fic by enabling the IP Broadcast Helper , forward BOOTP/DHCP traf fic by enabling BOOTP relay , how to enable router discovery , and how to config ure for Network T ime Protocol (NTP). A No[...]

11 470 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Configuring BOOTP/DHCP Relay Y ou can use Network V oyager to enable B OOTP Relay on each interface. If the interface is enabled for relay , you can set up a number of serve rs to which to forward BOOTP reques ts. Enter a new IP address in the New Server text bo x for each server . T o dele[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 471 T o disable BOOTP relay on an interface 1. Click BOOTP Relay under Configuration > Router Services in the tree view . 2. Select Off for the interface on which you want to disable BOOTP . 3. Click Apply to disable the interface. When you cli ck off, th en apply , the BOOTP relay parameters ([...]

11 472 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o configure the relaying of broadcast UDP packets on your system, use the following procedure. T o configure IP broadcast helper 1. Click IP Broadcast Helper under Configura tion > Route r Services in the tree view . 2. Click On for each interface to support IP Helper services. 3. Clic[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 473 Note Only the server portion of the Router Discove ry Protocol is supported. IPSO implements only the ICMP router discovery server portio n, which means that a Nokia router can advertise itself as a candidate default ro uter , but it will not adopt a default router using the router discovery p[...]

11 474 Nokia Network Voyager for IPSO 4.0 Refe rence Guide T o configure the router discovery services on your system, use th e following proced ure . T o enable router discovery services 1. Click Router Discovery under Configuration > Router Services in the tree view . 2. Select On for each interface to support router discovery service. 3. Clic[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 475  Advertisement Lifetime 5. (Optional) For each IP ad dress on the interfa ce, you can specify the following parameters, described in Ta b l e 3 0 .  Advertise Address  Preference 6. Click Apply . 7. Click Save to make your changes permanent. T o disable router discovery services 1. Cl[...]

11 476 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Configuring NTP Y ou can enable or disable NTP on your syst em; when NTP is active the local clock is synchronized as configured and hosts will be able to set th eir time through this machine. T o set the time manually , see “Setting the System T ime” on page 158. T o configure NTP 1. C[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 477 10. (Optional) Enable the NTP reference clock by clicking Y es in the NTP Master field. Note Only enable the NTP reference clock if you cannot r each an NTP server . 11 . Click Apply . The Stratum and Clock source fields appear . By default, the Stratum value is 1, and the Clock source is set [...]

11 478 Nokia Network Voyager for IPSO 4.0 Refe rence Guide[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide 479 12 Monitoring System Configuration and Hardware This chapter provides informatio n o n monitoring your system.Y ou can use Network V oyager to monitor many aspects of your IP security platfo rm in order to better maintain performance and security . Y ou can, for example, monitor state inform at[...]

12 480 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Disk and Swap Sp ace The Disk and Swap Space Utilization page shows sy stem resources use, in cluding disk and swap space use. This page retrieves the updated disk and swap space us e every 20 seconds. For each file system, you can monitor the number of kilobytes used and available, the per[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 481 IPSO Process Management When you are troubleshoo ting any system, it is helpful to have an unde rstanding of the daemons, or system processes, that are operating in the background. The process monitor (PM) monitors critical No kia IPSO processes. The PM is responsible for:  Starting and sto[...]

12 482 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Generating Monitor Report s Y ou can generate reports of data collection even ts. T o generate a report , click the link for the appropriate report un de r Monitor > Reports in the tree view . For information on configuring mo nito r reports, see “Configuring Monitor Reports” on page[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 483 T o display reports 1. Click the name of the report un der Monitor > Reports in the tree view . 2. Under Select Report T ype, select one of the following:  Hourly —Hourly report with a 1-hour di splay up to a maximum of 7 interval day data.  Daily —Daily report with 1-da y display[...]

12 484 Nokia Network Voyager for IPSO 4.0 Refe rence Guide  Real Memory Used—The percentage of the real memory being used.  Disk Capacity—The percentage of the disk space being used.  Interface T raffic S tatistics —For each physical and logical interface, shows the current state, input and output bytes, input and output errors . For[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 485  W eb Server Access Log —Shows information about acces ses to the Network V oyager interface using HTTP or HTTPS. Messages incl ude IP Address from which the local host did an http access to the system, user , da te, time, and HTTP acces s command.  W eb Server Error Log —Shows error[...]

12 486 Nokia Network Voyager for IPSO 4.0 Refe rence Guide  Time Since Join —T ime since node joined the cluster .  W ork Assigned (%) —Percent age of work load assigned to this node. Note If your cluster is not initialized, the Cluster Monitor page cont ains a link to the Cluster Configuration pag e, which enables you to configure cluste[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 487 For IPv6, click IPv6 Route Monitor under Monitor > IPv6 Monitor . Displaying Interface Settings T o view the interface settings for your system, click Route under Monitor > Routing Protocols in the tree view . Hardware Monitoring Y ou can use Netwo rk V oyager to mo nitor the following h[...]

12 488 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Using the iclid T ool Obtain routing diagnostic inform ation by creating a telnet session on the IP security platform and running iclid (IPSRD command-line interface daemon). T o display routing daemon st atus using iclid 1. Create a T elnet session and log into the firewall. 2. T ype iclid[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 489 bgp Provides a BGP summary . errors A table of BGP errors. groups A table of p arameters and data for each BGP group. detailed Det ailed statistics on BGP groups. summary A summary of st atistics on BGP groups. memory Lists BGP memory p a rameters and statistics. neighbor <peerid> advert[...]

12 490 Nokia Network Voyager for IPSO 4.0 Refe rence Guide rep Sum mary of BOOTP relay replies made. Element Category S ubcategor y Description dvmrp Summary of DVMRP state. interface Interface-spe cific state of DVMRP for each DVMRP-enabled interface. neighbor routes S tate of DVMRP neighbor route. neighbors Interface state of DVMRP neighbor pa ra[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 491 Element Category Subcategory De scription memory T otal memory usage in kilobytes. detailed T o tal memory use as well as memory use by each routin g protocol. Element Category Subcategory De scription ospf border routers L ists OSPF border routers and associated codes. database area Provides [...]

12 492 Nokia Network Voyager for IPSO 4.0 Refe rence Guide stats A comprehensive list of OSPF interface statistics. neighbor Lists OSPF neighbors and associated parameters. packet s Lists received and tr ansmitted OSPF packet s. Element Category S ubcategor y Description <proto> inbo und filter Lists inbound filter data for the specified prot[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 493 igrp Data on IGRP routes. ospf Data on OSPF routes. rip Dat a on RIP routes. static Data on static routes. bgp S tatistics on BGP routes. aspath List of parameters and st atus of BGP AS path. communities S tatus of BGP communities. detailed Det ails of BGP routes. metrics S tatus of BGP metric[...]

12 494 Nokia Network Voyager for IPSO 4.0 Refe rence Guide The following table shows examples of the iclid show command. Preventing Full Log Buffers and Related Console Messages When a significant amount of your traffi c is us ing fast path for delay-critical, real-time routing through the firewall, the console might di splay one of the following e[...]

Nokia Network Voyager for IPSO 4.0 Reference G uide 495 Note T o perform the following proced ures, use the zap or modzap utility . Y ou can obtain these utilities from the Nokia T echnical Assistance Center (T AC)—refer to Resolution 1261. If you are using FireW all-1 4.1 1. Set the execute permissions by issuing an fwstop command. 2. T o confir[...]

12 496 Nokia Network Voyager for IPSO 4.0 Refe rence Guide Note If the message indicates th at you have insuf f icient resources to accommodate a larger buffer size, take appro priate ac tions and try t his proced ure again. F or further information, cont act Nokia T echnical Assist ance Center (T AC). 4. After you verify that the change is appr op[...]

Nokia Network Voyager for IPSO 4.0 Refere nce Guide Ind ex - 497 Index A AAA account profile 316 authentication profile 314 configuring new se rvice 313 service module entry 314 service profile 314 session profile 317 ABR (area border ro uter ) 355 Accept Connections to VRRP IPs option 191 access control list (ACL) 452 access co ntrol list s 449 ad[...]

Index - 49 8 Nok ia Networ k Voyage r for IPSO 4.0 Reference Guide backup files default contents 169 manually creating 169 restoring from loca l 172 transferrin g 170 backup state, VRRP 202 backups cancelling scheduled 170 scheduling 170 bandwidth utilization 482 Bellman Ford algorithm 352 Bellman-Ford algorith m 385 best effort queue level 457 BGP[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide Index - 499 overview 207 PIM 214 static routes 214 three node example 243 transparent mod e 132, 215 upgrading images 217 clusters activating 229 adding nodes 229 administrator 210 administrators 233 configuring 220 configuring interfaces 222 configuring NTP 240 creating 220 deleting configurations[...]

Index - 50 0 Nok ia Networ k Voyage r for IPSO 4.0 Reference Guide daytime service 298 DDNS 153 DDR lists 58 applying to interface 60 rules 60 default route configuring 395 deleting IP address, VRRP considerations 193 dense mode described 370 in clusters 371 DES authentication 264 DHCP 469 address ranges 149 configuring 145 configuring client inter[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide Index - 501 fan sensors, monitoring 487 FDDI changing dupl ex setting 50 changing IP add ress 50 FIN bits 349 firewall monitoring configuring in cluster 223 firewall policies VRRP 204 firewall state, monitoring fo r VRRP 203 FireWall-1 23 Forward button 26 forwarding broadcast traffic 469 forwardin[...]

Index - 50 2 Nok ia Networ k Voyage r for IPSO 4.0 Reference Guide tunneling over SSH 311 HTTP daemon error message log 304 HTTPD error log file 485 process 481 I IANAifType MIB 250 ICLID description 351 iclid commands 488 displaying status 488 help 488 ICMP router discovery protocol 472 ICMPv6 router di scove ry 275 IF MIB 250 ifLinkUpDown trap 25[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide Index - 503 IP pools 224 IP source routing 304 IP spoofing 304 IP2250 clustering guidelines 216 link aggregation 37, 201 management p orts 30 transparent mod e 132 with clustering 207 IPoA 79 IPSec transpor t mode 329 tunnel mode 329 IPSec tunnels overview 328 requirements 333 Ipsilon Routing Daemo[...]

Index - 50 4 Nok ia Networ k Voyage r for IPSO 4.0 Reference Guide overview 354 M MAC address VRRP 190 mail relay configuring 157 description 156 features 156 sending mail 158 management ports 30, 216 master state, VRRP 202 MD5 authentication 264 MED 406 memory viewing 28 memory cache, clearing 26 memory utilization report 482 configuring 177 menu [...]

Nokia Network Voyager for IPSO 4.0 Reference Guide Index - 505 not-so-stubby areas 354 NSSA configuration param eters 358 defined 354 NTP configuring 476 description 475 NTP MIB 252 on clusters 240 O OID registration MIB 250 Open Shortes t Path First (OSPF) configuring 109 opening Voyager 24 operating system (IPSO) 23 optional disks configuring log[...]

Index - 50 6 Nok ia Networ k Voyage r for IPSO 4.0 Reference Guide process monitor 481 Q queue class 449, 450 queue classes associating with interfaces 459 configuring 457 creating 458 queue mode 34 QueueSpec 452, 4 55 R RADIUS 319 RAID 154 rate shaping example 465 rate-shap e MI B 250 rate-shaping bandwidth report 482 configuring 177 RDI (routing [...]

Nokia Network Voyager for IPSO 4.0 Reference Guide Index - 507 viewing settings 486 routing configuring 351 configuring ranks 402 creating a defa ult route 395 DDR lists 58 default prot oc ol rank 401 disabling a static route 398 features 390 IGRP 388 OSPF 109, 356 routing daemon (iclid ) commands 488 displaying status 488 help 488 routing domain 4[...]

Index - 50 8 Nok ia Networ k Voyage r for IPSO 4.0 Reference Guide troubles hooting 304 viewing certificate and private key 304 states, virtu al router 201 static host deleting 160 static mode VMAC 190 static routes backup 398 description 394 disabling 398 example 397 in clusters 214 stub area defined 354 swap space utilization 479, 480 SYN bits 34[...]

Nokia Network Voyager for IPSO 4.0 Reference Guide Index - 509 UDP packets forwarding 471 UDP ports IP Broadc ast Helper 472 unit types MIB 250 unnumbered inte rfaces 107 OSPF 110 users adding 290 attributes of 289 default 288 default pr ivileges for new 293 group ID 289 home directory 289 ID 289 managing accounts of 288 name 289 removing 290 remov[...]

Index - 51 0 Nok ia Networ k Voyage r for IPSO 4.0 Reference Guide VSZ 480 VTI 140 W watchdog t imer 487 WCHAN (wait channel) 480 web servers access log 485 wheel group 292 X X.21 configuring for Cisco HDLC 83 configuring for frame relay 85 example 87 interfaces 83 xntpd proces s 4 8 1 xpand process 481[...]