AudioCodes Mediant MSBR Series User manual

Configuration Guide
AudioCodes Mediant™ Multi-Service Business Routers (MSBR) Series
Security Setup
Version 7.2

Configuration Guide Contents
Version 7.2 3 Security Setup
Table of Contents
1Introduction .........................................................................................................7
2Access Control List.............................................................................................9
2.1 Configuration Example .........................................................................................11
3ACLv6 .................................................................................................................13
3.1 Configuration Example .........................................................................................14
4Management Access Lists ...............................................................................17
4.1 Configuration Example .........................................................................................17
5NAT and NAPT...................................................................................................19
5.1 Configuration Examples .......................................................................................22
5.1.1 Configuring TCP and ICMP NAT............................................................................ 22
5.1.2 Configuring Port Forwarding................................................................................... 22
5.1.3 Configuring Load Balancing using NAT.................................................................. 23
6SPI Firewall ........................................................................................................25
6.1 Configuration Example .........................................................................................26
7IPSec Tunneling ................................................................................................29
7.1 Configuration Examples .......................................................................................31
7.1.1 Configuring IPSec................................................................................................... 31
7.1.2 Configuring IPSec with GRE .................................................................................. 35
7.1.3 Configuring IPSec with RSA................................................................................... 40
7.1.3.1 Importing Certificates .............................................................................. 40
7.1.4 Configuring IPSec with IKEv2................................................................................. 49
7.1.4.1 Configuration Example ............................................................................ 49
8L2TP VPN Server...............................................................................................55
8.1 Configuration Example .........................................................................................55
9802.1X.................................................................................................................63
9.1 Activating dot1x Authentication on Windows 7......................................................64
9.2 Configuring dot1x on Windows 7 ..........................................................................66
9.3 Example of Local Authentication Configuration.....................................................71
10 DNS Query Randomization...............................................................................73
10.1 Configuration Example .........................................................................................73

Mediant MSBRs 4 Document #: LTRT-31828
Security Setup
This page is intentionally left blank.

Configuration Guide Notices
Version 7.2 5 Security Setup
Notice
Information contained in this document is believed to be accurate and reliable at the time of
printing. However, due to ongoing product improvements and revisions, AudioCodes cannot
guarantee accuracy of printed material after the Date Published nor can it accept responsibility
for errors or omissions. Updates to this document can be downloaded from
https://www.audiocodes.com/library/technical-documents.
This document is subject to change without notice.
Date Published: November-12-2020
WEEE EU Directive
Pursuant to the WEEE EU Directive, electronic and electrical waste must not be disposed of
with unsorted waste. Please contact your local recycling authority for disposal of this product.
Customer Support
Customer technical support and services are provided by AudioCodes or by an authorized
AudioCodes Service Partner. For more information on how to buy technical support for
AudioCodes products and for contact information, please visit our website at
https://www.audiocodes.com/services-support/maintenance-and-support.
Stay in the Loop with AudioCodes
Abbreviations and Terminology
Each abbreviation, unless widely used, is spelled out in full when first used.
Throughout this manual, unless otherwise specified, the term device refers to AudioCodes
Mediant MSBR products.
Related Documentation
Document Name
Mediant 500Li MSBR Hardware Installation Manual
Mediant 500Li MSBR User’s Manual
Mediant 500L MSBR Hardware Installation Manual
Mediant 500L MSBR User’s Manual
Mediant 500 MSBR Hardware Installation Manual
Mediant 500 MSBR User’s Manual
Mediant 800 MSBR Hardware Installation Manual
Mediant 800 MSBR User’s Manual

Mediant MSBRs 6 Document #: LTRT-31828
Security Setup
Document Revision Record
LTRT Description
31641 Initial document release for Ver. 7.2
31643 Removal of the auto-VPN section; added new section for DNS query randomization
31646 Updates for IPSec configuration
31647 Management Access List added (domain name support)
31648 Updates to Section Configuring IPSec with GRE
31820 Security updated with SHA-256; L2TP updated with enabling NAT traversal
31821 Configuring IPSec with RSA added
31822 Typo in Section Configuring Port Forwarding
31823 New command (config-isakmp)# ike
31825 Typos (incorrect IP addresses) in Configuring IPSec section
31826 Command added ip tcp adjust-mss (Mediant 500Li MSBR)
31827 IPSec with VTI removed
31828 IKEv2 added
Documentation Feedback
AudioCodes continually strives to produce high quality documentation. If you have any
comments (suggestions or errors) regarding this document, please fill out the Documentation
Feedback form on our website at https://online.audiocodes.com/documentation-feedback.
.

Configuration Guide 1. Introduction
Version 7.2 7 Security Setup
1 Introduction
This document describes configuration of the security functionality of AudioCodes Mediant
Multi-Service Business Routers (MSBR), hereafter referred to as device, using the
command-line interface (CLI).
The document describes the CLI commands required for configuring each aspect of security,
providing typical configuration examples for some of the features.

Mediant MSBRs 8 Document #: LTRT-31828
Security Setup
This page is intentionally left blank.

Configuration Guide 2. Access Control List
Version 7.2 9 Security Setup
2 Access Control List
The device supports access control lists (ACL). The ACLs are tools to categorize traffic
based on source IP or/and destination IP, protocols or ports used by traffic. The
categorization is done by matching traffic to rules defined in the ACL. The ACLs usually work
in combination with other features such as QoS, Firewall, IPSec and NAT. The ACLs are
used to select which traffic to apply to which feature. The device supports two types of ACLs
– connectionless and connection-aware or stateful. Connection-aware access lists only
match first packets based on a rule, for example, traffic from source to destination.
Subsequent packets with the same rule are categorized without matching. This saves CPU
and memory resources. The ACLs can only be configured on Layer-3 interfaces.
To configure ACLs, use the following commands:
Table 2-1: Access Control List
Command Description
# configure data
Enter the data configuration menu.
(config-data)# access-list
[number or word] [deny or
permit] <protocol> <source>
<source port> <destination>
<destination port> <mode> [log]
[number or word] – ACL can be addressed
using a number or a word. Note:access-list
names are case sensitive.
[deny or permit] – connection using this rule
is denied or permitted using this keyword.
<protocol> - connection is matched using
one of the protocols: tcp, udp, ah, esp, gre,
icmp, igmp, ip or manually selected using a
number, 0 to 255, that represents the
protocol field of the IP packet.
<source> - source can be selected as a
single host IP address, range of IP
addresses with mask or local address. It
also can be "any" address. Range of IP
addresses need to be selected using
wildcard.
<source port> - source can be matched
using TCP or UDP port. The <source port>
can be omitted.
<destination> - destination can be selected
as a single host IP address, range of IP
addresses with mask or local address. It
also can be "any" address. Range of IP
addresses needs to be selected using a
wildcard.
<destination port> - destination can be
matched using TCP or UDP port. The
<destination port> can be omitted.
<mode> - mode of the ACL. If the keyword
"established" is used, the ACL will be
connection aware. If the keyword "stateless"
is used, the ACL will be connectionless. The
keyword "dscp" can be used to match the
DSCP field of the IP packet. By default, the
ACL will be connection aware. The <mode>
can be omitted.
[LOG] – if the log keyword is used, if a
packet matches the rule, the event is logged

Mediant MSBRs 10 Document #: LTRT-31828
Security Setup
Command Description
and a counter will increment in the show
command.
(config-data)# ip access-list
[extended or standard] [Name or
number]
Alternative method to configure ACLs is by
using the ip access-list command. This
accesses the ACL with the [name or number]
configuration level. In the configuration level,
the commands start with deny or permit as if
the access-list command is used instead of
ip access-list
.
# sh data access-lists
Displays configured ACLs.
(config-data)# no access-list
<Name>
Deletes the ACL with the name <Name>.
From Version 6.8, ACL numbering is supported. Every line in the ACL has a number. Every
next line number is incremented by 10. To add a line between line number 10 and 20, start
the ACL command with a number, as shown in the example table below:
Table 2-2: ACL Commands Example
Command Description
# configure data
Enter the data configuration menu.
(config-data)# ip access-list
[extended or standard] [Name or
number]
Enter the ACL configuration level.
(config-ext-nacl)# 15 permit ip
<source> <destination>
Add line number 15.
(config-data)# ip access-list
resequence <ACL No. or name>
<start line> <step>
Allows the sequencing of the line numbers of
the ACL.
<start line>: starting line number of the ACL.
<step>: jump in numbers from line to line.

Configuration Guide 2. Access Control List
Version 7.2 11 Security Setup
2.1 Configuration Example
This example configures an ACL rule called "DC-Access" that allows traffic from any source
to a specific class C subnet:
# configure data
(config-data)# access-list DC-Access permit ip any 192.168.100.0
0.0.0.255 log
(config-data)# access-list DC-Access permit ip any 192.168.110.0
0.0.0.255 log
(config-data)# access-list DC-Access permit ip any 192.168.120.0
0.0.0.255 log
(config-data)# access-list DC-Access deny ip any any log
# show data access-lists
Extended IP access list DC-Access
DC-Access permit ip any 192.168.100.0 0.0.0.255 log (0 matches)
DC-Access permit ip any 192.168.110.0 0.0.0.255 log (0 matches)
DC-Access permit ip any 192.168.120.0 0.0.0.255 log (0 matches)
DC-Access deny ip any any log (0 matches)
#
The following example allows access from any IP to segment 192.168.199.0/24 only for SSH
(TCP port 22), Telnet (TCP port 23), SNMP (UDP port 162) and UDP port 2032. For
everything else, traffic is denied.
(config-data)# access-list DC-Access permit tcp any 192.168.199.0
0.0.0.255 eq 22 log
(config-data)# access-list DC-Access permit tcp any 192.168.199.0
0.0.0.255 eq 23 log
(config-data)# access-list DC-Access permit udp any 192.168.199.0
0.0.0.255 eq 162 stateless log
(config-data)# access-list DC-Access permit udp any 192.168.199.0
0.0.0.255 eq 2032 stateless log
(config-data)# access-list DC-Access deny ip any any
(config-data)#
The following example configures an ACL using the ip access-list command:
(config-data)# ip access-list extended DC-Access
(config-ext-nacl)# permit ip any 192.168.10.0 0.0.0.255 log
(config-ext-nacl)# deny ip any any log
(config-ext-nacl)#

Mediant MSBRs 12 Document #: LTRT-31828
Security Setup
This page is intentionally left blank.

Configuration Guide 3. ACLv6
Version 7.2 13 Security Setup
3 ACLv6
The device supports ACL for the IPv6 protocol. Configuration rules are the same as for IPv4.
Table 3-1: ACLv6 Commands
Command Description
# configure data
Configuration of ACLs is in the data level.
(config-data)# ipv6 access-list
[extended or standard] [Name or
number]
Accesses the ACL with the [name or number]
configuration level.
(config-data)# [line number]
[deny or permit] <protocol>
<source> <source port>
<destination> <destination port>
<mode> [log]
[line number]: Every line starts with a line
number. This defines the number of this line.
(from Version 6.8).
[deny or permit]: connection using this rule is
denied or permitted using.
<protocol>: connection is matched using
one of the protocols: tcp, udp, ah, esp, gre,
icmp, igmp, ip or manually selected using a
number, 0 to 255, that represents the
protocol field of the IP packet.
<source>: selects the source. The source
can be selected as a single host IP address,
range of IP addresses with mask or local
address. It also can be "any" address.
Range of IP addresses can be defined using
a wildcard.
<source port>: source can be matched using
TCP or UDP port. The <source port> can be
omitted.
<destination>: selects the destination. The
destination can be selected as a single host
IP address, range of IP addresses with
mask or local address. It also can be "any"
address. Range of IP addresses can be
defined using a wildcard.
<destination port>: destination can be
matched using TCP or UDP port. The
<destination port> can be omitted.
<mode>: the mode of the ACL. If the
keyword "established" is used, the ACL is
connection aware. If the keyword "stateless"
is used, the ACL is connectionless. The
keyword "dscp" can be used to match the
DSCP field of the IP packet. By default, the
ACL is connection aware. The <mode> can
be omitted.
[LOG]: if the log keyword is used, if a packet
matches the rule, the event is logged and a
counter will increment in the show
command.
# sh data access-lists
Displays configured ACLs.
(config-data)# no access-list
<Name>
Deletes the ACL with the name <Name>.

Mediant MSBRs 14 Document #: LTRT-31828
Security Setup
3.1 Configuration Example
This example configures an IPv6 ACL rule. Configuration is applied at firewall index for line
10, 20, and then 15.
# configure data
(config-data)# ipv6 access-list extended 150
(config-ext6-nacl)# 10 permit ipv6 2000:100:1::0/64
2000:100:2::0/64 log
(config-ext6-nacl)# 20 permit ipv6 2000:102:1::0/64
2000:100:2::0/64 log
(config-ext6-nacl)# 15 permit ipv6 2000:101:1::0/64
2000:100:2::0/64 log
(config-ext6-nacl)# exit
(config-data)# exit
#
You can view the configured ACL using the following command:
(config-data)#
# show data access-lists
Extended IP access list 150
150 10 permit ipv6 2000:100:1::0/64 2000:100:2::0/64 log (0
matches)
150 15 permit ipv6 2000:101:1::0/64 2000:100:2::0/64 log (0
matches)
150 20 permit ipv6 2000:102:1::0/64 2000:100:2::0/64 log (0
matches)
You can add lines to the end of the ACL:
# configure data
(config-data)#
(config-data)# ipv access-list extended 150
(config-ext6-nacl)# 999 deny ip any any
(config-ext6-nacl)# exit
The ACL can be organized using the resequence command:
(config-data)# ipv6 access-list resequence 150 10 10

Configuration Guide 3. ACLv6
Version 7.2 15 Security Setup
The result can be shown using the show data access-lists command:
(config-data)# exit
# show data access-lists
Extended IP access list 150
150 10 permit ipv6 2000:100:1::0/64 2000:100:2::0/64 log (0
matches)
150 20 permit ipv6 2000:101:1::0/64 2000:100:2::0/64 log (0
matches)
150 30 permit ipv6 2000:102:1::0/64 2000:100:2::0/64 log (0
matches)
150 40 deny ipv6 any any (0 matches)

Mediant MSBRs 16 Document #: LTRT-31828
Security Setup
This page is intentionally left blank.

Configuration Guide 4. Management Access Lists
Version 7.2 17 Security Setup
4 Management Access Lists
When an access list is created for management using the protocols SNMP, Telnet, SSH or
CWMP, it is possible to use DNS names instead of IP or IPv6 addresses. The device resolves
the name to an IP address and acts upon the ACL rules. If the DNS resolution fails within
one second, the device denies this connection.
4.1 Configuration Example
This example shows how to use access lists to permit or deny DNS hostnames through a
WAN interface. In the example, the Telnet connection configured in the access list has the
hostname “telnet_mgmt” (Telnet management workstation). This host permits access to
“mgmt_ws” (any management IP address of the device).
configure data
access-list telnet_mgmt permit ip host mgmt_ws local log
access-list telnet_mgmt deny ip any any log
Configure the ACL for the Telnet connection:
configure system
cli-terminal
wan-telnet-allow on
set telnet-acl "telnet_mgmt"
activate
exit
In the example below, the DNS name resolves locally on the device using the following
command:
ip host mgmt_ws 10.1.1.44 3600
In other environments, an external DNS server can be used. To configure an external DNS,
use the following command:
ip name-server <DNS Server IP address>
To verify the ACL, run two Telnet commands, once from mgmt_ws and once from a different
location. Use the command show data access-lists. The counter should be
incremented once for the mgmt_ws interface and once for the telnet_mgmt interface.
# sh d access-lists
Extended IP access list telnet_mgmt
telnet_mgmt 10 permit ip host mgmt_ws local log (1 matches)
telnet_mgmt 20 deny ip any any log (1 matches)

Mediant MSBRs 18 Document #: LTRT-31828
Security Setup
This page is intentionally left blank.

Configuration Guide 5. NAT and NAPT
Version 7.2 19 Security Setup
5 NAT and NAPT
The device supports the NAT and PAT protocols. The PAT protocol for the device is
addressed as Network Address and Port Translation (NAPT). NAT changes the inside
address of your network with an external address. NAPT changes the inside addresses of
your network with a single external address with several ports.
NAT and NAPT provide two major benefits:
The inside of a network behind NAT or NAPT is hidden and cannot be accessed from
outside networks.
Saves IP addresses on the Internet, by using one address toward the outside and
many addresses on the inside.
By default, NAPT is activated on the Gigabitethernet0/0 interface. To disable NAPT per
interface, use the following commands:
Table 5-1: NAT and NAPT Commands
Command Description
# configure data
Configuration of ACLs is in the data level.
(config-data)# interface
gigabitethernet 0/0
Configure interface gigabitethernet0/0.
(conf-if-GE 0/0)# no napt
Disable NAPT on the interface.
After disabling NAPT on the interface, the interface becomes a routing interface and packets
from the inside IP addresses are forwarded using the routing table through the interface
gigabitethernet0/0.
Figure 5-1: NAPT and NAT Topology
In Figure 5-1: NAPT and NAT Topology, when NAPT is disabled, in every packet sent to the
server from the user, the source is the user's IP address. When NAPT is enabled, the source
IP of every packet is the IP address configured on the WAN interface. The WAN interface in
the example is port Gi0/0.

Mediant MSBRs 20 Document #: LTRT-31828
Security Setup
Both NAT and NAPT can use a pool of addresses to contact (or to show) the outside word
(the WAN). For NAT and NAPT, a range of IP addresses and ports can be configured using
ACLs. This range of IP addresses is called a NAT pool. To configure the NAT pool, use the
following commands.
Table 5-2: NAT Pool Commands
Command Description
# configure data
Enter the data configuration menu.
(config-data)# access-list
tcp_nat permit tcp 192.168.0.0
0.0.0.255 any
Mark the traffic of the inside addresses. These
addresses will be hidden behind NAT.
(config-data)# ip nat pool
tcp_pool 180.1.100.50
180.1.100.50
Configure a NAT pool that starts with the
address 180.1.100.50 and ends with the
address 180.1.100.50. This means that there is
only one address in the NAT pool.
Table 5-3: NAT Rules
Command Description
(config-data)# ip nat inside
source list tcp_nat interface
gigabitethernet 0/0 pool tcp_pool
Configure IP NAT translation for devices behind
NAT. For every address?? selected by the
tcp_nat ACL, on the interface gi0/0 and use the
tcp_pool NAT pool.
Table 5-4: NAPT Rules
Command Description
(config-data)# ip nat inside
source list tcp_nat interface
gigabitethernet 0/0 pool tcp_pool
port 5000 5010
Configure IP NAPT translation for IP addresses
behind the NAT. For every address selected by
the tcp_nat ACL, on the interface gi0/0, map
multiple IP addresses to the tcp_pool
addresses using ports range 5000-5010.
The process of changing the LAN IP address to WAN IP address is called NAT translation.
To verify that the NAT translation is working, use the following command:
Table 5-5: NAT Translation
Command Description
# show data ip nat translations
Displays NAT translations.