FireBrick FB6502 User manual

FireBrick FB6502
User Manual
FB6000 Versatile Network Appliance

FireBrick FB6502 User Manual
This User Manual documents Software version V1.46.100
Copyright © 2012-2017 FireBrick Ltd.

iv
Table of Contents
Preface .................................................................................................................................. xvi
1. Introduction .......................................................................................................................... 1
1.1. The FB6000 ............................................................................................................... 1
1.1.1. Where do I start? .............................................................................................. 1
1.1.2. What can it do? ................................................................................................ 1
1.1.2.1. FB6502 Gigabit core VoIP SIP switch for ISTP use ...................................... 2
1.1.3. Ethernet port capabilities .................................................................................... 2
1.1.4. Product variants in the FB6000 series ................................................................... 2
1.2. About this Manual ....................................................................................................... 2
1.2.1. Version ........................................................................................................... 2
1.2.2. Intended audience ............................................................................................. 3
1.2.3. Technical details ............................................................................................... 3
1.2.4. Document style ................................................................................................. 3
1.2.5. Document conventions ....................................................................................... 3
1.2.6. Comments and feedback .................................................................................... 4
1.3. Additional Resources ................................................................................................... 4
1.3.1. Technical Support ............................................................................................. 4
1.3.2. IRC Channel .................................................................................................... 4
1.3.3. Application Notes ............................................................................................. 4
1.3.4. White Papers .................................................................................................... 4
1.3.5. Training Courses ............................................................................................... 5
2. Getting Started ...................................................................................................................... 6
2.1. IP addressing .............................................................................................................. 6
2.2. Accessing the web-based user interface ........................................................................... 6
2.2.1. Add a new user ................................................................................................ 7
3. Configuration ........................................................................................................................ 9
3.1. The Object Hierarchy ................................................................................................... 9
3.2. The Object Model ....................................................................................................... 9
3.2.1. Formal definition of the object model ................................................................. 10
3.2.2. Common attributes .......................................................................................... 10
3.3. Configuration Methods ............................................................................................... 10
3.4. Web User Interface Overview ...................................................................................... 10
3.4.1. User Interface layout ........................................................................................ 11
3.4.1.1. Customising the layout .......................................................................... 11
3.4.2. Config pages and the object hierarchy ................................................................. 12
3.4.2.1. Configuration categories ......................................................................... 12
3.4.2.2. Object settings ...................................................................................... 13
3.4.3. Navigating around the User Interface .................................................................. 15
3.4.4. Backing up / restoring the configuration .............................................................. 16
3.5. Configuration using XML ........................................................................................... 16
3.5.1. Introduction to XML ........................................................................................ 16
3.5.2. The root element - <config> ............................................................................. 17
3.5.3. Viewing or editing XML .................................................................................. 17
3.5.4. Example XML configuration ............................................................................. 17
3.6. Downloading/Uploading the configuration ...................................................................... 19
3.6.1. Download ...................................................................................................... 19
3.6.2. Upload .......................................................................................................... 19
4. System Administration .......................................................................................................... 20
4.1. User Management ...................................................................................................... 20
4.1.1. Login level ..................................................................................................... 20
4.1.2. Configuration access level ................................................................................ 21
4.1.3. Login idle timeout ........................................................................................... 21
4.1.4. Restricting user logins ...................................................................................... 21
4.1.4.1. Restrict by IP address ............................................................................ 21

FireBrick FB6502 User Manual
v
4.1.4.2. Logged in IP address ............................................................................. 22
4.1.4.3. Restrict by profile ................................................................................. 22
4.1.5. Password change ............................................................................................. 22
4.1.6. One Time Password (OTP) ............................................................................... 22
4.2. General System settings .............................................................................................. 23
4.2.1. System name (hostname) .................................................................................. 23
4.2.2. Administrative details ...................................................................................... 23
4.2.3. System-level event logging control ..................................................................... 23
4.2.4. Home page web links ...................................................................................... 23
4.3. Software Upgrades ..................................................................................................... 24
4.3.1. Software release types ...................................................................................... 24
4.3.1.1. Breakpoint releases ............................................................................... 24
4.3.2. Identifying current software version .................................................................... 25
4.3.3. Internet-based upgrade process .......................................................................... 25
4.3.3.1. Manually initiating upgrades ................................................................... 25
4.3.3.2. Controlling automatic software updates ..................................................... 26
4.3.4. Manual upgrade .............................................................................................. 26
4.4. Boot Process ............................................................................................................. 27
4.4.1. LED indications .............................................................................................. 27
4.4.1.1. Power LED status indications ................................................................. 27
4.4.1.2. Port LEDs ........................................................................................... 27
5. Event Logging ..................................................................................................................... 28
5.1. Overview .................................................................................................................. 28
5.1.1. Log targets ..................................................................................................... 28
5.1.1.1. Logging to Flash memory ...................................................................... 28
5.1.1.2. Logging to the Console .......................................................................... 29
5.2. Enabling logging ....................................................................................................... 29
5.3. Logging to external destinations ................................................................................... 29
5.3.1. Syslog ........................................................................................................... 29
5.3.2. Email ............................................................................................................ 30
5.3.2.1. E-mail process logging .......................................................................... 31
5.4. Factory reset configuration log targets ........................................................................... 31
5.5. Performance .............................................................................................................. 31
5.6. Viewing logs ............................................................................................................. 31
5.6.1. Viewing logs in the User Interface ..................................................................... 31
5.6.2. Viewing logs in the CLI environment ................................................................. 32
5.7. System-event logging ................................................................................................. 32
5.8. Using Profiles ........................................................................................................... 32
6. Interfaces and Subnets .......................................................................................................... 33
6.1. Relationship between Interfaces and Physical Ports .......................................................... 33
6.1.1. Port groups .................................................................................................... 33
6.1.2. Interfaces ....................................................................................................... 33
6.2. Defining an interface .................................................................................................. 33
6.2.1. Defining subnets ............................................................................................. 34
6.2.1.1. Source filtering ..................................................................................... 35
6.2.1.2. Using DHCP to configure a subnet .......................................................... 35
6.2.2. Setting up DHCP server parameters .................................................................... 35
6.2.2.1. Fixed/Static DHCP allocations ................................................................ 36
6.2.2.2. Restricted allocations ............................................................................. 36
6.2.2.3. Special DHCP options ........................................................................... 37
6.2.3. DHCP Relay Agent ......................................................................................... 38
6.3. Physical port settings .................................................................................................. 38
6.3.1. Setting duplex mode ........................................................................................ 38
6.3.2. Defining port LED functions ............................................................................. 39
7. Routing .............................................................................................................................. 40
7.1. Routing logic ............................................................................................................ 40

FireBrick FB6502 User Manual
vi
7.2. Routing targets .......................................................................................................... 41
7.2.1. Subnet routes .................................................................................................. 41
7.2.2. Routing to an IP address (gateway route) ............................................................. 41
7.2.3. Special targets ................................................................................................ 42
7.3. Dynamic route creation / deletion ................................................................................. 42
7.4. Routing tables ........................................................................................................... 42
7.5. Bonding ................................................................................................................... 42
8. Profiles ............................................................................................................................... 44
8.1. Overview .................................................................................................................. 44
8.2. Creating/editing profiles .............................................................................................. 44
8.2.1. Timing control ................................................................................................ 44
8.2.2. Tests ............................................................................................................. 45
8.2.2.1. General tests ........................................................................................ 45
8.2.2.2. Time/date tests ..................................................................................... 45
8.2.2.3. Ping tests ............................................................................................. 45
8.2.3. Inverting overall test result ................................................................................ 45
8.2.4. Manual override .............................................................................................. 46
9. Traffic Shaping .................................................................................................................... 47
9.1. Graphs and Shapers ................................................................................................... 47
9.1.1. Graphs ........................................................................................................... 47
9.1.2. Shapers .......................................................................................................... 48
9.1.3. Ad hoc shapers ............................................................................................... 48
9.1.4. Long term shapers ........................................................................................... 48
9.2. Multiple shapers ........................................................................................................ 48
9.3. Basic principles ......................................................................................................... 49
10. System Services ................................................................................................................. 50
10.1. Protecting the FB6000 .............................................................................................. 50
10.2. Common settings ..................................................................................................... 50
10.3. HTTP Server configuration ........................................................................................ 51
10.3.1. Access control ............................................................................................... 51
10.3.1.1. Trusted addresses ................................................................................ 51
10.4. Telnet Server configuration ........................................................................................ 51
10.4.1. Access control ............................................................................................... 52
10.5. DNS configuration ................................................................................................... 52
10.5.1. Blocking DNS names ..................................................................................... 52
10.5.2. Local DNS responses ..................................................................................... 52
10.5.3. Auto DHCP DNS .......................................................................................... 52
10.6. NTP configuration .................................................................................................... 53
10.7. SNMP configuration ................................................................................................. 53
10.8. RADIUS configuration .............................................................................................. 53
10.8.1. RADIUS client .............................................................................................. 53
10.8.1.1. RADIUS client settings ........................................................................ 53
10.8.1.2. Server blacklisting ............................................................................... 54
11. Network Diagnostic Tools .................................................................................................... 55
11.1. Access check ........................................................................................................... 55
11.2. Packet Dumping ...................................................................................................... 56
11.2.1. Dump parameters ........................................................................................... 56
11.2.2. Security settings required ................................................................................ 57
11.2.3. IP address matching ....................................................................................... 57
11.2.4. Packet types .................................................................................................. 57
11.2.5. Snaplen specification ...................................................................................... 57
11.2.6. Using the web interface .................................................................................. 58
11.2.7. Using an HTTP client .................................................................................... 58
11.2.7.1. Example using curl and tcpdump ........................................................... 58
12. VRRP ............................................................................................................................... 59
12.1. Virtual Routers ........................................................................................................ 59

FireBrick FB6502 User Manual
vii
12.2. Configuring VRRP ................................................................................................... 60
12.2.1. Advertisement Interval .................................................................................... 60
12.2.2. Priority ........................................................................................................ 60
12.3. Using a virtual router ................................................................................................ 60
12.4. VRRP versions ........................................................................................................ 60
12.4.1. VRRP version 2 ............................................................................................ 60
12.4.2. VRRP version 3 ............................................................................................ 61
12.5. Compatibility ........................................................................................................... 61
13. VoIP ................................................................................................................................. 62
13.1. What is VoIP? ......................................................................................................... 62
13.2. Registration and Proxies ............................................................................................ 62
13.2.1. Registrar ...................................................................................................... 62
13.2.2. Proxy ........................................................................................................... 62
13.3. Core call routing switch ............................................................................................ 63
13.3.1. Call control .................................................................................................. 63
13.3.2. Bulk registration client ................................................................................... 63
13.4. Network Address Translation ..................................................................................... 63
13.5. Number plan ........................................................................................................... 64
13.6. Telephone handsets .................................................................................................. 64
13.7. VoIP call carriers ..................................................................................................... 65
13.8. Hunt groups ............................................................................................................ 66
13.9. Call pickup/steal ...................................................................................................... 66
13.10. Busy lamp field ..................................................................................................... 66
13.11. Using RADIUS ...................................................................................................... 66
13.11.1. RADIUS accounting ..................................................................................... 66
13.11.2. RADIUS authentication ................................................................................. 66
13.11.2.1. Call routing by RADIUS .................................................................... 67
13.12. Call recording ........................................................................................................ 68
13.13. Voicemail and IVR services ..................................................................................... 69
13.14. Call Data Records .................................................................................................. 69
13.15. Technical details .................................................................................................... 70
13.16. Custom tones ......................................................................................................... 70
14. BGP ................................................................................................................................. 72
14.1. What is BGP? ......................................................................................................... 72
14.2. BGP Setup .............................................................................................................. 72
14.2.1. Overview ..................................................................................................... 72
14.2.2. Standards ..................................................................................................... 72
14.2.3. Simple example setup ..................................................................................... 73
14.2.4. Peer type ...................................................................................................... 73
14.2.5. Route filtering ............................................................................................... 74
14.2.5.1. Matching attributes .............................................................................. 74
14.2.5.2. Action attributes .................................................................................. 74
14.2.6. Well known community tags ........................................................................... 75
14.2.7. Announcing black hole routes .......................................................................... 75
14.2.8. Announcing dead end routes ............................................................................ 76
14.2.9. Bad optional path attributes ............................................................................. 76
14.2.10. <network> element ....................................................................................... 76
14.2.11. <route>, <subnet> and other elements ............................................................. 76
14.2.12. Route feasibility testing ................................................................................. 76
14.2.13. Diagnostics ................................................................................................. 77
14.2.14. Router shutdown .......................................................................................... 77
14.2.15. TTL security ............................................................................................... 77
15. Command Line Interface ...................................................................................................... 78
A. CIDR and CIDR Notation ..................................................................................................... 79
B. MAC Addresses usage .......................................................................................................... 81
B.1. Multiple MAC addresses? ........................................................................................... 81

FireBrick FB6502 User Manual
viii
B.2. How the FireBrick allocates MAC addresses .................................................................. 82
B.2.1. Interface ........................................................................................................ 82
B.2.2. Subnet .......................................................................................................... 82
B.2.3. PPPoE .......................................................................................................... 82
B.2.4. Base MAC .................................................................................................... 82
B.2.5. Running out of MACs ..................................................................................... 83
B.3. MAC address on label ............................................................................................... 83
B.4. Using with a DHCP server ......................................................................................... 84
C. VLANs : A primer ............................................................................................................... 85
D. Supported RADIUS Attribute/Value Pairs for VoIP operation ...................................................... 86
D.1. Authentication request ............................................................................................... 86
D.2. Authentication response ............................................................................................. 87
D.2.1. Challenge authentication .................................................................................. 87
D.2.2. Accepted authentication (registration) ................................................................. 87
D.2.3. Accepted authentication (invite) ........................................................................ 87
D.2.4. Rejected authentication .................................................................................... 88
D.3. Accounting Start ....................................................................................................... 88
D.4. Accounting Interim .................................................................................................... 88
D.5. Accounting Stop ....................................................................................................... 89
D.6. Disconnect ............................................................................................................... 89
D.7. Change of Authorisation ............................................................................................. 90
E. FireBrick specific SNMP objects ............................................................................................ 91
E.1. Monitoring information .............................................................................................. 91
E.2. BGP information ....................................................................................................... 91
E.3. Monitoring information .............................................................................................. 92
F. Command line reference ........................................................................................................ 93
F.1. General commands .................................................................................................... 93
F.1.1. Trace off ....................................................................................................... 93
F.1.2. Trace on ........................................................................................................ 93
F.1.3. Uptime .......................................................................................................... 93
F.1.4. General status ................................................................................................. 93
F.1.5. Memory usage ................................................................................................ 93
F.1.6. Process/task usage ........................................................................................... 93
F.1.7. Login ............................................................................................................ 93
F.1.8. Logout .......................................................................................................... 94
F.1.9. See XML configuration .................................................................................... 94
F.1.10. Load XML configuration ................................................................................ 94
F.1.11. Show profile status ........................................................................................ 94
F.1.12. Enable profile control switch ........................................................................... 94
F.1.13. Disable profile control switch .......................................................................... 94
F.1.14. Show RADIUS servers ................................................................................... 94
F.1.15. Show DNS resolvers ...................................................................................... 94
F.2. Networking commands ............................................................................................... 95
F.2.1. Subnets ......................................................................................................... 95
F.2.2. Ping and trace ................................................................................................ 95
F.2.3. Show a route from the routing table ................................................................... 95
F.2.4. List routes ...................................................................................................... 95
F.2.5. List routing next hops ...................................................................................... 95
F.2.6. See DHCP allocations ...................................................................................... 96
F.2.7. Clear DHCP allocations ................................................................................... 96
F.2.8. Lock DHCP allocations .................................................................................... 96
F.2.9. Unlock DHCP allocations ................................................................................. 96
F.2.10. Name DHCP allocations ................................................................................. 96
F.2.11. Show ARP/ND status ..................................................................................... 96
F.2.12. Show VRRP status ........................................................................................ 96
F.2.13. Send Wake-on-LAN packet ............................................................................. 96

FireBrick FB6502 User Manual
ix
F.2.14. Check access to services ................................................................................. 97
F.3. BGP commands ........................................................................................................ 97
F.4. VoIP commands ........................................................................................................ 97
F.5. Advanced commands ................................................................................................. 97
F.5.1. Panic ............................................................................................................. 97
F.5.2. Reboot .......................................................................................................... 97
F.5.3. Screen width .................................................................................................. 97
F.5.4. Make outbound command session ...................................................................... 97
F.5.5. Show command sessions .................................................................................. 98
F.5.6. Kill command session ...................................................................................... 98
F.5.7. Flash memory list ........................................................................................... 98
F.5.8. Delete block from flash .................................................................................... 98
F.5.9. Boot log ........................................................................................................ 98
F.5.10. Flash log ...................................................................................................... 98
G. Constant Quality Monitoring - technical details ......................................................................... 99
G.1. Access to graphs and csvs .......................................................................................... 99
G.1.1. Trusted access ................................................................................................ 99
G.1.2. Dated information ........................................................................................... 99
G.1.3. Authenticated access ...................................................................................... 100
G.2. Graph display options .............................................................................................. 100
G.2.1. Data points .................................................................................................. 100
G.2.2. Additional text ............................................................................................. 100
G.2.3. Other colours and spacing .............................................................................. 101
G.3. Overnight archiving ................................................................................................. 101
G.3.1. Full URL format ........................................................................................... 102
G.3.2. load handling ............................................................................................... 102
G.4. Graph scores ........................................................................................................... 103
G.5. Creating graphs, and graph names .............................................................................. 103
H. Hashed passwords .............................................................................................................. 104
H.1. Password hashing .................................................................................................... 104
H.1.1. Salt ............................................................................................................. 104
H.2. One Time Password seed hashing .............................................................................. 105
I. Configuration Objects .......................................................................................................... 107
I.1. Top level ................................................................................................................. 107
I.1.1. config: Top level config .................................................................................. 107
I.2. Objects ................................................................................................................... 108
I.2.1. system: System settings ................................................................................... 108
I.2.2. link: Web links .............................................................................................. 109
I.2.3. user: Admin users .......................................................................................... 109
I.2.4. eap: User access controlled by EAP .................................................................. 109
I.2.5. log: Log target controls ................................................................................... 110
I.2.6. log-syslog: Syslog logger settings ..................................................................... 110
I.2.7. log-email: Email logger settings ........................................................................ 111
I.2.8. services: System services ................................................................................. 111
I.2.9. snmp-service: SNMP service settings ................................................................. 112
I.2.10. ntp-service: NTP service settings ..................................................................... 112
I.2.11. telnet-service: Telnet service settings ............................................................... 113
I.2.12. http-service: HTTP service settings .................................................................. 113
I.2.13. dns-service: DNS service settings .................................................................... 114
I.2.14. dns-host: Fixed local DNS host settings ............................................................ 115
I.2.15. dns-block: Fixed local DNS blocks .................................................................. 115
I.2.16. radius-service: RADIUS service definition ........................................................ 116
I.2.17. radius-service-match: Matching rules for RADIUS service ................................... 117
I.2.18. radius-server: RADIUS server settings ............................................................. 118
I.2.19. ethernet: Physical port controls ....................................................................... 119
I.2.20. sampling: Packet sampling configuration .......................................................... 119

FireBrick FB6502 User Manual
x
I.2.21. portdef: Port grouping and naming .................................................................. 120
I.2.22. interface: Port-group/VLAN interface settings .................................................... 120
I.2.23. subnet: Subnet settings .................................................................................. 121
I.2.24. vrrp: VRRP settings ...................................................................................... 122
I.2.25. dhcps: DHCP server settings .......................................................................... 123
I.2.26. dhcp-attr-hex: DHCP server attributes (hex) ...................................................... 124
I.2.27. dhcp-attr-string: DHCP server attributes (string) ................................................. 124
I.2.28. dhcp-attr-number: DHCP server attributes (numeric) ........................................... 124
I.2.29. dhcp-attr-ip: DHCP server attributes (IP) .......................................................... 125
I.2.30. route: Static routes ........................................................................................ 125
I.2.31. network: Locally originated networks ............................................................... 125
I.2.32. blackhole: Dead end networks ........................................................................ 126
I.2.33. loopback: Locally originated networks ............................................................. 126
I.2.34. namedbgpmap: Mapping and filtering rules of BGP prefixes ................................. 127
I.2.35. bgprule: Individual mapping/filtering rule ......................................................... 127
I.2.36. bgp: Overall BGP settings .............................................................................. 128
I.2.37. bgppeer: BGP peer definitions ........................................................................ 128
I.2.38. bgpmap: Mapping and filtering rules of BGP prefixes ......................................... 130
I.2.39. cqm: Constant Quality Monitoring settings ........................................................ 130
I.2.40. profile: Control profile .................................................................................. 132
I.2.41. profile-date: Test passes if within any of the time ranges specified ......................... 133
I.2.42. profile-time: Test passes if within any of the date/time ranges specified .................. 134
I.2.43. profile-ping: Test passes if any addresses are pingable ......................................... 134
I.2.44. ip-group: IP Group ....................................................................................... 134
I.2.45. voip: Voice over IP config ............................................................................. 135
I.2.46. carrier: VoIP carrier details ............................................................................ 136
I.2.47. telephone: VoIP telephone authentication user details .......................................... 138
I.2.48. tone: Tone definitions .................................................................................... 139
I.2.49. ringgroup: Ring groups .................................................................................. 139
I.2.50. dhcp-relay: DHCP server settings for remote / relayed requests ............................. 140
I.3. Data types ............................................................................................................... 140
I.3.1. autoloadtype: Type of s/w auto load .................................................................. 140
I.3.2. config-access: Type of access user has to config .................................................. 140
I.3.3. user-level: User login level .............................................................................. 141
I.3.4. eap-subsystem: Subsystem with EAP access control ............................................. 141
I.3.5. eap-method: EAP access method ....................................................................... 141
I.3.6. syslog-severity: Syslog severity ........................................................................ 141
I.3.7. syslog-facility: Syslog facility ........................................................................... 142
I.3.8. month: Month name (3 letter) ........................................................................... 142
I.3.9. day: Day name (3 letter) .................................................................................. 143
I.3.10. radiuspriority: Options for controlling platform RADIUS response priority tagging ... 143
I.3.11. radiustype: Type of RADIUS server ................................................................ 143
I.3.12. port: Physical port ........................................................................................ 144
I.3.13. Crossover: Crossover configuration .................................................................. 144
I.3.14. LinkSpeed: Physical port speed ....................................................................... 144
I.3.15. LinkDuplex: Physical port duplex setting .......................................................... 144
I.3.16. LinkFlow: Physical port flow control setting ..................................................... 144
I.3.17. LinkClock: Physical port Gigabit clock master/slave setting ................................. 145
I.3.18. LinkLED-y: Yellow LED setting ..................................................................... 145
I.3.19. LinkLED-g: Green LED setting ...................................................................... 145
I.3.20. LinkPower: PHY power saving options ............................................................ 145
I.3.21. LinkFault: Link fault type to send ................................................................... 146
I.3.22. sampling-protocol: Sampling protocol .............................................................. 146
I.3.23. trunk-mode: Trunk port more ......................................................................... 146
I.3.24. ramode: IPv6 route announce level .................................................................. 146
I.3.25. dhcpv6control: Control for RA and DHCPv6 bits ............................................... 146