FireBrick FB6602 User manual

FireBrick FB6602
User Manual
FB6000 Versatile Network Appliance

FireBrick FB6602 User Manual
This User Manual documents Software version V1.46.100
Copyright © 2012-2017 FireBrick Ltd.

iv
Table of Contents
Preface .................................................................................................................................. xvi
1. Introduction .......................................................................................................................... 1
1.1. The FB6000 ............................................................................................................... 1
1.1.1. Where do I start? .............................................................................................. 1
1.1.2. What can it do? ................................................................................................ 1
1.1.2.1. FB6602 Mobile GTPv1 GGSN/L2TP gateway ............................................. 2
1.1.3. Ethernet port capabilities .................................................................................... 2
1.1.4. Product variants in the FB6000 series ................................................................... 2
1.2. About this Manual ....................................................................................................... 2
1.2.1. Version ........................................................................................................... 2
1.2.2. Intended audience ............................................................................................. 3
1.2.3. Technical details ............................................................................................... 3
1.2.4. Document style ................................................................................................. 3
1.2.5. Document conventions ....................................................................................... 3
1.2.6. Comments and feedback .................................................................................... 4
1.3. Additional Resources ................................................................................................... 4
1.3.1. Technical Support ............................................................................................. 4
1.3.2. IRC Channel .................................................................................................... 4
1.3.3. Application Notes ............................................................................................. 4
1.3.4. White Papers .................................................................................................... 4
1.3.5. Training Courses ............................................................................................... 5
2. Getting Started ...................................................................................................................... 6
2.1. IP addressing .............................................................................................................. 6
2.2. Accessing the web-based user interface ........................................................................... 6
2.2.1. Add a new user ................................................................................................ 7
3. Configuration ........................................................................................................................ 9
3.1. The Object Hierarchy ................................................................................................... 9
3.2. The Object Model ....................................................................................................... 9
3.2.1. Formal definition of the object model ................................................................. 10
3.2.2. Common attributes .......................................................................................... 10
3.3. Configuration Methods ............................................................................................... 10
3.4. Web User Interface Overview ...................................................................................... 10
3.4.1. User Interface layout ........................................................................................ 11
3.4.1.1. Customising the layout .......................................................................... 11
3.4.2. Config pages and the object hierarchy ................................................................. 12
3.4.2.1. Configuration categories ......................................................................... 12
3.4.2.2. Object settings ...................................................................................... 13
3.4.3. Navigating around the User Interface .................................................................. 15
3.4.4. Backing up / restoring the configuration .............................................................. 16
3.5. Configuration using XML ........................................................................................... 16
3.5.1. Introduction to XML ........................................................................................ 16
3.5.2. The root element - <config> ............................................................................. 17
3.5.3. Viewing or editing XML .................................................................................. 17
3.5.4. Example XML configuration ............................................................................. 17
3.6. Downloading/Uploading the configuration ...................................................................... 19
3.6.1. Download ...................................................................................................... 19
3.6.2. Upload .......................................................................................................... 19
4. System Administration .......................................................................................................... 20
4.1. User Management ...................................................................................................... 20
4.1.1. Login level ..................................................................................................... 20
4.1.2. Configuration access level ................................................................................ 21
4.1.3. Login idle timeout ........................................................................................... 21
4.1.4. Restricting user logins ...................................................................................... 21
4.1.4.1. Restrict by IP address ............................................................................ 21

FireBrick FB6602 User Manual
v
4.1.4.2. Logged in IP address ............................................................................. 22
4.1.4.3. Restrict by profile ................................................................................. 22
4.1.5. Password change ............................................................................................. 22
4.1.6. One Time Password (OTP) ............................................................................... 22
4.2. General System settings .............................................................................................. 23
4.2.1. System name (hostname) .................................................................................. 23
4.2.2. Administrative details ...................................................................................... 23
4.2.3. System-level event logging control ..................................................................... 23
4.2.4. Home page web links ...................................................................................... 23
4.3. Software Upgrades ..................................................................................................... 24
4.3.1. Software release types ...................................................................................... 24
4.3.1.1. Breakpoint releases ............................................................................... 24
4.3.2. Identifying current software version .................................................................... 25
4.3.3. Internet-based upgrade process .......................................................................... 25
4.3.3.1. Manually initiating upgrades ................................................................... 25
4.3.3.2. Controlling automatic software updates ..................................................... 26
4.3.4. Manual upgrade .............................................................................................. 26
4.4. Boot Process ............................................................................................................. 27
4.4.1. LED indications .............................................................................................. 27
4.4.1.1. Power LED status indications ................................................................. 27
4.4.1.2. Port LEDs ........................................................................................... 27
5. Event Logging ..................................................................................................................... 28
5.1. Overview .................................................................................................................. 28
5.1.1. Log targets ..................................................................................................... 28
5.1.1.1. Logging to Flash memory ...................................................................... 28
5.1.1.2. Logging to the Console .......................................................................... 29
5.2. Enabling logging ....................................................................................................... 29
5.3. Logging to external destinations ................................................................................... 29
5.3.1. Syslog ........................................................................................................... 29
5.3.2. Email ............................................................................................................ 30
5.3.2.1. E-mail process logging .......................................................................... 31
5.4. Factory reset configuration log targets ........................................................................... 31
5.5. Performance .............................................................................................................. 31
5.6. Viewing logs ............................................................................................................. 31
5.6.1. Viewing logs in the User Interface ..................................................................... 31
5.6.2. Viewing logs in the CLI environment ................................................................. 32
5.7. System-event logging ................................................................................................. 32
5.8. Using Profiles ........................................................................................................... 32
6. Interfaces and Subnets .......................................................................................................... 33
6.1. Relationship between Interfaces and Physical Ports .......................................................... 33
6.1.1. Port groups .................................................................................................... 33
6.1.2. Interfaces ....................................................................................................... 33
6.2. Defining an interface .................................................................................................. 34
6.2.1. Defining subnets ............................................................................................. 34
6.2.1.1. Source filtering ..................................................................................... 35
6.2.1.2. Using DHCP to configure a subnet .......................................................... 35
6.2.2. Setting up DHCP server parameters .................................................................... 35
6.2.2.1. Fixed/Static DHCP allocations ................................................................ 36
6.2.2.2. Restricted allocations ............................................................................. 37
6.2.2.3. Special DHCP options ........................................................................... 38
6.2.3. DHCP Relay Agent ......................................................................................... 38
6.3. Physical port settings .................................................................................................. 38
6.3.1. Setting duplex mode ........................................................................................ 39
6.3.2. Defining port LED functions ............................................................................. 39
7. Routing .............................................................................................................................. 40
7.1. Routing logic ............................................................................................................ 40

FireBrick FB6602 User Manual
vi
7.2. Routing targets .......................................................................................................... 41
7.2.1. Subnet routes .................................................................................................. 41
7.2.2. Routing to an IP address (gateway route) ............................................................. 41
7.2.3. Special targets ................................................................................................ 42
7.3. Dynamic route creation / deletion ................................................................................. 42
7.4. Routing tables ........................................................................................................... 42
7.5. Bonding ................................................................................................................... 42
8. Profiles ............................................................................................................................... 44
8.1. Overview .................................................................................................................. 44
8.2. Creating/editing profiles .............................................................................................. 44
8.2.1. Timing control ................................................................................................ 44
8.2.2. Tests ............................................................................................................. 45
8.2.2.1. General tests ........................................................................................ 45
8.2.2.2. Time/date tests ..................................................................................... 45
8.2.2.3. Ping tests ............................................................................................. 45
8.2.3. Inverting overall test result ................................................................................ 45
8.2.4. Manual override .............................................................................................. 46
9. Traffic Shaping .................................................................................................................... 47
9.1. Graphs and Shapers ................................................................................................... 47
9.1.1. Graphs ........................................................................................................... 47
9.1.2. Shapers .......................................................................................................... 48
9.1.3. Ad hoc shapers ............................................................................................... 48
9.1.4. Long term shapers ........................................................................................... 48
9.2. Multiple shapers ........................................................................................................ 49
9.3. Basic principles ......................................................................................................... 49
10. PPPoE .............................................................................................................................. 50
10.1. Types of DSL line and router in the United Kingdom ..................................................... 50
10.2. Definining PPPoE links ............................................................................................. 51
10.2.1. IPv6 ............................................................................................................ 51
10.2.2. Additional options ......................................................................................... 51
10.2.2.1. MTU and TCP fix ............................................................................... 51
10.2.2.2. Service and ac-name ............................................................................ 52
10.2.2.3. Logging ............................................................................................. 52
10.2.2.4. Speed and graphs ................................................................................ 52
11. Tunnels ............................................................................................................................. 53
12. System Services ................................................................................................................. 54
12.1. Protecting the FB6000 .............................................................................................. 54
12.2. Common settings ..................................................................................................... 54
12.3. HTTP Server configuration ........................................................................................ 55
12.3.1. Access control ............................................................................................... 55
12.3.1.1. Trusted addresses ................................................................................ 55
12.4. Telnet Server configuration ........................................................................................ 56
12.4.1. Access control ............................................................................................... 56
12.5. DNS configuration ................................................................................................... 56
12.5.1. Blocking DNS names ..................................................................................... 56
12.5.2. Local DNS responses ..................................................................................... 56
12.5.3. Auto DHCP DNS .......................................................................................... 57
12.6. NTP configuration .................................................................................................... 57
12.7. SNMP configuration ................................................................................................. 57
12.8. RADIUS configuration .............................................................................................. 57
12.8.1. RADIUS server (platform RADIUS) ................................................................. 57
12.8.2. RADIUS client .............................................................................................. 57
12.8.2.1. RADIUS client settings ........................................................................ 58
12.8.2.2. Server blacklisting ............................................................................... 58
13. Network Diagnostic Tools .................................................................................................... 59
13.1. Access check ........................................................................................................... 59

FireBrick FB6602 User Manual
vii
13.2. Packet Dumping ...................................................................................................... 60
13.2.1. Dump parameters ........................................................................................... 60
13.2.2. Security settings required ................................................................................ 61
13.2.3. IP address matching ....................................................................................... 61
13.2.4. Packet types .................................................................................................. 61
13.2.5. Snaplen specification ...................................................................................... 62
13.2.6. Using the web interface .................................................................................. 62
13.2.7. Using an HTTP client .................................................................................... 62
13.2.7.1. Example using curl and tcpdump ........................................................... 62
14. VRRP ............................................................................................................................... 63
14.1. Virtual Routers ........................................................................................................ 63
14.2. Configuring VRRP ................................................................................................... 64
14.2.1. Advertisement Interval .................................................................................... 64
14.2.2. Priority ........................................................................................................ 64
14.3. Using a virtual router ................................................................................................ 64
14.4. VRRP versions ........................................................................................................ 64
14.4.1. VRRP version 2 ............................................................................................ 64
14.4.2. VRRP version 3 ............................................................................................ 65
14.5. Compatibility ........................................................................................................... 65
15. BGP ................................................................................................................................. 66
15.1. What is BGP? ......................................................................................................... 66
15.2. BGP Setup .............................................................................................................. 66
15.2.1. Overview ..................................................................................................... 66
15.2.2. Standards ..................................................................................................... 66
15.2.3. Simple example setup ..................................................................................... 67
15.2.4. Peer type ...................................................................................................... 67
15.2.5. Route filtering ............................................................................................... 68
15.2.5.1. Matching attributes .............................................................................. 68
15.2.5.2. Action attributes .................................................................................. 68
15.2.6. Well known community tags ........................................................................... 69
15.2.7. Announcing black hole routes .......................................................................... 69
15.2.8. Announcing dead end routes ............................................................................ 70
15.2.9. Bad optional path attributes ............................................................................. 70
15.2.10. <network> element ....................................................................................... 70
15.2.11. <route>, <subnet> and other elements ............................................................. 70
15.2.12. Route feasibility testing ................................................................................. 71
15.2.13. Diagnostics ................................................................................................. 71
15.2.14. Router shutdown .......................................................................................... 71
15.2.15. TTL security ............................................................................................... 71
16. Internet Service Providers .................................................................................................... 72
16.1. Background ............................................................................................................. 72
16.1.1. How it all began ............................................................................................ 72
16.1.2. Point to Point Protocol ................................................................................... 72
16.1.3. L2TP ........................................................................................................... 72
16.1.4. Broadband .................................................................................................... 73
16.1.5. RADIUS ...................................................................................................... 73
16.1.6. BGP ............................................................................................................ 73
16.2. Incoming L2TP connections ....................................................................................... 73
16.3. The importance of CQM graphs ................................................................................. 74
16.4. Authentication ......................................................................................................... 74
16.5. Accounting .............................................................................................................. 75
16.6. RADIUS Control messages ........................................................................................ 75
16.7. PPPoE .................................................................................................................... 75
16.8. GGSN .................................................................................................................... 75
16.9. Typical configuration ................................................................................................ 75
16.9.1. Interlink subnet ............................................................................................. 76

FireBrick FB6602 User Manual
viii
16.9.2. BGP with carrier ........................................................................................... 76
16.9.3. RADIUS session steering ................................................................................ 76
16.9.4. L2TP endpoints ............................................................................................. 77
16.9.5. ISP RADIUS ................................................................................................ 77
17. Command Line Interface ...................................................................................................... 78
A. CIDR and CIDR Notation ..................................................................................................... 79
B. MAC Addresses usage .......................................................................................................... 81
B.1. Multiple MAC addresses? ........................................................................................... 81
B.2. How the FireBrick allocates MAC addresses .................................................................. 82
B.2.1. Interface ........................................................................................................ 82
B.2.2. Subnet .......................................................................................................... 82
B.2.3. PPPoE .......................................................................................................... 82
B.2.4. Base MAC .................................................................................................... 82
B.2.5. Running out of MACs ..................................................................................... 83
B.3. MAC address on label ............................................................................................... 83
B.4. Using with a DHCP server ......................................................................................... 84
C. VLANs : A primer ............................................................................................................... 85
D. Supported L2TP Attribute/Value Pairs .................................................................................... 86
D.1. Start-Control-Connection-Request ................................................................................ 86
D.2. Start-Control-Connection-Reply ................................................................................... 86
D.3. Start-Control-Connection-Connected ............................................................................. 87
D.4. Stop-Control-Connection-Notification ........................................................................... 87
D.5. Hello ....................................................................................................................... 87
D.6. Incoming-Call-Request ............................................................................................... 87
D.7. Incoming-Call-Reply .................................................................................................. 88
D.8. Incoming-Call-Connected ........................................................................................... 88
D.9. Outgoing-Call-Request ............................................................................................... 88
D.10. Outgoing-Call-Reply ................................................................................................ 89
D.11. Outgoing-Call-Connected .......................................................................................... 89
D.12. Call-Disconnect-Notify ............................................................................................. 89
D.13. WAN-Error-Notify .................................................................................................. 89
D.14. Set-Link-Info .......................................................................................................... 89
D.15. Notes ..................................................................................................................... 90
D.15.1. BT specific notes .......................................................................................... 90
D.15.2. IP over LCP ................................................................................................. 90
E. Supported RADIUS Attribute/Value Pairs for L2TP operation ..................................................... 91
E.1. Authentication request ................................................................................................ 91
E.2. Authentication response .............................................................................................. 92
E.2.1. Accepted authentication ................................................................................... 92
E.2.1.1. Prefix Delegation .................................................................................. 93
E.2.2. Rejected authentication .................................................................................... 94
E.3. Accounting Start ....................................................................................................... 94
E.4. Accounting Interim .................................................................................................... 95
E.5. Accounting Stop ........................................................................................................ 96
E.6. Disconnect ............................................................................................................... 96
E.7. Change of Authorisation ............................................................................................. 96
E.8. Filter ID .................................................................................................................. 97
E.9. Notes ....................................................................................................................... 98
E.9.1. L2TP relay .................................................................................................... 98
E.9.2. LCP echo and CQM graphs .............................................................................. 99
E.9.3. IP over LCP ................................................................................................... 99
E.9.4. Closed User Group .......................................................................................... 99
E.9.5. Routing table ................................................................................................ 100
F. FireBrick specific SNMP objects .......................................................................................... 101
F.1. Monitoring information ............................................................................................. 101
F.2. BGP information ...................................................................................................... 101

FireBrick FB6602 User Manual
ix
F.3. L2TP information .................................................................................................... 102
G. Command line reference ..................................................................................................... 103
G.1. General commands .................................................................................................. 103
G.1.1. Trace off ..................................................................................................... 103
G.1.2. Trace on ...................................................................................................... 103
G.1.3. Uptime ........................................................................................................ 103
G.1.4. General status ............................................................................................... 103
G.1.5. Memory usage .............................................................................................. 103
G.1.6. Process/task usage ......................................................................................... 103
G.1.7. Login .......................................................................................................... 103
G.1.8. Logout ........................................................................................................ 104
G.1.9. See XML configuration .................................................................................. 104
G.1.10. Load XML configuration .............................................................................. 104
G.1.11. Show profile status ...................................................................................... 104
G.1.12. Enable profile control switch ......................................................................... 104
G.1.13. Disable profile control switch ........................................................................ 104
G.1.14. Show RADIUS servers ................................................................................. 104
G.1.15. Show DNS resolvers .................................................................................... 104
G.2. Networking commands ............................................................................................. 105
G.2.1. Subnets ....................................................................................................... 105
G.2.2. Ping and trace .............................................................................................. 105
G.2.3. Show a route from the routing table ................................................................. 105
G.2.4. List routes ................................................................................................... 105
G.2.5. List routing next hops .................................................................................... 105
G.2.6. See DHCP allocations .................................................................................... 106
G.2.7. Clear DHCP allocations ................................................................................. 106
G.2.8. Lock DHCP allocations .................................................................................. 106
G.2.9. Unlock DHCP allocations ............................................................................... 106
G.2.10. Name DHCP allocations ............................................................................... 106
G.2.11. Show ARP/ND status ................................................................................... 106
G.2.12. Show VRRP status ...................................................................................... 106
G.2.13. Send Wake-on-LAN packet ........................................................................... 106
G.2.14. Check access to services ............................................................................... 107
G.3. L2TP commands ..................................................................................................... 107
G.4. BGP commands ...................................................................................................... 107
G.5. GGSN commands .................................................................................................... 107
G.6. PPPoE commands .................................................................................................... 107
G.7. Advanced commands ............................................................................................... 107
G.7.1. Panic .......................................................................................................... 107
G.7.2. Reboot ........................................................................................................ 107
G.7.3. Screen width ................................................................................................ 108
G.7.4. Make outbound command session .................................................................... 108
G.7.5. Show command sessions ................................................................................ 108
G.7.6. Kill command session .................................................................................... 108
G.7.7. Flash memory list ......................................................................................... 108
G.7.8. Delete block from flash .................................................................................. 108
G.7.9. Boot log ...................................................................................................... 108
G.7.10. Flash log .................................................................................................... 109
H. Constant Quality Monitoring - technical details ....................................................................... 110
H.1. Broadband back-haul providers .................................................................................. 110
H.2. Access to graphs and csvs ........................................................................................ 110
H.2.1. Trusted access .............................................................................................. 110
H.2.2. Dated information ......................................................................................... 111
H.2.3. Authenticated access ...................................................................................... 111
H.3. Graph display options .............................................................................................. 111
H.3.1. Data points .................................................................................................. 111

FireBrick FB6602 User Manual
x
H.3.2. Additional text ............................................................................................. 112
H.3.3. Other colours and spacing .............................................................................. 112
H.4. Overnight archiving ................................................................................................. 113
H.4.1. Full URL format ........................................................................................... 113
H.4.2. load handling ............................................................................................... 114
H.5. Graph scores ........................................................................................................... 114
H.6. Creating graphs, and graph names .............................................................................. 114
I. Hashed passwords ............................................................................................................... 115
I.1. Password hashing ..................................................................................................... 115
I.1.1. Salt .............................................................................................................. 115
I.2. One Time Password seed hashing ................................................................................ 116
J. Configuration Objects .......................................................................................................... 118
J.1. Top level ................................................................................................................ 118
J.1.1. config: Top level config .................................................................................. 118
J.2. Objects ................................................................................................................... 119
J.2.1. system: System settings ................................................................................... 119
J.2.2. link: Web links .............................................................................................. 120
J.2.3. user: Admin users .......................................................................................... 120
J.2.4. eap: User access controlled by EAP .................................................................. 121
J.2.5. log: Log target controls ................................................................................... 121
J.2.6. log-syslog: Syslog logger settings ..................................................................... 121
J.2.7. log-email: Email logger settings ....................................................................... 122
J.2.8. services: System services ................................................................................. 122
J.2.9. snmp-service: SNMP service settings ................................................................. 123
J.2.10. ntp-service: NTP service settings ..................................................................... 123
J.2.11. telnet-service: Telnet service settings ............................................................... 124
J.2.12. http-service: HTTP service settings .................................................................. 125
J.2.13. dns-service: DNS service settings .................................................................... 125
J.2.14. dns-host: Fixed local DNS host settings ............................................................ 126
J.2.15. dns-block: Fixed local DNS blocks .................................................................. 126
J.2.16. radius-service: RADIUS service definition ........................................................ 127
J.2.17. radius-service-match: Matching rules for RADIUS service ................................... 128
J.2.18. radius-server: RADIUS server settings ............................................................. 129
J.2.19. ethernet: Physical port controls ....................................................................... 130
J.2.20. sampling: Packet sampling configuration .......................................................... 130
J.2.21. portdef: Port grouping and naming .................................................................. 131
J.2.22. interface: Port-group/VLAN interface settings ................................................... 131
J.2.23. subnet: Subnet settings .................................................................................. 132
J.2.24. vrrp: VRRP settings ...................................................................................... 133
J.2.25. dhcps: DHCP server settings .......................................................................... 134
J.2.26. dhcp-attr-hex: DHCP server attributes (hex) ...................................................... 135
J.2.27. dhcp-attr-string: DHCP server attributes (string) ................................................. 135
J.2.28. dhcp-attr-number: DHCP server attributes (numeric) ........................................... 135
J.2.29. dhcp-attr-ip: DHCP server attributes (IP) .......................................................... 136
J.2.30. pppoe: PPPoE settings ................................................................................... 136
J.2.31. ppp-route: PPP routes .................................................................................... 137
J.2.32. ggsn: GTP GGSN settings ............................................................................. 138
J.2.33. route: Static routes ........................................................................................ 138
J.2.34. network: Locally originated networks ............................................................... 139
J.2.35. blackhole: Dead end networks ........................................................................ 139
J.2.36. loopback: Locally originated networks ............................................................. 140
J.2.37. namedbgpmap: Mapping and filtering rules of BGP prefixes ................................ 140
J.2.38. bgprule: Individual mapping/filtering rule ......................................................... 141
J.2.39. bgp: Overall BGP settings ............................................................................. 141
J.2.40. bgppeer: BGP peer definitions ........................................................................ 142
J.2.41. bgpmap: Mapping and filtering rules of BGP prefixes ......................................... 143