FireBrick FB2700 User manual

FireBrick FB2700
User Manual
FB2700 Versatile Network Appliance

FireBrick FB2700 User Manual
This User Manual documents Software version V1.44.000
Copyright © 2012-2015 FireBrick Ltd.

iv
Table of Contents
Preface .................................................................................................................................. xxi
1. Introduction .......................................................................................................................... 1
1.1. The FB2700 ............................................................................................................... 1
1.1.1. Where do I start? .............................................................................................. 1
1.1.2. What can it do? ................................................................................................ 1
1.1.3. Ethernet port capabilities .................................................................................... 2
1.1.4. Differences between the devices in the FB2x00 series .............................................. 2
1.1.5. Software features .............................................................................................. 2
1.1.6. Migration from previous FireBrick models ............................................................ 2
1.2. About this Manual ....................................................................................................... 3
1.2.1. Version ........................................................................................................... 3
1.2.2. Intended audience ............................................................................................. 3
1.2.3. Technical details ............................................................................................... 3
1.2.4. Document style ................................................................................................. 3
1.2.5. Document conventions ....................................................................................... 4
1.2.6. Comments and feedback .................................................................................... 4
1.3. Additional Resources ................................................................................................... 4
1.3.1. Technical Support ............................................................................................. 4
1.3.2. IRC Channel .................................................................................................... 5
1.3.3. Application Notes ............................................................................................. 5
1.3.4. White Papers .................................................................................................... 5
1.3.5. Training Courses ............................................................................................... 5
2. Getting Started ...................................................................................................................... 6
2.1. IP addressing .............................................................................................................. 6
2.2. Accessing the web-based user interface ........................................................................... 6
2.2.1. Add a new user ................................................................................................ 7
3. Configuration ........................................................................................................................ 9
3.1. The Object Hierarchy ................................................................................................... 9
3.2. The Object Model ....................................................................................................... 9
3.2.1. Formal definition of the object model ................................................................. 10
3.2.2. Common attributes .......................................................................................... 10
3.3. Configuration Methods ............................................................................................... 10
3.4. Web User Interface Overview ...................................................................................... 10
3.4.1. User Interface layout ........................................................................................ 11
3.4.1.1. Customising the layout .......................................................................... 11
3.4.2. Config pages and the object hierarchy ................................................................. 12
3.4.2.1. Configuration categories ......................................................................... 12
3.4.2.2. Object settings ...................................................................................... 13
3.4.3. Navigating around the User Interface .................................................................. 15
3.4.4. Backing up / restoring the configuration .............................................................. 16
3.5. Configuration using XML ........................................................................................... 16
3.5.1. Introduction to XML ........................................................................................ 16
3.5.2. The root element - <config> ............................................................................. 17
3.5.3. Viewing or editing XML .................................................................................. 17
3.5.4. Example XML configuration ............................................................................. 17
3.6. Downloading/Uploading the configuration ...................................................................... 19
3.6.1. Download ...................................................................................................... 19
3.6.2. Upload .......................................................................................................... 20
4. System Administration .......................................................................................................... 21
4.1. User Management ...................................................................................................... 21
4.1.1. Login level ..................................................................................................... 21
4.1.2. Configuration access level ................................................................................ 22
4.1.3. Login idle timeout ........................................................................................... 22
4.1.4. Restricting user logins ...................................................................................... 22

FireBrick FB2700 User Manual
v
4.1.4.1. Restrict by IP address ............................................................................ 22
4.1.4.2. Logged in IP address ............................................................................. 23
4.1.4.3. Restrict by profile ................................................................................. 23
4.1.5. Password change ............................................................................................. 23
4.1.6. One Time Password (OTP) ............................................................................... 23
4.2. General System settings .............................................................................................. 24
4.2.1. System name (hostname) .................................................................................. 24
4.2.2. Administrative details ...................................................................................... 24
4.2.3. System-level event logging control ..................................................................... 24
4.2.4. Home page web links ...................................................................................... 24
4.2.5. Password hashing ............................................................................................ 25
4.2.6. OTP seed hashing ........................................................................................... 25
4.3. Software Upgrades ..................................................................................................... 26
4.3.1. Software release types ...................................................................................... 26
4.3.1.1. Breakpoint releases ............................................................................... 26
4.3.2. Identifying current software version .................................................................... 27
4.3.3. Internet-based upgrade process .......................................................................... 27
4.3.3.1. Manually initiating upgrades ................................................................... 27
4.3.3.2. Controlling automatic software updates ..................................................... 28
4.3.4. Manual upgrade .............................................................................................. 28
4.4. Boot Process ............................................................................................................. 29
4.4.1. LED indications .............................................................................................. 29
4.4.1.1. Power LED status indications ................................................................. 29
4.4.1.2. Port LEDs ........................................................................................... 29
5. Event Logging ..................................................................................................................... 30
5.1. Overview .................................................................................................................. 30
5.1.1. Log targets ..................................................................................................... 30
5.1.1.1. Logging to Flash memory ...................................................................... 30
5.1.1.2. Logging to the Console .......................................................................... 31
5.2. Enabling logging ....................................................................................................... 31
5.3. Logging to external destinations ................................................................................... 31
5.3.1. Syslog ........................................................................................................... 31
5.3.2. Email ............................................................................................................ 32
5.3.2.1. E-mail process logging .......................................................................... 33
5.4. Factory reset configuration log targets ........................................................................... 33
5.5. Performance .............................................................................................................. 33
5.6. Viewing logs ............................................................................................................. 33
5.6.1. Viewing logs in the User Interface ..................................................................... 33
5.6.2. Viewing logs in the CLI environment ................................................................. 34
5.7. System-event logging ................................................................................................. 34
5.8. Using Profiles ........................................................................................................... 34
6. Interfaces and Subnets .......................................................................................................... 35
6.1. Relationship between Interfaces and Physical Ports .......................................................... 35
6.1.1. Port groups .................................................................................................... 35
6.1.2. Interfaces ....................................................................................................... 35
6.2. Defining port groups .................................................................................................. 36
6.3. Defining an interface .................................................................................................. 36
6.3.1. Defining subnets ............................................................................................. 37
6.3.1.1. Source filtering ..................................................................................... 38
6.3.1.2. Using DHCP to configure a subnet .......................................................... 38
6.3.2. Setting up DHCP server parameters .................................................................... 38
6.3.2.1. Fixed/Static DHCP allocations ................................................................ 39
6.3.2.2. Restricted allocations ............................................................................. 40
6.3.2.3. Special DHCP options ........................................................................... 41
6.3.3. DHCP Relay Agent ......................................................................................... 41
6.4. Physical port settings .................................................................................................. 41

FireBrick FB2700 User Manual
vi
6.4.1. Disabling auto-negotiation ................................................................................ 42
6.4.2. Setting port speed ............................................................................................ 42
6.4.3. Setting duplex mode ........................................................................................ 42
6.4.4. Defining port LED functions ............................................................................. 42
7. Session Handling ................................................................................................................. 44
7.1. Routing vs. Firewalling ............................................................................................... 44
7.2. Session Tracking ....................................................................................................... 44
7.2.1. Session termination .......................................................................................... 45
7.3. Session Rules ............................................................................................................ 45
7.3.1. Overview ....................................................................................................... 45
7.3.2. Processing flow ............................................................................................... 46
7.3.3. Defining Rule-Sets and Rules ............................................................................ 49
7.3.3.1. Recommended method of implementing firewalling .................................... 50
7.3.3.2. Changes to session traffic ....................................................................... 51
7.3.3.3. Graphing and traffic shaping ................................................................... 52
7.3.3.4. Configuring session time-outs ................................................................. 52
7.3.3.5. Load balancing ..................................................................................... 52
7.4. Network Address Translation ....................................................................................... 53
7.4.1. When to use NAT ........................................................................................... 53
7.4.2. NAT ALGs .................................................................................................... 53
7.4.3. Setting NAT in rules ........................................................................................ 54
7.4.4. What NAT does .............................................................................................. 54
7.4.5. NAT with PPPoE ............................................................................................ 54
7.4.6. NAT with Dongles .......................................................................................... 55
7.4.7. NAT with other types of external routing ............................................................ 55
7.4.8. Mixing NAT and non NAT ............................................................................... 55
7.4.9. Carrier grade NAT .......................................................................................... 55
7.4.10. Using NAT setting on subnets ......................................................................... 56
8. Routing .............................................................................................................................. 57
8.1. Routing logic ............................................................................................................ 57
8.2. Routing targets .......................................................................................................... 58
8.2.1. Subnet routes .................................................................................................. 58
8.2.2. Routing to an IP address (gateway route) ............................................................. 58
8.2.3. Special targets ................................................................................................ 59
8.3. Dynamic route creation / deletion ................................................................................. 59
8.4. Routing tables ........................................................................................................... 59
8.5. Bonding ................................................................................................................... 59
8.6. Route overrides ......................................................................................................... 60
9. Profiles ............................................................................................................................... 61
9.1. Overview .................................................................................................................. 61
9.2. Creating/editing profiles .............................................................................................. 61
9.2.1. Timing control ................................................................................................ 61
9.2.2. Tests ............................................................................................................. 62
9.2.2.1. General tests ........................................................................................ 62
9.2.2.2. Time/date tests ..................................................................................... 62
9.2.2.3. Ping tests ............................................................................................. 62
9.2.3. Inverting overall test result ................................................................................ 63
9.2.4. Manual override .............................................................................................. 63
10. Traffic Shaping .................................................................................................................. 64
10.1. Graphs and Shapers .................................................................................................. 64
10.1.1. Graphs ......................................................................................................... 64
10.1.2. Shapers ........................................................................................................ 65
10.1.3. Ad hoc shapers ............................................................................................. 65
10.1.4. Long term shapers ......................................................................................... 65
10.2. Multiple shapers ...................................................................................................... 66
10.3. Basic principles ....................................................................................................... 66

FireBrick FB2700 User Manual
vii
11. PPPoE .............................................................................................................................. 67
11.1. Types of DSL line and router in the United Kingdom ..................................................... 67
11.2. Definining PPPoE links ............................................................................................. 68
11.2.1. IPv6 ............................................................................................................ 68
11.2.2. Additional options ......................................................................................... 68
11.2.2.1. MTU and TCP fix ............................................................................... 68
11.2.2.2. Service and ac-name ............................................................................ 69
11.2.2.3. Logging ............................................................................................. 69
11.2.2.4. Speed and graphs ................................................................................ 69
12. Tunnels ............................................................................................................................. 70
12.1. IPsec (IP Security) ................................................................................................... 70
12.1.1. Introduction .................................................................................................. 70
12.1.1.1. Integrity checking ................................................................................ 70
12.1.1.2. Encryption ......................................................................................... 70
12.1.1.3. Authentication .................................................................................... 71
12.1.1.4. IKE ................................................................................................... 71
12.1.1.5. Manual Keying ................................................................................... 71
12.1.1.6. Identities and the Authentication Mechanism ............................................ 72
12.1.2. Setting up IPsec connections ........................................................................... 72
12.1.2.1. Global IPsec parameters ....................................................................... 72
12.1.2.2. IKE proposals ..................................................................................... 73
12.1.2.3. IKE roaming IP pools .......................................................................... 73
12.1.2.4. IKE connections .................................................................................. 73
12.1.2.4.1. IKE connection mode and type ................................................... 73
12.1.2.4.2. IKE and IPsec proposal lists ....................................................... 73
12.1.2.4.3. Authentication and IKE identities ................................................ 74
12.1.2.4.4. IP addresses ............................................................................. 74
12.1.2.4.5. Road Warrior connections .......................................................... 75
12.1.2.4.6. Routing ................................................................................... 75
12.1.2.4.7. Other parameters ...................................................................... 75
12.1.2.5. Setting up Manual Keying .................................................................... 75
12.1.2.5.1. IP endpoints ............................................................................. 76
12.1.2.5.2. Algorithms and keys ................................................................. 76
12.1.2.5.3. Routing ................................................................................... 76
12.1.2.5.4. Mode ...................................................................................... 76
12.1.2.5.5. Other parameters ...................................................................... 77
12.1.3. Using EAP with IPsec/IKE ............................................................................. 77
12.1.4. Using certificates with IPsec/IKE ..................................................................... 77
12.1.4.1. Creating certificates ............................................................................. 79
12.1.5. Choice of algorithms ...................................................................................... 79
12.1.6. NAT Traversal .............................................................................................. 80
12.1.7. Configuring a Road Warrior server ................................................................... 81
12.1.8. Connecting to non-FireBrick devices ................................................................. 82
12.1.8.1. Using StrongSwan on Linux ................................................................. 82
12.1.8.2. Setting up a Road Warrior VPN on an Android client ................................ 83
12.1.8.3. Setting up a Road Warrior VPN on an iOS (iPhone/iPad) client .................... 84
12.1.8.4. Manual keying using Linux ipsec-tools ................................................... 84
12.2. FB105 tunnels ......................................................................................................... 85
12.2.1. Tunnel wrapper packets .................................................................................. 86
12.2.2. Setting up a tunnel ......................................................................................... 86
12.2.3. Viewing tunnel status ..................................................................................... 87
12.2.4. Dynamic routes ............................................................................................. 87
12.2.5. Tunnel bonding ............................................................................................. 87
12.2.6. Tunnels and NAT .......................................................................................... 87
12.2.6.1. FB2700 doing NAT ............................................................................. 88
12.2.6.2. Another device doing NAT ................................................................... 88

FireBrick FB2700 User Manual
viii
12.3. Ether tunnelling ....................................................................................................... 88
13. USB Port .......................................................................................................................... 90
13.1. USB configuration .................................................................................................... 90
13.1.1. 3G dongle configuration ................................................................................. 90
14. System Services ................................................................................................................. 91
14.1. Protecting the FB2700 .............................................................................................. 91
14.2. Common settings ..................................................................................................... 91
14.3. HTTP Server configuration ........................................................................................ 92
14.3.1. Access control ............................................................................................... 92
14.3.1.1. Trusted addresses ................................................................................ 92
14.4. Telnet Server configuration ........................................................................................ 93
14.4.1. Access control ............................................................................................... 93
14.5. DNS configuration ................................................................................................... 93
14.5.1. Blocking DNS names ..................................................................................... 93
14.5.2. Local DNS responses ..................................................................................... 93
14.5.3. Auto DHCP DNS .......................................................................................... 94
14.6. NTP configuration .................................................................................................... 94
14.7. SNMP configuration ................................................................................................. 94
14.8. RADIUS configuration .............................................................................................. 94
14.8.1. RADIUS server (platform RADIUS) ................................................................. 94
14.8.2. RADIUS client .............................................................................................. 94
14.8.2.1. RADIUS client settings ........................................................................ 95
14.8.2.2. Server blacklisting ............................................................................... 95
15. Network Diagnostic Tools .................................................................................................... 96
15.1. Firewalling check ..................................................................................................... 96
15.2. Access check ........................................................................................................... 97
15.3. Packet Dumping ...................................................................................................... 97
15.3.1. Dump parameters ........................................................................................... 98
15.3.2. Security settings required ................................................................................ 98
15.3.3. IP address matching ....................................................................................... 99
15.3.4. Packet types .................................................................................................. 99
15.3.5. Snaplen specification ...................................................................................... 99
15.3.6. Using the web interface .................................................................................. 99
15.3.7. Using an HTTP client ................................................................................... 100
15.3.7.1. Example using curl and tcpdump .......................................................... 100
16. VRRP ............................................................................................................................. 101
16.1. Virtual Routers ...................................................................................................... 101
16.2. Configuring VRRP ................................................................................................. 102
16.2.1. Advertisement Interval .................................................................................. 102
16.2.2. Priority ....................................................................................................... 102
16.3. Using a virtual router .............................................................................................. 102
16.4. VRRP versions ...................................................................................................... 102
16.4.1. VRRP version 2 .......................................................................................... 102
16.4.2. VRRP version 3 .......................................................................................... 103
16.5. Compatibility ......................................................................................................... 103
17. VoIP ............................................................................................................................... 104
17.1. What is VoIP? ....................................................................................................... 104
17.2. Registration and Proxies .......................................................................................... 104
17.2.1. Registrar ..................................................................................................... 104
17.2.2. Proxy ......................................................................................................... 104
17.3. Home/office phone system ....................................................................................... 105
17.4. Network Address Translation .................................................................................... 105
17.5. Number plan .......................................................................................................... 106
17.6. Telephone handsets ................................................................................................. 106
17.7. VoIP call carriers ................................................................................................... 107
17.8. Hunt groups ........................................................................................................... 108

FireBrick FB2700 User Manual
ix
17.8.1. Ring Type .................................................................................................. 108
17.8.2. Ring order .................................................................................................. 109
17.8.3. Overflow .................................................................................................... 109
17.8.4. Out of hours ............................................................................................... 109
17.9. Call pickup/steal ..................................................................................................... 109
17.10. Busy lamp field .................................................................................................... 110
17.11. Using RADIUS .................................................................................................... 110
17.11.1. RADIUS accounting ................................................................................... 110
17.11.2. RADIUS authentication ............................................................................... 110
17.11.2.1. Call routing by RADIUS ................................................................... 111
17.12. Call recording ...................................................................................................... 112
17.13. Voicemail and IVR services ................................................................................... 113
17.14. Call Data Records ................................................................................................. 113
17.15. Technical details ................................................................................................... 114
17.16. Custom tones ....................................................................................................... 114
18. BGP ............................................................................................................................... 116
18.1. What is BGP? ........................................................................................................ 116
18.2. BGP Setup ............................................................................................................ 116
18.2.1. Overview .................................................................................................... 116
18.2.2. Standards .................................................................................................... 116
18.2.3. Simple example setup ................................................................................... 117
18.2.4. Peer type .................................................................................................... 117
18.2.5. Route filtering ............................................................................................. 118
18.2.5.1. Matching attributes ............................................................................ 118
18.2.5.2. Action attributes ................................................................................ 118
18.2.6. Well known community tags .......................................................................... 119
18.2.7. Announcing black hole routes ........................................................................ 119
18.2.8. Announcing dead end routes .......................................................................... 120
18.2.9. Bad optional path attributes ........................................................................... 120
18.2.10. <network> element ..................................................................................... 120
18.2.11. <route>, <subnet> and other elements ............................................................ 120
18.2.12. Route feasibility testing ............................................................................... 120
18.2.13. Diagnostics ................................................................................................ 121
18.2.14. Router shutdown ........................................................................................ 121
18.2.15. TTL security ............................................................................................. 121
19. OSPF .............................................................................................................................. 122
19.1. What is OSPF? ...................................................................................................... 122
19.2. OSPF Setup ........................................................................................................... 122
19.2.1. Overview .................................................................................................... 122
19.2.2. Standards .................................................................................................... 122
19.2.3. Simple example setup ................................................................................... 123
19.2.4. <ospf> configelement ................................................................................... 123
20. Internet Service Providers ................................................................................................... 124
20.1. Background ........................................................................................................... 124
20.1.1. How it all began .......................................................................................... 124
20.1.2. Point to Point Protocol .................................................................................. 124
20.1.3. L2TP ......................................................................................................... 124
20.1.4. Broadband .................................................................................................. 125
20.1.5. RADIUS ..................................................................................................... 125
20.1.6. BGP .......................................................................................................... 125
20.2. Incoming L2TP connections ..................................................................................... 125
20.3. The importance of CQM graphs ................................................................................ 126
20.4. Authentication ........................................................................................................ 126
20.5. Accounting ............................................................................................................ 127
20.6. RADIUS Control messages ...................................................................................... 127
20.7. PPPoE .................................................................................................................. 127

FireBrick FB2700 User Manual
x
20.8. Typical configuration .............................................................................................. 127
20.8.1. Interlink subnet ............................................................................................ 127
20.8.2. BGP with carrier .......................................................................................... 128
20.8.3. RADIUS session steering .............................................................................. 128
20.8.4. L2TP endpoints ........................................................................................... 129
20.8.5. ISP RADIUS ............................................................................................... 129
21. Command Line Interface .................................................................................................... 130
A. Factory Reset Procedure ...................................................................................................... 131
B. CIDR and CIDR Notation ................................................................................................... 133
C. MAC Addresses usage ........................................................................................................ 135
C.1. Multiple MAC addresses? ......................................................................................... 135
C.2. How the FireBrick allocates MAC addresses ................................................................ 136
C.2.1. Interface ...................................................................................................... 136
C.2.2. Subnet ......................................................................................................... 136
C.2.3. PPPoE ......................................................................................................... 136
C.2.4. Base MAC ................................................................................................... 136
C.2.5. Running out of MACs ................................................................................... 137
C.3. MAC address on label .............................................................................................. 137
C.4. Using with a DHCP server ........................................................................................ 138
D. VLANs : A primer ............................................................................................................. 139
E. Supported L2TP Attribute/Value Pairs ................................................................................... 140
E.1. Start-Control-Connection-Request ............................................................................... 140
E.2. Start-Control-Connection-Reply .................................................................................. 140
E.3. Start-Control-Connection-Connected ........................................................................... 141
E.4. Stop-Control-Connection-Notification .......................................................................... 141
E.5. Hello ..................................................................................................................... 141
E.6. Incoming-Call-Request ............................................................................................. 141
E.7. Incoming-Call-Reply ................................................................................................ 142
E.8. Incoming-Call-Connected .......................................................................................... 142
E.9. Outgoing-Call-Request .............................................................................................. 142
E.10. Outgoing-Call-Reply ............................................................................................... 143
E.11. Outgoing-Call-Connected ........................................................................................ 143
E.12. Call-Disconnect-Notify ............................................................................................ 143
E.13. WAN-Error-Notify ................................................................................................. 143
E.14. Set-Link-Info ......................................................................................................... 143
E.15. Notes ................................................................................................................... 144
E.15.1. BT specific notes ......................................................................................... 144
E.15.2. IP over LCP ............................................................................................... 144
F. Supported RADIUS Attribute/Value Pairs for L2TP operation .................................................... 145
F.1. Authentication request .............................................................................................. 145
F.2. Authentication response ............................................................................................ 146
F.2.1. Accepted authentication .................................................................................. 146
F.2.1.1. Prefix Delegation ................................................................................ 147
F.2.2. Rejected authentication ................................................................................... 148
F.3. Accounting Start ...................................................................................................... 148
F.4. Accounting Interim .................................................................................................. 149
F.5. Accounting Stop ...................................................................................................... 150
F.6. Disconnect .............................................................................................................. 150
F.7. Change of Authorisation ........................................................................................... 150
F.8. Filter ID ................................................................................................................. 151
F.9. Notes ..................................................................................................................... 152
F.9.1. L2TP relay ................................................................................................... 152
F.9.2. LCP echo and CQM graphs ............................................................................ 153
F.9.3. IP over LCP ................................................................................................. 153
F.9.4. Closed User Group ........................................................................................ 153
F.9.5. Routing table ................................................................................................ 153