HP MSR SERIES User manual

HP MSR Router Series
W
eb-Based
Configuration Guide(V5)
Part number: 5998-8174
Software version: CMW520-R2513
Document
v
ersion: 6PW106-20150808

Legal and notice information
© Copyright 2015 Hewlett-Packard Development Company, L.P.
No part of this documentation may be reproduced or transmitted in any form or by any means without
prior written consent of Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS
MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or use
of this material.
The only warranties for HP products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an
additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.

i
Contents
Web overview······························································································································································ 1
Logging in to the Web interface······································································································································1
Logging out of the Web interface ···································································································································2
Introduction to the Web interface····································································································································2
User level············································································································································································4
Introduction to the Web-based NM functions················································································································4
Common Web interface elements································································································································ 18
Managing Web-based NM through CLI ····················································································································· 21
Enabling/disabling Web-based NM·················································································································· 21
Managing the current Web user ························································································································· 22
Configuration guidelines ··············································································································································· 22
Troubleshooting Web browser ····································································································································· 22
Cannot access the device through the Web interface ······················································································ 22
Displaying device information ··································································································································26
Displaying device information······································································································································ 27
Displaying broadband connection information ·········································································································· 27
Displaying 3G wireless card state ······························································································································· 27
Displaying LAN information·········································································································································· 28
Displaying WLAN information ····································································································································· 28
Displaying service information ····································································································································· 28
Displaying recent system logs······································································································································· 28
Managing integrated services ······································································································································ 29
Basic services configuration ······································································································································30
Configuring basic services············································································································································ 30
Entering the homepage of basic configuration wizard····················································································· 30
Setting WAN interface parameters····················································································································· 30
Setting LAN interface parameters························································································································ 39
Setting WLAN interface parameters ··················································································································· 40
Validating the basic services configuration········································································································ 41
Configuring WAN interfaces····································································································································43
Configuring an Ethernet interface ································································································································ 43
Configuring an SA interface········································································································································· 46
Configuring an ADSL/G.SHDSL interface··················································································································· 48
Overview································································································································································ 48
Configuration procedure ······································································································································ 48
Configuring a CE1/PRI interface ································································································································· 51
Overview································································································································································ 51
Configuration procedure ······································································································································ 52
Configuring a CT1/PRI interface·································································································································· 54
Displaying interface information and statistics ··········································································································· 55
Configuring VLANs····················································································································································57
Overview········································································································································································· 57
Configuring a VLAN and its VLAN interface ·············································································································· 57
Recommended configuration procedures ··········································································································· 57
Creating a VLAN and its VLAN interface··········································································································· 58
Configuring VLAN member ports ························································································································ 59
Configuring parameters for a VLAN interface ··································································································· 59

ii
Configuration guidelines ··············································································································································· 61
Wireless configuration overview ······························································································································62
Overview········································································································································································· 62
Configuration task list ···················································································································································· 62
Configuring wireless services····································································································································63
Configuring wireless access service····························································································································· 63
Creating a wireless access service······················································································································ 63
Configuring clear type wireless service ·············································································································· 64
Configuring crypto type wireless service············································································································ 71
Binding an AP radio to a wireless service·········································································································· 76
Security parameter dependencies ······················································································································· 77
Displaying wireless access service······························································································································· 78
Displaying wireless service··································································································································· 78
Displaying client ···················································································································································· 81
Displaying RF ping information ··························································································································· 84
Wireless access service configuration examples········································································································ 85
Wireless service configuration example············································································································· 85
Access service-based VLAN configuration example·························································································· 87
PSK authentication configuration example ········································································································· 89
Local MAC authentication configuration example····························································································· 91
Remote MAC authentication configuration example························································································· 93
Remote 802.1X authentication configuration example····················································································· 96
802.11n configuration example ·······················································································································100
Client mode ····························································································································································· 102
Enabling the client mode·············································································································································102
Connecting the wireless service·························································································································103
Displaying statistics ·············································································································································104
Client mode configuration example···························································································································105
Configuring radios·················································································································································· 107
Configuring data transmit rates··································································································································111
Configuring 802.11a/802.11b/802.11g rates····························································································111
Configuring 802.11n MCS································································································································112
Displaying radio···························································································································································112
Displaying WLAN services bound to a radio ··································································································112
Displaying detailed radio information ··············································································································113
Configuring WLAN security ··································································································································· 115
Blacklist and white list··················································································································································115
Configuring the blacklist and white list functions ·····································································································115
Configuring dynamic blacklist ···························································································································115
Configuring static blacklist ·································································································································116
Configuring white list ··········································································································································117
Configuring user isolation ···········································································································································117
Configuring WLAN QoS········································································································································ 119
Configuring wireless QoS ···········································································································································119
Enabling wireless QoS ·······································································································································119
Setting the SVP service········································································································································119
Setting CAC admission policy ···························································································································120
Setting radio EDCA parameters for APs ···········································································································121
Setting EDCA parameters for wireless clients ··································································································122
Displaying radio statistics···································································································································123
Displaying client statistics ···································································································································125

iii
Setting rate limiting ·············································································································································126
Wireless QoS configuration example························································································································127
CAC service configuration example ·················································································································127
Static rate limiting configuration example ········································································································129
Dynamic rate limiting configuration example ··································································································130
Configuring advanced settings ······························································································································ 132
Setting a district code ··················································································································································132
Channel busy test·························································································································································132
Managing a 3G modem ········································································································································ 134
Displaying 3G modem information····························································································································134
Configuring the cellular interface ·······························································································································137
Managing the PIN ·······················································································································································138
Rebooting the 3G modem···········································································································································138
Configuring NAT····················································································································································· 140
Overview·······································································································································································140
Recommended configuration procedure····················································································································140
Configuring dynamic NAT··········································································································································140
Configuring a DMZ host ·············································································································································142
Creating a DMZ host ··········································································································································142
Enabling DMZ host on an interface ··················································································································142
Configuring an internal server····································································································································143
Enabling application layer protocol check················································································································145
Configuring connection limit·······································································································································145
NAT configuration examples······································································································································146
Internal hosts accessing public network configuration example ····································································146
Internal server configuration example···············································································································148
Configuring access control····································································································································· 152
Configuration procedure·············································································································································152
Access control configuration example·······················································································································153
Configuring URL filtering········································································································································· 155
Configuration procedure·············································································································································155
URL filtering configuration example ···························································································································156
Configuring attack protection································································································································· 158
Overview·······································································································································································158
Blacklist function ··················································································································································158
Intrusion detection function·································································································································158
Configuring the blacklist function·······························································································································160
Recommended configuration procedure···········································································································160
Enabling the blacklist function ···························································································································161
Adding a blacklist entry manually·····················································································································161
Viewing blacklist entries ·····································································································································162
Configuring intrusion detection ··································································································································162
Attack protection configuration examples ·················································································································164
Attack protection configuration example for MSR900/20-1X·······································································164
For MSR20/30/50/93X/1000 routers···········································································································167
Configuring application control····························································································································· 171
Recommended configuration procedure····················································································································171
Loading applications···········································································································································171
Configuring a custom application ·····················································································································172
Enabling application control······························································································································173

iv
Application control configuration example ···············································································································174
Webpage redirection configuration······················································································································ 176
Overview·······································································································································································176
Configuring webpage redirection······························································································································176
Configuring routes ·················································································································································· 178
Overview·······································································································································································178
Creating an IPv4 static route·······································································································································178
Displaying the active route table································································································································179
IPv4 static route configuration example·····················································································································180
Network requirements·········································································································································180
Configuration considerations ·····························································································································181
Configuration procedure ····································································································································181
Configuration guidelines ·············································································································································183
Configuring user-based load sharing ···················································································································· 184
Overview·······································································································································································184
Configuration procedure·············································································································································184
Configuring traffic ordering ··································································································································· 186
Overview·······································································································································································186
Recommended configuration procedure····················································································································186
Setting the traffic ordering interval·····························································································································187
Specifying the traffic ordering mode ·························································································································187
Displaying internal interface traffic ordering statistics ·····························································································187
Displaying external interface traffic ordering statistics ····························································································188
Configuring DNS ···················································································································································· 189
Overview·······································································································································································189
Recommended configuration procedure····················································································································189
Configuring dynamic domain name resolution································································································189
Configuring DNS proxy······································································································································190
Enabling dynamic domain name resolution··············································································································190
Enabling DNS proxy····················································································································································190
Clearing the dynamic domain name cache··············································································································191
Specifying a DNS server·············································································································································191
Configuring a domain name suffix ····························································································································191
Domain name resolution configuration example······································································································192
Configuring DDNS·················································································································································· 197
Overview·······································································································································································197
Configuration prerequisites·········································································································································198
Configuration procedure·············································································································································198
DDNS configuration example·····································································································································199
Configuring DHCP ·················································································································································· 202
Introduction to DHCP ···················································································································································202
Recommended configuration procedure····················································································································203
Configuring the DHCP server·····························································································································203
Configuring the DHCP relay agent····················································································································203
Configuring the DHCP client······························································································································204
Configuration guidelines ·············································································································································204
Enabling DHCP ····························································································································································204
Configuring DHCP interface setup ·····························································································································205
Configuring a static address pool for the DHCP server···························································································206
Configuring a dynamic address pool for the DHCP server·····················································································208

v
Configuring IP addresses excluded from dynamic allocation·················································································210
Configuring a DHCP server group·····························································································································211
DHCP configuration examples····································································································································212
DHCP configuration example without DHCP relay agent···············································································213
DHCP relay agent configuration example········································································································220
Configuring ACLs···················································································································································· 226
Overview·······································································································································································226
Recommended IPv4 ACL configuration procedure···································································································226
Configuration guidelines ·············································································································································227
Adding an IPv4 ACL ····················································································································································227
Configuring a rule for a basic IPv4 ACL ···················································································································228
Configuring a rule for an advanced IPv4 ACL ·········································································································229
Configuring a rule for an Ethernet frame header ACL·····························································································232
Configuring QoS····················································································································································· 235
Overview·······································································································································································235
Subnet limit···························································································································································235
Advanced limit·····················································································································································235
Advanced queue ·················································································································································235
Configuring subnet limit ··············································································································································236
Configuring advanced limit ········································································································································237
Configuring advanced queue·····································································································································240
Configuring interface bandwidth·······················································································································240
Configuring bandwidth guarantee····················································································································241
QoS configuration examples ······································································································································244
Subnet limit configuration example ···················································································································244
Advanced queue configuration example··········································································································245
Appendix Packet precedences ···································································································································248
Configuring SNMP·················································································································································· 251
Overview·······································································································································································251
SNMP agent configuration task list····························································································································251
Enabling the SNMP agent function ···················································································································252
Configuring an SNMP view ·······························································································································254
Configuring an SNMP community·····················································································································256
Configuring an SNMP group·····························································································································257
Configuring an SNMP user ································································································································258
Configuring the SNMP trap function·················································································································260
Displaying SNMP packet statistics ····················································································································262
SNMPv1/v2c configuration example························································································································262
SNMPv3 configuration example ································································································································266
Configuring bridging·············································································································································· 272
Overview·······································································································································································272
Major functionalities of bridges·························································································································272
VLAN transparency ·············································································································································276
Configuring bridging···················································································································································276
Recommended basic bridging configuration procedure·················································································276
Enabling a bridge set ·········································································································································276
Adding an interface to a bridge set··················································································································277
Bridging configuration example·································································································································278
Configuring user groups········································································································································· 282
User group configuration task list·······························································································································282
Configuring a user group···································································································································283
Configuring a user ··············································································································································283

vi
Configuring access control·································································································································284
Configuring application control·························································································································285
Configuring bandwidth control··························································································································286
Configuring packet filtering································································································································287
Synchronizing user group configuration for wan interfaces···········································································289
User group configuration example·····························································································································289
Configuring MSTP··················································································································································· 297
Introduction to STP ·······················································································································································297
STP protocol packets ···········································································································································297
Basic concepts in STP··········································································································································297
How STP works····················································································································································298
Introduction to RSTP ·····················································································································································304
Introduction to MSTP····················································································································································304
MSTP features ······················································································································································304
MSTP basic concepts ··········································································································································305
How MSTP works ················································································································································309
MSTP implementation on devices······················································································································309
Protocols and standards ·····································································································································309
Configuration restrictions and guidelines··················································································································309
Recommended MSTP configuration procedure·········································································································310
Configuring an MST region ········································································································································310
Configuring MSTP globally ·········································································································································312
Configuring MSTP on a port·······································································································································315
MSTP configuration example······································································································································317
Configuring RADIUS ··············································································································································· 322
Overview·······································································································································································322
Configuring a RADIUS scheme···································································································································322
Configuring common parameters······················································································································323
Adding RADIUS servers ······································································································································326
RADIUS configuration example ··································································································································327
Configuration guidelines ·············································································································································332
Configuring login control ······································································································································· 334
Configuration procedure·············································································································································334
Login control configuration example··························································································································335
Network requirements·········································································································································335
Configuring a login control rule so Host A cannot Telnet to Router ······························································335
Configuring a login control rule so Host B cannot access Router through the Web····································336
Configuring ARP······················································································································································ 338
Overview·······································································································································································338
Gratuitous ARP·····················································································································································338
Displaying ARP entries·················································································································································338
Creating a static ARP entry ·········································································································································339
Removing ARP entries ··················································································································································339
Enabling learning of dynamic ARP entries················································································································340
Configuring gratuitous ARP·········································································································································341
Static ARP configuration example ······························································································································341
Configuring ARP attack protection························································································································· 346
Overview·······································································································································································346
Configuring periodic sending of gratuitous ARP packets ························································································346
Configuring ARP automatic scanning ························································································································347
Configuring fixed ARP ·················································································································································348

vii
Configuring IPsec VPN ··········································································································································· 350
Overview·······································································································································································350
Recommended configuration procedure····················································································································350
Configuring an IPsec connection································································································································351
Displaying IPsec VPN monitoring information ··········································································································358
IPsec VPN configuration example ······························································································································359
Configuration guidelines ·············································································································································361
Configuring L2TP····················································································································································· 363
Enabling L2TP ·······························································································································································364
Adding an L2TP group ················································································································································364
Displaying L2TP tunnel information····························································································································370
Client-initiated VPN configuration example ··············································································································370
Configuring GRE····················································································································································· 375
Overview·······································································································································································375
Configuring a GRE over IPv4 tunnel ··························································································································375
Recommended configuration procedure···········································································································375
Creating a GRE tunnel········································································································································375
GRE over IPv4 tunnel configuration example············································································································377
SSL VPN overview··················································································································································· 384
How SSL VPN works····················································································································································384
Advantages of SSL VPN ··············································································································································385
Configuring SSL VPN gateway ······························································································································ 386
Recommended configuration procedure····················································································································386
Configuring the SSL VPN service ·······························································································································387
Configuring Web proxy server resources ·················································································································389
Configuring TCP application resources ·····················································································································391
Configuring a remote access service resource·································································································392
Configuring a desktop sharing service resource ·····························································································393
Configuring an email service resource ·············································································································394
Configuring a Notes service resource···············································································································395
Configuring a common TCP service resource ··································································································397
Configuring IP network resources·······························································································································398
Recommended configuration procedure···········································································································398
Configuring global parameters··························································································································398
Configuring host resources·································································································································399
Configuring a user-IP binding ····························································································································401
Configuring a predefined domain name··········································································································402
Configuring a resource group ····································································································································403
Configuring local users················································································································································405
Adding a local user manually····························································································································405
Importing local users in bulk ······························································································································407
Configuring a user group············································································································································408
Viewing user information ············································································································································410
Viewing online user information ························································································································410
Logging out an online user·································································································································410
Viewing history user information ·······················································································································410
Performing basic configurations for the SSL VPN domain·······················································································411
Configuring the domain policy ··························································································································411
Configuring the caching policy ·························································································································413
Configuring a bulletin ·········································································································································413
Configuring authentication policies ···························································································································414
Configuring local authentication ·······················································································································415

viii
Configuring RADIUS authentication ··················································································································415
Configuring LDAP authentication·······················································································································416
Configuring AD authentication ··························································································································418
Configuring combined authentication···············································································································419
Configuring a security policy······································································································································420
Customizing the SSL VPN user interface ···················································································································424
Customizing the SSL VPN interface partially····································································································424
Customizing the SSL VPN interface fully···········································································································426
User access to SSL VPN·········································································································································· 427
Logging in to the SSL VPN service interface ·············································································································427
Accessing SSL VPN resources·····································································································································428
Getting help information ·············································································································································429
Changing the login password ····································································································································429
SSL VPN configuration example ···························································································································· 431
Network requirements ·················································································································································431
Configuration prerequisites·········································································································································431
Configuration procedure·············································································································································432
Configuring the SSL VPN service·······················································································································432
Configuring SSL VPN resources·························································································································435
Configuring SSL VPN users ································································································································440
Configuring an SSL VPN domain ······················································································································443
Verifying the configuration··········································································································································445
Managing certificates············································································································································· 448
Overview·······································································································································································448
Recommended configuration procedure····················································································································448
Recommended configuration procedure for manual request··········································································449
Recommended configuration procedure for automatic request······································································450
Creating a PKI entity····················································································································································451
Creating a PKI domain ················································································································································452
Generating an RSA key pair·······································································································································455
Destroying the RSA key pair ·······································································································································456
Retrieving and displaying a certificate ······················································································································456
Requesting a local certificate ······································································································································458
Retrieving and displaying a CRL ································································································································459
PKI configuration examples·········································································································································459
Certificate request from a Windows 2003 CA server ····················································································459
Certificate request from an RSA Keon CA server ····························································································463
IKE negotiation with RSA digital signature·······································································································467
Configuration guidelines ·············································································································································473
Managing the system·············································································································································· 474
Configuring Web management··································································································································474
Managing the configuration ·······································································································································474
Saving the configuration·····································································································································474
Restoring factory defaults ···································································································································475
Backing up configuration ···································································································································475
Restoring configuration·······································································································································476
Backing up and restoring device files through the USB port··········································································477
Rebooting the device ···················································································································································478
Managing services·······················································································································································479
Managing users ···························································································································································481
Creating a user····················································································································································481
Setting the super password ································································································································482