Nokia Network Voyager User manual

Voyager Reference Guide
Part No. N450820002 Rev A
Published December 2003

2Voyager Reference Guide
COPYRIGHT
©2003 Nokia. All rights reserved.
Rights reserved under the copyright laws of the United States.
RESTRICTED RIGHTS LEGEND
Use, duplication, or disclosure by the United States Government is subject to restrictions as set
forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at
DFARS 252.227-7013.
Notwithstanding any other license agreement that may pertain to, or accompany the delivery of,
this computer software, the rights of the United States Government regarding its use,
reproduction, and disclosure are as set forth in the Commercial Computer Software-Restricted
Rights clause at FAR 52.227-19.
IMPORTANT NOTE TO USERS
This software and hardware is provided by Nokia Inc. as is and any express or implied
warranties, including, but not limited to, implied warranties of merchantability and fitness for a
particular purpose are disclaimed. In no event shall Nokia, or its affiliates, subsidiaries or
suppliers be liable for any direct, indirect, incidental, special, exemplary, or consequential
damages (including, but not limited to, procurement of substitute goods or services; loss of use,
data, or profits; or business interruption) however caused and on any theory of liability, whether in
contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use
of this software, even if advised of the possibility of such damage.
Nokia reserves the right to make changes without further notice to any products herein.
TRADEMARKS
Nokia is a registered trademark of Nokia Corporation. Other products mentioned in this
document are trademarks or registered trademarks of their respective holders.
030114

Voyager Reference Guide 3
Nokia Contact Information
Corporate Headquarters
Regional Contact Information
Nokia Customer Support
Web Site http://www.nokia.com
Telephone [phone] or
1-650-625-2000
Fax [phone]
Mail
Address
Nokia Inc.
313 Fairchild Drive
Mountain View, California
94043-2215 USA
Americas Nokia Inc.
313 Fairchild Drive
Mountain View, CA 94043-2215
USA
Tel: [phone]
Outside USA and Canada: [phone]
email: ipsecurity.[email protected]
Europe,
Middle East,
and Africa
Nokia House, Summit Avenue
Southwood, Farnborough
Hampshire GU14 ONG UK
Tel: UK: [phone]
Tel: France: [phone]
email: ipsecurity.[email protected]
Asia-Pacific 438B Alexandra Road
#07-00 Alexandra Technopark
Singapore 119968
Tel: [phone]
email: ipsecurity[email protected]
Web Site: https://support.nokia.com/
Email: [email protected]
Americas Europe
Voice: 1-888-361-5030 or
1-613-271-6721
Voice: [phone]
Fax: [phone] Fax: [phone]
Asia-Pacific
Voice: [phone]
Fax: [phone]
031014

4Voyager Reference Guide

Voyager Reference Guide 5
Contents
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
How to Use Voyager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25
Command-Line Utility Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31
Monitoring and Configuring System Resources . . . . . . . . . . . . . . . . . . .33
Dynamic Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34
Static Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48
Configuring Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65
Ethernet Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .69
Gigabit Ethernet Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .75
Virtual LAN Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80
FDDI Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84
ISDN Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89
Token Ring Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .121
Point-to-Point Link over ATM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .128
IP over ATM (IPoA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136
Serial (V.35 and X.21) Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .143
T1(with built-in CSU/DSU) Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .152
E1 (with built-in CSU/DSU) Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .164
HSSI Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .174
Unnumbered Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .180
Cisco HDLC Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .188
Point-to-Point Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .189
Frame Relay Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192
Loopback Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .197
GRE Tunnels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .198
DVMRP Tunnels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .209
ARP Table Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .214
Configuring ARP for the ATM Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .217

6Voyager Reference Guide
Configuring Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
OSPF (Open Shortest Path First) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
RIP (Routing Information Protocol) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Protocol-Independent Multicast (PIM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
IGRP (Inter-Gateway Routing Protocol) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
DVMRP (Distance Vector Multicast Routing Protocol) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
IGMP (Internet Group Management Protocol) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Backup Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
Route Aggregation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
Route Rank . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
BGP (Border Gateway Protocol) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281
Route Redistribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325
Configuring Traffic Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
Configuring Clustering in IPSO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343
Configuring Access Control Lists (ACL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402
Configuring Access Control List Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407
Configuring Aggregation Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412
Configuring Queue Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415
Configuring ATM QoS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419
Configuring Common Open Policy Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423
Configuring Transparent Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435
Configuring Router Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .449
Bootp (Bootstrap Protocol) Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451
IP Broadcast Helper . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453
Router Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456
VRRP (Virtual Router Redundancy Protocol) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
NTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486
Configuring System Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
DNS Hostname Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493
Configuring Disk Mirroring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 494
Mail Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496
Failure Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498
Time and Date Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499
Static Host Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499
System Logging Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500
Hostname Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504
Managing Configuration Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505

Voyager Reference Guide 7
Backing Up and Restoring Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .507
Scheduling Jobs Through the Crontab File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .514
Managing IPSO Images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .515
Installing New IPSO Images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .517
Managing Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .520
Advanced System Tuning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .523
Configuring Security and Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .525
Password Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .528
Group Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .532
Network Access Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .533
Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .543
Secure Shell (SSH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .545
Secure Socket Layer (SSL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .555
Authentication, Authorization, and Accounting (AAA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .560
Cryptographic Acceleration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .583
IPsec Tunnels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .587
Voyager Session Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .616
Configuring Fault Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .621
Fault Management Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .622
Configuring SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .627
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .628
Configuring SNMP v1 and v2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .634
Interpreting SNMP Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .643
SNMP v3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .647
Configuring Asset Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .651
Asset Management Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .651
Configuring IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .653
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .654
Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .656
IPv6 and IPv4 Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .657
Routing Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .662
Router Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .665
Traffic Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .667
Security and Access Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .668

8Voyager Reference Guide
IPSO Process Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 671
IPSO Process Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 671
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689

Voyager Reference Guide 9
1Overview
Chapter Contents
!Software Overview
!Interface Overview
!Routing Overview
!Redistributing Routes Overview
Software Overview
This section gives you an overview of the Nokia software configured and
maintained by Nokia Voyager software.
Nokia firewalls function with the help of several software components:
!Operating System—Nokia firewalls run Nokia IPSO, a UNIX-like
operating system based on FreeBSD. IPSO is customized to support
Nokia’s enhanced routing capabilities and Check Point’s FireWall-1
firewall functionality, and to "harden" network security. Unnecessary
features have been removed to minimize the need for UNIX system
administration.
!Ipsilon Routing Daemon (IPSRD)—IPSRD is Nokia’s routing software.
The routing policy implemented by IPSRD resides in a database. Voyager
(see below) configures and maintains the routing software and database.

1Overview
10 Voyager Reference Guide
!Check Point FireWall-1—FireWall-1 consists of two major components:
(1) the Firewall module, which runs on the Nokia firewall and
implements the security policy, and (2) the Management module, which
runs either on the Nokia firewall or on another workstation. Use the
Management Module to define and maintain the security policy.
!Voyager—Voyager communicates with the routing software to configure
interfaces and routing protocols, to manage routing policy for the firewall,
and to monitor network traffic and protocol performance. Voyager also
provides online documentation. Voyager itself runs on a remote machine
as a client application of the Nokia routing software and is HTML based.
Interface Overview
This section describes how to configure network devices and assign IP
addresses to them using Voyager.
Interface Types
Nokia NAPs support the following interface types.
Note
Consult the appropriate hardware installation guide to find out what
interfaces your unit supports.
!Ethernet/Fast Ethernet
!FDDI
!ATM (RFC1483 PVCs only)
!Serial (V.35 and X.21) running PPP, point-to-point Frame Relay, or Cisco
HDLC
!T1/E1 running PPP, Frame Relay, or Cisco HDLC
!HSSI running PPP, point-to-point Frame Relay, or Cisco HDLC
!VPN Tunneling

Voyager Reference Guide 11
!Token Ring
!Unnumbered Interface
!ISDN
You can configure these interfaces with IP addresses. You also can assign
additional IP addresses to the loopback, FDDI, and Ethernet interfaces. All
interface types support IP multicast.
Configuring Network Devices
Voyager displays network devices as physical interfaces. A physical interface
exists for each physical port on a network interface card (NIC) installed in the
unit. Physical interface names have the form:
<type>-s<slot>p<port>
where:
<type> is a prefix indicating the device type. The interface-name prefixes for
each type are as follows:
Type Prefix
Ethernet
eth
FDDI
fddi
ATM atm
Serial
ser
T1/E1
ser
HSSI
ser
Token Ring tok
ISDN isdn

1Overview
12 Voyager Reference Guide
<slot> is the number of the slot the device occupies in the unit.
<port> is the port number of the card. The first port on a NIC is port one. For
example, a two-port Ethernet NIC in slot 2 is represented by two physical
interfaces:
eth-s2p1 and eth-s2p2 .
The loopback interface also has a physical interface named
loop0 .
Use Voyager to set the attributes of the device. For example, line speed and
duplex mode are attributes of an Ethernet physical interface. Each
communications port has exactly one physical interface.
Configuring IP Addresses
Logical interfaces are created for a device's physical interface. You assign an
IP address to logical interfaces and then route to the IP address. Ethernet,
FDDI, and Token Ring devices have one logical interface.
For ATM devices, you create a new logical interface each time you configure
an RFC1483 PVC for the device. Serial, T1/E1, and HSSI devices have one
logical interface when they are running PPP or Cisco HDLC. Serial, T1/E1
and HSSI devices running point-to-point Frame Relay have a logical interface
for each PVC configured on the port. You also have the option of configuring
an unnumbered interface for point-to-point interfaces. Tunnels, however,
cannot be configured as unnumbered interfaces.
Logical interfaces, by default, are named after the physical interface for which
they are created. If you wish, you can override this default name with a more
descriptive or familiar name. You can also associate a comment with the
logical interface as a further way to define its relationship in the network.
Default logical interface names have the form:
<type>-s<slot>p<port>c<chan>
where
<type> , <slot> and <port> have the same values as the corresponding
physical interface
<chan> is the channel number of the logical interface. For logical interfaces
created automatically, the channel number is always zero. For logical

Voyager Reference Guide 13
interfaces created manually, the channel number is the identifier of the virtual
circuit (VC) for which the interface is created (for example, the ATM VCI or
the Frame Relay DLCI).
For example, the logical interface of a physical interface
eth-s2p1 is called
eth-s2p1c0 . The logical interfaces for PVCs 17 and 24 on an ATM NIC in
slot 3 are called
atm-s3p1c17 and atm-s3p1c24 respectively.
Once a logical interface exists for a device, you can assign an IP address to it.
For Ethernet, FDDI, and Token Ring, you must specify the interface's local IP
address and the length (in bits) of the subnet mask for the subnet to which the
device connects.
If you are running multiple subnets on the same physical network, you can
configure additional addresses and subnet masks on the single logical
Physical
Interface
Logical Interface
Default Cisco HDLC PPP Frame Relay
Ethernet One (
c0 )
FDDI One ( c0 )
ATM One per VCI (
c# )
Serial
(X.21 or V.35) One (
c0 ) One ( c0 ) One per DLCI
( c# )
T1/E1 One (
c0 ) One ( c0 ) One per DLCI
( c# )
HSSI One (
c0 ) One ( c0 ) One per DLCI
( c# )
Token Ring One (c0)
ISDN One (
c# )

1Overview
14 Voyager Reference Guide
interface connected to that network. You do not need to create additional
logical interfaces to run multiple subnets on a single physical network.
For point-to-point media, such as ATM, serial, or HSSI, you can either assign
IP addresses or configure an unnumbered interface. When assigning IP
addresses you must specify the IP address of the local interface and the IP
address of the remote system's point-to-point interface.
You can add only one local/destination IP address pair to a point-to-point
logical interface. To assign IP addresses to multiple VCs, you must create a
logical interface for each VC. IP subnets are not supported on point-to-point
interfaces.
Whenever an unnumbered interface generates a packet, it uses the address of
the interface that the user has specified as the source address of the IP packet.
Thus, for a router to have an unnumbered interface, it must have at least one
IP address assigned to it. The Nokia implementation of unnumbered
interfaces does not support virtual links.
Indicators and Interface Status
The configuration and status of removable-interface devices are displayed.
Interfaces can be changed while they are offline. The events, their effects, and
indications are:
!If you hot-insert a device (not power down the unit first), it appears in the
lists of interfaces immediately (after a page refresh) on the configuration
pages.
!If you hot-pull a device, and no configuration exists for it, it disappears
from the lists of interfaces immediately.
!If you hot-pull a device, and it had a configuration, its configuration
details continue to be displayed and can be changed even after a reboot.
!Hotswapped interfaces that are fully seated in a router’s chassis are
represented in the ifTable (MIB-II), ipsoCardTable (IP440-IPSO-System-
MIB), and the hrNetworkTable
(Host-Resources-MIB).

Voyager Reference Guide 15
!Unwanted configurations of absent devices can be deleted, which
removes the physical and logical interfaces from all interface lists.
!None: If no color indication is displayed, the physical interface is
disabled. To enable the interface, click on the physical interface name to
go to its configuration page.
!Blue: The device corresponding to this physical interface has been
removed from the system, but its configuration remains. To delete its
configuration, click on the physical interface name to go to its
configuration page.
!Red: The physical interface is enabled, but the device does not detect a
connection to the network.
!Green: The physical interface is ready for use. It is enabled and
connected to the network.
Address Resolution Protocol (ARP)
ARP allows a host to find the physical address of a target host on the same
physical network using only the target’s IP address. ARP is a low-level
protocol that hides the underlying network physical addressing and permits
assignment of an arbitrary IP address to every machine.ARP is considered
part of the physical network system and not as part of the internet protocols.
Using the Loopback Interface
By default, the loopback interface has 127.0.0.1 configured as its IP address.
Locally originated packets sent to this interface are sent back to the
originating process.
You might want to assign an address to the loopback interface that is the same
as the OSPF firewall ID, or is the termination point of a BGP session. This
allows firewall adjacencies to stay up even if the outbound interface is down.
Do not specify an IP subnet mask length when you add addresses to the
loopback interface.

1Overview
16 Voyager Reference Guide
Configuring Tunnel Interfaces
Tunnel interfaces are used to encapsulate protocols inside IP packets. Use
tunneling to:
!send network protocols over IP networks that don’t support them
!encapsulate and encrypt private data to send over a public IP network.
Create a tunnel logical interface by specifying an encapsulation type. Use
Voyager to set the encapsulation type. Voyager supports two encapsulation
types, DVMRP and VPN.
The tunnel logical interface name has the form:
tun0c<chan>
where <chan> (channel number) is an instantiation identifier.
DVMRP (Distance Vector Multicast Routing
Protocol) Tunnels
DVMRP tunnels encapsulate multicast packets using IP-in-IP encapsulation.
The encapsulated packets appear as unicast IP packets. This technique allows
two multicast routers to exchange multicast packets even when they are
separated by routers that cannot forward multicast packets. For each DVMRP
tunnel you create, you must provide the IP address of the interface that forms
the local endpoint of the tunnel and the IP address of the multicast router that
is at the remote end of the tunnel forming the remote endpoint of the tunnel.
Note
The remote multicast router must support IP-in-IP encapsulation and
must be configured with a tunnel interface to the local router.
When you have created the DVMRP tunnel interface, set all other DVMRP
multicast configuration parameters from the DVMRP configuration page.

Voyager Reference Guide 17
VPN (Virtual Private Networking) Tunnels
VPN tunnels encapsulate IP packets using Generic Routing Encapsulation
(GRE) without options. The encapsulated packets appear as unicast IP
packets. For each VPN tunnel you create, you must assign a local and remote
IP address. You also must provide the local and remote endpoint addresses of
the interface to which this tunnel is bound. VPN tunnels provide redundant
configuration between two sites for high availability. The remote router must
also support VPN encapsulation and must be configured with a tunnel
interface to the local router.
Routing Overview
This section discusses the following topics:
!Nokia Routing Subsystem
!Routing Protocols
Nokia Routing Subsystem
The Nokia routing subsystem, Ipsilon Routing Daemon (IPSRD), is an
essential part of your firewall. IPSRD’s role is to dynamically compute paths
or routes to remote networks. Routes are calculated by a routing protocol.
Besides providing routing protocols, IPSRD also allows routes to be
converted or redistributed between routing protocols. Finally, when there are
multiple protocols with a route to a given destination, IPSRD allows you to
specify a ranking of protocols. Based on this ranking, a single route is
installed in the forwarding table for each destination.
You can configure each of the supported routing protocols, route
redistribution, and other routing options via the Configuring Routing section
in Voyager.
Routing monitoring is available by following links from the individual
protocol pages or by clicking on the Monitor button in Voyager. Another

1Overview
18 Voyager Reference Guide
monitoring tool is ICLID. This tool provides interactive, text-based
monitoring of the routing subsystem.
Routing Protocols
Routing protocols compute the best route to each destination. Routing
protocols also exchange information with adjacent firewalls. The best route is
determined by the cost or metric values.
Routing protocols can be broken up into two major categories: exterior
gateway protocols (EGPs) and interior gateway protocols (IGPs). Interior
gateway protocols exchange routing information inside an autonomous
system (AS). An AS is a routing domain, such as inside an organization, that
contacts its own routing. An EGP exchanges routing information between
ASes and provides for specialized policy-bound filtering and configuration.
Interior Routing Protocols
IPSRD supports three IGPs: RIP (Routing Information Protocol), IGRP
(Interior Gateway Routing Protocol), and OSPF (Open Shortest Path First).
Static routes and aggregate routes are also supported.
RIP
RIP is a commonly used IGP. There are two versions of RIP: RIP version 1,
and RIP version 2. Both versions are supported by IPSRD.
RIP uses a simple distance vector algorithm called Bellman Ford to calculate
routes. In RIP, each destination has a cost or metric value, which is based
solely on the number of hops between the calculating firewall and the given
destination.
The maximum metric value is 15 hops, which means that RIP is not suited to
networks within a diameter greater than 15 firewalls. The advantage of RIP
version 2 over RIP version 1 is that it supports non-classful routes. Classful
routes are old-style class A, B, C routes. You should use RIP version 2 instead
of RIP version 1 whenever possible.

Voyager Reference Guide 19
Nokia also supports RIPng, the version of RIP that supports IPv6 interfaces.
IGRP
IGRP (Interior Gateway Routing Protocol) is a distance vector protocol. IGRP
has a number of metrics for each destination. These metrics include link delay,
bandwidth, reliability, load, MTU, and hop count. A single composite metric
is formed by combining metrics with a particular weight.
Like RIP version 1, IGRP does not fully support non-classful routing.
OSPF
OSPF (Open Shortest Path First) is a modern link-state routing protocol. It
fully supports non-classful networks. OSPF has a single, 24-bit metric for
each destination. You can configure this metric to any desired value.
OSPF allows the AS to be broken up into areas. Areas allow you to increase
overall network stability and scalability. At area boundaries, routes can be
aggregated to reduce the number of routes each firewall in the AS must know
about. If there are multiple paths to a single destination with the same
computed metric, OSPF can install them into the forwarding table.
Protocol Described in RFC
RIP version 1 RFC1058
RIP version 2 RFC1723
RIPng
Protocol Described in RFC
OSPF RFC2328

1Overview
20 Voyager Reference Guide
DVMRP
DVMRP (Distance Vector Multicast Routing Protocol) is a multicast routing
protocol (RIP, OSPF, and IGRP are unicast routing protocols). Multicasting is
typically used for real-time audio and video when there is a single source of
data and multiple receivers. DVMRP uses a hop-based metric and, like RIP, a
distance-vector route calculation.
BGP
BGP (Border Gateway Protocol) is an exterior gateway protocol that is used
to exchange network reachability information between BGP-speaking
systems running in each AS. BGP is unlike interior gateway protocols (IGRP
or OSPF), which periodically flood an intra-domain network with all the
known routing table entries and build their own reliability on top of a
datagram service. Instead, BGP uses TCP as its underlying transport
mechanism.
BGP is also a path-vector routing protocol, which limits the distribution of a
firewall’s reachability information to its peer or neighbor firewalls. BGP uses
path attributes to provide more information about each route. BGP maintains
an AS path, which includes the number of each AS that the route has
transited. Path attributes may also be used to distinguish between groups of
routes to determine administrative preferences. This allows greater flexibility
in determining route preference and achieves a variety of administrative ends.
BGP supports two basic types of sessions between neighbors: internal (IBGP)
and external (EBGP). Internal sessions run between firewalls in the same
autonomous systems, while external sessions run between firewalls in
different autonomous systems.
Aggregate Routes
Route aggregation allows you to take many small routes and aggregate them
into one large route. This reduces the number of routes advertised for a given
protocol. These aggregate routes are then redistributed into other protocols.
The aggregates are activated by contributing routes. For example, if a firewall
has many stub interface routes subnetted from a class C and is running RIPv2