Yamaha Router Configuration Training ~ console ~ Contents Console operation Log in Set Login & Admin password Basic Command Interface Addressing DHCP Static Routing NAT PPPoE IPsec VPN Static/Dynamic Packet Filtering 2 © Yamaha Corporation Before training Please disable Windows firewall. [Start menu] – [Control Panel] – [Windows Firewall] Select “Turn Windows Firewall on or off”. 3 © Yamaha Corporation Access into the Router ■Basic method of the access RTX810 Console（Tera Term) 4 © Yamaha Corporation Setup the console environment 1. Install the driver of the USB-Serial 2. Install the Tera Term software 3. Setup the Tera Term parameter Menu → Setup → Serial port Parameter Baud rate Data Parity Stop Flow control Value 9600 bit/s 8 bit None 1 bit Xon/Xoff 4. Start the router 5 © Yamaha Corporation 1. Login from Serial Sample: ・The router will start automatically in 10 seconds. ・No password is set in the beginning. 6 © Yamaha Corporation 2. How to configure Sample: ・Enter the administrator mode to configure the router. ・Use command “ administrator ” to enter the administrator mode. ・No password is set in the beginning. 7 © Yamaha Corporation 3. How to change passwords Sample: ・Use command “ login password ” to change login password. ・Use command “ administrator password ” to change admin password. ・Use command “ save ” to save running configuration to FlashROM. Login password → “ yamaha ” Administrator password → “ router ” 8 © Yamaha Corporation 4. Logout ・Use command “ exit ” to logout from login user and admin. ・Enter login password. ・Enter admin password. 9 © Yamaha Corporation 5. Basic commands 10 ・ – – – – Show Command ① show config ② show ip route ③ show arp ④ show environment ・ – – – Maintenance ① save ② restart ③ cold start ・ – – – Network Command ① ping ② traceroute ③ telnet ⑤ ⑥ ⑦ ⑧ show log show status <interface> show ipsec sa show techinfo © Yamaha Corporation 5. Basic commands (1) Sample: ・“ show status lan1 ” shows the status of LAN1. ・“ show log ” shows the syslog of the router. 11 © Yamaha Corporation 5. Basic commands (2) Sample: ・“ show techinfo” shows all information of the router. 12 © Yamaha Corporation 6. Command help Sample: ・Use key “ ? ” to show command list. ・Use key “ ? ” after word to show command help or other command list. 13 © Yamaha Corporation 7. Configuration control (1) Yamaha router has 5 domains for the configuration files on internal memory. These domains are name as number “ 0 ” ～ “ 4 ” and it is possible to do following operations for each domain. - Copy the configuration file - Delete the configuration file - Show the configuration file list - Show the saved configuration file content Internal memory (Flash ROM) ･･･ 0 1 (default) ･･･ 14 ･･･ 2 3 4 ･･･ © Yamaha Corporation 7. Configuration control (2) Sample: ・Use command “ save NUM ” to save running-configuration to specific domain on FlashROM. ・Use command “ show config list ” to show saved config list. ・Use command “ copy config P1 P2 ” to copy configuration from P1 to P2. ・Use command “ delete config ” to delete configuration on FlashROM. 15 © Yamaha Corporation 8. Interface addressing ■Configure IP Address to LAN Interface 172.16.1.0/24 1000::/64 .1(LAN2) .1(LAN1) 192.168.100.0/24 2000::/64 16 © Yamaha Corporation 8. Interface addressing (1) Command ip <interface> address <IPv4address/mask> ipv6 <interface> address <IPv6address/mask> ・・・・・・① ・・・・・・② Sample: ① Configure IPv4 address to each LAN address. // ① // ② 17 ② Configure IPv6 address to each LAN address. ・Use command “ save ” to save running configuration to FlashROM. © Yamaha Corporation 8. Interface addressing (2) Sample: ・“ show status lan1 ” shows the status of LAN1. ・“ show status lan2 ” shows the status of LAN2. 18 © Yamaha Corporation 8. Interface addressing (3) ・“ show ipv6 address ” shows IPv6 address information. 19 © Yamaha Corporation 9. Delete command Sample: ・Use word “ no ” to clear followed command. 20 © Yamaha Corporation 10. DHCP server setting ■Enable DHCP Server and Assign DHCP Address to DHCP Clients(PC) .1(LAN1) 192.168.100.0/24 ・・・ 192.168.100.2 ~ 192.168.100.191 21 © Yamaha Corporation 10. DHCP server setting (1) Command dhcp service server dhcp scope <scope_id> <scope/mask> ・・・・・・① ・・・・・・② Sample: ① Enable DHCP Server //① //② ② Configure the scope range of DHCP IP addresses. 22 © Yamaha Corporation 10. DHCP server setting (2) Sample: : 23 ・“ show status dhcp ” shows the status of DHCP lease. © Yamaha Corporation 11. Router Advertisement ■Configure the Router Advertisement and send to host. Router Advertisement .1(LAN1) 2000::/64 The computer creates ipv6 address from Router Advertisement 2000::XXXX /64 24 © Yamaha Corporation 11. Router Advertisement (1) Command ipv6 prefix <prefix_id> <prefix/mask> ipv6 <interface> rtadv send <prefix_id> ・・・・・・① ・・・・・・② Sample: ① Configure IPv6 prefix. //① //② 25 ② Configure the Router Advertisement. © Yamaha Corporation 11. Router Advertisement (2) The computer create IPv6 address from prefix on RA. 26 © Yamaha Corporation Return to factory default setting ① Use command “ cold start ” to return to factory default. //① //② ② Router restarts automatically. //③ ・Push “ Enter ” in 10 seconds counting. ③ Restart from config0. 27 © Yamaha Corporation 12. Static route setting ■Configure Static Route for Networking. 172.16.1.0/24 2000::/64 172.16.2.0/24 3000::/64 Router-A .1 (LAN1) 1.1.1.0/2 4 .1 1000::/64 .2 (LAN2) (LAN2) Router-B .1 (LAN1) ping 28 © Yamaha Corporation 12. Static route setting (1) Command ip route <network/mask> gateway <nexthop> ・・・① ipv6 route <network/mask> gateway <nexthop>%<interface> ・・・② Sample: Router-A ① Set static route for 172.16.2.0/24 ② Set static route for 3000::/64 //① //② 29 “ default ” means 0.0.0.0 © Yamaha Corporation 12. Static route setting (2) Command ip route <network/mask> gateway <nexthop> ・・・① ipv6 route <network/mask> gateway <nexthop>%<interface> ・・・② Sample: Router-B ① Set static route for 172.16.1.0/24 ② Set static route for 2000::/64 //① //② 30 “ default ” means 0.0.0.0 © Yamaha Corporation 12. Static route setting (3) Sample: Router-A ・“ show ip route ” shows the ipv4 routing table of the Router. ・“ show ipv6 route ” shows the ipv6 routing table of the Router. 31 © Yamaha Corporation Configuration Change //① ① Save configuration to config0. //② ② Restart Router. ・Push “ Enter ” in 10 seconds counting. //③ 32 ③ Restart from config1. © Yamaha Corporation 13. Network Address Translation (NAT) NAT … the process of modifying IP address information in IP packet headers. the process for private address group to use 1 global IP address. NAT table Source Source Port 192.168.100.2 ⇔ 172.16.1.1 : 60000 192.168.100.3 ⇔ 172.16.1.1 : 60001 192.168.100.4 ⇔ 172.16.1.1 : 60002 ･･･ 192.168.100.X ⇔ 172.16.1.1 : 6000X internet 172.16.1.1 .1 192.168.100.0/24 .2 .3 .4 .X ・・・ 33 © Yamaha Corporation 13. NAT (1) ■Configure NAT for IP Networking Web server 172.16.1.100 ○ 172.16.1.0/24 NAT .1 (LAN2) 172.16.1.1 192.168.100.2 × .1 (LAN1) 192.168.100.0/24 Your computer 192.168.100.2 34 © Yamaha Corporation 13. NAT (2) Command nat descriptor type <nat_id> masquerade nat descriptor address outer <nat_id> <Outer IP Address> nat descriptor address inner <nat_id> <Inner IP Address> ip <interface> nat descriptor <nat_id> ・・・・・・① ・・・・・・② ・・・・・・③ ・・・・・・④ Sample: ① Enable NAT Select “ masquerade ” to use NAPT. //① //③ //④ //② ② Put Global IP Address for translation. ③ Put any private IP Address. “ auto ” means all. ④ Set NAT to the interface. 35 © Yamaha Corporation 13. NAT (3) Sample: ・“ show nat descriptor address ” shows the nat table of the Router. 36 © Yamaha Corporation 14. Static masquerade Static masquerade … the process of forwarding the packets which coming to specific port number. internet NAT table Destination Port Destination Port 172.16.1.1 : 80 ⇔ 192.168.100.100 : 80 172.16.1.1 .1 192.168.100.0/24 .100 Web server on private network 37 © Yamaha Corporation 14. Static masquerade (1) Your computer 172.16.1.2 172.16.1.0/24 NAT .1 (LAN2) 192.168.100.100:80 .1 (LAN1) 172.16.1.1:80 192.168.100.0/24 Web server 192.168.100.100 38 © Yamaha Corporation 14. Static masquerade (2) Command nat descriptor type <nat_id> masquerade nat descriptor address outer <nat_id> <Outer IP Address> nat descriptor address inner <nat_id> <Inner IP Address> nat descriptor masquerade static <nat_id> <table_num> <Inner IP> <Proto> <Port> ip <interface> nat descriptor <nat_id> Sample: ・・・・・・ ① ・・・・・・ ② ・・・・・・ ③ ・・・・・・ ④ ・・・・・・ ⑤ ① Enable NAT Select “ masquerade” to use NAPT. //① //③ ② Put Global IP Address for translation. //② //④ //⑤ ③ Put any private IP Address. “auto” means all. ④ Set Inner IP and Port for port forward. ⑤ Set NAT to the interface. 39 © Yamaha Corporation 14. Static masquerade (3) Sample: ・“ show nat descriptor address ” shows the routing table of the Router. 40 © Yamaha Corporation Configuration Change //① ① Save configuration to config1. //② ② Restart Router. ・Push “ Enter ” in 10 seconds counting. ③ Restart from config2. //③ 41 © Yamaha Corporation 15. Static packet filtering ■Configure Static Packet Filtering Web server Static Packet Filtering Condition .200 × .100 ・172.16.1.200:80 → 192.168.100.0/24 ： Reject ○ ・172.16.1.100 → 192.168.100.0/24 ： Pass 172.16.1.0/24 .1 (LAN2) Filtering (tcp 80 = HTTP) .1 (LAN1) 192.168.100.0/24 Your computer 42 © Yamaha Corporation 15. Static packet filtering (1) Command ip filter <Filter_NUM> <Type> <Src_Add> <Dst_Add> <Protocol <Src_Port> <Dst_Port>> ・・ ① ip <Interface> secure filter <Direction> <Filter_Num> ・・ ② * To record the result of Packet Filtering, Configure the filter type such as pass-log and reject-log And also, configure “ syslog notice on ” to show the record on the syslog. Sample: ① Create Packet Filtering. 2 //② //③ 43 //① ② Set filter to the interface. ③ Configure this command to record the result of packet filtering. © Yamaha Corporation 15. Static packet filtering rule Received packet Sample filtering configuration: ip filter 1 reject 1.1.1.1 2.2.2.2 tcp 80 * ip filter 2 reject 1.1.1.1 3.3.3.3 udp * * ip filter 3 pass * * * * * ip lan2 secure filter in 1 2 3 Filter1 TCP src:80 From:1.1.1.1 To:2.2.2.2 In case of above configuration, packets received on LAN2 interface are evaluated in right sequence. YES NO Filter2 ※ The received packet that does not match any filtering are discard. If you want to reject specific packet, you should set all-pass filtering at the last of filter configuration. Filter3 YES UDP From:1.1.1.1 To:3.3.3.3 YES NO all NO Pass 44 Discard © Yamaha Corporation 15. Static packet filtering (2) PASS-LOG ・“ show log ” shows the syslog and results of Packet Filtering. REJECT-LOG 45 © Yamaha Corporation 16. Dynamic packet filtering ■Configure Dynamic Packet Filtering (Stateful Inspection) Web server .100 ○ Dynamic Filtering Condition ・LAN1 → LAN2 ： Pass ・LAN2 → LAN1 ： Reject ・Reply packets of LAN1 → LAN2 ： Pass 172.16.1.0/24 Filtering (tcp 80 = HTTP) .1 (LAN2) × .1 (LAN1) 192.168.100.0/24 Your computer 46 © Yamaha Corporation 16. Dynamic packet filtering (1) Command ip filter <Filter_Num> <Type> <Src_Add> <Dst_Add> <Protocol <Src_Port> <Dst_Port>> ・・・・・・ ① ip flter dynamic <Dynamic_Filter_Num> <Src_Add> <Dst_Add> <Protocol> ・・・・・・ ② ip <interface> secure filter <Direction> <Filter_Num> dynamic <Dynamic_Filter_Num> ・・・・・・ ③ *NOTE ・To enable Dynamic Filter, Static Packet Filter is needed to be configured in advance. The first packet should be filtered by static filter. Once the packet is filtered by Static Filter, then, Dynamic Filter becomes active. ex} ip lan1 secure filter out 1 dynamic 1 ・For Dynamic Filter, the parameter of <Protocol> is such as ftp, www, domain, smtp, pop3, tcp and udp. 47 © Yamaha Corporation 16. Dynamic packet filtering (2) Sample: ① Create Static Packet Filtering. ② Create Dynamic Packet Filtering. //① //② //③ //⑤ 48 //④ ③ Set inbound filter to the Interface. ④ Set dynamic filter for outbound filter to the interface. ⑤ Configure this command to record the result of packet filtering. © Yamaha Corporation 16. Dynamic packet filtering (3) Sample: ・“ show ip connection ” shows the session information of Dynamic Filtering. 49 © Yamaha Corporation 16. Dynamic packet filtering (4) Sample: ・“ show log ” shows the syslog and results of Packet Filtering. ・“ INSPECT ” means that Packets are filtered by Dynamic Filtering. 50 © Yamaha Corporation Configuration Change //① ① Save configuration to config2. //② ② Restart Router. ・Push “ Enter ” in 10 seconds counting. ③ Restart from config3. //③ 51 © Yamaha Corporation 17. Internet Accessing (PPPoE) ■Configure PPPoE Setting for Internet Access Internet Router-A (WAN) (WAN) .1 (LAN) Router-B .1 (LAN) 172.16.2.0/24 172.16.1.0/24 PC1 52 PC2 © Yamaha Corporation 17. PPPoE (1) Command pp select <pp_num> ・・・・・・① pppoe use <interface> ・・・・・・② pp always-on <on/off> ・・・・・・③ pp auth accept <auth mthod> ・・・・・・④ pp auth myname <user_id> <user_pass> ・・・・・・⑤ ppp lcp mru <on/off> <frame size> ・・・・・・⑥ ip pp mtu <mtu size> ・・・・・・⑦ ppp ccp type <type> ・・・・・・⑧ ppp ipcp ipaddress <on/off> ・・・・・・⑨ ppp ipcp msext <on/off> ・・・・・・⑩ ip pp nat descriptor <nat_id> ・・・・・・⑪ ip pp tcp mss limit <length> ・・・・・・⑫ pp enable <pp_num> ・・・・・・⑬ dns server pp <pp_num> ・・・・・・⑭ ip route <network address/mask> gateway pp <pp_num> ・・・・・・⑮ (＊1) ＊1 ) this parameter is for dynamic IP Address which assigned from ISP. If you want to use static IP Address, set “ ip pp <IP Address/Mask> ” instead. 53 © Yamaha Corporation 17. PPPoE (2) Sample: (Dynamic Global Address) //① //② //③ //④ //⑤ //⑥ //⑦ //⑧ //⑨ //⑩ //⑪ //⑫ //⑬ //⑭ 54 //⑮ ① Create pp interface ② Choose physical interface ③ Enable always-on connections ④ Choose authentication ⑤ Set USER-ID and Password ⑥ Set LCP MRU parameter ⑦ Set MTU parameter ⑧ Choose compression type ⑨ Enable dynamic IP address ⑩ Enable dynamic DNS address ⑪ Enable nat descriptor for pp ⑫ Enable optimization of MSS ⑬ Enable pp interface ⑭ Set DNS server from ⑩ ⑮ Set static routing Router A ID: user1, PASS: pass1 Router B ID: user2, PASS: pass2 © Yamaha Corporation 17. PPPoE (3) Sample: ・“ show status pp 1 ” shows the status of pp 1 interface. 55 © Yamaha Corporation 18. IPsec VPN (Main mode) ■Configure IPsec VPN (Main Mode) via Internet Router-A PSK: secret .201 Internet (200.1.1.0/24) Router-B .202 PSK: secret IPSec .1 .1 172.16.1.0/24 .2 PC1 56 .2 172.16.2.0/24 PC2 © Yamaha Corporation 18. IPsec VPN (Main mode) (1) Command：(Center and Branch) tunnel select <Tunnel_Num> tunnel encapsulation <Type> ipsec tunnel <Policy_ID> ipsec sa policy <Policy_ID> <Tunnel_Num> esp <Algorithm> <Authentication> ipsec ike keepalive use <Tunnel_Num> <on/off> ipsec ike keepalive log <Tunnel_Num> <on/off> ipsec ike local address <Tunnel_Num> <Local_Gateway_Address> ipsec ike remote address <Tunnel_Num> <Remote_Gateway_Address> ipsec ike pre-shared-key <Tunnel_Num> text <Text_Key> tunnel enable <Tun_Num> ip route <network address/mask> gateway <Tun_Num> ipsec auto refresh <on/off> 57 ・・・・・・① ・・・・・・② ・・・・・・③ ・・・・・・④ ・・・・・・⑤ ・・・・・・⑥ ・・・・・・⑦ ・・・・・・⑧ ・・・・・・⑨ ・・・・・・⑩ ・・・・・・⑪ ・・・・・・⑫ © Yamaha Corporation 18. IPsec VPN (Main mode) (2) Sample: Router-A //① //② //④ //⑤ //⑨ //③ //⑥ //⑦ //⑧ //⑩ //⑪ //⑬ 58 //⑫ ① Create Tunnel Interface ② Select IPsec Policy-ID ③ Create IPsec Policy ④ Enable use of keepalive ⑤ Disable keepalive log ⑥ Set IP address of local GW ⑦ Set IP address of remote GW ⑧ Set pre shared key ⑨ Enable Tunnel Interface ⑩ Set port forwarding for IPsec ⑪ Set port forwarding for IKE ⑫ Set static routing ⑬ Enable Initiation of KeyExchange © Yamaha Corporation 18. IPsec VPN (Main mode) (3) Sample: Router-B //① //② //③ //④ //⑤ //⑥ //⑦ //⑧ //⑨ //⑩ //⑪ //⑫ //⑬ 59 ① Create Tunnel Interface ② Select IPsec Policy-ID ③ Create IPsec Policy ④ Enable use of keepalive ⑤ Disable keepalive log ⑥ Set IP address of local GW ⑦ Set IP address of remote GW ⑧ Set pre shared key ⑨ Enable Tunnel Interface ⑩ Set port forwarding for IPsec ⑪ Set port forwarding for IKE ⑫ Set static routing ⑬ Enable Initiation of KeyExchange © Yamaha Corporation 18. IPsec VPN (Main mode) (4) Sample: ・“ show status tunnel 1 ” shows the status of tunnel 1 interface. ・“ show ipsec sa ” shows the status of ISAKMP SA and IPsec SA. 60 © Yamaha Corporation 19. IPsec VPN (Aggressive mode) ■Configure IPsec VPN (Aggressive Mode) via Internet Dynamic IP Address Router-A PSK: secret Remote Name: test .201 Internet (200.1.1.0/24) Router-B PSK: secret Local Name: test IPSec .1 .1 172.16.1.0/24 PC1 61 172.16.2.0/24 PC2 © Yamaha Corporation 19. IPsec VPN (Aggressive mode) (1) Command：(Center) Router-A tunnel select <Tunnel_Num> tunnel encapsulation <Type> ipsec tunnel <Policy_ID> ipsec sa policy <Policy_ID> <Tunnel_Num> esp <Algorithm> <Authentication> ipsec ike keepalive use <Tunnel_Num> <on/off> ipsec ike keepalive log <Tunnel_Num> <on/off> ipsec ike local address <Tunnel_Num> <Local_Gateway_Address> ipsec ike remote address any ipsec ike remote name <Tunnel_Num> <Tex_key> key-id ipsec ike pre-shared-key <Tunnel_Num> text <Text_Key> tunnel enable <Tun_Num> ip route <network address/mask> gateway <Tun_Num> 62 ・・・・・・① ・・・・・・② ・・・・・・③ ・・・・・・④ ・・・・・・⑤ ・・・・・・⑥ ・・・・・・⑦ ・・・・・・⑧ ・・・・・・⑨ ・・・・・・⑩ ・・・・・・⑪ ・・・・・・⑫ © Yamaha Corporation 19. IPsec VPN (Aggressive mode) (2) Command：(Branch) Router-B tunnel select <Tunnel_Num> tunnel encapsulation <Type> ipsec tunnel <Policy_ID> ipsec sa policy <Policy_ID> <Tunnel_Num> esp <Algorithm> <Authentication> ipsec ike keepalive use <Tunnel_Num> <on/off> ipsec ike keepalive log <Tunnel_Num> <on/off> ipsec ike local address <Tunnel_Num> <Local_Gateway_Address> ipsec ike remote address <Remote_Gateway_Address> ipsec ike local name <Tunnel_Num> <Tex_key> key-id ipsec ike pre-shared-key <Tunnel_Num> text <Text_Key> tunnel enable <Tun_Num> ip route <network address/mask> gateway <Tun_Num> ipsec auto refresh <on/off> 63 ・・・・・・① ・・・・・・② ・・・・・・③ ・・・・・・④ ・・・・・・⑤ ・・・・・・⑥ ・・・・・・⑦ ・・・・・・⑧ ・・・・・・⑨ ・・・・・・⑩ ・・・・・・⑪ ・・・・・・⑫ ・・・・・・⑬ © Yamaha Corporation 19. IPsec VPN (Aggressive mode) (3) Sample: Router-A //① //② //④ //⑤ //⑩ //③ //⑥ //⑦ //⑧ //⑨ //⑪ //⑬ 64 //⑫ ① Create Tunnel Interface ② Select IPsec Policy-ID ③ Create IPSec Policy ④ Enable use of keepalive ⑤ Disable keepalive log ⑥ Set IP address of local GW ⑦ Accept any IP as remote GW ⑧ Set name of remote GW ⑨ Set pre shared key ⑩ Enable Tunnel Interface ⑪ Set port forwarding for IPsec ⑫ Set port forwarding for IKE ⑬ Set static routing © Yamaha Corporation 19. IPsec VPN (Aggressive mode) (4) Sample: Router-B //① //② //④ //⑤ //⑩ //③ //⑥ //⑦ //⑧ //⑨ //⑪ //⑭ 65 //⑬ //⑫ ① Create Tunnel Interface ② Select IPsec Policy-ID ③ Create IPsec Policy ④ Enable use of keepalive ⑤ Disable keepalive log ⑥ Set IP address of local GW ⑦ Set IP address of remote GW ⑧ Set name of local GW ⑨ Set pre shared key ⑩ Enable Tunnel Interface ⑪ Set port forwarding for IPsec ⑫ Set port forwarding for IKE ⑬ Set static routing ⑭ Enable Initiation of KeyExchange © Yamaha Corporation 19. IPsec VPN (Aggressive mode) (5) Sample: ・“ show status tunnel 1 ” shows the status of tunnel 1 interface. ・“ show ipsec sa ” shows the status of ISAKMP SA and IPsec SA. 66 © Yamaha Corporation 19. IPsec VPN (Aggressive mode) (6) Sample: ・“ show ipsec sa gateway 1 detail ” shows the specific information about ISAKMP and IPsec SA. 67 © Yamaha Corporation Website for Yamaha product http://www.yamaha.com/products/en/network/ We will update the information such as new firmware, sample configuration … etc. 68 © Yamaha Corporation