Document Outline

• Contents
• DHCP Relay
  • 1.1 DHCP Relay
    • 1.1.1 Feature Overview
    • 1.1.2 Functionality
      • 1.1.2.1 BOOTP Requests
      • 1.1.2.2 BOOTP Replies
    • 1.1.3 Using DHCP Relay with NAT
    • 1.1.4 Command Line Interface
      • 1.1.4.1 Enabling DHCP Relay
      • 1.1.4.2 Disabling DHCP Relay
      • 1.1.4.3 Configuring the Gateway Address field when NAT is enabled
    • 1.1.5 Displaying DHCP Configuration
    • 1.1.6 Displaying Statistics
    • 1.1.7 DHCP Limitations
• Configuring Internet Group Management Protocol
  • 2.1 IGMP Configuration
    • 2.1.1 IGMP Commands
    • 2.1.2 IGMP Configuration Examples
      • 2.1.2.1 Example 1
      • 2.1.2.2 Example 2
      • 2.1.2.3 Example 3
      • 2.1.2.4 Example 4
      • 2.1.2.5 Example 5
      • 2.1.2.6 Example 6
      • 2.1.2.7 Example 7
      • 2.1.2.8 Example 8
      • 2.1.2.9 Example 9
      • 2.1.2.10 Example 10
      • 2.1.2.11 Example 11
      • 2.1.2.12 Example 12
      • 2.1.2.13 Example 13
• Filtering IP Traffic
  • 3.1 IP Packet Filter Lists
    • 3.1.1 Example1
      • 3.1.1.1 Configure the Black Box LR1104A.
    • 3.1.2 Example 2
      • 3.1.2.1 Configure the Black Box LR1104A
    • 3.1.3 Example 3
      • 3.1.3.1 Configure the Black Box LR1104A
• Configuring Security
  • 4.1 IPSec Configurations
  • 4.2 Example 1: Managing the Black Box LR1104A Securely Over an IPSec Tunnel
    • Step 10.1: Configure firewall policies to allow IKE negotiation through untrusted interface (appl...
    • Step 10.2: Configure firewall policies to allow desired services through untrusted interface to m...
    • Step 10.3: Display firewall policies in the internet map (applicable only if firewall license is ...
    • Step 10.4: Display firewall policies in the internet map in detail (applicable only if firewall l...
  • 4.3 Example 2: Single Proposal: Tunnel Mode Between Two Black Box Security Gateways
    • Step 8.1: Configure firewall policies to allow IKE negotiation through untrusted interface (appli...
    • Step 8.2: Display firewall policies in the internet map (applicable only if firewall license is e...
    • Step 8.3: Display firewall policies in the internet map in detail (applicable only if firewall li...
    • Step 8.4: Configure firewall policies to allow transit traffic from remote LAN to the local LAN (...
    • Step 8.5: Display firewall policies in the corp map (applicable only if firewall license is enabled)
    • Step 8.6: Display firewall policies in the corp map in detail (applicable only if firewall licens...
  • 4.4 Example 3: Multiple IPSec Proposals: Tunnel Mode Between Two Black Box Security Gateways
  • 4.5 Example 4: IPSec remote access to corporate LAN using user group method
    • Step 1: As in Step1 of Example 1
    • Step 2: As in Step2 of Example 1
    • Step 3: As in Step3 of Example 1
    • Step 4: Configure dynamic IKE policy for a group of mobile users
    • Step 5: Display dynamic IKE policies
    • Step 6: Display dynamic IKE policies in detail
    • Step 7: Configure dynamic IPSec policy for a group of mobile users
    • Step 8: Display dynamic IPSec policies
    • Step 9: Display dynamic IPSec policies in detail
    • Step 10: Configure radius server (applicable only if client authentication is configured in dynam...
    • Step 11: Configure firewall policies to allow IKE negotiation through untrusted interface (applic...
    • Step 12: Display firewall policies in the internet map (applicable only if firewall license is en...
    • Step 13: Display firewall policies in the internet map in detail (applicable only if firewall lic...
    • Step 14: Configure firewall policies for a group of mobile users to allow access to the local LAN...
    • Step 15: Display firewall policies in the corp map (applicable only if firewall license is enabled)
    • Step 16: Display firewall policies in the corp map in detail (applicable only if firewall license...
  • 4.1 Example 5: IPSec remote access to corporate LAN using mode configuration method
    • Step 1: As in Step1 of Example 1
    • Step 2: As in Step2 of Example 1
    • Step 3: As in Step3 of Example 1
    • Step 4: Configure dynamic IKE policy for a group of mobile users
    • Step 5: Display dynamic IKE policies
    • Step 6: Display dynamic IKE policies in detail
    • Step 7: Configure dynamic IPSec policy for a group of mobile users
    • Step 8: Display dynamic IPSec policies
    • Step 9: Display dynamic IPSec policies in detail
    • Step 10: Configure firewall policies to allow IKE negotiation through untrusted interface (applic...
    • Step 11: Display firewall policies in the internet map (applicable only if firewall license is en...
    • Step 12: Display firewall policies in the internet map in detail (applicable only if firewall lic...
    • Step 13: Configure firewall policies for a group of mobile users to allow access to the local LAN...
    • Step 14: Display firewall policies in the corp map (applicable only if firewall license is enabled)
    • Step 15: Display firewall policies in the corp map in detail (applicable only if firewall license...
• IPSec Specifications
  • 5.1 IPSec Appendix
    • 5.1.1 Black Box IKE and IPSec Defaults
      • 5.1.1.1 IKE Defaults
      • 5.1.1.2 IPSec Defaults
• Forwarding IP Traffic
  • 6.1 IP Multiplexing
    • 6.1.1 Packet Forwarding Modes
    • 6.1.2 Proxy ARP and Packet Forwarding
    • 6.1.3 Addressing in IP Multiplexing Networks
    • 6.1.4 Single Subnet
    • 6.1.5 Split Subnet
    • 6.1.6 Secondary Addressing – POP Only
    • 6.1.7 Secondary Addressing – 30 Bit
    • 6.1.8 Secondary Addressing – 29 Bit
    • 6.1.9 Pros and Cons of Different IP Addressing Schemes
    • 6.1.10 Routing Considerations for IP Multiplexing
• IP Multiplexing HDLC Configurations
  • 7.1 Connecting a Black Box Router to a Router/CSU via HDLC
    • 7.1.1 Configure the Black Box LR1104A at Site 2
• IP Multiplexing PPP and MLPPP Configurations
  • 8.1 Configuring Multiple PPP and MLPPP Bundles
    • 8.1.1 Configure the Black Box LR1104A at the Main Site
• Configuring PPP, MLPPP, and HDLC
  • 9.1 Layer Two Configurations: PPP, MLPPP, and HDLC
    • 9.1.1 MLPPP Configuration
      • 9.1.1.1 Configure the Black Box LR1114A System at Site 1
    • 9.1.2 PPP and MLPPP Configuration
      • 9.1.2.1 Configure the Black Box LR1104A System at the Main Site
    • 9.1.3 HDLC Configuration
      • 9.1.3.1 Configure the Black Box LR1104A System at the Main Site
• Configuring Firewalls
  • 10.1 Firewalls
  • 10.2 Firewall Configuration Examples
    • 10.2.1 Basic Firewall Configuration
      • Step 1:Configure the Ethernet interfaces and the WAN interfaces with IP addresses:
      • Step 2: Create the security zones CORP and DMZ and attach interfaces:
      • Step 3: Verify that the interfaces are attached to the security zones:
      • Step 4: Create policies for Security Zone CORP that:
      • Step 5: Verify the firewall policy for Security Zone CORP:
      • Step 6: Verify that the HTTP filter object in Security Zone CORP is created as configured.
      • Step 7: Create policies for Security Zone DMZ that:
      • Step 8:Verify the firewall policy for Security Zone DMZ
      • Step 9: Verify that the FTP filter objects for Security Zone DMZ are created as configured:
      • Step 10: Create a default route out of the WAN
      • Step 11:Verify the system configuration by displaying the running configuration.
    • 10.2.1 Stopping DoS Attacks
    • 10.2.2 Packet Reassembly
  • 10.3 NAT Configurations
  • 10.4 NAT Configuration Examples
    • 10.4.1 Dynamic NAT (many to many)
    • 10.4.2 Static NAT (one to one)
    • 10.4.3 Port Address Translation (Many to one)
      • Method:1 – Specifying NAT address with the policy command
      • Method:2 – Attaching nat pool to the policy
• Multipath Multicast Configurations
  • 11.1 Multipath Multicast
  • 11.2 Multipath Commands
    • 11.2.1 Multipath Examples
• Configuring NAT
  • 12.1 Network Address Translation
    • 12.1.1 Dynamic NAT
    • 12.1.2 Static NAT
    • 12.1.3 Configuration for Figure 1
    • 12.1.4 Configuration for Figure 2
    • 12.1.5 Reverse NAT
    • 12.1.6 Configuration for Figure 3
• NAT Configuration Examples
  • 13.1 NAT Configurations
  • 13.1 NAT Configuration Examples
    • 13.1.1 Dynamic NAT (many to many)
    • 13.1.2 Static NAT (one to one)
    • 13.1.3 Port Address Translation (Many to one)
      • Method:1 – Specifying NAT address with the policy command
      • Method:2 – Attaching nat pool to the policy
• Remote Access VPNs
  • 14.1 Secure Remote Access Using IPSec VPN
  • 14.2 Access Methods
    • 14.2.1 Remote Access: User Group
    • 14.2.2 Remote Access: Mode Configuration
  • 14.3 Configuration Examples
  • 14.4 IPSec Remote Access User Group Method – Single Proposal, Pre-shared Key Authentication
  • 14.5 IPSec Remote Access Mode Configuration Group Method
• Networking with Routing Information Protocol
  • 15.1 Routing Information Protocol
    • 15.1.1 Configuring RIP for Ethernet 0 and WAN 1 Interfaces
    • 15.1.2 Displaying RIP Configuration
    • 15.1.3 Displaying All Configured RIP Interfaces
• Configuring Static Routes
  • 16.1 Static Routing Configuration
    • 16.1.1 Configure the Router at Site “A”
    • 16.1.2 Configure the Router at site “B”
• Configuring Open Shortest Path First Routing
  • 17.1 OSPF Routing Protocol
    • 17.1.1 Configuring the host name
    • 17.1.2 Configuring interface ethernet 0
    • 17.1.3 Configuring interface bundle Dallas
    • 17.1.4 Configuring ospf
    • 17.1.5 Configuring ospf interface parameters
    • 17.1.6 Displaying neighbors
    • 17.1.7 Displaying ospf routes
    • 17.1.8 Displaying IP routes
• Configuring Generic Routing Encapsulation
  • 18.1 Configuring GRE
  • 18.2 Installing Licenses
  • 18.3 GRE Configuration Examples
    • 18.3.1 Configuring Site to Site Tunnel
  • 18.4 Configuring GRE Site to Site with IPSec
  • 18.5 Configuring GRE Site to Site with IPSec and OSPF
• Configuring OSPF and Frame Relay
  • 19.1 OSPF - Frame Relay
    • 19.1.1 Configuring the host name
    • 19.1.2 Configuring interface ethernet 0
    • 19.1.3 Configuring interface bundle Dallas
    • 19.1.4 Configuring OSPF
    • 19.1.5 Configuring interface Dallas parameters
    • 19.1.6 Configuring interface ethernet 0 parameters
    • 19.1.7 Displaying OSPF parameters
• Configuring Protocol Independent Multicasting Routing
  • 20.1 PIM Configuration
    • 20.1.1 PIM Commands
    • 20.1.2 PIM Configuration Examples
• mtrace Configuration
  • 21.1 Multicast Traceroute Facility
    • 21.1.1 mtrace Command
      • 21.1.2 Restrictions
    • 21.1.2 mtrace Example
• Configuring Quality of Service Routing
  • 22.1 Configuring QoS
    • 22.1.1 Features
    • 22.1.2 Definitions
    • 22.1.3 Classification Types
      • 22.1.3.1 Create bundle AppTest
      • 22.1.3.2 Create traffic classes
      • 22.1.3.3 Assign classification types
    • 22.1.4 VLAN Identifiers
      • 22.1.4.1 Create bundle VLANtest
      • 22.1.4.2 Create traffic classes and assign classifications
    • 22.1.5 Bulk Statistics
      • 22.1.5.1 Configuring bulk statistics
• Virtual LAN Tagging
  • 23.1 Managing Traffic with VLAN Tagging
    • 23.1.1 Reston configuration: Black Box LR1104A
      • 23.1.1.1 Configure interface bundle balt1
      • 23.1.1.2 Configure interface balt1 pvc 100
      • 23.1.1.3 Configure interface bundle dc1
      • 23.1.1.4 Configure interface ethernet 0
      • 23.1.1.5 Configure ip routing
    • 23.1.2 DC configuration: Black Box LR1114A
      • 23.1.2.1 Configure interface ethernet 0
      • 23.1.2.2 Configure interface bundle mip
      • 23.1.2.3 Configure ip routing
• Managing Redundant connections
  • 24.1 Trunk Group/Failover
    • 24.1.1 Configuration Details
      • 24.1.1.1 Configure the Black Box LR1114A for Failover Operation
• WAN Interface Configurations
  • 25.1 T1 Interface Configuration
    • 25.1.1 Module Configuration
      • 25.1.1.1 T1
    • 25.1.2 Bundle Configuration
      • 25.1.2.1 Fractional T1
        • 27.1.3 T1
        • 27.1.4 NxT1
• Virtual LAN Forwarding
  • 26.1 Managing VLAN Traffic
    • 26.1.1 POP configuration: Black Box LR1104A
      • 26.1.1.1 Configure mlppp bundle interface
      • 26.1.1.2 Configure interface ethernet 0
      • 26.1.1.3 Configure in-band vlan forwarding table
      • 26.1.1.4 Configure rate limiting for vlans
    • 26.1.2 Bldg1 configuration: Black Box LR1114A
      • 26.1.2.1 Configure interface bundle uplink
      • 26.1.2.2 Configure inband VLAN forwarding table
      • 26.1.2.3 Configure rate limiting for VLANs
      • 26.1.2.4 Configure SNMP
• Mutlilink Frame Relay
  • 27.1 Multilink Frame Relay FRF.15 and FRF.16
    • 27.1.1 Features
      • 27.1.1.1 # Configure Ethernet interface
      • 27.1.1.2 # Configure CVC1
      • 27.1.1.3 # Congfigure CVC2
      • 27.1.1.4 # Configure CVC3
      • 27.1.1.5 #Configure AVC
• Configuring Frame Relay and Multilink Frame Relay
  • 28.1 Layer Two Configurations FR and MFR
    • 28.1.1 FR Configuration
      • 28.1.1.1 Configure the HSSI Bundle at Site 1
      • 28.1.1.2 Configure the Clear Channel Bundle on the LR1104A
    • 28.1.2 MFR Configuration
      • 28.1.2.1 Configure the LR1104A LR1104A at Site 1
      • 28.1.2.2 Configure the LR1104A
      • 28.1.2.3 Configure the LR1104A LR1114A at Site 2
      • 28.1.2.4 Configure the LR1104A