ELTEX ESR Series User Manual

ESR-Series. User manual
503
16.3.3 Configuration example 2
Objective:
Configure access for users in LAN 21.12.2.0/24 to public network using Source NAT function without the
firewall. Public network address range for SNAT 200.10.0.100-200.10.0.249.
Solution:
Begin configuration with network interface configuration and disabling the firewall:
esr(config)# interface gigabitethernet 1/0/1
esr(config-if-gi)# ip address 21.12.2.1/24
esr(config-if-gi)# ip firewall disable
esr(config-if-gi)# exit
esr(config)# interface tengigabitethernet 1/0/1
esr(config-if-te)# ip address 200.10.0.1/24
esr(config-if-te)# ip firewall disable
esr(config-if-te)# exit
For SNAT function configuration, create 'LOCAL_NET' LAN address profile that includes addresses which are
allowed to access the public network and 'PUBLIC_POOL' public network address profile.
esr(config)# object-group network LOCAL_NET
esr(config-object-group-network)# ip address-range 21.12.2.2-21.12.2.254
esr(config-object-group-network)# exit

esr(config)# object-group network PUBLIC_POOL
esr(config-object-group-network)# ip address-range 200.10.0.100-200.10.0.249
esr(config-object-group-network)# exit
Configure SNAT service.
First step is to create public network address pool for use with SNAT:
esr(config)# nat source
esr(config-snat)# pool TRANSLATE_ADDRESS
esr(config-snat-pool)# ip address-range 200.10.0.100-200.10.0.249
esr(config-snat-pool)# exit
Second step is to create SNAT rule set. In the set attributes, specify that the rules are applying only to packets
transferred to public network through te1/0/1 port. Rules include a check which ensures that data source
address belongs to 'LOCAL_NET' pool:

ELTEX ESR Series Specifications

General

Model	ESR Series
Category	Network Router
Manufacturer	ELTEX
Management	Web interface, CLI, SNMP
Operating Temperature	0°C to 40°C
Dimensions	Varies by model
Weight	Varies by model
Routing Protocols	OSPF, BGP
WAN Interfaces	Ethernet, SFP
LAN Interfaces	Ethernet, SFP
VPN Support	IPsec, L2TP, PPTP
Firewall	Stateful packet inspection, ACLs
Power over Ethernet (PoE)	Available on some models
QoS	Traffic prioritization

Summary

4 Management interfaces

4.1 Command line interface (CLI)

Explains the Command Line Interface for device management, including access methods and security.

5 Initial router configuration

5.1 ESR router factory settings

Information on essential basic settings installed with the factory configuration for immediate use.

5.2 Router connection and configuration

Covers basic router configuration, including IP addresses, security zones, and services like NAT and Firewall.

6 Firmware update

6.1 Updating firmware via system resources

Procedure for updating firmware using TFTP, FTP, or SCP servers.

6.2 Updating firmware via bootloader

Instructions for updating router firmware via the bootloader, including TFTP server configuration.

7 Safe configuration recommendations

7.1 General recommendations

General recommendations for safe installation, including disabling unused interfaces and setting system clock.

7.2 Event logging system configuration

7.3 Password usage policy configuration

Configuration algorithms for password policy, including length, complexity, and history.

7.4 AAA policy configuration

Configuration algorithms for AAA policy, including RADIUS, TACACS, and LDAP authentication.

7.5 Remote management configuration

Recommendations and examples for secure remote management configuration.

7.6 Configuration of protection against network attacks mechanisms

Algorithms and recommendations for configuring network attack protection mechanisms.

8 Interface management

8.1 VLAN Configuration

Details on configuring VLANs, including algorithms and examples for tagged and untagged modes.

8.2 LLDP configuration

Explains LLDP configuration for network equipment discovery and parameter exchange.

8.3 LLDP MED configuration

8.4 Sub-interface termination configuration

8.5 Q-in-Q termination configuration

8.8 MLPPP Configuration

8.9 Bridge configuration

8.11 Mirroring configuration (SPAN/RSPAN)

8.12 LACP configuration

9 Tunneling management

9.1 GRE tunnel configuration

Details GRE tunnel configuration, including algorithms and IP-GRE tunnel examples.

9.2 DMVPN configuration

Explains DMVPN configuration for creating virtual private networks with dynamic tunnels.

9.3 L2TPv3 tunnel configuration

Provides configuration algorithms and examples for L2TPv3 tunnels for Layer 2 OSI packets.

9.4 IPsec VPN configuration

Covers IPsec VPN configuration, including route-based, policy-based, and remote access methods.

9.5 LT tunnels configuration

10 QoS management

10.1 Basic QoS

Configuration for basic QoS, focusing on traffic classification and relabeling on input.

10.2 Advanced QoS

11 Routing management

11.1 Routing information advertising policy

Describes policies for advertising routing information via RIP, OSPF, IS-IS, iBPG, and eBPG protocols.

11.2 Static routes configuration

Explains static routing configuration without dynamic routing protocols.

11.3 RIP Configuration

11.4 OSFP configuration

11.5 BGP configuration

Explains BGP configuration for subnet reachability information exchange among autonomous systems.

11.7 PBR routing policy configuration

11.8 VRF Lite configuration

11.10 IS-IS configuration

12 MPLS technology management

12.1 LDP configuration

Details LDP configuration, including algorithms and examples for peer communication.

12.2 Configuring session parameters in LDP

12.3 Configuring session parameters in targeted-LDP

12.5 L2VPN Martini mode configuration

12.6 L2VPN Kompella mode configuration

12.7 L3VPN configuration

Details L3VPN service configuration for combining distributed client IP networks within a single VRF.

13 Security management

13.1 AAA configuration

Covers AAA (Authentication, Authorization, Accounting) for access provisioning and control.

13.2 Command privilege configuration

13.3 Configuration of logging and protection against network attacks

Provides algorithms for configuring logging and protection against various network attacks.

13.4 Firewall configuration

Explains firewall configuration for controlling and filtering network packets based on defined rules.

13.5 Access list (ACL) configuration

Details Access Control List (ACL) configuration for defining traffic transmission rules.

13.6 IPS/IDS configuration

Covers IPS/IDS configuration, including base setup, rule updates, and user rule creation.

14 Redundancy management

14.1 VRRP configuration

Covers VRRP configuration for increased router availability and default gateway redundancy.

14.2 VRRP tracking configuration

15 Remote access configuration

15.1 Configuring server for remote access to corporate network via PPTP protocol

Details PPTP server configuration for establishing secure VPN tunnels over unsecured networks.

15.2 Configuring server for remote access to corporate network via L2TP protocol

Explains L2TP server configuration for establishing virtual private networks and data security.

15.3 Configuring server for remote access to corporate network via OpenVPN protocol

Covers OpenVPN server configuration for secure remote access and data transmission.

15.4 Configuring remote access client via PPPoE

15.5 Configuring remote access client via PPTP

15.6 Configuring remote access client via L2TP

16 Service management

16.1 DHCP server configuration

Covers integrated DHCP server configuration for LAN device network settings.

16.2 Destination NAT configuration

Explains Destination NAT (DNAT) for translating destination IP addresses for public network access.

16.3 Source NAT configuration

16.4 Static NAT configuration

16.5 HTTP/HTTPS traffic proxying

18 BRAS (Broadband Remote Access Server) management

18.1 Configuration algorithm

18.2 Example of configuration with SoftWLC

19 VoIP management

19.1 SIP profile configuration algorithm

19.2 FXS/FXO ports configuration algorithm

19.3 Dial plan configuration algorithm

19.4 PBX server configuration algorithm

19.6 VoIP configuration example

19.7 Dial plan configuration example