FireBrick FB2700
User Manual
FB2700 Versatile Network Appliance
FireBrick FB2700 User Manual
This User Manual documents Software version V1.53.000 Copyright © 2012-2018 FireBrick Ltd.
Table of Contents
Preface ... xxii
1. Introduction ... 1
1.1. The FB2700 ... 1
1.1.1. Where do I start? ... 1
1.1.2. What can it do? ... 1
1.1.3. Ethernet port capabilities ... 2
1.1.4. Differences between the devices in the FB2x00 series ... 2
1.1.5. Software features ... 2
1.1.6. Migration from previous FireBrick models ... 2
1.2. About this Manual ... 3
1.2.1. Version ... 3
1.2.2. Intended audience ... 3
1.2.3. Technical details ... 3
1.2.4. Document style ... 3
1.2.5. Document conventions ... 4
1.2.6. Comments and feedback ... 4
1.3. Additional Resources ... 4
1.3.1. Technical Support ... 4
1.3.2. IRC Channel ... 5
1.3.3. Application Notes ... 5
1.3.4. Training Courses ... 5
2. Getting Started ... 6
2.1. IP addressing ... 6
2.2. Accessing the web-based user interface ... 6
2.2.1. Setup wizard ... 7
2.2.1.1. Login username/password ... 9
2.2.1.2. WAN/PPPoE settings ... 9
2.2.1.3. LAN settings ... 9
2.2.1.4. Initial config ... 9
3. Configuration ... 10
3.1. The Object Hierarchy ... 10
3.2. The Object Model ... 10
3.2.1. Formal definition of the object model ... 11
3.2.2. Common attributes ... 11
3.3. Configuration Methods ... 11
3.4. Data types ... 11
3.4.1. Sending and receiving values ... 12
3.4.2. Lists of values ... 12
3.4.3. Set of possible values ... 12
3.4.4. Dates, times, and durations ... 12
3.4.5. Colours ... 12
3.4.6. Passwords and secrets ... 13
3.4.7. IP addresses ... 13
3.4.7.1. Simple IP addresses ... 13
3.4.7.2. Subnets and prefixes ... 13
3.4.7.3. Ranges ... 13
3.4.7.4. Prefix filters ... 14
3.5. Web User Interface Overview ... 14
3.5.1. User Interface layout ... 14
3.5.1.1. Customising the layout ... 15
3.5.2. Config pages and the object hierarchy ... 15
3.5.2.1. Configuration categories ... 16
3.5.2.2. Object settings ... 17
3.5.3. Navigating around the User Interface ... 18
FireBrick FB2700 User Manual
3.5.4. Backing up / restoring the configuration ... 19
3.6. Configuration using XML ... 19
3.6.1. Introduction to XML ... 19
3.6.2. The root element - <config> ... 20
3.6.3. Viewing or editing XML ... 20
3.6.4. Example XML configuration ... 21
3.7. Downloading/Uploading the configuration ... 22
3.7.1. Download ... 23
3.7.2. Upload ... 23
4. System Administration ... 24
4.1. User Management ... 24
4.1.1. Login level ... 24
4.1.2. Configuration access level ... 25
4.1.3. Login idle timeout ... 25
4.1.4. Restricting user logins ... 25
4.1.4.1. Restrict by IP address ... 25
4.1.4.2. Logged in IP address ... 26
4.1.4.3. Restrict by profile ... 26
4.1.5. Password change ... 26
4.1.6. One Time Password (OTP) ... 26
4.2. General System settings ... 27
4.2.1. System name (hostname) ... 27
4.2.2. Administrative details ... 27
4.2.3. System-level event logging control ... 27
4.2.4. Home page web links ... 27
4.3. Software Upgrades ... 28
4.3.1. Software release types ... 28
4.3.1.1. Breakpoint releases ... 28
4.3.2. Identifying current software version ... 29
4.3.3. Internet-based upgrade process ... 29
4.3.3.1. Manually initiating upgrades ... 29
4.3.3.2. Controlling automatic software updates ... 30
4.3.4. Manual upgrade ... 30
4.4. Boot Process ... 31
4.4.1. LED indications ... 31
4.4.1.1. Power LED status indications ... 31
4.4.1.2. Port LEDs ... 31
5. Event Logging ... 32
5.1. Overview ... 32
5.1.1. Log targets ... 32
5.1.1.1. Logging to Flash memory ... 32
5.1.1.2. Logging to the Console ... 33
5.2. Enabling logging ... 33
5.3. Logging to external destinations ... 33
5.3.1. Syslog ... 33
5.3.2. Email ... 34
5.3.2.1. E-mail process logging ... 35
5.4. Factory reset configuration log targets ... 35
5.5. Performance ... 35
5.6. Viewing logs ... 35
5.6.1. Viewing logs in the User Interface ... 35
5.6.2. Viewing logs in the CLI environment ... 36
5.7. System-event logging ... 36
5.8. Using Profiles ... 36
6. Interfaces and Subnets ... 37
6.1. Relationship between Interfaces and Physical Ports ... 37
FireBrick FB2700 User Manual
6.1.1. Port groups ... 37
6.1.2. Interfaces ... 38
6.2. Defining port groups ... 38
6.3. Defining an interface ... 39
6.3.1. Defining subnets ... 39
6.3.1.1. Source filtering ... 40
6.3.1.2. Using DHCP to configure a subnet ... 40
6.3.2. Setting up DHCP server parameters ... 41
6.3.2.1. Fixed/Static DHCP allocations ... 41
6.3.2.2. Restricted allocations ... 42
6.3.2.3. Special DHCP options ... 43
6.3.3. DHCP Relay Agent ... 43
6.4. Physical port settings ... 43
6.4.1. Disabling auto-negotiation ... 44
6.4.2. Setting port speed ... 44
6.4.3. Setting duplex mode ... 44
6.4.4. Defining port LED functions ... 44
7. Session Handling ... 46
7.1. Routing vs. Firewalling ... 46
7.2. Session Tracking ... 46
7.2.1. Session termination ... 47
7.3. Session Rules ... 47
7.3.1. Overview ... 47
7.3.2. Processing flow ... 48
7.3.3. Defining Rule-Sets and Rules ... 51
7.3.3.1. Recommended method of implementing firewalling ... 52
7.3.3.2. Changes to session traffic ... 53
7.3.3.3. Graphing and traffic shaping ... 54
7.3.3.4. Configuring session time-outs ... 54
7.3.3.5. Load balancing ... 55
7.3.3.6. NAT-PMP / PCP (Port Control Protocol) ... 55
7.4. Network Address Translation ... 56
7.4.1. When to use NAT ... 56
7.4.2. NAT ALGs ... 57
7.4.3. Setting NAT in rules ... 57
7.4.4. What NAT does ... 57
7.4.5. NAT with PPPoE ... 58
7.4.6. NAT with Dongles ... 58
7.4.7. NAT with other types of external routing ... 58
7.4.8. Mixing NAT and non NAT ... 58
7.4.9. Carrier grade NAT ... 59
7.4.10. Using NAT setting on subnets ... 59
8. Routing ... 60
8.1. Routing logic ... 60
8.2. Routing targets ... 61
8.2.1. Subnet routes ... 61
8.2.2. Routing to an IP address (gateway route) ... 61
8.2.3. Special targets ... 62
8.3. Dynamic route creation / deletion ... 62
8.4. Routing tables ... 62
8.5. Bonding ... 62
8.6. Route overrides ... 63
9. Profiles ... 64
9.1. Overview ... 64
9.2. Creating/editing profiles ... 64
9.2.1. Timing control ... 64
FireBrick FB2700 User Manual
9.2.2. Tests ... 65
9.2.2.1. General tests ... 65
9.2.2.2. Time/date tests ... 65
9.2.2.3. Ping tests ... 65
9.2.3. Inverting overall test result ... 66
9.2.4. Manual override ... 66
9.2.5. Scripting ... 66
10. Traffic Shaping ... 68
10.1. Graphs and Shapers ... 68
10.1.1. Graphs ... 68
10.1.2. Shapers ... 69
10.1.3. Ad hoc shapers ... 69
10.1.4. Long term shapers ... 69
10.2. Multiple shapers ... 70
10.3. Basic principles ... 70
11. PPPoE ... 71
11.1. Types of DSL line and router in the United Kingdom ... 71
11.2. Definining PPPoE links ... 72
11.2.1. IPv6 ... 72
11.2.2. Additional options ... 72
11.2.2.1. MTU and TCP fix ... 72
11.2.2.2. Service and ac-name ... 73
11.2.2.3. Logging ... 73
11.2.2.4. Speed and graphs ... 73
12. Tunnels ... 74
12.1. IPsec (IP Security) ... 74
12.1.1. Introduction ... 74
12.1.1.1. Integrity checking ... 74
12.1.1.2. Encryption ... 74
12.1.1.3. Authentication ... 75
12.1.1.4. IKE ... 75
12.1.1.5. Manual Keying ... 75
12.1.1.6. Identities and the Authentication Mechanism ... 76
12.1.2. Setting up IPsec connections ... 76
12.1.2.1. Global IPsec parameters ... 76
12.1.2.2. IKE proposals ... 77
12.1.2.3. IKE roaming IP pools ... 77
12.1.2.4. IKE connections ... 77
12.1.2.4.1. IKE connection mode and type ... 77
12.1.2.4.2. IKE and IPsec proposal lists ... 77
12.1.2.4.3. Authentication and IKE identities ... 78
12.1.2.4.4. IP addresses ... 79
12.1.2.4.5. Road Warrior connections ... 79
12.1.2.4.6. Routing ... 79
12.1.2.4.7. Other parameters ... 79
12.1.2.5. Setting up Manual Keying ... 80
12.1.2.5.1. IP endpoints ... 80
12.1.2.5.2. Algorithms and keys ... 80
12.1.2.5.3. Routing ... 80
12.1.2.5.4. Mode ... 81
12.1.2.5.5. Other parameters ... 81
12.1.3. Using EAP with IPsec/IKE ... 81
12.1.4. Using certificates with IPsec/IKE ... 81
12.1.4.1. Creating certificates ... 83
12.1.5. Choice of algorithms ... 84
12.1.6. NAT Traversal ... 85
FireBrick FB2700 User Manual
12.1.7. Configuring a Road Warrior server ... 85
12.1.8. Connecting to non-FireBrick devices ... 87
12.1.8.1. Using StrongSwan on Linux ... 87
12.1.8.2. Setting up a Road Warrior VPN on an Android client ... 88
12.1.8.3. Setting up a Road Warrior VPN on an iOS (iPhone/iPad) client ... 88
12.1.8.4. Manual keying using Linux ipsec-tools ... 89
12.2. FB105 tunnels ... 90
12.2.1. Tunnel wrapper packets ... 90
12.2.2. Setting up a tunnel ... 91
12.2.3. Viewing tunnel status ... 91
12.2.4. Dynamic routes ... 92
12.2.5. Tunnel bonding ... 92
12.2.6. Tunnels and NAT ... 92
12.2.6.1. FB2700 doing NAT ... 92
12.2.6.2. Another device doing NAT ... 93
12.3. Ether tunnelling ... 93
13. USB Port ... 94
13.1. USB configuration ... 94
13.1.1. 3G dongle configuration ... 94
14. System Services ... 95
14.1. Protecting the FB2700 ... 95
14.2. Common settings ... 95
14.3. HTTP Server configuration ... 96
14.3.1. Access control ... 96
14.3.1.1. Trusted addresses ... 96
14.3.2. HTTPS access ... 97
14.4. Telnet Server configuration ... 98
14.4.1. Access control ... 98
14.5. DNS configuration ... 99
14.5.1. Blocking DNS names ... 99
14.5.2. Local DNS responses ... 99
14.5.3. Auto DHCP DNS ... 99
14.6. NTP configuration ... 99
14.7. SNMP configuration ... 100
14.8. RADIUS configuration ... 100
14.8.1. RADIUS server (platform RADIUS) ... 100
14.8.2. RADIUS client ... 100
14.8.2.1. RADIUS client settings ... 100
14.8.2.2. Server blacklisting ... 101
15. Network Diagnostic Tools ... 102
15.1. Firewalling check ... 102
15.2. Access check ... 103
15.3. Packet Dumping ... 103
15.3.1. Dump parameters ... 104
15.3.2. Security settings required ... 104
15.3.3. IP address matching ... 105
15.3.4. Packet types ... 105
15.3.5. Snaplen specification ... 105
15.3.6. Using the web interface ... 105
15.3.7. Using an HTTP client ... 106
15.3.7.1. Example using curl and tcpdump ... 106
16. VRRP ... 107
16.1. Virtual Routers ... 107
16.2. Configuring VRRP ... 108
16.2.1. Advertisement Interval ... 108
16.2.2. Priority ... 108
FireBrick FB2700 User Manual
16.3. Using a virtual router ... 108
16.4. VRRP versions ... 108
16.4.1. VRRP version 2 ... 108
16.4.2. VRRP version 3 ... 109
16.5. Compatibility ... 109
17. VoIP ... 110
17.1. What is VoIP? ... 110
17.2. Registration and Proxies ... 110
17.2.1. Registrar ... 110
17.2.2. Proxy ... 110
17.3. Home/office phone system ... 111
17.4. Network Address Translation ... 111
17.5. Number plan ... 112
17.6. Telephone handsets ... 112
17.7. VoIP call carriers ... 113
17.8. Hunt groups ... 114
17.8.1. Ring Type ... 114
17.8.2. Ring order ... 115
17.8.3. Overflow ... 115
17.8.4. Out of hours ... 115
17.9. Call pickup/steal ... 115
17.10. Busy lamp field ... 116
17.11. Using RADIUS ... 116
17.11.1. RADIUS accounting ... 116
17.11.2. RADIUS authentication ... 116
17.11.2.1. Call routing by RADIUS ... 117
17.12. Call recording ... 118
17.13. Voicemail and IVR services ... 119
17.14. Call Data Records ... 119
17.15. Technical details ... 120
17.16. Custom tones ... 120
18. BGP ... 122
18.1. What is BGP? ... 122
18.2. BGP Setup ... 122
18.2.1. Overview ... 122
18.2.2. Standards ... 122
18.2.3. Simple example setup ... 123
18.2.4. Peer type ... 123
18.2.5. Route filtering ... 124
18.2.5.1. Matching attributes ... 124
18.2.5.2. Action attributes ... 124
18.2.6. Well known community tags ... 125
18.2.7. Announcing black hole routes ... 125
18.2.8. Grey holes ... 126
18.2.9. Announcing dead end routes ... 126
18.2.10. Bad optional path attributes ... 126
18.2.11. <network> element ... 127
18.2.12. <route>, <subnet> and other elements ... 127
18.2.13. Route feasibility testing ... 127
18.2.14. Diagnostics ... 127
18.2.15. Router startup and shutdown ... 127
18.2.16. TTL security ... 128
19. OSPF ... 129
19.1. What is OSPF? ... 129
19.2. OSPF Setup ... 129
19.2.1. Overview ... 129
FireBrick FB2700 User Manual
19.2.2. Standards ... 129
19.2.3. Simple example setup ... 130
19.2.4. <ospf> configelement ... 130
20. Internet Service Providers ... 131
20.1. Background ... 131
20.1.1. How it all began ... 131
20.1.2. Point to Point Protocol ... 131
20.1.3. L2TP ... 131
20.1.4. Broadband ... 132
20.1.5. RADIUS ... 132
20.1.6. BGP ... 132
20.2. Incoming L2TP connections ... 132
20.3. The importance of CQM graphs ... 133
20.4. Authentication ... 133
20.5. Accounting ... 134
20.6. RADIUS Control messages ... 134
20.7. PPPoE ... 134
20.8. Typical configuration ... 134
20.8.1. Interlink subnet ... 134
20.8.2. BGP with carrier ... 135
20.8.3. RADIUS session steering ... 135
20.8.4. L2TP endpoints ... 136
20.8.5. ISP RADIUS ... 136
21. Command Line Interface ... 137
A. Factory Reset Procedure ... 138
B. CIDR and CIDR Notation ... 140
C. MAC Addresses usage ... 142
C.1. Multiple MAC addresses? ... 142
C.2. How the FireBrick allocates MAC addresses ... 143
C.2.1. Interface ... 143
C.2.2. Subnet ... 143
C.2.3. PPPoE ... 143
C.2.4. Base MAC ... 143
C.2.5. Running out of MACs ... 144
C.3. MAC address on label ... 144
C.4. Using with a DHCP server ... 145
D. Scripted access ... 146
D.1. Tools ... 146
D.2. Access control ... 146
D.2.1. Username and password ... 146
D.2.2. OTP ... 146
D.2.3. Allow list ... 146
D.2.4. Allowed access ... 146
D.3. XML data for common functions ... 146
D.4. XML data from diagnostics and tests ... 147
D.4.1. Cross site scripting security ... 147
D.4.2. Arguments to scripts ... 147
D.5. Special URLs ... 148
D.6. Web sockets ... 148
E. VLANs : A primer ... 149
F. Supported L2TP Attribute/Value Pairs ... 150
F.1. Start-Control-Connection-Request ... 150
F.2. Start-Control-Connection-Reply ... 150
F.3. Start-Control-Connection-Connected ... 151
F.4. Stop-Control-Connection-Notification ... 151
F.5. Hello ... 151
FireBrick FB2700 User Manual
F.6. Incoming-Call-Request ... 151
F.7. Incoming-Call-Reply ... 152
F.8. Incoming-Call-Connected ... 152
F.9. Outgoing-Call-Request ... 152
F.10. Outgoing-Call-Reply ... 153
F.11. Outgoing-Call-Connected ... 153
F.12. Call-Disconnect-Notify ... 153
F.13. WAN-Error-Notify ... 153
F.14. Set-Link-Info ... 153
F.15. Notes ... 154
F.15.1. BT specific notes ... 154
F.15.2. IP over LCP ... 154
G. Supported RADIUS Attribute/Value Pairs for L2TP operation ... 155
G.1. Authentication request ... 155
G.2. Authentication response ... 156
G.2.1. Accepted authentication ... 156
G.2.1.1. Prefix Delegation ... 157
G.2.2. Rejected authentication ... 158
G.3. Accounting Start ... 158
G.4. Accounting Interim ... 159
G.5. Accounting Stop ... 160
G.6. Disconnect ... 160
G.7. Change of Authorisation ... 160
G.8. Filter ID ... 161
G.9. Notes ... 162
G.9.1. L2TP relay ... 162
G.9.2. LCP echo and CQM graphs ... 163
G.9.3. IP over LCP ... 163
G.9.4. Closed User Group ... 164
G.9.5. Routing table ... 164
H. Supported RADIUS Attribute/Value Pairs for VoIP operation ... 165
H.1. Authentication request ... 165
H.2. Authentication response ... 166
H.2.1. Challenge authentication ... 166
H.2.2. Accepted authentication (registration) ... 166
H.2.3. Accepted authentication (invite) ... 166
H.2.4. Rejected authentication ... 167
H.3. Accounting Start ... 167
H.4. Accounting Interim ... 167
H.5. Accounting Stop ... 168
H.6. Disconnect ... 168
H.7. Change of Authorisation ... 169
I. FireBrick specific SNMP objects ... 170
I.1. BGP information ... 170
I.2. IPsec information ... 170
I.3. L2TP information ... 171
I.4. VoIP information ... 172
I.5. CPU usage information ... 172
I.6. Running Statistics ... 172
J. Command line reference ... 174
J.1. General commands ... 174
J.1.1. Trace off ... 174
J.1.2. Trace on ... 174
J.1.3. Uptime ... 174
J.1.4. General status ... 174
J.1.5. Memory usage ... 174
FireBrick FB2700 User Manual
J.1.6. Process/task usage ... 174
J.1.7. Login ... 174
J.1.8. Logout ... 175
J.1.9. See XML configuration ... 175
J.1.10. Load XML configuration ... 175
J.1.11. Show profile status ... 175
J.1.12. Enable profile control switch ... 175
J.1.13. Disable profile control switch ... 175
J.1.14. Show RADIUS servers ... 175
J.1.15. Show DNS resolvers ... 175
J.2. Networking commands ... 176
J.2.1. Subnets ... 176
J.2.2. Ping and trace ... 176
J.2.3. Show a route from the routing table ... 176
J.2.4. List routes ... 176
J.2.5. List routing next hops ... 176
J.2.6. See DHCP allocations ... 177
J.2.7. Clear DHCP allocations ... 177
J.2.8. Lock DHCP allocations ... 177
J.2.9. Unlock DHCP allocations ... 177
J.2.10. Name DHCP allocations ... 177
J.2.11. Show ARP/ND status ... 177
J.2.12. Show VRRP status ... 177
J.2.13. Send Wake-on-LAN packet ... 177
J.3. Firewalling commands ... 178
J.3.1. Check access to services ... 178
J.3.2. Check firewall logic ... 178
J.4. USB/dongle commands ... 178
J.4.1. Show dongle connectoons ... 178
J.4.2. Reset USB interface and all attached devices ... 178
J.4.3. Reset PPP/Dongle data connection ... 178
J.5. L2TP commands ... 178
J.6. BGP commands ... 178
J.7. OSPF commands ... 179
J.8. PPPoE commands ... 179
J.9. VoIP commands ... 179
J.10. Dongle/USB commands ... 179
J.11. Advanced commands ... 179
J.11.1. Panic ... 179
J.11.2. Reboot ... 179
J.11.3. Screen width ... 179
J.11.4. Make outbound command session ... 180
J.11.5. Show command sessions ... 180
J.11.6. Kill command session ... 180
J.11.7. Flash memory list ... 180
J.11.8. Delete block from flash ... 180
J.11.9. Boot log ... 180
J.11.10. Flash log ... 180
K. Constant Quality Monitoring - technical details ... 181
K.1. Broadband back-haul providers ... 181
K.2. Access to graphs and csvs ... 181
K.2.1. Trusted access ... 181
K.2.2. Dated information ... 182
K.2.3. Authenticated access ... 182
K.3. Graph display options ... 182
K.3.1. Scaleable Vector Graphics ... 182
FireBrick FB2700 User Manual
K.3.2. Data points ... 183
K.3.3. Additional text ... 183
K.3.4. Other colours and spacing ... 183
K.4. Overnight archiving ... 184
K.4.1. Full URL format ... 184
K.4.2. load handling ... 185
K.5. Graph scores ... 185
K.6. Creating graphs, and graph names ... 185
L. Hashed passwords ... 186
L.1. Password hashing ... 186
L.1.1. Salt ... 186
L.2. One Time Password seed hashing ... 187
M. Configuration Objects ... 189
M.1. Top level ... 189
M.1.1. config: Top level config ... 189
M.2. Objects ... 190
M.2.1. system: System settings ... 190
M.2.2. link: Web links ... 191
M.2.3. user: Admin users ... 192
M.2.4. eap: User access controlled by EAP ... 192
M.2.5. log: Log target controls ... 192
M.2.6. log-syslog: Syslog logger settings ... 193
M.2.7. log-email: Email logger settings ... 193
M.2.8. services: System services ... 194
M.2.9. http-service: Web service settings ... 194
M.2.10. dns-service: DNS service settings ... 195
M.2.11. dns-host: Fixed local DNS host settings ... 196
M.2.12. dns-block: Fixed local DNS blocks ... 197
M.2.13. radius-service: RADIUS service definition ... 197
M.2.14. radius-service-match: Matching rules for RADIUS service ... 198
M.2.15. radius-server: RADIUS server settings ... 199
M.2.16. telnet-service: Telnet service settings ... 200
M.2.17. snmp-service: SNMP service settings ... 201
M.2.18. time-service: System time server settings ... 201
M.2.19. ethernet: Physical port controls ... 202
M.2.20. sampling: Packet sampling configuration ... 203
M.2.21. portdef: Port grouping and naming ... 203
M.2.22. interface: Port-group/VLAN interface settings ... 204
M.2.23. subnet: Subnet settings ... 205
M.2.24. vrrp: VRRP settings ... 206
M.2.25. dhcps: DHCP server settings ... 207
M.2.26. dhcp-attr-hex: DHCP server attributes (hex) ... 207
M.2.27. dhcp-attr-string: DHCP server attributes (string) ... 208
M.2.28. dhcp-attr-number: DHCP server attributes (numeric) ... 208
M.2.29. dhcp-attr-ip: DHCP server attributes (IP) ... 208
M.2.30. pppoe: PPPoE settings ... 209
M.2.31. ppp-route: PPP routes ... 210
M.2.32. usb: USB 3G/dongle settings ... 210
M.2.33. dongle: 3G/dongle settings ... 211
M.2.34. route: Static routes ... 212
M.2.35. network: Locally originated networks ... 213
M.2.36. blackhole: Dead end networks ... 213
M.2.37. loopback: Locally originated networks ... 214
M.2.38. ospf: Overall OSPF settings ... 214
M.2.39. namedbgpmap: Mapping and filtering rules of BGP prefixes ... 215
M.2.40. bgprule: Individual mapping/filtering rule ... 215
FireBrick FB2700 User Manual
M.2.41. bgp: Overall BGP settings ... 216
M.2.42. bgppeer: BGP peer definitions ... 216
M.2.43. bgpmap: Mapping and filtering rules of BGP prefixes ... 218
M.2.44. cqm: Constant Quality Monitoring settings ... 219
M.2.45. l2tp: L2TP settings ... 221
M.2.46. l2tp-outgoing: L2TP settings for outgoing L2TP connections ... 221
M.2.47. l2tp-incoming: L2TP settings for incoming L2TP connections ... 223
M.2.48. l2tp-relay: Relay and local authentication rules for L2TP ... 224
M.2.49. fb105: FB105 tunnel definition ... 225
M.2.50. fb105-route: FB105 routes ... 226
M.2.51. ipsec-ike: IPsec configuration (IKEv2) ... 226
M.2.52. ike-connection: connection configuration ... 227
M.2.53. ipsec-route: IPsec tunnel routes ... 229
M.2.54. ike-roaming: IKE roaming IP pools ... 229
M.2.55. ike-proposal: IKE security proposal ... 229
M.2.56. ipsec-proposal: IPsec AH/ESP proposal ... 230
M.2.57. ipsec-manual: peer configuration ... 230
M.2.58. ping: Ping/graph definition ... 231
M.2.59. profile: Control profile ... 232
M.2.60. profile-date: Test passes if within any of the time ranges specified ... 233
M.2.61. profile-time: Test passes if within any of the date/time ranges specified ... 233
M.2.62. profile-ping: Test passes if any addresses are pingable ... 234
M.2.63. shaper: Traffic shaper ... 234
M.2.64. shaper-override: Traffic shaper override based on profile ... 235
M.2.65. ip-group: IP Group ... 235
M.2.66. route-override: Routing override rules ... 235
M.2.67. session-route-rule: Routing override rule ... 236
M.2.68. session-route-share: Route override load sharing ... 236
M.2.69. rule-set: Firewall/mapping rule set ... 237
M.2.70. session-rule: Firewall rules ... 238
M.2.71. session-share: Firewall load sharing ... 239
M.2.72. voip: Voice over IP config ... 239
M.2.73. carrier: VoIP carrier details ... 241
M.2.74. telephone: VoIP telephone authentication user details ... 242
M.2.75. tone: Tone definitions ... 243
M.2.76. ringgroup: Ring groups ... 244
M.2.77. etun: Ether tunnel ... 245
M.2.78. dhcp-relay: DHCP server settings for remote / relayed requests ... 245
M.3. Data types ... 246
M.3.1. ppp-dump: PPP dump format ... 246
M.3.2. autoloadtype: Type of s/w auto load ... 246
M.3.3. config-access: Type of access user has to config ... 246
M.3.4. user-level: User login level ... 246
M.3.5. eap-subsystem: Subsystem with EAP access control ... 247
M.3.6. eap-method: EAP access method ... 247
M.3.7. syslog-severity: Syslog severity ... 247
M.3.8. syslog-facility: Syslog facility ... 247
M.3.9. http-mode: HTTP/HTTPS security mode ... 248
M.3.10. radiuspriority: Options for controlling platform RADIUS response priority tagging ... 248
M.3.11. radiustype: Type of RADIUS server ... 249
M.3.12. month: Month name (3 letter) ... 249
M.3.13. day: Day name (3 letter) ... 249
M.3.14. port: Physical port ... 250
M.3.15. Crossover: Crossover configuration ... 250
M.3.16. LinkSpeed: Physical port speed ... 250
FireBrick FB2700 User Manual
M.3.17. LinkDuplex: Physical port duplex setting ... 250
M.3.18. LinkFlow: Physical port flow control setting ... 250
M.3.19. LinkClock: Physical port Gigabit clock master/slave setting ... 251
M.3.20. LinkLED: LED settings ... 251
M.3.21. LinkPower: PHY power saving options ... 252
M.3.22. LinkFault: Link fault type to send ... 252
M.3.23. sampling-protocol: Sampling protocol ... 252
M.3.24. trunk-mode: Trunk port mode ... 252
M.3.25. ramode: IPv6 route announce level ... 252
M.3.26. dhcpv6control: Control for RA and DHCPv6 bits ... 253
M.3.27. bgpmode: BGP announcement mode ... 253
M.3.28. sampling-mode: Sampling mode ... 253
M.3.29. sfoption: Source filter option ... 253
M.3.30. pppoe-mode: Type of PPPoE connection ... 254
M.3.31. pppoe-calling: Additional prefix on PPPoE calling ID ... 254
M.3.32. pdp-context-type: Type of IP connection ... 254
M.3.33. ipsec-type: IPsec encapsulation type ... 254
M.3.34. ipsec-auth-algorithm: IPsec authentication algorithm ... 254
M.3.35. ipsec-crypt-algorithm: IPsec encryption algorithm ... 255
M.3.36. peertype: BGP peer type ... 255
M.3.37. radius-nas: NAS IP to report ... 255
M.3.38. ike-authmethod: authentication method ... 256
M.3.39. ike-mode: connection setup mode ... 256
M.3.40. ike-PRF: IKE Pseudo-Random Function ... 256
M.3.41. ike-DH: IKE Diffie-Hellman group ... 256
M.3.42. ike-ESN: IKE Sequence Number support ... 256
M.3.43. ipsec-encapsulation: Manually keyed IPsec encapsulation mode ... 257
M.3.44. switch: Profile manual setting ... 257
M.3.45. dynamic-graph: Type of dynamic graph ... 257
M.3.46. firewall-action: Firewall action ... 257
M.3.47. voip-format: Number presentation format ... 257
M.3.48. uknumberformat: Number formatting option ... 258
M.3.49. recordoption: Recording option ... 258
M.3.50. ring-group-order: Order of ring ... 258
M.3.51. ring-group-type: Type of ring when one call in queue ... 258
M.3.52. record-beep-option: Record beep option ... 259
M.4. Basic types ... 259
Index ... 262
List of Figures
2.1. Initial web page in factory reset state ... 7
2.2. Setup Wizard ... 8
3.1. Main menu ... 15
3.2. Icons for layout controls ... 15
3.3. Icons for configuration categories ... 16
3.4. The "Setup" category ... 16
3.5. Editing an "Interface" object ... 17
3.6. Show hidden attributes ... 17
3.7. Attribute definitions ... 18
3.8. Navigation controls ... 18
4.1. Setting up a new user ... 24
4.2. Software upgrade available notification ... 30
4.3. Manual Software upload ... 31
7.1. Example sessions created by drop and reject actions ... 48
7.2. Processing flow chart for rule-sets and session-rules ... 50
C.1. Product label showing MAC address range ... 144
List of Tables
2.1. IP addresses for computer ... 6
2.2. IP addresses to access the FireBrick ... 6
2.3. IP addresses to access the FireBrick ... 6
3.1. Special character sequences ... 20
4.1. User login levels ... 25
4.2. Configuration access levels ... 25
4.3. General administrative details attributes ... 27
4.4. Attributes controlling auto-upgrades ... 30
4.5. Power LED status indications ... 31
5.1. Logging attributes ... 33
5.2. System-Event Logging attributes ... 36
6.1. Port LED functions ... 44
6.2. Example modified Port LED functions ... 45
7.1. Action attribute values ... 48
8.1. Example route targets ... 61
12.1. IPsec algorithm key lengths ... 80
12.2. IKE / IPsec algorithm proposals ... 84
14.1. List of system services ... 95
14.2. List of system services ... 96
15.1. Packet dump parameters ... 104
15.2. Packet types that can be captured ... 105
17.1. Ring Type ... 114
17.2. Ring Order ... 115
17.3. Access-Accept ... 118
17.4. Default tones ... 120
18.1. Peer types ... 123
18.2. Communities ... 125
18.3. Network attributes ... 127
19.1. OSPF config attributes ... 130
C.1. DHCP client names used ... 145
D.1. Special URLs ... 148
F.1. SCCRQ ... 150
F.2. SCCRP ... 150
F.3. SCCCN ... 151
F.4. StopCCN ... 151
F.5. HELLO ... 151
F.6. ICRQ ... 151
F.7. ICRP ... 152
F.8. ICCN ... 152
F.9. OCRQ ... 152
F.10. OCRP ... 153
F.11. OCCN ... 153
F.12. CDN ... 153
F.13. WEN ... 153
F.14. SLI ... 153
G.1. Access-request ... 155
G.2. Access-Accept ... 156
G.3. Access-Reject ... 158
G.4. Accounting-Start ... 158
G.5. Accounting-Interim ... 159
G.6. Accounting-Stop ... 160
G.7. Disconnect ... 160
G.8. Change-of-Authorisation ... 160
G.9. Filter-ID ... 161
FireBrick FB2700 User Manual
H.1. Access-request ... 165
H.2. Access-Challenge ... 166
H.3. Access-Accept ... 166
H.4. Access-Accept ... 166
H.5. Access-Reject ... 167
H.6. Accounting-Start ... 167
H.7. Accounting-Interim ... 167
H.8. Accounting-Stop ... 168
H.9. Disconnect ... 168
H.10. Change-of-Authorisation ... 169
I.1. iso.3.6.1.4.1.24693.179 ... 170
I.2. iso.3.6.1.4.1.24693.500 ... 170
I.3. Connection State ... 170
I.4. iso.3.6.1.4.1.24693.1701 ... 171
I.5. iso.3.6.1.4.1.24693.5060 ... 172
I.6. iso.3.6.1.4.1.24693.2 ... 172
I.7. iso.3.6.1.4.1.24693.3 ... 173
K.1. File types ... 181
K.2. Colours ... 183
K.3. Text ... 183
K.4. Text ... 183
K.5. URL formats ... 184
M.1. config: Attributes ... 189
M.2. config: Elements ... 189
M.3. system: Attributes ... 190
M.4. system: Elements ... 191
M.5. link: Attributes ... 191
M.6. user: Attributes ... 192
M.7. eap: Attributes ... 192
M.8. log: Attributes ... 193
M.9. log: Elements ... 193
M.10. log-syslog: Attributes ... 193
M.11. log-email: Attributes ... 194
M.12. services: Elements ... 194
M.13. http-service: Attributes ... 194
M.14. dns-service: Attributes ... 195
M.15. dns-service: Elements ... 196
M.16. dns-host: Attributes ... 196
M.17. dns-block: Attributes ... 197
M.18. radius-service: Attributes ... 197
M.19. radius-service: Elements ... 198
M.20. radius-service-match: Attributes ... 198
M.21. radius-server: Attributes ... 200
M.22. telnet-service: Attributes ... 200
M.23. snmp-service: Attributes ... 201
M.24. time-service: Attributes ... 201
M.25. ethernet: Attributes ... 202
M.26. sampling: Attributes ... 203
M.27. portdef: Attributes ... 203
M.28. interface: Attributes ... 204
M.29. interface: Elements ... 205
M.30. subnet: Attributes ... 205
M.31. vrrp: Attributes ... 206
M.32. dhcps: Attributes ... 207
M.33. dhcps: Elements ... 207
M.34. dhcp-attr-hex: Attributes ... 207
FireBrick FB2700 User Manual
M.35. dhcp-attr-string: Attributes ... 208
M.36. dhcp-attr-number: Attributes ... 208
M.37. dhcp-attr-ip: Attributes ... 208
M.38. pppoe: Attributes ... 209
M.39. pppoe: Elements ... 210
M.40. ppp-route: Attributes ... 210
M.41. usb: Attributes ... 210
M.42. usb: Elements ... 211
M.43. dongle: Attributes ... 211
M.44. dongle: Elements ... 212
M.45. route: Attributes ... 212
M.46. network: Attributes ... 213
M.47. blackhole: Attributes ... 213
M.48. loopback: Attributes ... 214
M.49. ospf: Attributes ... 214
M.50. namedbgpmap: Attributes ... 215
M.51. namedbgpmap: Elements ... 215
M.52. bgprule: Attributes ... 215
M.53. bgp: Attributes ... 216
M.54. bgp: Elements ... 216
M.55. bgppeer: Attributes ... 217
M.56. bgppeer: Elements ... 218
M.57. bgpmap: Attributes ... 218
M.58. bgpmap: Elements ... 219
M.59. cqm: Attributes ... 219
M.60. l2tp: Attributes ... 221
M.61. l2tp: Elements ... 221
M.62. l2tp-outgoing: Attributes ... 221
M.63. l2tp-outgoing: Elements ... 222
M.64. l2tp-incoming: Attributes ... 223
M.65. l2tp-incoming: Elements ... 224
M.66. l2tp-relay: Attributes ... 224
M.67. fb105: Attributes ... 225
M.68. fb105: Elements ... 226
M.69. fb105-route: Attributes ... 226
M.70. ipsec-ike: Attributes ... 227
M.71. ipsec-ike: Elements ... 227
M.72. ike-connection: Attributes ... 227
M.73. ike-connection: Elements ... 229
M.74. ipsec-route: Attributes ... 229
M.75. ike-roaming: Attributes ... 229
M.76. ike-proposal: Attributes ... 230
M.77. ipsec-proposal: Attributes ... 230
M.78. ipsec-manual: Attributes ... 230
M.79. ipsec-manual: Elements ... 231
M.80. ping: Attributes ... 231
M.81. profile: Attributes ... 232
M.82. profile: Elements ... 233
M.83. profile-date: Attributes ... 233
M.84. profile-time: Attributes ... 233
M.85. profile-ping: Attributes ... 234
M.86. shaper: Attributes ... 234
M.87. shaper: Elements ... 234
M.88. shaper-override: Attributes ... 235
M.89. ip-group: Attributes ... 235
M.90. route-override: Attributes ... 235
FireBrick FB2700 User Manual
M.91. route-override: Elements ... 236
M.92. session-route-rule: Attributes ... 236
M.93. session-route-rule: Elements ... 236
M.94. session-route-share: Attributes ... 237
M.95. rule-set: Attributes ... 237
M.96. rule-set: Elements ... 238
M.97. session-rule: Attributes ... 238
M.98. session-rule: Elements ... 239
M.99. session-share: Attributes ... 239
M.100. voip: Attributes ... 239
M.101. voip: Elements ... 241
M.102. carrier: Attributes ... 241
M.103. telephone: Attributes ... 242
M.104. tone: Attributes ... 244
M.105. ringgroup: Attributes ... 244
M.106. etun: Attributes ... 245
M.107. dhcp-relay: Attributes ... 245
M.108. dhcp-relay: Elements ... 245
M.109. ppp-dump: PPP dump format ... 246
M.110. autoloadtype: Type of s/w auto load ... 246
M.111. config-access: Type of access user has to config ... 246
M.112. user-level: User login level ... 246
M.113. eap-subsystem: Subsystem with EAP access control ... 247
M.114. eap-method: EAP access method ... 247
M.115. syslog-severity: Syslog severity ... 247
M.116. syslog-facility: Syslog facility ... 247
M.117. http-mode: HTTP/HTTPS security mode ... 248
M.118. radiuspriority: Options for controlling platform RADIUS response priority tagging ... 248
M.119. radiustype: Type of RADIUS server ... 249
M.120. month: Month name (3 letter) ... 249
M.121. day: Day name (3 letter) ... 249
M.122. port: Physical port ... 250
M.123. Crossover: Crossover configuration ... 250
M.124. LinkSpeed: Physical port speed ... 250
M.125. LinkDuplex: Physical port duplex setting ... 250
M.126. LinkFlow: Physical port flow control setting ... 250
M.127. LinkClock: Physical port Gigabit clock master/slave setting ... 251
M.128. LinkLED: LED settings ... 251
M.129. LinkPower: PHY power saving options ... 252
M.130. LinkFault: Link fault type to send ... 252
M.131. sampling-protocol: Sampling protocol ... 252
M.132. trunk-mode: Trunk port mode ... 252
M.133. ramode: IPv6 route announce level ... 252
M.134. dhcpv6control: Control for RA and DHCPv6 bits ... 253
M.135. bgpmode: BGP announcement mode ... 253
M.136. sampling-mode: Sampling mode ... 253
M.137. sfoption: Source filter option ... 253
M.138. pppoe-mode: Type of PPPoE connection ... 254
M.139. pppoe-calling: Additional prefix on PPPoE calling ID ... 254
M.140. pdp-context-type: Type of IP connection ... 254
M.141. ipsec-type: IPsec encapsulation type ... 254
M.142. ipsec-auth-algorithm: IPsec authentication algorithm ... 254
M.143. ipsec-crypt-algorithm: IPsec encryption algorithm ... 255
M.144. peertype: BGP peer type ... 255
M.145. radius-nas: NAS IP to report ... 255
M.146. ike-authmethod: authentication method ... 256
FireBrick FB2700 User Manual
M.147. ike-mode: connection setup mode ... 256
M.148. ike-PRF: IKE Pseudo-Random Function ... 256
M.149. ike-DH: IKE Diffie-Hellman group ... 256
M.150. ike-ESN: IKE Sequence Number support ... 256
M.151. ipsec-encapsulation: Manually keyed IPsec encapsulation mode ... 257
M.152. switch: Profile manual setting ... 257
M.153. dynamic-graph: Type of dynamic graph ... 257
M.154. firewall-action: Firewall action ... 257
M.155. voip-format: Number presentation format ... 257
M.156. uknumberformat: Number formatting option ... 258
M.157. recordoption: Recording option ... 258
M.158. ring-group-order: Order of ring ... 258
M.159. ring-group-type: Type of ring when one call in queue ... 258
M.160. record-beep-option: Record beep option ... 259
M.161. Basic data types ... 259
Preface
The FB2700 device is the result of several years of intensive effort to create products based on state of the art processing platforms, featuring an entirely new operating system and IPv6-capable networking software, written from scratch in-house by the FireBrick team. Custom designed hardware, manufactured in the UK, hosts the new software, and ensures FireBrick are able to maximise performance from the hardware, and maintain exceptional levels of quality and reliability.
The result is a product that has the feature set and performance to handle the tasks encountered in today's office networking environments, where new access technologies such as Fibre To The Cabinet (FTTC) deliver faster connections than ever before.
The new software is closely related to that which runs on FireBrick's 'big-box' product, the FB6000, a carrier- grade product that has been proven in the field for a number of years, effortlessly handling huge volumes of traffic, and thousands of customer connections.
The software is constantly being improved and new features added, so please check that you are reading the manual appropriate to the version of software you are using. This manual is for version V1.53.000.
Chapter 1. Introduction
1.1. The FB2700
1.1.1. Where do I start?
The FB2700 is shipped in a factory reset state. This means it has a default configuration that allows the unit to be attached directly to a computer, or into an existing network, and is accessible via a web browser on a known IP address for further configuration.
Besides allowing initial web access to the unit, the factory reset configuration provides a starting point for you to develop a bespoke configuration that meets your requirements.
A printed copy of the QuickStart Guide is included with your FB2700 and covers the basic set up required to gain access to the web based user interface. If you have already followed the steps in the QuickStart guide, and are able to access the FB2700 via a web browser, you can begin to work with the factory reset configuration by referring to Chapter 3.
Initial set up is also covered in this manual, so if you have not already followed the QuickStart Guide, please start at Chapter 2.
Tip
The FB2700's configuration can be restored to the state it was in when shipped from the factory. The procedure requires physical access to the FB2700, and can be applied if you have made configuration changes that have resulted in loss of access to the web user interface, or any other situation where it is appropriate to start from scratch - for example, commissioning an existing unit for a different role, or where you've forgotten an administrative user password. It is also possible to temporarily reset the FB2700 to allow you to recover and edit a broken configuration (though you still need to know the password you had). You can also go back one step in the config. For details on the factory reset procedure please refer to Appendix A, or consult the QuickStart Guide.
The remainder of this chapter provides an overview of the FB2700's capabilities, and covers your product support options.
Tip
The latest version of the QuickStart guide for the FB2700 can be obtained from the FireBrick website at : http://www.firebrick.co.uk/pdfs/quickstart-2700.pdf
1.1.2. What can it do?
The FB2700 is an extremely versatile network appliance which you can think of as something akin to a Swiss army knife for networking.
It can :
• Act as an IP level firewall, to protect your network from direct attack over the Internet.
• Allocate network addresses to machines on your network (e.g. DHCP and SLAAC)
• Manage multiple networks at once
• Modify traffic passing though to do address and protocol-port mapping
• Control the speed of different types of traffic (traffic shaping)
Introduction
• Handle the current Internet Protocol (IPv6) as well as legacy IPv4.
• Act as an office phone system using SIP phones and carriers/services
• Provide 3G/4G dongle support for mobile internet or DSL backup and much more...
1.1.3. Ethernet port capabilities
The FB2700 has four Ethernet network ports that can operate at 10Mb/s, 100Mb/s, or 1Gb/s. The ports implement auto-negotiation by default, but operation can be fine-tuned to suit specific circumstances. The function of these ports is very flexible, and defined by the device's configuration. The ports implement one or more interfaces, and each interface can span either a single port or a user-defined group of ports.
When a port group is defined, the ports in the group work as a conventional Layer 2 network switch, directly transferring traffic at wire-speed that is destined for a Layer 2 address that is present on one of the other ports in the group.
Conversely, multiple interfaces can be implemented on a single physical port (or port group) via support for IEEE 802.1Q VLANs, ideal for using the FB2700 with VLAN-capable network switches. In this case, a single physical connection can be made between a VLAN-capable switch and the FB2700, and with the switch configured appropriately, this physical connection will carry traffic to/from multiple VLANs, and the FB2700 can do Layer 3 processing (routing/firewalling etc.) between nodes on two or more VLANs.
1.1.4. Differences between the devices in the FB2x00 series
• FB2500 No USB port, 4 ethernet ports, max 100Mb/s routed traffic.
• FB2700 USB port for dongle, 4 ethernet ports, max ~350Mb/s routed traffic.
• FB2900 USB port for dongle, 4 ethernet ports, SFP port, max ~750Mb/s routed traffic.
Note
The FB2500 model is no longer available for new supply. The FB2900 model is replacing the FB2700.
1.1.5. Software features
The FB2700 has a simple two level software-feature-set. Devices are graded as "base" models or "fully-loaded"
models. The base model lacks a few of the features such as BGP, L2TP and various bonding and tunnelling features.
You can use the base model for routing packets, filtering (firewalling) or arranging a 3G fallback for your DSL line.
The "fully-loaded" model is useful for bonding multiple lines, tunnelling and more obscure features such as announcing addresses to an upstream provider by BGP.
It is possible to upgrade from "base" to "fully-loaded" at a later date if you wish. Contact your dealer for details.
The cost is usually just the difference in the price between the models.
1.1.6. Migration from previous FireBrick models
Many FB2700 users may well be migrating from earlier FireBrick products, such as the FireBrick 105, to take advantage of the significantly higher performance of the FB2700, and perhaps to use features that simply didn't
Introduction
exist on the FB105. As you will see from reading Chapter 3, the new range of FireBrick products introduce a modern, well structured configuration based on an underlying XML file. The User Interface is intentionally closely coupled with the XML structures, and this will likely be the most apparent visual difference for users experienced with the FB105.
To aid the transition, a translator is provided which will generate an FB2700 XML configuration file from an FB105 configuration file, mapping features and functionality across as closely as is possible; the converted configuration should be treated as a starting point for using your FB2700 in place of your FB105, as the result from the converter may be incomplete, or there may be aspects that cannot be carried over. The translator can be accessed at : http://www.firebrick.co.uk/fb105-2700.php
If you have one or more FB105 devices in your network, you'll be pleased to know that the fully-loaded FB2700 supports the FB105 tunnel protocol, and will interwork seemlessly, allowing you to upgrade devices as time and budgets allow.
Your dealer can also give you advice on converting configurations from older FB105 based networks.
1.2. About this Manual
1.2.1. Version
Every major FB2700 software release is accompanied by a release-specific version of this manual. This manual documents software version V1.53.000 - please refer to Section 4.3 to find out more about software releases, and to see how to identify which software version your FB2700 is currently running.
If your FB2700 is running a different version of system software, then please consult the version of this manual that documents that specific version, as there may be significant differences between the software versions.
Also bear in mind that if you are not reading the latest version of the manual (and using the latest software release), references in this manual to external resources, such as the FireBrick website, may be out of date.
You can find the latest revision of a manual for a specific software version on the FB2700 software downloads website [http://www.firebrick.co.uk/software.php?PRODUCT=2700]. This includes the revision history for all software releases.
1.2.2. Intended audience
This manual is intended to guide FB2700 owners in configuring their units for their specific applications. We try to make no significant assumption about the reader's knowledge of FireBrick products, but as might be expected given the target market for the products, it is assumed the reader has a reasonable working knowledge of common IP and Ethernet networking concepts. So, whether you've used FireBrick products for years, or have purchased one for the very first time, and whether you're a novice or a network guru, this Manual sets out to be an easy to read, definitive guide to FireBrick product configuration for all FireBrick customers.
1.2.3. Technical details
There are a number of useful technical details included in the apendices. These are intended to be a reference guild for key features.
1.2.4. Document style
At FireBrick, we appreciate that different people learn in different ways - some like to dive in, hands-on, working with examples and tweaking them until they work the way they want, referring to documentation as required. Other people prefer to build their knowledge up from first principles, and gain a thorough understanding of what they're working with. Most people we suspect fall somewhere between these two learning styles.
Introduction
This Manual aims to be highly usable regardless of your learning style - material is presented in an order that starts with fundamental concepts, and builds to more complex operation of your FireBrick. At all stages we hope to provide a well-written description of how to configure each aspect of the FireBrick, and - where necessary - provide enough insight into the FireBrick's internal operation that you understand why the configuration achieves what it does.
1.2.5. Document conventions
Various typefaces and presentation styles are used in this document as follows :-
• Text that would be typed as-is, for example a command, or an XML attribute name is shown in monospaced_font
• Program (including XML) listings, or fragments of listings are shown thus :-
/* this is an example program listing*/
printf("Hello World!\n");
• Text as it would appear on-screen is shown thus :-
This is an example of some text that would appear on screen.
Note that for documentation purposes additional
line-breaks may be present that would not be in the on-screen text
• Notes of varying levels of significance are represented thus (colour schemes may differ depending on signficance) :-
Note
This is an example note.
The significance is identified by the heading text and can be one of : Tip - general hints and tips, for example to point out a useful feature related to the current discussion ; Note - a specific, but not critical, point relating to the surrounding text ; Caution - a potentially critical point that you should pay attention to, failure to do so may result in loss of data, security issues, loss of network connectivity etc.
1.2.6. Comments and feedback
If you'd like to make any comments on this Manual, point out errors, make suggestions for improvement or provide any other feedback, we would be pleased to hear from you via e-mail at : [email protected].
1.3. Additional Resources
1.3.1. Technical Support
Technical support is available, in the first instance, via the reseller from which you purchased your FireBrick.
FireBrick provide extensive training and support to resellers and you will find them experts in FireBrick products.
However, before contacting them, please ensure you have :-
Introduction
• upgraded your FB2700 to the latest version of software (see Section 4.3) and
• are using the latest revision of the manual applicable to that software version and
• have attempted to answer your query using the material in this manual
Many FireBrick resellers also offer general IT support, including installation, configuration, maintenance, and training. You may be able to get your reseller to develop FB2700 configurations for you - although this will typically be chargeable, you may well find this cost-effective, especially if you are new to FireBrick products.
If you are not satisfied with the support you are getting from your reseller, please contact us [http://
www.firebrick.co.uk/contact.php].
1.3.2. IRC Channel
A public IRC channel is available for FireBrick discussion - the IRC server is irc.z.je, and the channel is #firebrick.
1.3.3. Application Notes
Some applications notes have been created by the FireBrick team and included on the web site. There are also useful Wiki web sites provided by main dealers which cover specific configuration examples. Ask your dealer for more details. These are usually public WiKi web sites even if not buying from that specific dealer.
1.3.4. Training Courses
FireBrick provide training courses for the full Firebrick series of products, and also training course on general IP networking that are useful if you are new to networking with IP.
Training course attendance is mandatory for all FireBrick dealers to be accredited.
To obtain information about upcoming courses, please contact us via e-mail at : [email protected].
Chapter 2. Getting Started
2.1. IP addressing
You can configure your FireBrick using a web browser - to do this, you need IP connectivity between your computer and the FireBrick. For a new FB2700 or one that has been factory reset, there are three methods to set this up, as described below - select the method that you prefer, or that best suits your current network architecture.
• Method 1 - use the FireBrick's DHCP server to configure a computer.
If your computer is already configured (as many are) to get an IP address automatically, you can connect your computer to port 1 on the FireBrick, and the FireBrick's inbuilt DHCP server should give it an IPv4 and IPv6 address.
• Method 2 - configure a computer with a fixed IP address.
Alternatively, you can connect a computer to port 1 on the FireBrick, and manually configure your computer to have the fixed IP address(es) shown below :-
Table 2.1. IP addresses for computer
IPv6 IPv4
2001:DB8::2/64 10.0.0.2 ; subnet mask : 255.255.255.0
• Method 3 - use an existing DHCP server to configure the FireBrick.
If your LAN already has a DHCP server, you can connect port 4 of your FireBrick to your LAN, and it will get an address. Port 4 is configured, by default, not to give out any addresses and as such it should not interfere with your existing network. You would need to check your DHCP server to find what address has been assigend to the FB2700.
2.2. Accessing the web-based user interface
If you used Method 1, you should browse to the FireBrick's web interface as follows, or you can use the IP addresses detailed:-
Table 2.2. IP addresses to access the FireBrick
URL
http://my.firebrick.co.uk/
If you used Method 2, you should browse to the FireBrick's IP address as listed below:-
Table 2.3. IP addresses to access the FireBrick
IPv6 IPv4
http://[2001:DB8::1] http://10.0.0.1
If you used Method 3, you will need to be able to access a list of allocations made by the DHCP server in order to identify which IP address has been allocated to the FB2700, and then browse this address from your computer. If your DHCP server shows the client name that was supplied in the DHCP request, then you will
Getting Started
see FB2700 in the client name field (assuming a factory reset configuration) - if you only have one FB2700 in factory reset state on your network, then it will be immediately obvious via this client name. Otherwise, you will need to locate the allocation by cross-referring with the MAC address range used by the FB2700 you are interested in - if necessary, refer to Appendix C to see how to determine which MAC address you are looking for in the list of allocations.
Once you are connected to the FB2700, you should see a page with "Configuration needed" prominently displayed, as shown below :-
Figure 2.1. Initial web page in factory reset state
Click on the "edit the configuration" link (red text), or the Wizard menu item, which will take you to the set- up wizard for a new configuration.
2.2.1. Setup wizard
The setup wizard allows you to fill in a few key items before entering the normal configuration editor.
Getting Started
Figure 2.2. Setup Wizard
There key settings may vary in later versions, but they represent the main settings you need to consider to get started.
Getting Started
2.2.1.1. Login username/password
The first part of the wizard covers your login to the FireBrick management interface. There are various ways this access is controlled and locked down, but ultimately this is the way you control your configuration and so they are very important.
For simple security reasons it is better to pick a sensible username, and not admin
For good security reasons you should create a long, easy to remember, but hard to guess, password. There is no limit on how long you make the password, so you can create a complete pass phrase (i.e. a sentence) if you prefer. Rememver that upper/lower case matter as do spaces. The FireBrick does not make any attempt to enfoce password policy and will allow you to use a stupid password if you wish, just not a blank one.
Once you have finished the process for your initial config, and logged in, we strongly recommend setting up a two factor authentication using a one time password app on a mobile phone, etc.
2.2.1.2. WAN/PPPoE settings
There are two main ways the FB2700 is connected to the Internet - either using a PPPoE device such as a bridging modem or an external router that provides access via DHCP setting of a WAN address.
The wizard allows you to set these up, either or both, with PPPoE login/password on a port, and DHCP client on a port, as a WAN interface.
Note
If you use the wizard to make a WAN Ethernet port, you will no longer be able to access the web control pages via that interface as it will not be considered local.
2.2.1.3. LAN settings
The factory default configuration provides a WAN and LAN. In the case of the LAN, several separate ports are configured as independant LAN subnets. The wizard allows you to define a LAN with one or more ports as a switched port group and define an IPv4 and IPv6 subnet that is used on that LAN. You can set a number of options for DHCP, SLAAC, etc.
Note
Typically an ISP connection via PPPoE will Prefix Delegate IPv6 address blocks so these do not usually need to be set up manually.
2.2.1.4. Initial config
Having completed the initial wizard questions you will then find yourself in the normal cofiguration editor.
You can make any more changes you need to the initial configuration, and then save this.
Once saved you are prompted to login using the username/password details you provided.
Note
The wizard makes no attempt to check the details you entered, these simply become part of that initial configuration. As such you may see error messages when you try to save the config, and will need to make corrections before you can proceed.
Note
If you have changed the LAN IP address settings and are using DHCP on your connected computer you may find you need to get a new address and re-connect to the FireBrick control pages at this point.
Chapter 3. Configuration
3.1. The Object Hierarchy
The FB2700 has, at its core, a configuration based on a hierarchy of objects, with each object having one or more attributes. An object has a type, which determines its role in the operation of the FB2700. The values of the attributes determine how that object affects operation. Attributes also have a type (or datatype), which defines the type of data that attribute specifies. This in turn defines what the valid syntax is for a value of that datatype - for example some are numeric, some are free-form strings, others are strings with a specific format, such as a dotted-quad IP address. Some examples of attribute values are :-
• IP addresses, and subnet definitions in CIDR format e.g. 192.168.10.0/24
• free-form descriptive text strings, e.g. a name for a firewall rule
• Layer 4 protocol port numbers e.g. TCP ports
• data rates used to control traffic shaping
• enumerated values used to control a feature e.g. defining Ethernet port LED functions
The object hierarchy can be likened to a family-tree, with relationships between objects referred to using terms such as Parent, Child, Sibling, Ancestor and Descendant. This tree-like structure is used to :-
• group a set of related objects, such as a set of firewall rules - the parent object acts as a container for a group of (child) objects, and may also contribute to defining the detailed behaviour of the group
• define a context for an object - for example, an object used to define a locally-attached subnet is a child of an object that defines an interface, and as such defines that the subnet is accessible on that specific interface.
Since multiple interfaces can exist, other interface objects establish different contexts for subnet objects.
Additional inter-object associations are established via attribute values that reference other objects, typically by name, e.g. a firewall rule can specify one of several destinations for log information to be sent when the rule is processed.
3.2. The Object Model
The term 'object model' is used here to collectively refer to :-
• the constraints that define a valid object hiearchy - i.e. which object(s) are valid child objects for a given parent object, how many siblings of the same type can exist etc.
• for each object type, the allowable set of attributes, whether the attributes are mandatory or optional, their datatypes, and permissible values of those attributes
The bulk of this User Manual therefore serves to document the object model and how it controls operation of the FB2700.
Tip
This version of the User Manual may not yet be complete in its coverage of the full object model.
Some more obscure attributes may not be covered at all - some of these may be attributes that are not used under any normal circumstances, and used only under guidance by support personnel. If you encounter attribute(s) that are not documented in this manual, please refer in the first instance to the documentation described in Section 3.2.1 below. If that information doesn't help you, and you think
Configuration
the attribute(s) may be relevant to implementing your requirements, please consult the usual support channel(s) for advice.
3.2.1. Formal definition of the object model
The object model has a formal definition in the form of an XML Schema Document (XSD) file, which is itself an XML file, normally intended for machine-processing. A more readable version of this information is available in Appendix M.
Note, however, that this is reference material, containing only brief descriptions, and intended for users who are familiar with the product, and in particular, for users configuring their units primarily via XML.
The XSD file is also available on the software downloads website by following the "XSD" link that is present against each software release.
3.2.2. Common attributes
Most objects have a comment attribute which is free-form text that can be used for any purpose. Similarly, most objects have a source attribute that is intended for use by automated configuration management tools.
Neither of these attributes have a direct effect on the operation of the FB2700.
Many objects have a name attribute which is non optional and often needs to be unique within the list of object.
This allows the named object to be referenced from other attributes. The data type for these is typically an NMTOKEN which is a variant of a string type that does not allow spaces. If you include spaces then they are removed automatically. This helps avoid any problems referencing names in other places especially where the reference may be a space separated list.
Many objects have a graph attribute. This allows a graph name to be specified. However, the actual graph name will be normalised to avoid spaces and limit the number of characters. Try to keep graph names as basic characters (letters, numbers) to avoid confusion.
3.3. Configuration Methods
The configuration objects are created and manipulated by the user via one of two configuration methods :
• web-based graphical User Interface accessed using a standard web-browser (uses javascript).
• an XML (eXtensible Markup Language) file representing the entire object hierarchy, editable via the web interface or can be uploaded to the FB2700
The two methods operate on the same underlying object model, and so it is possible to readily move between the two methods - changes made via the User Interface will be visible as changes to the XML, and vice-versa.
Which method you use is entirely up to you, and some users prefer one or the other, or may make some changes in one of the other. Some operations, such as changing the order of a list of objects, is easier in the XML editor, for example. The web based editor means you do not have to find/remember the attribite names as they are all presented to you. For more information on using XML, refer to Section 3.6.
3.4. Data types
All of the actual values in the configuration are provided by means of XML attributes, and so they are represented as a string of characters. The value is escaped as per XML rules, e.g. & for &, < for <,
> for > and " for " within the string between the quote marks for the attribite value.
Obviously, even though all data is just a string, there are actually different data types, as defined in Section M.4, some of which have value restrictions (range of numbers, or specific string lengths, etc). Some of these are described in more details here.
