FireBrick FB6202 User Manual
   Next

FireBrick FB6202 User Manual

This User Manual documents Software version V2.00.100

Copyright © 2012-2023 FireBrick Ltd.

Table of Contents

Preface
1. Introduction
1.1. The FB6000
1.1.1. Where do I start?
1.1.2. What can it do?
1.1.2.1. FB6202 Gigabit L2TP LNS with detailed monitoring of all lines
1.1.3. Ethernet port capabilities
1.1.4. Product variants in the FB6000 series
1.2. About this Manual
1.2.1. Version
1.2.2. Intended audience
1.2.3. Technical details
1.2.4. Document style
1.2.5. Document conventions
1.2.6. Comments and feedback
1.3. Additional Resources
1.3.1. Technical Support
1.3.2. IRC Channel
1.3.3. Application Notes
1.3.4. Training Courses
2. Getting Started
2.1. IP addressing
2.2. Accessing the web-based user interface
2.2.1. Initial configuration
3. Configuration
3.1. The Object Hierarchy
3.2. The Object Model
3.2.1. Formal definition of the object model
3.2.2. Common attributes
3.3. Configuration Methods
3.4. Configuration upgrades and versioning
3.5. Data types
3.5.1. Sending and receiving values
3.5.2. Lists of values
3.5.3. Set of possible values
3.5.4. Dates, times, and durations
3.5.5. Colours
3.5.6. Passwords and secrets
3.5.7. IP addresses
3.5.7.1. Simple IP addresses
3.5.7.2. Subnets and prefixes
3.5.7.3. Ranges
3.5.7.4. Prefix filters
3.6. Web User Interface Overview
3.6.1. User Interface layout
3.6.2. Config pages and the object hierarchy
3.6.2.1. Configuration categories
3.6.2.2. Object settings
3.6.3. Navigating around the User Interface
3.6.4. Backing up / restoring the configuration
3.6.5. Customising the layout
3.7. Configuration using XML
3.7.1. Introduction to XML
3.7.2. The root element - <config>
3.7.3. Viewing or editing XML
3.7.4. Example XML configuration
3.8. Downloading/Uploading the configuration
3.8.1. Download
3.8.2. Upload
4. System Administration
4.1. User Management
4.1.1. Login level
4.1.2. Configuration access level
4.1.3. Login idle timeout
4.1.4. Restricting user logins
4.1.4.1. Restrict by IP address
4.1.4.2. Logged in IP address
4.1.4.3. Restrict by profile
4.1.5. Password change
4.1.6. One Time Password (OTP)
4.2. General System settings
4.2.1. System name (hostname)
4.2.2. Administrative details
4.2.3. System-level event logging control
4.2.4. Home page web links
4.3. Software Upgrades
4.3.1. Software release types
4.3.1.1. Breakpoint releases
4.3.2. Identifying current software version
4.3.3. Internet-based upgrade process
4.3.3.1. Manually initiating upgrades
4.3.3.2. Controlling automatic software updates
4.3.4. Manual upgrade
4.4. Boot Process
4.4.1. LED indications
4.4.1.1. Port LEDs
5. Event Logging
5.1. Overview
5.1.1. Log targets
5.1.1.1. Logging to Flash memory
5.1.1.2. Logging to the Console
5.2. Enabling logging
5.3. Logging to external destinations
5.3.1. Syslog
5.3.2. Email
5.3.2.1. E-mail process logging
5.4. Factory reset configuration log targets
5.5. Performance
5.6. Viewing logs
5.6.1. Viewing logs in the User Interface
5.6.2. Viewing logs in the CLI environment
5.7. System-event logging
5.8. Using Profiles
6. Interfaces and Subnets
6.1. Relationship between Interfaces and Physical Ports
6.1.1. Port groups
6.1.2. Interfaces
6.2. Defining an interface
6.2.1. Defining subnets
6.2.1.1. Source filtering
6.2.1.2. Using DHCP to configure a subnet
6.2.1.3. Using SLAAC (IPv6 router announcements) to configure a subnet
6.2.1.4. Providing IPv6 addresses to devices on a network (IPv6 router announcements)
6.2.1.5. IPv6 prefix delegated subnets
6.2.2. Setting up DHCP server parameters
6.2.2.1. Fixed/Static DHCP allocations
6.2.2.2. Restricted allocations
6.2.2.3. Special DHCP options
6.2.2.4. Logging
6.2.3. DHCP Relay Agent
6.3. Physical port settings
6.3.1. Setting duplex mode
6.3.2. Defining port LED functions
7. Routing
7.1. Routing logic
7.2. Routing targets
7.2.1. Subnet routes
7.2.2. Routing to an IP address (gateway route)
7.2.3. Special targets
7.3. Dynamic route creation / deletion
7.4. Routing tables
7.5. Bonding
8. Profiles
8.1. Overview
8.2. Creating/editing profiles
8.2.1. Timing control
8.2.2. Tests
8.2.2.1. General tests
8.2.2.2. Time/date tests
8.2.2.3. Ping tests
8.2.3. Inverting overall test result
8.2.4. Manual override
8.2.5. Scripting
9. Traffic Shaping
9.1. Graphs and Shapers
9.1.1. Graphs
9.1.2. Shapers
9.1.3. Ad hoc shapers
9.1.4. Long term shapers
9.1.5. Shared shapers
9.2. Multiple shapers
9.3. Basic principles
10. PPPoE
10.1. PPPoE client
10.2. Types of DSL line and router in the United Kingdom
10.3. Definining PPPoE client links
10.3.1. IPv6
10.3.2. Additional options
10.3.2.1. MTU and TCP fix
10.3.2.2. Service and ac-name
10.3.2.3. Logging
10.3.2.4. Speed and graphs
10.4. PPPoE BRAS
10.4.1. Additional options
11. Tunnels
11.1. L2TP tunnelling
11.1.1. Incoming tunnel
11.1.2. Incoming session
12. System Services
12.1. Protecting the FB6000
12.2. Common settings
12.3. HTTP Server configuration
12.3.1. Access control
12.3.1.1. Trusted addresses
12.3.2. HTTPS access
12.4. Telnet Server configuration
12.4.1. Access control
12.5. DNS configuration
12.5.1. Auto DHCP DNS
12.5.2. Local DNS responses
12.5.3. Blocking DNS names
12.6. NTP configuration
12.7. SNMP configuration
12.8. RADIUS configuration
12.8.1. RADIUS server (platform RADIUS)
12.8.2. RADIUS client
12.8.2.1. RADIUS client settings
12.8.2.2. Server blacklisting
13. Network Diagnostic Tools
13.1. Access check
13.2. Packet Dumping
13.2.1. Dump parameters
13.2.2. Security settings required
13.2.3. IP address matching
13.2.4. Packet types
13.2.5. Snaplen specification
13.2.6. Using the web interface
13.2.7. Using an HTTP client
13.2.7.1. Example using curl and tcpdump
14. VRRP
14.1. Virtual Routers
14.2. Configuring VRRP
14.2.1. Advertisement Interval
14.2.2. Priority
14.3. Using a virtual router
14.4. VRRP versions
14.4.1. VRRP version 2
14.4.2. VRRP version 3
14.5. Compatibility
15. BGP
15.1. What is BGP?
15.2. BGP Setup
15.2.1. Overview
15.2.2. Standards
15.2.3. Simple example setup
15.2.4. Peer type
15.2.5. Route filtering
15.2.5.1. Matching attributes
15.2.5.2. Action attributes
15.2.6. Well known community tags
15.2.7. Announcing black hole routes
15.2.8. Grey holes
15.2.9. Announcing dead end routes
15.2.10. Bad optional path attributes
15.2.11. <network> element
15.2.12. <route>, <subnet> and other elements
15.2.13. Route feasibility testing
15.2.14. Status
15.2.15. Diagnostics
15.2.16. Router startup and shutdown
15.2.17. TTL security
16. Internet Service Providers
16.1. Background
16.1.1. How it all began
16.1.2. Point to Point Protocol
16.1.3. L2TP
16.1.4. Broadband
16.1.5. RADIUS
16.1.6. BGP
16.2. Incoming L2TP connections
16.3. The importance of CQM graphs
16.4. Authentication
16.5. Accounting
16.6. RADIUS Control messages
16.7. PPPoE
16.8. Typical configuration
16.8.1. Interlink subnet
16.8.2. BGP with carrier
16.8.3. RADIUS session steering
16.8.4. L2TP endpoints
16.8.5. ISP RADIUS
17. Command Line Interface
A. CIDR and CIDR Notation
B. MAC Addresses usage
B.1. Multiple MAC addresses?
B.2. How the FireBrick allocates MAC addresses
B.2.1. Interface
B.2.2. Subnet
B.2.3. PPPoE
B.2.4. Running out of MACs
B.3. Forcing particular MAC addresses
B.4. MAC address on label
B.5. Using with a DHCP server
C. Scripted access
C.1. Tools
C.2. Access control
C.2.1. Username and password
C.2.2. OTP
C.2.3. Allow list
C.2.4. Allowed access
C.3. XML data for common functions
C.4. XML data from diagnostics and tests
C.4.1. Cross site scripting security
C.4.2. Arguments to scripts
C.5. Special URLs
C.6. Web sockets
D. VLANs : A primer
E. Supported L2TP Attribute/Value Pairs
E.1. Start-Control-Connection-Request
E.2. Start-Control-Connection-Reply
E.3. Start-Control-Connection-Connected
E.4. Stop-Control-Connection-Notification
E.5. Hello
E.6. Incoming-Call-Request
E.7. Incoming-Call-Reply
E.8. Incoming-Call-Connected
E.9. Outgoing-Call-Request
E.10. Outgoing-Call-Reply
E.11. Outgoing-Call-Connected
E.12. Call-Disconnect-Notify
E.13. WAN-Error-Notify
E.14. Set-Link-Info
E.15. Notes
E.15.1. BT specific notes
E.15.2. IP over LCP
F. Supported RADIUS Attribute/Value Pairs for L2TP operation
F.1. Authentication request
F.2. Authentication response
F.2.1. Accepted authentication
F.2.1.1. Prefix Delegation
F.2.2. Rejected authentication
F.3. Accounting Start
F.4. Accounting Interim
F.5. Accounting Stop
F.6. Disconnect
F.7. Change of Authorisation
F.8. Filter ID
F.9. Notes
F.9.1. L2TP relay
F.9.2. LCP echo and CQM graphs
F.9.3. IP over LCP
F.9.4. Closed User Group
F.9.5. Routing table
G. FireBrick specific SNMP objects
G.1. Conventions
G.1.1. IP addresses as indices
G.2. Firebrick-specific structures for BGP
G.2.1. Structure definitions
G.2.1.1. The list of BGP peers for this Firebrick
G.2.2. Enum Definitions
G.3. Firebrick-specific structures for L2TP
G.3.1. Structure definitions
G.3.1.1. fbL2tpGeneralTunnels
G.3.1.2. fbL2tpGeneralSessions
G.3.1.3. The list of L2TP peers for this Firebrick
G.4. Firebrick CPU usage
G.4.1. Structure definitions
G.4.1.1. CPU usage for this Firebrick
G.5. Firebrick system stats
G.5.1. Structure definitions
G.5.1.1. The table of runtime stats for this Firebrick
G.6. Monitoring for general system features
G.6.1. Structure definitions
G.6.1.1. The list of readings for this Firebrick
G.7. System wide status
G.7.1. Structure definitions
G.7.1.1. fbGlobalMemory
G.7.1.2. fbGlobalBuffers
G.8. Monitoring information (deprecated)
H. Command line reference
H.1. General commands
H.1.1. Trace off
H.1.2. Trace on
H.1.3. Uptime
H.1.4. General status
H.1.5. Memory usage
H.1.6. Process/task usage
H.1.7. Login
H.1.8. Logout
H.1.9. See XML configuration
H.1.10. Load XML configuration
H.1.11. Show profile status
H.1.12. Enable profile control switch
H.1.13. Disable profile control switch
H.1.14. Show RADIUS servers
H.1.15. Show DNS resolvers
H.2. Networking commands
H.2.1. Subnets
H.2.2. Renegotiate DHCP for a subnet
H.2.3. Ping and trace
H.2.4. Show a route from the routing table
H.2.5. List routes
H.2.6. List routing next hops
H.2.7. See DHCP allocations
H.2.8. Clear DHCP allocations
H.2.9. Lock DHCP allocations
H.2.10. Unlock DHCP allocations
H.2.11. Name DHCP allocations
H.2.12. Show ARP/ND status
H.2.13. Show VRRP status
H.2.14. Send Wake-on-LAN packet
H.2.15. Check access to services
H.3. Logging commands
H.3.1. Show Log
H.4. BGP commands
H.4.1. Show BGP
H.4.2. Show BGP Peer
H.4.3. Show BGP Summary
H.4.4. Show BGP Routes
H.4.5. Clear BGP
H.4.6. Refresh BGP
H.4.7. Refresh BGP
H.5. L2TP commands
H.5.1. Show L2TP
H.5.2. Show L2TP Tunnels
H.5.3. Clear L2TP All
H.5.4. Show L2TP Tunnel
H.5.5. Show L2TP Tunnel
H.5.6. Show L2TP Sessions
H.5.7. Show L2TP Session
H.5.8. Clear L2TP Tunnel
H.5.9. Clear L2TP Tunnel
H.5.10. Clear L2TP Session
H.6. Advanced commands
H.6.1. Panic
H.6.2. Reboot
H.6.3. Screen width
H.6.4. Make outbound command session
H.6.5. Show command sessions
H.6.6. Kill command session
H.6.7. Flash memory list
H.6.8. Delete block from flash
H.6.9. Boot log
H.6.10. Flash log
I. Constant Quality Monitoring - technical details
I.1. Broadband back-haul providers
I.2. Access to graphs and csvs
I.2.1. Trusted access
I.2.2. Dated information
I.2.3. Authenticated access
I.3. Graph display options
I.3.1. Scaleable Vector Graphics
I.3.2. Data points
I.3.3. Additional text
I.3.4. Other colours and spacing
I.4. Overnight archiving
I.4.1. Full URL format
I.4.2. load handling
I.5. Graph scores
I.6. Creating graphs, and graph names
J. Hashed passwords
J.1. Password hashing
J.1.1. Salt
J.2. One Time Password seed hashing
K. Configuration Objects
K.1. Top level
K.1.1. config: Top level config
K.2. Objects
K.2.1. system: System settings
K.2.2. link: Web links
K.2.3. routing-table: Default source IP for services using a given table
K.2.4. user: Admin users
K.2.5. eap: User access controlled by EAP
K.2.6. log: Log target controls
K.2.7. log-syslog: Syslog logger settings
K.2.8. log-email: Email logger settings
K.2.9. services: System services
K.2.10. http-service: Web service settings
K.2.11. dns-service: DNS service settings
K.2.12. dns-host: Fixed local DNS host settings
K.2.13. dns-block: Fixed local DNS blocks
K.2.14. radius-service: RADIUS service definition
K.2.15. radius-service-match: Matching rules for RADIUS service
K.2.16. radius-server: RADIUS server settings
K.2.17. telnet-service: Telnet service settings
K.2.18. snmp-service: SNMP service settings
K.2.19. time-service: System time server settings
K.2.20. ethernet: Physical port controls
K.2.21. sampling: Packet sampling configuration
K.2.22. portdef: Port grouping and naming
K.2.23. interface: Port-group/VLAN interface settings
K.2.24. subnet: Subnet settings
K.2.25. subnet-template: Subnet option templates for RA
K.2.26. vrrp: VRRP settings
K.2.27. dhcps: DHCP server settings
K.2.28. dhcp-attr-hex: DHCP server attributes (hex)
K.2.29. dhcp-attr-string: DHCP server attributes (string)
K.2.30. dhcp-attr-number: DHCP server attributes (numeric)
K.2.31. dhcp-attr-ip: DHCP server attributes (IP)
K.2.32. pppoe: PPPoE settings
K.2.33. ppp-route: PPP routes
K.2.34. route: Static routes
K.2.35. network: Locally originated networks
K.2.36. blackhole: Dead end networks
K.2.37. loopback: Locally originated networks
K.2.38. namedbgpmap: Mapping and filtering rules of BGP prefixes
K.2.39. bgprule: Individual mapping/filtering rule
K.2.40. bgp: Overall BGP settings
K.2.41. bgppeer: BGP peer definitions
K.2.42. bgpmap: Mapping and filtering rules of BGP prefixes
K.2.43. cqm: Constant Quality Monitoring settings
K.2.44. l2tp: L2TP settings
K.2.45. l2tp-incoming: L2TP settings for incoming L2TP connections
K.2.46. l2tp-relay: Relay and local authentication rules for L2TP
K.2.47. profile: Control profile
K.2.48. profile-date: Test passes if within any of the time ranges specified
K.2.49. profile-time: Test passes if within any of the date/time ranges specified
K.2.50. profile-ping: Test passes if any addresses are pingable
K.2.51. shaper: Traffic shaper
K.2.52. shaper-override: Traffic shaper override based on profile
K.2.53. ip-group: IP Group
K.2.54. dhcp-relay: DHCP server settings for remote / relayed requests
K.3. Data types
K.3.1. user-level: User login level
K.3.2. ppp-dump: PPP dump format
K.3.3. autoloadtype: Type of s/w auto load
K.3.4. config-access: Type of access user has to config
K.3.5. eap-subsystem: Subsystem with EAP access control
K.3.6. eap-method: EAP access method
K.3.7. syslog-severity: Syslog severity
K.3.8. syslog-facility: Syslog facility
K.3.9. http-mode: HTTP/HTTPS security mode
K.3.10. radiuspriority: Options for controlling platform RADIUS response priority tagging
K.3.11. radiustype: Type of RADIUS server
K.3.12. month: Month name (3 letter)
K.3.13. day: Day name (3 letter)
K.3.14. port: Physical port
K.3.15. Crossover: Crossover configuration
K.3.16. LinkFlow: Physical port flow control setting
K.3.17. LinkClock: Physical port Gigabit clock master/slave setting
K.3.18. LinkLED-y: Yellow LED setting
K.3.19. LinkLED-g: Green LED setting
K.3.20. LinkPower: PHY power saving options
K.3.21. LinkFault: Link fault type to send
K.3.22. sampling-protocol: Sampling protocol
K.3.23. trunk-mode: Trunk port mode
K.3.24. ramode: IPv6 route announce level
K.3.25. bgpmode: BGP announcement mode
K.3.26. sampling-mode: Sampling mode
K.3.27. sfoption: Source filter option
K.3.28. pppoe-mode: Type of PPPoE connection
K.3.29. pppoe-calling: Additional prefix on PPPoE calling ID
K.3.30. peertype: BGP peer type
K.3.31. radius-nas: NAS IP to report
K.3.32. switch: Profile manual setting
K.4. Basic types
Index

List of Figures

2.1. Initial web page in factory reset state
3.1. Icons for configuration categories
3.2. The "Setup" category
3.3. Editing an "Interface" object
3.4. Show hidden attributes
3.5. Attribute definitions
3.6. Navigation controls
4.1. Setting up a new user
4.2. Software upgrade available notification
4.3. Manual Software upload
B.1. Product label showing MAC address range

List of Tables

2.1. IP addresses for computer
2.2. IP addresses to access the FireBrick
2.3. IP addresses to access the FireBrick
3.1. Special character sequences
4.1. User login levels
4.2. Configuration access levels
4.3. General administrative details attributes
4.4. Attributes controlling auto-upgrades
5.1. Logging attributes
5.2. System-Event Logging attributes
7.1. Example route targets
12.1. List of system services
12.2. List of system services
13.1. Packet dump parameters
13.2. Packet types that can be captured
15.1. Peer types
15.2. Communities
15.3. Network attributes
B.1. DHCP client names used
C.1. Special URLs
E.1. SCCRQ
E.2. SCCRP
E.3. SCCCN
E.4. StopCCN
E.5. HELLO
E.6. ICRQ
E.7. ICRP
E.8. ICCN
E.9. OCRQ
E.10. OCRP
E.11. OCCN
E.12. CDN
E.13. WEN
E.14. SLI
F.1. Access-request
F.2. Access-Accept
F.3. Access-Reject
F.4. Accounting-Start
F.5. Accounting-Interim
F.6. Accounting-Stop
F.7. Disconnect
F.8. Change-of-Authorisation
F.9. Filter-ID
G.1. Indices
G.2. Fields
G.3. FbBgpPeerState - The state of a BGP peer
G.4. Fields
G.5. Fields
G.6. Indices
G.7. Fields
G.8. Indices
G.9. Fields
G.10. Indices
G.11. Fields
G.12. Indices
G.13. Fields
G.14. Fields
G.15. Fields
G.16. iso.3.6.1.4.1.24693.1.X.Y
I.1. File types
I.2. Colours
I.3. Text
I.4. Text
I.5. URL formats
K.1. config: Attributes
K.2. config: Elements
K.3. system: Attributes
K.4. system: Elements
K.5. link: Attributes
K.6. routing-table: Attributes
K.7. user: Attributes
K.8. eap: Attributes
K.9. log: Attributes
K.10. log: Elements
K.11. log-syslog: Attributes
K.12. log-email: Attributes
K.13. services: Elements
K.14. http-service: Attributes
K.15. dns-service: Attributes
K.16. dns-service: Elements
K.17. dns-host: Attributes
K.18. dns-block: Attributes
K.19. radius-service: Attributes
K.20. radius-service: Elements
K.21. radius-service-match: Attributes
K.22. radius-server: Attributes
K.23. telnet-service: Attributes
K.24. snmp-service: Attributes
K.25. time-service: Attributes
K.26. ethernet: Attributes
K.27. sampling: Attributes
K.28. portdef: Attributes
K.29. interface: Attributes
K.30. interface: Elements
K.31. subnet: Attributes
K.32. subnet-template: Attributes
K.33. vrrp: Attributes
K.34. dhcps: Attributes
K.35. dhcps: Elements
K.36. dhcp-attr-hex: Attributes
K.37. dhcp-attr-string: Attributes
K.38. dhcp-attr-number: Attributes
K.39. dhcp-attr-ip: Attributes
K.40. pppoe: Attributes
K.41. pppoe: Elements
K.42. ppp-route: Attributes
K.43. route: Attributes
K.44. network: Attributes
K.45. blackhole: Attributes
K.46. loopback: Attributes
K.47. namedbgpmap: Attributes
K.48. namedbgpmap: Elements
K.49. bgprule: Attributes
K.50. bgp: Attributes
K.51. bgp: Elements
K.52. bgppeer: Attributes
K.53. bgppeer: Elements
K.54. bgpmap: Attributes
K.55. bgpmap: Elements
K.56. cqm: Attributes
K.57. l2tp: Attributes
K.58. l2tp: Elements
K.59. l2tp-incoming: Attributes
K.60. l2tp-incoming: Elements
K.61. l2tp-relay: Attributes
K.62. profile: Attributes
K.63. profile: Elements
K.64. profile-date: Attributes
K.65. profile-time: Attributes
K.66. profile-ping: Attributes
K.67. shaper: Attributes
K.68. shaper: Elements
K.69. shaper-override: Attributes
K.70. ip-group: Attributes
K.71. dhcp-relay: Attributes
K.72. dhcp-relay: Elements
K.73. user-level: User login level
K.74. ppp-dump: PPP dump format
K.75. autoloadtype: Type of s/w auto load
K.76. config-access: Type of access user has to config
K.77. eap-subsystem: Subsystem with EAP access control
K.78. eap-method: EAP access method
K.79. syslog-severity: Syslog severity
K.80. syslog-facility: Syslog facility
K.81. http-mode: HTTP/HTTPS security mode
K.82. radiuspriority: Options for controlling platform RADIUS response priority tagging
K.83. radiustype: Type of RADIUS server
K.84. month: Month name (3 letter)
K.85. day: Day name (3 letter)
K.86. port: Physical port
K.87. Crossover: Crossover configuration
K.88. LinkFlow: Physical port flow control setting
K.89. LinkClock: Physical port Gigabit clock master/slave setting
K.90. LinkLED-y: Yellow LED setting
K.91. LinkLED-g: Green LED setting
K.92. LinkPower: PHY power saving options
K.93. LinkFault: Link fault type to send
K.94. sampling-protocol: Sampling protocol
K.95. trunk-mode: Trunk port mode
K.96. ramode: IPv6 route announce level
K.97. bgpmode: BGP announcement mode
K.98. sampling-mode: Sampling mode
K.99. sfoption: Source filter option
K.100. pppoe-mode: Type of PPPoE connection
K.101. pppoe-calling: Additional prefix on PPPoE calling ID
K.102. peertype: BGP peer type
K.103. radius-nas: NAS IP to report
K.104. switch: Profile manual setting
K.105. Basic data types

List of Examples

G.1.
G.2.
   Next
   Preface