| Message Number | Message |
|---|---|
| 0 | Echo Reply |
| 3 | Destination Unreachable |
| 4 | Source Quench |
| 5 | Redirect |
| 8 | Echo |
| 11 | Time Exceeded |
| 12 | Parameter Problem |
| 13 | Timestamp |
| 14 | Timestamp Reply |
| 15 | Information Request |
| 16 | Information Reply |
Problem
Configuring Port Mapping via web interface is not possible. Use telnet commands detailed below.
Solution
If you are having problems configuring port mapping on a Zyxel router, the below instructions should help you.
There is no way of doing this using the web GUI so please use the telnet command to configure port mapping.
You can only do port address translation via the command line interface (telnet):
Example 1: translate external ports 4420 through 4422 to internal ports 8080 through 8082 to internal lan
ip 192.168.26.101
:4420 -> 192.168.26.101:8080
:4421 -> 192.168.26.101:8081
:4422 -> 192.168.26.101:8082
ip nat server load 1
ip nat server edit 2 svrport 4420 4422
ip nat server edit 2 intport 8080 8082
ip nat server edit 2 forwardip 192.168.26.101
ip nat server edit 2 active yes
ip nat server save
To display the table :
ip nat server load 1
ip nat server disp 1
Example 2 : Translate external ports 8080 to internal ports 80 to internal lan ip 192.168.0.10
ip nat server load 1
ip nat server edit 2 svrport 8080 8080
ip nat server edit 2 intport 80 80
ip nat server edit 2 forwardip 192.168.0.10
ip nat server edit 2 active yes
ip nat server save
Change Default WebAdmin tcp port 80 to 81 as this will cause issue’s.
Enable WEB-Admin :
sys server load
sys server access http 0
sys server save
Change WEB-ADMIN port 80 to 81.
sys server load
sys server port web 81
sys server save
sys server: save ok
Notes: (1) The “load 1” is required to loading the set #1 (1st page) of rules,
the “edit 2” refers to the 2nd rule (in set #1)
(2) svrport refers to the ports as they appear on the WAN side before the translation
(3) intport refers to the ports as they appear on the LAN side after the translation
if you view the port forwarding rules in the web interface (Network > NAT) the external ports
(svrport) are shown in rule 1 (N-1)
If your firewall is enabled, then you will need to create a firewall rule based on the internal ports (intport).
Add WAN/LAN rule 1 Permit Source IP = any Destination IP = 192.168.0.10 Service = TCP Port 80
Display Listening Ports:
sys server disp
ip tcp status
ENABLE/DISABLE FIREWALL
P-660H-D1> sys firewall active no
P-660H-D1> sys firewall active yes
config t
service tcp-keepalives-in
service tcp-keepalives-out
!
ip inspect max-incomplete high 900
ip inspect max-incomplete low 800
ip inspect one-minute high 900
ip inspect one-minute low 800
ip inspect udp idle-time 15
ip inspect dns-timeout 10
ip inspect tcp idle-time 900
no ip inspect name myfw
ip inspect name myfw cuseeme timeout 900
ip inspect name myfw ftp timeout 900
ip inspect name myfw rcmd timeout 900
ip inspect name myfw realaudio timeout 900
ip inspect name myfw smtp timeout 900
ip inspect name myfw tftp timeout 900
ip inspect name myfw udp timeout 15
ip inspect name myfw tcp timeout 900
ip inspect name myfw h323 timeout 900
ip inspect name myfw pptp timeout 900
!
ip tcp ecn
ip tcp selective-ack
ip tcp timestamp
ip tcp synwait-time 30
ip tcp path-mtu-discovery
!
int vlan 1
ip inspect myfw in
ip urlfilter max-resp-pak 10000
ip urlfilter allow-mode off
ip urlfilter cache 102400
ip urlfilter exclusive-domain allow google.co.uk
ip urlfilter exclusive-domain deny yahoo.co.uk
ip urlfilter audit-trail
!
!
Enable Traffic Inspection:
ip inspect name (name) http urlfilter audit-trail off
ip inspect name (name) http java-list 10
ip inspect name (name) http urlfilter
!
!
The following command sets the URL filtering cache table size to 12000.
!
show ip urlfilter statistics —Shows information and statistics about the filtering server.
show ip urlfilter cache
show ip urlfilter filter config —Shows the filtering configuration
We will look at what this port is used for, and how it relates to the security in Windows 2000.
SMB over TCP vs SMB over NBT The SMB (Server Message Block) protocol is used among other things
for file sharing in Windows NT / 2000.
In Windows NT it ran on top of NBT (NetBIOS over TCP/IP), which used the famous ports 137, 138 (UDP)
and 139 (TCP). In Windows 2000, Microsoft added the possibility to run SMB directly over TCP/IP,
without the extra layer of NBT. For this they use TCP port 445.
When Windows 2000 uses port 445, and when it uses 139 In Windows 2000 you have the possibility to
disable NetBIOS over TCP/IP.
1. You do this by right-clicking on My Network Places and selecting Properties.
2. Then right-click on the appropriate Local Area Connection icon, and select Properties.
3. Next, click on Internet Protocol (TCP/IP) and Properties.
4. Now click Advanced, and select the WINS tab. There you can enable or disable NetBIOS over TCP/IP.
The changes take effect immediately without rebooting the system. From now on I will refer to the “client“
as the computer from where you map drives and other shared resources, and to the “server” as the
computer with resources that are shared. I will also refer to NetBIOS over TCP/IP only as NBT.
If the client has NBT enabled, it will always try to connect to the server at both port 139 and 445
simultaneously.
If there is a response from port 445, it sends a RST to port 139, and continues it’s SMB session to
port 445 only. If there is no response from port 445, it will continue it’s SMB session to port 139 only,
if it gets a response from there.If there is no response from either of the ports,
the session will fail completely.
If the client has NBT disabled, it will always try to connect to the server at port 445 only.
If the server answers on port 445, the session will be established and continue on that port.
If it doesn’t answer, the session will fail completely.
This is the case if the server for example runs Windows NT 4.0. If the server has NBT enabled, it listens on
UDP ports 137, 138, and on TCP ports 139, 445.
If it has NBT disabled, it listens on TCP port 445 only.
If you want it to never use anything but port 445, disable NBT.
Created an access-list on the LAN interface of internal LAN traffic going out.
ip access-list extended LAN
deny ip host 172.20.19.255 any
deny ip host 172.20.19.0 any
deny ip host 0.0.0.0 any
deny tcp 172.20.19.0 0.0.0.255 any eq 135
deny udp 172.20.19.0 0.0.0.255 any eq 136
deny udp 172.20.19.0 0.0.0.255 any eq netbios-ns
deny udp 172.20.19.0 0.0.0.255 any eq netbios-dgm
deny tcp 172.20.19.0 0.0.0.255 any eq 139
permit ip 172.20.19.0 0.0.0.255 172.20.0.0 0.0.255.255
permit ip 172.20.19.0 0.0.0.255 any
!
!
Assign ACL to Vlan Interface:
config t
interface vlan 1
ip access-group LAN in
Resulting in :
show ip access-list LAN
What’s so “fair” about Weighted Fair Queueing (WFQ)? WFQ prevents one particular stream of network traffic, or flow, from using most or all of the available bandwidth while forcing other streams of traffic to sit and wait.
These flows are defined by WFQ and require no access list configuration. Flow-based WFQ is the default queueing scheme for Serial interfaces running at E1 speed or below.
Flow-Based WFQ takes these packet flows and classifies them into conversations. WFQ gives priority to the interactive, low-bandwidth conversations, and then splits the remaining bandwidth fairly between the non-interactive, high-bandwidth conversations.
In the following exhibit, a Telnet flow reaches the router at the same time as two FTP flows. Telnet is low-volume, so the Telnet transmission will be forwarded first. The two remaining file transfers will then be assigned a comparable amount of bandwidth. The packets in the two file transfers will be interleaved – that is, some packets for Flow 1 will be sent, then some for Flow 2, and so on. The key here is that one file transfer flow will not have priority over the other.
Enabling flow-based WFQ is simple enough. We don’t even have to configure it on the following Serial interface, since WFQ is enabled by default on all serial interfaces running at or below E1 speed, but let’s walk through the steps:
R1(config)#int serial0
R1(config-if)#fair-queue ?
<1-4096> Congestive Discard Threshold
<cr>
The Congestive Discard Threshold dictates the number of packets that can be held in a single queue. The default is 64. Let’s change it to 200.
R1(config)#int serial0
R1(config-if)#fair-queue ?
<1-4096> Congestive Discard Threshold
<cr>
R1(config-if)#fair-queue 200
To verify your queuing configuration, run show queue followed by the interface type and number.
R1#show queue serial0
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: weighted fair
Output queue: 0/1000/200/0 (size/max total/threshold/drops)
Conversations 0/0/256 (active/max active/max total)
Reserved Conversations 0/0 (allocated/max allocated)
Available Bandwidth 1158 kilobits/sec
IOS Help shows other WFQ Options:
R1(config-if)#fair-queue 200 ?
<16-4096> Number Dynamic Conversation Queues
<cr>
The Dynamic Conversation Queues are used for normal, best-effort conversations. We’ll change that to 200 as well.
R1(config-if)#fair-queue 200 200
Number of dynamic queues must be a power of 2 (16, 32, 64, 128, 256, 512, 1024)
Then again, maybe we won’t. Let’s change it to 256 instead and use IOS Help to show any other options.
R1(config-if)#fair-queue 200 256 ?
<0-1000> Number Reservable Conversation Queues
The final WFQ option is the number of Reservable Conversation Queues. The default here is zero. These queues are used for specialized queueing and Quality of Service features like the Resource Reservation Protocol (RSVP). We’ll set this to 100.
R1(config-if)#fair-queue 200 256 100
show queue verifies that all three of these values have been successfully set, as does show queueing fair.
R1#show queue serial 0
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: weighted fair
Output queue: 0/1000/200/0 (size/max total/threshold/drops)
Conversations 0/0/256 (active/max active/max total)
Reserved Conversations 0/0 (allocated/max allocated)
Available Bandwidth 1158 kilobits/sec
Earlier in this section, I mentioned that serial interfaces running at E1 speed or lower will run WFQ by default. However, if any of the following features are running on the interface, WFQ will not be the default.
eq:
eq:
WFQ (Cisco 857)
Enable Fair-Queue on Interface as FIFO is the default Queuing :
Interface Vlan 1
fair-queue
From here you will need to make a route-map and set ip precedence or TOS values :
!
route-map qos-outbound
match ip address 101
set ip tos 8
match ip address 102
set ip tos 6
match ip address 103
set ip tos 4
!
we then need to apply this route map to any LAN interfaces we have ( VLAN , etc)
!
int vlan 1
ip policy route-map qos-outbound
!
!
Its important to understand what you have exactly done here.
You haven’t enabled QOS, there is no flow more important then any other flow ( nothing is guarantee).
What you have done is match traffic into que’s, when the link is congested, WFQ will serve each que equally. What you have done is stop starvation of flows.
If your link is under T1 ( 1.544Mbit) then don’t enable CBWFQ as it should automatically do WFQ and in the route maps set ip precedence instead of TOS. If its above T1 then you cant enable WFQ because the required command aren’t there.
This is for the outboud traffic, you cant control incoming) with Fair Queing/TOS there is no priority, by adding a TOS value to the header you helping to create more granular flows. which in turn when congested will service each QUE equally and stop starvation of flows.
The WFQ method has the advantage of being fast, reliable and easy to implement.
WFQ follows these main criteria:
Dedicated queues for each flow (referred to as conversations), messages are sorted into conversations
reducing starvation, delay, and jitter within the queue.
Allocating bandwidth fairly and accurately among all flows, reducing scheduling delay and
guaranteeing service.
IP Precedence is used as weight when allocating bandwidth.
Although bandwidth is allocated fairly among all flows, unfairness is reinstated by giving proportionately
more bandwidth to flows with higher IP precedence or lower weight.
WFQ has to classify individual flows using the following information taken from the IP/TCP/UDP headers.
These parameters are used as input for a hash algorithm that produces a fixed length number that is
used as the index of the queue.
Source IP address
Destination IP address
Protocol number to identify TCP or UDP
Type of service field
Source TCP/UDP port number
Destination TCP/UDP port number.
On A 857 you can’t set the cue to be CBWFQ.
To log all packets dropped by the firewall, use the
ip inspect log drop-pkt command in global configuration mode.
To return to the default state, use the no form of this command.
ip inspect log drop-pkt
no ip inspect log drop-pkt
Cisco Named Access-List resequence numbers after removing a rule.
eg :
Cisco#show ip access-lists WANIncoming
!
Extended IP access list WANIncoming
10 permit ip host 1.1.1.1 any (243750 matches)
20 permit ip 2.2.2.8 0.0.0.7 any (982563 matches)
30 permit esp host 2.2.2.222 any (169532251 matches)
40 permit udp host 2.2.2.222 any eq isakmp (9864 matches)
50 permit udp host 2.2.2..30 any eq ntp (15 matches)
60 permit udp host 2.2.2.31 any eq ntp (15 matches)
70 permit udp host 194.72.6.57 eq domain any (87 matches)
80 permit udp host 194.73.82.242 eq domain any (9 matches)
90 permit icmp host 2.2.2.222 any (6 matches)
100 permit icmp any any administratively-prohibited
110 permit icmp any any echo-reply (7015 matches)
120 permit icmp any any packet-too-big
130 permit icmp any any time-exceeded (1044 matches)
140 permit icmp any any traceroute
150 permit icmp any any unreachable (774 matches)
180 deny ip any any log (6452 matches)
config t
ip access-list resequence WANIncoming 10 10
This will re-order to sequence no. to start from 10 and increment by 10.
Should look like this:
Cisco#show ip access-lists WANIncoming
!
Extended IP access list WANIncoming
10 permit ip host 1.1.1.1 any (243750 matches)
20 permit ip 2.2.2.8 0.0.0.7 any (982563 matches)
30 permit esp host 2.2.2.222 any (169532251 matches)
40 permit udp host 2.2.2.222 any eq isakmp (9864 matches)
50 permit udp host 2.2.2..30 any eq ntp (15 matches)
60 permit udp host 2.2.2.31 any eq ntp (15 matches)
70 permit udp host 194.72.6.57 eq domain any (87 matches)
80 permit udp host 194.73.82.242 eq domain any (9 matches)
90 permit icmp host 2.2.2.222 any (6 matches)
100 permit icmp any any administratively-prohibited
110 permit icmp any any echo-reply (7015 matches)
120 permit icmp any any packet-too-big
130 permit icmp any any time-exceeded (1044 matches)
140 permit icmp any any traceroute
150 permit icmp any any unreachable (774 matches)
160 deny ip any any log (6452 matches)
!
!
e.g :
config t
ip access-list resequence WANIncoming 10 10
This will re-order to sequence no. to start from 5 and increment by 5.
Cisco#show ip access-lists WANIncoming
!
Extended IP access list WANIncoming
5 permit ip host 1.1.1.1 any (243750 matches)
10 permit ip 2.2.2.8 0.0.0.7 any (982563 matches)
15 permit esp host 2.2.2.222 any (169532251 matches)
20 permit udp host 2.2.2.222 any eq isakmp (9864 matches)
25 permit udp host 2.2.2..30 any eq ntp (15 matches)
30 permit udp host 2.2.2.31 any eq ntp (15 matches)
35 permit udp host 194.72.6.57 eq domain any (87 matches)
40 permit udp host 194.73.82.242 eq domain any (9 matches)
45 permit icmp host 2.2.2.222 any (6 matches)
50 permit icmp any any administratively-prohibited
55 permit icmp any any echo-reply (7015 matches)
60 permit icmp any any packet-too-big
65 permit icmp any any time-exceeded (1044 matches)
70 permit icmp any any traceroute
75 permit icmp any any unreachable (774 matches)
80 deny ip any any log (6452 matches)
You can also remove rules from the ACL by sequence numbers :
!
config t
ip access-list extended WANIncoming
no 50
no 60
aaa authentication login easyvpnlist local
aaa authorization network Comms-Networks local
!
!
crypto isakmp policy 1
encr aes 256
authentication pre-share
group 2
crypto isakmp key test address 2.2.2.2 no-xauth
crypto isakmp client configuration address-pool local EASYVPN_POOL
crypto isakmp xauth timeout 60
!
crypto isakmp client configuration group Comms-Networks
key test
dns 192.168.3.1
domain Comms-Networks
pool EASYVPN_POOL
acl EASY_VPN_SUBNET_SPLIT_TUNNELING
save-password
pfs
max-users 5
netmask 255.255.255.248
!
crypto ipsec transform-set sitetosite+easyvpn esp-aes 256 esp-sha-hmac
!
crypto map site-to-site 30 ipsec-isakmp dynamic Comms-Networks
!
crypto map site-to-site client authentication list easyvpnlist
crypto map site-to-site client configuration address respond
crypto map site-to-site isakmp authorization list Comms-Networks
crypto map site-to-site 1 ipsec-isakmp dynamic Comms-Networks
!
crypto map site-to-site 1 ipsec-isakmp
set peer 2.2.2.2
set transform-set sitetosite+easyvpn
match address IPSEC_VPN_SUBNET
!
crypto dynamic-map Comms-Networks 10
set transform-set sitetosite+easyvpn
reverse-route
!
!
ip local pool EASYVPN_POOL 192.168.3.2 192.168.3.6
!
ip access-list extended IPSEC_VPN_SUBNET
remark ACCESS_LOCAL_SUBNET-TO-REMOTE_SUBNETS
permit ip 192.168.2.0 0.0.0.7 10.0.0.0 0.0.0.255
permit ip 192.168.2.0 0.0.0.7 10.0.1.0 0.0.0.255
!
ip access-list extended EASY_VPN_SUBNET_SPLIT_TUNNELING
permit ip 192.168.3.0 0.0.0.7 any
remark ACCESS_MEDIA_SERVERS
permit ip 192.168.2.0 0.0.0.7 any
!
interface vlan 2
description MEDIA_SERVER_INTERFACE
ip address 192.168.2.1 255.255.255.248
ip inspect myfw in
ip nat inside
!
interface loopback 3
description EASY_VPN_SERVER_INTERFACE
ip address 192.168.3.1 255.255.255.248
ip inspect myfw in
ip nat inside
!
ip nat inside source route-map SERVERS_RMAP interface FastEthernet0/0 overload
ip nat inside source route-map EASY_VPN_RMAP interface FastEthernet0/0 overload
!
route-map SERVERS_RMAP permit 1
match ip address 102
!
route-map EASY_VPN_RMAP permit 1
match ip address 103
!
remark IPSEC_TUNNEL_DENY_NAT
access-list 102 deny ip 192.168.2.0 0.0.0.7 10.0.0.0 0.0.0.255
access-list 102 deny ip 192.168.2.0 0.0.0.7 10.0.1.0 0.0.0.255
remark MEDIA_SERVER_DENY_NAT_TO_EASY_VPN_SERVER
access-list 102 deny ip 192.168.2.0 0.0.0.7 192.168.6.0 0.0.0.7
remark ALLOW_ANY
access-list 102 permit ip 192.168.2.0 0.0.0.7 any
!
remark EASY_VPN_SERVER_DENY_NAT_TO_MEADIA_SERVER
access-list 103 deny ip 192.168.3.0 0.0.0.7 192.168.2.0 0.0.0.7
remark ALLOW_ANY
access-list 103 permit ip 192.168.3.0 0.0.0.7 any
Bind crypto map to WAN Interface :
interface FastEthernet0/0
crypto map site-to-site
INTRODUCTION
How to configure a host to router Easy VPN Solution, based:
Cisco VPN Client, and Easy VPN Server.
1. The Cisco Easy VPN negotiates tunnel parameters and establishes IPsec tunnels.
2. Xauth adds another level of authentication that identifies the user who
requests the IPsec connection.
3. Split tunneling enables the remote client to forward the Internet destined
traffic directly without forwarding it over the encrypted tunnel.
PREREQUISITES
The sample configuration is based on the following assumptions:
• The IP address at the Cisco Easy VPN Server is static.
• The IP address at the Cisco VPN Client is static or dynamic.
• The Cisco Easy VPN Client encrypts only traffic that is forwarded to the hub.
• Traffic destined for the Internet is forwarded, unencrypted, directly from the remote site.
• Traffic from the remote host is forwarded after applying Network Address Translation/Port
Address Translation (NAT/PAT).
• User level authentication is used for authorizing VPN access.
Configuration on Cisco Server end :
aaa authentication login easyvpnlist local
aaa authorization network Comms-Networks local
!
crypto isakmp policy 1
encr aes 256
authentication pre-share
group 2
crypto isakmp client configuration address-pool local EASYVPN_POOL
crypto isakmp xauth timeout 60
!
crypto isakmp client configuration group Comms-Networks
key P0wder07
dns 192.168.3.1
domain Comms-Networks
pool EASYVPN_POOL
acl EASY_VPN
save-password
pfs
max-users 5
netmask 255.255.255.248
!
crypto ipsec transform-set easyvpnvpn esp-aes 256 esp-sha-hmac
!
crypto dynamic-map Comms-Networks 10
set transform-set easyvpnvpn
reverse-route
!
crypto map easyvpn 3000 ipsec-isakmp dynamic Comms-Networks
!
crypto map easyvpn client authentication list easyvpnlist
crypto map easyvpn client configuration address respond
crypto map easyvpn isakmp authorization list Comms-Networks
crypto map easyvpn 1 ipsec-isakmp dynamic Comms-Networks
!
ip local pool EASYVPN_POOL 192.168.3.2 192.168.3.6
!
ip access-list extended EASY_VPN
permit ip 192.168.3.0 0.0.0.7 any
remark Access_to_Media_Server
permit ip 192.168.2.0 0.0.0.7 any
!
interface FastEthernet0/0
description WAN_INTERFACE
crypto map easyvpn
Note :
Don’t forget to configure nonat DENY statement from the 192.168.2.0 network over to 192.168.3.0 network, same vice-versa. This will ensure no NAT traffic is going over the ipsec encrypted tunnel.
The nonat ACL will bind to the corresponing Interfaces where traffic is to be initiated from.