Home

FireBrick FB6502 User Manual

1. control switch users List of NMTOKEN Any users Restrict users that have access to control switch initial boolean true Defines state at system startup if not using set interval duration 1 Time between tests invert boolean Invert final result of testing log NMTOKEN Not logging Log target log debug NMTOKEN Not logging Log additional information name NMTOKEN Not optional Profile name not NMTOKEN Active if specified profile is inactive as well as all other tests passing including and or List of NMTOKEN Active if any of these other profiles active regardless of other tests including not or and recover duration 1 Time before recover i e how long test has been passing route List of IPAddr Test passes if all specified addresses are routeable set switch Manual override ignore ALL other settings source string Source of data used in automated config management table unsignedByte 0 99 Routing table for ping route routetable timeout duration 10 Time before timeout i e how long test has been failing virp List of NMTOKEN VRRP state any of these is master Table G 49 profile Elements Element Type Instances Description date profile date Optional unlimited Test passes if within any date range specified ping profile ping Optional Test passes if address is answering pings time profile time Optional unlimited Test passes if within any time range
2. Value Description false Do not announce low Announce as low priority medium Announce as medium priority high Announce as high priority true Announce as default medium priority 128 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects G 3 21 dhcpv6control Control for RA and DHCPv6 bits Table G 80 dhcpv control Control for RA and DHCPv6 bits Value Description false Don t set bit or answer on DHCPv6 true Set bit but do not answer on DHCPv6 dhcpv6 Set bit and do answer on DHCP v6 G 3 22 bgpmode BGP announcement mode BGP mode defines the default advertisement mode for prefixes based on well known community tags Table G 81 bgpmode BGP announcement mode Value Description false Not included in BGP at all no advertise Not included in BGP not advertised at all no export Not normally exported from local AS confederation local as Not exported from local AS no peer Exported with no peer community tag true Exported as normal with no special tags added G 3 23 sfoption Source filter option Table G 82 sfoption Source filter option Value Description false No source filter checks blackhole Check replies have any valid route true Check replies down same port vlan G 3 24 peertype BGP peer type Peer type controls many of the default
3. 80 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported RADIUS Attribute Value Pairs for VoIP operation Acct Event 55 Time call answered Timestamp NAS Identifier 32 Configured hostname of FireBrick NAS IP Address 4 Far end IPv4 address for SIP if using IPv4 NAS IPv6 Address 95 Far end IPv6 address for SIP if using IPv6 NAS Port 5 Far end UDP port for SIP Note If the call is connected to another call leg then a second Acct Session Id is included with details of the linked call leg D 5 Accounting Stop As accounting interim update plus Table D 8 Accounting Stop AVP No Usage User Name 1 SIP URI for our end of the call leg Callback ID 20 SIP URI for other end of the call leg Called Station Id 30 Dialled number as received Calling Station Id 31 Calling number as received Acct Status Type 40 2 Stop Acct Session Id 44 Unique ID for session Acct Multi Session 50 SIP Call ID for call leg Id Acct Terminate 49 Cause code as appropriate Cause Acct Event 55 Time call ended Timestamp Chargeable User 89 CUI for this call Identity NAS Identifier 32 Configured hostname of FireBrick NAS IP Address 4 Far end IPv4 address for SIP if using IPv4 NAS IPv6 Address 95 Far end IPv6 address for SIP if using IPv6 NAS Port 5 Far end UDP port for SIP D 6 D
4. profile NMTOKEN Profile name source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable tag List of Community List of community tags G 2 30 blackhole Dead end networks Networks that go nowhere Table G 38 blackhole Attributes Attribute Type Default Description as path List up to 10 Custom AS path as if network received unsignedInt bgp bgpmode false BGP announce mode for routes comment string Comment ip List of IPPrefix Not optional One or more network prefixes localpref unsignedInt 4294967295 Localpref of network highest wins name string Name profile NMTOKEN Profile name source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable tag List of Community List of community tags G 2 31 loopback Locally originated networks Loopback addresses define local IP addresses Table G 39 loopback Attributes Attribute Type Default Description as path List up to 10 Custom AS path as if network received unsignedInt bgp bgpmode BGP announce mode for routes comment string Comment ip List of IPAddr Not optional One or more local network addresses localpref unsignedInt 4294967295 Localpref of network highest wins name string Name profile NMTOKEN Profile name source string Source of da
5. Caution Please only set things to log to fb support if requested by support staff 5 5 Performance The FireBrick can log a lot of information and adding logs can causes things to slow down a little The controls in the config allow you to say what you log in some detail However logging to flash will always slow things down a lot and should only be used where absolutely necessary 5 6 Viewing logs 5 6 1 Viewing logs in the User Interface To view a log in the web User Interface select the Log item in the Status menu Then select which log target to view by clicking the appropriate link You can also view a pseudo log target All which shows log event messages sent to any log target The web page then continues showing log events on the web page in real time i e as they happen Note This is an open ended web page which has been known to upset some browsers but this is rare However it does not usually work with any sort of web proxy which expects the page to actually finish 31 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Event Logging All log targets can be viewed via the web User Interface regardless of whether they specify any external logging or logging to Flash memory 5 6 2 Viewing logs in the CLI environment The command line allows logs to be viewed and you can select which log target or all targets The logging continues on screen until you pres
6. 3 FireBrick FB2700 Home Status Diagnostics Graphs Config Logout E E E 6 E EJ E E E Within each category there are one or more sections delimited by horizontal lines Each of these sections has a heading and corresponds to a particular type of top level object and relates to a major part of the configuration that comes under the selected category See Figure 3 4 for an example showing part of the Setup category which includes general system settings the system object and control of system services network services provided by the FB6000 such as the web interface web server telnet server etc controlled by the services object 12 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Figure 3 4 The Setup category System System settings name contact location intro comment Edit ruby Mike Chambers WF Ryde Office General system services Edit General system services Constant Quality Monitoring config Each section is displayed as a tabulated list showing any existing objects of the associated type Each row of the table corresponds with one object and a subset typically those of most interest at a glance of the object s attributes are shown in the columns the column heading shows the attribute name If no objects of that type exist there will be a single row with an Add link Where the order of the objects matter there will be an Add link
7. lt http local only false gt Web control page access via http This address is allowed access to web control pages subject to username password being allowed lt telnet allow admin ips local only false gt Telnet access This address is not allowed access due to the allow list on telnet service in this example admin ips is the name of an IP address group that does not include 1 2 3 4 lt dns local only true gt 51 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Network Diagnostic Tools DNS resolver access This address is not on a local Ethernet subnet and so not allowed access 11 2 Packet Dumping The FireBrick includes the ability to capture packet dumps for diagnostic purposes This might typically be used where the behaviour of the FB6000 is not as expected and can help identify whether other devices are correctly implementing network protocols if they are then you should be able to determine whether the FB6000 is responding appropriately The packet dumping facility may also be of use to you to debug traffic and thus specific network protocols between two hosts that the brick is routing traffic between This feature is provided via the FB6000 s HTTP server and provides a download of a pcap format file old format suitable for use with t cpdump or Wireshark A packet dump can be performed by eithe
8. After listing the possible commands the CLI re displays the command line typed so far which you can then complete Please refer to Appendix E for command details 72 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix A CIDR and CIDR Notation Classless Inter Domain Routing CIDR is a strategy for IP address assignment originally specified in 1993 that had the aims of conserving the address space and limiting the growth rate of global routing state The current specification for CIDR is in RFC4632 http tools ietf org html rfc4632 The pre CIDR era CIDR replaced the original class based organisation of the IP address space which had become wasteful of address space and did not permit aggregation of routing information In the original scheme only three sizes of network were possible e Class A 128 possible networks each with 16 777 216 addresses e Class B 16384 possible networks each with 65 536 addresses e Class C 2097152 possible networks each with 256 addresses Every network including any of the large number of possible Class C networks required an entry in global routing tables those used by core Internet routers since it was not possible to aggregate entries that had the same routing information The inability to aggregate routes meant global routing table size was growing fast which meant performance issues at core routers The position and size of the netw
9. F 2 2 Additional text Additional text is shown on the graph based on the values in the configuration if not specified There are 4 lines on the top left in small text and two heading lines top right in large text Table F 3 Text Key Text Z Clean output clears all additional text fields 90 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Constant Quality Monitoring technical details Z Clean and clear as z but also sets inside background and off line colours to transparent so graphs are easy to merge with those other LNSs C Line 1 top left text default if not set in config is system name c Line 2 top left text N Line 3 top left text n Line 4 top left text H Main heading text default if not set in config is graph name h Sub heading text F 2 3 Other colours and spacing Colours can be in the form of RGB RRGGBB RGBA RRGGBBAA defining red green blue alpha or some simple colour names Table F 4 Text Key Meaning L Defines a number of pixels to be provided on the left of the graph Bandwidth and scale axis shown based on space provided left and right R Defines a number of pixels to be provided on the right of the graph Bandwidth and scale axis is shown based on space provided left and right T Defines a number of pixels to be provided on the top of the graph Time axes is show based on space at
10. gt and characters have special meaning there are special escape character sequences starting with the ampersand character that are used to represent these characters They are Table 3 1 Special character sequences Sequence Character represented amp 1lt lt amp gt gt amp quot samp amp Note that since the ampersand character has special meaning it too has an escape character sequence Attributes are written in the form name value or name value Multiple attributes are separated by white space spaces and line breaks Generally the content of an element can be other child elements or text However the FB6000 doesn t use text content in elements all configuration data is specified via attributes Therefore you will see that elements only contain one or more child elements or no content at all Whilst there is generally not any text between the tags white space is normally used to make the layout clear 3 5 2 The root element lt config gt At the top level an XML file normally only has one element the root element which contains the entire element hierarchy In the FB6000 the root element is lt config gt and it contains top level configuration elements that cover major areas of the configuration such as overall system settings interface definitions firewall rule sets etc In addition to this User Manual there is reference material is available that docum
11. unsignedShort unsigned short integer 0 65535 byte byte integer 128 127 unsignedByte unsigned byte integer 0 255 boolean Boolean dateTime YYYY MM DDTHH MM SS date time time HH MM SS time NMTOKEN String with no spaces void Internal use IPAddr IP address IPNameA ddr IP address or name IP4Addr IPv4 address IP6Addr IPv6 address IPPrefix IP address bitlen IPRange IP address bitlen or range IPNameRange IP address bitlen or range or name IP4Range IPv4 address bitlen or range IP4Prefix IPv4 address bitlen IPSubnet IP address bitlen 131 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects IPFilter Route filter Password Password Community XXX XXX community PortRange XXX XXX port range Colour rgb rrggbb rgba rrggbbaa colour Secret Secret passphrase duration Period HH MM SS username Login name NMTOKEN ipnamerangelist List of IPranges or ip groups PNameRange routetable Route table number 0 99 unsignedByte ipnamelist List of IP addresses or domain names JPNameAddr datenum Day number in month 1 31 unsignedByte stringlist List of strings string iplist List of IP addresses PAddr subnetlist List of subnets IPSubnet ra max Route announcement max interval seconds 4 1800 unsignedShort ra min Route announcement min interval seconds
12. 0 1245 808299 Network Diagnostic Tools 11 2 6 Using the web interface The web form is accessed by selecting the Packet dump item under the Diagnostics main menu item Setup the dump parameters with reference to Table 11 1 and click the Dump button Your browser will ask you to save a file which will take time to save as per the timeout requested 11 2 7 Using an HTTP client To perform a packet dump using an HTTP client you first construct an appropriate URL that contains standard HTTP URL form style parameters from the list shown in Table 11 1 Then you retreive the dump from the FB6000 using a tool such as curl The URL is http lt FB6000 IP address or DNS name gt pcap parameter_name value amp parameter_name value The URL may include as many parameter name and value pairs as you need to completely specify the dump parameters Packet capturing stops if the output stream HTTP transfer fails This is useful if you are unable to determine a suitable timeout period and would like to run an ongoing capture which you stop manually This is achieved by specifying a very long duration and then interrupting execution of the HTTP client using Ctrl C or similar Only one capture can operate at a time The HTTP access fails if no valid interfaces or sessions etc are specified or if a capturing is currently running 11 2 7 1 Example using curl and tcpdump An example of a simple real time dump and analysis run
13. ADMIN System administrator DEBUG System debugger G 3 4 syslog severity Syslog severity Log severity different loggable events log at different levels Table G 63 syslog severity Syslog severity Value Description EMERG System is unstable ALERT Action must be taken immediately CRIT Critical conditions ERR Error conditions WARNING Warning conditions NOTICE Normal but significant events INFO Informational DEBUG Debug level messages NO LOGGING No logging G 3 5 syslog facility Syslog facility Syslog facility usually used to control which log file the syslog is written to Table G 64 syslog facility Syslog facility Value Description KERN Kernel messages USER User level messges MAIL Mail system DAEMON System Daemons AUTH Security auth SYSLOG Internal to syslogd LPR Printer NEWS News UUCP UUCP CRON Cron deamon AUTHPRIV private security auth FTP File transfer 124 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects 12 Unused 13 Unused 14 Unused 15 Unused LOCALO Local 0 LOCAL1 Local 1 LOCAL2 Local 2 LOCAL3 Local 3 LOCAL4 Local 4 LOCALS Local 5 LOCAL6 Local 6 LOCAL7 Local 7 G 3 6 month Month name 3 letter Table G 65 month Month name 3 letter Value Description Jan January Feb Febru
14. once the overall test result has been pass for a specified duration the profile transitions to Active These two durations are controlled by attributes and provide a means to filter out short duration blips that are of little interest An example of a test that can be performed is a Ping test ICMP echo request packets are sent and replies are expected If replies are not being received the test fails Profiles can be logically combined using familiar boolean terminology i e AND OR and NOT allowing for some complex profile logic to be defined that determines a final profile state from several conditions By combining profiles with the FB6000 s event logging facilities they can also be used for automated monitoring and reporting purposes where profile state changes can be e mailed direct from the FB6000 For example a profile using a Ping test can be used to alert you via e mail when a destination is unreachable The current state of all the profiles configured on your FB6000 can be seen by choosing the Profiles item in the Status menu Tip You can also define dummy profiles that are permanantly Active or Inactive which can be useful if you wish to temporarily disable some functionality without deleting configuration object s For example you can force an FB105 tunnel to be Down preventing traffic from being routed through it Refer to Section 8 2 4 for details 8 2 Creating editing profiles In the web user int
15. press the Save button The navigation button area shown in Figure 3 8 also includes three other buttons e New creates a new instance of the object type being edited the new object is inserted after the current one this is equivalent to using the Add link one level up in the hierarchy e Erase deletes the object being edited note that the object will not actually be erased until the configuration is saved e Help browses to the online reference material as desribed in Section 3 2 1 for the object type being edited 15 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Caution If you Add a new object but don t fill in any parameter values the object will remain in existence should you navigate away You should be careful that you don t inadvertently add incompletely setup objects this way as they may affect operation of the FireBrick possibly with a detrimental effect If you have added an object perhaps for the purposes of looking at what attributes can be set on it remember to delete the object before you navigate away the Erase button see Figure 3 8 is used to delete the object you are viewing 3 4 4 Backing up restoring the configuration To back up save or restore the configuration start by clicking on the Config main menu item This will show a page with a form to upload a configuration file in XML to the FB6000 also on the page is a
16. 0 1245 808299 Attribute Type Default Description allow List of Allow from List of IP ranges from which service can be IPNameRange anywhere accessed auto dhcp boolean Forward and reverse DNS for names in DHCP using this domain comment string Comment domain string Our domain local only boolean true Restrict access to locally connected Ethernet subnets only log NMTOKEN Not logging Log events log debug NMTOKEN Not logging Log debug 100 Configuration Objects log error NMTOKEN Log as event Log errors profile NMTOKEN Profile name resolvers List of IPAddr Recursive DNS resolvers to use source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable Table G 17 dns service Elements Element Type Instances Description block dns block Optional unlimited Fixed local DNS host blocks host dns host Optional unlimited Fixed local DNS host entries G 2 13 dns host Fixed local DNS host settings DNS forwarding resolver service Table G 18 dns host Attributes Attribute Type Default Description comment string Comment ip List of IPAddr Our IP IP addresses to serve or our IP if omitted name List of string Not optional Host names can use as a part of a domain profile NMTOKEN Profile name restrict List of List of IP ranges to which this is served
17. 1245 808195 Fax 44 0 1245 808299 Chapter 11 Network Diagnostic Tools Various network diagnostic tools are provided by the FB6000 accessible through either the web user interface or the CLI e Packet dump low level diagnostics to for detailed examination of network traffic passing through the FB6000 e Ping standard ICMP echo request reply ping mechanism e Traceroute classical traceroute procedure ICMP echo request packets with increasing TTL values soliciting TTL expired responses from routers along the path e Access check check whether a specific IP address is allowed to access the various network services described in Chapter 10 Each tool produces a textual result and can be accessed via the CLI where the same result text will be shown Caution The diagnostic tools provided are not a substitute for external penetration testing they are intended to aid understanding of FB6000 configuration assist in development of your configuration and for diagnosing problems with the behaviour of the FB6000 itself 11 1 Access check For each network service implemented by the FB6000 see Chapter 10 this command shows whether a specific IP address will be able to access or utilise the service based on any access restrictions configured on the service For example the following shows some service configurations expressed in XML and the access check result when checking access for an external address 1 2 3 4
18. B BGP overview 67 Boot process 26 Breadcrumbs 12 C Configuration backing up and restoring 16 categories user interface 12 methods 10 overview 9 overview of using XML 16 transferring using HTTP client 19 using web user interface 10 Configuration Basic data types 131 Configuration Data types 123 Configuration Field definitions 94 D DHCP configuring server 35 configuring subnet with DHCP client 34 Diagnostics Access check 51 Packet dumping 52 DNS configuring resolver s to use 49 E Ethernet Ports configuring LED indication modes 36 configuring speed and or duplex modes 36 relationship with interfaces 33 sequenced flashing of LEDs 26 Event logging external logging 29 overview 28 viewing logs 31 G Graphs 44 H Hostname setting 22 HTTP service configuration 48 Interfaces defining 33 Ethernet 33 relationship with physical ports 33 L LEDs Power LED status indications 26 Log targets 28 Logging see Event logging N Navigation buttons in user interface 15 NTP Network Time Protocol configuring time servers to use 50 O Object Hierarchy overview 9 Object Model definition of 9 formal definition 10 P Packet dumping 52 Example using curl and tcpdump 54 Profiles defining 41 overview 41 viewing current state 41 R RADIUS configuring service 50 Route definition of 38 Routing route targets 39 S Shapers 45 SNM
19. BGP config blackhole blackhole Optional unlimited Black hole dropped packets networks cqm cqm Optional Constant Quality Monitoring config ethernet ethernet Optional unlimited Ethernet port settings interface interface Optional up to 8192 Ethernet interface port group vlan and subnets ip group ip group Optional unlimited Named IP groups log log Optional up to 50 Log target controls loopback loopback Optional unlimited Extra local addresses network network Optional unlimited Locally originated networks nowhere blackhole Optional unlimited Dead end icmp error networks port portdef Optional up to 2 Port grouping and naming profile profile Optional unlimited Control profiles route route Optional unlimited Static routes services services Optional General system services system system Optional System settings user user Optional unlimited Admin users voip voip Optional VoIP config G 2 Objects G 2 1 system System settings The system settings are the top level attributes of the system which apply globally www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 94 Configuration Objects Table G 3 system Attributes Attribute Type Default Description comment string Comment contact string Contact name dos delay unsignedInt 2
20. Cause D 2 Authentication response D 2 1 Challenge authentication Table D 2 Access Challenge AVP No Usage Digest Realm 104 Digest Realm Digest Nonce 105 Digest Nonce Digest QOP 110 Digest QOP Digest Algorithm 111 Digest Algorithm Digest Opaque 116 Digest Opaque Digest Stale 120 Digest Stale D 2 2 Accepted authentication registration Table D 3 Access Accept AVP No Usage Calling Station Id 31 Calling number to be set up for tel number routing to this registration if omitted then the registration is not recorded Session Timeout 27 Time to send in reply Expires header SIP AOR 121 SIP URI Contact for 302 redirect response D 2 3 Accepted authentication invite Note that this section is not yet complete Table D 4 Access Accept AVP No Usage Chargeable User 89 Identity to be used on accounting records Identity Called Station Id 30 Overrides Dialled number of this call Calling Station Id 31 Overrides CLI to use on this call Anonymous will flag as withheld CLI User Name 1 Replaces the Name of the this call Filter Id 11 Adds a call recording email address to this call 79 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported RADIUS Attribute Value Pairs for VoIP operation SIP AOR 121 Creates a new outgoing call leg See S
21. SS 79 D S ACCeSS Re Cts oirlo rr E EEEE EON E E SERRES ii 80 D 6 Accounting Start 3 si 0055 sss an tessa E aE tists Geek EE odd ia EN E EASES EIRE EEEE ENE ETERRA St 80 D 7 Accounting Interi pte a E a rote toa rss 80 DS Accounting StOp een o ie A DIRE vss Mode dE 81 PAN se ieoor eaea aeee eted es evesends sbovas aaa r EEEE seatds ses Messe Ea e E EIE EE E Esaa ENEE 81 D 10 Change of Authorisation isisisi anino ies e E EESE E EEE SEEE EE E TE eeu eeae esas 82 Bel Filetypes irn aeae aea e e E a a e a T A E E as 89 F2 COlOUIS a oer r Bes Si A a Ses a T EVE ETE oe ETE E r EA LOSE EEA ee ES 90 Fi3 OX a E E TET E ET 90 BAe KES e E EEN A ESA E es AA E E 91 FBS URE formats esenp a o aap EEE O ARE E E E EEE 92 Gil CONDE Attributes arrati rea e eres E N iE A E EES AE aes E see NEES EEES 94 62 config Elements sseeg eare a a ka oaao EEE EEEE EE d AVT ESSEEN EEOSE RESE ReiS 94 G3 system Attributes rhan r Sistas a dd tias 95 G 4 system Elements cit a ses E e E yd Bas E E E E 95 GS 5 links Attributes ir o eoi eTe A See bes oe eden EES 95 CA A rA NE TE NEONA AEE INE ENEE ASAR dae daseowaedahcosanapeesmsdtesaees 96 67 l g ADUTE S ere e te EEE SEAE EE EE EEEE ESEE E 96 G8 log Elements oeie e a E ea E E bad E E aa 96 G9 log syslog O NO 97 G 10 Jog emarl Attributes 5 3 25 scisesivess sass Seacds sectacdseesseadscsetes La EE ETERS censosecesscaaeSsangssesveageaes 97 Gil le services Elements emitan tias 98 G 12 spmp service Attrib
22. against each object clicking an Add link for a particular object will insert a new object before it To add a new object after the last existing one click on the Add link on the bottom or only row of the table Tip If there is no Add link present then this means there can only exist a limited number of objects of that type possibly only one and this many already exist The existing object s may have originated from the factory reset configuration You can push down into the hierarchy by clicking the Edit link in a table row This takes you to a page to edit that specific object The page also shows any child objects of the object being edited using the same horizontal line delimited section style used in the top level categories You can navigate back up the hierarchy using various methods see Section 3 4 3 Caution Clicking the Add link will create a new sub object which will have blank default settings This can be useful to see what attributes an object can take but if you do not want this blank object to be part of the configuration you later save you will need to click Erase Simply going back Up or moving to another part of the config will leave this newly created empty object and that could have undesirable effects on the operation of your FireBrick if saved 3 4 2 2 Object settings The details of an object are displayed as a matrix of boxes giving the appearance of a wall of bricks one for each attrib
23. capabilities database hosted on FireBrick company servers for your specific FB6000 as identified by the unit s Serial Number Normally your FB6000 will be running factory or possibly beta software with alpha software only used under advice and guidance of support personnel while investigating fixing possible bugs or performance issues You can see whether your FB6000 is able to run alpha releases by viewing the main Status page click the Status main menu item and look for the row labelled Allowed if the text shows Alpha builds for testing then your FB6000 can run alpha releases 4 3 1 1 Breakpoint releases Occasionally a software release will introduce a change to the object model that means the way specific functionality is configured in XML also changes for example an attribute may have been deprecated and a replacement attribute should be used instead A release where such an change has been made and existing configurations will need modifying are termed Breakpoint software releases Breakpoint releases are special as they are able to automatically update an existing configuration used with the previous software release so that it is compatible with the new release and functionality is retained where ever possible When using the Internet based upgrade process the FB6000 will always upgrade to the next available breakpoint version first so that the configuration is updated appropriately If your current software versio
24. da Seabee E uyeeddt eds nds 119 EI VOP Elements vi A A 120 G56 carrier Ati DULES sisiane e ten sevas tes Seh dnee dua eRh bag bates av cued ot Su bdwou sa eaaseateua tes teed festa 120 G57 telephone Attributes di ete 121 G38 tone Ati DUTIES RN pa ESER 122 6 39 ringeroup AtribUles ctas Sek ev iacenss cence eee eee aaa e ii enue ose aden eR ES 122 G 60 autoloadtype Type of s w auto load ooocooocnnccnnccnncnnncnnccnnconnconncconccnnconnconncnnncnnnrnnrcnnroninano 123 G 61 config access Type of access user has to config ooccocccnccnnccnnccnnccnncnnnconnconnconaconocnnccnircnicnnn 123 6 62 user level User losin level semen n e hese tbsp o Senate ile AS S 124 G 63 syslog severity Syslog Severity 2 0 eee ee cence ence ee T E A seca eeee NAE ENEE 124 G64 syslog facilitys Syslog facility cons snexsesesg spon ueden ss weedasadeecaws awed doe pavegdenahova dasa E E N 124 G 65 month Month name 3 letter 2 0 cece cece cece ee cece ee ne eee eee e nee eee eens nec e eee ee nea n En Ee ee EE EE EEE 125 G66 day Day Dame 3 letter A pp oud deat yawmecs shoes gia phltwanas shinee NEEE EAE EEES NEE 125 G 67 radiuspriority Options for controlling platform RADIUS response priority tagging 04 126 G 68 radiustype Type of RADIUS server serront vedenn ee eani eener ne 126 G69 port Physical port cc iaa di e ii tt laa 126 G 70 Crossover Crossover Configuration sss re a Eo EE AE SEERE EESE e pean 126 G 71 L
25. hierarchy ooocoooccnocnnccnnccnnocnncnnncnnnonnconnconnccnnccnnccnnoos 12 3 4 2 1 Configuration categories cece cece ence cece ceca cena ceneeneeeeeeeeeeeeeeeeeeaeeaaes 12 3 4 22 Object SCHINGS erson eee vented ri Uri De Vath daa es ri 13 3 4 3 Navigating around the User Interface ocoooccnoccncconocnnccnnncnncnnnrcnorcnccnnconnccnnccnnioos 15 3 4 4 Backing up restoring the configuration oocoocccoccnncnnccnnconnconnconncnnnccnnconnconnconiconoss 16 3 5 Configuration using XML oir nee 16 3 521 Introduction to XML sess eer e rr matty aos radiata rajas 16 3 5 2 The root element lt cOnfig gt oieri ceo ceee eee ce ceca cece cena EEEE EEEE E EEEE 17 3 5 3 Viewing or editing XML oss s cess ig cvetasass seboesoveceeadeneccasguacosesessusvaadsbevsacsaseoedaneeee 17 3 5 4 Example XML configuration 0 cece cece cece ce eece ence eeceeeceeecaeseaesea sean eee eeneeees 17 3 6 Downloading Uploading the configuration ocoocconccnccnnconnconnconnconnconnconncnnncnnronronccnncinncinns 19 3 6 1 DOWnlOdd neseni oyini re teva ses Se a di ote ase ele 19 3 02 A A 19 4 System Administration ii seais 20 4 1 User Managment ensisi red tibia diaria aora dicto baa E patria 20 ALL Eogin level ui A a A eas 20 4 1 2 Configuration access level sssrini sinees rre uine EE EE EEEE PESE RS RSE T ERIS ENST 21 4 1 3 Login idle timeout inisio ap ES EEE onde cos Mac eden ag Duchess KEE EEE EREE EESE iaa 21 414 Restrictme User l
26. in the FB6000 series e FB6102 High capacity ping monitoring box e FB6202 Gigabit L2TP LNS with detailed monitoring of all lines e FB6302 Gigabit BGP router e FB6402 Gigabit stateful firewall e FB6502 Gigabit core VoIP SIP switch for ISTP use FB6602 Mobile GTPv1 GGSN L2TP gateway 1 2 About this Manual 1 2 1 Version Every major FB6000 software release is accompanied by a release specific version of this manual This manual documents software version V1 27 001 please refer to Section 4 3 to find out more about software releases and to see how to identify which software version your FB6000 is currently running If your FB6000 is running a different version of system software then please consult the version of this manual that documents that specific version as there may be significant differences between the software versions Also bear in mind that if you are not reading the latest version of the manual and using the latest software release references in this manual to external resources such as the FireBrick website may be out of date www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Introduction You can find the latest revision of a manual for a specific software version on the FB6000 software downloads website http www firebrick co uk software php PRODUCT 6000 This includes the revision history for all software releases 1 2 2 Intended audience This manual is intended
27. internal type as it has to match ours The exact elements that apply are defined in the XML XSD documentation for your software release 14 2 4 Peer type The type attribute controls some of the behaviour of the session and some of the default settings as follows Table 14 1 Peer types Type Meaning normal Normal mode no special treatment Follows normal BGP rules transit Used when talking to a transit provider or a peer that provides more than just their own routes Peers only with different AS The community no export is added to imported routes unless explicitly de tagged peer Used when talking to a peer providing only their own routes Peers only with different AS The community no export is added to imported routes unless explicitly de tagged allow only their as defaults to true customer Used when talking to customers routers expecting transit feed and providing their own routes Peers only with different AS allow only their as defaults to true allow export defaults to true The community no export is added to exported routes unless explicitly de tagged internal For IBGP links Peers only with same AS allow own as defaults to true 68 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 BGP reflector For IBGP links that are a route reflector Route reflector rules apply Peers only with same AS allow own as defaults to true confederate For EBGP that is pa
28. log message e mail addresses as to be expected you must specify a target e mail address using the to attribute You can optionally specify a From address by setting the from atttribute or you can allow the FB6000 to create an address based on the unit s serial number outgoing mail server the FB6000 normally sends e mail directly to the Mail eXchanger MX host for the domain but you can optionally specify an outgoing mail server smart host to use instead by setting the server attribute SMTP port number the FB6000 defaults to using TCP port 25 to perform the SMTP mail transfer but if necessary you can set the port attribute to specify which port number to use retry delay if an attempt to send the e mail fails the FB6000 will wait before re trying the default wait period is 10 minutes but you can change this by setting the ret ry attribute An example of a simple log target with e mailing is available in a factory reset configuration the associated XML is shown below from which you can see that in many cases you only need to specify the to attribute the comment attribute is an optional general comment field lt log name fb support comment Log target for sending logs to FireBrick support team gt lt email to crashlog firebrick 1td uk comment Crash logs emailed to FireBrick Support team gt 30 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Event Loggin
29. need to perform an HTTP GET of the following URL http lt FB6000 IP address or DNS name gt config config An example of doing this using cur 1 run on a Linux box is shown below curl http lt FB6000 IP address or DNS name gt config config user username password output filename Replace username and password with appropriate credentials The XML configuration file will be stored in the file specified by filename you can choose any file extension you wish or none at all but we suggest that you use xm1 for consistency with the file extension used when saving a configuration via the User Interface see Section 3 4 4 3 6 2 Upload To upload the configuration to the FB6000 you need to send the configuration XML file as if posted by a web form using encoding MIME type multi part form data An example of doing this using cur 1 run on a Linux box is shown below curl http lt FB6000 IP address or DNS name gt config config user username password form config ft filename 19 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 4 System Administration 4 1 User Management You will have created your first user as part of the initial setup of your FB6000 as detailed in either the QuickStart Guide or in Chapter 2 in this manual To create edit or delete users browse to the config pages by clicking the Edit item in the sub men
30. on a Linux box is shown below cuni silent no buffer user name pass http 1 2 3 4 pcap interface LAN amp timeout 300 amp snaplen 1500 usr sbin tcpdump r n v Note Linebreaks are shown in the example for clarity only they must not be entered on the command line In this example we have used username name and password pass to log in to a FireBrick on address 1 2 3 4 obviously you would change the IP address or host name and credentials to something suitable for your FB6000 We have asked for a dump of the interface named LAN with a 5 minute timeout and capturing 1500 byte packets We have then fed the output in real time hence specifying no buf fer on the curl command to tcpdump and asked it to take capture data from the standard input stream via the r options We have additionally asked for no DNS resolution n and verbose output v Consult the documentation provided with the client e g Linux box system for details on the extensive range of tcpdump options these can be used to filter the dump to better locate the packets you are interested in 54 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 12 VRRP The FB6000 supports VRRP Virtual Router Redundancy Protocol which is a system that provides routing redundancy by enabling more than one hardware device on a network to act as a gateway for routing traffic Hardware redundancy mean
31. password can be specified and are used to validate the credentials of the incoming call An incoming carrier will usually relate to a specific extn which is what is called when a call comes in You can leave this unset and route based on called ddi or you can set the extn including X characters in place of the digits sent with the call as the dialled number These are taken from the right have end of the dialled 60 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 VoIP number so if 0134567890 is what was called 1XX would be extn 190 This makes it easy to define a trunk carrier for incoming calls You do not have to configure VoIP carriers for outgoing call routing as this can be specified in RADIUS call routing replies from your RADIUS authentication server Configuring specific carriers allows more fine tuned controls such as limiting concurrent calls etc and you can reference a configured carrier in the RADIUS call routing reply 13 8 Hunt groups Hunt groups are normally provided by sending details of multiple endpoints on the RADIUS call routing response It is also possible to configure local hunt groups on the FB6000 as a standard PABX function 13 9 Call pickup steal Call pickup steal is not normally used with a voice carrier service as it is more of a PABX feature It is disabled by default but can be enabled on hunt groups and telephone configuration if required It allows a rin
32. prefixes to be announced as path Optional AS path to be used as if we had received this prefix from another AS with this path localpref Applicable localpref to announce bgp The bgp mode one of the well known community tags or true the default which is announced by BGP with no extra tags 14 2 9 lt route gt lt subnet gt and other elements Subnet and route elements used for normal set up of internal routing can be announced by BGP using the bgp attribute with the same values as the well known community tags please true meaning simply announce with no tags and false meaning the same as no advertise Many other objects in the configuration which can cause routes to be inserted have a bgp attribute which can be set to control whether the routes are announced or not 70 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 BGP 14 2 10 Route feasibility testing The FB6000 has an aggressive route feasibility test that confirms not only routability of each next hop but also that it is answering ARP ND requests Whenever a next hop is infeasible then all routes using that next hop are removed When it becomes feasible the routes are re applied This goes beyond the normal BGP specification and minimises any risk of announcing a black hole route 14 2 11 Diagnostics The web control pages have diagnostics allowing routing to be show either for a specific target IP finding the most specif
33. specified G 2 38 profile date Test passes if within any of the time ranges specified Time range test in profiles Table G 50 profile date Attributes Attribute Type Default Description comment string Comment start dateTime Start YY Y Y MM DDTHH MM SS stop dateTime End Y YY Y MM DDTHH MM SS 117 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects G 2 39 profile time Test passes if within any of the date time ranges specified Time range test in profiles Table G 51 profile time Attributes Attribute Type Default Description comment string Comment days Set of day Which days of week apply default all start time Start HH MM SS stop time End HH MM SS G 2 40 profile ping Test passes if any addresses are pingable Ping targets Table G 52 profile ping Attributes Attribute Type Default Description flow unsignedShort Flow label IPv6 gateway IPAddr Ping via specific gateway bypasses session tracking if set ip IPAddr Not optional Target IP source ip IPAddr Source IP ttl unsignedB yte Time to live Hop limit G 2 41 ip group IP Group Named IP group Table G 53 ip group Attributes Attribute Type Default Description comment string Comment ip List of IPRange One o
34. that affect the automatic software upgrade process Table 4 4 Attributes controlling auto upgrades Attribute Description sw update Controls what types of software releases the auto upgrade process will download install This attribute can also be used to disable the auto upgrade process use the value of false to achieve this false Disables auto upgrades factory Only download install factory releases this is the default if the attribute is not specified beta Download install factory or beta releases alpha Download install factory beta or alpha releases sw update profile Specifies the name of a profile to use to control when software upgrades are attempted see Chapter 8 for details on profiles The current setting of sw update in descriptive form can be seen on the main Status page adjacent to the word Upgrade as shown in Figure 4 2 in that example sw update is set to or is defaulting to factory 4 3 4 Manual upgrade This method is entirely manual in the sense that the brick itself does not download new software from the FireBrick servers and responsibilty for loading breakpoint releases as required lies with the user 25 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration In order to do this you will first need to download the required software image file which has the file extension img from the FB6000 soft
35. that interval For each named graph the FB6000 stores data for the last 24 hours Note Specifying a graph does not itself cause any traffic shaping to occur but is a pre requisite to specifying how the associated traffic flow should be shaped 44 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Traffic Shaping 9 1 2 Shapers Once you have graphed a possibly bi directional traffic flow you can then also define speed restrictions on those flows These can be simple Tx and Rx speed limits or more complex settings allowing maximum average speeds over time You define the speed controls associated with the graphed traffic flow s by creating a shaper top level object To create or edit a shaper object in the web User Interface first click on the Shape category icon To create a new object click the Add link To edit an existing object click the appropriate Edit link instead The shaper object specifies the parameters primarily traffic rates to use in the traffic shaping process and the shaper is associated with the appropriate existing graph by specifying the name attribute of the shaper object to be the same as the name of the graph 9 1 3 Ad hoc shapers You can define a shaper object and set the speed controls for that shaper and then define the graph attribute on something e g an interface to apply that shaper to the interface It is also possible in most cases to s
36. the exact address used within this range depends on a number of factors generally you should look for an IP address allocation against any of the addresses in the range Alternatively if the range specification doesn t include a hyphen it specifies that all addresses in the range start with this prefix the first address in the range will have zero for all the remaining digits and the last address in the range will have F for all the remaining digits For example 75 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 MAC Addresses usage 000397 147C is interpreted as e All addresses in the range start with 00 03 97 14 7C e the first address in the range has zero for the remaining digits 00 e the last address in the range has F for the remaining digits FF Therefore this range spans 00 03 97 14 7C 00 to 00 03 97 14 7C FF inclusive 256 addresses If your DHCP server shows the name of the client FB6000 that issued the DHCP request then you will see a value that depends on whether the system name is set on the FB6000 as shown in Table B 1 Refer to Section 4 2 1 for details on setting the system name Table B 1 DHCP client names used System name Client name used not set e g factory reset configuration FB6000 set Main application software running If the FB6000 s system name is set and your DHCP server shows client names then this is likely to be the preferre
37. top and bottom B Defines a number of pixels to be provided on the bottom of the graph Time axes is show based on space at top and bottom Y Defines Y bandwidth scale starting point 0 is lowest 1 is next etc y Defines Y ms scale max level in ms I Defines colour for graticule Defines colour for axis lines Defines colour for background within axis Defines colour for background outside axis lt a Defines colour for writing text F 3 Overnight archiving The system is designed to make it easy to archive all graphs or png xml etc files over night The graphs hold 1000 data points which is 27 hours 46 minutes This means you can access a full day s data for the previous day in the first 3 hours 46 minutes of the new day 2 hours 46 or 4 hours 46 when clocks change in previous day As such it is recommended that over night archiving is done of the previous day just after midnight The recommended command to run just after midnight is wget m http host port cqm date F z as this will create a directory for the server cqm date and z and then the files The use of z clears text off the graphs to make them clean F 3 1 Full URL format The full URL format allows several variations These are mainly to allow sensible directory structures in overnight archiving 91 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Constant Quality Monitor
38. ttl security 1 causes a TTL of 1 on outgoing packets This simulates the behaviour of some other routers in IBGP mode Using 2 3 etc will simulate the behaviour of such routers in EBGP multi hop mode This is non standard as RFCs recommend a much higher TTL and BGP does not require TTLs to be set differently Without ttl security set or set to 0 the RFC recommended default TTL us used on all sent packets and not checked on received packets 71 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 15 Command Line Interface The FB6000 provides a traditional command line interface CLI environment that can be used to check status information and control some aspects of the unit s operation The CLI is accessed via the telnet protocol the FB6000 implements a telnet server which you can connect to using any common telnet client program To learn how to enable the telnet server and to set up access restrictions please refer to Section 10 4 The CLI is also available via the serial interface on the rear of the unit This is normally set to 9k600 1N8 A USB serial lead is supplied Note The CLI is not normally used to change the configuration of the unit that must be done via the web interface Whilst most commands can be carried out via the web interface there are a few that can only be performed via the CLI The CLI has the following features e full line editing capabi
39. variant of a string type that does not allow spaces If you include spaces then they are removed automatically This helps avoid any problems referencing names in other places especially where the reference may be a space separated list Many objects have a graph attribute This allows a graph name to be specified However the actual graph name will be normalised to avoide spaces and limit the number of characters Try to keep graph names as basic characters letters numbers to avoid confusion 3 3 Configuration Methods The configuration objects are created and manipulated by the user via one of two configuration methods e web based graphical User Interface accessed using a supported web browser e an XML eXtensible Markup Language file representing the entire object hierarchy editable via the web interface or can be uploaded to the FB6000 The two methods operate on the same underlying object model and so it is possible to readily move between the two methods changes made via the User Interface will be visible as changes to the XML and vice versa Users may choose to start out using the User Interface and as experience with the object model and the XML language develops increasingly make changes in the XML environment For information on using XML to configure the FB6000 please refer to Section 3 5 3 4 Web User Interface Overview This section provides an overview of how to use the web based User Interface We recommend that
40. 000 Usage below which fail is not expected fblogo Colour bd 1220 Colour for logo graticule Colour grey Graticule colour heading string Heading of graph hourformat string H Hour format key unsignedByte 90 Pixels space for key label ave string Av Label for average latency label fail string Fail Label for seconds failed label latency string Latency Label for latency label max string Max Label for maximum latency label min string Min Label for minimum latency label off string Off Label for off line seconds label period string Period Label for period label poll string Polls Label for polls label rej string Reject Label for rejected seconds label rx string Rx Label for Rx traffic level label score string Score Label for score label sent string Sent Label for seconds polled 115 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects label time string Time Label for time label traffic string Traffic bit s Label for traffic level label tx string Tx Label for Tx traffic level latency level unsignedInt 100000000 Latency level not expected on low usage latency levell unsignedInt 100000000 Latency level ns latency level2 unsignedInt 500000000 Latency level 2 ns latency score unsignedByte 200 Score for high latency and low usage latency scorel unsignedB yte 10 Score for on above level 1 latency score2 unsignedByte
41. 121 Virtual RO terS a da a fey eR ee eat 55 12 2 Contipuring VRRP osser a a ssendertegaseeey a am pau eden Sy vuahasatweates ieela des 56 12 21 Advertisement Intervalo A Ds 56 1222 o IR 56 12 3 Usmeza virtual router vato a Ra el ia wade ee Na T 56 124 VRRP lt VersiOnS centers adi lieta pi EERE INE IEEE 56 12 41 VRRP version 2 A O AD 56 vi www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6502 User Manual 124 2 VRRP AP A 57 12 5 Compatibilty iii ia Veen uk fos ie pS 37 E RR 58 1351 W h tas VoIP Ia A did ead weet eee 58 13 2 Registration and PrOXIES yes ear Sects neon ese cows Taedel aus Ei OR E Riiie 58 BATRES STan AU A id AS 58 VA O Ae ER dat atvuane 58 13 3 Core lt call routine Wii A oe eee ee ER ores a ced 59 13 4 Network Address Translation zsrsr ersen yra R E e a EAEE EAER 59 135 Number plai a E A a E 59 13 6 Telephone handsets sssrini ne dabegaee sa weeded esencias aaa 60 1337 VOIP Call Carriers AA eco ieee E EE E E EE E ose eeetha deeded 60 O O 61 13 9 Call pick p Stella AA E dep E ece debt 61 13 10 Busy lamp field onsarniin crisi nae sa tee ini iria rapida 61 13 11 Using RADIUS Id is 61 15111 RADIUS accounting weyers orn r deeb seas er rin Disp eon deen NE vaeecepe trees 61 13 11 2 RADIUS authentication ta ds ab Rn Redes as Eee eae 62 13 11 2 1 Call routing by RADIUS 0 00 eee cee a ee eeca e TERE 62 13 12 Call recording 4 3 sec sts este ch
42. 1245 808299 Configuration Objects Table G 6 user Attributes Attribute Type Default Description allow List of Restrict logins to be from specific IP IPNameRange addresses comment string Comment config config access full Config access level full name string Full name level user level ADMIN Login level name NMTOKEN Not optional User name username otp string OTP serial number password Password Not optional User password profile NMTOKEN Profile name source string Source of data used in automated config management table unsignedByte 0 99 0 Restrict login to specific routing table routetable timeout duration 5 00 Login idle timeout zero to stay logged in G 2 4 log Log target controls Named logging target Table G 7 log Attributes Attribute Type Default Description colour Colour Colour used in web display comment string Comment console boolean Log immediately to console flash boolean Log immediately to slow flash memory use with care jtag boolean Log immediately jtag development use only name NMTOKEN Not optional Log target name profile NMTOKEN Profile name source string Source of data used in automated config management Table G 8 log Elements Element Type Instances Description email log email Optional unlimited Email settings syslog log syslog Op
43. 1245 808299 FireBrick FB6502 User Manual F3 Overmight archiving o soassevoex ssp emacs n e e a ehapetan ded pa vedanebnweanseeseer ober ssenagent ER NRE 91 E 3 1 FL URE format a li ee Muh ate dss nesed seas 91 F322 load handle condition sins cine trar id iodo 92 EA Graph COS O OIE ras 92 F 5 Creating graphs and graph names sesoses eesse einne ne a Eep O EEES IEE PAAS E pe SNEER e 92 G Configuration Objects via A ia iii 94 GA Top level x cocvosss sac ovosteestvaaheecaeb E ey vie dod Zeb dao gs E wUAd abet eee sds Soudan teeetae devon 94 G11 lt config Top level config aiii pa eee ee dee eds pees 94 E2ODJOC Sumito 94 6 2 1 System Systm set viii a dd 94 G22 Jinks Web links care iia ds 95 623 User AMIN USOS id ese eect rea A eels dal eee eae 95 E TR A i en na ye E Seaans pa wedoushy n NE EEEE e seme sees 96 G 2 5 log syslog Syslog logger settings oooconoconocnnccnnccnoccnoronocnnconnconnccnnccnnconnconicnnass 96 G 2 6 log email Email logger settings coooconoccnocnnccnnccnncnnncnnocnnccnnconnconnccnnccnnconacinicos 97 2 7 Services System SETVICES oree wed ieee hs oe is 97 G 2 8 snmp service SNMP service settings 1 0 0 0 cece cece cence cece eece ence eee eeeeeeeeeeeeeeeaees 98 G 2 9 ntp service NTP service Settings ern e a aaa r a E E AEE SSTT 98 G 2 10 telnet service Telnet service settings oooccoccnoccnccnnconnconnccnnccnnconnconncnnncnnncnnronoss 99 G 2 11 http service HTTP service set
44. 2 6 Comments and feedback c 0 5cc00 sisesscessssesscabeesteop seventies dheeSansdsevete edi vesdeneses odon 4 1 3 Additional Resources olores ire be cneds bac EE EET E EE EEEE EENS 4 13 1 Technical Support osisssa a a athate sss pit E E me batiante dotted bates 4 1 3 2 IRC Chantel onc ooh ec oka RE RAE A EA es 4 1 3 3 Application A TN 4 1 3 4 White Papers oes lt i cbese cists it leia OEE EEE EES RESSE EE EE ES 4 1 3 3 Traine COUrSeS 3 irine st bates saatiasee vat sash E E T EA pola iras 5 2s Getting Started osier eao e Ere Sask fester EES agus EEES hs dese EESE EEEE OE Gesseer ieee Ri 6 Deli IP AAATESSING EE ns O 6 2 2 Accessing the web based user interface 00 ee cece eee cee ce eee cena cen eeneeeeeeeeeeeeeeeeseaees 6 2 2 t Adda MEW USER state datos abate apra rape a a crespo DRAE 7 3s Configuration or A Eee see eee Ei 9 3 1 The Object Hierarchy ctas rin rre tess od sedanens 9 3 2 The Object Model soci isis bradicardia des 9 3 2 1 Formal definition of the object model ooooccnoccnnconccnnccnnccnnncnnconoconocnnccnnccnnccnnioos 10 3 2 2 RN 10 3 3 Configuration Methods piiris siriarren is enana EPE EERE SISE PTE E iones ie 10 3 4 Web User Interface OvervieW i6 25sseeccebsse eee cctp eves cos bec end EEE EEEIEE EEES 10 3 4 1 User Intertace layout adsl 11 3 4 1 1 Customising the layout ooocoooccnccnccnnncnncconccnnconnconnccnnconnconnconncnnncnnncnnronass 11 3 4 2 Config pages and the object
45. 20 Score for on above level 2 latency usage unsignedInt 128000 Usage below which latency is not expected left unsignedByte 0 Pixels space left of main graph log NMTOKEN Not logging Log events max Colour green Colour for maximum latency min Colour 008 Colour for minimum latency ms max positivelnteger 500 ms max height off Colour c8f Colour for off line seconds outside Colour transparent Colour for outer border rej Colour f8c Colour for off line seconds right unsignedByte 50 Pixels space right of main graph TX Colour 800 Colour for Rx traffic level secret Secret Secret for MD5 coded URLs sent Colour ff8 Colour for polled seconds subheading string Subheading of graph text Colour black Colour for text textl string Text line 1 text2 string Text line 2 text3 string Text line 3 text4 string Text line 4 timeformat string Y Yom d H Time format M S top unsignedByte 4 Pixels space at top of graph tx Colour 080 Colour for Tx traffic level G 2 37 profile Control profile General on off control profile used in various places in the config Table G 48 profile Attributes Attribute Type Default Description and List of NMTOKEN Active if all specified profiles are active as well as all other tests passing including not comment string Comment 116 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects
46. 3 1350 unsignedShort ip6list List of IPv6 addresses 1P6Addr mtu Max transmission unit 576 2000 unsignedShort vlan VLAN ID O untagged 0 4095 unsignedShort ip4rangelist List of IP4ranges IP4Range macprefixlist List of strings macprefix macprefix MAC prefix hexBinary ip4list List of IPv4 addresses IP4Addr graphname Graph name token prefixlist List of IP Prefixes IPPrefix aslist List of AS numbers unsignedIntList unsignedIntList List of integers unsignedInt communitylist List of BGP communities Community filterlist List of IP Prefix filters 1PFilter bgp prefix limit Maximum prefixes accepted on BGP session 1 10000 unsignedInt nmtokenlist List of NMTOKEN NMTOKEN iprangelist List of IPranges IPRange userlist List of user names username prefix4list List of IPv4 Prefixes 1P4Prefix portlist List of protocol port ranges PortRange protolist List of IP protocols unsignedByte routetableset Set of routetables routetable vlan nz VLAN ID 1 4095 unsignedShort dates Set of dates datenum cug CUG ID 1 32767 unsignedShort 132 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects twn id Local tunnel ID 1 20 unsignedShort ses id Local session ID 1 250 unsignedShort 133 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Index
47. 3 9 radiustype Type of RADIUS server 0 00 0 ee cee ce ence neces ceeeca essa eeea sean eeaes 126 E 3 L0 portPhysical Dorta dee eee eh et as ey 126 G 3 11 Crossover Crossover configuration coooconoccnccnnccnncnnncnnccnnconnconnconnconnconnconicnnnss 126 G 3 12 LinkSpeed Physical port speed 2 0 0 0 cece cece cee ce ence eeceeeceeeea essa essa eens eeueegs 126 G 3 13 LinkDuplex Physical port duplex setting o ocoooccoccnncnnocnnccnnccnnconnconnccnnccnncnnnoos 127 G 3 14 LinkFlow Physical port flow control setting ooooccocccnccnnconnccnncnnnconaconaconicinnos 127 G 3 15 LinkClock Physical port Gigabit clock master slave setting ooocoooccnoconoccnccnnnos 127 G 3 16 LinkLED y Yellow LED setting 2 0 0 0 eee cee cee ceeeeeeeca teen ceca sean eean cogs 127 G 3 17 LinkLED g Green LED setting irean a e E e E VEER 128 G 3 18 LinkPower PHY power saving options ooccoocccccnoccnncnnccnnccnnccnnccnnccnnconaconaconose 128 G 3 19 LinkFault Link fault type to send oooccoccnnccnnconnconnconnconocononnnonnnronncnnccnncinninnns 128 G 3 20 ramode IPv6 route announce level oooooooccnnccnnconoconccnnccnnccnnonnnccnncnnconnconnconns 128 G 3 21 dhcpv control Control for RA and DHCPV bits ooccoccccccncccncccnccnnconnccnniccnnions 129 G 3 22 bgpmode BGP announcement mode oooccnncnnccnnccnnconoconccnnconnconnccnnccnnccnnconaconicos 129 G 3 23 sfoption Source filter Option tseisean en n E E E E A EEE 12
48. 808299 Chapter 9 Traffic Shaping The FB6000 includes traffic shaping functionality that allows you to control the speed of specific traffic flows through the FB6000 The FB6000 also provides graphing functionality allowing specific traffic flows to be plotted on a graph image PNG format that the FB6000 generates Within the FB6000 traffic shaping and graphing are closely associated and this is reflected in how you configure traffic shaping in order to be able to perform traffic shaping you must first graph the traffic flow 9 1 Graphs and Shapers 9 1 1 Graphs Several objects in the FB6000 s configuration allow you to specify the name of a graph by setting the value of the graph attribute This causes the traffic flow that is associated with that object a firewall rule an interface or whatever the attribute is attached to to be recorded on a graph with the specified name For connections that have a defined state such as a PPP link the graph will also show the link state history Other information such as packet loss and latency may also be displayed depending on whether it can be provided by the type of object you are graphing For example the XML snippet below shows the graph attribute being set on an interface As soon as you have set a graph attribute and saved the configuration a new graph with the specified name will be created lt interface name LAN port LAN graph LAN gt The graph is viewab
49. 808299 VoIP 13 13 Voicemail and IVR services Voicemail is still in development The FB6000 will simply pass the call to a voicemail server via SIP This could be a local device on the network or a service provided by a carrier We will include a software package to run on a linux box that will save the recording Tip Most VoIP carriers provide voicemail 13 14 Call Data Records A Call Data Record CDR is a record that is used for charging for a call It consists of the following which are shown in a comma separated list e Start time when call connected UTC with milliseconds or if not connected then when call created Duration of ringing seconds and milliseconds Duration of call seconds and milliseconds or minus and call status if call not connected e Call Record Data Where the CDR is created based on the presence of a cui setting in the configuration the Call Record Data consists of the following fields Where RADIUS is used the Call Record Data is simply the data provided by RADIUS e Chargeable User Identiy the content of the cui setting e Dialled number e Calling Line Identity The CUI is just a string of characters It can be set on a telephone user but defaults to ddi exten or name if not set It is typically the telephone number that should pay for the call being made In a simple example of a telephone calling an external number the call comes in inbound leg and an outgoing call is made to th
50. 9 G 3 24 peertype BGP peer type seire eE E ea Di E EAA 129 G 3 25 switch Profile manual setting ooocoooccnnconocnnccnnncnnnonoronoconccnnccnnccnnccnnconncnnncos 130 G 3 26 voip format Number presentation format ocoocccoccnnccnnccnnconnconnconconacnnccnnroninnnos 130 G 3 27 uknumberformat Number formatting Option cooocccnoccnnnccnnnoccnncnnnnnccnnnnccnnccnnns 130 G 3 28 recordoption Recording Option 0 eee eee cece ce ence ence ence eeceeeceeeeaeeea seen eeaneeaes 130 G 3 29 ring group order Order Of ring 0 0 0 0 eee cece cence eee ceeeceeeeeeeeaeeeu seen sean eeneeegs 130 G 3 30 ring group type Type of ring when one call in queue eee eee eee e eee 131 GAs Basi AY POS semillero hanes sven don dae a pbarea e a des teed ARES 131 TSK dsl steered E a A NN 134 x www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 List of Figures 2 1 Initial web page in factory reset State amoran i a E E E E E E E a aa 7 2 2 Amitial Users page cat id A AAA rl es EEE E 7 2 3 Setin up A oe eoa s a ar a E ESEE E PEPON EEE SEPAN TESTE EEO AEOS NESA E EPRS 8 2 4 Configuration being stored 0 00 0 ee cee EEEE EEEE ceca EEE EEEE EAEEREN EE EEEE IKES 8 3 1 Main Menu wis irene r a a lo IU pa a E a batwah ATE aE 11 3 2 Icons Tor layout Controls visiaci orein eee E e E e E E E iSe 12 3 3 Icons for configuration Categories sscosoosssosioniioccio ninas roisse ians sE a
51. Access Accept AVP No Usage Calling Station Id 31 Replaces CLI of current call leg Called Station Id 30 Replaces Dialled number of current call leg User Name 1 Replaces the Name of the current call leg Filter Id 11 Adds a call recording email address to the current call leg Chargeable User 89 Adds a CDR record with this CUL and current CLI and Dialled attributes to Identity the current call leg SIP AOR 121 Creates a new outgoing call leg See below for formats An outgoing call leg is created for each SIP AOR entry and it can be in one of the following formats Each of this can also include a number of digits and a symbol at the start which specifies a delay before attempting to connect that outgoing leg e numberOcarrier which causes a call via a known carrier The part after the is the name of carrier in the config The Dialled number is set to the number specified and the CLI is set from the originating call e tel number which causes a call via a registered telephone The Dialled number is set to the number specified and the CLI is set from the originating call e sip uri which causes a call via a an arbitrary SIP URI The Dialled number and CLI are set from the originating call This format allows sip numberQ host and sip user passO host and also sip user pass hostumber This final version makes a call using the sip numberO host target but authenticates using user and pass Tip I
52. CLI command If a client does not request renewal of the lease before it expires the allocation entry will show expired Expired entries remain stored and are used to lease the same IP address again if the same client as identified by its MAC address requests an IP address However if a new MAC address requests an allocation and there are no available IPs excluding expired allocations in the allocation pool then the oldest expired allocation IP address is re used for the new client 6 2 2 1 Fixed Static DHCP allocations Fixed or static allocations can be achieved by creating a separate dhcp object for each such allocation and specifying the client MAC address via the mac attribute on the dhcp object The XML below shows an example of a fixed allocation note the MAC address is written without any colons and is therefore a string of twelve hexadecimal digits 48 bits This allocation also supplies DNS resolver information to the client 35 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Interfaces and Subnets lt inmbertace gt lt dhcp name laptop ip SS IS mac 0090F59E4F12 ans SSA a 81 187 96 96 log default gt lt interrace gt Tip If you are setting up a static allocation but your client has already obtained an address from your FB6000 from a pool you will need to clear the allocation and then force the client to issue another DHCP
53. D to find the device on the LAN to which the traffic is to be sent a specific IP address a gateway the packet is forwarded to another router gateway routing is then determined based on the gateway s IP address instead tunnel interface such as L2TP PPPoE or FB105 such routes are created as part of the config for the tunnels interface and relate to the specific tunnel special targets e g the FB6000 itself or to a black hole causes all traffic to be dropped These are covered in more detail in the following sections 7 2 1 Subnet routes Whenever you define a subnet or one is created dynamically e g by DHCP an associated route is automatically created for the associated prefix Packets being routed to a subnet are sent to the Ethernet interface that the subnet is associated with Traffic routed to the subnet will use ARP or ND to find the final MAC address to send the packet to In addition a subnet definition creates a very specific single IP a 32 for IPv4 or a 128 for IPv6 route for the IP address of the FB6000 itself on that subnet This is a separate loop back route which effectively internally routes traffic back into the FB6000 itself i e it never appears externally A subnet can also have a gateway specified either in the config or by DHCP or RA This gateway is just like creating a route to 0 0 0 0 0 or 0 as a specific route configuration It is mainly associated with the subnet f
54. E E S 86 E 2 14 Check access to SETVICES aeri resne E E E pee usd ee E E E E pes EEN 87 jee EI COMMANAS fess 03 0855 ASAT O E E EET A EEA EE A 87 E4 VolP Command A a EE ica 87 E3 Advanced commands to A iii 87 Bid ei Panie A geek A E A NE AEE 87 E52 Reboot it a a a a TaN aE AS TNE 87 EI IA A cidade 87 E 5 4 Make outbound command session ocococncncncncncncncncncocococononnno nono nono nono nonononcncnnnns 87 E 5 5 Show command SesslONS ocococncncncncncocnnonononononono nono no aT EEE EE ES E 88 E 5 6 Kill command Session ocococncncncncncncncnconononono nono nono nono nono no nono nnnnonnnononanonanononononos 88 EST Flash memory Ut eii 88 E 3 8 Delete block from flash is mersani kete See eves ede A NE EIS 88 E59 BOOt LOL r A E E E E A S TEI 88 ESAO Flash NO 88 F Constant Quality Monitoring technical details ooonncnnnnnccnnccnnconnconncnnnccnnconnconncnnncnnncnnrcninnnn 89 Fil Access to graphs and CSVS cococsessssusesspemecaspneeeass nh von dbs ER E E E E EEE NEE ENEE 89 Edo Lo Trusted ACCESS ii a ATO EE AAN 89 E 1 2 Dated MfOrMati On tritio 89 Fil 3 AUlthEnticated access aiii 90 E 2 Graplicdisplay Options smc nt a a 90 F2 V Data POIS A a ie 90 F227 Additional uta Cote seeks bat a a e So eae Na TA eee Sea Bag waa eta eee 90 F 2 3 Other colours and spacing 0 0 0 0 eee eee ee cee cence A e teen ceca p OEE E E EEE ENE 91 viii www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0
55. FireBrick FB6502 User Manual 3 FB6000 Versatile Network Appliance www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6502 User Manual This User Manual documents Software version V1 27 001 Copyright O 2012 2013 FireBrick Ltd www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Table of Contents Pref cio penae ar isa poe iia iris s XV T Introd ton il AA CEG a ee LT BR ee AA 1 LV Fhe EBO0000 scort 1 1 1 1 Where do Start cion ae e iia dirias 1 121 2 What Can doit n E E It Pita taria ase 1 1 1 2 1 FB6502 Gigabit core VoIP SIP switch for ISTP use 2 0 0 eect ee reece 2 1 1 3 Ethernet port Capabilities 2 2 5 3 scsescsssces cud ssectsvegecssh aga sboteeiherteeedsesscks cbveoseegasesteadeets 2 1 1 4 Product variants in the FB6000 series oocoooconoccnccnnccnnncnnccnncnnncnnconnconnccnnccnnconncinncos 2 1 2 About this Mayal sissoo a E a cottages A E A E E E ratos ERT 2 BV Version vied ir o eos A A a E tess 2 1 2 2 Intended audiences s ccesci sss csccesscsese sd Seesceugssecusugpeoen ods sere sds eessesdessovengibeosessssevearg ERE 3 1 23 Technical detallito lapa bests poke tat pide csi ct 3 1 2 4 Document Style cres ses iria lle Is rones Dette amigh as poros tee 3 1 2 5 Document CONVENLONS os cess odes see erre EE Aden ende ER ARO eds 3 1
56. GP session other than confederation or where allow export is set FFFFFF02 no advertise The route is not considered part of BGP Whilst it is applied and used for routing internally it is not announced at all or considered to have been received for the purposes of BGP FFFFFF03 local as The route is only advertised on IBGP same AS sessions FFFFFF04 no peer This tag is passed on to peers but does not have any special meaning internally 14 2 7 Bad optional path attributes The BGP specification is clear that receipt of a path attribute that we understand but is in some way wrong should cause the BGP session to be shut down This has a problem if the attribute is one that is not known to intermediate routers in the internet which means a bad content is propagated to multiple routers on the internet and they will drop their session This can cause a major problem in the internet To work around this have by default ignore bad optional partial set to true The effect is that if a path attribute we understand is wrong and it is optional and trhe router that sent it to us did not understand or check it partial bit is set we ignore the specific route rather than dropping the whole BGP session 14 2 8 lt network gt element The network element defines a prefix that is to be announced by BGP but has no internal on routing Table 14 3 Network attributes Attribute Meaning ip One or more
57. IP ranges from which service can be IPNameRange anywhere accessed comment string Comment community string public Community string local only boolean false Restrict access to locally connected Ethernet subnets only log NMTOKEN Not logging Log events log debug NMTOKEN Not logging Log debug log error NMTOKEN Log as event Log errors port unsignedShort 161 Service port profile NMTOKEN Profile name source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable G 2 9 ntp service NTP service settings The NTP settings define how the system clock is set from what servers and controls for daylight saving summer time The defaults are those that apply to the EU Table G 13 ntp service Attributes www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Attribute Type Default Description allow List of Allow from List of IP ranges from which service can be IPNameRange anywhere accessed comment string Comment local only boolean true Restrict access to locally connected Ethernet subnets only 98 Configuration Objects log NMTOKEN Not logging Log events log debug NMTOKEN Not logging Log debug log error NMTOKEN Log as event Log errors ntpserver List of IPNameAddr ntp firebrick ltd uk List of time servers IP or hostname from which time may be
58. IPNameRange reverse boolean Map reverse DNS as well source string Source of data used in automated config management ttl unsignedInt 60 Time to live G 2 14 dns block Fixed local DNS blocks DNS forwarding resolver service Table G 19 dns block Attributes Attribute Type Default Description comment string Comment name List of string Not optional Host names can use as a part of a domain profile NMTOKEN Profile name restrict List of List of IP ranges to which this is served IPNameRange source string Source of data used in automated config management ttl unsignedInt 60 Time to live 101 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects G 2 15 radius service RADIUS service definition RADIUS server and proxy definitions Table G 20 radius service Attributes Attribute Type Default Description acct port unsignedShort 1813 Accounting UDP port auth port unsignedShort 1812 Authentication UDP port authenticator boolean Require message authenticator backup ip List of IPNameAddr Target IP s or hostname for backup L2TP connection class string Class field to send comment string Comment context name string Juniper Context Name SIN502 control port unsignedShort 3799 Control UDP port CoA DM dummy ip boolean true Send dummy framed IP response log NMTOKEN Not l
59. Interrupt DoS restoration counter leave at default dos limit unsignedInt 1000 Interrupt DoS packet limit leave at default intro string Home page text location string Location description log NMTOKEN Web console Log system events log debug NMTOKEN Not logging Log system debug messages log error NMTOKEN Web Flash console Log system errors log eth NMTOKEN Web console Log Ethernet messages log eth debug NMTOKEN Not logging Log Ethernet debug log eth error NMTOKEN Web Flash console Log Ethernet errors log panic NMTOKEN Web logs Log system panic messages log stats NMTOKEN Not logging Log one second stats name string System hostname source string Source of data used in automated config management sw update autoloadtype false Load new software automatically sw update profile NMTOKEN Profile name for when to load new s w Table G 4 system Elements Element Type Instances Description link link Optional unlimited Home page links G 2 2 link Web links Links to other web pages Table G 5 link Attributes Attribute Type Default Description comment string Comment name string Link name profile NMTOKEN Profile name source string Source of data used in automated config management text string Link text url string Link address G 2 3 user Admin users User names passwords and abilities for admin users 95 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0
60. MAC However this can lead to problems in some cases 55 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 VRRP 12 2 Configuring VRRP VRRP operates within a layer 2 broadcast domain so VRRP configuration on the FB6000 comes under the scope of an interface definition As such to set up your FB6000 to participate in a Virtual Router group you need to create a vrrp object as a child object of the interface that is in the layer 2 domain where the VRRP operates 12 2 1 Advertisement Interval A master indicates that it still alive by periodically sending an advertisement multicast packet to the group members A failure to receive a multicast packet from the master router for a period longer than three times the advertisement interval timer causes the backup routers to assume that the master router is down The interval is specified in multiples of 10ms so a value of 100 represents one second The default value if not specified is one second If you set lower than one second then VRRP3 is used by default see below VRRP2 only does whole seconds and must have the same interval for all devices VRRP3 can have different intervals on different devices but typically you would set them all the same The shorter the advertisement interval the shorter the black hole period but there will be more multicast traffic in the network Note For IPv6 VRRP3 is used by default whereas for IPv4 VR
61. NS resolvers show dns 84 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Command line reference Shows current DNS resolver list and status E 2 Networking commands E 2 1 Subnets show subnets show subnet lt integer gt You can list all current subnets or details of a specific subnet This shows the same information as the web status pages for subnets E 2 2 Ping and trace ping lt IPNameAddr gt table lt routetable gt source lt IPAddr gt gateway lt IPAddr gt flow lt unsignedshort gt count lt positivelnteger gt ttl lt unsignedByte gt size lt unsignedShort gt xml lt boolean gt traceroute lt IPNameAddr gt table lt routetable gt source lt IPAddr gt gateway lt IPAddr gt flow lt unsignedShort gt count lt positivelnteger gt ttl lt unsignedByte gt size lt unsignedShort gt xml lt boolean gt This sends a series of ICMP echo requests ping to a specified destination and confirms a response is received and the round trip time For the traceroute variant the TTL Hopcount is increased by one each time to show a series of response hops There are a number of controls allowing you to fine tune what is sent Obviously you should only send from a source address that will return to the FB6000 correctly You can also ask for the results to be presented in an XML format Where possible the reve
62. P configuring service 50 Software identifying current version 24 Software upgrades breakpoint releases 24 controlling auto upgrade behaviour 25 overview 23 software release types 23 System name see Hostname System services checking access to 51 configuring 47 definition of 47 list of 47 134 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Index T Telnet service configuration 48 Time out login sessions 21 Traffic shaping overview 44 U User Interface customising layout 11 general layout 11 navigation 15 overview 10 Users creating configuring 20 login level 20 restricting logins by IP address 21 V Virtual Router Redundancy Protocol VRRP 55 virtual router definition of 55 VRRP versions 56 VLANs introduction to 77 VoIP basics 58 CDR 64 NAT 59 overview 58 registration 58 technical 65 X XML introduction to 16 XML Schema Document XSD file 10 135 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299
63. P address as listed below Table 2 3 IP addresses to access the FireBrick IPv6 IPv4 http 2001 DB8 1 http 10 0 0 1 If you used Method 3 you will need to be able to access a list of allocations made by the DHCP server in order to identify which IP address has been allocated to the FB6000 and then browse this address from your computer If your DHCP server shows the client name that was supplied in the DHCP request then you will see FB6000 in the client name field assuming a factory reset configuration if you only have one FB6000 in factory reset state on your network then it will be immediately obvious via this client name Otherwise you will need to locate the allocation by cross referring with the MAC address range used by the FB6000 you are www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Getting Started interested in if necessary refer to Appendix B to see how to determine which MAC address you are looking for in the list of allocations Once you are connected to the FB6000 you should see a page with Configuration needed prominently displayed as shown below Figure 2 1 Initial web page in factory reset state E FireBrick FB2500 Z Test Brick Configuration needed This is a factory reset configuration No usernames and passwords have been configured to access the system Please edit the configuration and add a user and password You can also e
64. RADIUS server can decide if it is to challenge it or not An Access reject with no message attribute will not sent any error to a non local IP requestor add a message to force this 13 11 2 1 Call routing by RADIUS To understand how call routing works you need to understand how call legs work A call leg is a connection to or from the FB6000 to another SIP device It could be a SIP carrier or a telephone Typically there is an incoming call leg from a carrier or a phone which needs to be authenticated and then a call routing decision is made An Access Accept response can then contain the call routing attributes This causes one or more outgoing call legs to be created These would typically be ringing telephones Once one of these legs answers the others are 62 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 VoIP cancelled and the two legs are connected together to form a call The purpose of the routing attributes is to create these outgoing call legs and to set up attributes such as CDRs and call recording Each call leg has a CLI calling number a Dialled number a display Name a number of CDR records each of which have CDR and Dialled as well and finally a number of email addresses for call recording The response attributes are processed in order Initially the last call leg is the originating call When a new outgoing leg is added that becomes the current call leg Table 13 1
65. RP2 is used by default Devices have to be using the same version IPv4 and IPv6 can co exist with one using VRRP2 and the other VRRP3 Setting the same config apart from priority on all devices ensures they have the same version 12 2 2 Priority Each device is assigned a priority which determines which device becomes the master and which devices remain as backups The working device with the highest priority becomes the master If using the real IP of the master then the master should have priority 255 Otherwise pick priorities from 1 to 254 It is usually sensible to space these out e g using 100 and 200 We suggest not setting priority 1 see profiles and test below 12 3 Using a virtual router A virtual router is used by another device simply by specifying the virtual router s virtual IP address as the gateway in a route rather than using a router s real IP address From an IP point of view the upstream device is completely unaware that the IP address is associated with a group of physical devices and will forward traffic to the virtual IP address as required exactly as it would with a single physical gateway 12 4 VRRP versions 12 4 1 VRRP version 2 VRRP version 2 works with IPv4 addresses only i e does not support IPv6 and whole second advertisement intervals only The normal interval is one second since the timeout is three times that this means the fastest a backup can take over is just over 3 seconds You shou
66. S 40 TA Routino tables cuidas A e ia 40 PDs BONING deta ees uk eb toe ind aii dede ones Sada 40 O E E E T 41 Beli OVERVIEW e n a ii 41 8 2 Crea ng editine proves isa A En 41 S82 Timing Control seese lei tirante 41 LL MOSES a a ee ada 42 A AA den servedorstunnesey ceases Sunes spuee daha E EE SEE EEAS ERS 42 9 2 2 2 Time date testa da Ue ae Ss te 42 AS ak ssesus ra gas ygas da e a Men lasd iu e aa hee Muse Sem aE sac ene 42 8 2 3 Inverting overall test result 0 0 0 0 cece cece cece cece ee E E en EAR ESS 42 8 2 4 Manual override A O 42 9 Traffic Shaping csopor rria A 44 9 1 Graphs and Shapers rren aeae suet a A ead Leauge R E E danger yeaswaa wets 44 ITE Graphs E A E E NEA E A E S 44 A NS 45 ITTIA Hoc shapers ia id Seder ae Bes seat etree 45 9 14 Tongerm Shapers variation dy vis R ene tdae aan daen dene dcegeubanens eyeahs 45 9 2 Multiple shapers annae as send it A dos eee eas 45 9 3 BASIC PIIMCIP ES sssi peoa an EEE Seabee ap vemesk dened E sudes ens See trons wet ip alar E aes 46 LOS System Services da A Nubia ae davis Sh waa S ee Nee ash aes 47 10 1 Protectine the FB 6000 isc ics tse darian a boc n cub denagoetaak Gob eadeons iues tae denise nbaetaes de 47 10 2 CommonSettin ci a A ec Matec i es 47 10 3 HTTP Server cont guration serena ere e e E R EE EE E NRE ORN AEN EESE 48 103 1 Access control tacita lores E dd 48 10 3 1 L Trusted addresses srstdi doctors init dybedaboraeh E EER nes debate oy 48 10 4 T
67. TE ACK CANCEL BYE log sip other NMTOKEN Not logged OPTIONS INFO etc log sip register NMTOKEN Not logged REGISTER max ring duration 5 00 Max time limit on call setup national string 0 National dialling prefix pabx boolean false Operate as office PABX pickup string Call pickup steal prefix radius call string Name for RADIUS server config to use call routing radius cdr string Name for RADIUS server config to use for CDRs radius challenge boolean Send RADIUS auth to get challenge response radius register string Name for RADIUS server config to use for registrations realm string FireBrick Default realm record beep boolean true Send beep at start of recording record mandatory boolean Drop call if recording fails record server string Call recording server hostname or address release string 1470 CLI release prefix security replies boolean true Don t challenge or error reply to unrecognised non local IP request source string Source of data used in automated config management 119 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects status group 403 unsignedInt 603 Hunt group response for group 403 status group 404 unsignedInt 604 Hunt group response for group 404 status group 406 unsignedInt 606 Hunt group response for group 406 status group 486 unsignedInt 600 Hunt group response for group 486 user agent string Versi
68. Ti ESEE EE PEIRES S NEOS EEES aE e 12 3 4 The Setup Category ieska r E EE EE E EEO E EAE EK EEES OES 13 33 Editins an Interface OBJECT deerant e ea o e ts E E E E T a EE ESES 14 3 6 Show hidden attributeS oscri he E EEEE EE EEE EE ES E E 14 3 72 Attribute definitions cocos e oreson iii EE EENES ETSE EESTE SEESE SPEEN TEES iii 14 3 8 Navigati n controls Leo EEVEE EEE EEA EEEE EOE EE KEE EEEIEE 15 4 1 Settna up NEW USER oras cirios nnne EE E e e a E E EE E a 20 4 2 Software upgrade available notification ooocooccoccnnccnnccnnconncnnncnnnconnconncnnnroncnnnronncnnccnnccnnccnnions 25 4 3 Manual Software Upload is sssi orii oeroceaan n sE EE ERa E I EIE a e ES eE EEES AS EaI SEs pa PESAS o 26 B 1 Product label showing MAC address range ooocooccccccnccnnconnconnconnconnccnncnnnconncnnncnnnrnnncnnronarenicnnss 75 xi www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 List of Tables 2 1 Praddresses for cOMpuUter 4 j2isssis secs dario sora vinieran Ear aria s 6 2 2 IP addresses to access the FireBrick sissies c esoe ire e EESE EEE EEE EEE 6 2 3 IP addresses to access the FireBrick vissi sssrnas iir sissesse airas enes s sa riep E PESA EN SAEPE EE ITET 6 3 1 Special character Sequences ioiii iers tnus sers voce ces reader Edna ESEE EEE RE EEEE ERANTS 17 AV User losin JeyelS ereit otn a E toi 21 4 2 Configuration access levels i sc ccesece cose eo e EE E S O S E t 21 4 3 G
69. VRRP virtual addresses This includes answering pings configurable and handling DNS traffic Other VRRP devices may not operate in the same way and so may not work in the same way if they take over from the FireBrick 57 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 13 VolP 13 1 What is VolP Voice over IP VoIP is simply a means of carrying voice telephone calls over Internet Protocol the Internet Instead of using pairs of wires to carry the signal electrically the sound is sampled and converted to a sequence of bytes This is normally what is done in the telephone exchange before the data is sent over the telephone network The key difference with VoIP is that the bytes are placed in packets typically 20ms long and these are sent via Internet Protocol Unlike the telephone network IP can cause packets to be delayed lost or even copied It is the job of the receiving end to cope with this and produce the audio again for the recipient to hear The end result is that telephone calls can be made over the Internet This can cause confusion as this is often seen simply as free calls Apart from costs for Internet traffic this is indeed true where calls do not involve the traditional telephone network and you control both ends but typically you will need to subscribe to a carrier who can route calls to and from the traditional telephone network The FB6000 s role in this it to handle
70. Z Trace OO ia A Ai A cect evade TEENA 83 E k3 Uptime A 83 E14 General Status buses 83 SA E NS 83 E 1 6 Process task usage iii a o oia is 83 O 83 Bal 8x HOS Out ii rin ASES 84 E19 See XML configuration sis nas ionn ariete dept i ctas 84 E 1 10 Load XML configuration sier ee nei E E a E sean esas RE SN 84 EEIE Show profile Status cartel iii 84 E 1 12 Enable profile control switch oooccoooccccnoccnnccnnnncnnnnncnnnccnnnnconnnncnnnccnnnnccnnccnnns 84 E 1 13 Disable profile control switch oooccoccnnccnncnnocnnccnnccnnconnccnnconnconnconncnnncnnncnnronose 84 E 1 14 Show RADIUS Servers vs ii o en 84 ETS Show DNS TESOlVeTS duela n bye IN dando 84 E 2 Networking commands r n a i na E a e Teia a pS SS 85 ESB LS SUDOES n seor A lt dins 85 E22 Ping and trace id 85 E 2 3 Show a route from the routing table oooonccoccnnccnnconnccnncnnnconeconncnnncnnanonccnncnnnss 85 E24 Last TOUS A ada 85 E225 IAS sev E E E E EE ONE EEE REEE EN 85 E 2 6 See DHCP allocations srren ai a A EE E E E E AI 86 EZ 7 Cleat DHCP allocations a e a e e NER aa e ani 86 E28 Lock DHCP allocationS oi ii e EEES ENSE 86 F 2 9 Unlock DHCP allocations synn E E EE E OYES 86 E 2 10 Name DHCP allocations receio e i i E A T A seen E iE 86 E2 1I Show ARP ND Status as a a AN E NA NESAS 86 E2 12 Show VRRP status e eie n a A ree ias adas 86 E 2 13 Send Wakezon LAN packet urscsisratictotoaiepenonasin Dong ee o ap S E R
71. access request provides the Contact URI and can be used in the reply to cause a 302 redirect response to a specified contact e An access request is sent to approve any SIP request such as REGISTER SUBSCRIBE OPTIONS etc e An access request is sent to make call routing decision for INVITE and REFER e An access request is sent to make a call routing decision when a 3xx response is received from a connection being made to a telephone Acct Terminate Cause specified the redirect code e g 301 302 Access requests are made even when the request is coming from an locally configured telephone In such cases the telephone must also pass validation against a locally configured password if present To identify such requests the User Name is the configured name or extn or ddi of the telephone user and Chargeable User Identity attribute is set based on the configured CUI Access requests are made even when from a recognised carrier In such case the carrier is validated by the FireBrick directly and then the access request made to decide call routing To identify such requests the User Name is the configured name of the carrier prefixed with an character Note In the case of a telephone user any charaters at the start of the name are removed so that it cannot be confused with a carrier Note A call can come from anywhere An unknown request from a non local IP will send a RADIUS request before challenging the requestor so that the
72. ade process is controlled by system objects attributes these are described in Section 4 3 3 2 4 2 1 System name hostname The system name also called the hostname is used in various aspects of the FB6000 s functions and so we recommend you set the hostname to something appropriate for your network The hostname is set using the name attribute 4 2 2 Administrative details The attributes shown in Table 4 3 allow you to specify general administrative details about the unit Table 4 3 General administrative details attributes Attribute Purpose comment General comment field contact Contact name intro Text that appears on the home page the home page is the first page you see after logging in to the FB6000 This text is also displayed immediately after you login to a command line session location Physical location description 22 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration 4 2 3 System level event logging control The log and log attributes control logging of events related to the operation of the system itself For details on event logging please refer to Chapter 5 and for details on the logging control attributes on system object please refer to Section 5 7 4 2 4 Home page web links The home page is the first page you see after logging in to the FB6000 or when you click the Home main menu item The home pa
73. ame VLAN standard the dominant standard being IEEE 802 1Q Such switches can seggregate physical switch ports into user defined groups with one VLAN associated with each group Switching of traffic only occurs between the physical ports in a group thus isolating each group from the others Where more than one switch is used with an uplink connection between switches VLAN tagging is used to multiplex packets from different VLANs across these single physical connections A TEEE 802 1Q VLAN tag is a small header prefixed to the normal Ethernet packet payload includes a 12 bit number range 1 4095 that identifies the tagged packet as belonging to a specific VLAN When a tagged packet arrives at another switch the tag specifies which VLAN it is in and switching to the appropriate physical port s occurs In addition to VLAN support in switches some end devices incorporate VLAN support allowing them to send and receive tagged packets from VLAN switch infrastructure and use the VLAN ID to map packets to multiple logical interfaces whilst only using a single physical interface Such VLAN support is typically present in devices that are able to be multi homed have more than one IP interface such as routers and firewalls and general purpose network capable operating systems such as Linux The FB6000 supports IEEE 802 1Q VLANs and will accept and send packets with 802 1Q VLAN tags It can therefore work with any Ethernet switch or other
74. an route to you and they tell their peers that they can route to you via that provider This only works if you have IP address space of your own that you can announce to the world unless you are an ISP then this is not commonly the case Even though IPv4 address space has already run out it is possible to obtain IPv6 PI address space and an AS number to announce your own IPv6 addresses to multiple providers for extra resilience You can use BGP purely as an internal routing protocol to ensure parts of your network know how to route to other parts of your network and can dynamically reroute via other links when necessary In most cases unless you are an ISP of somesort you are not likely to need BGP 14 2 BGP Setup 14 2 1 Overview The FB6000 series router provides BGP routing capabilities The aim of the design is to make configurationm simple for a small ISP or corporate BGP user defining key types of BGP peer with pre set rules to minimise mistakes Caution Misconfiguring BGP can have a serious impact on the Internet as a whole In most cases your transit providers will have necessary filtering in place to protect from mistakes but that is not always the case If you are an ISP and connect to peering points you can cause havoc locally or even internationally by misconfiguring your BGP Take care and get professional advice if you are unsure 14 2 2 Standards The key features supported are e Simple pre set configuration
75. and export anyway allow only their as boolean Only accept routes that are solely the peers AS allow own as boolean Allow our AS inbound as unsignedInt Peer AS capability as4 boolean true If supporting AS4 capability graceful boolean true If supporting Graceful Restart restart capability mpe ipv4 boolean true If supporting MPE for IPv4 capability mpe ipv6 boolean true If supporting MPE for IPv6 capability route boolean true If supporting Route Refresh refresh comment string Comment 112 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects drop default boolean false Ignore default route received export med unsignedInt Set MED on exported routes unless export filter sets it holdtime unsignedInt 30 Hold time ignore bad optional boolean true Ignore routes with a recognised badly partial formed optional that is flagged partial import localpref unsignedInt Set localpref on imported routes unless import filter sets it import tag List of Community List of community tags to add in addition to any import filters in soft boolean Mark received routes as soft ip List of IPAddr One or more IPs of neighbours omit to allow incoming log debug NMTOKEN Not logging Log debug max prefix unsignedInt 10000 Limit prefixes IPv4 IPv6 1 10000 bgp prefix limit md5 Secre
76. and force the profile state using the set attribute a value of t rue forces the state to Active and false forces it to Inactive You can also configure the set attribute with a value of control switch This causes the profile to be set manually based on a control switch which is not stored in the configuration itself The switch appears on the home web page allowing it to be turned on or off with one click It can also be changed from the command line You can restrict each switch to one or more specific users to define who has control of the switch This control applies even if the user has no access to make configuration changes as the switch is not part of the 42 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Profiles config The switch state is automatically stored in the dynamic peristent data along with DHCP settings etc so survives a power cycle restart Note that the value of the invert attribute is ignored when manual override is requested These fixed state profiles can be used as simple on off controls for configuration objects The following shows an example of two such profiles expressed in XML lt profile name Off set false gt lt profile name 0n set true gt lt profile name IT Support comment Allow IT support company access to server set control switch gt 43 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245
77. app is running and none of the Ethernet ports are connected to an active link partner Note that the app continues to run and the power LED will still be on solid When connected to an active link partner these flashing sequences will stop and the port LEDs will start indicating physical port status with various status indications possible controllable via the configuration see Section 6 3 27 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 5 Event Logging 5 1 Overview Many events in the operation of the FireBrick create a log entry These are a one line string of text saying what happened This could be normal events such as someone logging in to the web interface or unusual events such as a wrong password used or DHCP not being able to find any free addresses to allocate 5 1 1 Log targets A log target is a named destination initially internal to the FB6000 for log entries you can have multiple log targets set up which you can use to separate out log event messages according to some criteria for example you could log all firewalling related log events to a log target specifically for that purpose This makes it easier to locate events you are looking for and helps you keep each log target uncluttered with un related log events this is particularly important when when you are logging a lot of things very quickly A log target is defined using a 1og top level object w
78. apping and filtering rules of accepting prefixes from peer G 2 34 bgpmap Mapping and filtering rules of BGP prefixes This defines the rules for mapping and filtering of prefixes to from a BGP peer Table G 44 bgpmap Attributes Attribute Type Default Description comment string Comment detag List of Community List of community tags to remove drop boolean Do not import export this prefix localpref unsignedInt Set localpref highest wins med unsignedInt Set MED prefix List of 1PFilter Drop all that are not in this prefix list source string Source of data used in automated config management tag List of Community List of community tags to add Table G 45 bgpmap Elements Element Type Instances Description match bgprule Optional unlimited List rules in order of checking G 2 35 bgprule Individual mapping filtering rule An individual rule for BGP mapping filtering Table G 46 bgprule Attributes Attribute Type Default Description comment string Comment community Community Community that must be present to match detag List of Community List of community tags to remove drop boolean Do not import export this prefix localpref unsignedInt Set localpref highest wins med unsignedInt Set MED name string Name no community Community Community that must not be present to match pad unsignedB
79. appropriate to the version of software you are using This manual is for version V1 27 001 XV www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 1 Introduction 1 1 The FB6000 1 1 1 Where do start The FB6000 is shipped in a factory reset state This means it has a default configuration that allows the unit to be attached directly to a computer or into an existing network and is accessible via a web browser on a known IP address for further configuration Besides allowing initial web access to the unit the factory reset configuration provides a starting point for you to develop a bespoke configuration that meets your requirements A printed copy of the QuickStart Guide is included with your FB6000 and covers the basic set up required to gain access to the web based user interface If you have already followed the steps in the QuickStart guide and are able to access the FB6000 via a web browser you can begin to work with the factory reset configuration by referring to Chapter 3 Initial set up is also covered in this manual so if you have not already followed the QuickStart Guide please start at Chapter 2 Tip The FB6000 s configuration can be restored to the state 1t was in when shipped from the factory The procedure requires physical access to the FB6000 and can be applied if you have made configuration changes that have resulted in loss of access to the web user interface o
80. ary Mar March Apr April May May Jun June Jul July Aug August Sep September Oct October Nov November Dec December G 3 7 day Day name 3 letter Table G 66 day Day name 3 letter Value Description Sun Sunday Mon Monday Tue Tuesday Wed Wednesday Thu Thursday Fri Friday Sat Saturday www voipon co uk 125 sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects G 3 8 radiuspriority Options for controlling platform RADIUS response priority tagging Table G 67 radiuspriority Options for controlling platform RADIUS response priority tagging Value Description equal All the same priority strict In order specified random Random order calling Hashed on calling station id called Hashed on called station id username Hashed on full username user Hashed on username before realm Hashed on username after prefix Hashed on username initial letters and numbers only G 3 9 radiustype Type of RADIUS server Table G 68 radiustype Type of RADIUS server Value Description authentication Authentication server accounting Accounting server control Allowed to send control CoA DM G 3 10 port Physical port Table G 69 port Physical port Value Description 0 Port 0 left 1 Port 1 right G 3 11 Crossover Crossover configuration Physical po
81. ary between software releases 3 4 3 Navigating around the User Interface You navigate around the hierarchy using one or more of the following e configuration category icons e the breadcrumbs each part of the breadcrumbs delimited by the symbol is a clickable link e the in page navigation buttons shown in Figure 3 8 Up move one level up in the object hierachy Prev Previous object in a list and Next Next object in a list Figure 3 8 Navigation controls Interface interface 2 of 3 LAN Up Prev Next New Erase Help Caution The configuration pages are generated on the fly using JavaScript within your web browser environment i e client side scripting As such the browser is essentially unaware of changes to page content and cannot track these changes this means the browser s navigation buttons Back Forward will not correctly navigate through a series of configuration pages Please take care not to use the browser s Back button whilst working through configuration pages navigation between such pages must be done via the buttons provided on the page Prev Next and Up Navigating away from an object using the supported navigation controls doesn t cause any modifications to that object to be lost even if the configuration has not yet been saved back to the FB6000 All changes are initially held in memory in the web browser itself and are committed back to the FireBrick only when you
82. atus forced G 3 16 LinkLED y Yellow LED setting Table G 75 LinkLED y Yellow LED setting Value Description Duplex On when full duplex blink when half duplex and collisions detected Collision Activity Blink when Tx or Rx activity Fault On when autonegotiation mismatch Tx Blink when Tx activity Off Permanently off 127 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects On Permanently on Cycling Cycling pattern G 3 17 LinkLED g Green LED setting Table G 76 LinkLED g Green LED setting Value Description Link Activity On when link up blink when Tx or Rx activity Duplex On when full duplex blink when half duplex and collisions detected Collision Rx Blink when Rx activity Off Permanently off On Permanently on Cycling Cycling pattern G 3 18 LinkPower PHY power saving options Table G 77 LinkPower PHY power saving options Value Description none No power saving full Full power saving G 3 19 LinkFault Link fault type to send Table G 78 LinkFault Link fault type to send Value Description false No fault true Send fault off line Send offline fault 1G ane Send ANE fault 1G G 3 20 ramode IPv6 route announce level IPv6 route announcement mode and level Table G 79 ramode IP v6 route announce level
83. auto Speed setting for this port yellow LinkLED y Tx Yellow LED setting G 2 19 portdef Port grouping and naming Port grouping and naming Table G 25 portdef Attributes Attribute Type Default Description comment string Comment name NMTOKEN Not optional Name ports Set of port Not optional Physical port s profile NMTOKEN Profile name source string Source of data used in automated config management G 2 20 interface Port group VLAN interface settings The interface definition relates to a specific physical port group and VLAN It includes subnets and VRRP that apply to that interface Table G 26 interface Attributes Attribute Type Default Description comment string Comment graph token graphname Graph name link NMTOKEN Interface to which this is linked at layer 2 log NMTOKEN Not logging Log events including DHCP and related events log debug NMTOKEN Not logging Log debug 105 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects log error NMTOKEN Log as event Log errors mtu unsignedShort 1500 MTU for this interface 576 2000 mtu name NMTOKEN Name ping IPAddr Ping address to add loss latency to graph for interface port NMTOKEN Not optional Port group name profile NMTOKEN Profile name ra client boolean true Accept IPv6 RA and create auto conf
84. butes are listed in the XML XSD documentation for the software version The main ones are e A list of prefixes filters defining which prefixes to match e There will be community tag checking and AS path checking in future You can have a rule with no matching attribute which will always be applied but this is generally pointless as no later rules will be considered If you want to define defaults then set them in the top level import export object 14 2 5 2 Action attributes The actual attributes are listed in the XML XSD documentation for the software version The main ones are e Adding specific community tags e Removing specific community tags including defaults added by the peer type e Dropping the route completely e Changing the MED e Changing the localpref 69 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 BGP You can have a rule with no action attributes If matched then this means none of the actions are taken and communities localpref med etc are all unchanged 14 2 6 Well known community tags Specific well known communities are supported natively Some of these are set automatically based on peer type and can be explicitly removed using the detag action These rules are automatically checked for exporting routes unless overridden on the peer attributes Table 14 2 Communities Community Name Meaning FFFFFFO1 no export The route is not announced on any EB
85. ccess list The CQM config defines a secret which is used to authorise untrusted access using an SHA1 hash in the URL All CQM URLs are in the cqm path F 1 1 Trusted access To access a graph you simply need to request the URL that is the graph name followed by the file extension E g http host port cqm circuit png Table F 1 File types Extn Format png PNG image CSV COMMA separated values list tsv TAB separated values list txt SPACE separated values list xml XML data F 1 2 Dated information Without any date the data returned is the latest For csv it is all data points available For graph it is the last 24 to 25 hours You can display data for a specific date This only makes sense for today and during the first couple of hours of the day you can get yesterday in full The syntax is that of a date first in the form YYYY MM DD e g http host port cqm Y Y Y Y MM DD circuit png 89 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Constant Quality Monitoring technical details F 1 3 Authenticated access Authenticate access requires a prefix of a hex shal string e g http host port cqm longhexsha1 circuit png or http host port cqm longhexsha1 Y Y YY MM DD circuit png The SHA is 40 character hex of the SHA1 hash made from the graph name the date and the http secret The date is in the form Y YY Y MM DD and is today s da
86. connected devices You can also lock down access to a specific routing table and restrict the source IP addresses from which connections are accepted In the case of the web interface you can also define trusted IP addresses which are given priority access to the login page even 10 2 Common settings Most system service have common access control attributes as follows Tip You can verify whether the access control performs as intended using the diagnostic facility described in Section 11 1 Table 10 2 List of system services Attribute Function 47 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Services table If specified then the service only accepts requests connections on the specified routing table If not specified then the service works on any routing table Where the service is also a client then this specifies the routing table to use default 0 allow If specified then this is a list of ranges of IP addresses and ip group names from which connections are allowed If specified as an empty list then no access is allowed If omitted then access is allowed from everywhere Note that if Local only is specified the allow list allows access from addresses that are not local if they are in the al low list local only This normally defaults to t rue but not in all cases If true then access is only allowed from machines on IPs on the local subnet and any addresses in
87. cting as a call server outside of any NAT connected telephones can handle cases where devices are behind a simple port mapping NAT which has a timeout of at least 60 seconds It recognises REGISTER and INVITE requests that appear to be behind NAT and will treat the requester IP port as the contact rather than the stated contact in the message At RTP level it will send all audio to the same IP and port from which it is received rather than the endpoint defined in the SDP Registrations that seem to be from NAT connections will receive a null UDP packet at approximately 60 second intervals to keep the control session open on the NAT router This is not foolproof but works in most cases with simple NAT gateways including where a FireBrick is doing the NAT It obviously also works where a NAT device is doing full ALG and changing the control messages and RTP accordingly 13 5 Number plan The FB6000 is designed primarily as a core VoIP switch which means it uses real public telephone numbers A registered telephone will be assigend a DDI Direct Dial In number which can be used in call routing It also is possible to use the FB6000 in a PABX mode and allocate internal extension numbers if you wish 59 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 VoIP Note DDI Direct Dial In telephone numbers must be entered in the full international format This is a plus then the country code and area co
88. d to be associated with the optimal route to the destination IP address since it is the most specific i e it covers a smaller IP address range than any shorter matching prefix For example if you have two routes one for 10 0 1 32 27 and another for 10 0 0 0 8 which encompasses 10 0 1 32 27 then a destination IP address of 10 0 1 35 will match the longest prefix smallest address range 27 route The order in which routes are created does not normally matter as you do not usually have two routes that have the same prefix However there is an attribute of every route called the 1localpref which decides between identical routes the higher localpref being the one which applies If you have identical routes with the same localpref then one will apply you cannot rely on which one but it can in some cases mean you are bonding multiple links Tip You can show the route s that apply for a specific destination IP address or address range using the CLI command show route You can also see a list of all routes in a routing table using the CLI command show routes There is also a routing display on the Diagnostics control web pages 38 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Routing 7 2 Routing targets A route can specify various targets for the packet Table 7 1 Example route targets Target Notes an Ethernet interface locally atached subnet requires ARP or N
89. d using allow and local on1y controls as with any service If this allows access then a user can try and login However access can also be restricted on a per user basis to IP addresses and using profiles which block the login even if the passord is correct Additionally access to the HTTP server can be completely restricted to all clients under the control of a profile This can be used for example to allow access only during certain time periods 10 3 1 1 Trusted addresses Trusted addresses are those from which additional access to certain functions is available They are specified by setting the trusted attribute using address ranges or IP address group names This trusted access allows visibility of graphs without the need for a password and is mandatory for packet dump access 10 4 Telnet Server configuration The Telnet server allows standard telnet protocol clients available for most client platforms to connect to the FB6000 and access a command line interface CLI The CLI is documented in Chapter 15 and in the Appendix E 48 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Services 10 4 1 Access control Access control can be restricted in the same way as the HTTP web service including per user access restrictions Note By default the FB6000 will only allow telnet access from machines that are on one of the locally attached Ethernet subnets This default
90. d way to locate the relevant DHCP allocation in a list rather than trying to locate it by MAC address If the FB6000 is in a factory reset state then the system name will not be set and you will have to locate it by MAC address 76 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix C VLANs A primer An Ethernet Layer 2 broadcast domain consists of a group of Ethernet devices that are interconnected typically via switches such that an Ethernet broadcast packet which specifies a reserved broadcast address as the destination Ethernet address of the packet sent by one of the devices is always received by all the other devices in the group A broadcast domain defines the boundaries of a single Local Area Network When Virtual LANs VLANs are not in use a broadcast domain consist of devices such as PCs and routers physical cables switches or hubs and possibly bridges In this case creating a distinct Layer 2 broadcast domain requires a distinct set of switch hub bridge hardware not physically interconnected with switch hub bridge hardware in any other domain A network using Virtual LANs is capable of implementing multiple distinct Layer 2 broadcast domains with shared physical switch hardware The switch es used must support VLANs and this is now common in cost effective commodity Ethernet switches Inter working of VLAN switch hardware requires that all hardware support the s
91. da ase eee 108 G32 dhcp attr hex Attributes sor sess codecssteng seta dags suanaeey weds REA EE E AE NE AESA Eea 109 6 33 dhep attr s tring A ttri DULES acoso recht i bce E cuted a are ee ee 109 G 34 dhep attr nuimber Atte DUtes isos Sh vedaveseeacss spose geen seed EE E AES EEES EErEE EENS 109 G35 dhepzattrip Attributes coi ii E 110 G36 Toutes SA NN 110 G37 Network Att DUTES da A e Oo ad 110 G38 blackhole A tteiDUtes co tocaron cines Ee EEEE ER ap E EVE EEEE NEE PERSEY 111 639 loopb ck Atrib teS iii ia A E tee ieee len des 111 G40 Depi Atri butes yarn a a A a E AE AREAS 112 G41 pep Elements 0 E EN E EEE a EA E E ds 112 6 42 DEPpeer AttrIDUtES arene EEE e E NE EEA EEE N E E Sora EEEE tea 112 G43 bgppeer Elements viril A a LOR ay a Ra US 113 G 44 Depmap ATDULES iesene decile dacwesnuthes A EE condos dou eadawasyesaue dans docenas 114 G45 bepmap Elements vie nests ti teed tae ee E E RA eed tee ved ee 114 G46 Deprule Attributes cesa e or stansedyass OE nate evens eons EEE sande S PERSEE 114 GAT CGM Attributes innr dels ae ES eae adele Nees 115 GAS prote A RN 116 G49 profile Elements o nied E ea ola See Sees 117 G50 profile dates Atte Dutes ives cusecosseseuecoes E RE EEE e E R EARE EEES eaten 117 G51 profile time Attributes 0 A eee aed 118 G52 profile pings Attributes eren e a E AE RE EEE A E E NEES SA 118 G33 1P 2TOUD Attributes ii A A AA a s 118 6 34 VOD AUTIDULES sist ii Sua soe eae oh eelay sh Smads
92. ddress and port where a user can login This can be useful where a firewall policy prevents incoming access to allow someone to have access from outside e g the FireBrick support team E 5 5 Show command sessions show command sessions The FB6000 can have multiple telnet connections at the same time This lists all of the current connections E 5 6 Kill command session kin command session lt IPAddr gt You can kill a command session by IP address This is useful if you know you have left a telnet connected from somewhere else Telnet sessions usually have a timeout but this can be overridden in the configuration for each user E 5 7 Flash memory list show flash contents Lists the content of flash memory this includes various files such as software releases configuration and so on Multiple copies are usually stored allowing you to delete a later version if needed and roll back to an older version E 5 8 Delete block from flash delete config lt unsignedInt gt confirm lt string gt delete data lt unsignedInt gt confirm lt string gt delete image lt unsignedInt gt confirm lt string gt Delete a block from flash memory This cannot be undone You have to specify the correct type of block and specify confirm yes for the command to work E 5 9 Boot log show boot log lt unsignedInt gt Show log of recent boots You can specify the number of bytes of r
93. ddresses 12 hexBinary macprefix name string Name ntp List of IP4Addr From system settings NTP server profile NMTOKEN Profile name source string Source of data used in automated config management syslog List of IP4Addr Syslog server time List of IP4Addr Our IP Time server Table G 31 dhcps Elements Element Type Instances Description send dhcp attr hex Optional unlimited Additional attributes to send hex send ip dhcp attr ip Optional unlimited Additional attributes to send IP send number dhcp attr number Optional unlimited Additional attributes to send numeric send string dhcp attr string Optional unlimited Additional attributes to send string G 2 24 dhcp attr hex DHCP server attributes hex Additional DHCP server attributes hex 108 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects Table G 32 dhcp attr hex Attributes Attribute Type Default Description comment string Comment force boolean Send even if not requested 1d unsignedB yte Not optional Attribute type code name string Name value hexBinary Not optional Value vendor boolean Add as vendor specific option under option 43 G 2 25 dhcp attr string DHCP server attributes string Additional DHCP server attributes string Table G 33 dhcp attr string Attribu
94. de and number e g 441234567890 which is country code 44 for UK area code 1234 and local number 567890 In the UK you would dial this as 01234567890 Note that there is no 0 in from the of the area code when quoted in international format and definitely no 0 in such numbers 13 6 Telephone handsets A VoIP handset which supports SIP will normally work with the FB6000 Most makes of handset actually allow multiple identities on the handset so it can appear as multiple handsets to one or more phone systems but a typical installation will not normally need more than on identity per handset On the handset you will need to set a registrar and or proxy which is usually either a host name or an IP address This will need to refer to the FB6000 s address The handset will also have some form of login or username and a password Typically you would use the extension number or DDI as the username but in an office PABX you may want people s names as the user name VoIP users are normall authenticated using RADIUS to your authentication server Appendix D provides details of the RADIUS parameters It is possible to configure local telephone users as well The VoIP status page shows the active registrations from handsets Tip The log register and log register debug settings can provide a lot of information about registrations and help diagnose any problems 13 7 VoIP call carriers A VoIP carrier is a service provider that can accept outgoin
95. dit XML Click on the edit the configuration link red text which will take you to the main user interface page for managing the configuration 2 2 1 Add a new user You now need to add a new user with a password in order to gain full access to the FireBrick s user interface Click on the Users icon then click on the Add link to add a user The Users page is shown below with the Add link highlighted Figure 2 2 Initial Users page E FireBrick FB2500 aseaseeae E me E E ES Ed E EJ El Save Cancel There are unsaved changes that have not yet been sent to the FireBrick The config has been changed during your edit if you save now those changes will be replaced by yours Admin users Enter a suitable username in the Name box and enter a password passwords are mandatory as shown below Leave all other checkboxes un ticked but see the Tip below regarding the timeout setting Note Take care to enter the password carefully as the FB6000 does not prompt you for confirmation of the password www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Getting Started Figure 2 3 Setting up a new user Admin users user 1 of 1 New Erase Help User names passwords and abilities for admin users name E comment profile User name Comment Profile name password E full name E otp User password Full name OTP serial number M
96. dius IP Table G 21 radius service Elements Element Type Instances Description match radius service Optional unlimited Matching rules for specific responses match server radius server Optional unlimited RADIUS server settings G 2 16 radius service match Matching rules for RADIUS service Rules for matching incoming RADIUS requests Table G 22 radius service match Attributes Attribute Type Default Description allow List of Match source IP address of RADIUS IPNameRange request authenticator boolean Require message authenticator backup ip List of IPNameAddr Target IP s or hostname for backup L2TP connection called station id List of string One or more patterns to match called station id calling station id List of string One or more patterns to match calling station id class string Class field to send comment string Comment context name string Juniper Context Name SIN502 dummy ip boolean true Send dummy framed IP response ip List of Match target IP address of RADIUS IPNameRange request name string Name nsn conditional boolean Only send NSN settings if username is not same as calling station id nsn tunnel override unsignedByte Additional response for GGSN usage username nsn tunnel user unsignedInt Additional response for GGSN usage auth method order radiuspriority Priority tagging of endpoints sent pro
97. dpoint must be answering ARP or ND packets If not then the route using the gateway is supressed and other less specific routes may apply 39 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Routing 7 2 3 Special targets It is possible to define two special targets black hole packets routed to a black hole are silently dropped Silent refers to the lack of any ICMP response back to the sender nowhere also called Dead End packets routed to nowhere are also dropped but the FB6000 generates ICMP error responses back to the sender The blackhole and nowhere top level objects are used to specify prefixes which are routed to these special targets In the User Interface these objects can be found under the Routes category icon 7 3 Dynamic route creation deletion For data links that have an Up Down state such as L2TP or FB105 tunnels or PPP links the ability to actually send traffic to the route target will depend on the state of the link For such links you can specify route s to automatically create each time the link comes up when the link goes down these routes are removed automatically This can be useful where a link such as PPPoE is defined with a given localpref value and a separate route is defined with a lower localpref value i e less preferred and therefore acts as a fallback route if the PPPoE link drops 7 4 Routing tables The conventional ro
98. e which then includes alpha releases if your FB6000 is enabled for alpha software see Section 4 3 1 refer to Section 4 3 3 2 for details on how to configure auto upgrades 24 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration Caution Alpha releases may be unstable and so we do not generally recommend setting your FB6000 to automatically install alpha releases 4 3 3 1 Manually initiating upgrades Whenever you browse to the main Status page the FB6000 checks whether there is newer software available given the current software version in use and whether alpha releases are allowed If new software is available you will be informed of this as shown in Figure 4 2 Figure 4 2 Software upgrade available notification Upgrade This FireBrick automatically upgrades to new factory releases Software upgrade Upgrade available A FireBrick is a registered trademark of FireBrick Ltd Copyright 2009 11 FireBrick Ltd All Rights Reserved To see what new software is available click on the Upgrade available link This will take you to a page that will show Release notes that are applicable given your current software version and the latest version available On that page there is an Upgrade button which will begin the software upgrade process 4 3 3 2 Controlling automatic software updates There are two attributes on the system object see Section 4 2
99. e carrier outbound leg A CDR record is attached to the outbound leg with the telephones CUI and the corresponding CLI and dialled number used When the call connects the start time is set on the CDR At the end of the call the CDR record is written out CDR records can be logged e g syslog and send by RADIUS accounting RADIUS accounting also carries details of each call leg start interim and stop and the CDR records are contained in the final RADIUS STOP message for the call so only in one record There are more complex examples such as A calls B and B diverts to C When a call is diverted or transferred the CDR for that outbound leg is moved to the new outbound leg along with any CDR for that outbound leg This means that in this example you get two final CDRs one for A to B and one for B to C each starting when the call connected and having the same duration For a transfer e g A calls B B places on hold and calls C then B transfers call you have the same situation but the start times and duration of the two parts are not the same This stacking of CDRs is important for call billing In these examples A only expects to pay for a call to B which may even be free if an internal call But B expects to pay for the call to C because they diverted or transferred the calls A CDR can be associated with an incoming call leg this is normally set by RADIUS or by giving a carrier a cui setting This is sticky and stays with the cal
100. e different VRIDs on different VLANs At any one time one physical device is the master and is handling all the traffic sent to the virtual IP address If the master fails a backup takes over and this process is transparent to other devices which do not need to be aware of the change The members of the group communicate with each other using multicast IP packets The transparency to device failure is implemented by having group members all capable of receiving traffic addressed to the same single MAC address A special MAC address is used 00 00 5E 00 01 XX where XX is the VRID or VRRPv2 and 00 00 5E 00 02 XX for VRRPv3 The master device will reply with this MAC address when an ARP request is sent for the virtual router s IP address Since the MAC address associated with the virtual IP address does not change ARP cache entries in other devices remain valid throughout the master backup switch over and other devices are not even aware that the switch has happened apart from a short black hole period until the backup starts routing When there is a switch over the VRRP packets that are multicast are sent from this special MAC so network switches will automatically modify internal MAC forwarding tables and start switching traffic to the appropriate physical ports for the physical router that is taking up the active routing role Note You can disable the use of the special MAC if you wish and use a normal FireBrick
101. eceived by the interface To create a new interface click on the Add link to take you to a new interface defintion Select one of the defined port groups If the interface is to exist in a VLAN tick the vlan checkbox and enter the VLAN ID in the text field Editing an existing interface works similarly click the Edit link next to the interface you want to modify 33 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Interfaces and Subnets An interface object can have the following child objects e One or more subnet definition objects e Zero or more DHCP server settings objects e Zero or more Virtual Router Redundancy Protocol VRRP settings objects refer to Chapter 12 6 2 1 Defining subnets Each interface can have one or more subnets definitions associated with it The ability to specify multiple subnets on an interface can be used where it is necessary to communicate with devices on two different subnets and it is acceptable that the subnets exist in the same broadcast domain For example it may not be possible to reassign machine addresses to form a single subnet but the machines do not require firewalling from each other Note As discussed in Section 6 1 an interface is associated with a broadcast domain therefore multiple subnets existing in a single broadcast domain are not isolated at layer 2 from each other Effective firewalling at layer 3 cannot be established betwe
102. ecent log to show E 5 10 Flash log show flash log lt unsignedInt gt The logging system can log to flash for a permanent record This is done automatically for some system events and when booting You can specify the number of bytes of recent log to show 88 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix F Constant Quality Monitoring technical details The FireBrick provides constant quality monitoring The main purpose of this is to provide a graphical representation of the performance of an interface or traffic shaper e 100 second interval statistics available graphically as png and in text as csv covering at least the last 25 hours one day e Loss latency stats where available including minimum average and maximum latency for the 100 second sample and percentage packet loss e Throughput stats where available e g interfaces shapers including average tx and rx rate for 100 second sample Graphs can be loss latency or throughput of both A ping only system would only have loss latency An interface or shaper normally has only throughput data F 1 Access to graphs and csvs Graphs can be accessed by http using the normal web management interface This can be used as a direct link from a web browser or using common tools such as curl and wget The web management interface services http define the port and allowed user list and also a trusted IP a
103. ect settings harder The design is intended to work with all common VoIP handsets and carriers If you experience any difficulty with a carrier or a VoIP device please contact the FireBrick support team ideally with a full debug log 13 16 Custom tones The configuration also allows customised tones to be generated You can replace these with your own versions The format for a tone is either a single fone or a series of duration tone sections In a sequence you can use duration for a period of silence A duration is a number and then ms and a fone is a frequency or frequency frequency for mixing two tones Each frequency is a number of Hz and can have a volume suffix which is and a number if dB The tone can be followed by if you want it to be shaped rise at start and fall at end Table 13 2 Default tones Tone Plan silence 100ms progress 1000ms 1000ms 400Hz 3dB 450Hz 3dB 1000ms ring 1000ms 400ms 400Hz 3dB 450Hz 3dB 200ms 400ms 400Hz 3dB 450Hz 3dB 1000ms queue 700ms 400ms 400Hz 3dB 450Hz 3dB 200ms 400ms 400Hz 3dB 450Hz 3dB 200ms 400ms 400Hz 3dB 450Hz 3dB 700ms busy 375ms 400Hz 375ms hold 100ms 400Hz 3dB 450Hz 3dB 200ms 100ms 400Hz 3dB 450Hz 3dB 2600ms wait 2600ms 100ms 400Hz 3dB 450Hz 3dB 200ms 100ms 400Hz 3dB 450Hz 3dB close encounter 1000ms 300ms 588Hz 300ms 654Hz 400ms 524Hz 600ms 262Hz 1000ms 392Hz 1000ms bbc 50ms 345ms 122Hz 35ms 300ms 525Hz 2000ms 65 w
104. ection 13 11 2 1 for details of call routing D 2 4 Rejected authentication Table D 5 Access Reject AVP No Usage Reply Message 18 Reply message sent in SIP response The reply message is included in a Warning heading D 3 Accounting Start Table D 6 Accounting Start AVP No Usage User Name 1 SIP URI for our end of the call leg Callback ID 20 SIP URI for other end of the call leg Called Station Id 30 Dialled number as received Calling Station Id 31 Calling number as received Acct Status Type 40 1 Start Acct Session Id 44 Unique ID for call leg Acct Multi Session 50 SIP Call ID for call leg Id Acct Event 55 Time call started trying Timestamp NAS Identifier 32 Configured hostname of FireBrick NAS IP Address 4 Far end IPv4 address for SIP if using IPv4 NAS IPv6 Address 95 Far end IPv6 address for SIP if using IPv6 NAS Port 5 Far end UDP port for SIP D 4 Accounting Interim Table D 7 Accounting Interim AVP No Usage User Name 1 SIP URI for our end of the call leg Callback ID 20 SIP URI for other end of the call leg Called Station Id 30 Dialled number as received Calling Station Id 31 Calling number as received Acct Status Type 40 3 Interim Acct Session Id 44 Unique ID for session Acct Multi Session 50 SIP Call ID for call leg and second instance is Session Id of linked call Id
105. elnet Server configuration oocccoccnnccnnconnconnconeconncnnnrnnnrnnronnrnnnrnn seca eeaeeeae eeu Roa iion 48 TOA lr ACCESS COMO Lemos iris rte iria oes R ne Seabee pgeumeck deuadeueghsveassae tees 49 10 5 DNS CONSUL su sii ken isd By ee eis WUE a cass dd 49 10 5 1 Blocking DNS Names es seedevstascssniad azdgeaacueeeetbongabegd tirao Aaadaw eda ss teen dende ines 49 10 5 27 Local DNS responses Gadir A E eet are Sa 49 10 5 3 Auto DHCP DNS ccessisiseysesesighnedsapnnuecsspn sea thshh rica shar E O EERS EE E 49 10 6 NTP Conti SUTTON A sede eee eis 50 1057 SNMPcontfigtirati on tl da let inci cis 50 10 8 RADIUS configuration 2 0 0 0 ee n cece eceeecceeene cece EE EE E TEEN 50 108 1 RADIUS CHEE enian oe umask e suede cup dee E A E EEES O RESES 50 11 Network Diagnostic Tools eii e del aida 51 A A sues hoes et hace nsec hes den yaden Sera cagdub aden shout bandon eanasgs wes hash aeeiaeettes 51 11 2 Packet DUMMIES dan dos tilda 52 11 21 D mp Parameters snorre nS E EE E EE E ARSENE RNE 52 11 2 2 Security settings reg ired rg enn e e Ee E aci 53 12233 address matching esns iener TS e S ES 53 LL A Packet ty PES A A E A eds 53 122 5 Shaplen specification AAA E N R EA e SEERE EOSS 53 11 2 6 Using the web interlace cui Ai 54 11 2 7 Using an FUT PC ent irere codo nyvet cea E R E a gveseentuent hee geen eae 54 11 2 7 1 Example using curl and tcpdump oooconcccnccnnccnncnnnconocnnccnnconnccnnccnnccnncnnncos 54 A O A 55
106. en such subnets to achieve that subnets need to exist in different broadcast domains and thus be on different interfaces An example of this is seen in the factory default configuration which has two interfaces WAN and LAN allowing firewalling of the LAN from the Internet You may also have both IPv4 and IPv6 subnets on an interface where you are also using IPv6 networking The primary attributes that define a subnet are the IP address range of the subnet the IP address of the FB6000 itself on that subnet and an optional name The IP address and address range are expressed together using CIDR notation if you are not familiar with this notation please refer to Appendix A for an overview To create or edit subnets select the Interface category in the top level icons then click Edit next to the appropriate interface under the section headed IP subnet on the interface you will see the list of existing subnet child objects if any and an Add link Note In a factory reset configuration there are two temporary subnets defined on the LAN interface 2001 DB8 1 64and10 0 0 1 24 These subnet definitions provide a default IP address that the FB6000 can initially be accessed on regardless of whether the FB6000 has been able to obtain an address from an existing DHCP server on the network Once you have added new subnets to suit your requirements and tested that they work as expected these temporary definitions should be remo
107. eneral administrative details attributes ocoooccnnconoconccnnocnncnnncnnnronocnnconnconnccnnocnnccnncnnncnnncnnnes 22 4 4 Attributes controlling auto upgrades ocoooccoccnnccnncnnccnnccnnccnnccnnccnnocnncrnncnnncnnncnnnnnnrnncnncinnrinninnn 25 4 5 Power LED status Indications 22s 2 csc25 soportes va Dino prin raton AO AE a E 26 5 1 Logging attributes ita A AD Ta ea anced 29 3 2 System Event Logging attributes cirri osi serria t ses ss suiker resep EEPE POSTE EE SEPSE Enie Ep E EEP ESES 32 7 1 Example Toute targets csse iere nnee be EEA E EAEE EE EES ES EEE RE o sien utes 39 10 1 List of syStemSErVICES rinitis iris E A E E AREE 47 10 2 List Of system Servicesin aeons io anre gules EES E cs eae ecu E EEE EEVEE ETEA EEEE E 47 11 1 Packet AAPP testes ikae Eo SEEST TEESE SE EA Ron EEE SETI 52 11 2 Packet types that can be captured oooocccoccnnccnnconnconnconncnnncnnononrnnnronnrnnnrnnronnccnncrnnconncnnncnnininnss 53 13 1 Access A Cept ciae ennie e a E e rie 63 13 2 Default TONES ii A A A Aids 65 14 1 Peer types iia iris odie 68 14 2 COMMUNES 5 54 sss oka oye cir ii ii EES 70 14 3 Network attributes iiiam iiaa a a rt ones sai ri oia 70 Bel DHCP chent names Used sss iore iese aran egos ese ecb sworneseta cys cowed E S ina DTi adds E e ai 76 A s 5565 os sos oss obs cacad TE septa ast NEO PRERE AE E PORIS EE othe she Sosa eg ESPET ETEO dost erases sess 78 D2 Access Challenge coin is 79 O 79 DA ACCESS Accept sit AAA A A A
108. ents the XML elements refer to Section 3 2 1 3 5 3 Viewing or editing XML The XML representation of the configuration can be viewed and edited in text form via the web interface by clicking on XML View and XML Edit respectively under the main menu Config item Viewing the configuration is as you might expect read only and so is safe in as much as you can t accidentally change the configuration 3 5 4 Example XML configuration An example of a simple but complete XML configuration is shown below with annotations pointing out the main elements lt xml version 1 0 encoding UTF 8 gt lt config xmlns http firebrick 1ltd uk xml fb2700 xmlns xsi http www w3 org 2001 XMLSchema instance xsi schemaLocation http firebrick 1td uk xml fb2700 timestamp 2011 10 14T12 24 072 patch 8882 gt 17 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration lt system name gateway O contact Peter smith location The Basement Tog pante bs uppore gt lt system gt lt user name peter O full name Peter Smith password FB105 4D42454D2 6F 8BF5480F07DFALE41AE47410154F6 timeout PT3H20M conti ful tee eG iy lt log name default gt lt log name fb support gt lt email to crashlogltfirebrick l1td uk comment Crash logs emailed to FireBrick Support gt lt log gt lt services gt O lt ntp tim
109. equipment that also supports 802 1Q VLANs and therefore allows multiple logical interfaces to be implemented on a single physical port VLAN tagged switching is now also used in Wide Area Layer 2 Ethernet networks where a Layer 2 circuit is provided by a carrier over shared physical infrastructure The conventional concept of a LAN occupying a small geographic area is thus no longer necessarily true 77 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix D Supported RADIUS Attribute Value Pairs for VolP operation RADIUS is used to authenticate REGISTRATION requests allowing registration of telephones It is also used to authenticate INVITE requests and provide call routing information RADIUS Accounting is used to provide details of calls in progress D 1 Authentication request Authentication requests are used for SIP requests where the request is to be challenged e g REGISTER INVITE REFER SUBSCRIBE OPTIONS etc The format mostly follows RFC5090 There is an option radius challenge to send the RADIUS authentication request before receiving authentication data from the requestor which allows progress without authentication credentials but more likely to be used to send a ACCESS_ CHALLENGE response to customise the challenge sent to the requestor Table D 1 Access request AVP No Usage User Name 1 Name of locally confi
110. erface profiles are created and edited by clicking on the Profiles category icon A profile is defined by a profile top level object 8 2 1 Timing control The following timing control parameters apply e interval the interval between tests being performed e timeout the duration that the overall test must have been failing for before the profile state changes to Inactive e recover the duration that the overall test must have been passing for before the profile state changes to Active 41 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Profiles The timeout and recover parameters do not apply to manually set profiles see Section 8 2 4 and those based on time of day see Section 8 2 2 2 8 2 2 Tests 8 2 2 1 General tests General tests are provided for the following Routable addresses the route attributes lists one or more IP addresses full addresses not CIDR prefix ranges only if all the addresses are routable i e there is an entry in the routing table that will match that address will this test pass Refer to Chapter 7 for discussion of routing tables and the routing logic used by the FB6000 e VRRP state the vrrp attribute lists one or more Virtual Router group membership definitions see Chapter 12 by name if the FB6000 is not the master device in any of these Virtual Routers this test will fail If more than one of these general tests is selected c
111. eserver pool ntp org gt lt telnet log default gt Sa lt dns domain watchfront co uk resolvers 81 187 42 42 81 187 96 96 gt lt services gt lt port name WAN ports IE eS lt port name LAN ports 2 gt lt interface name WAN port WAN gt lt subnet name ADSL o Ns SS lt interface gt lt interface name LAN 6 port LANT lt subnet name LAN 1p 81 187 96 94 28 gt lt dhcp name LAN ip er 187 96 887927 log default gt lt interface gt Sois sets some general system parameters see Section 4 2 defines a single user with the highest level of access DEBUG see Section 4 1 defines a log target see Chapter 5 configures key system services see Chapter 10 defines physical port group see Section 6 1 000008 18 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration O defines an interface with one subnet and a DHCP allocation pool see Chapter 6 3 6 Downloading Uploading the configuration The XML file may be retrieved from the FireBrick or uploaded to the FireBrick using HTTP transfers done via tools such as curl Using these methods configuration of the FB6000 can be integrated with existing administrative systems Note Linebreaks are shown in the examples below for clarity only they must not be entered on the command line 3 6 1 Download To download the configuration from the FB6000 you
112. f the originating call leg is incoming and not get been connected a single SIP AOR response can be provided of the format of a 3 digit response code or 3xx uri where 3xx is the response code e g 302 and is replaced by sip and used as a Contact header in a 3xx response Redirect only works on some carriers phones and serves to redirect the incoming call away from the FB6000 13 12 Call recording The FB6000 supports call recording by teeing off the two way audio from a call leg and sending to a SIP endpoint The SIP endpoint will then record the call and handle it in any way you wish The recording is controlled by setting an email address on a call leg This can be configured for telephone users and set to automatically record incoming one outgoing only or all calls You can also set this on a hunt group to record all incoming calls to the hunt group attaching the recording to the calling leg The recording server can be any SIP endpoint such as an asterisk box A linux based call recording app is available to FireBrick customers for this purpose and some VOIP carriers may offer this as a service Tip If the SIP endpoint supports stereo a law then the recording is made in stereo with each side of the conversation on a channel The supplied call recording app makes stereo a law WAV files and can be configured to send these by email as each call ends 63 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245
113. ferent responses You can also control when responses are given using a profile e g time of day 10 5 2 Local DNS responses Instead of blocking names you can also make some names return pre defined responses This is usually only used for special cases and there is a default for my firebrick co uk which returns the FireBrick s own IP Faking DNS responses will not always work and new security measures such as DNSSEC will mean these faked responses will not be accepted 10 5 3 Auto DHCP DNS The FB6000 can also look for specific matching names and IP addresses for forward and reverse DNS that match machines on your LAN This is done by telling the FireBrick the domain for your local network Any name that is within that domain which matches a client name of a DHCP allocation that the FireBrick has made will return the IP address assigned by DHCP This is applied in reverse for reverse DNS mapping an IP address back to a name You can enable this using the auto dhcp attribute 49 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Services 10 6 NTP configuration The NTP service automatically sets the FB6000 s real time clock using time information provided by a Network Time Protocol NTP server There are public NTP servers available for use on the Internet and a factory reset configuration does not specify an NTP server which means a default of ntp firebrick ltd uk You can set yo
114. file NMTOKEN Profile name relay ip List of IPAddr Address to copy RADIUS request relay port unsignedShort 1812 Authentication UDP port for copy RADIUS request relay table unsignedByte 0 99 Routing table number for copy of RADIUS routetable request 103 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects secret Secret Shared secret for RADIUS requests needed for replies source string Source of data used in automated config management tagged boolean Tag all attributes that can be target hostname string Hostname for L2TP connection target ip List of IPNameAddr Target IP s or hostname for primary L2TP connection target secret test Secret List of IPAddr Shared secret for L2TP connection List of IPs that must have routing for this target to be valid deprecated tunnel assignment string Tunnel Assignment ID to send id tunnel client return boolean Return tunnel client as radius IP username List of string One or more patterns to match username G 2 17 radius server RADIUS server settings Server settings for outgoing RADIUS Table G 23 radius server Attributes Attribute Type Default Description comment string Comment host List of IPNameAddr Not optional One or more hostname IPs of RADIUS servers max timeout duration 20 Ma
115. format Number presentation format oooccoccnnccnnccnnccnnconnconnconncnnonnncnnnronnronccnnccnnccnncnnncos 130 G 86 uknumberformat Number formatting Option ocooocnnccnnccnnccnnccnnconnconnconncnnncnncnnnrnnncnnccnncinninnno 130 G 87 recordoption Recording Option sseesssseeseresresrrsresrrrrssrrrrsrrerrsrrerrrresrrrrerrerrsrreerereererees 130 G88 ring sroup order Order OF TNS isese eraran n r NE EA IE RS E a 130 G 89 ring group type Type of ring when one call in queue ooccooccnccnnccnnccnnccnnconnconiconaconocnncnnncnnns 131 G90 O 131 xiv www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Preface The FB6000 device is the result of several years of intensive effort to create products based on state of the art processing platforms featuring an entirely new operating system and IPv6 capable networking software written from scratch in house by the FireBrick team Custom designed hardware manufactured in the UK hosts the new software and ensures FireBrick are able to maximise performance from the hardware and maintain exceptional levels of quality and reliability The result is a product that has the feature set performance and reliability to handle mission critical functions effortlessly handling huge volumes of traffic supporting thousands of customer connections The software is constantly being improved and new features added so please check that you are reading the manual
116. formation doesn t help you and you think the attribute s may be relevant to implementing your requirements please consult the usual support channel s for advice www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration 3 2 1 Formal definition of the object model The object model has a formal definition in the form of an XML Schema Document XSD file which is itself an XML file normally intended for machine processing A more readable version of this information is available in Appendix G Note however that this is reference material containing only brief descriptions and intended for users who are familiar with the product and in particular for users configuring their units primarily via XML The XSD file is also available on the software downloads website by following the XSD link that is present against each software release 3 2 2 Common attributes Most objects have a comment attribute which is free form text that can be used for any purpose Similarly most objects have a source attribute that is intended for use by automated configuration management tools Neither of these attributes have a direct effect on the operation of the FB6000 Many objects have a name attribute which is non optional and often needs to be unique within the list of object This allows the named object to be referenced from other attributes The data type for these is typically an NMTOKEN which is a
117. g lt log gt A profile can be used to stop emails at certain times and when the email logging is back on an active profile it tries to catch up any entries still in the RAM buffer if possible 5 3 2 1 E mail process logging Since the process of e mailing can itself encounter problems it is possible to request that the process itself be logged via the usual log target mechanism This is done by specifying one or more of the log 1og debug and log error attributes Note We recommend that you avoid setting these attributes such that specify the log target containing the email object otherwise you are likely to continually receive e mails as each previous e mail process log will trigger another e mail the hold off will limit the rate of these mails though 5 4 Factory reset configuration log targets A factory reset configuration has a log target named default which only logs to RAM Provided this log target has not been deleted you can therefore simply set 1og default on any appropriate object to immediately enable logging to this default log target which can then be viewed from the web User Interface or via the CLI A factory reset configuration also has a log target named fb support which is referenced by the 1og panic attribute of the system object see Section 5 7 This allows the FireBrick to automatically email the support team if there is a panic crash you can of course change or delete this if you prefer
118. g calls and route incoming calls Typically a VoIP carrier is expecting a handset to register with the carrier and will then send calls to the registered device It is also possible for a VoIP carrier to send calls to the FB6000 using a fixed pre set configuration To set up a VoIP carrier where the FB6000 registers with the carrier you need to specify the registrar attribute This can be a host name or IP address You also need to specify the username and password For incoming calls you need to specify the extn that is logically dialled when a call comes in from this carrier this can be the extension number of a telephone or hunt group To set up a VoIP carrier for outgoing calls you need to specify the proxy This can be a host name or IP address You also need to specify the username and password You can define the carrer to use for outgoing calls on a per telephone basis and also for hunt groups where the group calls an external number You can also define a default carrier if none is otherwise specified A backup carrier can also be defined which is used if the call fails via the selected carrier For a carrier that sends calls to the FB6000 without registration you will need to set the to attribute to either the full address used in the To of the incoming connections or at least the domain part If calls can come in to multiple numbers you also need to set the incoming format so that calls can be routed In this case the username and
119. g events log error NMTOKEN log as event Log errors low priority unsignedByte 1 Lower priority applicable until routing established name NMTOKEN Name preempt boolean true Whether pre empt allowed priority unsignedByte 100 Normal priority profile NMTOKEN Profile name source string Source of data used in automated config management test List of IPAddr List of IPs to which routing must exist else low priority deprecated 107 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects use vmac boolean true Whether to use the special VMAC or use normal MAC version3 boolean v2 for IPv4 v3 for Use only version 3 IPv6 vrid unsignedByte 42 VRID G 2 23 dhcps DHCP server settings Settings for DHCP server Table G 30 dhcps Attributes Attribute Type Default Description boot IP4Addr Next boot server boot file string Boot filename class string Class match client name string Client name match comment string Comment dns List of IP4Addr Our IP DNS resolvers domain string From system settings DNS domain force boolean Send all options even if not requested gateway List of IP4Addr Our IP Gateway ip List of 1P4Range 0 0 0 0 0 Address pool lease duration 2 00 00 Lease length log NMTOKEN Not logging Log events allocations mac List up to Partial or full MAC a
120. g pages in this manual these pages are accessed by clicking on the Edit item in the sub menu under the Config main menu item Note The config pages utilise JavaScript for their main functionality you must therefore have JavaScript enabled in your web browser in order to configure your FB6000 using the web interface 3 4 1 1 Customising the layout The following aspects of the user interface layout can be customised The banner area can be reduced in height or removed all together e The main menu strip can be positioned vertically at the left or right hand sides or horizontally at the top under the banner if present Additionally you can choose to use the default fonts that are defined in your browser setup or use the fonts specified by the user interface 11 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration These customisations are controlled using three icons on the left hand side of the page footer as shown in Figure 3 2 below Figure 3 2 Icons for layout controls t A0 FireBrick is a registered trademark of FireBrick Ltd The first icon an up down arrow controls the banner size visibility and cycles through three settings full size banner reduced height banner no banner The next icon a left right arrow controls the menu strip position and cycles through three settings menu on the left menu on the right menu at the top The last
121. ge displays the system name and if defined the text specified by the int ro attribute on the system object Additionally you can define one or more web links to appear on the home page These are defined using Link objects which are child objects of the system object To make a usable link you must specify the following two attributes on the 1ink object e text the text displayed as a hyperlink e url link destination URL Additionally you can name a link specify a comment and make the presence of the link on the home page conditional on a profile 4 3 Software Upgrades FB6000 users benefit from FireBrick s pro active software development process which delivers fast fixes of important bugs and implementation of many customer enhancement requests and suggestions for improvement As a matter of policy FireBrick software upgrades are always free to download for all FireBrick customers To complement the responsive UK based development process the FB6000 is capable of downloading and installing new software directly from Firebrick s servers providing the unit has Internet access This Internet based upgrade process can be initiated manually refer to Section 4 3 3 1 or the FB6000 can download and install new software automatically without user intervention Tf the unit you want to upgrade does not have Internet access then new software can be uploaded to the unit via a web browser instead see Section 4 3 4 Caution S
122. get object has flash true It causes each log entry to be written to the internal non volatile Flash log as it is created The flash log is intended for urgent permanent system information only and is visible using the show flash log CLI command see Appendix E for details on using this command Chapter 15 covers the CLI in general Caution Flash logging slows down the system considerably only enable Flash logging where absolutely necessary The flash log does have a limit on how much it can hold but it is many thousands of entries so this is rarely an issue Oldest entries are automatically discarded when there is no space 28 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Event Logging 5 1 1 2 Logging to the Console The console is the command line environment described in Chapter 15 You can cause log entries to be displayed as soon as possible on the console assuming an active console session by setting console true on the log target You can stop the console logging with trof f command or restart it with tron command The FB6000 also has a serial console to which console log entries are sent if logged in 5 2 Enabling logging Event logging is enabled by setting one of the attributes shown in Table 5 1 on the appropriate object s in the configuration which depends on what event s you are interested in The attribute value specifies the name of the log target to send t
123. ging call to a phone or hunt group to be picked up or an active call to be stolen by dialling prefix default and the extension number Pickup and steal can be provided via RADIUS controls on a large scale voice service 13 10 Busy lamp field Call pickup steal is not normally used with a voice carrier service as it is more of a PABX feature It is disabled by default but can be configured for individual telephones and hunt groups 13 11 Using RADIUS RADIUS can be used to allow new handsets to be registered dynamically without individual configuration by using RADIUS authentication to an external RADIUS server RADIUS is also used to make call routing decisions RADIUS accounting can be used to log calls as they start and end to an external RADIUS server Tip You have to configure each of the radius functions in the VoIP config leaving the radius setting unset will disable use of RADIUS for that feature There are separate configuration settings for register call and cdr 13 11 1 RADIUS accounting RADIUS accounting logs each call leg so a typical call has an incoming and outgoing leg e A RADIUS START message is sent when the call leg is created e A RADIUS INTERIM update is sent if when the call connects i e status 200 e A RADIUS STOP message is sent when the call ends even if it did not connect An interim update includes a call duration which is the time spent ringing A final stop message contains a call durati
124. guration based on a hierarchy of objects with each object having one or more attributes An object has a type which determines its role in the operation of the FB6000 The values of the attributes determine how that object affects operation Attributes also have a type or datatype which defines the type of data that attribute specifies This in turn defines what the valid syntax is for a value of that datatype for example some are numeric some are free form strings others are strings with a specific format such as a dotted quad IP address Some examples of attribute values are e IP addresses and subnet definitions in CIDR format e g 192 168 10 0 24 e free form descriptive text strings e g a name for a firewall rule e Layer 4 protocol port numbers e g TCP ports e data rates used to control traffic shaping e enumerated values used to control a feature e g defining Ethernet port LED functions The object hierarchy can be likened to a family tree with relationships between objects referred to using terms such as Parent Child Sibling Ancestor and Descendant This tree like structure is used to e group a set of related objects such as a set of firewall rules the parent object acts as a container for a group of child objects and may also contribute to defining the detailed behaviour of the group e define a context for an object for example an object used to define a locally attached subnet is a child of an object that def
125. gured telephone user or E and locally configured carrier name Chargeable User 89 If request relates to locally configured telephone user or carrier Identity Message 80 Message signature as per RFC2869 Authenticator Called Station Id 30 Local part of To header Calling Station Id 31 Local part of From header NAS Identifier 32 Configured hostname of FireBrick NAS IP Address 4 Requestor IPv4 address if using IPv4 NAS IPv6 Address 95 Requestor IPv6 address if using IPv6 NAS Port 5 Requestor UDP port NAS Port Type 61 Send with value 5 virtual if NAT detected Class 25 User Agent string Acct Multi Session 50 Call ID from request Id Digest Response 103 Digest Response Digest Realm 104 Digest Realm Digest Nonce 105 Digest Nonce Digest Method 108 Digest Method Digest URI 109 Digest URL or URI from request if no Authorization digest present Digest QOP 110 Digest QOP Digest Algorithm 111 Digest Algorithm 78 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported RADIUS Attribute Value Pairs for VoIP operation Digest CNonce 113 Digest CNonce Digest Nonce Count 114 Digest Nonce Count NC Digest Username 115 Digest Username Digest Opaque 116 Digest Opaque SIP AOR 121 Contact URI Session Timeout 27 Time from Expires header Acct Terminate 49 Only sent for a redirect call routing the redirect code e g 301 302
126. hat the speed drops This can be automatic or using a rate of drop per hour e g tx step The rate will drop down to the defined minimum speed Once the average since bursting started drops below the target and the restrictions are lifted returning to the maximum speed If the minimum speed is below the target speed then this will happen eventually even if the link is used solidly at the maximum it is allowed If the minimum is at the target or higher then the usage will have to drop below the target for a time before the average speed drops low enough to restore full speed The overall effect of this means that you can burst up to a specified maximum but ultimately you cannot transfer more than if the target speed had been applied the whole time 9 2 Multiple shapers A packet that passes through the FB6000 can pass through multiple shapers for example 45 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Traffic Shaping The ingress interface can have a defined shaper e It is possible to create a bonded gateway route where multiple routes exist for the same target typically a default gateway and each route as a speed set which is itself a shaper This is used to control how much traffic goes via each of the bonded routes You simply create more than one route object with a speed or graph setting e The egress interface can have a defined shaper 9 3 Basic principles Each shape
127. hat type Otherwise the index is an html page explaining the options A blank graph is available by accessing simply png i e no graph name An xml list of all graphs is available as xml A csv list of graph name and score is available as csv and similarly for txt and tsv A special case exists for extracting the xml files for all graphs in one request using the name xml F 3 2 load handling The graphs and csv files are generated on the fly and only one is generated at a time Connection requests are queued As part of the normal web management system the trusted IPs queue is always processed first so constant access from untrusted sources will not stop access from trusted sources If the queue is full the connection is not accepted The most load applies when archiving but tools like wget fetch one linked file at a time which is ideal F 4 Graph scores Graphs are scored based on settings in the config Each 100 second sample has a score which is included in the csv and xml lists for any graph The score is also totalled for a graph as a whole and included in the csv and xml list of all graphs This total is done by multiplying the last score by 864 the previous by 863 and so on for the previous 24 hours F 5 Creating graphs and graph names Graph names are text and up to 20 characters Only letters numbers and are allowed All other characters are removed It is recommended that names complying with this are u
128. he fastest type of external logging is using syslog which should manage to keep up in pretty much all cases 5 3 1 Syslog The FB6000 supports sending of log entries across a network to a syslog server Syslog is described in RFC5424 http tools ietf org html rfc5424 and the FB6000 includes microsecond resolution time stamps the hostname from system settings and a module name in entries sent via syslog Syslog logging is very quick as there is no reply and syslog servers can be easily setup on most operating systems particularly Unix like systems such as Linux Note Older syslog servers will typically show time and hostname twice and will need upgrading 29 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Event Logging The module name refers to which part of the system caused the log entry and is also shown in all other types of logging such as web and console To enable log messages to be sent to a syslog server you need to create a syslog object that is a child of the log target 1og object You must then specify the DNS name or IP address of your syslog server by setting the server attribute on the syslog object You can also set the facility and or severity values using these attributes facility the facility to be used in the syslog messages when syslog entries are generated by subsystems or processes in a general purpose operating system the facility typically identifie
129. he event message to The events that cause a log entry will naturally depend on the object on which you enable logging Some objects have additional attributes such as log error for unusual events and 1og debug for extra detail Table 5 1 Logging attributes Attribute Event types log This is normal events Note that if 1og error is not set then this includes errors log error This is when things happen that should not It could be something as simple as bad login on telnet Note that if 1og error is not set but 1og is set then errors are logged to the log target by default log debug This is extra detail and is normally only used when diagnosing a problem Debug logging can be a lot of information for example in some cases whole packets are logged e g PPP It is generally best only to use debug logging when needed 5 3 Logging to external destinations Entries in the buffer can also be sent on to external destinations such as via email or syslog Support for triggering SNMP traps may be provided in a future software release You can set these differently for each log target There is inevitably a slight lag between the event happening and the log message being sent on and in some cases such as email you can deliberately delay the sending of logs to avoid getting an excessive number of emails If an external logging system cannot keep up with the rate logs are generated then log entries can be lost T
130. hen using the web User Interface these objects are in the Setup category under the heading Log target controls Every log entry is put in a buffer in RAM which only holds a certain number of log entries typically around 1MB of text once the buffer is full the oldest entries are lost as new ones arrive Since the buffer is stored in volatile memory RAM buffer contents are lost on reboot or power failure This buffer can be viewed via the web interface or command line which can show the history in the buffer and then follow the log in real time even when viewing via a web browser with some exceptions see Section 5 6 1 In some cases it is essential to ensure logged events can be viewed even after a power failure You can flag a log target to log to the non volatile Flash memory within the FB6000 where it will remain stored even after a power failure You should read Section 5 5 before deciding to log events to Flash memory Each log target has various attributes and child objects defining what happens to log entries to this target However in the simplest case where you do not require non volatile storage or external logging see Section 5 3 the log object will only need a name attribute and will have no child objects In XML this will look something like loo name tmy logi 5 1 1 1 Logging to Flash memory The internal Flash memory logging system is separate from the external logging It applies if the log tar
131. how tasks Shows internal task list This is mainly for diagnostics purposes E 1 7 Login Login Normally when you connect you are prompted for a username and password If this is incorrect you can use the login to try again 83 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Command line reference E 1 8 Logout logout Guat exit You can also use Ctrl D to exit or close the connection if using telnet E 1 9 See XML configuration show run show configuration Dumps the full XML configuration to the screen E 1 10 Load XML configuration import configuration You then send the XML configuration ending with a blank line You would not normally import a configuration using this command as you can use the web interface and tools like curl to load configtations This command is provided as a last resort for emergency use so use with care E 1 11 Show profile status show profiles Shows profiles and current status E 1 12 Enable profile control switch enable profile lt string gt Turns a named profile control switch on E 1 13 Disable profile control switch disable profile lt string gt Turns a named profile control switch off E 1 14 Show RADIUS servers show radius show radius lt IPAddr gt Shows details of RADIUS servers currently in use E 1 15 Show D
132. ic ecest A da eects 63 15 13 Voicemail and IVR services suroeste n e erp snes edey speedily E ESEI EE Y 64 13 14 Call Data Records tio IA a 64 13 45 Technical details 2s iaerousathca a en e aoe ea ten nived Sasi aey taarteeuSbeadgvedaeoareak Sees 65 13 16 Custom OESTE cado 65 M O emauge taea wos es A E ES NN 67 A I What IS BGR dia re sab esac idad A TIS 67 14 2 BGP Setup isidro denn dacete one dasdaneadenss vedi a dasetguve sas fauethenteetanedgvedaensyceters 67 LA Det A A A E E E O E A ieee dha 67 L422 Standards A O NO 67 14 2 3 Simple example Setup 2 da its 68 14 24 PEGE LY Pe ag dove n hse dae tigen sence hats Seb cnetay gua oe eb uadon EN syed twadewed AES 68 14 27 35 Route Mtr sett slate oe EA AS Se Day 69 14 25 Matching attributes e enir seer seen deep a vomee coy iden geoseeee deep eno beans 69 14 2 5 2 AchOn altri DUES vatios 69 14 2 6 Well known community tags cece eeee cece cece cena eens cen eeeeeeeeeeeeeaeeeaeeenes 70 14 2 7 Bad optional path attributes oooconocnnccnnncnncnnoconoconccnnconnccnnccnncnnncnnncnnncnnncnnronose 70 14 2 8 lt n6twork gt element corrio siento sy ste coy nee du ope Sueas O EAE paved dosh wena E 70 14 2 9 lt route gt lt subnet gt and other elements oooooococccncncncncncncnrncnnonononononononononononononos 70 14 2 10 Ronte feasibility testing sieren o Bons suetdos ge aE vedios doin 71 14 211 DIARIOS E ie 71 EA LY AN IO 71 14 2213 ETL SSC CULICY e Ia A E E I
133. ic route which applies or for a specified prefix This lists the routes that exist in order and indicates if they are supressed e g route feasibility has removed the route There are command line operation to show routing as well It is also possible using the command line to confirm what routes are imported from or exported to any peer The diagnostics also allow ping and traceroute which can be useful to confirm correct routing 14 2 12 Router shutdown One router shutdown e g for software load all established BGP sessions have all announced routes cleanly withdrawn and the session closes cleanly However all received routes are retained in the routing table until the final shutdown and restart This minimises the impact of the shutdown when operating a pair of routers as it allows all outbound traffic to continue while stopping inbound traffic 14 2 13 TTL security The FireBrick supports RFC5082 standard TTL security Simply setting ttl security 1 on the peer settings causes all of the BGP control packets to have a TTL of 255 and expects all received packets to be TTL 255 as well You can configure multiple hops as well setting ttl security 2 for example still sends TTL 255 but accepts 254 or 255 This works up to 127 You can also configure a non standard forced TTL mode by setting a negative TTL security 1 to 128 which forces a specific TTL on sending packets but does not check received packets For example setting
134. icon the letter A toggles between using browser specified or user interface specified fonts Layout settings are stored in a cookie since cookies are stored on your computer and are associated with the DNS name or IP address used to browse to the FB6000 this means that settings that apply to a particular FB6000 will automatically be recalled next time you use the same computer browser to connect to that FB6000 It is also possible to configure an external CSS to use with the FireBrick web control pages which allows a great deal of control over the overall layout and appearance This can be usful for dealers or IT support companies to set up FireBricks in a style and branding of their choice 3 4 2 Config pages and the object hierarchy The structure of the config pages mirrors the object hierachy and therefore they are themselves naturally hierachical Your postition in the hierachy is illustrated in the breadcrumbs trail at the top of the page for example Firewall mapping rules rule set 1 of 3 filters rule 7 of 19 ICMP This shows that the current page is showing a rule which exists within a rule set which in turn is in the Firewall mapping rules category see below 3 4 2 1 Configuration categories Configuration objects are grouped into a number of categories At the top of the config pages is a set of icons one for each category as shown in Figure 3 3 Figure 3 3 Icons for configuration categories
135. ig subnets and routes restrict mac boolean Use only one MAC on this interface source string Source of data used in automated config management source filter sfoption Source filter traffic received via this interface table unsignedByte 0 99 0 Routing table applicable routetable vlan unsignedShort 0 VLAN ID O untagged 0 4095 vlan Table G 27 interface Elements Element Type Instances Description dhcp dhcps Optional unlimited DHCP server settings subnet subnet Optional unlimited IP subnet on the interface virp virp Optional unlimited VRRP settings G 2 21 subnet Subnet settings Subnet settings define the IP address es of the FireBrick and also allow default routes to be set Table G 28 subnet Attributes Attribute Type Default Description accept dns boolean true Accept DNS servers specified by DHCP arp timeout unsignedShort 60 Max lifetime on ARP and ND bgp bgpmode BGP announce mode for routes broadcast boolean false If broadcast address allowed comment string Comment gateway List of IPAddr One or more gateways to install ip List of IPSubnet Automatic by DHCP One or more IP len localpref unsignedInt 4294967295 Localpref for subnet highest wins mtu unsignedShort As interface MTU for subnet 576 2000 mtu name string Name profile NMTOKEN Profile name 106 www voipon co uk sales voipo
136. ilable to all users from any IP address If you don t require such open access you may wish to restrict access using the settings described in Section 10 3 3 4 1 User Interface layout The User Interface has the following general layout e a banner area at the top of the page containing the FireBrick logo model number and system name e amain menu with sub menus that access various parts of the user interface the main menu can be shown vertically or horizontally sub menu appearance depends on this display style if the main menu is vertical sub menus are shown by expanding the menu vertically if the main menu is horizontal sub menus are shown as pull down menus a footer area at the bottom of the page containing layout control icons and showing the current software version e the remaining page area contains the content for the selected part of the user interface Figure 3 1 shows the main menu when it is set to display horizontally Note that the main menu items themselves have a specific function when clicked clicking such items displays a general page related to that item for example clicking on Status shows some overall status information whereas sub menu items under Status display specific categories of status information Figure 3 1 Main menu 3 FireBrick FB2700 Home Status Diagnostics Graphs Config Logout The user interface pages used to change the device configuration are referred to as the confi
137. imply set a speed attribute on some object This creates an un named shaper so no graph which has the specified speed for egress tx This is unique to that object unlike named shapers which are shared between all objects using the same named shaper It is also possible to set graph and speed attributes to create a named shaper with the specified speed without having to create a separate shaper object If you set a graph attribute without a speed attribute or creating a shaper object then that simply creates a graph without traffic shaping Multiple objects can share the same graph 9 1 4 Long term shapers If defining a shaper using the shaper object there are a number of extra options which allow a long term shaper to be defined A long term shaper is one that changes the actual speed applied dynamlically to ensure a long term usage level that is within a defined setting The key parameters for the long term shaper are the target speed e g tx the minimum speed e g tx min and maximum speed e g tx max The target speed is what is normally used if nothing else is set but if a min and max are set then the shaper will actually use the max speed normally However if the usage exceeds the target speed then this is considered to be bursting and this continues until the average speed since the bursting started drops below the target speed When bursting initiall a time is allowed with no change of speed e g tx min burst and after t
138. ince failed send server IPNameAddr Smart host to use rather than MX source string Source of data used in automated config management subject string From first line being Subject logged table unsignedByte 0 99 0 Routing table number for sending email routetable to string Not optional Target email address G 2 7 services System services System services are various generic services that the system provides and allows access controls and settings for these to be specified The service is only active if the corresponding element is included in services otherwise it is disabled 97 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects Table G 11 services Elements Element Type Instances Description dns dns service Optional DNS service settings http http service Optional HTTP server settings ntp ntp service Optional NTP client settings server not implemented yet radius radius service Optional RADIUS server proxy settings snmp snmp service Optional SNMP server settings telnet telnet service Optional Telnet server settings G 2 8 snmp service SNMP service settings The SNMP service has general service settings and also specific attributes for SNMP such as community Table G 12 snmp service Attributes Attribute Type Default Description allow List of Allow from List of
139. ines an interface and as such defines that the subnet is accessible on that specific interface Since multiple interfaces can exist other interface objects establish different contexts for subnet objects Additional inter object associations are established via attribute values that reference other objects typically by name e g a firewall rule can specify one of several destinations for log information to be sent when the tule is processed 3 2 The Object Model The term object model is used here to collectively refer to e the constraints that define a valid object hiearchy i e which object s are valid child objects for a given parent object how many siblings of the same type can exist etc e for each object type the allowable set of attributes whether the attributes are mandatory or optional their datatypes and permissible values of those attributes The bulk of this User Manual therefore serves to document the object model and how it controls operation of the FB6000 Tip This version of the User Manual may not yet be complete in its coverage of the full object model Some more obscure attributes may not be covered at all some of these may be attributes that are not used under any normal circumstances and used only under guidance by support personnel If you encounter attribute s that are not documented in this manual please refer in the first instance to the documentation described in Section 3 2 1 below If that in
140. ing technical details Table F 5 URL formats URL Meaning cqm All CQM URLs start with this 32 hex Optional authentication string needed for untrusted access Can be used with trusted access characters to test the authentication is right YYYY MM Optional date to restrict output Can also be in the form YY YY MM DD YY Y Y MM DD DD YYYY MM DD if preferred Can also have HH or HH on the end to get data for just one hour and HH HH or HH HH on the end for a specific range of hours Can end HH MM SS or MM MM SS for data for one hour from a specific time options Optional graph colour control options Useful when extracting a list of images as the all must have the same options as the list is just graphname png as a relative link thereby ensuring all graphs appear in this directory The options list can include separators rather amp separators to make apparent subdirectories ext The file extension can be included on the end of the options this is used only for making the index of all graphs for that type see below graphname Graph name For XML this can be just to produce one XML file with all graphs ext Extension for file type required options Options can alternatively be included as a html form get field list Where no graph name or ext are provided i e the index page of a directory then an html page is served An ext can be included after any options to make a list of files of t
141. inks peed Physical port speed mitad id amet 126 G 72 LinkDuplex Physical port duplex setting ooocccoconoconocnnccnnccnnnonoronoronncnnccnnconncnoncnnncnnncnnnoos 127 G 73 LinkFlow Physical port flow control setting oooccoccncccnccnnccnnconncconccnnconnconoconarcnccnnrcnncnnn 127 xiii www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6502 User Manual G 74 LinkClock Physical port Gigabit clock master slave setting ooocoooccnnccncconoconccnnaccnacnnicnninnn 127 G 73 EmkLED lt y Yellow LED setting ci ii do aldea cdea ies 127 G 76 EmkEED 9 Green LED Setting seres foi tonteria e E dan ebeegueedaassaees tees 128 G 77 LinkPower PHY power saving Options cece cece eee eee ceeeceeeca seca cece eeae eens eeneeeneeeeeeeenes 128 G 78 LinkFault Link fault typet6 sende h scacsse eects peek ess seve p nE e yeaa tee ARNEE TE p a E EES 128 G 79 ramode IPv6 route announce leyele eaa E T E E E EEEE E 128 G 80 dhcpv6control Control for RA and DHCPV6 bits ooocccoccnnccnnccnnconncconccnnconnconnconncnnacnncnnnconoss 129 G 81 bgpmode BGP announcement mode ooocoocnnccnnccnnconnconnccnncnnnconncnnncnnncnnnrnnrnnnronncnnccnncinnccnnions 129 6 82 sfoption Source filter Opt OM eissa e e E AA E NE ENE EREN ER R EN SE 129 6 83 peertype BGP peer types soenen an di 129 G 84 switch Profile manual Setting arriere ds eene a a a e cde e a aa 130 G 85 voip
142. iour is controlled by one or more dhcp objects which are children of an interface object Address allocations are made from a pool of addresses the pool is either explicitly defined using the ip attribute or if ip is not specified it consists of all addresses on the interface i e from all subnets but excluding network or broadcast addresses or any addresses that the FB6000 has seen ARP responses for i e addresses already in use perhaps through a static address configuration on a machine The XML below shows an example of an explicitly specified DHCP pool AINCEGEACS a5 lt gt lt dhcp name LAN ip 172 30 16 50 80 log default gt lt intertace gt Tip When specifying an explicit range of IP addresses if you start at the network then the FB6000 will allocate that address Not all devices cope with this so it is recommended that an explicit range is used e g 192 168 1 100 199 You do not however have to be careful of either the FireBrick s own addresses or subnet broadcast addresses as they are automatically excluded When using the default 0 0 0 0 0 range network addresses are also omitted as are any other addresses not within a subnet on the same interface Every allocation made by the DHCP server built in to the FB6000 is stored in non volatile memory and as such will survive power cycling and or rebooting The allocations can be seen using the DHCP item in the Status menu or using the show dhcp
143. is option allows such traffic Use with care else you dump your own dump traffic 52 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Network Diagnostic Tools 11 2 2 Security settings required The following criteria must be met in order to use the packet dump facility e You must be accessing from an IP listed as trusted in the HTTP service configuration see Section 10 3 e You must use a user and password for a DEBUG level user the user level is set with the Level attribute on the user object Note These security requirements are the most likely thing to cause your attempts to packet dump to fail If you are getting a simple 404 error response and think you have specified the correct URL if using an HTTP client please check security settings are as described here 11 2 3 IP address matching You may optionally specify upto two IP address to be checked for a match in packets on the interface s and or L2TP session s specified If you do not specify any IP addresses then all packets are returned If you specify one IP address then all packets containing that IP address as source or destination are returned If you specify two IP addresses then only those packets containing both addresses each address being either as source or destination are returned IP matching is only performed against ARP IPv4 or IPv6 headers and not in encapsulated packets or ICMP payl
144. is used since the CLI offers a degree of system control that 1s not available via the web interface for example software images stored in the on board Flash memory can be deleted via the CLI The example XML below shows the telnet service configured this way lt telnet allow V0 0 020 24 LO 20 SS LOL TOO T007 98 LO O 9950 24 comment telnet service access restricted by IP address local only false gt 10 5 DNS configuration The DNS service provides name resolution service to other tasks within the app software and can act as a relay for requests received from client machines DNS typically means converting a name like www firebrick co uk to one or more IP addresses but it can also be used for reverse DNS finding the name of an IP address DNS service is normally provided by your ISP The DNS service on the FB6000 simply relays requests to external DNS servers and caches replies You can configure a list of external DNS servers using the resolvers attribute However DNS resolvers are also learned automatically via various systems such as DHCP In most cases you do not need to set the resolvers 10 5 1 Blocking DNS names You can configure names such that the FB6000 issues an NXDOMAIN response making it appear that the domain does not exist This can be done using a wildcard e g you could block xxx Tip You can also restrict responses to certain IP addresses on your LAN making it that some devices get dif
145. isconnect A disconnect message is accepted as per RFC5176 if the session can be disconnected and ACK is sent else a NAK Table D 9 Disconnect AVP No Usage Acct Session Id 44 Unique ID for session Acct Terminate 49 SIP response code Cause 81 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Supported RADIUS Attribute Value Pairs for VoIP operation D 7 Change of Authorisation A change of authorisation message is accepted as per RFC5176 Table D 10 Change of Authorisation AVP No Usage Acct Session Id 44 Unique ID for session 82 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix E Command line reference E 1 General commands E 1 1 Trace off EOL Stop interactive logging to this CLI session lasts until logout or tron E 1 2 Trace on tron Restart interactive logging to this CLI session Some types of logging can be set to log to console which shows on the CLI E 1 3 Uptime uptime show uptime Shows how long since the FB6000 restarted E 1 4 General status show status Shows general status information including uptime who owns the FireBrick etc This is the same as the Status on the web control pages E 1 5 Memory usage show memory Shows memory usage summary E 1 6 Process task usage s
146. ither the web user interface or to the command line interface via telnet see Chapter 15 will time out after a period of inactivity This idle time out defaults to 5 minutes and can be changed by setting the timeout attribute value The time out value is specified using the syntax for the XML fb duration data type The syntax is hours minutes and seconds or minutes and seconds or just seconds E g 5 00 To set a user s time out in the user interface tick the checkbox next to timeout and enter a value in the format described above Setting a timeout to 0 means unlimited and shoudl obviously be used with care 4 1 4 Restricting user logins 4 1 4 1 Restrict by IP address You can restrict logins by a given user to be allowed only from specific IP addresses using the a11ow attribute This restriction is per user and is distinct from and applies in addition to any restrictions specified on either the web or telnet for command line interface access services see Section 10 3 and Section 10 4 or any firewall rules that affect web or telnet access to the FB6000 itself 21 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration 4 1 4 2 Logged in IP address The FireBrick allows a general definition of JP groups which allow a name to be used in place of a range of IP addresses This is a very general mechanism that can be used for single IP addresses or groups of ranges IP
147. ithhold prefix and leave display name area code string Local area code without national prefix for use from this phone carrier NMTOKEN Carrier to use for outbound calls comment string Comment ar string Chargeableuseridentity for call accounting ddi string Full telephone number international format starting display name string Text name to use email string Email address sent to call recording server expires duration 1 00 00 Registration expiry time extn string Local extension number local only boolean true Restrict access to registrations from Ethernet subnets only max calls unsignedInt Maximum simultaneous calls allowed name NMTOKEN Not optional User name local part of from 121 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects password Secret Authentication password profile NMTOKEN Profile name realm string Realm record recordoption Automatically record calls source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable uk cli text uknumberformat Auto Send display name as UK formatted number username string Authentication username wrap up duration Wrap up time before new call G 2 45 tone Tone definitions Definition of tones used Table G 58 tone Att
148. ld configure all devices in a VRRP group with the same settings apart from their priority 56 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 VRRP 12 4 2 VRRP version 3 VRRP version 3 works in much the same way but allows the advertisement interval to be any multiple of 10ms 1 100th of a second The default interval is still 1 second but it can now be set much faster so although the timeout is still 3 times the interval this means the backup could take over in as little as 30ms VRRP3 also works with IPv6 Whilst IPv4 and IPv6 VRRP are completely independent you can configure both at once in a single vrrp object by listing one or more IPv4 addresses and one or more IPv6 addresses VRRP3 is used by default for any IPv6 addresses or where an interval of below one second is selected It can also be specifically set in the config by setting the attribute version3 to the value true Caution If you have devices that are meant to work together as VRRP but one is version 2 and one is version 3 then they will typically not see each other and both become master The FB6000 s VRRP Status page shows if VRRP2 or VRRP3 is in use and whether the FireBrick is master or not 12 5 Compatibility VRRP2 and VRRP3 are standard protocols and so the FB6000 can work alongside other devices that support VRRP2 or VRRP3 Note that the FB6000 has non standard support for some specific packets sent to the
149. le directly as a PNG image from the FB6000 via the web User Interface to view a graph click the PNG item in the Graphs menu This will display all the graphs that are currently configured itis not currently possible to show a single graph within the web User Interface environment It is possible to access the graph data in many ways using the URL to control what information is shown labels and colours and also allowing graphs to be archived See Appendix F for more details Note You may find images shown for graph names that are no longer specified anywhere in the configuration Over time these graphs will disappear automatically Alternatively the underlying graph data is available in XML format again via the FB6000 s built in HTTP server The XML version of the data can be viewed in the web User Interface by clicking the XML item in the Graphs menu and then clicking on the name of the graph you re interested in Both directions of traffic flow are recorded and are colour coded on the PNG image generated by the FB6000 The directions are labelled tx and rx but the exact meaning of these will depend on what type of object the graph was referenced from for example on a graph for an interface tx will be traffic leaving the FB6000 and rx will be traffic arriving at the FB6000 Each data point on a graph corresponds to a 100 second interval where a data point is showing a traffic rate the rate is an average over
150. lect the method that you prefer or that best suits your current network architecture e Method 1 use the FireBrick s DHCP server to configure a computer If your computer is already configured as many are to get an IP address automatically you can connect your computer to port 1 on the FireBrick and the FireBrick s inbuilt DHCP server should give it an IPv4 and IPv6 address Method 2 configure a computer with a fixed IP address Alternatively you can connect a computer to port 1 on the FireBrick and manually configure your computer to have the fixed IP address es shown below Table 2 1 IP addresses for computer IPv6 IPv4 2001 DB8 2 64 10 0 0 2 subnet mask 255 255 255 0 e Method 3 use an existing DHCP server to configure the FireBrick If your LAN already has a DHCP server you can connect port 4 of your FireBrick to your LAN and it will get an address Port 4 is configured by default not to give out any addresses and as such it should not interfere with your existing network You would need to check your DHCP server to find what address has been assigend to the FB6000 2 2 Accessing the web based user interface If you used Method 1 you should browse to the FireBrick s web interface as follows or you can use the IP addresses detailed Table 2 2 IP addresses to access the FireBrick URL http my firebrick co uk If you used Method 2 you should browse to the FireBrick s I
151. ling leg and is logged when the calling leg ends even if the call did not connect Otherwise the CDR is only logged if it connects 64 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 VoIP 13 15 Technical details The FireBrick operates according to well established technical standards within specific design constraints which allow it to operate efficiently handling thousands of calls SIP 2 0 UDP control messages using IPv4 or IPv6 are supported up to approximately 1900 bytes fragmented 1f necessary The FireBrick always acts as an audio media endpoint i e it is always in the media path This minimises call routing and firewalling issues The FireBrick uses the same IP for media and control messages on each call The FireBrick always acts as a SIP protocol endpoint and not as a relaying proxy This minimises incompatibility between end devices being a party to a call as they do not see each others protocol messages Only RTP audio using a law 20ms is supported This is generally compatible with all carriers and devices and provides high quality audio Out of band DTMF is accepted using SIP INFO or RFC2833 DMTF can be sent using RFC2833 or generated a law in band audio Error responses to REGISTER INVITE from non local devices are not normally sent this is against the SIP protocols but avoids issues with port scanning systems looking for VoIP platforms This can make diagnosis of incorr
152. link Download save config that will download the current configuration in XML format 3 5 Configuration using XML 3 5 1 Introduction to XML An XML file is a text file i e contains human readable characters only with formally defined structure and content An XML file starts with the line lt xma version 1 0 encoding UTF 8 gt This defines the version of XML that the file complies with and the character encoding in use The UTF 8 character coding is used everywhere by the FireBrick The XML file contains one or more elements which may be nested into a hiearchy Note In XML the configuration objects are represented by elements so the terms object and element are used interchangeably in this manual Each element consists of some optional content bounded by two tags a start tag AND an end tag A start tag consists of the following sequence of characters e a lt character e the element name e optionally a number of attributes e a gt character An end tag consists of the following sequence of characters e a lt character e a character e the element name e a gt character 16 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration If an element needs no content it can be represented with a more compact self closing tag A self closing tag 1s the same as a start tag but ends with gt and then has no content or end tag Since the lt
153. lities that cursor keys backspace key and delete key function as expected allowing you to go back and insert delete characters You can press Enter at any point in the command line text and the full command text will be processed command history memory the CLI remembers a number of previously typed commands and these can be recalled using the Up and Down cursor keys Once you ve located the required command you can edit it if needed and then press Enter supports entering abbreviated commands you only need to type sufficient characters to make the command un ambiguous for example show dhcp and show dns can be abbreviated to sh dh and sh dn respectively show is the only command word that begins sh and two characters of the second command word are sufficient to make it un ambiguous built in command help you can list all the available commands and the CLI will also show the synopsis for each command Typing the character at the command prompt immediately displays this list you do not have to press Enter Alternatively you can list all the possible completions of a part typed command in this case typing the character after typing part of a command will list only commands that begin with the already typed characters for example typing tr causes the CLI to respond as shown below marty Cr traceroute lt IPNameAddr gt table lt routetable gt source lt IPAddr gt EOE EEOM marty Er
154. longer prefixes that are reachable by using the associated routing information This therefore provides the ability to create aggregated routing table entries For example a routing table entry with a destination of 10 1 2 0 23 specifies the address range 10 1 2 0 to 10 1 3 255 inclusive As an example it might be that in practice two 24 subnets are reachable via this 73 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 CIDR and CIDR Notation routing table entry 10 1 2 0 24 and 10 1 3 0 24 routing table entries for these subnets would appear in a downstream router Note that in either a network subnet or routing destination specification the address will be the starting address of the IP address range being expressed such that there will be M least significant bits of the address set to zero where M 32 prefix_length Combined interface IP address and subnet definitions Another common use of the CIDR notation is to combine the definition of a network with the specification of the IP address of an end system on that network this form is used in subnet definitions on the FB6000 and in many popular operating systems For example the default IPv4 subnet on the LAN interface after factory reset is 10 0 0 1 24 the address of the FB6000 on this subnet is therefore 10 0 0 1 and the prefix length is 24 bits leaving 8 bits for host addresses on the subnet The subnet address range is the
155. lso each of the external logging entries can have a profile Some types of logging will catch up when their profile comes back on e g email but most are immediate such as syslog and SMS and will drop any entries when disabled by an Inactive profile 32 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 6 Interfaces and Subnets This chapter covers the setup of Ethernet interfaces and the definition of subnets that are present on those interfaces 6 1 Relationship between Interfaces and Physical Ports The FB6000 features two Gigabit Ethernet 1Gb s ports These ports only work at gigabit speeds Each port features a green and amber LED the functions of which can be chosen from a range of options indicating link speed and or traffic activity The exact function of the ports is flexible and controlled by the configuration of the FB6000 6 1 1 Port groups As the FB6000 only has two phisical ports the port group configuration on the FB6000 has no options only two groups are possible each with the one physical interface Port group configuration is provided only for consistency and some degree of configuration file portability with the FB2500 and FB2700 products 6 1 2 Interfaces In the FB6000 an interface is a logical equivalent of a physical Ethernet interface adapter Each interface normally exists in a distinct broadcast domain and is associated with at most one port gro
156. lue Description false Don t format numbers for display true Format numbers for display with spacing replace zero Format numbers for display with spacing and replacing zeros may look clearer on some CLI devices G 3 28 recordoption Recording option Table G 87 recordoption Recording option Value Description false Don t automatically record calls in only Automatically record incoming calls out only Automatically record outgoing calls true Automatically record all calls G 3 29 ring group order Order of ring Table G 88 ring group order Order of ring Value Description strict Order in config 130 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects random Random order cyclic Cycling from last call oldest Oldest used phone first G 3 30 ring group type Type of ring when one call in queue Table G 89 ring group type Type of ring when one call in queue Value Description all All phones cascade Increasing number of phones sequence One phone at a time G 4 Basic types Table G 90 Basic data types Type Description string text string token text string hexBinary hex coded binary data integer integer 2147483648 2147483647 positiveInteger positive integer 1 4294967295 unsignedInt unsigned integer 0 4294967295
157. mands are only available when logged in as a user set with DEBUG level access E 5 1 Panic panic Estena comete steungs This causes the FB6000 to crash causing a panic event with a specified message You need to specify confirm yes for the command to work This can be useful to test fallback scenarios by simulating a fatal error Note that panic crash logs are emailed to the FireBrick support by default so please use a meaningful string e g panic testing fallback confirm yes E 5 2 Reboot reboot lt unsignedInt gt hard confirm lt string gt A reboot is a more controlled shutdown and restart unlike the panic command The first argument is a block number see show flash contents and forces reboot to run a specific software stored in flash Normally the reboot will run the latest valid code The hard option forces the reboot to clear the Ethernet ports and other hardware so takes a couple of seconds You must specify confirm yes for this to work E 5 3 Screen width set command screen width lt unsignedInt gt This allows you to set the screen width E 5 4 Make outbound command session start command session lt IPAddr gt port lt unsignedShort gt table lt routetable gt 87 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Command line reference This allows a reverse telnet connection to be made A TCP connection is made to the IP a
158. me source string Source of data used in automated config management www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 99 Configuration Objects table unsignedByte 0 99 0 routetable Routing table number G 2 11 http service HTTP service settings Web management pages Table G 15 http service Attributes Attribute Type Default Description access control string Additional header for cross site javascript allow origin allow List of Allow from List of IP ranges from which service can be IPNameRange anywhere accessed comment string Comment css url string Additional CSS for web control pages local only boolean true Restrict access to locally connected Ethernet subnets only log NMTOKEN Not logging Log events log debug NMTOKEN Not logging Log debug log error NMTOKEN Log as event Log errors port unsignedShort 80 Service port profile NMTOKEN Profile name source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable trusted List of List of allowed IP ranges from which IPNameRange additional access to certain functions is available G 2 12 dns service DNS service settings DNS forwarding resolver service Table G 16 dns service Attributes www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44
159. n co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects proxy arp boolean false Answer ARP ND by proxy if we have routing ra ramode false If to announce IPv6 RA for this subnet ra dns List of IP6Addr List of recursive DNS servers in route announcements ra managed dhcpv6control RA M managed flag ra max unsignedShort 600 Max RA send interval 4 1800 ra max ra min unsignedShort Min RA send interval 3 1350 ra min ra mtu unsignedS hort As subnet MTU to use on RA ra other dhcpv6control RA O other flag ra profile NMTOKEN Profile if inactive then forces low priority RA source string Source of data used in automated config management test IPAddr Test link state using ARP ND for this IP ttl unsignedB yte 64 TTL for originating traffic via subnet G 2 22 vrrp VRRP settings VRRP settings provide virtual router redundancy for the FireBrick Profile inactive does not disable vrrp but forces vrrp low priority Table G 29 vrrp Attributes Attribute Type Default Description answer ping boolean true Whether to answer PING to VRRP IPs when master comment string Comment delay unsignedInt 60 Delay after routing established before priority returns to normal interval unsignedShort 100 Transit interval centiseconds ip List of IPAddr Not optional One or more IP addresses to announce log NMTOKEN Not logging Lo
160. n is several breakpoint releases behind the latest version the upgrade process will be repeated for each breakpoint release and then to the latest version if that is later than the latest breakpoint release On the FB6000 software downloads website breakpoint releases are labelled Breakpoint immediately under the version number Note If you have saved copies of configurations for back up purposes always re save a copy after upgrading to a breakpoint issue If you use automated methods to configure your FB6000 check documentation to see whether those methods need updating 4 3 2 Identifying current software version The current software version is displayed on the main Status page shown when you click the Status main menu item itself 1 e not a submenu item The main software application version is shown next to the word Software e g Software mB OO Hermia Valle OF 200d AON SAO 2s 180 The software version is also displayed in the right hand side of the footer area of each web page and is shown immediately after you login to a command line session 4 3 3 Internet based upgrade process If automatic installs are allowed the FB6000 will check for new software on boot up and approximately every 24 hours thereafter your FB6000 should therefore pick up new software at most 24 hours after it is released You can choose to allow this process to install only new factory releases factory or beta releases or any releas
161. new software image proves unreliable it is demoted and the unit falls back to running older software The show flash contents CLI command can be used to see what is stored in the Flash see Appendix E 4 4 1 LED indications 4 4 1 1 Power LED status indications The green power LED has three defined states as shown in Table 4 5 below Table 4 5 Power LED status indications Indication Status Off No AC power applied to unit or possibly hardware fault Flashing with approximately 1 second period Bootloader running waiting for network connection On Main application software running After power up the normal power LED indication sequence is therefore to go through the 1 second period flashing phase and then if at least one Ethernet port is connected to an active device change to solid once the app is running From power up a FB6000 will normally boot and be operational in under five seconds 4 4 1 2 Port LEDs 26 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration Whilst the bootloader is waiting for an active Ethernet connection the green and yellow LEDs built into the physical port connectors flash in a continual left to right then right to left sequence The port LEDs on the panel on the opposite side to the physical ports also flash in a clock wise sequence Note The same port LED flashing sequences are observed if the
162. ntly dropping the packet a black hole e an IP address range that this routing information applies to the routing destination A routing table consists of one or more routes Unlike typical IP stacks the FB6000 supports multiple independent routing tables Routing destinations are expressed using CIDR notation if you are not familiar with this notation please refer to Appendix A for an overview Note that ip groups cannot be used when defining subnets or routes IP groups allow arbitrary ranges and not just prefixes but routes can only use prefixes There are two cases that deserve special attention e A routing destination may be a single IP address in which case it is a 32 in CIDR notation for IPv4 The 32 part for IPv4 or 128 for IPv6 is not shown when displaying such prefixes e A routing destination may encompass the entire IPv4 or IPv6 address space written as 0 0 0 0 0 for IPv4 or 0 for IPv6 in CIDR notation Since the prefix is zero length all destination IP addresses will match this route however it is always the shortest prefix route present and so will only match if there are no more specific routes Such routes therefore acts as a default route The decision of where to send the packet is based on matching the packet s destination IP address to one or more routing table entries If more than one entry matches then the longest most specific prefix entry is used The longest prefix is assume
163. o so may result in loss of data security issues loss of network connectivity etc 1 2 6 Comments and feedback If you d like to make any comments on this Manual point out errors make suggestions for improvement or provide any other feedback we would be pleased to hear from you via e mail at docs firebrick co uk 1 3 Additional Resources 1 3 1 Technical Support Technical support is available in the first instance via the reseller from which you purchased your FireBrick FireBrick provide extensive training and support to resellers and you will find them experts in FireBrick products However before contacting them please ensure you have e upgraded your FB6000 to the latest version of software see Section 4 3 and e are using the latest revision of the manual applicable to that software version and e have attempted to answer your query using the material in this manual Many FireBrick resellers also offer general IT support including installation configuration maintenance and training You may be able to get your reseller to develop FB6000 configurations for you although this will typically be chargeable you may well find this cost effective especially if you are new to FireBrick products If you are not satisfied with the support you are getting from your reseller please contact us http www firebrick co uk contact php 1 3 2 IRC Channel A public IRC channel is available for FireBrick discussion the IRC ser
164. oads If capturing too much some packets may be lost 11 2 4 Packet types The capture can collect different types of packets depending on where the capture is performed All of these are presented as Ethernet frames with faked Ethernet headers where the packet type is not Ethernet Table 11 2 Packet types that can be captured Type Notes Ethernet Interface based capture contains the full Ethernet frame with any VLAN tag removed IP IP only currently not possible to capture at this level An Ethernet header is faked PPP PPP from the protocol word HDLC header is ignored 1f present An Ethernet header is faked and also a PPPoE header The PPPoE header has the session PPPoE ID that is the local end L2TP session ID The faked protocol header has target MAC of 00 00 00 00 00 00 and source MAC of 00 00 00 00 00 01 for received packets and these reversed for sent packets 11 2 5 Snaplen specification The snaplen argument specifies the maximum length captured but this applies at the protocol level As such PPP packets will have up to the snaplen from the PPP protocol bytes and then have fake PPPoE and Ethernet headers added A snaplen value of O has special meaning it causes logging of just IP TCP UDP and ICMP headers as well as headers in ICMP error payloads This is primarily to avoid logging data carried by these protocols 53 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44
165. ocononocononoconanocononos 109 G 2 27 dhcp attr ip DHCP server attributes IP oooonooncnnccnnccnnccnnconnconoconoconaconacnnronoso 109 G 2 28 TOUTE Static TO tES nea r a pa o EEE E IEE EEEa EE AE E IS 110 G 2 29 network Locally originated networks ocoooconcconoconocnnocnnocnnronoconccnnconoconnccnnioos 110 G 2 30 blackhole Dead end networks oooccocccoccnnconnconnconeconoconoconaconocnnronaconccnnccnninnno 111 G 2 31 loopback Locally originated networks ocoonccncccccnnnccnncnnccnnconnconnccnncnnnconaconncos 111 G 232 bgp Overall BGP Settings sreco eenn Ea EE EE REEN seeds 112 G 2 33 bgppeer BGP peer definitions siese e a R O a EI E ETR 112 G 2 34 bgpmap Mapping and filtering rules of BGP prefixes ooocccoccnoconcconccnnocnnncnnconoso 114 G 2 35 bgprule Individual mapping filtering rule oooocccnoccnnnccnnnccnnnioconoconnnncinnnacnnninnns 114 G 2 36 cqm Constant Quality Monitoring settings oocoooccnccnnccnnnnnncnnornnccnnccnncinncconions 115 G 2 37 profile Control profile oooccconnccnnccnnnoccnnoccnnnccnnnncnnnccnnnnccnnnncnonccnnnnconnninnnncos 116 G 2 38 profile date Test passes if within any of the time ranges specified oooccconnccnncccc 117 G 2 39 profile time Test passes if within any of the date time ranges specified 118 G 2 40 profile ping Test passes if any addresses are pingable ocoooccnoncccnnccnnncccnnocnnnns 118 6 2 41 1P 2r00p IP Groups e
166. oftware upgrades are best done using the Internet based upgrade process if possible this ensures the changes introduced by Breakpoint releases are automatically accounted for see Section 4 3 1 1 Software upgrades will trigger an automatic reboot of your FB6000 this will cause an outage in routing and can cause connections that are using NAT to drop However the FB6000 reboots very quickly and in many cases users will be generally unaware of the event You can also use a profile to restrict when software upgrades may occur for example you could ensure they are always done over night The reboot will close all BGP sessions first For this reason on the FB6000 factory reset config does not have automatic s w upgrades enabled The reboot will wait for all VoIP calls to complete before rebooting 4 3 1 Software release types There are three types of software release factory beta and alpha For full details on the differences between these software releases refer to the FB6000 software downloads website http www firebrick co uk 23 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration software php PRODUCT 6000 please follow the read the instructions link that you will find just above the list of software versions Note In order to be able to run alpha releases your FB6000 must be enabled to run alpha software this 1s done by changing the entry in the FireBrick
167. ogging Log events log debug NMTOKEN Log debug log error NMTOKEN Log as event Log errors nsn conditional boolean Only send NSN settings if username is not same as calling station id nsn tunnel override unsignedByte username Additional response for GGSN usage nsn tunnel user unsignedInt Additional response for GGSN usage auth method order radiuspriority Priority tagging of endpoints sent profile NMTOKEN Profile name relay ip List of IPAddr Address to copy RADIUS request relay port unsignedShort 1812 Authentication UDP port for copy RADIUS request relay table unsignedByte 0 99 Routing table number for copy of RADIUS routetable request secret Secret Shared secret for RADIUS requests needed for replies source string Source of data used in automated config management tagged boolean Tag all attributes that can be target hostname string Hostname for L2TP connection target ip List of IPNameAddr Target IP s or hostname for primary L2TP connection target secret Secret Shared secret for L2TP connection test List of IPAddr List of IPs that must have routing for this target to be valid deprecated tunnel assignment string Tunnel Assignment ID to send id 102 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects tunnel client return boolean Return tunnel client as ra
168. ogins soria i e E E E a a EES E T EE ee 21 4 1 4 1 Restrict by IP address onca a a e a a raSi 21 iv www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6502 User Manual A A A O 22 414 3 Restrict by profiles Ages ies o ie a dhs as 22 4 2 General System Sets sanesna down ss oia de saws eden ates nseugeato heeds da ri doce 22 4 2 1 System name hostname cceceeeeeeeeecneceeeeeeeeeeeceeeeeeeeeseceeeaeeeeeaeeeeeaeeeeaeeeeeas 22 ADD Administrativo details vcd stores ir ara das 22 4 2 3 System level event logging control ooooocnoncnocnnccnnccnnccnnccnnccnnconnconnconnconaronccnnronose 23 4 2 4 Home page web links tiritas iria 23 4 3 oftware Uporades id A de eae ae ren 23 43 A Software release types so ssc susaesnyootdietyseecesuoes R kee e A obese Soop itn IEn Et 23 4 3 1 Breakpomt releases onr ero e italia dla 24 4 3 2 Identifying current software version ooocccooccccnoccnnocnnnnccnnnncnonccnnnnccnnnrnnnnccnnnncnoninns 24 4 3 3 Internet based upgrade Process oocoocccnccnnccnnccnnconnconeconnconncnnnnnnronnronncnnccnnccnnccnnions 24 4 3 3 1 Manually initiating upgrades ooccooccnccnnccnnconnconnccnnccnnconnconnconncnnncnnncnnrnnoss 25 4 3 3 2 Controlling automatic software updates 0 0 0 0 cece cece eee cece eee eeneeen scans 25 43 4 ManualcUparade decidi reinar samen dy E N cvs 25 4 4 BOO POC Sii id lator cashes endear reed eee es 26 4 4 TBD ndiCatl
169. on specific User Agent to send withhold string 141 CLI withhold prefix Table G 55 voip Elements Element Type Instances Description carrier carrier Optional up to 200 VoIP carriers group ringgroup Optional up to 20 Ring groups telephone telephone Optional up to 200 VoIP users tone tone Optional up to 25 Defined tones G 2 43 carrier VolP carrier details VoIP carrier details Table G 56 carrier Attributes Attribute Type Default Description allow List of Allow from List of IP ranges from which invite IPNameRange anywhere accepted cli format voip format national CLI number format for outgoing calls comment string Comment cui string Chargeable user identity for call accounting of incoming calls display name string Text name to use expires duration 1 00 00 Registration expiry time extn string Local number assumed for incoming call use X for digits from end of called numbers force dtmf boolean Always send DTMF in band from string From SIP address for outbound registration and invites hold tone boolean true Send hold tones to carrier incoming format voip format national Dialled number format for incoming calls max calls unsignedInt Maximum simultaneous calls allowed name NMTOKEN Not optional Carrier name outgoing format voip format national Dialled number format for outgoing calls password Secret Carrier password for o
170. on which is the time from the connection of the call 61 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 VoIP 13 11 2 RADIUS authentication RADIUS authentication is used for any challenged requests such as REGISTER INVITE REFER SUBSCRIBE OPTIONS etc The Digest Method is always included to indicate a VoIP request and identify the type of request You can have a RADIUS authentication before the FireBrick challenges the reqestor setting the radius challenge settings allowing a RADIUS challenge response to customise the challenge this also happens for a non local request where the user is not recognised as a local telephone user Otherwise the FB6000 will send a challenge automatically and only send a RADIUS authentication when the authenticated message is received Tip For an unauthenticated request you can respond with an Access Challenge including the paramaters to challenge but any attributes you omit will be completed automatically so you can simple response with an empty challenge to simply confirm the FB6000 is to go ahead and do the challenge itself For REGISTER an accept response can include a Called Station Id attribute can be used to define the registered connection as a tel number URI for call routing Without this the registration is not logged on the FB6000 and it is assumed the RADIUS server will record where to send calls based on the registration The SIP AOR AVP in the
171. ons sos cusacsetes cee oeseecs eh Seedisp eee aespa ven dheh deeds pep age gees eek tees venlenonseteeceene 26 4 4 1 1 Power LED status indications coooccnccnnccnncnnncnnocnnccnnconnccnnccnncnnnconncnnncnnnes 26 AAV POr LEDS triana ia ita in 26 dy Event TOs pine RA A Ea a 28 De Mc OVERVISW see O 28 Dells LOS tar Pets A Mask ae a E e Saves Sai ae ben ek Mee a RWG ae A etal 28 1 1 1 Eoggimg to Flash memory srs isee e a E EES ES 28 5 1 1 2 Logging to the Console teenie a ee EE E EE E SE 29 3 23 Enabling Jor SIN greer orr R e e E E A EO EROR EEEE ESE EEEE 29 5 3 Logging to external destinations 2 0 0 0 cece n E E a E a sE eh 29 SA IO 29 D3 2s Email AA tinct E E ys avast en tielign eb ete devetvecunoaes tantieeb S 30 SA E mail process lOPSIN gS ppsa sevedee sth svdeasne tea gessesoness ET eeaesen gwen ses 31 5 4 Factory reset configuration log targets 1 0 0 0 cece cece cee cence eeceeeeeeeea ceca eeaeeeae eeu eeneeeneeeenees 31 D D PETLOLIMANCE aise O Ses dawed SEAS 31 DOA VIEWS NORS ieee iN E wed ede ated reat A Mabeboed eer east 31 5 6 1 Viewing logs in the User Interface 2 0 0 0 cece t ennienni iore ere api ooe iE pano ps 31 5 6 2 Viewing logs in the CLI environment 0 cece cece scence ence eceeeceeeeeeeeaeeeaes 32 NA SUS OS 32 5 8 Using Profiles ai A iia 32 6 Interfaces and SubnetS smilies 33 6 1 Relationship between Interfaces and Physical Ports ooooccoccnnconnconnccnnconnconocnnncnnncnnocaninnn
172. or convenience If defined by DHCP or RA then like the rest of the routes created by DHCP or RA it is removed when the DHCP or RA times out Example lt subnet ip 192 168 0 1 24 gt creates a route for destination 192 168 0 0 24 to the interface associated with that subnet A loop back route to 192 168 0 1 the FB6000 s own IP address on that subnet is also created 7 2 2 Routing to an IP address gateway route Routes can be defined to forward traffic to another IP address which will typically be another router often also called a gateway For such a routing target the gateway s IP address is then used to determine how to route the traffic and another routing decision is made This subsequent routing decision usually identifies an interface or other data link to send the packet via in more unusual cases the subsequent routing decision identifies another gateway so it is possible for the process to be recursive until a real destination is found Example lt route ip 0 0 0 0 0 gateway 192 168 0 100 gt creates a default IPv4 route that forwards traffic to 192 168 0 100 The routing for 192 168 0 100 then has to be looked up to find the final target e g it may be to an Ethernet interface in which case an ARP is done for 192 168 0 100 to find the MAC to send the traffic There is logic to ensure that the next hop is valid the gateway specified must be routable somewhere and if that is via an Ethernet interface then the en
173. ore routes are the same type of interface and there are shapers applied to those routes then a decisions is made on a per packet basis as to which interface to used The shapers are used to decide which link is least far ahead This means that traffic is sent down each link at the speed of that link To make this work to the best effect set the tx speed of the shapers on the links to match the actual link speed E g for broadband lines set the speed to match the uplink from the FB6000 40 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 8 Profiles Profiles allow you to enable disable various aspects of the FB6000 s configuration and thus functionality based on things such as time of day or presence absence of Ping responses from a specified device 8 1 Overview A profile is a two state control entity it is either Active or Inactive On or Off like a switch Once a profile is defined it can be referenced in various configuration objects where the profile state will control the behaviour of that object A profile s state is determined by one or more defined tests which are performed periodically If multiple tests are specified then the overall test result will be pass only if all the individual test results are pass Assuming the profile s state is Active then when the overall test result has been fail for a specified duration the profile transitions to Inactive Similary
174. ork ID and host ID bitfields were implied by the bit pattern of some of the most significant address bits which segmented the 32 bit IPv4 address space into three main blocks one for each class of network CIDR The prefix notation introduced by CIDR was in the simplest sense to make explicit which bits in a 32 bit IPv4 address are interpreted as the network number or prefix associated with a site and which are the used to number individual end systems within the site In this sense the prefix is the N most significant bits that comprise the network ID bitfield CIDR notation is written as IPv4 Traditional IPv4 dotted quad number followed by the slash character followed by a decimal prefix length value between 0 and 32 inclusive IPv6 IPv6 address followed by the slash character followed by a decimal prefix length value between 0 and 128 inclusive Where formerly only three network sizes were available CIDR prefixes may be defined to describe any power of two sized block of between one and 2432 end system addresses that begins at an address that is a multiple of the block size This provides for far less wasteful allocation of IP address space The size of the range is given by 24M where M 32 prefix_length Routing destinations As well as being used to define a network subnet the CIDR notation is used to define the destination in a routing table entry which may encompass multiple networks with
175. orresponding attribute specified then they must all pass along with all other tests defined for the overall result to be pass 8 2 2 2 Time date tests Time and or date tests are specified by date and or time objects which are child objects of the profile object You can define multiple date ranges via multiple date objects the date test will pass if the current date is within any of the defined ranges Similarly you can define multiple time ranges via multiple t ime objects the time test will pass 1f the current time is within any of the defined ranges Tip Unlike other tests the chanhe of state because of a date time test takes effect immediately rather than waiting for several seconds to confirm it is still Saturday or some such 8 2 2 3 Ping tests Like time date tests a Ping test is specified by a ping object as a child of the profile object At most one Ping test can be defined per profile logical combinations of profiles can be used to combine Ping tests if necessary 8 2 3 Inverting overall test result The tests described in the previous section are used to form an overall test result Normally this overall result is used to determine the profile state using the mapping Pass gt Active and Fail gt Inactive By setting the invert attribute to t rue the overall result is inverted Pass changed to Fail and vice versa first before applying the mapping 8 2 4 Manual override You can manually override all tests
176. port s duplex mode Note If you do not set the autoneg attribute checkbox is unticked and you set both port speed and duplex mode to values other than auto auto negotiation will be disabled this behaviour is to reduce the potential for duplex mis match problems that can occur when connecting the FB6000 to some vendors notably Cisco equipment that has auto negotation disabled by default 6 3 2 Defining port LED functions Each port has options to control the way the yellow and green LEDs are displayed based on the state of the port The default is yellow for Tx and green for link activity 37 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 7 Routing 7 1 Routing logic The routing logic in the FB6000 operates primarily using a conventional routing system of most specific prefix which is commonly found in many IP stacks in general purpose computers and routers Conventional routing determines where to send a packet based only on the packet s destination IP address and is applied on a per packet basis i e each packet that arrives is processed independently from previous packets Note that with this routing system it does not matter where the packet came from either in terms of source IP address or which interface tunnel etc the packet arrived on A route consists of e a target specifying where to send the packet to this may be a specialised action such as sile
177. r any other situation where it 1s appropriate to start from scratch for example commissioning an existing unit for a different role or where you ve forgotten an administrative user password Itis also possible to temporarily reset the FB6000 to allow you to recover and edit a broken configuration though you still need to know the password you had You can also go back one step in the config The remainder of this chapter provides an overview of the FB6000 s capabilities and covers your product support options Tip The latest version of the QuickStart guide for the FB6000 can be obtained from the FireBrick website at http www firebrick co uk pdfs quickstart 6000 pdf 1 1 2 What can it do The FB6000 series of products is a family of high speed ISP telco grade routers and firewalls providing a range of specific functions Key features of the FB6000 family e 1U 19 rack mount e Very low power consumption typical 20W all important with today s power charges in data centres e Two small fans are the only moving parts for high reliability e Dual 120 230V AC power feed IPv6 built in from the start www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Introduction e Gigabit performance The FB600 series are provided in a number of variants This manual is for the FB6502 This variant includes e Border Gateway Protocol to allow routes to be announced and accepted from peering BGP router
178. r more IP ranges or IP len name string Not optional Name source string Source of data used in automated config management users List of NMTOKEN Include IP of time limited logged in web users G 2 42 voip Voice over IP config Voice over IP config 118 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects Table G 54 voip Attributes Attribute Type Default Description area code string Local area code without national prefix backup carrier NMTOKEN Backup carrier to use for external calls comment string Comment country string 44 Local country code default carrier NMTOKEN Default carrier to use for external calls domain string Domain to use for us on outgoing SIP connections emergency List of string 112 999 Emergency numbers emergency uri string Use outbound carrier SIP URI for emergency calls international string 00 International dialling prefix local digits string 23456789 Local numbers start with these digits local min len unsignedByte 5 Local numbers min length log NMTOKEN Not logging Log calls log cdr NMTOKEN Not logged Log CDR records log debug NMTOKEN Not logging Log debug and SIP messages log error NMTOKEN Log as event Log errors log sip blf NMTOKEN Not logged SUBSCRIBE NOTIFY PUBLISH log sip call NMTOKEN Not logged INVI
179. r of these methods e via the user interface using a web page form to setup the dump once the capture data has been downloaded it can be analysed using t codump or Wireshark e using an HTTP client on another machine typically a command line client utility such as cur1 The output is streamed so that when used with curl and tcpdump you can monitor traffic in real time Limited filtering is provided by the FB6000 so you will normally apply any additional filtering you need via tcpdump 11 2 1 Dump parameters Table 11 1 lists the parameters you can specify to control what gets dumped The Parameter name column shows the exact parameter name to specify when constructing a URL to use with an HTTP client The Web form field column shows the label of the equivalent field on the user interface form Table 11 1 Packet dump parameters Parameter name Web form field Function interface Interface One or more interfaces as the name of the interface e g interface WAN also applies for name of PPPoE on an interface snaplen Snaplen The maximum capture length for a packet can be specified in bytes Default 0 auto See notes below timeout Timeout The maximum capture time can be specified in seconds Default 10 ip IP address 2 off Up to two IPs can be specified to filter packets self Include my IP By default any traffic to or from the IP which is connecting to the web interface to access pcap is excluded Th
180. r tracks how far ahead the link has got with traffic that has been recently sent This depends on the length of packets sent and the speed of the shaper This is essentially tracking how much is likely to be queued at a bottleneck further on The FB6000 does not delay sending packets and assumes something with a lower speed is probably queuing them up later This record of how far ahead the traffic is gets used in two ways If the shaper is too far ahead then packets are dropped causing the link to be rate limited to the selected speed Exactly how much is too far depends on the packet size with small packets less than 1000 bytes allowed more margin than large packets This has the effect of prioritising DNS interactive traffic VoIP etc Where there are two or more links with shapers a link is picked based on which is the least far ahead This has the effect of balancing the traffic levels between multiple links based on the speed of each link exactly 46 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 10 System Services A system service provides general functionality and runs as a separate concurrent process alongside normal traffic handling Table 10 1 lists the services that the FB6000 can provide Table 10 1 List of system services Service Function SNMP server provides clients with access to management information using the Simple Network Managemen
181. rebrick co uk for technical notes 13 4 Network Address Translation Network Addres Translation NAT is common on many Internet connections in homes and offices It means that the office uses private 1P addresses e g 192 168 1 1 and these are mapped translated to one external address NAT is known to cause a lot of problems with a wide variety of applications and protocols One of those that suffers a lot from the problems of NAT is VoIP There are sometimes ways of making this work but it usually a compromise of some sort and prone to problems The FB6000 provides some key ways to tackle the issues of NAT e An FB2500 FB2700 can be used as a gateway device in a home or office using PPPoE to connect to the Internet This means the FireBrick has a real external IP address without NAT The FireBrick can then connect to SIP handsets on the LAN using private IP addresses The FireBrick provides a gateway for VoIP with no NAT implications Note Some ISPs may start using Carrier Grade NAT CGNAT and so a real 1P address may involve additional cost e The FireBrick can make use of the current Internet Protcol IPv6 At present there are few carriers and handsets that work with IPv6 but this is improving all of the time IPv6 avoids the need for NAT The FireBrick acts as a media gateway which makes firewalling rules simple even when using IPv6 and allows IPv4 and IPv6 devices to interwork with no problems e The FireBrick when a
182. refore 10 0 0 0to10 0 0 255 A prefix length of 32 is possible and specifies a block size of just one address equivalent to a plain IP address specification with no prefix notation This is not the same as a combined subnet and interface IP address definition as it only specifies a single IP address General IP address range specifications CIDR notation can also be used in the FB6000 to express general IP address ranges such as in session rules trusted IP lists access control lists etc In these cases the notation is the same as for routing destinations or subnets i e the address specified is the starting address of the range and the prefix length determines the size of the range 74 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix B MAC Addresses usage Ethernet networks use 48 bit MAC addresses These are globally unique and allocated by the equipment manufacturer from a pool of addresses that is defined by the first three octets bytes which identify the organization and are known as the Organizationally Unique Identifier OUT OUIs are issued by the IEEE more information and a searchable database of existing OUIs are available at http standards ieee org develop regauth oui MAC addresses are commonly written as six groups of two hexadecimal digits separated by colons or hyphens FB6000s currently ship with an OUI value of 00 03 97 In principle the FireBrick could ha
183. request e g unplug ethernet cable do a software repair connection procedure or similar etc See the show dhcp and clear dhcp CLI commands in the Appendix E for details on how to clear the allocation Chapter 15 covers the CLI in general You can also Jock an existing dynamic allocation to prevent it being re used for a different MAC address even if it has expired 6 2 2 1 1 Special DHCP attributes For each pool you can list specific DHCP attributes specified as a string IPv4 address or number or even as raw data in hexadecimal You can force sending of an attribute even if not requested For vendor specific attributes ID 43 you can either specify in hex as ID 43 or you can specify the code to use and set the vendor flag this adds an attribute type 43 with the code and length for the attribute which can be string IPv4 address number or hexadecimal 6 2 2 2 Partial MAC address based allocations In addition to specifying a full 48 bit 12 hexadecimal character MAC address in a dhcp object it is also possible to specify part of a MAC address specifically some number of leading bytes The dhcp object will then apply for any client whose MAC address has the same leading bytes For example as discussed in Appendix B the first three octets bytes of a MAC address identify the organization often the end product manufacturer that can allocate that MAC address to an Ethernet device By specifying only these first three bytes
184. ributes Attribute Type Default Description name NMTOKEN Not optional Tone name plan string Not optional Plan for frequency and duration e g 400ms 400Hz 3dB 450Hz 3dB G 2 46 ringgroup Ring groups Ring groups Table G 59 ringgroup Attributes www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Attribute Type Default Description allow pickup List of string Only allow pickup from these extensions allow subscribe List of string Only allow subscribe Busy Lamp Field from these extensions answer time duration 30 Answer caller if ringing this long carrier NMTOKEN Carrier to use for external calls comment string Comment cui string Chargeable user identity for call accounting ddi List of string Full telephone number international format starting display name string Text name to use email string Email address sent to call recording server extn List of string Local extension number initial time duration Don t progress to second number until this time limit unsignedByte Number allowed to queue 122 Configuration Objects name NMTOKEN Not optional Group name order ring group order strict Order of ring out of hours List of string Numbers to ring if out of profile overflow List of string Numbers to ring when more than one call in queue overflow
185. rse DNS name is shown next to replies but there is deliberately no delay waiting for DNS responses so you may find it useful to run a trace a second time as results from the first attempt will be cached E 2 3 Show a route from the routing table show route lt IPPrefix gt table lt routetable gt Shows details of a route in the routing table Where an individual IP is used the route that would be used is shown but if a specifiy prefix is used then that specific route is shown even if there may be more specific routes in use E 2 4 List routes show routes lt IPFilter gt table lt routetable gt Lists routes in the routing table limited to those that match the filter if specified E 2 5 List routing next hops show route nexthop lt IPAddr gt List the next hop addresses currently in use and their status 85 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Command line reference E 2 6 See DHCP allocations show dhcp lt IP4Addr gt table lt routetable gt Shows DHCP allocations with option to show details for specific allocation E 2 7 Clear DHCP allocations clear dhcp ip lt IP4Range gt table lt routetable gt Allows you to remove one or more DHCP allocations E 2 8 Lock DHCP allocations lock dhcp ip lt IP4Addr gt table lt routetable gt Locks a DHCP allocation This s
186. rt crossover configuration Table G 70 Crossover Crossover configuration Value Description auto Crossover is determined automatically MDI Force no crossover G 3 12 LinkSpeed Physical port speed Table G 71 LinkSpeed Physical port speed Value Description 126 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects 10M 10Mbit sec 100M 100Mbit sec 1G 1Gbit sec auto Speed determined by autonegotiation G 3 13 LinkDuplex Physical port duplex setting Table G 72 LinkDuplex Physical port duplex setting Value Description half Half duplex full Full duplex auto Duplex determined by autonegotiation G 3 14 LinkFlow Physical port flow control setting Table G 73 LinkFlow Physical port flow control setting Value Description none No flow control symmetric Can support two way flow control send pauses Can send pauses but does not support pause reception any Can receive pauses and may send pauses if required G 3 15 LinkClock Physical port Gigabit clock master slave setting Table G 74 LinkClock Physical port Gigabit clock master slave setting Value Description prefer master Master status negotiated preference for master prefer slave Master status negotiated preference for slave force master Master status forced force slave Slave st
187. rt of a confederation Confederation rules apply Peers only with different AS ixp Must be EBGP and sets default of no fib and not add own as Routes from this peer are marked as IXP routes which affects filtering on route announcements 14 2 5 Route filtering Each peer has a set of import and export rules which are applied to routes that are imported or exported from the peer In future there will be named peer groups route maps and prefix lists The objects import and export work in exactly the same way checking the routes imported or exported against a set of rules and then possibly making changes to the attributes of the routes or even choosing to discard the route Each of these objects contain e Cosmetic attributes such as name comment and source e Route matching attributes allowing specific routes to be selected e Action attributes defining changes to the route e A continuation attribute stop defining if the matching stops at this rule default or continues to check further rules The rules are considered in order The first rule to match all of the matching attributes is used If no rules match then the default actions from the import export object are used In addition the top level import export has a prefix list If present then this will limit the prefixes processed at a top level dropping any that do not match the list without even considering the rules 14 2 5 1 Matching attributes The actual attri
188. s e SIP VoIP caller server providing core call routing and registration functions for a voice network operator 1 1 2 1 FB6502 Gigabit core VoIP SIP switch for ISTP use The FB6502 acts as a core voice network switch It provides high capacity media forwarding and SIP 2 0 VoIP protocol handling including registration and call routing The design allows the FB6502 to perform the grunt of a large scale voice network leaving external devices e g linux boxes to make decisions and log calls interacting via RADIUS messages The FB6502 can work with pools of RADIUS servers for fallback and load management 1 1 3 Ethernet port capabilities The FB6000 has two Ethernet network ports that operate at 1Gb s The ports implement auto negotiation by default but operation can be fine tuned to suit specific circumstances The function of these ports is very flexible and defined by the device s configuration The ports implement one or more interfaces Multiple interfaces can be implemented on a single physical port via support for IEEE 802 1Q VLANs ideal for using the FB6000 with VLAN capable network switches In this case a single physical connection can be made between a VLAN capable switch and the FB6000 and with the switch configured appropriately this physical connection will carry traffic to from multiple VLANs and the FB6000 can do Layer 3 processing routing firewalling etc between nodes on two or more VLANs 1 1 4 Product variants
189. s e g admin machines may be a list or range of the IP addresses from which you want to allow some access The feature can also be useful even where only one IP is in the group just to give the IP a meaningful name in an access list These named IP groups can be used in the allow list for a user login along with specific IP addresses or ranges if needed However IP groups can also list one or more user names and implicitely include the current IP address from which those users are logged in to the web interface This can be useful for firewall rules where you may have to log in to the FireBrick even as a NOBODY level user just to get your IP address in an access list to allow further access to a network from that IP 4 1 4 3 Restrict by profile By specifying a profile name using the profile attribute you can allow logins by the user only when the profile is in the Active state see Chapter 8 You can use this to for example restrict logins to be allowed only during certain times of the day or you can effectively suspend a user account by specifying an always Inactive profile 4 2 General System settings The system top level object can specify attributes that control general global system settings The available attributes are described in the following sections and can be configured in the User Interface by choosing the Setup category then clicking the Edit link under the heading System settings The software auto upgr
190. s VRRP can provide resilience in the event of device failure by allowing a backup device to automatically assume the role of actively routing traffic 12 1 Virtual Routers VRRP abstracts a group of routers using the concept of a virtual router which has a virtual IP address The IP address is virtual in the sense that it is associated with more than one hardware device and can move between devices automatically The virtual IP address normally differs from the real IP address of any of the group members but it can be the real address of the master router if you prefer e g if short of IP addresses You can have multiple virtual routers on the same LAN at the same time so there is a Virtual Router Identifier VRID that is used to distinguish them The default VRID used by the FB6000 is 42 You must set all devices that are part of the same group virtual router to the same VRID and this VRID must differ from that used by any other virtual routers on the same LAN Typically you would only have one virtual router on any given LAN so the default of 42 does not normally need changing Note You can use the same VRID on different VLANs without a clash in any way in the FB6000 however you may find some switches and some operatings systems do not work well and get confused about the same MAC appearing on different interfaces and VLANs As such it is generally a good idea to avoid doing this unless you are sure your network will cope i e us
191. s a key such as RETURN In addition anything set to log to console shows anyway see Section 5 1 1 2 unless disabled with the troff command 5 7 System event logging Some aspects of the operation of the overall system have associated events and messages that can be logged Logging of such events is enabled via the system object attributes shown in Table 5 2 below Table 5 2 System Event Logging attributes system object attribute Event types log General system events log debug System debug messages log error System error messages log eth General Ethernet hardware messages log eth debug Ethernet hardware debug messages log eth error Ethernet hardware error messages log panic System Panic events log stats One second stats messages Specifying system event logging attributes is usually only necessary when diagnosing problems with the FB6000 and will typically be done under guidance from support staff For example log stats causes a log message to be generated every second containing some key system statistics and state information which are useful for debugging Note that there are some system events such as startup and shutdown which are always logged to all log targets and to the console and flash by default regardless of these logging attributes 5 8 Using Profiles The log target itself can have a profile which stops logging happening when the profile is disabled A
192. s for a peer setting It allows typical settings to be defined with one attribute that reflects the type of peer Table G 83 peertype BGP peer type Value Description normal Normal BGP operation transit EBGP Mark received as no export peer EBGP Mark received as no export only accept peer AS customer EBGP Allow export as if confederate only accept peer AS internal IBGP allowing own AS reflector IBGP allowing own AS and working in route reflector mode confederate EBGP confederate 129 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects lixp Internet exchange point peer on route server G 3 25 switch Profile manual setting Manual setting control for profile Table G 84 switch Profile manual setting Value Description false Profile set to OFF true Profile set to ON control switch Profile set based on control switch on home page G 3 26 voip format Number presentation format Table G 85 voip format Number presentation format Value Description international Full international number int no plus International without leading plus national With nat int prefix local Internal extension number local number block Do not use for calls G 3 27 uknumberformat Number formatting option Table G 86 uknumberformat Number formatting option Va
193. s for typical ISP corporate setup e RFC4271 Standard BGP capable of handling multiple full internet routing tables e RFC4893 32 bit AS number handling e RFC2858 Multi protocol handling of IPv6 67 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 BGP RFC1997 Community tagging with in build support of well known communities RFC2385 TCP MDS protection RFC2796 Route reflector peers RFC3392 Capabilities negotiation RFC3065 Confederation peers RFC5082 TTL Security Multiple independent routing tables allowing independent BGP operations Multiple AS operation 14 2 3 Simple example setup A typical installation may have transit connections from which a complete internet routing table is received peers which provide their own routes only internal peers making an IBGP mesh customers to which transit is provided and customer routes may be accepted To make this set up simple the lt peer gt definition contains a type attribute This allows simple BGP configuration such as lt bgp as 12345 gt lt peer as 666 name transitl type transit ip 1 2 3 4 gt lt peer as 777 Name transii2 tyoe transit ip 2 3 4 0 2 3 4 6 gt lt peer type internal ip 5 6 7 8 gt lt bgp gt This example has two transit providers the second of which is actually two peer IP addresses and one internal connection Note that the peer AS is optional and unnecessary on
194. s the message source where the commonly used facility identifiers are not suitable the local0 thru local7 identifiers can be used If the facility attribute is not set it defaults to LOCALO e severity the severity value to be used in the syslog messages if not set the severity defaults to NOTICE The FB6000 normally uses the standard syslog port number of 514 but if necessary you can change this by setting the port attribute value 5 3 2 Email You can cause logs to be sent by e mail by creating an email object that is a child of the log target 10g object An important aspect of emailed logs is that they have a delay and a hold off The delay means that the email is not sent immediately because often a cluster of events happen over a short period and it is sensible to wait for several log lines for an event before e mailing The hold off period is the time that the FB6000 waits after sending an e mail before sending another Having a hold off period means you don t get an excessive number of e mails since the logging system is initially storing event messages in RAM the e mail that is sent after the hold off period will contain any messages that were generated during the hold off period The following aspects of the e mail process can be configured e subject you can either specify the subject by setting the subject attribute value or you can allow the FB6000 to create a subject based on the first line of the
195. sed Any graph name that you try and use that is too long will be replaced with one that uses part of the name and a hash to try and ensure a consistent unique graph name is applied 92 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Constant Quality Monitoring technical details Graphs can be defined in some configuration settings such as interface names The number of graphs is limited depending on memory but the design is to allow for 100 000 distinctly named graphs Dynamic circuits simply do not have graphs on them if this number is exceeded Graphs not used for more than the data retention time are discarded automatically 93 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Appendix G Configuration Objects This appendix defines the object definitions used in the FireBrick FB6502 VoIP configuration Copyright 2008 13 FireBrick Ltd G 1 Top level G 1 1 config Top level config The top level config element contains all of the FireBrick configuration data Table G 1 config Attributes Attribute Type Default Description patch integer Internal use for s w updates that change config syntax timestamp dateTime Config store time set automatically when config is saved Table G 2 config Elements Element Type Instances Description bgp bgp Optional up to 100
196. set by ntp poll duration 1 00 00 NTP poll rate profile NMTOKEN Profile name source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable tz1 name string GMT Timezone name tz1 offset duration 0 Timezone 1 offset from UTC tz12 date unsignedByte 1 31 25 Timezone 1 to 2 earliest date in month datenum tz12 day day Sun Timezone 1 to 2 day of week of change tz12 month month Mar Timezone 1 to 2 month tz12 time time 01 00 00 Timezone 1 to 2 local time of change tz2 name string BST Timezone 2 name tz2 offset duration 1 00 00 Timezone 2 offset from UTC tz21 date unsignedByte 1 31 25 Timezone 2 to earliest date in month datenum tz21 day day Sun Timezone 2 to day of week of change tz21 month month Oct Timezone 2 to 1 month tz21 time time 02 00 00 Timezone 2 to local time of change G 2 10 telnet service Telnet service settings Telnet control interface Table G 14 telnet service Attributes Attribute Type Default Description allow List of Allow from List of IP ranges from which service can be IPNameRange anywhere accessed comment string Comment local only boolean true Restrict access to locally connected Ethernet subnets only log NMTOKEN Not logging Log events log debug NMTOKEN Not logging Log debug log error NMTOKEN Log as event Log errors port unsignedShort 23 Service port profile NMTOKEN Profile na
197. set device has to be able to accept calls from the carrier Again a username and password are used for security but this time it is the device checking the credentials of the carrier 13 2 2 Proxy To make an outgoing call via a SIP carrier you have to send the call details to a proxy In the case of the FB6000 acting as the carrier the same address is used for registrar and proxy The process uses a username and password in much the same way as registration and they are usually the same details This checks that the device is allowed to make the calls and allows right person to be billed for the call Tip You can have a case of incoming calls working and not outgoing which means registration has worked but somehow you have incorrect proxy details The other way around where outgoing calls work and 58 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 VoIP incoming do not would mean the registration is not working but the proxy details are correct The logging options can be very useful to help diagnose problems 13 3 Core call routing switch The design allows the FB6502 to perform the grunt of a large scale voice network leaving external devices e g linux boxes to make decisions and log calls interacting via RADIUS messages The FB6502 can work with pools of RADIUS servers for fallback and load management Note This section of the manual is still in development Please see www fi
198. six hexadecimal characters no colon delimiters in the mac attribute you could ensure that all devices from the associated manufacturer are allocated addresses from a particular address pool This is helpful if you have some common firewalling requirements for such a group of devices for example if all your VoIP phones are from one manufacturer as you can have appropriate firewall rule s that apply to addresses in that pool 6 3 Physical port settings The detailed operation of each physical port can be controlled by creating ethernet top level objects one for each port that you wish to define different behaviour for vs default behaviour To create anew ethernet object or edit an existing object select the Interface category from the top level icons Under the section headed Ethernet port settings you will see the list of existing ethernet objects if any and an Add link In a factory reset configuration there are no ethernet objects and all ports assume the following defaults e Link auto negotiation is enabled both speed and duplex mode are determined via auto negotiation which should configure the link for highest performance possible for the given link partner which will need to be capable of and participating in auto negotiation for this to happen 36 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Interfaces and Subnets e Auto crossover mode is enabled the port
199. ss 33 O 33 e BSA Intertaces A A io eee 33 DN A O 33 6 2 1 Defining SUDNE S 2 ii iio aia dos 34 6 2 1 1 Using DHCP to configure a subnet oocccoccnccnnconnccnncnnnconnconoconanonocnnccnarnnns 34 6 2 2 Setting up DHCP server parameters oooccoccnnccnnccnnconoconnconnconncnnncnnnnnnrnnncnnccnnccnnicnns 35 6 2 2 1 Fixed Static DHCP allocations 20 0 0 eee ec cece eee ece eee eeeeeeeeseeeeaeeeaes 35 6 2 2 1 1 Special DHCP attributes 2 0 00 cece e cena eeneeeneeennees 36 6 2 2 2 Partial MAC address based allocations ocoooccnocnnccnnccnncnnnconccnnccnnccnnccnncons 36 6 3 Physical port Stun a A ad ye ec dg EEE E eee 36 6 3 0 Setting duplex mode c0 o52s cose sesues oesh oun ass priista nostre EEREN I 37 6 3 2 Defining port LED functions oocccooccnnnccnnnoccnnccnnnnccnnnncnonocnnnnccnnnncnoncnnnnncinnnrcnnnose 37 TROUDE O veut edacene sees ee E decors E a AE E EES 38 Tol Routing lOGIC erste eeen E R E A E ES 38 T 27 Routing targets resoa a e E EE E E EEN E RAE EERIE SE E A EE ES ERR 39 TZ LS UDC TOUS SS AA ds 39 7 2 2 Routing to an IP address gateway route ooccooccnnconnconoconconacnnncnnncnaronoronccnnrinninnno 39 9223 Special targets ti deste tee eis dele Rea as IO ie tou ey Ia 40 v www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6502 User Manual 7 3 Dynamic route creation deletion oocccoccnnccnnccnncnnnconconncnnncnnncnnnnnnroncnn cono Ea pE
200. t MDS signing secret name string Name next hop self boolean false Force us as next hop outbound no fib boolean Don t include received routes in packet forwarding pad unsignedByte Pad prefix stuff our AS on export by this many profile NMTOKEN Profile name same ip type boolean true Only accept send IPv4 routes to IPv4 peers and IPv6 routes to IPv6 peers send default boolean false Send a default route to this peer send no routes boolean false Don t send any normal routes shutdown boolean Shutdown this neighbour deprecated use profile source string Source of data used in automated config management timer idle unsignedInt 60 Idle time after error timer openwait unsignedInt 10 Time to wait for OPEN on connection timer retry unsignedInt 10 Time to retry the neighbour ttl security byte Enable RFC5082 TTL security if ve 1 to 127 i e 1 for adjacent router If ve 1 to 128 set forced sending TTL i e 1 for TTL of 1 sending and not checking type peertype normal Type of neighbour affects some defaults use vrrp as self boolean true if customer Use VRRP address as self if possible transit type Table G 43 bgppeer Elements Element Type Instances Description 113 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects export bgpmap Optional Mapping and filtering rules of announcing prefixes to peer import bgpmap Optional M
201. t Protocol NTP client automatically synchronises the FB6000 s clock with an NTP time server usually using an Internet public NTP server Telnet server provides an administration command line interface accessed over a network connection HTTP server serves the web user interface files to a user s browser on a client machine DNS relays DNS requests from either the FB6000 itself or client machines to one or more DNS resolvers RADIUS Configuration of RADIUS client accessing external RADIUS servers Services are configured under the Setup category under the heading General system services where there is a single services object XML element lt services gt The services object doesn t have any attributes itself all configuration is done via child objects one per service If a service object is not present the service is disabled Clicking on the Edit link next to the services object will take you to the lists of child objects Where a service object is not present the table in that section will contain an Add link A maximum of one instance of each service object type can be present 10 1 Protecting the FB6000 The FB6000 does not have a firewall as such However the design of the FB6000 is that it should be able to protect itself sensibly without the need for a separate firewall Each service has specific access control settings and these default to not allowing external access i e traffic not from locally Ethernet
202. t is zero bits In some cases the presence of an attribute will have meaning even 1f that attribute is an empty string or zero value In some cases the default for an attribute will not be a fixed value but will depend on other factors e g it may be auto or set if using xyz The description of the default value should make this clear Where an optional attribute is not ticked the attribute does not appear in the XML at all These can be seen in Figure 3 7 Figure 3 7 Attribute definitions Attribute name m name Name Attribute WAN fo descriptions port Port group name Attribute values 14 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration If the attribute value is shown in a strike through font with a horizontal line through it mid way vertically this illustrates that the attribute can t be set this will happen where the attribute value would reference an instance of particular type of object but there are not currently any instances of objects of that type defined Tip Since the attribute name is a compact concise and un ambiguous way of referring to an attribute please quote attribute names when requesting technical support and expect technical support staff to discuss your configuration primarily in terms of attribute and object element names rather than descriptive text or physical location on your screen both of which can v
203. ta used in automated config management table unsignedByte 0 99 0 Routing table number routetable 111 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects tag List of Community List of community tags G 2 32 bgp Overall BGP settings The BGP element defines general BGP settings and a list of peer definitions for the individual BGP peers Table G 40 bgp Attributes Attribute Type Default Description as unsignedInt Our AS cluster id IP4Addr Our cluster ID comment string Comment 1d IP4Addr Our router ID log NMTOKEN Not logging Log events name string Name source string Source of data used in automated config management table unsignedByte 0 99 0 Routing table number routetable Table G 41 bgp Elements Element Type Instances Description peer bgppeer Optional up to 50 List of peers neighbours G 2 33 bgppeer BGP peer definitions The peer definition specifies the attributes of an individual peer Multiple IP addresses can be specified typically for IPv4 and IPv6 addresses for the same peer but this can be used for a group of similar peers Table G 42 bgppeer Attributes Attribute Type Default Description add own as boolean Add our AS on exported routes allow export boolean Ignore no export community
204. te for undated access based on local time This means a graph URL can be composed that is valid for a specific graph name for a specific day Note that an MDS can also be used instead but the SHA 1 is the preferred method F 2 Graph display options The graphs can have a number of options which define the colours text and layout These are defined as http form get attributes on the URL e g http host port cqm circuit png H a heading Note that they can also be included in the path before the graph name e g http host port cqm H a heading circuit png in which case they can be separated by rather than amp The attributes are processed in order F 2 1 Data points The data point controls can be included as either fieldname or fieldname colour To make a valid URL either escape the prefix or omit it If any of these are included then only those that are included are shown If just fieldname is specified then the default colour is applied The text on the right shows what fields are included and their colour key Table F 2 Colours Key Colour Defines colour for minimum latency Defines colour for average latency Defines colour for max latency Defines colour for upload rate Defines colour for download rate Defines colour for sent echos Defines colour for rejected echos Defines colour for failed no response echos Oo a So ole lt gt z Defines colour for off line
205. tee aur ia 71 15 Command Line Interfaces yenno telares dota a Aeboadoweece tase dosed seth oas Sea loreto dencia 72 A CIDR and CIDR Notation ci thee ta eed ish ee ha He eda Sed Le echt 73 B MAC Addresses US age ost saesisghveddesyleondssd tati Ains 75 Cy VISANS A primer sisi sen ce dives ii A 77 D Supported RADIUS Attribute Value Pairs for VoIP operation oooccoccnnccnnccnnconnconnconocnnacnnccnnroninnnos 78 D1 Authentication Te quest A eee a Seed is d 78 D2 Authentication TESpONSE sy coset eorne ornen Soapsoun EE oases somes Nito ERPS AEE peo e ede pne 79 D 2 1 Challenge authentication siirre eee ccc c cence ee E ES ANET EET REESS 79 D 2 2 Accepted authentication registration oooconccnnccnnnnnncnnoronccnnccnnccnnccnnccnnccnnconncinncos 79 D 2 3 Accepted authentication invite ocooonocononocononocononocononocononocononoronnoconroronanoronos 79 D 2 4 Rejected authentication mu disse tenerse esd ple brea cea teens 80 Di ACCOUDEMS Start AA R S 80 DAs ACCOUNTING Interim orenian e dacete E tee eventd oes anb leew ee a a e a stage aes 80 DS Accounting Stop coterie dealt ee ER A A 81 vil www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6502 User Manual DO DISCOMNE 0 EA AE AE OEE ae rai nice 81 D 7 Change of AuthoriSatlOM ecc iio 82 E Command line TeferenCe imgerr A a aa AR ae ia 83 EL General commands a AE tibios 83 ETT TRACE OA A A AA AA AAO 83 E
206. tes Attribute Type Default Description comment string Comment force boolean Send even if not requested id unsignedByte Not optional Attribute type code name string Name value string Not optional Value vendor boolean Add as vendor specific option under option 43 G 2 26 dhcp attr number DHCP server attributes numeric Additional DHCP server attributes numeric Table G 34 dhcp attr number Attributes Attribute Type Default Description comment string Comment force boolean Send even if not requested id unsignedByte Not optional Attribute type code name string Name value unsignedInt Not optional Value vendor boolean Add as vendor specific option under option 43 G 2 27 dhcp attr ip DHCP server attributes IP Additional DHCP server attributes IP www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 109 Configuration Objects Table G 35 dhcp attr ip Attributes Attribute Type Default Description comment string Comment force boolean Send even if not requested 1d unsignedB yte Not optional Attribute type code name string Name value IP4Addr Not optional Value vendor boolean Add as vendor specific option under option 43 G 2 28 route Static routes Static routes define prefixes which are permanently in the routing table and
207. the allow list if specified log The standard log log error and log debug settings can be used to specified levels of logging for the service A locally attached subnet is one which can be directly reached via one of the defined interfaces i e is not accessed via a gateway Tip Address ranges in allow can be entered using either lt first address gt lt last_address gt syntax or using CIDR notation lt start address gt lt prefix length gt If a range entered using the first syntax can be expressed using CIDR notation it will be automatically converted to that format when the configuration is saved You can also use name s of defined IP address group s which are pre defined ranges of IPs 10 3 HTTP Server configuration The HTTP server s purpose is to serve the HTML and supporting files that implement the web based user interface for the FB6000 It is not a general purpose web server that can be used to serve user documents and so there is little to configure 10 3 1 Access control By default the FB6000 will allow access to the user interface from any machine although obviously access to the user interface normally requires the correct login credentials to be provided However if you have no need for your FB6000 to be accessed from arbitrary machines then you may wish to lock down access to the user interface to one or more client machines thus removing an attack vector Access can be restricte
208. the IP packets used for VoIP It does not get involved in converting sound to or from packets of data but in passing those packets of data between VoIP devices and carriers The protocol involves complex sequences of messages for control and authentications which the FB6000 handles 13 2 Registration and Proxies One of the common confusions with SIP VoIP is the way registrations work 13 2 1 Registrar A SIP device can register with a service e g with the FB6000 or with a SIP carrier This is like logging in and means that incoming calls are then sent to the device The device will renew the registration periodically to stay logged in and if it fails to do this then incoming calls will fail This process uses a username and password for security Obviously you also have to say where to register the proxy specifies IP address or host name of the SIP service with which you are registering and the registrar defines the hostname to use in the registration This process works well if the service does not have a fixed idea of where you are which is normally the case for SIP handsets Even on a local network the IP of the handset will normally be dynamically allocated with DHCP and for a SIP carrier the IP could be anywhere in the world Note It is possible to have a VoIP carrier that does have a pre set idea of where calls are to be sent and sends the calls without registration In this case there is no registration process but the hand
209. tica a eee eee ROE eee ened dees 118 62 42 voip Voiceover IP COMPILE f2 5 1598 5 45 esas se Ee e a E E E Eaa RSSa S 118 6 243 carrier VolP carrier details cocoa Ie tea ead eed eee 120 G 2 44 telephone VoIP telephone authentication user details 1 0 0 0 eee eee ee ee eeee 121 G 2 45 tone Tone definitions ccoooccnooccnnnccnnnocnnnccnnnnconnnncnonccnnnnccnnrnnnncccnnncconicnnnns 122 G 2 46 ring sroup Ring STOUPS essien adn iris AA E nets 122 G3 Data pes A A A E hte Sa cht es 123 ix www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6502 User Manual G 3 1 autoloadtype Type of s w auto load ooocooocnnccnnccnncnnoconccnnccnnccnnccnnccnnconnconaconncos 123 G 3 2 config access Type of access user has to Config cooocccncnnccnnccnnccncconccnnconnconnccnncons 123 Gi3 3 user l vel User login level critico its metileno tase suede EE E aE IES 123 G 3 4 syslog severity Syslog severity oooooccoccccccnccnnccnnconnconncnnncnnnconncnnncnnncnnccnnronicnnns 124 G 3 5 syslog facility Syslog facility oooooocccnccnccnnccnoconoconnconnconnconoconncnnncnnncnnrcnaronnss 124 G 3 6 month Month name 3 letter 2 0 0 0 cece ccc cece cece ee ee nese ee ee eee eceeeeeeeneeeeeeaeeeeneaees 125 63 7 day Day name 3 letter sc s3scc veces ses seeteeoy e dase E ae pone E RE 125 G 3 8 radiuspriority Options for controlling platform RADIUS response priority tagging 126 G
210. time duration 30 Include overflow after this time at head of queue profile NMTOKEN Profile name progress time duration 6 Time between each target called redirect boolean Allow calls to be diverted before ringing ring List of string Numbers to ring ringall time duration Switch to ring all after this time at head of queue source string Source of data used in automated config management type ring group type all Type of ring when one call in queue G 3 Data types G 3 1 autoloadtype Type of s w auto load Table G 60 autoloadtype Type of s w auto load Value Description false Do no auto load factory Load factory releases beta Load beta test releases alpha Load test releases G 3 2 config access Type of access user has to config Table G 61 config access Type of access user has to config Value Description none No access unless explicitly listed view View only access no passwords read Read only access with passwords full Full view and edit access G 3 3 user level User login level User login level commands available are restricted according to assigned level 123 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects Table G 62 user level User login level Value Description NOBODY Unknown or not logged in user GUEST Guest user USER Normal unprivileged user
211. timeout E config E level Login idle timeout zero to stay logged in Config access level Login level 5 00 full ADMIN E allow Tip You may also want to increase the login session idle time out from the default of 5 minutes especially if you are unfamiliar with the user interface To do that tick the checkbox next to timeout and enter an appropriate value as minutes colon and seconds e g 15 00 for 15 minutes Click on the Save button near the top of the screen which will save a new configuration that includes your new user definition You should now see a page showing the progress of storing the new configuration in Flash memory Figure 2 4 Configuration being stored Loading config No errors found Erasing flash page Programming flash page Flashed 1789 bytes Config loaded Please login to make any further changes Login On this page there is a Login link in red text click on this link and then log in using the username and password you chose We recommend you read Chapter 3 to understand the design of the FB6000 s user interface and then start working with your FB6000 s factory reset configuration Once you are familiar with how the user interface is structured you can find more detail on setting up users in Section 4 1 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 3 Configuration 3 1 The Object Hierarchy The FB6000 has at its core a confi
212. tings ooocoooccnccnncnnncnnncnnccnnconnconnccnnccnnccnnconnconncos 100 G 2 12 dns service DNS service SettidgS osson orehan oseon Ee Se VEES EErEE 100 G 2 13 dns host Fixed local DNS host settings ocooccooccccccnccnnconoconnccnnccnnconaconncnnncnnnos 101 G 2 14 dns block Fixed local DNS blocks ooocoooconcccncccnccnnccnoconccnnccnnccnnccnnccnnconncnnnoos 101 G 2 15 radius service RADIUS service definition oooconoccnccnnncnnncnnncnononaconccnnconnccnncons 102 G 2 16 radius service match Matching rules for RADIUS service ooocccoccnnconnccnnconncnnns 103 G 2 17 radius server RADIUS server settings ooocoooccnccnccnnocnnocnnccnnconnconnccnnconnconaconicos 104 G 2 18 ethernet Physical port controls oooocconcnccnnccnnccnnccnnconnconnconnconnconncnnacnnnnnnncnose 104 G 2 19 portdef Port grouping and naming oooccnnccnnconnconeconnconncononnncnnnrnnncnnccnnccnnccnnioos 105 G 2 20 interface Port group VLAN interface settings oocoooccnnccnnconoconconacnnacnnocnnccnncnnos 105 62 21 subnet S bnet Senos isis oi laa ee Mie td ia 106 G 2 22 SS A O AO 107 G 2 23 dhcps DHCP server settings seniii a E R E E E TE EEN S 108 G 2 24 dhcp attr hex DHCP server attributes hex oooooococononcconococononoconococononoconanoconos 108 G 2 25 dhcp attr string DHCP server attributes string ooooccnoccnnconoconccnnccnnncnnncnanonono 109 G 2 26 dhcp attr number DHCP server attributes numeric occoococcnon
213. tional unlimited Syslog settings G 2 5 log syslog Syslog logger settings Logging to a syslog server www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 96 Configuration Objects Table G 9 log syslog Attributes Attribute Type Default Description comment string Comment facility syslog facility LOCALO Facility setting port unsignedShort 514 Server port profile NMTOKEN Profile name server IPNameAddr Not optional Syslog server severity syslog severity NOTICE Severity setting source string Source of data used in automated config management source ip IPAddr Use specific source IP table unsignedByte 0 99 0 Routing table number for sending syslogs routetable G 2 6 log email Email Logging to email Table G 10 log email Attributes logger settings Attribute Type Default Description comment string Comment delay duration 1 00 Delay before sending since first event to send from string One made up using Source email address serial number hold off duration 1 00 00 Delay before sending since last email log NMTOKEN Not logging Log emailing process log debug NMTOKEN Not logging Log emailing debug log error NMTOKEN Not logging Log emailing errors port unsignedShort 25 Server port profile NMTOKEN Profile name retry duration 10 00 Delay before sending s
214. to guide FB6000 owners in configuring their units for their specific applications We try to make no significant assumption about the reader s knowledge of FireBrick products but as might be expected given the target market for the products it is assumed the reader has a reasonable working knowledge of common IP and Ethernet networking concepts So whether you ve used FireBrick products for years or have purchased one for the very first time and whether you re a novice or a network guru this Manual sets out to be an easy to read definitive guide to FireBrick product configuration for all FireBrick customers 1 2 3 Technical details There are a number of useful technical details included in the apendices These are intended to be a reference guild for key features 1 2 4 Document style At FireBrick we appreciate that different people learn in different ways some like to dive in hands on working with examples and tweaking them until they work the way they want referring to documentation as required Other people prefer to build their knowledge up from first principles and gain a thorough understanding of what they re working with Most people we suspect fall somewhere between these two learning styles This Manual aims to be highly usable regardless of your learning style material is presented in an order that starts with fundamental concepts and builds to more complex operation of your FireBrick At all stages we hope to provide a
215. tops the allocation being used for any other MAC address even if long expired E 2 9 Unlock DHCP allocations unlock dhcp ip lt IP4Addr gt table lt routetable gt Unlocks a DHCP allocation allowing the address to be re used if the expired E 2 10 Name DHCP allocations name dhcp ip lt IP4Addr gt name lt string gt table lt routetable gt Allows you to set a name for a DHCP allocation overridding the clientname that was sent E 2 11 Show ARP ND status show arp show arp lt IPAddr gt Shows details of ARP and Neighbour discovery cache E 2 12 Show VRRP status show VELO Lists all VRRP in use and current status E 2 13 Send Wake on LAN packet wol interface lt string gt mac lt hexBinary gt Send a wake on LAN packet to a specific interface 86 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Command line reference E 2 14 Check access to services check access lt IPAddr gt table lt routetable gt Reports access control checks for a source address to various internal services This is separate from any firewalling E 3 BGP commands Note This command summary is not yet complete please see www firebrick co uk for details E 4 VoIP commands Note This command summary is not yet complete please see www firebrick co uk for details E 5 Advanced commands Some com
216. u under the Config main menu item then click on the Users category icon Click on the Edit link adjacent to the user you wish to edit or click on the Add link to add a user To delete a user click the appropriate Edit link then click the Erase button in the navigation controls see Figure 3 8 As with any such object erase operation the object will not actually be erased until the configuration is saved Once you have added a new user or are editing an existing user the object editing page will appear as shown in Figure 4 1 Figure 4 1 Setting up a new user Admin users user 1 of 1 Up New Erase Help User names passwords and abilities for admin users name E comment profile User name Comment Profile name password E full name E otp User password Full name OTP serial number E timeout E config E level Login idie timeout zero to stay logged in Config access level Login level 5 00 full ADMIN LECI Restrict logins to esses The minimum attributes that must be specified are name which is the username that you type in when logging in and password passwords are mandatory on the FB6000 You can optionally provide a full name for the specified username and a general comment field value 4 1 1 Login level A user s login level is set with the level attribute and determines what CLI commands the user can run The default if the level attribute is not specified is ADMIN you may
217. up Each port can operate simply as an interface with no VLANs or can have one or more tagged VLANs which are treated as separate logical interfaces Using VLAN tags and a VLAN capable switch you can effectively increase the number of physical ports If you are unfamiliar with VLANs or the concept of broadcast domains Appendix C contains a brief overview By combining the FB6000 with a VLAN capable switch using only a single physical connection between the switch and the FB6000 you can effectively expand the number of distinct physical interfaces with the upper limit on number being determined by switch capabilities or by inherent IEEE 802 1Q VLAN or FB6000 MAC address block size An example of such a configuration is a multi tenant serviced office environment where the FB6000 acts as an Internet access router for a number of tenants firewalling between tenant networks and maybe providing access to shared resources such as printers 6 2 Defining an interface To create or edit interfaces select the Interface category in the top level icons under the section headed Ethernet interface port group vlan and subnets you will see the list of existing interface top level objects if any and an Add link The primary attributes that define an interface are the name of the physical port group it uses an optional VLAN ID and an optional name If the VLAN ID is not specified it defaults to 0 which means only untagged packets will be r
218. ur preferred NTP server instead The NTP service is currently only an NTP client A future software version is likely to add NTP server functionality allowing other NTP clients typically those in your network to use the FB6000 as an NTP server Configuration of the NTP client service typically only requires setting the timeserver attribute to specify one or more NTP servers using either DNS name or IP address 10 7 SNMP configuration The SNMP service allows other devices to query the FB6000 for management related information using the Simple Network Management Protocol SNMP As with the HTTP server access can be restricted to e specific client IP addresses and or e clients connecting from locally attached Ethernet subnets only See Section 10 3 1 for details The SNMP service defaults to allowing access from anywhere The remaining SNMP service configuration attributes are community specifies the SNMP community name with a default of public e port specifies the port number that the SNMP service listens on this typically does not need setting as the default is the standard SNMP port 161 10 8 RADIUS configuration 10 8 1 RADIUS client RADIUS is used for authentication call routing and accounting for VoIP servcies Chapter 13 provides details of how RADIUS is used for VoIP Appendix D provides details of the specific AVPs used with RADIUS for VoIP 50 www voipon co uk sales voipon co uk Tel 44 0
219. utbound registration or inbound authenticated calls profile NMTOKEN Profile name proxy string Carrier proxy hostname or address for registration and calls registrar string Carrier hostname for registration 120 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects send hold boolean true Pass hold state to carrier source string Source of data used in automated config management source ip IPAddr Source IP to use table unsignedByte 0 99 0 Routing table number routetable to List of string To SIP request address for inbound invites may be domain for any at a domain trust cli boolean true Trust inbound calling line identity username string Carrier username for outbound registration or inbound authenticated calls withhold string Mark withheld outbound calls using this dial prefix and send CLI in remote party id G 2 44 telephone VoIP telephone authentication user details VoIP telephone details Table G 57 telephone Attributes Attribute Type Default Description allow List of Allow from List of IP ranges from which registration IPNameRange anywhere accepted allow pickup List of string Allow all if PABX Only allow pickup from these extensions mode allow subscribe List of string Only allow subscribe Busy Lamp Field from these extensions anon numeric boolean Mark anonymous calls just using w
220. ute associated with that object type Figure 3 5 shows an example for an interface object covered in Chapter 6 13 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Figure 3 5 Editing an Interface object MW comment 8 profile Comment Profile name m port 8 vian 8 mtu Port group name VLAN ID O untagged l arr MTU for this interface WAN y 0 8 ra client 8 ping Accept IPv6 RA and create auto config subnets and routes true 8 log error 8 log debug Log errors Log debug Log as event Not logging By default more advanced or less frequently used attributes are hidden if this applies to the object being edited you will see the text shown in Figure 3 6 The hidden attributes can be displayed by clicking on the link Show all Figure 3 6 Show hidden attributes There are additional attributes which have not been shown Show all Each brick in the wall contains the following e a checkbox if the checkbox is checked an appropriate value entry widget is displayed otherwise a default value is shown and applied for that setting If the attribute is not optional then no checkbox is show e the attribute name this is a compact string that exactly matches the underlying XML attribute name e a short description of the attribute Tip Tf there is no default shown for an attribute then its value if needed is zero blank null empty string false internally i
221. utes iras rs piro a ote potes 98 G 13 ntp Service Attributes oi ae 98 CA Attributes sisis oreuon ros esiri os easa Eo PERO PEE pT ESOR PESENE ES ES PETUERE PPS EE PEEPS 99 G 15 http service AA Esne EE E E EEEE EE EEA EEEE E EESE KASETE REEE EERS 100 G 16 dns service Attributes cocotero rasp catia oi bac E EE e EEA E E EE EE r EE EES 100 G 17 dns service Elements sirean ersero eea cso eas eE E E O NEE e EE EERE 101 xii www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 FireBrick FB6502 User Manual CAN NAAA copy tea ER phvae abode waesiss wien gear eee Use ENE EEEN a gee 101 G19 Sdns block Attributes cin da Shae tae Bee 101 G 20 radius s rvice Attributes costat d e dene oon ebth dador iii cierran 102 G21 radius service Elements aitor it 103 G 22 radi s servicez match Attributes ssena ane Sens eeby EEEE ys E ES E EEES E 103 6 23 tadi s seryei Att DUES iine a a E E a E a E E E E ates 104 G24 ethernet AttriButeS costal a A E E E a E ARES denon esos pias 105 E Pa rS ea A CERE oI EEEE a A A 105 G 26 Interlace AUMIDULES soneron ya e a deep EA EEE EE RNE E e EER ober SAE E Y 105 5 27 interface Elemental o aces Gee abe eae Ls ee 106 G28 subnet Attributes tosis nc iseertee ites a E doen stem aden gnas adel ect E dos AE O NE e EET 106 G95 Virps ATIDULES it di rn IO E dio peace E EA 107 G30 dhcps gt Atte DUtes arco ira ropita sra 108 E 31 dheps Elements iii e E R cleat eee Sa ub a
222. uting logic described above operates using one of possibly many routing tables that the FB6000 can support simultaneously Routing tables are numbered with the default being routing table 0 zero The various ways to add routes allow the routing table to be specified and so allow completely independent routing for different routing tables The default table table zero is used when optional routing table specification attributes or CLI command parameters are omitted Each interface is logically in a routing table and traffic arriving on it is processed based on the routes in that routing table Tunnels like FB105 and L2TP allow the wrapped tunnel packets to work on one routing table and the tunnel payload packets to be on another Routing tables can be very useful when working with tunnels of any sort placing the wrappers in one routing table allowing DHCP clients and so on without taking over the default route for all traffic The payload can then be in the normal routing table 0 7 5 Bonding A key feature of the FB6000 is the ability to bond multiple links at a per packet level Bonding works with routing and shapers together See Chapter 9 for details of shapers The basic principle is that you have two or more routes that are identical same target IP prefix and have the same localpref so that there is nothing to decide between them As described above this normally means one of the routes is picked However where the two or m
223. ve a single MAC address for all operations However practical experience has led to the use of multiple MAC addresses on the FireBrick A unique block of addresses is assigned to each FireBrick with the size of the block dependent on the model Most of the time FB6000 users do not need to know what MAC addresses the product uses However there are occasions where this information is useful such as when trying to identify what IP address a DHCP server has allocated to a specific FB6000 For information on how MAC addresses are used by the FB6000 please refer to this article on the FireBrick website http www firebrick co uk fb2700 mac php The label attached to the bottom of the FB6000 shows what MAC address range that unit uses using a compact notation as highlighted in Figure B 1 Figure B 1 Product label showing MAC address range FireBrick FB2x00 E E aC 3 mu Made in UK e Serial 2X00 XXXX XXXX Bee 110 240VAC 50 60Hz 0 2 0 TA In this example the range is specified as 000397 147C F this is interpreted as e All addresses in the range start with 00 03 97 14 7 e the next digit then ranges from C through to F e the first address in the range has zero for the remaining digits C 00 e the last address in the range has F for the remaining digits F FF Therefore this range spans 00 03 97 14 7C 00 to 00 03 97 14 7F FF inclusive 1024 addresses If you trying to identify an IP address allocation note that
224. ved To create a new subnet click on the Add link to take you to a new subnet object defintion Tick the ip checkbox and enter the appropriate CIDR notation Editing an existing subnet works similarly click the Edit link next to the subnet you want to modify 6 2 1 1 Using DHCP to configure a subnet You can create a subnet that is configured via DHCP by clearing the ip checkbox the absence of an IP address prefix specification causes the FB6000 to attempt to obtain an address from a DHCP server which must be in the same broadcast domain It may help to use the Comment field to note that the subnet is configured via DHCP In its simplest form a DHCP configured subnet is created by the following XML lt subnet gt 34 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Interfaces and Subnets Tip It is possible to specify multiple DHCP client subnets like this and the FB6000 will reserve a separate MAC address for each This allows the FB6000 to aquire multiple independant IP addresses by DHCP on the same interface if required 6 2 2 Setting up DHCP server parameters The FB6000 can act as a DHCP server to dynamically allocate IP addresses to clients Optionally the allocation can be accompanied by information such as a list of DNS resolvers that the client should use Since the DHCP behaviour needs to be defined for each interface specifically each broadcast domain the behav
225. ver is irc z je and the channel is Hfirebrick 1 3 3 Application Notes FireBrick are building a library of Application Note documents that you can refer to each Application Note describes how to use and configure a FireBrick in specific scenarios such as using the device in a multi tenant Serviced Office environment or using the FireBrick to bond multiple WAN connections together 1 3 4 White Papers FireBrick White Papers cover topics that deserve specific discussion they are not related to specific Applications rather they aim to educate interested readers regarding networking protocols common best practice and real world issues encountered www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Introduction 1 3 5 Training Courses FireBrick provide training courses for the FB2x00 series products and also training course on general IP networking that are useful if you are new to networking with IP To obtain information about upcoming courses please contact us via e mail at training firebrick co uk www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 2 Getting Started 2 1 IP addressing You can configure your FireBrick using a web browser to do this you need IP connectivity between your computer and the FireBrick For a new FB6000 or one that has been factory reset there are three methods to set this up as described below se
226. ware downloads website http www firebrick co uk software php PRODUCT 6000 onto your PC The next step is the same as you would perform when manually initiating an Internet based upgrade i e you should browse to the main Status page where if there is new software is available you will be informed of this as shown in Figure 4 2 This step is necessary since the manual upgrade feature currently shares the page used for Internet based manual upgrades which is reached by clicking Upgrade available link After clicking this link you will find the manual upgrade method at the bottom of the page as shown in Figure 4 3 Figure 4 3 Manual Software upload Manual software upload WRAS asenon CODES Use this to upgrade software for the boot loader or main application as required Tick the box to force a reboot once new software is loaded 4 4 Boot Process The FB6000 contains internal Flash memory storage that holds two types of software e main application software generally referred to as the app e a bootloader runs immediately on power up initialises system and then loads the app It is possible for only one of these types of software or neither of them to be present in the Flash but when shipped from the factory the unit will contain a bootloader and the latest factory release application software The FB6000 can store multiple app software images in the Flash and this is used with an automatic fall back mechanism if a
227. well written description of how to configure each aspect of the FireBrick and where necessary provide enough insight into the FireBrick s internal operation that you understand why the configuration achieves what it does 1 2 5 Document conventions Various typefaces and presentation styles are used in this document as follows e Text that would be typed as is for example a command or an XML attribute name is shown in monospaced_font Program including XML listings or fragments of listings are shown thus this is an example program listing printr mello World Vm e Text as it would appear on screen is shown thus This is an example of some text that would appear on screen Note that for documentation purposes additional line breaks may be present that would not be in the on screen text www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Introduction e Notes of varying levels of significance are represented thus colour schemes may differ depending on signficance Note This is an example note The significance is identified by the heading text and can be one of Tip general hints and tips for example to point out a useful feature related to the current discussion Note a specific but not critical point relating to the surrounding text Caution a potentially critical point that you should pay attention to failure to d
228. whether these should be announced by routing protocols or not Table G 36 route Attributes Attribute Type Default Description bgp bgpmode BGP announce mode for routes comment string Comment gateway List of IPAddr Not optional One or more target gateway IPs graph token graphname Graph name ip List of IPPrefix Not optional One or more network prefixes localpref unsignedInt 4294967295 Localpref of network highest wins name string Name profile NMTOKEN Profile name source string Source of data used in automated config management speed unsignedInt Egress rate limit b s table unsignedByte 0 99 0 Routing table number routetable G 2 29 network Locally originated networks Network blocks that are announced but not actually added to internal routes note that blackhole and nowhere objects can also announce but add routing Table G 37 network Attributes www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Attribute Type Default Description as path List up to 10 Custom AS path as if network received unsignedInt bgp bgpmode true BGP announce mode for routes comment string Comment ip List of IPPrefix Not optional One or more network prefixes localpref unsignedInt 4294967295 Localpref of network highest wins name string Name 110 Configuration Objects
229. will swap Receive and Transmit pairs if required to adapt to cable link partner configuration The green port LED is configured to show combined Link Status and Activity indication the LED will be off if no link is established with a link partner When a link is established at any speed the LED will be on steady when there is no activity and will blink when there is activity e The yellow port LED is configured to show Transmit activity When you first create an ethernet object you will see that none of the attribute checkboxes are ticked and the defaults described above apply Ensure that you set the port attribute value correctly to modify the port you intended to The FB6000 configuration contains a number of port settings which are not possible and will not save e g 10M and 100M modes These are included for compatibility with FB2500 and FB2700 products The FB6000 only operates at gigabit port speeds 6 3 1 Setting duplex mode If auto negotiation is enabled the FB6000 port will normally advertise that it is capable of either half or full duplex operation modes if you have reason to restrict the operation to either of these modes you can set the duplex attribute to either half or full This will cause the port to only advertise the specified mode if the auto negotiate capable link partner does not support that mode the link will fail to establish If auto negotiation is disabled the duplex attribute simply sets the
230. wish to downgrade the level for users who are not classed as system administrators 20 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 System Administration Table 4 1 User login levels Level Description NOBODY No access to any menu items GUEST Guest user access to some menu items USER Normal unprivileged user ADMIN System administrator DEBUG System debugging user 4 1 2 Configuration access level The configuration access level determines whether a user has read only or read write access to the configuration as shown in Table 4 2 below This mechanism can also be used to deny all access to the configuration using the none level but still allowing access to other menus and diagnostics This setting is distinct from and not connected with the login level described above You can use the access level to define for example whether a USER login level user can modify the configuration Typically an ADMIN or DEBUG login level user would always be granted full access so for ADMIN or DEBUG level user s the default of fu11 is suitable Table 4 2 Configuration access levels Level Description none No access unless explicitly listed view View only access no passwords read Read only access with passwords full Full view and edit access DEFAULT 4 1 3 Login idle timeout To improve security login sessions to e
231. ww voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 VoIP 1000Hz 1000Hz Tip Accessing a url on the FireBrick of voip ring wav serves a WAV format of the tone You can test tones using a URL like voip tone wav 100ms 1000Hz 200ms 2000Hz but ensure you URL escape the query string 66 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Chapter 14 BGP 14 1 What is BGP BGP Border Gateway Protocol is the protocol used between ISPs to advise peers of routes that are available Each ISP tells its peers the routes it can see being the routes it knows itself and those that it has been advised by other peers In an ideal world everyone would tell everyone else the routes they can see there would be almost no configuration needed all packets would find the best route accross the Internet automatically To some extent this is what happens between major transit providers in the Internet backbone In practice things are not that simple and you will have some specific relationships with peers when using BGP For most people there will be transit providers with which you peer You can receive a full table from each transit provider containing routes to everywhere in the Internet via that provider The FB6000 can then decide which provider has the best route to any destination You can advise the transit provider of your own routes for your own network so that they c
232. ximum final timeout min timeout duration 5 Minimum final timeout name string Name port unsignedShort From services radius UDP port settings profile NMTOKEN Profile name queue unsignedInt Concurrent requests over all of these servers per type scale timeout unsignedByte 2 Timeout scaling factor secret Secret Not optional Shared secret for RADIUS requests source string Source of data used in automated config management table unsignedByte 0 99 Routing table number routetable type Set of radiustype All Server type G 2 18 ethernet Physical port controls Physical port attributes 104 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects Table G 24 ethernet Attributes Attribute Type Default Description autoneg boolean auto negotiate unless Perform link auto negotiation manual 10 100 speed and duplex are set clocking LinkClock prefer slave Gigabit clock setting crossover Crossover auto Port crossover configuration duplex LinkDuplex auto Duplex setting for this port flow LinkFlow none Flow control setting green LinkLED g Link Activity Green LED setting optimise boolean true enable PHY optimisations port port Not optional Physical port power saving LinkPower full enable PHY power saving send fault LinkFault Send fault status shutdown boolean false Power down this port speed LinkSpeed
233. you read this section if you are unfamiliar with the FB6000 so that you feel comfortable with the design of the User Interface Later chapters cover specific functionality topics describing which objects are relevant any underlying operational principles that are useful to understand and what effect the attributes and their values have The web based User Interface provides a method to create the objects that control operation of the FB6000 Internally the User Interface uses a formal definition of the object model to determine where in the hierarchy objects may be created and what attributes may exist on each object so you can expect the User Interface to always generate valid XML i If the User Interface does not generate valid XML i e when saving changes to the configuration the FireBrick reports XML errors then this may be a bug please check this via the appropriate support channel s 10 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Additionally the web User Interface provides access to the following items e status information such as DHCP server allocations FB105 tunnel information and system logs e network diagnostic tools such as Ping and Traceroute there are also tools to test how the FB6000 will process particular traffic allowing you to verify your firewalling is as intended e traffic graphs By default access to the web user interface is ava
234. yte Pad prefix stuff our AS on export by this many can be zero to not send our AS 114 www voipon co uk sales voipon co uk Tel 44 0 1245 808195 Fax 44 0 1245 808299 Configuration Objects prefix List of 1PFilter Prefixes that this rule applies to source string Source of data used in automated config management tag List of Community List of community tags to add G 2 36 cqm Constant Quality Monitoring settings Constant quality monitoring graphs and data have a number of settings Most of the graphing settings can be overridden when a graph is collected so these define the defaults in many cases Table G 47 cqm Attributes Attribute Type Default Description ave Colour 08f Colour for average latency axis Colour black Axis colour background Colour white Background colour bottom unsignedByte 11 Pixels space at bottom of graph dateformat string Y Yom od Date format dayformat string Joa Day format fail Colour red Colour for failed dropped seconds fail level unsignedInt 1 Fail level not expected on low usage fail levell unsignedByte 3 Loss level 1 fail level2 unsignedByte 50 Loss level 2 fail score unsignedByte 200 Score for fail and low usage fail scorel unsignedB yte 100 Score for on above level 1 fail score2 unsignedB yte 200 Score for on above level 2 fail usage unsignedInt 128

FireBrick FB6502 User Manual

Contents

Download Pdf Manuals

Related Search

Related Contents