30 Cyclades™ ACS 6000 Advanced Console Server Installation/Administration/User Guide
Usage
Click System - Usage to view memory and Flash usage.
Network
Click Network to view and configure the network options for Hostname, DNS, IPv6, Bonding,
IPv4 and IPv6 static routes, Hosts, Firewall, IPSec (VPN) and SNMP.
Settings
Click Network - Settings to make changes to the configured network settings: Hostname, DNS,
Bonding, IPv4 Multiple Routing Table.
NOTE: IPv4 Multiple Routing Table allow administrator to configure two networks one for each interface (EHT0 and ETH1) with its own default gateway.
Devices
An administrator can select, enable and configure the IP addresses assigned to the network interfaces and view the MAC address. Besides the two standard Ethernet interfaces, the list of network interfaces includes entries for any Ethernet PC cards that may be installed.
To configure a network device:
1.
Select Network - Devices. The Devices screen appears with a list of network interfaces and their status (enabled or disabled).
2.
Click the name of the network device to configure.
3.
Select the status (either Enabled or Disabled) from the drop-down menu.
4.
Select one of the following IPv4 method options:
• Select DHCP to have the IPv4 IP address set by the DHCP server.
• Select Static to enter the IPv4 IP address, subnet mask and gateway address manually.
• Select IPv4 address unconfigured to disable IPv4.
5.
Select one of the following IPv6 method options:
• Select Stateless if the link is restricted to the local IP address.
• Select DHCPv6 to have the IPv6 IP address set by the DHCP server.
• Select Static to enter the IPv6 IP address and prefix length manually.
• Select IPv6 address unconfigured to disable IPv6.
6.
Select the Ethernet Mode for the built-in interface (ETH0 and ETH1).
Chapter 3: Accessing the Console Server via the Web Manager 31
NOTE: The MAC Address for the device will be displayed after this option.
NOTE: The following step is only active for mounted Ethernet PC cards.
7.
Enter the following Wireless LAN information: a.
Select MyPrivateNet (ESSID) to enter the unique identifier for the wireless access point.
b.
Select Channel to enter the communication channel with the access point.
c.
Select Encrypted to enable data encryption during transmission.
d.
Enter the key or password to decode incoming encrypted data, then click Save.
IPv4 and IPv6 static routes
To add static routes:
1.
Select Network - IPv4 Static Routes or IPv6 Static Routes. Any existing static routes are listed with their Destination IP/Mask, Gateway, Interface and Metric values shown.
2.
Click Add.
3.
Select Default to configure the default route.
-or-
Select Host IP Or Network to enter custom settings for Destination IP/Mask.
Enter the required Destination IP/Mask Bits with the syntax <destination IP>/<CIDR> in the Destination IP/Mask Bits field.
4.
Enter the IP address of the gateway in the Gateway field.
5.
Enter the number of hops to the destination in the Metric field, then click Save
Hosts
An administrator can configure a table of host names, IP addresses and host aliases for the local network.
To add a host:
1.
Select Network - Hosts.
2.
Click Add to add a new host.
3.
Enter the IP address, hostname and alias of the host you want to add, then click Save.
To edit a host:
1.
Select Network - Hosts.
2.
Click on the IP address of the hostname you want to edit.
32 Cyclades™ ACS 6000 Advanced Console Server Installation/Administration/User Guide
3.
Enter a new hostname and alias, as applicable, then click Save.
Firewall
Administrators can configure the console server to act as a firewall. By default, three built-in chains accept all INPUT, FORWARD and OUTPUT packets. Select the Add, Delete or Change
Policy buttons to add a user chain, delete user-added chains and to change the built-in chains policy. Default chains can have their policy changed (Change Policy) to accept or drop, but cannot be deleted. Clicking on the Chain Name allows you to configure rules for chains.
Firewall configuration is available by clicking on Network - Firewall. Separate but identical configuration screens are available from either the IPv4 Filter Table or IPv6 Filter Table menu options.
Only the policy can be edited for a default chain; default chain policy options are ACCEPT and DROP.
When a chain is added, only a named entry for the chain is created. One or more rules must be configured for a chain after it is added.
Configuring the firewall
For each rule, an action (either ACCEPT, DROP, RETURN, LOG or REJECT ) must be selected from the Target pull-down menu. The selected action is performed on an IP packet that matches all the criteria specified in the rule.
If LOG is selected from the Target pull-down menu, the administrator can configure a Log
Level, a Log Prefix and whether the TCP sequence, TCP options and IP options are logged in the Log Options Section.
If REJECT is selected from the Target pull-down menu, the administrator can select an option from the Reject with pull-down menu; the packet is dropped and a reply packet of the selected type is sent.
Protocol options
Different fields are activated for each option in the Protocol pull-down menu.
If Numeric is selected from the Protocol menu, enter a Protocol Number in the text field.
If TCP is selected from the Protocol menu, a TCP Options Section is activated for entering source and destination ports and TCP flags.
If UDP is selected from the Protocol menu, the UDP section is activated for entering source and destination ports.
Chapter 3: Accessing the Console Server via the Web Manager 33
Table 3.3: Firewall Configuration - TCP and UDP Options Fields
Field/Menu Option Definition
Source Port - or - Destination Port
A single IP address or a range of IP addresses.
TCP Flags
[TCP only] SYN (synchronize), ACK (acknowledge), FIN (finish), RST (reset),
URG (urgent) and PSH (push). The conditions in the pull-down menu for each flag are: Any, Set or Unset.
If ICMP is selected from the Protocol menu, the ICMP Type pull-down menu is activated.
If an administrator enters the Ethernet interface (eth0 or eth1) in the input or output interface fields and selects an option (2nd and further packets, All packets and fragments or
Unfragmented packets and 1st packets) from the Fragments pull-down menu, the target action is performed on packets from or to the specified interface if they meet the criteria in the selected
Fragments menu option.
To add a chain:
1.
Select Network - Firewall.
2.
Select either IPv4 Filter Table or IPv6 Filter Table as needed.
3.
Click Add.
4.
Enter the name of the chain to be added.
5.
Click Save.
NOTE: Spaces are not allowed in the chain name.
6.
Add one or more rules to complete the chain configuration.
To change the policy for a default chain:
NOTE: User-defined chains cannot be edited. To rename a user-added chain, delete it and create a new one.
1.
Select Network - Firewall.
2.
Select either IPv4 Filter Table or IPv6 Filter Table as needed.
3.
Select the checkbox next to the name of the chain you want to change (FORWARD,
INPUT, OUTPUT).
4.
Click Change Policy and select Accept or Drop from the drop-down menu.
5.
Click Save.
To add a rule:
1.
Select Network - Firewall.
34 Cyclades™ ACS 6000 Advanced Console Server Installation/Administration/User Guide
2.
Select either IPv4 Filter Table or IPv6 Filter Table as needed.
3.
From the chain list, click the name of the chain you want to add a rule to.
4.
Click Add and configure the rule as needed, then click Save.
To edit a rule:
1.
Select Network - Firewall.
2.
Select either IPv4 Filter Table or IPv6 Filter Table as needed.
3.
From the chain list, click the name of the chain with the rule you want to edit.
4.
Select the rule you want to edit and click Edit.
5.
Modify the rule as needed and click Save.
IPSec(VPN)
Virtual Private Network (VPN) enables a secure communication between the console server and a remote network by utilizing a gateway and creating a secured connection between the console server and the gateway. The IPSec protocol is used to construct the secure tunnel and provides encryption and authentication services at the IP level of the protocol stack.
NOTE: IPSec(VPN) is not supported with IPv6.
When Network - IPSec(VPN) is selected, the IPSec(VPN) screen is displayed.
Use the Add button to add a VPN connection or click on an existing connection name to edit one already in the list. Click the Delete button to delete an existing connection. If NAT settings need to be changed, click the Configure NAT button.
When you click the Add button, the IPSec(VPN) - Add screen is displayed.
NOTE: To run IPSec (VPN), you must enable IPSec under the custom Security Profile.
The remote gateway is referred to as the remote or right host and the console server is referred to as the local or left host. If left and right are not directly connected, then you must also specify a NextHop IP address.
The next hop for the remote or right host is the IP address of the router to which the remote host or gateway running IPSec sends packets when delivering them to the left host. The next hop for the left host is the IP address of the router to which the console server sends packets to for delivery to the right host.
A Fully Qualified Domain Name should be indicated in the ID fields for both the Local (Left) host and the Remote (Right) host where the IPSec negotiation takes place.
