-
Cisco Secure Router 520 Series Software Configuration Guide
-
Index
-
Preface
- Part 1: Getting Started
-
Part 2: Configuring Your Router for Ethernet and DSL Access
-
Sample Network Deployments
-
Configuring PPP over Ethernet with NAT
-
Configuring PPP over ATM with NAT
-
Configuring a LAN with DHCP and VLANs
-
Configuring a VPN Using Easy VPN and an IPSec Tunnel
-
Configuring VPNs Using an IPSec Tunnel and Generic Routing Encapsulation
-
Configuring a Simple Firewall
-
Configuring a Wireless LAN Connection
-
- Part 3: Configuring Additional Features and Troubleshooting
- Part 4: Reference Information
-
Feedback
Table Of Contents
Viewing the Default Configuration
Information Needed for Customizing the Default Parameters
Configure Fast Ethernet LAN Interfaces
Configure the Fast Ethernet WAN Interface
Configure the ATM WAN Interface
Configure the Wireless Interface
Configuring a Loopback Interface
Configuring Command-Line Access to the Router
Basic Router Configuration
The Cisco Secure Router 520 Series routers are designed for small businesses with up to 50 users and teleworkers who want secure connectivity to corporate LANs and to the Internet. These routers provide advanced security features that include secure Virtual Private Network (VPN) access and comprehensive threat defense with Cisco IOS Firewall, Intrusion Prevention Solution (IPS), and URL filtering. The Cisco Secure Router 520 Series routers also provide dynamic routing and advanced quality of service (QoS) features.
The Cisco Secure Router 520 Series routers complement the Cisco Unified Communications 500 Series router and the Cisco Smart Business Communications System (SBCS) portfolio. As part of the SBCS portfolio, the Cisco Secure Router 520 Series routers deliver a common user experience through integration with the Cisco Configuration Assistant, Cisco Smart Assist, Cisco Monitor Manager, and Cisco Monitor Director.
This chapter provides procedures for configuring the basic parameters of your Cisco router, including global parameter settings, routing protocols, interfaces, and command-line access using the CLI. It also describes the default configuration at startup.
Note
Individual router routers may not support every feature described throughout this guide. Features not supported by a particular router are indicated whenever possible.
This chapter contains the following sections:
•
•
Each section includes a configuration example and verification steps, as available.
For complete information on how to access global configuration mode, see the "Entering Global Configuration Mode" section in Appendix A, "Cisco IOS Basic Skills." For more information on the commands used in the following tables, see the Cisco IOS Release 12.3 documentation set.
Viewing the Default Configuration
When the router first boots up, some basic configuration has already been performed. All of the LAN and WAN interfaces have been created, console and VTY ports are configured, and the inside interface for Network Address Translation has been assigned.
To view the default configuration, follow these steps:
Step 1
Step 2
Information Needed for Customizing the Default Parameters
You need to gather some or all of the following information, depending on your planned network scenario, prior to configuring your network.
•
–
–
–
–
•
–
–
–
•
–
–
–
–
AAL5SNAP—This can be either routed RFC 1483 or bridged RFC 1483. For routed RFC 1483, the service provider must provide you with a static IP address. For bridged RFC 1483, you may use DHCP to obtain your IP address, or you may obtain a static IP address from your service provider.
AAL5MUX PPP—With this type of encapsulation, you need to determine the PPP-related configuration items.
•
–
Once you have collected the appropriate information, you can perform a full configuration on your router, beginning with the tasks in the "Configuring Basic Parameters" section.
Interface Port Labels
Table 1-1 lists the interfaces supported for each router and their associated port labels on the equipment.
Configuring Basic Parameters
To configure the router, perform one or more of these tasks:
•
•
•
A configuration example is presented with each task to show the network configuration following completion of that task.
Configure Global Parameters
Perform these steps to configure selected global parameters for your router:
For complete information on the global parameter commands, see the Cisco IOS Release 12.3 documentation set.
Configure Fast Ethernet LAN Interfaces
The Fast Ethernet LAN interfaces on your router are automatically configured as part of the default VLAN and as such, they are not configured with individual addresses. Access is afforded through the VLAN. You may assign the interfaces to other VLANs if desired. For more information about creating VLANs, see Chapter 5, "Configuring a LAN with DHCP and VLANs."
Configure WAN Interfaces
The Cisco Secure Router 520 Ethernet-to-Ethernet routers have one Fast Ethernet interface for WAN connection. The Cisco Secure Router 520 ADSL-over-POTS and Cisco Secure Router 520
ADSL-over-ISDN routers have one ATM interface for WAN connection.Based on the router you have, configure the WAN interface(s) by using one of the following procedures:
•
•
Configure the Fast Ethernet WAN Interface
This procedure applies only to the Cisco Secure Router 520 Ethernet-to-Ethernet routers. Perform these steps to configure the Fast Ethernet interface, beginning in global configuration mode:
Configure the ATM WAN Interface
This procedure applies only to the Cisco Secure Router 520 ADSL-over-POTS and Cisco Secure Router 520 ADSL-over-ISDN routers.
Perform these steps to configure the ATM interface, beginning in global configuration mode:
Configure the Wireless Interface
The wireless interface enables connection to the router through a wireless LAN connection. For more information about configuring a wireless connection, see Chapter 9, "Configuring a Wireless LAN Connection," and the Cisco Access Router Wireless Configuration Guide.
Configuring a Loopback Interface
The loopback interface acts as a placeholder for the static IP address and provides default routing information.
For complete information on the loopback commands, see the Cisco IOS Release 12.3 documentation set.
Perform these steps to configure a loopback interface, beginning in global configuration mode:
Configuration Example
The loopback interface in this sample configuration is used to support Network Address Translation (NAT) on the virtual-template interface. This configuration example shows the loopback interface configured on the Fast Ethernet interface with an IP address of 200.200.100.1/24, which acts as a static IP address. The loopback interface points back to virtual-template1, which has a negotiated IP address.
!interface loopback 0ip address 200.200.100.1 255.255.255.0 (static IP address)ip nat outside!interface Virtual-Template1ip unnumbered loopback0no ip directed-broadcastip nat outside!Verifying Your Configuration
To verify that you have properly configured the loopback interface, enter the show interface loopback command. You should see verification output similar to the following example.
Router# show interface loopback 0Loopback0 is up, line protocol is upHardware is LoopbackInternet address is 200.200.100.1/24MTU 1514 bytes, BW 8000000 Kbit, DLY 5000 usec,reliability 255/255, txload 1/255, rxload 1/255Encapsulation LOOPBACK, loopback not setLast input never, output never, output hang neverLast clearing of "show interface" counters neverQueuing strategy: fifoOutput queue 0/0, 0 drops; input queue 0/75, 0 drops5 minute input rate 0 bits/sec, 0 packets/sec5 minute output rate 0 bits/sec, 0 packets/sec0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants, 0 throttles0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 output buffer failures, 0 output buffers swapped outAnother way to verify the loopback interface is to ping it:
Router# ping 200.200.100.1Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 200.200.100.1, timeout is 2 seconds:!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 msConfiguring Command-Line Access to the Router
Perform these steps to configure parameters to control access to the router, beginning in global configuration mode:
For complete information about the command line commands, see the Cisco IOS Release 12.3 documentation set.
Configuration Example
The following configuration shows the command-line access commands.
You do not need to input the commands marked "default." These commands appear automatically in the configuration file generated when you use the show running-config command.
!line con 0exec-timeout 10 0password 4youreyesonlylogintransport input none (default)stopbits 1 (default)line vty 0 4password secretlogin!Configuring Static Routes
Static routes provide fixed routing paths through the network. They are manually configured on the router. If the network topology changes, the static route must be updated with a new route. Static routes are private routes unless they are redistributed by a routing protocol. Configuring static routes on the Cisco Secure Router 520 Series router is optional.
Perform these steps to configure static routes, beginning in global configuration mode:
Step 1
ip route prefix mask {ip-address | interface-type interface-number [ip-address]}
Example:
Router(config)# ip route 192.168.0.0 255.255.0.0 10.10.10.2Router(config)#Specifies the static route for the IP packets.
For details about this command and additional parameters that can be set, see the Cisco IOS IP Command Reference, Volume 2 of 4: Routing Protocols.
Step 2
end
Example:
Router(config)# endRouter#Exits router configuration mode, and enters privileged EXEC mode.
For complete information on the static routing commands, see the Cisco IOS Release 12.3 documentation set. For more general information on static routing, see Appendix B, "Concepts."
Configuration Example
In the following configuration example, the static route sends out all IP packets with a destination IP address of 192.168.1.0 and a subnet mask of 255.255.255.0 on the Fast Ethernet interface to another device with an IP address of 10.10.10.2. Specifically, the packets are sent to the configured PVC.
You do not need to enter the commands marked "(default)." These commands appear automatically in the configuration file generated when you use the show running-config command.
!ip classless (default)ip route 192.168.1.0 255.255.255.0 10.10.10.2!Verifying Your Configuration
To verify that you have properly configured static routing, enter the show ip route command and look for static routes signified by the "S."
You should see verification output similar to the following example.
Router# show ip routeCodes: C - connected, S - static, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external,i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2ia - IS-IS inter area, * - candidate default, U - per-user static routeo - ODR, P - periodic downloaded static routeGateway of last resort is not set10.0.0.0/24 is subnetted, 1 subnetsC 10.108.1.0 is directly connected, Loopback0S* 0.0.0.0/0 is directly connected, FastEthernet0Configuring Dynamic Routes
In dynamic routing, the network protocol adjusts the path automatically, based on network traffic or topology. Changes in dynamic routes are shared with other routers in the network.
The Cisco routers can use IP routing protocols, such as Routing Information Protocol (RIP), to learn routes dynamically. You can configure either of these routing protocols on your router.
Configuring RIP
Perform these steps to configure the RIP routing protocol on the router, beginning in global configuration mode:
For complete information on the dynamic routing commands, see the Cisco IOS Release 12.3 documentation set. For more general information on RIP, see Appendix B, "Concepts."
Configuration Example
The following configuration example shows RIP version 2 enabled in IP network 10.0.0.0 and 192.168.1.0.
Execute the show running-config command from privileged EXEC mode to see this configuration.
!router ripversion 2network 10.0.0.0network 192.168.1.0no auto-summary!Verifying Your Configuration
To verify that you have properly configured RIP, enter the show ip route command and look for RIP routes signified by "R." You should see verification output like the example shown below.
Router# show ip routeCodes: C - connected, S - static, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external,i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2ia - IS-IS inter area, * - candidate default, U - per-user static routeo - ODR, P - periodic downloaded static routeGateway of last resort is not set10.0.0.0/24 is subnetted, 1 subnetsC 10.108.1.0 is directly connected, Loopback0R 3.0.0.0/8 [120/1] via 2.2.2.1, 00:00:02, Ethernet0/0
