主要コマンドのメモ

時間の設定
Router(config)# timezone 9
Router(config)# ntp retry 3
Router(config)# ntp interval 3600
Router(config)# clock 16 01 0 3 1 2010
Router(config)# show clock
Sunday, 3 January 2010 16:01:28 +09 00

ホスト名の設定(任意）
Router(config)# hostname cu
cu(config)#

保存
Router(config)# write memory
Building configuration…
% Warning: do NOT enter CNTL/Z while saving to avoid config corruption.
Router(config)#

インターフェイス状態の確認
Router(config)# show interfaces FastEthernet0/0.0
Interface FastEthernet0/0.0 is administratively down
Fundamental MTU is 1500 octets
Current bandwidth 100M b/s, QoS is disabled
Datalink header cache type is none: 0/0 (standby/dynamic)
SNMP MIB-2:
ifIndex is 518
Logical INTERFACE:
Elapsed time after clear counters 0:11:00
0 packets input, 0 bytes, 0 errors
0 unicasts, 0 non-unicasts, 1 unknown protos
0 drops, 0 misc errors
0 output requests, 0 bytes, 0 errors
0 unicasts, 0 non-unicasts
0 overflows, 0 neighbor unreachable, 0 misc errors
1 link-up detected, 0 link-down detected
Encapsulation ETHERNET:
State is initialized
FastEthernet status:
Physical address is 00:30:13:36:ce:03
Port status is up
Full-duplex, 100M b/s, 100BaseTX
Promiscuous mode is disabled
Statistics:
Rx errors:
0 alignment errors, 0 CRC errors
0 long frames, 0 short frames, 0 overflows
Tx errors:
0 single collisions, 0 multiple collisions
0 excessive collisions, 0 late collisions
0 deferred transmissions, 0 carrier sense errors
0 underflows
Router(config)#

FE0/0に固定IP設定
Router(config)# interface FastEthernet0/0.0
Router(config-FastEthernet0/0.0)# ip address 192.168.0.1/24
Router(config-FastEthernet0/0.0)# ipv6 address autoconfig
Router(config-FastEthernet0/0.0)# no shutdown
Router(config-FastEthernet0/0.0)# show ip address

FE0/1にDHCP設定
Router(config)# interface FastEthernet0/1.0
Router(config-FastEthernet0/1.0)# ip address dhcp
Router(config-FastEthernet0/1.0)# ipv6 address autoconfig
Router(config-FastEthernet0/1.0)# no shutdown
Router(config-FastEthernet0/1.0)# show ip address
Router(config-FastEthernet0/1.0)# ip nat enable

NAT設定
Router(config)# interface FastEthernet0/1.0
Router(config-FastEthernet0/1.0)# ip nat translation timeout 3600
Router(config-FastEthernet0/1.0)# ip nat dynamic list lan pool abc
Router(config-FastEthernet0/1.0)# ip nat enable

telnetサーバ
Router(config)# ip access-list lan permit ip src 192.168.0.0/24 dest any
Router(config)# telnet-server ip access-list lan
Router(config)# telnet-server ip enable

default route設定
Router(config)# ip route default FastEthernet0/1.0 dhcp

NTPサーバ設定
Router(config)# ntp server 133.27.4.121
Router(config)# ntp server 210.173.160.27
Router(config)# ntp ip enable

DHCPサーバ設定
Router(config)# ip dhcp profile lan
Router(config-dhcp-lan)# assignable-range 192.168.0.100 192.168.0.254
Router(config-dhcp-lan)# subnet-mask 255.255.255.0
Router(config-dhcp-lan)# dns-server 192.168.0.1
Router(config-dhcp-lan)# exit
Router(config)# ip dhcp enable
Router(config)# interface FastEthernet0/0.0
Router(config-FastEthernet0/0.0)# ip dhcp binding lan
Router(config-FastEthernet0/0.0)# exit

DNS proxy設定
Router(config)# dns cache enable
Router(config)# proxy-dns ip enable
Router(config)# proxy-dns ipv6 enable

UFSキャッシュ有効化

UFS キャッシュ（Unified Forwarding Service Cache）は、フィルタ、NAT/NAPT、IPSec など
のサービスを使用している場合に有効な高速フォワーディングキャッシュメカニズムであり、
IX1000/2000/3000 の独自機能です。UFS キャッシュにより、フィルタの多段設定、IPSec の複
数設定等におけるスケーラビリティを向上させます。Ver4.2 以降の IPv4、IPv6 それぞれで設定
できます。Ver.4.3 以降ではポリシールーティングが、Ver.7.3以降では、QoS、ダイナミックフィ
ルタでも UFS キャッシュが適用されます。

Router(config)# ip ufs-cache enable

Filtering設定
ip access-list strict-block deny tcp src any sport any dest any dport eq 137
ip access-list strict-block deny udp src any sport any dest any dport eq 137
ip access-list strict-block deny udp src any sport any dest any dport eq 138
ip access-list strict-block deny tcp src any sport any dest any dport eq 139
ip access-list strict-block deny tcp src any sport any dest any dport eq 445
ip access-list strict-block deny udp src any sport any dest any dport eq 445

ip access-list weak-block deny tcp src any sport any dest any dport eq 1
ip access-list weak-block deny udp src any sport any dest any dport eq 1
ip access-list weak-block deny tcp src any sport any dest any dport eq 11
ip access-list weak-block deny udp src any sport any dest any dport eq 11
ip access-list weak-block deny tcp src any sport any dest any dport eq 15
ip access-list weak-block deny udp src any sport any dest any dport eq 15
ip access-list weak-block deny tcp src any sport any dest any dport eq 70
ip access-list weak-block deny udp src any sport any dest any dport eq 70
ip access-list weak-block deny tcp src any sport any dest any dport eq 79
ip access-list weak-block deny udp src any sport any dest any dport eq 79
ip access-list weak-block deny tcp src any sport any dest any dport eq 87
ip access-list weak-block deny udp src any sport any dest any dport eq 87
ip access-list weak-block deny tcp src any sport any dest any dport eq 95
ip access-list weak-block deny udp src any sport any dest any dport eq 95
ip access-list weak-block deny tcp src any sport any dest any dport eq 111
ip access-list weak-block deny udp src any sport any dest any dport eq 111
ip access-list weak-block deny tcp src any sport any dest any dport eq 135
ip access-list weak-block deny udp src any sport any dest any dport eq 135
ip access-list weak-block deny tcp src any sport any dest any dport eq 144
ip access-list weak-block deny udp src any sport any dest any dport eq 144
ip access-list weak-block deny tcp src any sport any dest any dport eq 161
ip access-list weak-block deny udp src any sport any dest any dport eq 161
ip access-list weak-block deny tcp src any sport any dest any dport eq 162
ip access-list weak-block deny udp src any sport any dest any dport eq 162
ip access-list weak-block deny tcp src any sport any dest any dport eq 177
ip access-list weak-block deny udp src any sport any dest any dport eq 177
ip access-list weak-block deny tcp src any sport any dest any dport eq 220
ip access-list weak-block deny udp src any sport any dest any dport eq 220
ip access-list weak-block deny tcp src any sport any dest any dport eq 445
ip access-list weak-block deny udp src any sport any dest any dport eq 445
ip access-list weak-block deny tcp src any sport any dest any dport eq 512
ip access-list weak-block deny udp src any sport any dest any dport eq 512
ip access-list weak-block deny tcp src any sport any dest any dport eq 513
ip access-list weak-block deny udp src any sport any dest any dport eq 513
ip access-list weak-block deny tcp src any sport any dest any dport eq 514
ip access-list weak-block deny udp src any sport any dest any dport eq 514
ip access-list weak-block deny tcp src any sport any dest any dport eq 515
ip access-list weak-block deny udp src any sport any dest any dport eq 515
ip access-list weak-block deny tcp src any sport any dest any dport eq 517
ip access-list weak-block deny udp src any sport any dest any dport eq 517
ip access-list weak-block deny tcp src any sport any dest any dport eq 518
ip access-list weak-block deny udp src any sport any dest any dport eq 518
ip access-list weak-block deny tcp src any sport any dest any dport eq 520
ip access-list weak-block deny udp src any sport any dest any dport eq 520
ip access-list weak-block deny tcp src any sport any dest any dport eq 540
ip access-list weak-block deny udp src any sport any dest any dport eq 540
ip access-list weak-block deny tcp src any sport any dest any dport eq 1025
ip access-list weak-block deny udp src any sport any dest any dport eq 1025
ip access-list weak-block deny tcp src any sport any dest any dport eq 2000
ip access-list weak-block deny udp src any sport any dest any dport eq 2000
ip access-list weak-block deny tcp src any sport any dest any dport eq 2049
ip access-list weak-block deny udp src any sport any dest any dport eq 2049
ip access-list weak-block deny tcp src any sport any dest any dport eq 2766
ip access-list weak-block deny udp src any sport any dest any dport eq 2766
ip access-list weak-block deny tcp src any sport any dest any dport range 6000 6063
ip access-list weak-block deny udp src any sport any dest any dport range 6000 6063
ip access-list weak-block deny tcp src any sport any dest any dport eq 12345
ip access-list weak-block deny udp src any sport any dest any dport eq 12345

ip access-list specialuse deny ip src 0.0.0.0/8 dest any
ip access-list specialuse deny ip src 10.0.0.0/8 dest any
ip access-list specialuse deny ip src 172.16.0.0/12 dest any
ip access-list specialuse deny ip src 192.168.0.0/16 dest any
ip access-list specialuse deny ip src 127.0.0.0/8 dest any
ip access-list specialuse deny ip src 169.254.0.0/16 dest any
ip access-list specialuse deny ip src 192.0.2.0/24 dest any
ip access-list specialuse deny ip src 224.0.0.0/3 dest any
ip access-list specialuse deny ip src 198.18.0.0/15 dest any
ip access-list mynetwork permit ip src 192.168.0.0/24 dest any
ip access-list all-pass permit ip src any dest any
ip filter forced-reassembly

interface FastEthernet0/1.0
ip filter all-pass 65000 in
ip filter all-pass 65000 out
ip filter mynetwork 50 out
ip filter strict-block 1 in
ip filter strict-block 1 out
ip filter weak-block 100 in
ip filter weak-block 100 out
ip filter specialuse 101 in
ip filter specialuse 101 out

再起動
# スタートアップコンフィグのロード、DRAMメモリのクリア
restart

# プログラムのロード、スタートアップコンフィグのロード、DRAMメモリのクリア
reload

不思議な所
ip filterでdenyしているにもかかわらずnatテーブルができてしまう。もしかして、filterを通過しているのかと思ったけどちゃんとパケットは落とされている。謎。

いけてないところ
WAN側のIFはISPからDHCPでIPが振られているのだが、そのリース期限は6時間。
6時間毎にIFがIPをリリースし、一度downしてしまう。よって、NAPTテーブルも全部クリアされてしまう。再度割り当てられるIPは同じIPなので、とても不便。

すばらしい安定性
1ヶ月運用しているが、一度も再起動しないで稼働している。
WS0668 150x150 IX2015設定メモ

参考サイト
Firewallの設定はこちらを参考にしました。
http://www.kozupon.com/network/ix2015.html

変更履歴
2010/2/23 DHCPのフィルタ削除。
以下、削除部分。

ip access-list weak-block deny tcp src any sport any dest any dport eq 67
ip access-list weak-block deny udp src any sport any dest any dport eq 67
ip access-list weak-block deny tcp src any sport any dest any dport eq 68
ip access-list weak-block deny udp src any sport any dest any dport eq 68