IX2015

NEC IX2015 初期設定

2010年1月5日

投稿者: Yuki Matsukura (IX2015)

コメント無し

WS0641 150x150 NEC IX2015 初期設定

2日ほど運用して、メモリ使用率が50%以下

背景
会社で使っているLinksysのルータが調子悪くて、1日に数回ハングアップするようになった。そこで、2chで評判がいいIX2015をヤフオクで買った。標準価格：120,750円（税込）の製品が5000円以下。

このエントリーでは初期設定や前提となるメモを書いておく。

設定ファイルの内容などはIX2015関連記事を見てください。

想定環境
<LAN 192.168.0.0/24> – [192.168.0.1]<FE0/0:IX2015FE0/1>[DHCP] – <internet>

IFの番号
FE0/0 = FastEthernet0/0.0
FE0/1 = FastEthernet0/1.0

BRIの用途
> デジタル専用回線(HSD64/128など)、またはISDN回線（INSネット64)に接続することができます

IPSecキー確認
Router# enable-confi
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# show lic
IPsec H/W encryption is activated
Software Key Code is xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ISDN-BRI/VRRP option is activated
Software Key Code is xxxxxxxxxxxxxxxxxxxxxxxxx
Router(config)#

, ,

IX2015設定ファイルダンプ

2010年1月5日

投稿者: Yuki Matsukura (IX2015)

コメント無し

IX2015の設定ファイルコピペ。

設定の方向性:

  • NAPT環境
  • 不要なパケットは外に出さない
  • LANからのみtelnet接続可能

! NEC Portable Internetwork Core Operating System Software
! IX Series IX2010 (magellan-sec) Software, Version 8.3.44, RELEASE SOFTWARE
! Compiled Oct 20-Tue-2009 13:28:55 JST #1
! Current time Jan 05-Tue-2010 14:53:33 JST
!
!
timezone +09 00
!
!
!
!
!
!
ntp ip enable
ntp server 133.27.4.121
ntp server 210.173.160.27
ntp retry 3
ntp interval 3600
!
!
!
!
!
ip dhcp enable
ip access-list all-pass permit ip src any dest any
ip access-list mynetwork permit ip src 192.168.0.0/24 dest any
ip access-list specialuse deny ip src 10.0.0.0/8 dest any
ip access-list specialuse deny ip src 172.16.0.0/12 dest any
ip access-list specialuse deny ip src 192.168.0.0/16 dest any
ip access-list specialuse deny ip src 127.0.0.0/8 dest any
ip access-list specialuse deny ip src 169.254.0.0/16 dest any
ip access-list specialuse deny ip src 192.0.2.0/24 dest any
ip access-list specialuse deny ip src 224.0.0.0/3 dest any
ip access-list specialuse deny ip src 198.18.0.0/15 dest any
ip access-list strict-block deny tcp src any sport any dest any dport eq 137
ip access-list strict-block deny udp src any sport any dest any dport eq 137
ip access-list strict-block deny udp src any sport any dest any dport eq 138
ip access-list strict-block deny tcp src any sport any dest any dport eq 139
ip access-list strict-block deny tcp src any sport any dest any dport eq 445
ip access-list strict-block deny udp src any sport any dest any dport eq 445
ip access-list weak-block deny tcp src any sport any dest any dport eq 1
ip access-list weak-block deny udp src any sport any dest any dport eq 1
ip access-list weak-block deny tcp src any sport any dest any dport eq 11
ip access-list weak-block deny udp src any sport any dest any dport eq 11
ip access-list weak-block deny tcp src any sport any dest any dport eq 15
ip access-list weak-block deny udp src any sport any dest any dport eq 15
ip access-list weak-block deny tcp src any sport any dest any dport eq 67
ip access-list weak-block deny tcp src any sport any dest any dport eq 68
ip access-list weak-block deny tcp src any sport any dest any dport eq 70
ip access-list weak-block deny udp src any sport any dest any dport eq 70
ip access-list weak-block deny tcp src any sport any dest any dport eq 79
ip access-list weak-block deny udp src any sport any dest any dport eq 79
ip access-list weak-block deny tcp src any sport any dest any dport eq 87
ip access-list weak-block deny udp src any sport any dest any dport eq 87
ip access-list weak-block deny tcp src any sport any dest any dport eq 95
ip access-list weak-block deny udp src any sport any dest any dport eq 95
ip access-list weak-block deny tcp src any sport any dest any dport eq 111
ip access-list weak-block deny udp src any sport any dest any dport eq 111
ip access-list weak-block deny tcp src any sport any dest any dport eq 135
ip access-list weak-block deny udp src any sport any dest any dport eq 135
ip access-list weak-block deny tcp src any sport any dest any dport eq 144
ip access-list weak-block deny udp src any sport any dest any dport eq 144
ip access-list weak-block deny tcp src any sport any dest any dport eq 161
ip access-list weak-block deny udp src any sport any dest any dport eq 161
ip access-list weak-block deny tcp src any sport any dest any dport eq 162
ip access-list weak-block deny udp src any sport any dest any dport eq 162
ip access-list weak-block deny tcp src any sport any dest any dport eq 177
ip access-list weak-block deny udp src any sport any dest any dport eq 177
ip access-list weak-block deny tcp src any sport any dest any dport eq 220
ip access-list weak-block deny udp src any sport any dest any dport eq 220
ip access-list weak-block deny tcp src any sport any dest any dport eq 445
ip access-list weak-block deny udp src any sport any dest any dport eq 445
ip access-list weak-block deny tcp src any sport any dest any dport eq 512
ip access-list weak-block deny udp src any sport any dest any dport eq 512
ip access-list weak-block deny tcp src any sport any dest any dport eq 513
ip access-list weak-block deny udp src any sport any dest any dport eq 513
ip access-list weak-block deny tcp src any sport any dest any dport eq 514
ip access-list weak-block deny udp src any sport any dest any dport eq 514
ip access-list weak-block deny tcp src any sport any dest any dport eq 515
ip access-list weak-block deny udp src any sport any dest any dport eq 515
ip access-list weak-block deny tcp src any sport any dest any dport eq 517
ip access-list weak-block deny udp src any sport any dest any dport eq 517
ip access-list weak-block deny tcp src any sport any dest any dport eq 518
ip access-list weak-block deny udp src any sport any dest any dport eq 518
ip access-list weak-block deny tcp src any sport any dest any dport eq 520
ip access-list weak-block deny udp src any sport any dest any dport eq 520
ip access-list weak-block deny tcp src any sport any dest any dport eq 540
ip access-list weak-block deny udp src any sport any dest any dport eq 540
ip access-list weak-block deny tcp src any sport any dest any dport eq 1025
ip access-list weak-block deny udp src any sport any dest any dport eq 1025
ip access-list weak-block deny tcp src any sport any dest any dport eq 2000
ip access-list weak-block deny udp src any sport any dest any dport eq 2000
ip access-list weak-block deny tcp src any sport any dest any dport eq 2049
ip access-list weak-block deny udp src any sport any dest any dport eq 2049
ip access-list weak-block deny tcp src any sport any dest any dport eq 2766
ip access-list weak-block deny udp src any sport any dest any dport eq 2766
ip access-list weak-block deny tcp src any sport any dest any dport range 6000 6063
ip access-list weak-block deny udp src any sport any dest any dport range 6000 6063
ip access-list weak-block deny tcp src any sport any dest any dport eq 12345
ip access-list weak-block deny udp src any sport any dest any dport eq 12345
ip filter forced-reassembly
!
!
!
!
!
!
!
dns cache enable
!
proxy-dns ip enable
proxy-dns server 8.8.8.8 priority 200
proxy-dns server 8.8.4.4
proxy-dns ipv6 enable
!
telnet-server ip enable
telnet-server ip access-list mynetwork
!
!
!
!
!
!
!
!
!
ip dhcp profile lan
  assignable-range 192.168.0.100 192.168.0.254
  subnet-mask 255.255.255.0
  dns-server 192.168.0.1
!
device FastEthernet0/0
!
device FastEthernet0/1
!
device FastEthernet1/0
!
device BRI1/0
  isdn switch-type hsd128k
!
interface FastEthernet0/0.0
  ip address 192.168.0.1/24
  ip dhcp binding lan
  ipv6 address autoconfig
  no shutdown
!
interface FastEthernet0/1.0
  ip address dhcp receive-default
  ip napt enable
  ip filter strict-block 1 in
  ip filter weak-block 100 in
  ip filter specialuse 101 in
  ip filter all-pass 65000 in
  ip filter strict-block 1 out
  ip filter mynetwork 50 out
  ip filter weak-block 100 out
  ip filter specialuse 101 out
  ip filter all-pass 65000 out
  ipv6 address autoconfig
  no shutdown
!
interface FastEthernet1/0.0
  no ip address
  shutdown
!
interface BRI1/0.0
  encapsulation ppp
  no auto-connect
  no ip address
  shutdown
!
interface Loopback0.0
  no ip address
!
interface Null0.0
  no ip address
,

IX2015設定メモ

2010年1月5日

投稿者: Yuki Matsukura (IX2015)

コメント無し

主要コマンドのメモ

時間の設定
Router(config)# timezone 9
Router(config)# ntp retry 3
Router(config)# ntp interval 3600
Router(config)# clock 16 01 0 3 1 2010
Router(config)# show clock
Sunday, 3 January 2010 16:01:28 +09 00

ホスト名の設定(任意）
Router(config)# hostname cu
cu(config)#

保存
Router(config)# write memory
Building configuration…
% Warning: do NOT enter CNTL/Z while saving to avoid config corruption.
Router(config)#

インターフェイス状態の確認
Router(config)# show interfaces FastEthernet0/0.0
Interface FastEthernet0/0.0 is administratively down
Fundamental MTU is 1500 octets
Current bandwidth 100M b/s, QoS is disabled
Datalink header cache type is none: 0/0 (standby/dynamic)
SNMP MIB-2:
ifIndex is 518
Logical INTERFACE:
Elapsed time after clear counters 0:11:00
0 packets input, 0 bytes, 0 errors
0 unicasts, 0 non-unicasts, 1 unknown protos
0 drops, 0 misc errors
0 output requests, 0 bytes, 0 errors
0 unicasts, 0 non-unicasts
0 overflows, 0 neighbor unreachable, 0 misc errors
1 link-up detected, 0 link-down detected
Encapsulation ETHERNET:
State is initialized
FastEthernet status:
Physical address is 00:30:13:36:ce:03
Port status is up
Full-duplex, 100M b/s, 100BaseTX
Promiscuous mode is disabled
Statistics:
Rx errors:
0 alignment errors, 0 CRC errors
0 long frames, 0 short frames, 0 overflows
Tx errors:
0 single collisions, 0 multiple collisions
0 excessive collisions, 0 late collisions
0 deferred transmissions, 0 carrier sense errors
0 underflows
Router(config)#

FE0/0に固定IP設定
Router(config)# interface FastEthernet0/0.0
Router(config-FastEthernet0/0.0)# ip address 192.168.0.1/24
Router(config-FastEthernet0/0.0)# ipv6 address autoconfig
Router(config-FastEthernet0/0.0)# no shutdown
Router(config-FastEthernet0/0.0)# show ip address

FE0/1にDHCP設定
Router(config)# interface FastEthernet0/1.0
Router(config-FastEthernet0/1.0)# ip address dhcp
Router(config-FastEthernet0/1.0)# ipv6 address autoconfig
Router(config-FastEthernet0/1.0)# no shutdown
Router(config-FastEthernet0/1.0)# show ip address
Router(config-FastEthernet0/1.0)# ip nat enable

NAT設定
Router(config)# interface FastEthernet0/1.0
Router(config-FastEthernet0/1.0)# ip nat translation timeout 3600
Router(config-FastEthernet0/1.0)# ip nat dynamic list lan pool abc
Router(config-FastEthernet0/1.0)# ip nat enable

telnetサーバ
Router(config)# ip access-list lan permit ip src 192.168.0.0/24 dest any
Router(config)# telnet-server ip access-list lan
Router(config)# telnet-server ip enable

default route設定
Router(config)# ip route default FastEthernet0/1.0 dhcp

NTPサーバ設定
Router(config)# ntp server 133.27.4.121
Router(config)# ntp server 210.173.160.27
Router(config)# ntp ip enable

DHCPサーバ設定
Router(config)# ip dhcp profile lan
Router(config-dhcp-lan)# assignable-range 192.168.0.100 192.168.0.254
Router(config-dhcp-lan)# subnet-mask 255.255.255.0
Router(config-dhcp-lan)# dns-server 192.168.0.1
Router(config-dhcp-lan)# exit
Router(config)# ip dhcp enable
Router(config)# interface FastEthernet0/0.0
Router(config-FastEthernet0/0.0)# ip dhcp binding lan
Router(config-FastEthernet0/0.0)# exit

DNS proxy設定
Router(config)# dns cache enable
Router(config)# proxy-dns ip enable
Router(config)# proxy-dns ipv6 enable

UFSキャッシュ有効化

UFS キャッシュ（Unified Forwarding Service Cache）は、フィルタ、NAT/NAPT、IPSec など
のサービスを使用している場合に有効な高速フォワーディングキャッシュメカニズムであり、
IX1000/2000/3000 の独自機能です。UFS キャッシュにより、フィルタの多段設定、IPSec の複
数設定等におけるスケーラビリティを向上させます。Ver4.2 以降の IPv4、IPv6 それぞれで設定
できます。Ver.4.3 以降ではポリシールーティングが、Ver.7.3以降では、QoS、ダイナミックフィ
ルタでも UFS キャッシュが適用されます。

Router(config)# ip ufs-cache enable

Filtering設定
ip access-list strict-block deny tcp src any sport any dest any dport eq 137
ip access-list strict-block deny udp src any sport any dest any dport eq 137
ip access-list strict-block deny udp src any sport any dest any dport eq 138
ip access-list strict-block deny tcp src any sport any dest any dport eq 139
ip access-list strict-block deny tcp src any sport any dest any dport eq 445
ip access-list strict-block deny udp src any sport any dest any dport eq 445

ip access-list weak-block deny tcp src any sport any dest any dport eq 1
ip access-list weak-block deny udp src any sport any dest any dport eq 1
ip access-list weak-block deny tcp src any sport any dest any dport eq 11
ip access-list weak-block deny udp src any sport any dest any dport eq 11
ip access-list weak-block deny tcp src any sport any dest any dport eq 15
ip access-list weak-block deny udp src any sport any dest any dport eq 15
ip access-list weak-block deny tcp src any sport any dest any dport eq 70
ip access-list weak-block deny udp src any sport any dest any dport eq 70
ip access-list weak-block deny tcp src any sport any dest any dport eq 79
ip access-list weak-block deny udp src any sport any dest any dport eq 79
ip access-list weak-block deny tcp src any sport any dest any dport eq 87
ip access-list weak-block deny udp src any sport any dest any dport eq 87
ip access-list weak-block deny tcp src any sport any dest any dport eq 95
ip access-list weak-block deny udp src any sport any dest any dport eq 95
ip access-list weak-block deny tcp src any sport any dest any dport eq 111
ip access-list weak-block deny udp src any sport any dest any dport eq 111
ip access-list weak-block deny tcp src any sport any dest any dport eq 135
ip access-list weak-block deny udp src any sport any dest any dport eq 135
ip access-list weak-block deny tcp src any sport any dest any dport eq 144
ip access-list weak-block deny udp src any sport any dest any dport eq 144
ip access-list weak-block deny tcp src any sport any dest any dport eq 161
ip access-list weak-block deny udp src any sport any dest any dport eq 161
ip access-list weak-block deny tcp src any sport any dest any dport eq 162
ip access-list weak-block deny udp src any sport any dest any dport eq 162
ip access-list weak-block deny tcp src any sport any dest any dport eq 177
ip access-list weak-block deny udp src any sport any dest any dport eq 177
ip access-list weak-block deny tcp src any sport any dest any dport eq 220
ip access-list weak-block deny udp src any sport any dest any dport eq 220
ip access-list weak-block deny tcp src any sport any dest any dport eq 445
ip access-list weak-block deny udp src any sport any dest any dport eq 445
ip access-list weak-block deny tcp src any sport any dest any dport eq 512
ip access-list weak-block deny udp src any sport any dest any dport eq 512
ip access-list weak-block deny tcp src any sport any dest any dport eq 513
ip access-list weak-block deny udp src any sport any dest any dport eq 513
ip access-list weak-block deny tcp src any sport any dest any dport eq 514
ip access-list weak-block deny udp src any sport any dest any dport eq 514
ip access-list weak-block deny tcp src any sport any dest any dport eq 515
ip access-list weak-block deny udp src any sport any dest any dport eq 515
ip access-list weak-block deny tcp src any sport any dest any dport eq 517
ip access-list weak-block deny udp src any sport any dest any dport eq 517
ip access-list weak-block deny tcp src any sport any dest any dport eq 518
ip access-list weak-block deny udp src any sport any dest any dport eq 518
ip access-list weak-block deny tcp src any sport any dest any dport eq 520
ip access-list weak-block deny udp src any sport any dest any dport eq 520
ip access-list weak-block deny tcp src any sport any dest any dport eq 540
ip access-list weak-block deny udp src any sport any dest any dport eq 540
ip access-list weak-block deny tcp src any sport any dest any dport eq 1025
ip access-list weak-block deny udp src any sport any dest any dport eq 1025
ip access-list weak-block deny tcp src any sport any dest any dport eq 2000
ip access-list weak-block deny udp src any sport any dest any dport eq 2000
ip access-list weak-block deny tcp src any sport any dest any dport eq 2049
ip access-list weak-block deny udp src any sport any dest any dport eq 2049
ip access-list weak-block deny tcp src any sport any dest any dport eq 2766
ip access-list weak-block deny udp src any sport any dest any dport eq 2766
ip access-list weak-block deny tcp src any sport any dest any dport range 6000 6063
ip access-list weak-block deny udp src any sport any dest any dport range 6000 6063
ip access-list weak-block deny tcp src any sport any dest any dport eq 12345
ip access-list weak-block deny udp src any sport any dest any dport eq 12345

ip access-list specialuse deny ip src 0.0.0.0/8 dest any
ip access-list specialuse deny ip src 10.0.0.0/8 dest any
ip access-list specialuse deny ip src 172.16.0.0/12 dest any
ip access-list specialuse deny ip src 192.168.0.0/16 dest any
ip access-list specialuse deny ip src 127.0.0.0/8 dest any
ip access-list specialuse deny ip src 169.254.0.0/16 dest any
ip access-list specialuse deny ip src 192.0.2.0/24 dest any
ip access-list specialuse deny ip src 224.0.0.0/3 dest any
ip access-list specialuse deny ip src 198.18.0.0/15 dest any
ip access-list mynetwork permit ip src 192.168.0.0/24 dest any
ip access-list all-pass permit ip src any dest any
ip filter forced-reassembly

interface FastEthernet0/1.0
ip filter all-pass 65000 in
ip filter all-pass 65000 out
ip filter mynetwork 50 out
ip filter strict-block 1 in
ip filter strict-block 1 out
ip filter weak-block 100 in
ip filter weak-block 100 out
ip filter specialuse 101 in
ip filter specialuse 101 out

再起動
# スタートアップコンフィグのロード、DRAMメモリのクリア
restart

# プログラムのロード、スタートアップコンフィグのロード、DRAMメモリのクリア
reload

不思議な所
ip filterでdenyしているにもかかわらずnatテーブルができてしまう。もしかして、filterを通過しているのかと思ったけどちゃんとパケットは落とされている。謎。

いけてないところ
WAN側のIFはISPからDHCPでIPが振られているのだが、そのリース期限は6時間。
6時間毎にIFがIPをリリースし、一度downしてしまう。よって、NAPTテーブルも全部クリアされてしまう。再度割り当てられるIPは同じIPなので、とても不便。

すばらしい安定性
1ヶ月運用しているが、一度も再起動しないで稼働している。
WS0668 150x150 IX2015設定メモ

参考サイト
Firewallの設定はこちらを参考にしました。
http://www.kozupon.com/network/ix2015.html

変更履歴
2010/2/23 DHCPのフィルタ削除。
以下、削除部分。

ip access-list weak-block deny tcp src any sport any dest any dport eq 67
ip access-list weak-block deny udp src any sport any dest any dport eq 67
ip access-list weak-block deny tcp src any sport any dest any dport eq 68
ip access-list weak-block deny udp src any sport any dest any dport eq 68

, ,