Web * Location Information
NECタグのついている投稿
NEC IX2015 初期設定
2010年1月5日
2日ほど運用して、メモリ使用率が50%以下
背景
会社で使っているLinksysのルータが調子悪くて、1日に数回ハングアップするようになった。そこで、2chで評判がいいIX2015をヤフオクで買った。標準価格：120,750円（税込）の製品が5000円以下。
このエントリーでは初期設定や前提となるメモを書いておく。
設定ファイルの内容などはIX2015関連記事を見てください。
想定環境
<LAN 192.168.0.0/24> – [192.168.0.1]<FE0/0:IX2015FE0/1>[DHCP] – <internet>
IFの番号
FE0/0 = FastEthernet0/0.0
FE0/1 = FastEthernet0/1.0
BRIの用途
> デジタル専用回線(HSD64/128など)、またはISDN回線（INSネット64)に接続することができます
IPSecキー確認
Router# enable-confi
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# show lic
IPsec H/W encryption is activated
Software Key Code is xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ISDN-BRI/VRRP option is activated
Software Key Code is xxxxxxxxxxxxxxxxxxxxxxxxx
Router(config)#
IX2015設定ファイルダンプ
2010年1月5日
IX2015の設定ファイルコピペ。
設定の方向性:
- NAPT環境
- 不要なパケットは外に出さない
- LANからのみtelnet接続可能
! NEC Portable Internetwork Core Operating System Software ! IX Series IX2010 (magellan-sec) Software, Version 8.3.44, RELEASE SOFTWARE ! Compiled Oct 20-Tue-2009 13:28:55 JST #1 ! Current time Jan 05-Tue-2010 14:53:33 JST ! ! timezone +09 00 ! ! ! ! ! ! ntp ip enable ntp server 133.27.4.121 ntp server 210.173.160.27 ntp retry 3 ntp interval 3600 ! ! ! ! ! ip dhcp enable ip access-list all-pass permit ip src any dest any ip access-list mynetwork permit ip src 192.168.0.0/24 dest any ip access-list specialuse deny ip src 10.0.0.0/8 dest any ip access-list specialuse deny ip src 172.16.0.0/12 dest any ip access-list specialuse deny ip src 192.168.0.0/16 dest any ip access-list specialuse deny ip src 127.0.0.0/8 dest any ip access-list specialuse deny ip src 169.254.0.0/16 dest any ip access-list specialuse deny ip src 192.0.2.0/24 dest any ip access-list specialuse deny ip src 224.0.0.0/3 dest any ip access-list specialuse deny ip src 198.18.0.0/15 dest any ip access-list strict-block deny tcp src any sport any dest any dport eq 137 ip access-list strict-block deny udp src any sport any dest any dport eq 137 ip access-list strict-block deny udp src any sport any dest any dport eq 138 ip access-list strict-block deny tcp src any sport any dest any dport eq 139 ip access-list strict-block deny tcp src any sport any dest any dport eq 445 ip access-list strict-block deny udp src any sport any dest any dport eq 445 ip access-list weak-block deny tcp src any sport any dest any dport eq 1 ip access-list weak-block deny udp src any sport any dest any dport eq 1 ip access-list weak-block deny tcp src any sport any dest any dport eq 11 ip access-list weak-block deny udp src any sport any dest any dport eq 11 ip access-list weak-block deny tcp src any sport any dest any dport eq 15 ip access-list weak-block deny udp src any sport any dest any dport eq 15 ip access-list weak-block deny tcp src any sport any dest any dport eq 67 ip access-list weak-block deny tcp src any sport any dest any dport eq 68 ip access-list weak-block deny tcp src any sport any dest any dport eq 70 ip access-list weak-block deny udp src any sport any dest any dport eq 70 ip access-list weak-block deny tcp src any sport any dest any dport eq 79 ip access-list weak-block deny udp src any sport any dest any dport eq 79 ip access-list weak-block deny tcp src any sport any dest any dport eq 87 ip access-list weak-block deny udp src any sport any dest any dport eq 87 ip access-list weak-block deny tcp src any sport any dest any dport eq 95 ip access-list weak-block deny udp src any sport any dest any dport eq 95 ip access-list weak-block deny tcp src any sport any dest any dport eq 111 ip access-list weak-block deny udp src any sport any dest any dport eq 111 ip access-list weak-block deny tcp src any sport any dest any dport eq 135 ip access-list weak-block deny udp src any sport any dest any dport eq 135 ip access-list weak-block deny tcp src any sport any dest any dport eq 144 ip access-list weak-block deny udp src any sport any dest any dport eq 144 ip access-list weak-block deny tcp src any sport any dest any dport eq 161 ip access-list weak-block deny udp src any sport any dest any dport eq 161 ip access-list weak-block deny tcp src any sport any dest any dport eq 162 ip access-list weak-block deny udp src any sport any dest any dport eq 162 ip access-list weak-block deny tcp src any sport any dest any dport eq 177 ip access-list weak-block deny udp src any sport any dest any dport eq 177 ip access-list weak-block deny tcp src any sport any dest any dport eq 220 ip access-list weak-block deny udp src any sport any dest any dport eq 220 ip access-list weak-block deny tcp src any sport any dest any dport eq 445 ip access-list weak-block deny udp src any sport any dest any dport eq 445 ip access-list weak-block deny tcp src any sport any dest any dport eq 512 ip access-list weak-block deny udp src any sport any dest any dport eq 512 ip access-list weak-block deny tcp src any sport any dest any dport eq 513 ip access-list weak-block deny udp src any sport any dest any dport eq 513 ip access-list weak-block deny tcp src any sport any dest any dport eq 514 ip access-list weak-block deny udp src any sport any dest any dport eq 514 ip access-list weak-block deny tcp src any sport any dest any dport eq 515 ip access-list weak-block deny udp src any sport any dest any dport eq 515 ip access-list weak-block deny tcp src any sport any dest any dport eq 517 ip access-list weak-block deny udp src any sport any dest any dport eq 517 ip access-list weak-block deny tcp src any sport any dest any dport eq 518 ip access-list weak-block deny udp src any sport any dest any dport eq 518 ip access-list weak-block deny tcp src any sport any dest any dport eq 520 ip access-list weak-block deny udp src any sport any dest any dport eq 520 ip access-list weak-block deny tcp src any sport any dest any dport eq 540 ip access-list weak-block deny udp src any sport any dest any dport eq 540 ip access-list weak-block deny tcp src any sport any dest any dport eq 1025 ip access-list weak-block deny udp src any sport any dest any dport eq 1025 ip access-list weak-block deny tcp src any sport any dest any dport eq 2000 ip access-list weak-block deny udp src any sport any dest any dport eq 2000 ip access-list weak-block deny tcp src any sport any dest any dport eq 2049 ip access-list weak-block deny udp src any sport any dest any dport eq 2049 ip access-list weak-block deny tcp src any sport any dest any dport eq 2766 ip access-list weak-block deny udp src any sport any dest any dport eq 2766 ip access-list weak-block deny tcp src any sport any dest any dport range 6000 6063 ip access-list weak-block deny udp src any sport any dest any dport range 6000 6063 ip access-list weak-block deny tcp src any sport any dest any dport eq 12345 ip access-list weak-block deny udp src any sport any dest any dport eq 12345 ip filter forced-reassembly ! ! ! ! ! ! ! dns cache enable ! proxy-dns ip enable proxy-dns server 8.8.8.8 priority 200 proxy-dns server 8.8.4.4 proxy-dns ipv6 enable ! telnet-server ip enable telnet-server ip access-list mynetwork ! ! ! ! ! ! ! ! ! ip dhcp profile lan assignable-range 192.168.0.100 192.168.0.254 subnet-mask 255.255.255.0 dns-server 192.168.0.1 ! device FastEthernet0/0 ! device FastEthernet0/1 ! device FastEthernet1/0 ! device BRI1/0 isdn switch-type hsd128k ! interface FastEthernet0/0.0 ip address 192.168.0.1/24 ip dhcp binding lan ipv6 address autoconfig no shutdown ! interface FastEthernet0/1.0 ip address dhcp receive-default ip napt enable ip filter strict-block 1 in ip filter weak-block 100 in ip filter specialuse 101 in ip filter all-pass 65000 in ip filter strict-block 1 out ip filter mynetwork 50 out ip filter weak-block 100 out ip filter specialuse 101 out ip filter all-pass 65000 out ipv6 address autoconfig no shutdown ! interface FastEthernet1/0.0 no ip address shutdown ! interface BRI1/0.0 encapsulation ppp no auto-connect no ip address shutdown ! interface Loopback0.0 no ip address ! interface Null0.0 no ip address
IX2015設定メモ
2010年1月5日
主要コマンドのメモ
時間の設定
Router(config)# timezone 9
Router(config)# ntp retry 3
Router(config)# ntp interval 3600
Router(config)# clock 16 01 0 3 1 2010
Router(config)# show clock
Sunday, 3 January 2010 16:01:28 +09 00
ホスト名の設定(任意）
Router(config)# hostname cu
cu(config)#
保存
Router(config)# write memory
Building configuration…
% Warning: do NOT enter CNTL/Z while saving to avoid config corruption.
Router(config)#
インターフェイス状態の確認
Router(config)# show interfaces FastEthernet0/0.0
Interface FastEthernet0/0.0 is administratively down
Fundamental MTU is 1500 octets
Current bandwidth 100M b/s, QoS is disabled
Datalink header cache type is none: 0/0 (standby/dynamic)
SNMP MIB-2:
ifIndex is 518
Logical INTERFACE:
Elapsed time after clear counters 0:11:00
0 packets input, 0 bytes, 0 errors
0 unicasts, 0 non-unicasts, 1 unknown protos
0 drops, 0 misc errors
0 output requests, 0 bytes, 0 errors
0 unicasts, 0 non-unicasts
0 overflows, 0 neighbor unreachable, 0 misc errors
1 link-up detected, 0 link-down detected
Encapsulation ETHERNET:
State is initialized
FastEthernet status:
Physical address is 00:30:13:36:ce:03
Port status is up
Full-duplex, 100M b/s, 100BaseTX
Promiscuous mode is disabled
Statistics:
Rx errors:
0 alignment errors, 0 CRC errors
0 long frames, 0 short frames, 0 overflows
Tx errors:
0 single collisions, 0 multiple collisions
0 excessive collisions, 0 late collisions
0 deferred transmissions, 0 carrier sense errors
0 underflows
Router(config)#
FE0/0に固定IP設定
Router(config)# interface FastEthernet0/0.0
Router(config-FastEthernet0/0.0)# ip address 192.168.0.1/24
Router(config-FastEthernet0/0.0)# ipv6 address autoconfig
Router(config-FastEthernet0/0.0)# no shutdown
Router(config-FastEthernet0/0.0)# show ip address
FE0/1にDHCP設定
Router(config)# interface FastEthernet0/1.0
Router(config-FastEthernet0/1.0)# ip address dhcp
Router(config-FastEthernet0/1.0)# ipv6 address autoconfig
Router(config-FastEthernet0/1.0)# no shutdown
Router(config-FastEthernet0/1.0)# show ip address
Router(config-FastEthernet0/1.0)# ip nat enable
NAT設定
Router(config)# interface FastEthernet0/1.0
Router(config-FastEthernet0/1.0)# ip nat translation timeout 3600
Router(config-FastEthernet0/1.0)# ip nat dynamic list lan pool abc
Router(config-FastEthernet0/1.0)# ip nat enable
telnetサーバ
Router(config)# ip access-list lan permit ip src 192.168.0.0/24 dest any
Router(config)# telnet-server ip access-list lan
Router(config)# telnet-server ip enable
default route設定
Router(config)# ip route default FastEthernet0/1.0 dhcp
NTPサーバ設定
Router(config)# ntp server 133.27.4.121
Router(config)# ntp server 210.173.160.27
Router(config)# ntp ip enable
DHCPサーバ設定
Router(config)# ip dhcp profile lan
Router(config-dhcp-lan)# assignable-range 192.168.0.100 192.168.0.254
Router(config-dhcp-lan)# subnet-mask 255.255.255.0
Router(config-dhcp-lan)# dns-server 192.168.0.1
Router(config-dhcp-lan)# exit
Router(config)# ip dhcp enable
Router(config)# interface FastEthernet0/0.0
Router(config-FastEthernet0/0.0)# ip dhcp binding lan
Router(config-FastEthernet0/0.0)# exit
DNS proxy設定
Router(config)# dns cache enable
Router(config)# proxy-dns ip enable
Router(config)# proxy-dns ipv6 enable
UFSキャッシュ有効化
UFS キャッシュ（Unified Forwarding Service Cache）は、フィルタ、NAT/NAPT、IPSec など
のサービスを使用している場合に有効な高速フォワーディングキャッシュメカニズムであり、
IX1000/2000/3000 の独自機能です。UFS キャッシュにより、フィルタの多段設定、IPSec の複
数設定等におけるスケーラビリティを向上させます。Ver4.2 以降の IPv4、IPv6 それぞれで設定
できます。Ver.4.3 以降ではポリシールーティングが、Ver.7.3以降では、QoS、ダイナミックフィ
ルタでも UFS キャッシュが適用されます。
Router(config)# ip ufs-cache enable
Filtering設定
ip access-list strict-block deny tcp src any sport any dest any dport eq 137
ip access-list strict-block deny udp src any sport any dest any dport eq 137
ip access-list strict-block deny udp src any sport any dest any dport eq 138
ip access-list strict-block deny tcp src any sport any dest any dport eq 139
ip access-list strict-block deny tcp src any sport any dest any dport eq 445
ip access-list strict-block deny udp src any sport any dest any dport eq 445
ip access-list weak-block deny tcp src any sport any dest any dport eq 1
ip access-list weak-block deny udp src any sport any dest any dport eq 1
ip access-list weak-block deny tcp src any sport any dest any dport eq 11
ip access-list weak-block deny udp src any sport any dest any dport eq 11
ip access-list weak-block deny tcp src any sport any dest any dport eq 15
ip access-list weak-block deny udp src any sport any dest any dport eq 15
ip access-list weak-block deny tcp src any sport any dest any dport eq 70
ip access-list weak-block deny udp src any sport any dest any dport eq 70
ip access-list weak-block deny tcp src any sport any dest any dport eq 79
ip access-list weak-block deny udp src any sport any dest any dport eq 79
ip access-list weak-block deny tcp src any sport any dest any dport eq 87
ip access-list weak-block deny udp src any sport any dest any dport eq 87
ip access-list weak-block deny tcp src any sport any dest any dport eq 95
ip access-list weak-block deny udp src any sport any dest any dport eq 95
ip access-list weak-block deny tcp src any sport any dest any dport eq 111
ip access-list weak-block deny udp src any sport any dest any dport eq 111
ip access-list weak-block deny tcp src any sport any dest any dport eq 135
ip access-list weak-block deny udp src any sport any dest any dport eq 135
ip access-list weak-block deny tcp src any sport any dest any dport eq 144
ip access-list weak-block deny udp src any sport any dest any dport eq 144
ip access-list weak-block deny tcp src any sport any dest any dport eq 161
ip access-list weak-block deny udp src any sport any dest any dport eq 161
ip access-list weak-block deny tcp src any sport any dest any dport eq 162
ip access-list weak-block deny udp src any sport any dest any dport eq 162
ip access-list weak-block deny tcp src any sport any dest any dport eq 177
ip access-list weak-block deny udp src any sport any dest any dport eq 177
ip access-list weak-block deny tcp src any sport any dest any dport eq 220
ip access-list weak-block deny udp src any sport any dest any dport eq 220
ip access-list weak-block deny tcp src any sport any dest any dport eq 445
ip access-list weak-block deny udp src any sport any dest any dport eq 445
ip access-list weak-block deny tcp src any sport any dest any dport eq 512
ip access-list weak-block deny udp src any sport any dest any dport eq 512
ip access-list weak-block deny tcp src any sport any dest any dport eq 513
ip access-list weak-block deny udp src any sport any dest any dport eq 513
ip access-list weak-block deny tcp src any sport any dest any dport eq 514
ip access-list weak-block deny udp src any sport any dest any dport eq 514
ip access-list weak-block deny tcp src any sport any dest any dport eq 515
ip access-list weak-block deny udp src any sport any dest any dport eq 515
ip access-list weak-block deny tcp src any sport any dest any dport eq 517
ip access-list weak-block deny udp src any sport any dest any dport eq 517
ip access-list weak-block deny tcp src any sport any dest any dport eq 518
ip access-list weak-block deny udp src any sport any dest any dport eq 518
ip access-list weak-block deny tcp src any sport any dest any dport eq 520
ip access-list weak-block deny udp src any sport any dest any dport eq 520
ip access-list weak-block deny tcp src any sport any dest any dport eq 540
ip access-list weak-block deny udp src any sport any dest any dport eq 540
ip access-list weak-block deny tcp src any sport any dest any dport eq 1025
ip access-list weak-block deny udp src any sport any dest any dport eq 1025
ip access-list weak-block deny tcp src any sport any dest any dport eq 2000
ip access-list weak-block deny udp src any sport any dest any dport eq 2000
ip access-list weak-block deny tcp src any sport any dest any dport eq 2049
ip access-list weak-block deny udp src any sport any dest any dport eq 2049
ip access-list weak-block deny tcp src any sport any dest any dport eq 2766
ip access-list weak-block deny udp src any sport any dest any dport eq 2766
ip access-list weak-block deny tcp src any sport any dest any dport range 6000 6063
ip access-list weak-block deny udp src any sport any dest any dport range 6000 6063
ip access-list weak-block deny tcp src any sport any dest any dport eq 12345
ip access-list weak-block deny udp src any sport any dest any dport eq 12345
ip access-list specialuse deny ip src 0.0.0.0/8 dest any
ip access-list specialuse deny ip src 10.0.0.0/8 dest any
ip access-list specialuse deny ip src 172.16.0.0/12 dest any
ip access-list specialuse deny ip src 192.168.0.0/16 dest any
ip access-list specialuse deny ip src 127.0.0.0/8 dest any
ip access-list specialuse deny ip src 169.254.0.0/16 dest any
ip access-list specialuse deny ip src 192.0.2.0/24 dest any
ip access-list specialuse deny ip src 224.0.0.0/3 dest any
ip access-list specialuse deny ip src 198.18.0.0/15 dest any
ip access-list mynetwork permit ip src 192.168.0.0/24 dest any
ip access-list all-pass permit ip src any dest any
ip filter forced-reassembly
interface FastEthernet0/1.0
ip filter all-pass 65000 in
ip filter all-pass 65000 out
ip filter mynetwork 50 out
ip filter strict-block 1 in
ip filter strict-block 1 out
ip filter weak-block 100 in
ip filter weak-block 100 out
ip filter specialuse 101 in
ip filter specialuse 101 out
再起動
# スタートアップコンフィグのロード、DRAMメモリのクリア
restart
# プログラムのロード、スタートアップコンフィグのロード、DRAMメモリのクリア
reload
不思議な所
ip filterでdenyしているにもかかわらずnatテーブルができてしまう。もしかして、filterを通過しているのかと思ったけどちゃんとパケットは落とされている。謎。
いけてないところ
WAN側のIFはISPからDHCPでIPが振られているのだが、そのリース期限は6時間。
6時間毎にIFがIPをリリースし、一度downしてしまう。よって、NAPTテーブルも全部クリアされてしまう。再度割り当てられるIPは同じIPなので、とても不便。
すばらしい安定性
1ヶ月運用しているが、一度も再起動しないで稼働している。
参考サイト
Firewallの設定はこちらを参考にしました。
http://www.kozupon.com/network/ix2015.html
変更履歴
2010/2/23 DHCPのフィルタ削除。
以下、削除部分。
ip access-list weak-block deny tcp src any sport any dest any dport eq 67
ip access-list weak-block deny udp src any sport any dest any dport eq 67
ip access-list weak-block deny tcp src any sport any dest any dport eq 68
ip access-list weak-block deny udp src any sport any dest any dport eq 68
NECルータ自動再起動
2009年11月2日
すぐハングアップするルータの対処方法を書きます。
こちらの続きです。http://matsu.tymy.net/blog/2009/09/10/atermbr-745f68/
続きを読む >
AtermBR-745F68
2009年9月10日
FiberbitでレンタルしているAtermBRとかいうルータがここ1ヶ月ぐらい調子が悪かった。
ルータを取り替えても、サポートに3回ぐらい電話しても原因が判明せず。。。「PCが悪い！」とか言われたりもした。
結局は、このルータNATテーブルがオーバーフローするのが原因。
http://butsuyokudaimajin.blogspot.com/2008/02/necnat-tx-error-list-create-error.html
NEC製ルーター被害者の会というスレがいっぱいあった。
最近のコメント