Fireware How To Dynamic Routing

Transcription

1 Fireware How To Dynamic Routing How do I configure the Firebox to use RIP? Introduction A routing protocol is the language a router speaks with other routers to share information about the status of network routing tables. With static routing, routing tables are set and do not change. If a router on the remote path fails, a packet cannot get to its destination. Dynamic routing lets routing tables in routers change as the routes change. If the best path to a destination cannot be used, dynamic routing protocols change routing tables when necessary to keep your network traffic moving. Fireware Pro gives support to RIP v1 and v2, OSPF, and BGP v4 dynamic routing protocols. RIP (Routing Information Protocol) is used to manage router information in a self-contained network, such as a corporate LAN or a private WAN. With RIP, a gateway host sends its routing table to the closest router every 30 seconds. This router, in turn, sends the contents of its routing tables to neighboring routers. RIP is best for small networks. This is because the transmission of the full routing table every 30 seconds can put a large traffic load on the network, and because RIP tables are limited to 15 hops. OSPF is a better alternative for larger networks. There are two versions of RIP. RIP v1 uses a UDP broadcast over port 520 to send updates to routing tables. RIP v2 uses multicast to send routing table updates. Is there anything I need to know before I start? To use any of the dynamic routing protocols with Fireware, you must import or type a dynamic routing configuration file for the routing daemon you choose. This configuration file includes information such as a password and log file name. You can find a sample RIP configuration file in this FAQ: Notes about configuration files: The! and the # characters are comment characters. If the first character of the word is one of the comment characters, then the rest of the line is interpreted as a comment. If the comment character is not the first character of the word, it is interpreted as a command. Usually, you can use the word no at the beginning of the line to disable a command. For example: no network /24 area disables the backbone area on the specified network. Supported RIP routing commands to use in your routing daemon configuration file To create or modify a routing configuration file, here is a catalog of supported routing commands for RIP v1 and RIP v2. If you use RIP v2, you must include the subnet mask with any command that uses a network IP address or RIP v2 will not operate. The sections must appear in the configuration file in the same order they appear in this table. 1

2 RIP Routing Commands Section Command Description Set simple password or MD5 authentication on an interface interface eth[n] ip rip authentication string [PASSWORD] key chain [KEY-CHAIN] key [INTEGER] key-string [AUTH-KEY] interface eth[n] ip rip authentication mode md5 ip rip authentication mode key-chain [KEY-CHAIN] Configure RIP routing daemon Begin section to set authentication type for interface Set RIP authentication password Set MD5 key chain name Set MD5 key number Set MD5 authentication key Begin section to set authentication type for interface Use MD5 authentication Set MD5 authentication key-chain router rip Enable RIP daemon version [1 2] Set RIP version to 1 or 2 (default version 2) ip rip send version [1 2] Set RIP to send version 1 or 2 ip rip receive version [1 2] Set RIP to receive version 1 or 2 no ip split-horizon Disable split-horizon; enabled by default Configure interfaces and networks no network eth[n] passive-interface eth[n] passive-interface default network [A.B.C.D/M] neighbor [A.B.C.D/M] Distribute routes to RIP peers and inject OSPF or BGP routes to RIP routing table default-information originate redistribute kernel redistribute connected redistribute connected routemap [MAPNAME] redistribute ospf redistribute ospf route-map [MAPNAME] redistribute bgp redistribute bgp route-map [MAPNAME] Configure route redistribution filters with route maps and access lists access-list [PERMIT DENY] [LISTNAME] [A.B.C.D/M ANY] Share route of last resort (default route) with RIP peers Redistribute firewall static routes to RIP peers Redistribute routes from all interfaces to RIP peers Redistribute routes from all interfaces to RIP peers, with a route map filter (mapname) Redistribute routes from OSPF to RIP Redistribute routes from OSPF to RIP, with a route map filter (mapname) Redistribute routes from BGP to RIP Redistribute routes from BGP to RIP, with a route map filter (mapname) Create an access list to only allow or deny redistribution of an IP address or of any 2

3 Configuring your Firebox to Use RIP v1 Section Command Description route-map [MAPNAME] permit [N] match ip address [LISTNAME] Create a route map with a name and allow with a priority of N Configuring your Firebox to Use RIP v1 1 From Policy Manager, select Network > Dynamic Routing. The Dynamic Routing Setup dialog box appears. 2 Click Enable Dynamic Routing and Enable RIP. 3 Click Import to import a routing daemon configuration file, or type your configuration file in the text box. If you click Import, you can browse to the location of the RIP daemon configuration template. It is located in C:\Documents and Settings\My Documents\My WatchGuard. 4 Click OK. Allowing RIP v1 traffic through the Firebox You must add and configure a policy to allow RIP broadcasts from the router to the network broadcast IP address. You must also add the IP address of the Firebox interface to the To field. 1 From Policy Manager, select Edit > Add Policies. From the list of packet filters, select RIP. Click Add. The New Policy Properties window appears for RIP.

4 2 In the New Policy Properties dialog box, configure the policy to allow traffic from the IP or network address of the router that uses RIP to the Firebox interface it connects to. You must also add the network broadcast IP address. 3 Click OK. Configuring Fireware to Use RIP v2 1 In Policy Manager, select Network > Dynamic Routing. The Dynamic Routing Setup dialog box appears. 2 Click Enable Dynamic Routing and Enable RIP. 4

5 3 Click Import to import a routing daemon configuration file, or type your configuration parameters in the text box. If you click Import, you can browse to the location of the RIP daemon configuration file. It is located in C:\Documents and Settings\My Documents\My WatchGuard. 4 Click OK. Allowing RIP v2 traffic through the Firebox You must add and configure a policy to allow RIP v2 multicasts from the routers that have RIP v2 enabled to the reserved multicast IP address for RIP v2. 1 From Policy Manager, select Edit > Add Policies. From the list of packet filters, select RIP. Click Add. The New Policy Properties window appears for RIP. 2 In the New Policy Properties window, configure the policy to allow traffic from the IP or network address of the router using RIP to the multicast address Click OK. SUPPORT: U.S. and Canada All Other Countries COPYRIGHT 2006 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, Firebox, and Core are registered trademarks or trademarks of WatchGuard Technologies, Inc. in the United States and/or other countries. 5

6 Frequently Asked Questions About This Procedure What s the best way to get started? To get started, you really only need two commands in your RIP configuration file. These two commands, in this order, will start the RIP process: router rip network <network IP address of the interface you want the process to listen on and distribute through the protocol> On the Firebox, you also need to add the RIP policy as described in the document above. You can configure to policy to allow any to any until you are sure RIP is working, and then restrict the policy as recommended above. Finally, you must set up the router for the Firebox to talk to. After it is configured, look at the Firebox Status Report dynamic routing section to verify that the Firebox and the router are sending updates to each other. You can then add authentication and restrict the RIP policy to listen only on the correct interfaces. 6