JadeOS User Manual SK‐A2960‐182 03
Copyright © 2013 Skspruce, Inc. All rights reserved. No part of this documentation may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation, or adaptation) without prior, express and written permission from Skspruce, Inc. Skspruce, Inc. reserves the right to revise this documentation and to make changes in content from time to time without obligation on the part of Skspruce, Inc. to provide no‐ tification of such revision or changes.
This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) this device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation.
Important Notice on Product Safety Elevated voltages are inevitably present at specific points in this electrical equipment. Some of the parts may also have elevated operating temperatures. Non‐observance of these conditions and the safety instructions can result in personal injury or in property damage. Therefore, only trained and qualified personnel may install and maintain the system. All equipment connected has to comply with the applicable safety standards.
Content Content................................................................................................................... 1 Chapter 1 Preface ................................................................................................... 1 1.1 Intended Audience...............................................................................................1 1.2 Structure of this Document..................................................................................1 1.
3.4.3 Reset JadeOS ...............................................................................................12 3.4.4 Files Import/Export.....................................................................................12 3.5 System Update ...................................................................................................13 3.6 File Operations...................................................................................................14 3.6.1 Basic Operations ..................
5.1.2 Configuring Bridge ......................................................................................26 5.1.3 Dynamic Table.............................................................................................26 5.1.4 Bridge Aging ................................................................................................27 5.1.5 Static Table ..................................................................................................27 5.2 Port Mirror .............................
6.7.6 OSPF Point‐to‐point Configuration Example...............................................40 6.8 Configuring IPv6 .................................................................................................42 6.8.1 Address Configuration.................................................................................42 6.8.2 Routing Configuration .................................................................................42 6.8.3 Ping6 ...........................................................
9.4.2 Configuring role ..........................................................................................57 9.4.3 Configuring Radius Server Group................................................................57 9.4.4 Configuring Authentication Way.................................................................58 9.4.5 Configuring AAA Profile ..............................................................................58 9.4.6 Binding VLAN ..........................................................
10.1.6 Authentication Mode................................................................................73 10.1.7 STATION Management ..............................................................................73 10.2 Forwarding Mode.............................................................................................73 10.3 Configuring Power............................................................................................74 10.4 Configuring Radio.........................................
Chapter 1 Preface This preface describes the audience, structure, conventions and history of changes of JadeOS User Manual. It also provides important information about safety instructions for the JadeOS. 1.1 Intended Audience This document is intended to the experienced network administrators who need to configure and maintain JadeOS Multi‐Service Gateway. 1.2 Structure of this Document Chapter Title Subject This chapter provides an introduction to this Chapter 1 Preface document.
The following symbols and conventions are used in this document: 1.3.1 Symbols Used CAUTION: Means that the reader should be careful. In this situation, you might do something that could result in equipment damage or loss of data. WARNING: This warning symbol means danger. You are in a situation that could cause bodily injury. Before you work on any equipment, be aware of the haz‐ ards involved with electrical circuitry and be familiar with standard practices for pre‐ venting accidents. 1.3.
Chapter 2 System Overview 2.1 System Introductions SKG10000 Plus is a gateway equipment of telecommunication level that integrated with the functions of routing, switching and WLAN controller and so on. Based on the multi‐core and multi‐thread processor and designed with telecom grade ATCA standard, SKG10000 Plus is with powerful and extensible performance. With centralized management and configuration, it gives the ability of deployment for a large network with hundreds of gateways.
z z Fragmentation and Reassembly IPv4/IPv6 Security and AAA (Authentication, Authorization, Accounting) z z z z z z z z Access Control List (Interface/Standard/Session ACL) Role‐Based User Policy Web Portal/802.
2.3 Feature Highlights Extensible DHCP Server DHCP server offers 700 pps users per thread that can meet carrier‐grade scenarios that requires high performance and high availability. z Scalable performance and throughout - Optimized database By keeping lease information in a memory‐resident database, DHCP server offers fast response times for lease assignments and renewals. - Multi‐threaded architecture JadeOS uses a multi‐threaded architecture to deliver consistent throughput.
JadeOS.
Chapter 3 CLI and System Management JadeOS uses the command Line Interface (CLI) to implement the interaction between users and the operating system. Users can complete a range of system configuration and realize the management functions through the CLI. This chapter describes CLI and system operations. 3.1 CLI Access The console port on the equipment is Rj45 interface and located on the front panel of each line card.
Step 4 Enter the global mode using the following command: (JadeOS) > enable Password: enable When you are in enable mode, the > prompt changes to a pound sign (#): (JadeOS) # Step 5 Enter the configuration mode using the following command: (JadeOS) # configure terminal When you are in the configuration mode, ‘config’ appears before the # prompt: (JadeOS) (config) # 3.1.2 CLI Access via a Remote Console Users can access JadeOS remotely using TELNET from a TCP/IP network.
3.2.1 Command mode The CLI is divided into many different modes. The commands available to you at any given time depend on the mode that you are currently in. Entering a question mark (?) at the CLI prompt allows you to obtain a list of commands available for each command mode. When you log in to the CLI, you are in user mode. User mode contains only a limited subset of commands. To have access to all commands, you must enter enable mode normally by using a password.
mand. For example: (JadeOS) > ? enable Turn on Privileged commands exit Exit this session. Any unsaved changes are lost. help Help on CLI command line processing and a Description of the interactive help system logout Exit this session. Any unsaved changes are lost. ping Send ICMP echo packets to specified ip address. traceroute Trace route to the specified ip address. When typed at the end of a possible command or abbreviation, the question mark lists the commands that match (if any).
in for you automatically. If the abbreviation is too vague (too few characters), the cursor does not advance and you must type more characters or use the help feature to list the matching commands. 3.2.4 Deleting Configuration Settings Use the no command to delete or negate previously‐entered configurations or pa‐ rameters. To view a list of no commands, type no at the enable or ‘config’ prompt followed by the question mark. (JadeOS) (config) # no? 3.2.
For example, we configure a route to administrator subnet 192.168.0.0/24 through next hop 192.168.1.1. (JadeOS)(config)#ip route 192.168.0.0/24 192.168.1.1 3.4 Configuring Management 3.4.1 Inquire Configuration To view present configuration, use the command: (JadeOS) # show running-config 3.4.2 Saving Configuration Changes When you make configuration changes via the CLI, those changes affect the current running configuration only.
You can save configuration files into JadeOS and copy to an external server. copy startup-config flash: copy startup-config tftp: copy running-config flash: copy running-config ftp: [] copy running-config startup-config copy running-config tftp: 3.5 System Update The system image file is stored in the Compact Flash (CF) on each line card.
(JadeOS) #show image version ---------------------------------Partition Software Version Built on : 0:0 (/dev/sda1) : JadeOS 2.3.2.0 : SMP Thu Dec 19 18:01:40 CST 2013 ---------------------------------Partition Software Version Built on : 0:1 (/dev/sda2) : JadeOS 2.2.6.0 : SMP Mon Nov 18 14:58:24 CST 2013 3.6 File Operations 3.6.
tion • Log files You can use the following protocols to transfer files between JadeOS and external server or host: • File Transfer Protocol (FTP) • Trivial File Transfer Protocol (TFTP) Sever Type Configuration Trivial File Transfer Proto- IP address of the server col(TFTP) Filename IP address of the server Username and password to log into server File Transfer Protocol(FTP) Filename Table 3‐ 3 Parameters of TFTP and FTP Configuration 3.6.
To inquire users in the system, you can use the command: (JadeOS) #who vty[0] connected from 192.168.16.21 vty[1] connected from 192.168.16.22 vty[2] connected from 192.168.16.19 vty[3] connected from 192.168.16.19 3.8 Configuring System Settings 3.8.1 Setting Hostname The factory default hostname is JadeOS. You can change the hostname using the fol‐ lowing command: hostname For example: (JadeOS) (config) #hostname Gate (Gate) (config) # 3.8.
is used as the standard for setting the time zone.
(JadeOS)(config)#ntp authenticate (JadeOS)(config)#ntp authentication-key md5 (JadeOS)(config)#ntp trusted-key (JadeOS)(config)#ntp server iburst Example of configuring NTP authentication： (JadeOS)(config)#ntp authenticate (JadeOS)(config)#ntp authentication-key 1 md5 123 (JadeOS)(config)#ntp trusted-key 1 (JadeOS)(config)#ntp server 1.1.1.1 iburst 3.9 Ping and Traceroute Command ping and traceroute can help to diagnose network connection status. Command format: ping A.
Chapter 4 Interface Configuration This chapter will describe how to configure interface. 4.1 Naming Ethernet Port GigabitEthernet is GE port, and parameter ‘word’ format is . ‘slot’ means slot number, ‘port’ means port number. Both start with value 0 and range depends on the real number of Ethernet. For example, gigabitEthernet 1/0, gigabitEthernet 1/1 and gigabitethernet 1/2 means the first Ethernet port, the second Ethernet port and the third Ethernet port of the first slot.
Command Description Vlan 2 Create vlan 2 vlan 3 name "VLAN3" No vlan 2 Create vlan 3，and name as“vlan 3” delete vlan 2 Table 4‐1 command descriptions 4.3 Adding Ethernet Port into VLAN The Ethernet port can be set in access mode or trunk mode, and then added into a VLAN. The Ethernet port is in access mode by default. If it is set in trunk mode, the port can carry data of multi VLAN Tag. The port channel can be set in access mode or trunk mode.
For example，add gigabitethernet 1/2 into access vlan 2 (JadeOS)(config) #interface gigabitethernet 1/2 (JadeOS)(config-if)#switchport mode trunk (JadeOS)(config-if)#switchport trunk native vlan 4 (JadeOS)(config-if)#switchport trunk allowed vlan add 5-10,11,12 4.4 Configuring VLAN Interface Command to configure VLAN Interface: interface vlan <1-4094> Note: you need to create VLAN first before configuring Vlan Interface. For example： (JadeOS) (config)#interface vlan 2 (JadeOS) (config-if)#ip address 10.0.
Inquire LAG by using show Interface port‐channel command: (JadeOS)#show interface port-channel 2 Port-Channel 2 is administratively up Hardware is Port-Channel, address is 04:8B:42:10:0D:0B (bia 04:8B:42:10:0D:0B) Description: Link Aggregate (LACP) Spanning Tree is disabled VLAN membership: 190 Switchport priority: 0 Member port: GE 4/3, Admin is up, line protocol is up GE 4/4, Admin is up, line protocol is up link status last changed 0 day 0 hr 16 min 46 sec 106198 packets input, 21374111 byt
4.6 Configuring QinQ 4.6.1 Configuring QinQ Defined in IEEE802.1Q, VLAN Tag domain only uses 12 bytes to indicate VLAN ID, so equipment can support up to 4094 VLANs. Some scenarios, especially in metropoli‐ tan area network, require a separate VLAN for customers. Therefore, 4094 VLAN cannot meet the requirement. The 802.1QinQ expands VLAN space by using a VLAN‐in‐VLAN hierarchy and tagging the tagged packets. At the same time, QinQ makes SP use one VLAN supports the entire customer's VLANs.
address and routing in it. 2 QinQ Tag will be peeled when receiving data, and 2 QinQ Tag will be encapsulated when sending data. You can configure different services (for example, different authentication policies or bandwidth control policies) on different inner tag when data received in QinQ sub‐interface. 4.
25 Gi 12/12 unassigned / unassigned down down Gi 12/14 unassigned / unassigned down down Gi 12/16 unassigned / unassigned down down Gi 12/18 unassigned / unassigned down down JadeOS User Manual
Chapter 5 Layer‐2 Network Service JadeOS provides layer‐2 network service. This chapter will describe bridge forwarding and port mirror. 5.1 Bridge Forwarding 5.1.1 Bridge Description Bridge is used for the interconnection among two or more Layer‐2 network and data frame forwarding based on MAC address of Layer‐2 network. Bridge supports MAC address learning. Bridge will create one bridge table based on source MAC address when one data frame from one MAC address first going through bridge.
Datapath Bridge Table Entries ----------------------------Flags: P - Permanent, D - Deny, M - Mobile, L - Local MAC VLAN Assigned VLAN Destination -------------- ---- ------------- --------- Flags Aging-time ----- ------- 04:8B:42:12:00:81 5 5 Local PL 04:8B:42:12:0A:81 85 85 Local PL 04:8B:42:12:0A:A1 86 86 Local PL 04:8B:42:12:0A:C1 87 87 Local PL 04:8B:42:12:0A:E1 88 88 Local PL 5.1.4 Bridge Aging The bridge aging time is 15 minutes by default.
Chapter 6 Layer‐3 Network Service JadeOS provides layer‐3 network service. This chapter will describe how to configure IP address, static routing, GRE tunnel, DHCP, OSPF, and IPv6 and so on. 6.1 Configuring IP Address 6.1.1 Configuring IP Address Use the following commands to assign a static IP address to a port on JadeOS: interface gigabitethernet / no switchport ip address 6.1.
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default S 10.2.20.0/24 [1/0] via 192.168.20.1, mgmt 1 S 18.0.0.0/8 [1/0] via 192.168.20.1, mgmt 1 C 80.1.0.0/16 is directly connected, vlan 80 C 119.6.100.0/24 is directly connected, Gi 12/0 S 119.6.200.
Address HWaddress Interface Type 192.168.20.1 00:13:1A:A5:CC:80 mgmt 1 Dynamic 192.168.20.15 00:15:C5:F3:35:B2 mgmt 1 Dynamic 192.168.20.152 00:14:22:19:FC:C4 mgmt 1 Dynamic 119.6.100.1 C4:64:13:D1:9A:EA Gi 12/0 Dynamic 192.168.20.226 04:8B:42:10:6C:1C mgmt 1 Dynamic 172.50.3.2 04:8B:42:20:00:F5 Gi 12/2 Dynamic 6.3.2 Configuring ARP Proxy Proxy ARP includes local proxy ARP and proxy ARP.
(JadeOS) (config-if)#mtu 1460 (JadeOS) (config-if)#tcp4mss 1440 6.5 Configuring GRE Tunnel GRE (Generic Routing Encapsulation) specifies a protocol for encapsulation of an ar‐ bitrary protocol over another arbitrary network layer protocol. GRE defined in RFC 2784 and updated by RFC 2890.
6.6.1 Configuring DHCP Server To configure DHCP server, use following command: Step 1 Create one or more DHCP address pool： ip dhcp pool Step 2 Specify the gateway of DHCP client default-router A.B.C.D Step 3 Specify the DNS server of DHCP client dns-server A.B.C.
3 Free leases 64532 Active leases 1001 Abandoned leases 0 Reserved leases 0 Inquire DHCP lease information (JadeOS) #show ip dhcp binding lease 13.0.6.202 { starts Mon Dec 23 10:41:30 2013 ends Mon Dec 23 10:42:30 2013 binding state active; next binding state free; hardware ethernet 00:50:ba:50:73:2b; uid "\001\000P\272Ps+"; } lease 13.0.6.238 { starts Mon Dec 23 10:41:33 2013 ends Mon Dec 23 10:42:33 2013 binding state active; next binding state free; hardware ethernet 00:50:ba:50:75:2b; uid "\001
Dhcp Server Packet Statistics: Receive packet: Discover 0 Request 0 Release 0 Decline 0 Inform 0 Leasequery Unkown 0 0 Send packet: Offer 0 Ack 0 Nak 0 Other packet: Bootp 0 Boopreply 0 Offer Speed 0 client/sec Speed: 6.6.3 Configuring DHCP Relay JadeOS provides DHCP Relay function that enhances the DHCP function. A DHCP relay agent is any host that forwards DHCP packets between clients and servers.
Step 4 Specify the interface of DHCP Server (JadeOS)(config-dhcp-relay)# server-interface Step 5 Enable Relay (JadeOS)(config-dhcp-relay)# enable 6.6.4 DHCP Snooping DHCP Snooping acts as the firewall between untrust host and DHCP server, which avoid interfere and attack to the legal user. Through DHCP snooping, you can view the filtered illegal DHCP message.
00:50:ba:50:76:D8 13.0.6.237 300 D Gi 6/10 00:50:ba:50:76:D4 13.0.6.227 300 D Gi 6/10 Security Check Through binding table, DHCP snooping module determine whether the DHCP mes‐ sage sent by user is legal or not, and then reject illegal DHCP request if illegal. Enabling MAC address detection, DHCP snooping can avoid attack by checking whether the MAC address of DHCP protocol match with the source MAC address of Ethernet.
(JadeOS) (config-if)#arp authorized Note: ARP learning will be disabled after enabling ARP with DHCP. ¾ Disable ARP with DHCP function： Step 1 To save client ARP information, use no update arp command to disable ARP function: (JadeOS) (config)#ip dhcp pool ABC (JadeOS) (config-dhcp)#no update arp Step 2 Enable ARP learning function (JadeOS) (config)#interface vlan 6 (JadeOS) (config-if)#no arp authorized You can inquiry client ARP information by show arp command. 6.
Enabling OSPF requires that you create an OSPF router ID which is the only identifier in an AS system and area ID which specify the range of routing process. If the router ID is not configured, the loopback interface IP will be taken as router ID. If there is no loopback interface, system will select a maximum IP address from all of interface IPs.
transmit a link state update packet on an OSPF in‐ terface. Table 6‐1 OSPF Interface Parameter mit-delay 6.7.4 Configuring OSPF Area JadeOS OSPF supports the following types of area: z Stub area Stub areas are areas in to which information on external routes is not sent. Instead, there is a default external route generated by the area border router, into the stub area for destinations outside the autonomous system.
(JadeOS)(config)# router ospf (JadeOS)(config-router) # area 1 nssa default-information-originate 6.7.5 Configuring OSPF Network Type JadeOS supports the following types of OSPF network: • Point‐to‐point networks(HDLC, Token Ring, FDDI) One point‐to‐point links such as HDLC and PPP, OSPF runs as a point‐to‐point network type.
Figure 6‐1 OSPF configuration example Step 1 Create VLAN and add interfaces to VLAN (Refer to chapter 4 for VLAN configuration) Step 2 Configure OSPF on JadeOS A (JadeOS-A) (config) #router ospf (JadeOS-A) (config-router) #ospf router-id 1.1.1.1 (JadeOS-A) (config-router) #network 192.168.10.0/24 area 0 (JadeOS-A) (config-router) #network 192.168.20.0/24 area 1 (JadeOS-A) (config) #interface vlan 10 (JadeOS-A) (config-if) #ip address 192.168.10.
(JadeOS-B) (config-if) #ip address 192.168.10.2/24 (JadeOS-A) (config-if) #ip ospf network point-to-point (JadeOS-B) (config) #interface vlan 30 (JadeOS-B) (config-if) #ip address 192.168.30.1/24 (JadeOS-A) (config-if) #ip ospf network point-to-point Step 4 Configure OSPF on JadeOS C (JadeOS-C) (config) #router ospf (JadeOS-C) (config-router) #ospf router-id 1.1.1.3 (JadeOS-C) (config-router) #network 192.168.20.
To configure IPv6 routing, use following command: ipv6 route / 6.8.
Chapter 7 Network Security JadeOS is always deployed in gateway, which much data goes through it. The network environment of equipment is very complex and faces network security threat. This chapter will describe JadeOS network security and how to configure it. 7.1 Access Control List (ACL) Access Control List (ACL) defines the network access.ACL is the combination of rules; each rule can specify one matched rule and one operation.
Step 2 Deny tcp traffic from 60.0.0.0/255.255.255.0 to 192.168.10.0/255.255.255.0 with port range 1‐1023. (JadeOS) (config-std-test-extended)# deny tcp 60.0.0.0 255.255.255.0 192.168.10.0 255.255.255.0 range 1 1023 Step 3 Permit all the tcp port 80 traffic to 192.168.10.0/255.255.255.0. (JadeOS) (config-std-test-extended)# permit tcp any 192.168.10.0 255.255.255.0 eq 7.1.
To inquire the number of present session, use show datapath session counters command.
lates the private (not globally unique) addresses in the internal network into legal addresses, before packets are forwarded to another network. As part of this capability, NAT can be configured to advertise only one address for the entire network to the outside world. This provides additional security by effectively hiding the entire internal network behind that address. NAT offers the dual functions of security and address conservation and is typically implemented in remote‐access environments.
Step 3 and Step 4 show how to apply ACL to VLAN 100, please refer to chapter 9.4 for more information. Step 3 Configure user role and apply ACl (JadeOS)(config)#user-role trole (JadeOS)(config-trole)#access-list session tacl Step 4 Configure AAA Profile, and specify user role (JadeOS)(config)#aaa profile test (JadeOS)(AAA profile “test”)#initial-role trole Step 5 Apply AAA profile to VLAN 100 (JadeOS)(config)#vlan 100 aaa profile test 7.3.
(JadeOS) (config) #aaa profile test (JadeOS) (AAA profile “test”) #http-redirection enable (JadeOS) (AAA profile “test”) #initial-role trole Step 4 Apply AAA profile to VLAN 100 (JadeOS) (config) #vlan 100 aaa profile test 7.4 Configuring DoS Anti‐attack The main function of DoS anti‐attack is to protect the operation system of control plane, which can make JadeOS work normally in malicious attack.
Two configuration commands in config mode: firewall cp-bandwidth-contract firewall sp-bandwidth-contract For example: To configure the rate limit of session creation is 50000 per second: (JadeOS) (config)#firewall sp-bandwidth-contract session pps 50000 To configure the rate limit of new online user is 700 per second: (JadeOS) (config)#firewall sp-bandwidth-contract user pps 700 To configure the rate of receiving DHCP
rule [acl-filter | host-filter | mac-filter | net-filter] send acl-filter add lawful intercept rule, intercept data streams host-filter add lawful intercept rule, intercept host data streams mac-filter add lawful intercept rule, intercept ethernet data streams net-filter add lawful intercept rule, intercept host data streams Figure 6‐4 Lawful interception To create Lawful interception gateway interface and rules on JadeOS, complete the following steps: Step 1 Enter the LI configuration m
Chapter 8 Configuring HQoS With the rapid development of the computer network, services such as bandwidth, delay, jitter sensitive voice and video are transferred through IP network tunnel. JadeOS support HQoS (hierarchical QoS) technology which can classify the type of service traffic; it can also uniformly manage and hierarchically schedule the transfer objects, such as several users, multi‐service, and several types of traffic and so on, which ensure the quality for different data service.
(JadeOS) (config-role)#bandwidth-contract BW-8M downstream (JadeOS) (config-role)#bandwidth-contract BW-2M upstream 53 JadeOS User Manual
Chapter 9 Configuring AAA This chapter describes AAA configuration, including user network access, bandwidth control policy and so on. 9.1 The Attribute of Trust and Untrust Interface means the inside interface of data packet; when the interface is the attrib‐ ute of trust, JadeOS will disable authentication function in this interface; when the interface is the attribute of untrust, JadeOS will enable authentication function in this interface.
Delete User: when user offline or no traffic for a long time, JadeOS will delete this user table. 9.2.2 User Role and ACL User role defines the network access. JadeOS specifies the network access of user by ACL. To create a user role in JadeOS, you need to create a session ACL, and then ap‐ ply the ACL to the user role. To create user role, use the following steps: Step 1 Configure a session ACL named pre‐auth‐acl (JadeOS) (config) #ip access-list session pre-auth-acl Step 2 Configure network access.
For example, configure a user role named pre‐auth that permit DNS traffic, but redi‐ rect all other traffic to port 443 to perform authentications by DNAT; configure a user role named post‐auth that allow all the traffic; use the following steps: (JadeOS) (config) #ip access-list session pre-auth-acl (JadeOS) (config-sess-pre-auth-acl)#any any udp 53 permit (JadeOS) (config-sess-pre-auth-acl)#any any tcp 0 65535 dst-nat ip 10.0.0.
9.4.1 Configuring ACL ACL is used to specify user’s network access. Please refer to chapter 9.2 and 9.3 for more information. 9.4.2 Configuring role Configuring AAA profile need to configure user role before authentication and after authentication. Please refer to chapter 9.3 for more information. 9.4.
allow‐fail‐through Allow traffic that failed authentication auth‐server Distribute authentication server set Set Role/Vlan rule 9.4.4 Configuring Authentication Way Authentications supported by JadeOS are captive‐portal, dot1x, mac, open, psk, wep, and radius‐proxy; usually the authentication way will specify default‐role, which is the user role after successfully authentication. This chapter will describe the con‐ figuration for authentication way by using web portal as an example.
Step 4 Specify the Radius Server Group, and enable accounting function (JadeOS) (AAA profile "aaa")#radius-accounting SG1 (JadeOS) (AAA profile "aaa")#radius-accounting enable Commands supported by AAA profile Attribute Description authentication‐dot1x Configure 802.
MAC authentication will be used together with other authentication ways (WPA, web‐auth) in usual, also it can be used independently. After detecting MAC address in the first time, JadeOS will enable authentication for this user.
9.7 WEB Portal Authentication Web authentication is an authentication scheme based on browser. User that failed authentication will redirect to a login page, and require to input user name and password; user can access the network only after successfully authentication. WEB redirect supports DNAT redirect and HTTP 302 redirect. 9.7.1 Web Authentication Process Web authentication is based on HTTP protocol; authentication will not pop up forci‐ bly unless user send HTTP request.
(JadeOS) (AAA profile "aaa")#http-redir-url-id 1 Step 3 Enable http 302 redirect (JadeOS) (AAA profile "aaa")#http-redirection enable 9.7.4 Configuring Portal Server JadeOS web authentication will customize the login page through external portal server. Portal server will configure a client according to RFC3576 definition; the client is used for sending users’ disconnection and authorization change information to JadeOS.
(JadeOS) (AAA profile "aaa") #disconnect-message-client 9.7.6 Configuring Captive‐portal Authentication Step 1 Configure authentication way (JadeOS) (config)#aaa authentication captive-portal web-portal (JadeOS) (Portal Authentication Profile "web-portal)#server-group SG1 (JadeOS) (Portal Authentication Profile "web-portal)#default-role postauth (JadeOS) (Portal Authentication Profile "web-portal")#rfc-3576-client 119.6.200.
To configure black‐list in JadeOS, use the following command: (JadeOS) (config) #netdestination black-list name www.sina.com (JadeOS) (config) # ip access-list session post (JadeOS)(config-sess-post) #any alias 123 any deny send-deny-response position 2 9.8 Radius Proxy JadeOS supports radius proxy.
plied in 3G network. EAP‐SIM authentication is performed when users use SIM card and EAP‐AKA authentication is performed when users use USIM card. EAP‐SIM and EAP‐AKA is specified in RFC 4186 and RFC 4187 respectively. Figure 9‐1 EAP‐SIM authentication To configure EAP‐SIM authentication on JadeOS, following the steps: Step 1 Configure Radius Server and Server Group (JadeOS) (config) # aaa authentication-server radius r1 (JadeOS) (RADIUS Server "r1") #host 1.1.1.
(JadeOS) (VAP Profile "default")#ssid-profile default Step 6 Configure ap‐template (JadeOS) (config)#ap-template default (JadeOS) (AP template "default")#vap-profile default 9.
Figure 9‐2 Web authentication configuration example Step 1 Configure VLAN and IP (JadeOS) (config) #vlan database (JadeOS) (config-vlan) #vlan range 11,30 (JadeOS) (config) #interface gigabitethernet 4/1 (JadeOS) (config-if)#switchport access vlan 30 (JadeOS) (config-if)#exit (JadeOS) (config) #interface gigabitethernet 4/4 (JadeOS) (config-if)#switchport access vlan 11 (JadeOS) (config-if)#exit (JadeOS) (config) #interface vlan 30 (JadeOS) (config-subif)#ip address 119.6.200.
(JadeOS) (config-dhcp)#network 119.6.200.0 255.255.255.0 (JadeOS) (config-dhcp)#default-router 119.6.200.1 (JadeOS) (config-dhcp)#dns-server 119.6.6.6 (JadeOS) (config-dhcp)#exit (JadeOS) (config) #ip dhcp excluded-address 119.6.200.1 119.6.200.115 (JadeOS) (config) #ip dhcp excluded-address 119.6.200.117 119.6.200.254 (JadeOS) (config) #service dhcp Step 3 Configure ACL session (JadeOS) (config) #ip access-list session pre-auth-ctrl (JadeOS) (config-sess-pre-auth-ctrl)# host 119.6.200.
(JadeOS) (config) #aaa server-group g1 (JadeOS) (Server Group "g1") #auth-server r1 Step 8 Configure aaa profile (JadeOS) (config) #aaa profile ABC (JadeOS) (AAA Profile "ABC") #web-auth-server-group g1 (JadeOS) (AAA Profile "ABC") #rfc-3576-client 210.151.12.
N - VPN, L - local, Y - Any IP user, R - Routed user, M - Media Capable, S - Src NAT with VLAN IP, E - L2 Enforced, F - IPIP Force Delete, O - VOIP user IP MAC ACLs Contract Location Sessions Flags --------------- ----------------- ------- --------- -------- --------- ----(JadeOS) #show datapath user coun (JadeOS) #show datapath user counters Datapath User Table Count is: 0 70 JadeOS User Manual
71 JadeOS User Manual
Chapter 10 WLAN Management JadeOS provides solutions of wireless controller and FIT AP. Wireless controller uniformly configure, manage and maintain a large quantity of APs, which greatly reduces the maintenance of wireless network. JadeOS supports AP without configuration, which is convenient to expand FIT AP and wireless network. JadeOS also supports centralized authentication, which is convenient to uniformly access and authenticate.
maintenance. 10.1.3 CAPWAP Data Channel After configuration request by AP, AC will consult with AP to enable data channel. In centralized forwarding mode, up‐link message will be encapsulated with CAPWAP in AP, decapsulated in AC, and then forwarding; down‐link message will be encapsu‐ lated with CAPWAP in AC, and then arrive AP through CAPWAP tunnel; the down‐link message will be decapsulated in AP, and then arrive user terminals through 802.11 protocols. 10.1.
centralized forwarding, AC authentication local forwarding and local authentication local forwarding. 10.3 Configuring Power You can configure to automatically choose the power of AP and station in AC, the configuring command is as follows: transmit-power 0 Configuring Radio Frequency You can manually configure radio frequency of AP, at the same time, AP can keep the original radio frequency information when AP online again after AP offline normally.
Import CA in server into AC, which means transferring the CA format into another format that can be recognized by DTLS control channel and remove the password. For example: (JadeOS) #copy ftp 1.2.3.4 user cert_file flash sc-file-1 (JadeOS) #Cert import pem serverCert sc-1 sc-file-1 10.
10.7 ACL User access is mainly to issue ACL based on SSID, MAC, flow threshold, bandwidth control. ACL is important in building secure network, and mainly supports the fol‐ lowing functions: ¾ ACL based on MAC address Configure ACL based on MAC address in AC, which achieve the black‐list and white‐list based on MAC address.
For example： (JadeOS) (config)#ip access-list session acl1 (JadeOS) (config-sess-acl1)#host 1.1.1.
For example： (JadeOS) (config)#wids ap-classification-rule (JadeOS) (IDS AP Classification Rule )# enable (JadeOS) (IDS AP Classification Rule )# ssid test encription open (JadeOS) (IDS AP Classification Rule )# ap-oui 11:22:33 Note：To display rogue ap, use show rogue‐ap command. 10.10 Anti‐DoS The function of WLAN Dos is to prevent DoS attack.
Chapter 11 WEBUI 11.1 WEBUI Description JadeOS supports WEBUI configuration. 11.
Chapter 12 Configuring SNMP 12.1 Configuring SNMP Simple Network Management Protocol (SNMP) is an Internet‐standard protocol for managing devices on IP networks. It is used mostly in network management systems to monitor network‐attached devices for conditions that warrant administrative at‐ tention. JadeOS support versions 1, 2c, and 3 of SNMP.
Chapter 13 Maintanence and Diagnosis 13.1 Log System Log system is used to record system running status, which can be saved in local or remote log server. Log is classified to 8 levels from emerg to debug, and the default level is error. To set log level, use the following command in config mode: logging level [process app] logging [severity level] [type category] Note：log level: emerg , alert, crit, err, warning, notice, info, debug.
Figure 14‐ 1 Modules Diagram for the System Management When system powering up, a “master” system manager will be elected among all line cards existing in the chassis to control the whole equipment. The shelf manager con‐ trol board sends/receives messages from the cards and modules over I2C bus. The elected “master” system manager on the line card get information from the shelf manager control board across the switch board by TCP/IP to control and monitor the whole system.
To inquire the CPU usage percentage, use the following command: show cpuload To inquire the CPU memory usage information, use the following command: show memory To inquire system log, use the following command: show log all To inquire the process status, use the following command: show process monitor statistics Alarm The hardware running status on JadeOS can be monitored and reported to system manager.
Abbrviations A AC ACC ACL AS ATCA AP Alternating Current Automatic Current Control Access Control List Autonomous System Advanced Telecom Computing Architecture Access Point B BCMC Broadcast and Multicast C CAPWAP CDP CE CLI Control And Provisioning of Wireless Access Points Cisco Discovery Protocol Communication Edge Command Line Interface D DES DHCP DNS DOS Data Encryption Standard Dynamic Host Configuration Protocol Domain Name Server Disk Operating System E EAP EAPOL ECN Enterprise Application
IETF IGP IP IPMB IPMC IPMI IPS Internet Engineering Task Force Interior Gateway Protocol Internet Protocol Intelligent Platform Management Bus Intelligent Platform Management Controller Intelligent Platform Management Interface Intrusion Prevention System L LACP LAG LDAP LED Link Aggregation Control Protocol Link Aggregation Group Lightweight Directory Access Protocol Light Emitting Diode M MAC MLVDS Multi‐Access Computer Multipoint Low‐Voltage Differential Signaling N NAT NTP Network Address Transla
RFC RSTP RTC RTM Request For Comments Rapid Spanning Tree Protocol Real Time Clock Rear Transmission Module S SAD SAP SHA SNMP SSID SSL SSH STP Shelf Alarm Display Shelf Alarm Panel Secure Hash Algorithm Simple Network Management Protocol Service Set Identifier Secure Sockets Layer Secure Shell Spanning Tree Protocol T TCA TCP/IP TFTP TKIP Telecommunications Computing Architecture Transmission Control Protocol / Internet Protocol Trivial File Transfer Protocol Temporal Key Integrity Protocol U UDP Us
