[index] AT-AR1050V コマンドリファレンス 5.5.4
(本製品) |
(AR415S) |
|
ISP接続用ユーザー名 | user@isp1 | user@isp2 |
ISP接続用パスワード | isppasswd1 | isppasswd2 |
PPPoEサービス名 | 指定なし | 指定なし |
WAN側IPアドレス | 10.0.0.1/32 | 10.0.0.2/32 |
WAN側物理インターフェース | eth1 | eth0 |
WAN側(ppp0)IPアドレス | 10.0.0.1/32 | 10.0.0.2/32 |
LAN側(vlan1)IPアドレス | 192.168.10.1/24 | 192.168.20.1/24 |
ローカルセレクター | 192.168.10.0/24 | 192.168.20.0/24 |
リモートセレクター | 192.168.20.0/24 | 192.168.10.0/24 |
IKEバージョン・交換モード | ||
アルゴリズム | ||
ローカルID | 始点アドレス(デフォルト) | 始点アドレス(デフォルト) |
SA有効期間 | ||
アルゴリズム |
interface eth1 encapsulation ppp 0
interface ppp0 keepalive ip address 10.0.0.1/32 ppp username user@isp1 ppp password isppasswd1 ip tcp adjust-mss pmtu
interface vlan1 ip address 192.168.10.1/24
zone private network lan ip subnet 192.168.10.0/24 network peer ip subnet 192.168.20.0/24 interface tunnel0 network tunnel ip subnet 192.168.100.0/30
zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address 10.0.0.1
application esp protocol 50
application isakmp protocol udp sport 500 dport 500
firewall rule 10 permit esp from public.wan.ppp0 to public.wan rule 20 permit esp from public.wan to public.wan.ppp0 rule 30 permit isakmp from public.wan.ppp0 to public.wan rule 40 permit isakmp from public.wan to public.wan.ppp0 rule 50 permit any from private to private rule 60 permit any from private to public protect
nat rule 10 masq any from private to public enable
crypto isakmp key secret address 10.0.0.2
crypto ipsec profile ipsec1 transform 1 protocol esp integrity SHA1 encryption AES128
crypto isakmp profile isakmp1 version 1 mode main transform 1 integrity SHA1 encryption AES128 group 2
crypto isakmp peer address 10.0.0.2 profile isakmp1
interface tunnel0 tunnel source 10.0.0.1 tunnel destination 10.0.0.2 tunnel local selector 192.168.10.0/24 tunnel remote selector 192.168.20.0/24 tunnel protection ipsec profile ipsec1 tunnel mode ipsec ipv4 ip address 192.168.100.1/30 ip tcp adjust-mss 1260 mtu 1300
ip route 0.0.0.0/0 ppp0 ip route 192.168.20.0/24 tunnel0 ip route 192.168.20.0/24 Null 254
end
copy running-config startup-config
」の書式で実行します。awplus# copy running-config startup-config ↓ Building configuration... [OK]
awplus# write memory ↓ Building configuration... [OK]
awplus(config)# log buffered level informational facility local5 ↓
awplus# show log | include Firewall ↓
NoteAR415Sの設定に関する詳細は、AR415Sのドキュメントをご参照ください。
add user=secoff pass=PasswordS priv=securityOfficer
create ppp=0 over=eth0-any set ppp=0 bap=off iprequest=on username=user@isp2 password=isppasswd2 set ppp=0 over=eth0-any lqr=off echo=10
enable ip add ip int=vlan1 ip=192.168.20.1 add ip int=ppp0 ip=10.0.0.2 mask=255.255.255.255 add ip rou=0.0.0.0 mask=0.0.0.0 int=ppp0 next=0.0.0.0
enable firewall create firewall policy=net disable firewall policy=net identproxy enable firewall policy=net icmp_f=unre,ping add firewall policy=net int=vlan1 type=private add firewall policy=net int=ppp0 type=public add firewall poli=net nat=enhanced int=vlan1 gblin=ppp0 gblip=10.0.0.2 add firewall poli=net ru=1 ac=allo int=ppp0 prot=udp po=500 ip=10.0.0.2 gblip=10.0.0.2 gblp=500 add firewall poli=net ru=2 ac=non int=vlan1 prot=ALL ip=192.168.20.1-192.168.20.254 set firewall poli=net ru=2 rem=192.168.10.1-192.168.10.254 add firewall poli=net ru=5 ac=non int=ppp0 prot=ALL ip=192.168.20.1-192.168.20.254 enc=ips
CREATE ENCO KEY=1 TYPE=GENERAL VALUE=SECRET
create isakmp pol=isa pe=10.0.0.1 enc=aes128 key=1 set isakmp pol=isa gro=2 set isakmp pol=isa sendn=true set isakmp pol=isa dpdm=both create ipsec sas=1 key=isakmp prot=esp enc=aes128 hasha=sha create ipsec bund=1 key=isakmp string=1 create ipsec pol=isakmp int=ppp0 ac=permit set ipsec pol=isakmp lp=500 rp=500 tra=UDP create ipsec pol=vpn1 int=ppp0 ac=ipsec key=isakmp bund=1 peer=10.0.0.1 set ipsec pol=vpn1 lad=192.168.20.0 lma=255.255.255.0 rad=192.168.10.0 rma=255.255.255.0 create ipsec pol=inet int=ppp0 ac=permit enable ipsec enable isakmp
LOGIN SECOFF ENABLE SYSTEM SECURITY_MODE
! interface eth1 encapsulation ppp 0 ! interface ppp0 keepalive ip address 10.0.0.1/32 ppp username user@isp1 ppp password isppasswd1 ip tcp adjust-mss pmtu ! interface vlan1 ip address 192.168.10.1/24 ! zone private network lan ip subnet 192.168.10.0/24 network peer ip subnet 192.168.20.0/24 interface tunnel0 network tunnel ip subnet 192.168.100.0/30 ! zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host ppp0 ip address 10.0.0.1 ! application esp protocol 50 ! application isakmp protocol udp sport 500 dport 500 ! firewall rule 10 permit esp from public.wan.ppp0 to public.wan rule 20 permit esp from public.wan to public.wan.ppp0 rule 30 permit isakmp from public.wan.ppp0 to public.wan rule 40 permit isakmp from public.wan to public.wan.ppp0 rule 50 permit any from private to private rule 60 permit any from private to public protect ! nat rule 10 masq any from private to public enable ! crypto isakmp key secret address 10.0.0.2 ! crypto ipsec profile ipsec1 transform 1 protocol esp integrity SHA1 encryption AES128 ! crypto isakmp profile isakmp1 version 1 mode main transform 1 integrity SHA1 encryption AES128 group 2 ! crypto isakmp peer address 10.0.0.2 profile isakmp1 ! interface tunnel0 tunnel source 10.0.0.1 tunnel destination 10.0.0.2 tunnel local selector 192.168.10.0/24 tunnel remote selector 192.168.20.0/24 tunnel protection ipsec profile ipsec1 tunnel mode ipsec ipv4 ip address 192.168.100.1/30 ip tcp adjust-mss 1260 mtu 1300 ! ip route 0.0.0.0/0 ppp0 ip route 192.168.20.0/24 tunnel0 ip route 192.168.20.0/24 Null 254 ! end
Note「#」で始まる行は、コンソールから入力しないと意味を持たないコマンドか、設定ファイル(.cfg)に記述しても無効なコマンドを示しています。
NoteAR415Sの設定に関する詳細は、AR415Sのドキュメントをご参照ください。
add user=secoff pass=PasswordS priv=securityOfficer create ppp=0 over=eth0-any set ppp=0 bap=off iprequest=on username=user@isp2 password=isppasswd2 set ppp=0 over=eth0-any lqr=off echo=10 enable ip add ip int=vlan1 ip=192.168.20.1 add ip int=ppp0 ip=10.0.0.2 mask=255.255.255.255 add ip rou=0.0.0.0 mask=0.0.0.0 int=ppp0 next=0.0.0.0 enable firewall create firewall policy=net disable firewall policy=net identproxy enable firewall policy=net icmp_f=unre,ping add firewall policy=net int=vlan1 type=private add firewall policy=net int=ppp0 type=public add firewall poli=net nat=enhanced int=vlan1 gblin=ppp0 gblip=10.0.0.2 add firewall poli=net ru=1 ac=allo int=ppp0 prot=udp po=500 ip=10.0.0.2 gblip=10.0.0.2 gblp=500 add firewall poli=net ru=2 ac=non int=vlan1 prot=ALL ip=192.168.20.1-192.168.20.254 set firewall poli=net ru=2 rem=192.168.10.1-192.168.10.254 add firewall poli=net ru=5 ac=non int=ppp0 prot=ALL ip=192.168.20.1-192.168.20.254 enc=ips # CREATE ENCO KEY=1 TYPE=GENERAL VALUE=secret create isakmp pol=isa pe=10.0.0.1 enc=aes128 key=1 set isakmp pol=isa gro=2 set isakmp pol=isa sendn=true set isakmp pol=isa dpdm=both create ipsec sas=1 key=isakmp prot=esp enc=aes128 hasha=sha create ipsec bund=1 key=isakmp string=1 create ipsec pol=isakmp int=ppp0 ac=permit set ipsec pol=isakmp lp=500 rp=500 tra=UDP create ipsec pol=vpn1 int=ppp0 ac=ipsec key=isakmp bund=1 peer=10.0.0.1 set ipsec pol=vpn1 lad=192.168.20.0 lma=255.255.255.0 rad=192.168.10.0 rma=255.255.255.0 create ipsec pol=inet int=ppp0 ac=permit enable ipsec enable isakmp # LOGIN secoff # ENABLE SYSTEM SECURITY_MODE
(本製品) |
(AR415S) |
|
ISP接続用ユーザー名 | user@isp1 | user@isp2 |
ISP接続用パスワード | isppasswd1 | isppasswd2 |
PPPoEサービス名 | 指定なし | 指定なし |
WAN側IPアドレス | 動的割り当て(IPCP) | 10.0.0.2/32 |
WAN側物理インターフェース | eth1 | eth0 |
WAN側(ppp0)IPアドレス | 接続時にISPから取得 | 10.0.0.2/32 |
LAN側(vlan1)IPアドレス | 192.168.10.1/24 | 192.168.20.1/24 |
ローカルセレクター | 192.168.10.0/24 | 192.168.20.0/24 |
リモートセレクター | 192.168.20.0/24 | 192.168.10.0/24 |
IKEバージョン・交換モード | ||
アルゴリズム | ||
ローカルID | client | 始点アドレス(デフォルト) |
SA有効期間 | ||
アルゴリズム |
crypto isakmp profile isakmp1 version 1 mode aggressive transform 1 integrity SHA1 encryption AES128 group 2
interface tunnel0 tunnel source ppp0 tunnel local name client
create ipsec pol=vpn1 int=ppp0 ac=ipsec key=isakmp bund=1 peer=DYNAMIC set ipsec pol=vpn1 lad=192.168.20.0 lma=255.255.255.0 rad=192.168.10.0 rma=255.255.255.0
create isakmp pol=isa pe=any mod=aggressive enc=aes128 key=1 set isakmp pol=isa gro=2 set isakmp pol=isa sendn=true set isakmp pol=isa dpdm=both remotei=client
(C) 2019 - 2024 アライドテレシスホールディングス株式会社
PN: 613-002735 Rev.AD