[index] AT-AR4000S-Cloud リファレンスマニュアル 5.5.3
Noteサンドバイン社が提供するアプリケーションシグネチャデータベースを使用するにはアニュアルライセンスが必要です
(センター) （AR4050S） |
(拠点) （本製品） |
|
| WAN側物理インターフェース | eth1 | eth1 |
| WAN側（eth1）IPアドレス | 10.0.0.1/32 | 10.0.0.2/32 |
| LAN側（vlan1/eth0）IPアドレス | 192.168.10.1/24 | 192.168.100.1/24 |
| DNSサーバー | 192.168.11.100 | |
| eth0 | 192.168.100.1/24 | 管理用IPアドレス |
| eth1 | 未設定 |
Note構成が異なる場合はインターフェース名などを適宜読み替えてください。
no spanning-tree rstp enable
interface eth1 encapsulation ppp 0
interface ppp0 keepalive ppp username user@isp01 ppp password passwd01 ip address 10.0.0.1/32 ip tcp adjust-mss pmtu
interface vlan1 ip address 192.168.10.1/24
zone private network branch ip subnet 192.168.100.0/24 network proxy ip subnet 0.0.0.0/0 interface vlan1 ip subnet 192.168.10.0/24 ip subnet 192.168.11.0/24 network tunnel_if ip subnet 172.16.100.0/30
zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host routerA ip address 10.0.0.1 host routerB ip address 10.0.0.2
application esp protocol 50
application isakmp protocol udp dport 500
firewall rule 10 permit any from private to private no-state-enforcement rule 20 permit any from private to public rule 30 permit isakmp from public.wan.routerA to public.wan.routerB rule 40 permit isakmp from public.wan.routerB to public.wan.routerA rule 50 permit esp from public.wan.routerA to public.wan.routerB rule 60 permit esp from public.wan.routerB to public.wan.routerA protect
crypto isakmp key secret address 10.0.0.2
interface tunnel0 mtu 1300 tunnel source 10.0.0.1 tunnel destination 10.0.0.2 tunnel protection ipsec tunnel mode ipsec ipv4 ip address 172.16.100.1/30 ip tcp adjust-mss 1260
ip route 0.0.0.0/0 192.168.10.100 ip route 10.0.0.2/32 ppp0 ip route 192.168.100.0/24 tunnel0 ip route 192.168.100.0/24 null 254
end
interface eth1 encapsulation ppp 0
interface ppp0 keepalive ppp username user@isp02 ppp password passwd02 ip address 10.0.0.2/32 ip tcp adjust-mss pmtu
interface eth0 ip address 192.168.100.1/24
zone private network lan ip subnet 192.168.100.0/24 network proxy ip subnet 192.168.10.0/24 ip subnet 192.168.11.0/24 network tunnel ip subnet 0.0.0.0/0 interface tunnel0 network tunnel_if ip subnet 172.16.100.0/30
zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host routerA ip address 10.0.0.1 host routerB ip address 10.0.0.2
application esp protocol 50
application isakmp protocol udp dport 500
firewall rule 10 permit any from private to private no-state-enforcement rule 20 permit any from private to public rule 30 permit isakmp from public.wan.routerB to public.wan.routerA rule 40 permit isakmp from public.wan.routerA to public.wan.routerB rule 50 permit esp from public.wan.routerB to public.wan.routerA rule 60 permit esp from public.wan.routerA to public.wan.routerB rule 70 permit undecided from public.wan.routerB to public.wan rule 80 permit undecided from public.wan to public.wan.routerB protect
nat rule 10 masq any from private to public enable
crypto isakmp key secret address 10.0.0.1
interface tunnel0 mtu 1300 tunnel source 10.0.0.2 tunnel destination 10.0.0.1 tunnel protection ipsec tunnel mode ipsec ipv4 ip address 172.16.100.2/30 ip tcp adjust-mss 1260
dpi provider built-in counters detailed learning enable
web-redirect mode proxy proxy-host 192.168.10.100 port 3128 exclude app office365 enable
policy-based-routing application-decision once-only ip policy-route 1 match office365 to private.tunnel nexthop ppp0 policy-based-routing enable
ip name-server 192.168.11.100
ip route 0.0.0.0/0 tunnel1 ip route 0.0.0.0/0 null 254 ip route 10.0.0.1/32 ppp0
ip dns forwarding
end
Noteサンドバイン社が提供するアプリケーションシグネチャデータベースを使用するにはアニュアルライセンスが必要です
dpi provider procera counters detailed learning enable
web-redirect mode proxy proxy-host 192.168.10.100 port 3128 exclude app office enable
policy-based-routing application-decision once-only ip policy-route 1 match office to private.tunnel nexthop ppp0 policy-based-routing enable
copy running-config startup-config」の書式で実行します。awplus# copy running-config startup-config ↓ Building configuration... [OK]
awplus# write memory ↓ Building configuration... [OK]
awplus(config)# log buffered level informational facility local5 ↓
awplus# show log | include Firewall ↓
! no spanning-tree rstp enable ! interface eth1 encapsulation ppp 0 ! interface ppp0 keepalive ppp username user@isp01 ppp password passwd01 ip address 10.0.0.1/32 ip tcp adjust-mss pmtu ! interface vlan1 ip address 192.168.10.1/24 ! zone private network branch ip subnet 192.168.100.0/24 network proxy ip subnet 0.0.0.0/0 interface vlan1 ip subnet 192.168.10.0/24 ip subnet 192.168.11.0/24 network tunnel_if ip subnet 172.16.100.0/30 ! zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host routerA ip address 10.0.0.1 host routerB ip address 10.0.0.2 ! application esp protocol 50 ! application isakmp protocol udp dport 500 ! firewall rule 10 permit any from private to private no-state-enforcement rule 20 permit any from private to public rule 30 permit isakmp from public.wan.routerA to public.wan.routerB rule 40 permit isakmp from public.wan.routerB to public.wan.routerA rule 50 permit esp from public.wan.routerA to public.wan.routerB rule 60 permit esp from public.wan.routerB to public.wan.routerA protect ! crypto isakmp key secret address 10.0.0.2 ! interface tunnel0 mtu 1300 tunnel source 10.0.0.1 tunnel destination 10.0.0.2 tunnel protection ipsec tunnel mode ipsec ipv4 ip address 172.16.100.1/30 ip tcp adjust-mss 1260 ! ip route 0.0.0.0/0 192.168.10.100 ip route 10.0.0.2/32 ppp0 ip route 192.168.100.0/24 tunnel0 ip route 192.168.100.0/24 null 254 ! end
! interface eth1 encapsulation ppp 0 ! interface ppp0 keepalive ppp username user@isp02 ppp password passwd02 ip address 10.0.0.2/32 ip tcp adjust-mss pmtu ! interface eth0 ip address 192.168.100.1/24 ! zone private network lan ip subnet 192.168.100.0/24 network proxy ip subnet 192.168.10.0/24 ip subnet 192.168.11.0/24 network tunnel ip subnet 0.0.0.0/0 interface tunnel0 network tunnel_if ip subnet 172.16.100.0/30 ! zone public network wan ip subnet 0.0.0.0/0 interface ppp0 host routerA ip address 10.0.0.1 host routerB ip address 10.0.0.2 ! application esp protocol 50 ! application isakmp protocol udp dport 500 ! firewall rule 10 permit any from private to private no-state-enforcement rule 20 permit any from private to public rule 30 permit isakmp from public.wan.routerB to public.wan.routerA rule 40 permit isakmp from public.wan.routerA to public.wan.routerB rule 50 permit esp from public.wan.routerB to public.wan.routerA rule 60 permit esp from public.wan.routerA to public.wan.routerB rule 70 permit undecided from public.wan.routerB to public.wan rule 80 permit undecided from public.wan to public.wan.routerB protect ! nat rule 10 masq any from private to public enable ! crypto isakmp key secret address 10.0.0.1 ! interface tunnel0 mtu 1300 tunnel source 10.0.0.2 tunnel destination 10.0.0.1 tunnel protection ipsec tunnel mode ipsec ipv4 ip address 172.16.100.2/30 ip tcp adjust-mss 1260 ! dpi provider built-in counters detailed learning enable ! web-redirect mode proxy proxy-host 192.168.10.100 port 3128 exclude app office365 enable ! policy-based-routing application-decision once-only ip policy-route 1 match office365 to private.tunnel nexthop ppp0 policy-based-routing enable ! ip name-server 192.168.11.100 ! ip route 0.0.0.0/0 tunnel1 ip route 0.0.0.0/0 null 254 ip route 10.0.0.1/32 ppp0 ! ip dns forwarding ! end
(C) 2022 - 2023 アライドテレシスホールディングス株式会社
PN: 613-003066 Rev.D