Configuring Triple Play Security with CLI
This section provides information to configure Residential Broadband Aggregation services using the command line interface. It is assumed that the reader is familiar with VPLS, IES and VPRN (VPRN is supported on the 7750 SR only) services.
Topics in this section include:
Common Configuration Tasks
Topics in this section are:
Configuring Anti-Spoofing Filters
Anti-spoofing filters are used to prevent malicious subscribers sending IP packets with a forged IP or MAC address, and thus mis-directing traffic. The anti-spoofing filter is populated from the DHCP lease state table, and DHCP snooping must be enabled on the SAP.
There are three types of filters (MAC, IP and IP+MAC), one type is allowed per SAP.
The following displays an IES service interface configuration with anti-spoofing.
Configuring Triple Play Security features
Topics in this section are:
Configuring MAC Pinning
The following example displays a partial BSA configuration with MAC pinning enabled on a SAP:
Configuring MAC Protection
Preventing Access By Residential Subscribers Using Protected (Gateway) MAC Addresses
The first step is to create a list of MAC addresses to be protected, the second step is to prevent access using these source addresses inside an SHG or a SAP.
The following example displays a partial BSA configuration with some protected MAC addresses on any SAP created inside the SHG:
Restricting Access By Residential Subscribers To a Small List Of Upstream MAC Addresses:
The first step is to create a list of MAC addresses to be protected, the second step is to restrict access to these addresses only from an SHG or a SAP. (If the MAC address of an upstream server is not known, it can be discovered using e.g. the cpe-ping OAM tool.)
The following example displays a partial BSA configuration with restricted access to some MAC addresses from a specified SAP (an unrestricted access from any other SAP within the VPLS):
Configuring VPLS Redirect Policy
Figure 47 displays an IP filter entry configuration for VPLS redirect policy.
Figure 47: VPLS Redirect Policy Example
Information about defining and applying IP and MAC filters is described in the Router Configuration Guide.
Creating the Filter
The following displays a redirect filter entry:
Applying the Filter to a VPLS Service
The following displays how the redirection filter configured above is assigned to the ingress SAP from the DSLAM, and the ingress SDP from the BSR:
Configuring ARP Handling
Topics in this section are:
Configuring Proxy ARP
The implementation of proxy ARP with support for local proxy ARP allows the 7450 ESS or 7750 SR to respond to ARP requests in the subnet assigned to an IES or VPRN interface.
Configuring this command will allow multiple customers to share the same IP subnet.
The following example displays an IES proxy ARP configuration:
Configuring Local Proxy ARP
When local proxy ARP is enabled on an IP interface, the 7450 ESS or 7750 SR responds to all ARP requests for IP addresses belonging to the subnet with it's own MAC address, and forwards all traffic between hosts in that subnet. Local proxy ARP is disabled by default.
 | Note: When local-proxy-arp is enabled under a IES or VPRN service, all ICMP redirects on the ports associated with the service are automatically blocked. This prevents users from learning each other's MAC address (from ICMP redirects). |
The following example displays a local proxy ARP IES configuration:
Configuring ARP Reply Agent in a VPLS Service
When ARP reply agent is enabled, the 7450 ESS or 7750 SR will respond to ARP requests from the network, with information from the DHCP lease state table.
In the upstream direction (towards the network), the ARP reply agent intercepts ARP requests on subscriber SAPs, and checks them against the DHCP lease state table. The purpose is to prevent a malicious subscriber spoofing ARP request or ARP reply messages and thus populating the upstream router's ARP table with incorrect entries.
The following example displays a partial BSA configuration with ARP Reply Agent enabled on a SAP:
Configuring Remote Proxy ARP
The following example displays the IES configuration to enable remote proxy ARP:
Configuring Automatic ARP Table Population in an IES or VPRN Interface
The following example displays the IES DHCP configuration to enable automatic population of the ARP table using snooped DHCP information on an IES or VPRN (VPRN is supported on the 7750 SR only) interface:
Configuring CPU Protection
CPU Protection can be used to protect the SR OS in subscriber management scenarios. Refer to the SR OS System Management Guide for information about CPU Protection operation and configuration.
Configuring Web Portal Redirect
The generic CLI structure for defining and applying IP and MAC filters is described in the Router Configuration Guide.
The following example displays an IP filter entry configuration for web-portal redirect:
- Filter entry 10 in the example output allows the customer to access DNS to get the IP address of the original website they are trying to view.
- Entry 20 allows HTTP packets destined to the captive portal itself to be forwarded.
Note: The actual IP address (a.b.c.d) needs to be entered, not the DNS name (“www.myportal.com”). The IP address can be easily resolved from the 7450 ESS or 7750 SR CLI using the “ping” command.
- Entry 30 (which is the last option that does not drop the customer packets) checks for HTTP protocol and then starts the redirection process:
- The 7450 ESS or 7750 SR will intercept the HTTP GET from the subscriber and respond with an HTTP 302 (temporarily moved) with the URL configured in the filter entry. This URL can contain some variables, notably the customer IP and MAC addresses to allow the portal to create an entry for the customer. The original requested URL is also included to redirect the client site back to the original requested site when the process is done.
- The client will then close the connection with the original IP address and open a connection to the redirected server. Entry 20 will allow this connection.
The following displays how the redirection filter configured above is assigned to an ingress SAP: