|
|
Table Of Contents
11.2.1 Scenario 1: CTC and ONS 15454s on Same Subnet
11.2.2 Scenario 2: CTC and ONS 15454s Connected to a Router
11.2.3 Scenario 3: Using Proxy ARP to Enable an ONS 15454 Gateway
11.2.4 Scenario 4: Default Gateway on CTC Computer
11.2.5 Scenario 5: Using Static Routes to Connect to LANs
11.2.7 Scenario 7: Provisioning the ONS 15454 Proxy Server
11.4 Provisioning an External Firewall
11.4.1 Access Control List Example With Proxy Server Not Enabled
11.4.2 Access Control List Example With Proxy Server Enabled
IP Networking
This chapter provides seven scenarios showing Cisco ONS 15454s in common IP network configurations. The chapter does not provide a comprehensive explanation of IP networking concepts and procedures. For IP set up instructions, refer to the Cisco ONS 15454 Procedure Guide.
Chapter topics include:
Note
To connect ONS 15454s to an IP network, you must work with a LAN administrator or other individual at your site who has IP networking training and experience.
11.1 IP Networking Overview
ONS 15454s can be connected in many different ways within an IP environment:
•
•
•
•
•
•
11.2 IP Addressing Scenarios
ONS 15454 IP addressing generally has seven common scenarios or configurations. Use the scenarios as building blocks for more complex network configurations. Table 11-1 provides a general list of items to check when setting up ONS 15454s in IP networks.
11.2.1 Scenario 1: CTC and ONS 15454s on Same Subnet
Scenario 1 shows a basic ONS 15454 LAN configuration ( Figure 11-1). The ONS 15454s and CTC computer reside on the same subnet. All ONS 15454s connect to LAN A, and all ONS 15454s have DCC connections.
Figure 11-1 Scenario 1: CTC and ONS 15454s on same subnet
11.2.2 Scenario 2: CTC and ONS 15454s Connected to a Router
In Scenario 2 the CTC computer resides on a subnet (192.168.1.0) and attaches to LAN A ( Figure 11-2). The ONS 15454s reside on a different subnet (192.168.2.0) and attach to LAN B. A router connects LAN A to LAN B. The IP address of router interface A is set to LAN A (192.168.1.1), and the IP address of router interface B is set to LAN B (192.168.2.1).
On the CTC computer, the default gateway is set to router interface A. If the LAN uses DHCP (Dynamic Host Configuration Protocol), the default gateway and IP address are assigned automatically. In the Figure 11-2 example, a DHCP server is not available.
Figure 11-2 Scenario 2: CTC and ONS 15454s connected to router
11.2.3 Scenario 3: Using Proxy ARP to Enable an ONS 15454 Gateway
Scenario 3 is similar to Scenario 1, but only one ONS 15454 (node #1) connects to the LAN ( Figure 11-3). Two ONS 15454s (#2 and #3) connect to ONS 15454 #1 through the SONET DCC. Because all three ONS 15454s are on the same subnet, Proxy ARP enables ONS 15454 #1 to serve as a gateway for ONS 15454s #2 and #3.
Note
Figure 11-3 Scenario 3: Using Proxy ARP
ARP matches higher-level IP addresses to the physical addresses of the destination host. It uses a lookup table (called ARP cache) to perform the translation. When the address is not found in the ARP cache, a broadcast is sent out on the network with a special format called the ARP request. If one of the machines on the network recognizes its own IP address in the request, it sends an ARP reply back to the requesting host. The reply contains the physical hardware address of the receiving host. The requesting host stores this address in its ARP cache so that all subsequent datagrams (packets) to this destination IP address can be translated to a physical address.
Proxy ARP enables one LAN-connected ONS 15454 to respond to the ARP request for ONS 15454s not connected to the LAN. (ONS 15454 Proxy ARP requires no user configuration.) For this to occur, the DCC-connected ONS 15454s must reside on the same subnet. When a LAN device sends an ARP request to an ONS 15454 that is not connected to the LAN, the gateway ONS 15454 returns its MAC address to the LAN device. The LAN device then sends the datagram for the remote ONS 15454 to the MAC address of the proxy ONS 15454. The proxy ONS 15454 uses its routing table to forward the datagram to the non-LAN ONS 15454.
11.2.4 Scenario 4: Default Gateway on CTC Computer
Scenario 4 is similar to Scenario 3, but nodes #2 and #3 reside on different subnets, 192.168.2.0 and 192.168.3.0, respectively ( Figure 11-4). Node #1 and the CTC computer are on subnet 192.168.1.0. Proxy ARP is not used because the network includes different subnets. In order for the CTC computer to communicate with ONS 15454s #2 and #3, ONS 15454 #1 is entered as the default gateway on the CTC computer.
Figure 11-4 Scenario 4: Default gateway on a CTC computer
11.2.5 Scenario 5: Using Static Routes to Connect to LANs
Static routes are used for two purposes:
•
•
In Figure 11-5, one CTC residing on subnet 192.168.1.0 connects to a router through interface A. (The router is not set up with OSPF.) ONS 15454s residing on different subnets are connected through ONS 15454 #1 to the router through interface B. Because ONS 15454s #2 and #3 are on different subnets, proxy ARP does not enable ONS 15454 #1 as a gateway. To connect to CTC computers on LAN A, a static route is created on ONS 15454 #1.
Figure 11-5 Scenario 5: Static route with one CTC computer used as a destination
The destination and subnet mask entries control access to the ONS 15454s:
•
•
•
The IP address of router interface B is entered as the next hop, and the cost (number of hops from source to destination) is 2.
Figure 11-6 Scenario 5: Static route with multiple LAN destinations
11.2.6 Scenario 6: Using OSPF
Open Shortest Path First (OSPF) is a link state Internet routing protocol. Link state protocols use a "hello protocol" to monitor their links with adjacent routers and to test the status of their links to their neighbors. Link state protocols advertise their directly-connected networks and their active links. Each link state router captures the link state "advertisements" and puts them together to create a topology of the entire network or area. From this database, the router calculates a routing table by constructing a shortest path tree. Routes are continuously recalculated to capture ongoing topology changes.
ONS 15454s use the OSPF protocol in internal ONS 15454 networks for node discovery, circuit routing, and node management. You can enable OSPF on the ONS 15454s so that the ONS 15454 topology is sent to OSPF routers on a LAN. Advertising the ONS 15454 network topology to LAN routers eliminates the need to manually enter static routes for ONS 15454 subnetworks. Figure 11-7 shows a network enabled for OSPF. Figure 11-8 shows the same network without OSPF. Static routes must be manually added to the router in order for CTC computers on LAN A to communicate with ONS 15454 #2 and #3 because these nodes reside on different subnets.
OSPF divides networks into smaller regions, called areas. An area is a collection of networked end systems, routers, and transmission facilities organized by traffic patterns. Each OSPF area has a unique ID number, known as the area ID, that can range from 0 to 4,294,967,295. Every OSPF network has one backbone area called "area 0." All other OSPF areas must connect to area 0.
When you enable an ONS 15454 OSPF topology for advertising to an OSPF network, you must assign an OSPF area ID to the ONS 15454 network. Coordinate the area ID number assignment with your LAN administrator. All DCC-connected ONS 15454s should be assigned the same OSPF area ID.
Figure 11-7 Scenario 6: OSPF enabled
Figure 11-8 Scenario 6: OSPF not enabled
11.2.7 Scenario 7: Provisioning the ONS 15454 Proxy Server
The ONS 15454 proxy server is a set of functions that allows you to network ONS 15454s in environments where visibility and accessibility between ONS 15454s and CTC computers must be restricted. For example, you can set up a network so that field technicians and network operating center (NOC) personnel can both access the same ONS 15454s while preventing the field technicians from accessing the NOC LAN. To do this, one ONS 15454 is provisioned as a gateway NE (GNE) and the other ONS 15454s are provisioned as end NEs (ENEs). The GNE ONS 15454 tunnels connections between CTC computers and ENE ONS 15454s, providing management capability while preventing access for non-ONS 15454 management purposes.
The ONS 15454 proxy server performs the following tasks:
•
•
•
•
The ONS 15454 proxy server is provisioned using three checkboxes on the Provisioning > Network > General tab (see Figure 11-9):
•
•
•
Figure 11-9 Proxy Server Gateway Settings
Figure 11-10 shows an ONS 15454 proxy server implementation. A GNE ONS 15454 is connected to a central office LAN and to ENE ONS 15454s. The central office LAN is connected to a NOC LAN, which has CTC computers. The NOC CTC computer and craft technicians must both be able to access the ONS 15454 ENEs. However, the craft technicians must be prevented from accessing or seeing the NOC or central office LANs.
In the example, the ONS 15454 GNE is assigned an IP address within the central office LAN and is physically connected to the LAN through its LAN port. ONS 15454 ENEs are assigned IP addresses that are outside the central office LAN and given private network IP addresses. If the ONS 15454 ENEs are co-located, the craft LAN ports could be connected to a hub. However, the hub should have no other network connections.
Figure 11-10 ONS 15454 Proxy Server with GNE and ENEs on the same subnet
Table 11-2 shows recommended settings for ONS 15454 GNEs and ENEs in the configuration shown in Figure 11-10.
Figure 11-11 shows the same proxy server implementation with ONS 15454 ENEs on different subnets. Figure 11-12 shows the implementation with ONS 15454 ENEs in multiple rings. In each example, ONS 15454 GNEs and ENEs are provisioned with the settings shown in Table 11-2.
Figure 11-11 Scenario 7: ONS 15454 Proxy Server with GNE and ENEs on different subnets
Figure 11-12 Scenario 7: ONS 15454 Proxy Server with ENEs on multiple rings
Table 11-3 shows the rules the ONS 15454 follows to filter packets when Enable Firewall is enabled. If the packet is addressed to the ONS 15454, additional rules, shown in Table 11-4, are applied. Rejected packets are silently discarded.
If you implement the proxy server, keep the following rules in mind:
1.
2.
3.
4.
5.
If nodes become unreachable in cases 1, 2, and 3, you can correct the setting by performing one of the following:
•
•
11.3 Routing Table
ONS 15454 routing information is displayed on the Maintenance > Routing Table tabs ( Figure 11-13). The routing table provides the following information:
•
•
•
•
•
–
–
–
Figure 11-13 Viewing the ONS 15454 routing table
Table 11-5 shows sample routing entries for an ONS 15454.
Entry #1 shows the following:
•
•
•
•
Entry #2 shows the following:
•
•
•
•
Entry #3 shows the following:
•
•
•
•
Entry #4 shows the following:
•
•
•
•
Entry #5 shows a DCC-connected node that is accessible through a node that is not directly connected:
•
•
•
•
11.4 Provisioning an External Firewall
Table 11-6 shows the ports that are used by the TCC+.
11.4.1 Access Control List Example With Proxy Server Not Enabled
The following ACL (access control list) examples shows a firewall configuration when the Proxy Server feature is not enabled. In the example, the CTC workstation's address is 192.168.10.10. and the ONS 15454 address is 10.10.10.100 The firewall is attached to the GNE CTC, so inbound is CTC to the GNE and outbound is from the GNE to CTC. The CTC CORBA Standard constant is 683 and the TCC CORBA Default TCC Fixed (57790).
access-list 100 remark *** Inbound ACL, CTC -> NE ***
access-list 100 remark
access-list 100 permit tcp host 192.168.10.10 any host 10.10.10.100 eq www
access-list 100 remark *** allows initial contact with the 15454 using http (port 80) ***
access-list 100 remark
access-list 100 permit tcp host 192.168.10.10 683 host 10.10.10.100 eq 57790
access-list 100 remark *** allows CTC communication with the 15454 GNE (port 57790) ***
access-list 100 remark
access-list 100 permit tcp host 192.168.10.10 host 10.10.10.100 established
access-list 100 remark *** allows ACKs back from CTC to the 15454 GNE ***
access-list 101 remark *** Outbound ACL, NE -> CTC ***
access-list 101 remark
access-list 101 permit tcp host 10.10.10.100 any host 192.168.10.10 eq 683
access-list 101 remark *** allows alarms etc., from the 15454 (random port) to the CTC workstation (port 683) ***
access-list 100 remark
access-list 101 permit tcp host 10.10.10.100 host 192.168.10.10 established
access-list 101 remark *** allows ACKs from the 15454 GNE to CTC ***
11.4.2 Access Control List Example With Proxy Server Enabled
The following ACL (access control list) examples shows a firewall configuration when the Proxy Server feature is enabled. As with the first example, the CTC workstation address is 192.168.10.10 and the ONS 15454 address is 10.10.10.100. The firewall is attached to the GNE CTC, so inbound is CTC to the GNE and outbound is from the GNE to CTC. CTC CORBA Standard constant (683) and TCC CORBA Default TCC Fixed (57790).
access-list 100 remark *** Inbound ACL, CTC -> NE ***
access-list 100 remark
access-list 100 permit tcp host 192.168.10.10 any host 10.10.10.100 eq www
access-list 100 remark *** allows initial contact with the 15454 using http (port 80) ***
access-list 100 remark
access-list 100 permit tcp host 192.168.10.10 683 host 10.10.10.100 eq 57790
access-list 100 remark *** allows CTC communication with the 15454 GNE (port 57790) ***
access-list 100 remark
access-list 100 permit tcp host 192.168.10.10 683 host 10.10.10.100 eq 1080
access-list 100 remark *** allows CTC communication with the 15454 GNE proxy server (port 1080) ***
access-list 100 remark
access-list 100 permit tcp host 192.168.10.10 683 host 10.10.10.100 range 10240 10495
access-list 100 remark *** allows CTC communication with the 15454 ENEs (ports 10240 - 10495) via the GNE proxy server
***
access-list 100 remark
access-list 100 permit tcp host 192.168.10.10 host 10.10.10.100 established
access-list 100 remark *** allows ACKs from CTC to the 15454 GNE ***
access-list 101 remark *** Outbound ACL, NE -> CTC ***
access-list 101 remark
access-list 101 permit tcp host 10.10.10.100 any host 192.168.10.10 eq 683
access-list 101 remark *** allows alarms and other communications from the 15454 (random port) to the CTC workstation
(port 683) ***
access-list 100 remark
access-list 101 permit tcp host 10.10.10.100 host 192.168.10.10 established
access-list 101 remark *** allows ACKs from the 15454 GNE to CTC ***
Posted: Fri Feb 22 14:47:59 PST 2008
All contents are Copyright © 1992--2008 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.
