vendredi 27 août 2010

JUNOS: vlan tagging

Junos: How to configure a tag for a L3 interface ?

<br />
So, you have a L3 interface an want to add an IEEE 802.1Q VLAN TAG,

here is how to do so:

root@s1> show configuration interfaces me0
description "MGMT INTERFACE - DO NOT DELETE";
vlan-tagging;
unit 101 {
    vlan-id 101;
    family inet {
        address 10.150.8.161/16;
    }
}




vendredi 13 août 2010

NETASQ: How to hanlde FTP PASSIVE connexion ?

ASQ handles FTP thanks to FTP plugin analysis of the command port,

Support for FTP in a REDIRECT rule for Passive connection to an internal server,
Handling passive connections for an internal FTP server is only handled through a REDIRECT
operation; a BIDIRECTIONNAL MAP operation won't work for this purpose.

So you have an Internal FTP server. You want to allow access from the Internet.

You must be aware of:

- plugin ftp must be in auto-attach,
- ftp support must be activated in the NAT rule (we discuss this part after)
- In the object, the ftp service must use the FTP plugin, explicitly.
- In the policy firewall filters you must to have an explicit allow for the ftp service,
- You doesn't have to allow ftp-data

So you have an extra public IP, used for the ftp service. Naturally you created a BIMAP nat rules.
these work fine only is your ftp server run in active mode !

If your ftp server run in Passive mode, you need to create an extra nat rule, a REDIR one ! unless you do so, your FTP PASSIVE SERVER won't be available from the Internet.

Let me resume:

            FTP option { MAP / BIMAP } : support CLIENT ACTIVE FTP

            FTP option { REDIR }: support SERVER PASSIVE FTP

Definition of different NAT used in NETASQ:

MAP    that is used for mapping one address or network to another in an
       unregulated round robin fashion;

       REDIR    that is used for redirecting packets to one IP address and  port
       pair to another;

       BIMAP  for  setting up bidirectional NAT between an external IP address
       and an internal IP address and