Page 12 of 14
AVN-AN-MGMT-R10
Configuring the ANG-3000/7000 series Management Interface
Application Note
Installing and Configuring the Management Interface Card
To begin configuring IP services, change directory to:
/usr/indus/ipsec
Defining the Selector
The following command applies rules to SNMP, TELNET, HTTPS and ICMP protocols
(and their associated port numbers) originating from a Class C, 192.168.100.0 network.
The HTTPS selector identifies the type of traffic that is used to manage the ANG with
the Web Config configuration utility. Note that the defined port number is 8080 rather
than the standard HTTPS port number of 443. This is an Enterasys ANG-specific
implementation; the underlying protocol and security remains standard SSL.
The configuration defines named selectors to reach the “local” interface from the
given “remote” network outside the interface. The combination of protocols and ports
define the IP service to which access is restricted. The specific “local” interface is
specified later when binding the corresponding rule to a particular physical interface
(that is, the management interface).
ipsecSelector -a -n SNMP -o physical -r 192.168.100.0/24 -p UDP -v 161 -w 0
ipsecSelector -a -n TELNET -o physical -r 192.168.100.0/24 -p TCP -v 23 -w 0
ipsecSelector -a -n HTTPS -o physical -r 192.168.100.0/24 -p TCP -v 8080 -w 0
ipsecSelector -a -n ICMP -o physical -r 192.168.100.0/24 -p ICMP
The command switches are defined as follows:
Defining the Rules
After the Selectors have been configured, you must define the rules the ANG will use
to perform a particular action on the selectors. The following command applies the
pass
Rule to all selectors.
ipsecRule -a -n SNMP -s SNMP -w pass
ipsecRule -a -n TELNET -s TELNET -w pass
-a
Adds a Selector
-n
Defines the Selector name (SNMP, TELNET, HTTP(S), ICMP, for example)
-o
Sets the local address - virtual or physical (the address of the interface the selector is
applied to)
-r
Specifies the remote address
-p
Specifies the protocol (ANY, TCP, UDP, ICMP, GRE)
-v
Sets the local port number (0 for any)
-w
Sets the remote local port number (0 for any)
