Interfaces and Subnets
36
Editing an existing subnet works similarly - click the Edit link next to the subnet you want to modify.
The FB6000 can perform conventional Network Address Translation (NAT) for network connections / flows
originating from all machines on a subnet (for example, one using RFC1918 private IP address space) by setting
the
nat
attribute on the
subnet
object.
Tip
Behind the scenes, activation of NAT is on a 'per-session' basis, and the
nat
attribute on a subnet
is really a shortcut for a session-rule using the
set-nat
attribute. If you wish to learn more about
sessions and session-tracking, please refer to Chapter 7. If you have any need for firewalling, you'll
need to refer to that chapter in due course anyway.
6.2.1.1. Source filtering
The interface has an option to
source-filter
traffic received from the interface. This means checking the
source IP of all traffic that arrives.
Setting source filtering to
true
will only allow IPs that would be routed back down that interface. That is the
most restrictive setting, and can be useful for restricting customer connections to only originate traffic from
their assigned IP addresses.
Setting source filtering to
blackhole
is less restrictive. It allows IPs to which there is a valid route even
if to a different interface. If the IP is routed to a black hole or a dead end or not in the routing table then it
is not accepted.
Tip
The routing look up to check the source IP is normally done in the routing table of the interface.
However, it is possible to set a
source-filter-table
which allows the check to be done in
a different routing table. This usually only makes sense when used with the
blackhole
option. It
allows a separate routing table to be used to define source filtering explicitly if needed.
Note
Link local IPv6 addresses starting FE80 are always allowed, as is the 0.0.0.0 null IP for DHCP usage.
IPv6 addresses within 2002::/16 are treated as the embedded IPv4 address for filtering checks.
Obviously, having a firewall setting allows much more control over source address checking. These options
are independant of firewall rules and mainly applicable to devices where firewalling is not available.
6.2.1.2. Using DHCP to configure a subnet
You can create a subnet that is configured via DHCP by clearing the
ip
checkbox - the absence of an IP address/
prefix specification causes the FB6000 to attempt to obtain an address from a DHCP server (which must be
in the same broadcast domain). It may help to use the Comment field to note that the subnet is configured via
DHCP.
In its simplest form, a DHCP configured subnet is created by the following XML :-
<subnet />
Tip
It is possible to specify multiple DHCP client subnets like this, and the FB6000 will reserve a separate
MAC address for each. This allows the FB6000 to aquire multiple independant IP addresses by DHCP
on the same interface if required.
6.2.2. Setting up DHCP server parameters
The FB6000 can act as a DHCP server to dynamically allocate IP addresses to clients. Optionally, the allocation
can be accompanied by information such as a list of DNS resolvers that the client should use.
