background image

Software Release 2.3.1

27

Software Release 2.3.1
C613-10325-00 REV B

If the PROPORTIONAL option is specified, the virtual router reduces the 
priority to a percentage of the original priority in proportion the percentage of 
available ports. For example, if a router has five ports and a port fails, the 
router will drop its priority by a fifth of the original priority.

SET VRRP=

vr-identifier

 [ADINTERVAL=1..255] 

[AUTHENTICATION={NONE|PLAINTEXT}] [PASSWORD=

password

[PORTMONITORING={ON|OFF} [STEPVALUE={

stepvalue

|

PROPORTIONAL}]] [PREEMPT={ON|OFF}] [PRIORITY=1..254]

where:

stepvalue

 is a decimal number in the range 1 to 254.

This command only changes the parameters on this router. It is important that 
all routers involved in a virtual router are configured with the same values for 
the VRRP virtual router identifier, IP address, advertisement interval, pre-empt 
mode, authentication type, and password. Inconsistent configuration will 
cause advertisement packets to be rejected and the virtual router will not 
perform properly.

The PORTMONITORING parameter is valid when the VR is providing 
redundancy over a VLAN. The PORTMONITORING parameter specifies 
whether the VRRP should monitor the ports of the VLAN and alter the priority 
value if ports fail or are disabled. If the PORTMONITORING parameter is set 
to ON, the STEPVALUE parameter may also be specified. The default is OFF.

The STEPVALUE parameter specifies the value by which the priority of the VR 
should be decremented each time a VLAN port fails, or is disabled when the 
PORTMONITORING parameter is set to ON. If a number is specified, the 
priority of the VR will be reduced by this value each time a VLAN port fails or 
is disabled. If PROPORTIONAL is specified, the VR will reduce the priority to 
a percentage of the original priority in proportion to the percentage of available 
ports. The value specified for the STEPVALUE parameter is retained when port 
monitoring is disabled.

For instance, to enable the PORTMONITORING feature on the virtual router 
number 10 and set the step value to 100, use the following command:

SET VRRP VRID=10 PORTMONITORING=ON STEPVALUE=100

The SHOW VRRP command now shows port monitoring information.

Table 7: New parameters displayed in the output of the SHOW VRRP command.

Parameter

Meaning

Port Monitoring

Indicates whether the port monitoring feature is ON or OFF. 
This parameter is only displayed if the VR is operating over 
a VLAN interface.

Step value

If a number is shown (e.g. “40”), this indicates the value by 
which the priority of the VR will be reduced for each VLAN 
port that fails or is disabled. If “PROPORTIONAL” is shown, 
the priority will be reduced in proportion to the percentage 
of VLAN ports that are out of service.

Содержание AR 300 AT-AR300 AT-AR300

Страница 1: ...Security IPsec Source Interface and Enhancements 11 OSPF on Demand 12 Paladin Firewall Enhancements 14 Interface based NAT 14 Rule based NAT 14 Time Limited Rules 15 New Command Syntax 15 Web Redirect...

Страница 2: ...has been made to ensure that the information contained within this document and the features and changes described are accurate Allied Telesyn International can not accept any type of liability for e...

Страница 3: ...ards can be hot swapped into the same bay The software configurations of the interfaces on the hot swapped cards are preserved across the hot swap so that modules configured to interfaces on the cards...

Страница 4: ...Follow these steps to hot swap an NSM or PICs in an NSM 4PIC into an empty NSM bay 1 Check that the NSM or PIC bay is empty 2 Check that the NSM bay is ready for hot swap Look at the Swap and In use...

Страница 5: ...0 Series routers Commands to reset interface and IP MIB counters to zero and changes to the display of MIB counters IP and Interface Counters on page 29 An extended range of telephony functions on AR3...

Страница 6: ...ommands relating to interfaces on hot inserted cards until the router or switch is restarted These interfaces must be configured manually The router or switch does not update the MAC address of any ho...

Страница 7: ...es out entries after a specified period of up to 60 minutes When a domain or host is requested the cache is searched for a matching entry If a match is found a response is sent to the requesting PC or...

Страница 8: ...s not specified the name servers will be used as the default name servers All DNS requests that do not match another specified domain will be sent to the default name servers This is equivalent to spe...

Страница 9: ...eset Telnet Server Port Number The listen port for the Telnet server is now configurable so that it can be changed from the default value 23 The LISTENPORT parameter has been added to the SET TELNET c...

Страница 10: ...ompression encryption authentication or Diffie Hellman key exchange A decoding channel is used for decompression decryption or authentication With Software Release 2 3 1 the number of channels availab...

Страница 11: ...C POSTION pos RADDRESS ANY ipadd ipadd RMASK ipadd RNAME ANY system name RPORT ANY port OPAQUE SRCINTERFACE interface TRANSPORTPROTOCOL ANY EGP ESP GRE ICMP OPAQUE OSPF RSVP TCP UDP protocol UDPHEARTB...

Страница 12: ...t multi access NBMA networks are declared as demand circuits i e more than one router has the network configured as a demand circuit routing update traffic is reduced but the periodic sending of Hello...

Страница 13: ...ing OSPF on demand For more information see the Open Shortest Path First OSPF chapter of your switch or router s Software Reference The latest Software Reference can be downloaded from the support sit...

Страница 14: ...e sites For examples of their use see Web Redirection with Reverse NAT Rules on page 18 and Further Examples on page 19 As in previous releases the Paladin Firewall requires a special feature licence...

Страница 15: ...will be active from the creation of the rule and will be deleted after the time specified has expired All entries created from this rule will be destroyed once the rule expires Rules defined with a TT...

Страница 16: ...y allows traffic that matches the rule Care should be taken when defining the rule so only the desired traffic will be permitted through the firewall The GBLIP parameter specifies a single IP address...

Страница 17: ...The NATMASK parameter specifies an IP address mask that will be used to translate IP addresses from one subnet to another The MASK parameter must only be specified when the rule action is NAT and the...

Страница 18: ...everse NAT Rules The implementation of reverse NAT allows the firewall to perform Web Redirection A NAT rule can be created which redirects HTTP traffic and sends it to one particular web server defin...

Страница 19: ...t rule number until a match is found A low number will ensure that the allow rule will be applied if appropriate rather than any of the other rules ADD FIREWALL POLICY ISP RULE 5 INTERFACE vlan1 ACTIO...

Страница 20: ...private subnet 10 1 2 0 use the command ADD FIREWALL POLICY zone1 RULE 11 ACTION NAT NATTYPE STANDARD INT eth1 PROTOCOL all GBLIP 210 25 4 0 IP 10 1 2 0 NATMASK 255 255 255 0 REMOTEIP 210 25 4 1 210...

Страница 21: ...all HTTP Application Gateway Proxy A new Firewall HTTP proxy Application Gateway will filter outbound HTTP sessions based on the URLs requested and block the setting of all cookies or cookies requeste...

Страница 22: ...cter _ filename is the name of a file on the router These commands add or delete the contents of a HTTP filter file from the HTTP filter of the specified firewall policy The HTTP filter file contains...

Страница 23: ...han a similar entry with deny Finally keywords in the file have the least precedence They are only applied to sections of the URL not part of the closest fitting URL entry Figure 6 contains an example...

Страница 24: ...g a in front of the keyword indicates that the string must appear at the end of the URL for the URL to be denied The following entry would match www anything com this is an example but not www example...

Страница 25: ...passing through the HTTP proxy is enabled If PROXY is specified the display of general information about firewall proxies is enabled The DEBUG parameter is not retained over a reboot SHOW FIREWALL PO...

Страница 26: ...ach time a VLAN port fails or is disabled Table 6 New parameters in the output of the SHOW FIREWALL POLICY COUNTER command Parameter Meaning HTTP Proxy Filter File Name of a text file containing a lis...

Страница 27: ...the PORTMONITORING parameter is set to ON the STEPVALUE parameter may also be specified The default is OFF The STEPVALUE parameter specifies the value by which the priority of the VR should be decrem...

Страница 28: ...DD BGP AGGREGATE ADD BGP CONFEDERATIONPEER ADD BGP IMPORT ADD BGP NETWORK ADD BGP PEER DELETE BGP AGGREGATE DELETE BGP CONFEDERATIONPEER DELETE BGP IMPORT DELETE BGP NETWORK DELETE BGP PEER DISABLE BG...

Страница 29: ...The latest Software Reference can be downloaded from the support site at www alliedtelesyn co nz documentation documentation html IP and Interface Counters Software Release 2 3 1 allows you to reset a...

Страница 30: ...If an option is not specified or ALL is specified all the IP counters are displayed The output displayed with the option ARP is shown in Figure 7 on page 30 and Table 8 on page 30 The output displayed...

Страница 31: ...itiates a SLIP or PPP connection The interface will disappear when the user logs off when the router is restarted or when the IP module is reset with the RESET IP command An inactive interface is a pe...

Страница 32: ...NMP community name inBadCommunityUses The total number of SNMP PDUs delivered to the SNMP agent that represented an SNMP operation not allowed by the SNMP community name in the PDU inASNParseErrs The...

Страница 33: ...quest packets received by the router inGetResponses The number of SNMP Get Response packets received by the router inTraps The number of SNMP trap message packets received by the router outPkts The nu...

Страница 34: ...value 64 127000 in kbps is rounded down to the nearest 64kbps if below 1000 otherwise it is rounded down to the nearest 1000 or 1 Mbps For Gigabit ports the input value 8 1016 in Mbps is rounded down...

Страница 35: ...OFF YES NO other options SET USER login name LOGIN TRUE FALSE ON OFF YES NO other options SET USER LOGIN TRUE FALSE ON OFF YES NO other options TELNET Module Configuration Telnet Server Enabled Telne...

Страница 36: ...sed both for PAP and CHAP authentication and to login and access the command line Usernames with LOGIN set to FALSE can only be used for PAP and CHAP authentication After upgrading from 2 0 x or 2 1 x...

Отзывы: