FireBrick FB6602, Руководство пользователя

Страница: 66 / 152

51
Chapter 11. Tunnels
The FB6000 supports the following tunnelling protocols :-
• FB105 lightweight tunnelling protocol
• L2TP
Support for FB105 tunnels means the FB6000 can inter-work with existing FB105 hardware, and with FB2x00
devices.
11.1. FB105 tunnels
The FB105 tunnelling protocol is a FireBrick proprietary protocol that was first implemented in the FireBrick
FB105 device, and is popular with FB105 users for setting up VPNs etc. It is 'lightweight' in as much as it
is relatively simple, with low overhead and easy setup, but it does not currently offer encryption. Although
encryption is not available, the protocol does digitally sign packets, so that tunnel end-points can be confident
that the traffic originated from another 'trusted' end-point. Where it matters, encryption can be utilised via secure
protocols such as HTTPS or SSH over the tunnel.
The protocol supports multiple simultaneous tunnels to/from an end-point device, and Local Tunnel ID values
are used on an end-point device to identify each tunnel. The 'scope' of the Local ID is restricted to a single end-
point device - as such, the tunnel itself does not possess a (single) ID value, and is instead identified by the
Local IDs in use at both ends, which may well differ.
11.1.1. Tunnel wrapper packets
The protocol works by wrapping a complete IP packet in a UDP packet, with the destination port number of the
UDP packet defaulting to 1, but which can be set to any other port number if required. These UDP packets are
referred to as the 'tunnel wrappers', and include the digital signature. As with any other UDP traffic originating
at the FB6000, the tunnel wrappers are then encapsulated in an IP packet and sent to the IP address of the far-
end tunnel end-point. The IP packet that is contained in a tunnel wrapper packet is referred to as the 'tunnel
payload', and IP addresses in the payload packet are not involved in any routing decisions until the payload
is 'unwrapped' at the far-end.
Payload packet traffic is sent down a tunnel if the FB6000's routing logic determines that tunnel is the routing
target for the traffic. Refer to Chapter 7 for discussion of the routing processes used in the FB6000. Often, a
dynamic route is specified in the tunnel definition, such that traffic to a certain range of IP addresses (or possibly
all IP addresses, for a default route) is routed down the tunnel when it is in the Up state - see Section 11.1.4
for details.
Tip
Payload IP addressing is not restricted to RFC1918 private IP address space, and so FB105 tunnels
can be used to transport public IP address traffic too. This is ideal where you want to provide public
IP addresses to a network, but it is either impossible to route the addresses directly to the network -
e.g. it is behind a NAT'ing router, or is connected via networks (e.g. a 3rd party ISP) that you have no
control over - or you wish to benefit from having 'portable' public IP addresses e.g. you can physically
relocate a tunnel end-point FB6000 such that it is using different WAN connectivity, yet still have the
same public IP address block routed to an attached network.
11.1.2. Setting up a tunnel
You define a tunnel by creating an fb105 top-level object. In the web User Interface, these objects are created
and managed under the "Tunnels" category, in the section headed "FB105 tunnel settings".