WAN

WAN

1. Tipos de BMW WAN

   • BMW uses 3 different network solution types to connect remote locations with a data center: 1.Enterprise Network 2. High Speed Plant Network 3. LAN Extension
   • Enterprise Network
     • Very small to extra large MPLS WAN access
   • High Speed Plant Network
     • Large or extralarge location WAN access (Ethernet over SDH/sonet)
   • LAN Extension
     • MAN access - small location(metro ethernet)

2. Technical details

   • Interface + IP to MPLS - Gi0/1
   • Interface to LAN -G0/0

3. QoS = DSCP+Prec.bit

   • EF - 15%
   • stream - 15%
   • Business - 40%
   • Economy - 30%

4. Load balance

   • Incoming
     • By provider
   • Outcoming
     • By Provider, all traffic is send to the primary WAN router

5. Netflow

   •    1. Basic-config ip flow-cache timeout active 1 ip flow-export source Loopback1 ip flow-export version 5 ip flow-export destination 160.50.13.33 9995   2. On the logical WAN-Interface ip flow ingress ip flow egress   3. There mustn’t be any other netflow-config in place on other interfaces   4. The interfaces in the interface-tables of the routers must persit snmp-server ifindex persist   

6. SNMP Server

   •    snmp-server enable traps bgp state-changes snmp-server host 160.50.13.31 service  envmon bgp snmp snmp-server host 160.50.13.37 service  envmon bgp snmp

7. configuration

   • General
     • Router(config)# ip cef Router(config)# ip classless Router(config)# ip subnet-zero Router(config)# ip tcp synwait-time 5 Router(config)# no cdp run Router(config)# no ip source-route Router(config)# no ip http server Router(config)# no ip forward-protocol nd Router(config)# no ip forward-protocol udp Router(config)# no ip forward-protocol sdns Router(config)# no service tcp-small-servers Router(config)# no service udp-small-servers Router(config)# no service pad Router(config)# no service finger Router(config-if)# no ip proxy-arp Router(config-if)# no ip directed-broadcast Router(config-if)# no ip redirect Router(config-if)# duplex auto Router(config-if)# speed 100
   • “ip load-sharing per-packet”
     • Should one router have two equal paths to a common destination, the “ip load-sharing per-packet” command has to be entered on the outgoing interfaces.
   • no ip route-cache cef”
     • Should it become necessary to disable CEF on a particular interface, the “no ip route-cache cef” command has to be entered on this interface
   • DNS - no ip domain-lookup
     • A Cisco router that is not part of a DNS-enabled network should have the command “no ip domain-lookup” in the global configuration.
   • Password settings
     • Router(config)# service password-encryption Router(config)# enable secret PASSWORD Router(config)# line con 0 Router(config-line)# exec-timeout 10 0 Router(config-line)# password PASSWORD Router(config-line)# login Router(config-line)# transport output none
     • exec-timeout 10 0 After 10 minutes of inactivity the system will log out the user automatically from the console.
     • transport output To determine the protocols that can be used for outgoing connections from a line, use the transport output line configuration command. The default setting is Telnet.You can specify one protocol, multiple protocols, all protocols, or no protocols. To specify multiple protocols, enter the keyword for each protocol, separated by a space. Any settings made with the transport output command override settings made with the transport preferred command.
   • Password settings for the Virtual Terminal lines
     • Router(config)# access-list ACL-NR permit m.m.m.m Router(config)# line vty 0 4 Router(config-line)# ipv6 access-class VTY-ACCESS in Router(config-line)# exec-timeout 10 0 Router(config-line)# password PASSWORD Router(config-line)# login Where m.m.m.m is the inverted wildcard mask of the management network that is allowed to connect to this router. Applies standard ACL and password to protect virtual terminal ports. After 10 minutes of inactivity the system logs out the user automatically. ACL-NR is the number of the ACL list and gets assigned by CN Operations.
   • Anti-Spoofing
     • ip verify unicast reverse-path The interface configuration has to be done on the LAN Ethernet interface. Prerequisites: a) Minimum of Cisco IOS 11.1(17)CC/12.0(21)ST5 b) Cisco Express Forwarding (CEF) has to be enabled Cisco calls this function „Unicast RPF“ (uRPF)
     • poofing definition ================ As you know, the Internet is rife with security threats, and one such threat is IP address spoofing. During a typical IP address spoofing attempt, the attacker simply fakes the source of packets in order to appear as part of an internal network.  ways to block ip spoofing 1. Block IP addresses 2. Implement ACLs 3. Use reverse path forwarding (ip verify) 1. Block IP addresses Here's a list of IP addresses—and their subnet masks—that I would block from coming into my network from the Internet:10.0.0.0/8172.16.0.0/12192.168.0.0/16127.0.0.0/8224.0.0.0/3169.254.0.0/16 2. Implementing ACL The easiest way to prevent spoofing is using an ingress filter on all Internet traffic. The filter drops any traffic with a source falling into the range of one of the IP networks listed above. In other words, create an access control list (ACL) to drop all inbound traffic with a source IP in the ranges above.Here's a configuration example:Router# conf t Enter configuration commands, one per line. End with CNTL/Z. Router(config)# ip access-list ext ingress-antispoof Router(config-ext-nacl)# deny ip 10.0.0.0 0.255.255.255 any Router(config-ext-nacl)# deny ip 172.16.0.0 0.15.255.255 any Router(config-ext-nacl)# deny ip 192.168.0.0 0.0.255.255 any Router(config-ext-nacl)# deny ip 127.0.0.0 0.255.255.255 any Router(config-ext-nacl)# deny ip 224.0.0.0 31.255.255.255 any Router(config-ext-nacl)# deny ip 169.254.0.0 0.0.255.255 any Router(config-ext-nacl)# permit ip any any Router(config-ext-nacl)# exit Router(config)#int s0/0 Router(config-if)#ip access-group ingress-antispoof in 3. Use reverse path forwarding (ip verify) RPF does something similar with packets. It takes the source IP address of a packet received from the Internet and looks up to see if the router has a route in its routing table to reply to that packet. If there's no route in the routing table for a response to return to the source IP, then someone likely spoofed the packet, and the router drops the packet.Here's how to configure RPF on your router:Router(config)# ip cef Router(config)# int serial0/0 Router(config-if)# ip verify unicast reverse-path
   • Secure access to WAN routers using RADIUS-AAA
     • Router(config)# aaa new-model Router(config)# aaa authentication login radius-login group radius local Router(config)# aaa authentication ppp radius-ppp if-needed group radius Router(config)# aaa authorization exec default group radius if -authenticated Router(config)# aaa authorization network default group radius Router(config)# line vty 0 4 Router(config-line)# login authentication radius -login Router(config)# line con 0 Router(config-line)# login authentication radius -login Router(config)# interface serial 0 Router(config-if)# ppp authentication radius-ppp
     • AAA Note: Authentication, authorization, and accounting (AAA) is the name for Cisco’s network security services.
   • SNMP
     • Only the network management network on m.m.m.m with wildcard mask mw.mw.mw.mw gets access thru ACL list ACR-NR to the router via SNMP. S.s.s.s ist the IPv4 address of the SNMP trap host. For each trap host there should be multiple entries of the snmp-server host command. COMMUNITY is the SNMPv1 community string used to read SNMP objects and by the trap server. The COMMUNITY string and the ACL-NR are assigned by CN Operations. Router(config)# access-list ACL-NR permit m.m.m.m mw.mw.mw.mw Router(config)# snmp-server community COMMUNITY ro ACL-NR Router(config)# snmp-server trap-source loopback 0 Router(config)# snmp-server enable traps snmp Router(config)# snmp-server host s.s.s.s traps COMMUNITY
   • syslog
     • BRBMMCARA0001R#sh run | i service timestamps service timestamps debug datetime msec localtime show-timezone service timestamps log datetime BRBMMCARA0001R# BRBMMCARA0001R#sh run | i logging logging buffered 32000 logging monitor notifications cts logging verbose logging trap debugging logging source-interface Loopback0 logging host 135.89.106.42 logging host 135.89.112.42  
   • Network Time Protocol
     • With authentication Router(config)# clock timezone TZ OFFSET Router(config)# clock summer-time TZ recurring Router(config)# ntp source loopback 0 Router(config)# ntp update-calendar Router(config)# ntp server n.n.n.n Router(config)# ntp authenticate Router(config)# ntp authentication-key KEY-NR md5 PASSWORD Router(config)# ntp trusted-key KEY-NR Without authentication Router(config)# clock timezone TZ OFFSET Router(config)# clock summer-time TZ recurring Router(config)# access-list ACL-NR permit n.n.n.n Router(config)# access-list ACL-NR deny any log Router(config)# ntp source loopback 0 Router(config)# ntp access-group peer ACL-NR Router(config)# ntp update-calendar Router(config)# ntp server n.n.n.n
     • Where n.n.n.n is the IPv4 address of the NTP server. There should be multiple access-list ACL-NR permit and ntp server entries for each NTP server. ACL-NR is the number of the ACL list. This number and the PASSWORD for authentication are assigned by CN Operations. The timezone TZ has to be a well-known timezone, with OFFSET being the difference from UTC in hours. Prerequisites: Minimum of Cisco IOS 10.0 Limitations: The ntp update-calendar command is only available on routers with hardware clocks and therefore not available on the Cisco 2500 and 2600 series. Reference: Note: For the Provider Managed Router Service, the service provider may provide it’s own NTP servers. For Germany the timezone is “CET” with “1” as the offset to UTC.
   • DHCP relay
     • All Cisco WAN routers where clients need access to a remote Dynamic Host Configuration Protocol (DHCP) server NAO É O CASO DE BRAZIL Router(config-if)# ip helper-address d.d.d.d Router(config)# no ip forward-protocol udp tftp Router(config)# no ip forward-protocol udp nameserver Router(config)# no ip forward-protocol udp ntp Router(config)# no ip forward-protocol udp domain Router(config)# no ip forward-protocol udp time Router(config)# no ip forward-protocol udp netbios-ns Router(config)# no ip forward-protocol udp netbios-dgm Router(config)# no ip forward-protocol udp tacacs UDP forwarding is disabled in the implementation guideline for global settings, so the “no ip forward-protocol udp” statement has to be removed from the global section when DHCP relay is used!
   • HSRP
     • Scope: All Cisco WAN routers with the need for running Hot Standby Routing Protocol (HSRP) Active Router(config-if)# standby ip v.v.v.v Router(config-if)# standby preempt delay minimum 60 Router(config-if)# standby priority 105 Router(config-if)# standby track WAN-Interface Standby Router(config-if)# standby ip v.v.v.v Router(config-if)# standby preempt delay minimum 60 Router(config-if)# standby track WAN-Interface
     • Where v.v.v.v is the virtual IPv4 address being used. Interface configuration has to be done on the Ethernet interface. Only the WAN router with a main path to the A end should use the standby priority command. Cisco recommends using a delay of 60 s for a router to take over the active part after a line failure was restored (the line protocol may not be up yet).
   • OSPF
     • Scope: Cisco LAN routers at the A end with a Provider Managed Router Service and the need for Open Shortest Path First (OSPF) routing NAO PARA BRAZIL Router(config)# ip route 0.0.0.0 0.0.0.0 INT w.w.w.w Router(config)# router ospf PROCESS-ID Router(config-router)# network a.a.a.a 0.0.0.0 area AREA-ID Router(config-router)# default-information originate Where a.a.a.a is the IPv4 address of the interface pointing towards the A end and w.w.w.w is the IP address of the next-hop WAN router. INT is the interface the router sees the next-hop address thru.
     • Scope: Cisco LAN routers at the B end with a Provider Managed Router Service and the need for Open Shortest Path First (OSPF) routing NAP PARA BRAZIL Router(config)# ip route a.a.a.a m.m.m.m w.w.w.w Router(config)# router ospf PROCESS-ID Router(config-router)# network a.a.a.a m.m.m.m area AREA-ID Router(config-router)# redistribute static metric M subnets Where a.a.a.a is a network at the A end and m.m.m.m is the inverted netmask of that network. A similar entry would be used for C End networks. W.w.w.w is the interface of the next-hop WAN router. The metric M is optional and assigned by CN Operations. PROCESS-ID and AREAID are also assigned by CN Operations.
     • Scope: Cisco WAN routers at the A end with a BMW Managed Router Service and the need for Open Shortest Path First (OSPF) routing NAO PARA BRAZIL With authentication Router(config)# router ospf PROCESS-ID Router(config-router)# log-adjacency-changes Router(config-router)# network a.a.a.a 0.0.0.0 area AREA-ID Router(config-router)# default-information originate Router(config-router)# distance 255 l2.l2.l2.l2 0.0.0.0 Router(config-router)# area AREA-ID authentication message-digest Router(config-if)# ip ospf network point -to-point Router(config-if)# ip ospf message-digest-key KEY-ID md5 PASSWORD Without authentication Router(config)# router ospf PROCESS-ID Router(config-router)# log-adjacency-changes Router(config-router)# network a.a.a.a 0.0.0.0 area AREA-ID Router(config-router)# default-information originate Router(config-router)# distance 255 l2.l2.l2.l2 0.0.0.0 Router(config-if)# ip ospf network point -to-point Where a.a.a.a is the IPv4 address of the interface pointing towards the A end LAN and l2.l2.l2.l2 is the router ID of the second WAN router at the A end, typically the loopback address. The interface statement has to be entered on the interface pointing towards the A end LAN. PASSWORD is the password used to authenticate OSPF routing updates with Message Digest 5 (MD5). KEY-ID is the number assigned to this password.
     • Scope: Cisco WAN routers at the B end with a BMW Managed Router Service and the need for Open Shortest Path First (OSPF) routing NAO PARA BRAZIL With authentication Router(config)# router ospf PROCESS-ID Router(config-router)# log-adjacency-changes Router(config-router)# network b.b.b.b 0.0.0.0 area AREA-ID Router(config-router)# network t.t.t.t 0.0.0.0 area AREA-ID Router(config-router)# distance 220 Router(config-router)# area AREA-ID authentication message-digest Router(config-if)# ip ospf network point -to-point Router(config-if)# ip ospf message-digest-key KEY-ID md5 PASSWORD Without authentication Router(config)# router ospf PROCESS-ID Router(config-router)# log-adjacency-changes Router(config-router)# network b.b.b.b 0.0.0.0 area AREA-ID Router(config-router)# network t.t.t.t 0.0.0.0 area AREA-ID Router(config-router)# distance 220 Router(config-if)# ip ospf network point -to-point Where b.b.b.b is the IPv4 address of the interface pointing towards the B end core and t.t.t.t is the IPv4 address of the interface on the WAN transit point -to-point link. 220 is the weight factor for OSPF. It is set in a way to be slightly higher than internal BGP (200). The interface statement has to be entered on the interface pointing towards the B end core and on the interface that is connected to the WAN transit point -to-point link. PASSWORD is the password used to authenticate OSPF routing updates with Message Digest 5 (MD5). KEY-ID is the number assigned to this password.
   • BGP
     • Scope: Cisco WAN Router at the A end with a BMW Managed Router Service and the need for Border Gateway Protocol (BGP) routing Configuration: With authentication Router(config)# router bgp AS-NUMBER Router(config-router)# no synchronization Router(config-router)# bgp log-neighbor-changes Router(config-router)# network 0.0.0.0 Router(config-router)# redistribute connected Router(config-router)# neighbor t.t.t.t remote-as AS-NUMBER Router(config-router)# neighbor t.t.t.t password PASSWORD Router(config-router)# neighbor t.t.t.t next-hop-self Router(config-router)# neighbor r.r.r.r remote-as AS-NUMBER-R Router(config-router)# neighbor r.r.r.r password PASSWORD Router(config-router)# neighbor r.r.r.r next-hop-self Router(config-router)# no auto-summary Router(config)# ip route 0.0.0.0 0.0.0.0 Null0 Without authentication Router(config)# router bgp AS-NUMBER Router(config-router)# no synchronization Router(config-router)# bgp log-neighbor-changes Router(config-router)# network 0.0.0.0 Router(config-router)# redistribute connected Router(config-router)# neighbor t.t.t.t remote-as AS-NUMBER Router(config-router)# neighbor t.t.t.t next-hop-self Router(config-router)# neighbor r.r.r.r remote-as AS-NUMBER-R Router(config-router)# neighbor r.r.r.r next-hop-self Router(config-router)# no auto-summary Router(config)# ip route 0.0.0.0 0.0.0.0 Null0
     • Where t.t.t.t is the IPv4 address of the transit interface of the redundant WAN router. R.r.r.r. is the IPv4 address of the remote BGP router to exchange information with. All remote WAN routers r1-rn at the edge of the cloud have to be listed here! The last statement creates a static default route that is being advertised (network 0.0.0.0) into BGP.

8. Layering of Building Blocks

   • In summary, the direction from the LAN to the WAN is ordered as follows: 1. The LAN Core distributes traffic into different LAN building blocks such as WAN distribution, server distribution, office areas and many more. 2. Securing the BMW network is achieved by several measures. One is Network Intrusion Prevention System (NIPS) that shall protect the LAN core from malicious code that arrives via the WAN. A DMZ is needed to connect networks that are not considered as trusted. 3. WAN Distribution directs all traffic from a LAN to one or more different providers. 4. Monitoring shall collect application sensitive information on traffic that is send to or received from different locations. 5. WAN Optimization shall improve the response times of centralized applications. 6. The WAN Access ranges from the Customer Edge (CE) router, which defines the borderline between the operations responsibility of the WAN provider, and BMW until the Provider Edge (PE) router, which defines the borderline between services that can be customized to BMW’s needs and the provider’s standard service.
   • LAN core
   • Security Layer
     • NIPs
     • DMZ
   • WAN distro
   • Monitoring
   • WAN Optimization
   • WAN Access

9. Caracteristicas

   • 2 links balanceados via MHSRP
   • links AT&T
   • exemplo da planta : 2x 20M
     • 20 M de upload e 20M de download