Tuesday , March 19 2024
Home / IP Services

IP Services

Easy-IP source NAT on Huawei USG firewall

A short video describing EASY-IP source NAT on Huawei’s USG firewall to assure that our intranet users can acccess the Internet.

The easy-ip is the easiest way to translate private IP addresses on your local area network when you have only one public IP address or the public IP address is assigned dynamically.

USG firewall configuration script:

#
dhcp enable
#
interface GigabitEthernet1/0/0
undo shutdown
ip address 10.0.0.1 255.255.255.0
service-manage ping permit
dhcp select interface
dhcp server excluded-ip-address 10.0.0.100
dhcp server static-bind ip-address 10.0.0.200 mac-address 5489-98b4-6a79
dhcp server dns-list 10.0.0.100
#
interface GigabitEthernet1/0/2
undo shutdown
ip address 5.0.0.2 255.255.255.252
#
firewall zone trust
set priority 85
add interface GigabitEthernet1/0/0
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/2
#
ip route-static 0.0.0.0 0.0.0.0 5.0.0.1
#
security-policy
rule name ALLOW
source-zone local
destination-zone trust
destination-zone untrust
action permit
rule name NAT_EASY
source-zone trust
destination-zone untrust
source-address 10.0.0.0 mask 255.255.255.0
action permit
#
nat-policy
rule name NAT_EASY
source-zone trust
destination-zone untrust
source-address 10.0.0.0 mask 255.255.255.0
action source-nat easy-ip
#

Read More »

DHCP IPv4 server on Huawei USG6000 firewall

You know how to configure DHCP on Huawei router but have problem to do so on Huawei firewall? Take a few minutes and see how to do that.

DHCP IPv4 server that uses interface’s address pool to allocate IPv4 addresses to DHCP clients. The simplest way to implement DHCP on USG6000.

USG firewall configuration script:

#
dhcp enable
#
interface GigabitEthernet1/0/0
undo shutdown
ip address 10.0.0.1 255.255.255.0
service-manage ping permit
dhcp select interface
dhcp server excluded-ip-address 10.0.0.100
dhcp server static-bind ip-address 10.0.0.200 mac-address 5489-98b4-6a79
dhcp server dns-list 10.0.0.100
#
firewall zone trust
set priority 85
add interface GigabitEthernet1/0/0
#
security-policy
rule name ALLOW
action permit
#

Read More »

QinQ termination on subinterfaces to support DHCP Relay

So far you have learned basic and selective QinQ on Huawei swiches. They seem like a simple Layer 2 VPN solution, which we can use to connect 2 or more offices. And of course, it is truth.

But, sometimes, we want to have an access to external services or just to the Internet, instead of connecting 2 branch offices. And, still we can use QinQ technology, why not?

The only thing we should do is to terminate QinQ VLAN Tag on a router. Just create L3 subinterface and let the router to use IP routing table to forward packets.

In our LAB, I am going to show you how to terminate QinQ to use DHCP server, located outside our network. In this case DHCP Relay feature must be used.

So let’s get to the point!

QinQ termination on subinterfaces to support DHCP Relay on Huawei

Topology of QinQ to support DHCP Relay

Read More »

introduction to IPv6 – part 2

Let’s keep going and finish IPv6 introduction.

Multicast

A multicast address identifies a group of interfaces. Traffic, that is sent to a multicast address, is sent to multiple destinations at the same time. An interface may belong to any number of multicast groups. Multicast addresses are defined by the prefix FF00::/8.

 

The second octet defines the flags and the scope of the multicast address. Flags can be defined as:

  • 0 is reserved and must equal 0
  • R indicates rendezvous point and is almost always set to 0
  • P indicates prefix dependency and is almost always set to 0
  • T is the temporary bit. For a temporary multicast address T equals 1; for a permanent multicast address T equals 0.

Read More »

introduction to IPv6 – part 1

To start using IPv6 in our labs, I decided to prepare a short introduction of it. As it is a broad topic I had to split it into several parts. Let’s start from the beginning.

Short IPv6 history

First IPv6 protocol specification was introduced in late 1995 in RFC1883, so it was 18 years ago! About one year later 6bone network was started as a virtual network over the IPv4-based Internet (using IPv6 over IPv4 tunneling). The mission of the 6bone was to establish the IPv6 environment for testing purposes.  In 1999 IPv6 Forum was founded and registries started assigning IPv6 prefixes to ISPs. In 2000, many vendors began to bundle IPv6 into their mainstream product lines. 2009 – first serious IPv4 address shortage in developed countries.

What about IPv5?

IPv5 was an experimental Resource Reservation Protocol, intended to provide QoS for multimedia and defined as the Internet Stream Protocol version 2 (ST2). It was designed to coexist with IPv4 and use the same addressing scheme, not as a replacement of IPv4. ST2 was designed to coexist with IPv4 on each node. The main role of the ST2 was to transfer a real-time multimedia, where IPv4 could be used for the transfer of traditional data and control information. ST2 is described in RFC1819.

Read More »