Monday , July 23 2018

GRE on Huawei routers

Generic Routing Encapsulation (GRE) is introduced to encapsulate packets. Then these packets can be transmitted over an IPv4 network. GRE provides a mechanism to encapsulate packets of one protocol into packets of another protocol. This allows packets to be transmitted over heterogeneous networks. GRE also provides tunnels to transparently transmit VPN packets. When a device receives a packet that needs to be encapsulated and routed, it adds a GRE header to the packet and encapsulates it into another protocol such as IP. The packet is then forwarded by the IP protocol.

Let’s try to configure GRE tunnel between labnario_1 and labnario_3. All packets sent from PC_1 to PC_2, and vice versa, will be transmitted through the GRE tunnel.

Assure communication between routers in the network. It is omitted here.

Read More »

DHCP Relay Agent configuration in Huawei CLI

When PCs are in a different subnet than a DHCP server installed, DHCP Relay Agent can be used to forward DHCP requests from PCs to DHCP server. How to configure DHCP Relay Agent using Huawei CLI?

Let’s assume that we have the following topology:

We want our PC to acquire its IP address from the DHCP server configured on the labnarioR1 router. To do so, labnarioR2 should be configured as a DHCP Relay Agent to forward DHCP Requests and Offers between server and clients.

First, DHCP server should be configured. LabnarioR1 router will be configured to offer DHCP service for PC.

<labnarioR1>system-view 
Enter system view, return user view with Ctrl+Z.
[labnarioR1] dhcp enable
[labnarioR1] ip pool 1
[labnarioR1-ip-pool-1] gateway-list 172.16.1.1
[labnarioR1-ip-pool-1] network 172.16.1.0 mask 255.255.255.0
[labnarioR1-ip-pool-1] dns-list 150.100.15.1 150.100.15.2
[labnarioR1-ip-pool-1] domain-name labnario.com
[labnarioR1-ip-pool-1] quit
[labnarioR1]interface Ethernet0/0/0
[labnarioR1-Ethernet0/0/0]dhcp select global

Read More »

VRRP on Huawei router

Virtual Router Redundancy Protocol (VRRP) combines a group of routing devices on a LAN into a backup group that functions as a virtual router. From the host perspective in the LAN, it only needs the IP address of the virtual router rather than the IP address of a specific device in the backup group. Virtual IP address must be set as a default gateway for the host in the LAN. VRRP dynamically associates the virtual router with a physical device that transmits services. When the device fails, the second device is selected to handover traffic. The switchover should be transparent to users, allowing the internal and external networks to communicate without interruption. It, of course, depends on configured services. Most sensitive services need higher reliability and VRRP itself is not enough. But I will mention about it later in the post.

Let’s switch from theory to more practical things.

VRRP topology:

Assure communication between all elements in the network. It is omitted here.

Read More »

IPSec on Huawei AR router

How to secure communication between two sites connected to the Internet?

Use Site-to-Site IPsec VPN tunnel between two Huawei routers. IPsec VPN is an open standard protocol suite, defined by the IETF in the following RFCs: 2401, 2402-2412, 2451. IPSec is a widely used protocol for securing traffic on IP networks, including the Internet. IPSec can encrypt data between various devices, including router to router, firewall to router, desktop to router, and desktop to server.

How to configure IPsec VPN using Huawei CLI?

Let’s assume that we have two sites, Site1 and Site2. Both sites have PCs connected to the LAN network, PC1 and PC2 respectively. The sites are connected through WAN network (in our case labnarioR2 router simulates WAN). We want to secure communication between PC1 and PC2. To do so, we have to configure IPSec VPN tunnel between both sites. In our case tunnel will be established between labnarioR1 and labnarioR3 routers. Both routers will be responsible for data encryption and decryption using specified algorithms.

Read More »

Huawei’s equivalent of Cisco’s ‘logging synchronous’

If a router wants you to know something, it wants you to know right now!

Let’s look what will happen if you are entering a long command and the device wants you to be informed about a link’s failure:

[Huawei-acl-adv-3000]rule 10 permit ip vpn-instance vpn_labnario source 1.1.1.1 0.0.0.255 destination 1.1.1.2
Jan 15 2013 11:04:18-08:00 Huawei %%01PHY/1/PHY(l)[5]:    GigabitEthernet0/0/0:
change status to down
Jan 15 2013 11:04:18-08:00 Huawei %%01IFNET/4/LINK_STATE(l)[6]:The line protocol
IP on the interface GigabitEthernet0/0/0 has entered the DOWN state.
^
Error:Incomplete command found at '^' position.

When you click ‘Enter’ you will have to write the command once again. It is frustrating for all network administrators.

Unfortunately we cannot change it, like on Cisco’s devices, by ‘logging synchronous‘ command.

Read More »