From 54bdc76b3bae95734d73a5ac2f174b32a1b9f2e9 Mon Sep 17 00:00:00 2001 From: srividya0208 Date: Mon, 4 Sep 2023 02:13:54 -0400 Subject: correction of ipsec compression syntax and added a reference for changes done for zone based firewall --- docs/configuration/firewall/zone.rst | 11 ++++++----- docs/configuration/nat/nat44.rst | 2 -- docs/configuration/vpn/dmvpn.rst | 4 ---- docs/configuration/vpn/ipsec.rst | 27 ++++++++------------------- 4 files changed, 14 insertions(+), 30 deletions(-) (limited to 'docs/configuration') diff --git a/docs/configuration/firewall/zone.rst b/docs/configuration/firewall/zone.rst index 403de912..6afd47e9 100644 --- a/docs/configuration/firewall/zone.rst +++ b/docs/configuration/firewall/zone.rst @@ -6,13 +6,14 @@ Zone Based Firewall ################### -.. note:: **Important note:** - This documentation is valid only for VyOS Sagitta prior to - 1.4-rolling-YYYYMMDDHHmm +.. note:: For latest releases, refer the `firewall + `_ + main page to configure zone based rules. New syntax was introduced here + :vytask:`T5160` In zone-based policy, interfaces are assigned to zones, and inspection policy is applied to traffic moving between the zones and acted on according to -firewall rules. A Zone is a group of interfaces that have similar functions or +firewall rules. A zone is a group of interfaces that have similar functions or features. It establishes the security borders of a network. A zone defines a boundary where traffic is subjected to policy restrictions as it crosses to another region of a network. @@ -40,7 +41,7 @@ firewall can be created to simplify configuration when multiple interfaces belong to the same security zone. Instead of applying rule-sets to interfaces, they are applied to source zone-destination zone pairs. -An basic introduction to zone-based firewalls can be found `here +A basic introduction to zone-based firewalls can be found `here `_, and an example at :ref:`examples-zone-policy`. diff --git a/docs/configuration/nat/nat44.rst b/docs/configuration/nat/nat44.rst index 9aeb581e..c660f8f4 100644 --- a/docs/configuration/nat/nat44.rst +++ b/docs/configuration/nat/nat44.rst @@ -740,14 +740,12 @@ external interface in the image above) .. code-block:: none - set vpn ipsec ike-group my-ike ikev2-reauth 'no' set vpn ipsec ike-group my-ike key-exchange 'ikev1' set vpn ipsec ike-group my-ike lifetime '7800' set vpn ipsec ike-group my-ike proposal 1 dh-group '14' set vpn ipsec ike-group my-ike proposal 1 encryption 'aes256' set vpn ipsec ike-group my-ike proposal 1 hash 'sha256' - set vpn ipsec esp-group my-esp compression 'disable' set vpn ipsec esp-group my-esp lifetime '3600' set vpn ipsec esp-group my-esp mode 'tunnel' set vpn ipsec esp-group my-esp pfs 'disable' diff --git a/docs/configuration/vpn/dmvpn.rst b/docs/configuration/vpn/dmvpn.rst index 6680d46a..a85e03b4 100644 --- a/docs/configuration/vpn/dmvpn.rst +++ b/docs/configuration/vpn/dmvpn.rst @@ -200,7 +200,6 @@ Hub set protocols nhrp tunnel tun100 redirect set protocols nhrp tunnel tun100 shortcut - set vpn ipsec esp-group ESP-HUB compression 'disable' set vpn ipsec esp-group ESP-HUB lifetime '1800' set vpn ipsec esp-group ESP-HUB mode 'transport' set vpn ipsec esp-group ESP-HUB pfs 'dh-group2' @@ -208,7 +207,6 @@ Hub set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1' set vpn ipsec esp-group ESP-HUB proposal 2 encryption '3des' set vpn ipsec esp-group ESP-HUB proposal 2 hash 'md5' - set vpn ipsec ike-group IKE-HUB ikev2-reauth 'no' set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' set vpn ipsec ike-group IKE-HUB lifetime '3600' set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' @@ -309,7 +307,6 @@ VyOS can also run in DMVPN spoke mode. set protocols nhrp tunnel tun100 redirect set protocols nhrp tunnel tun100 shortcut - set vpn ipsec esp-group ESP-HUB compression 'disable' set vpn ipsec esp-group ESP-HUB lifetime '1800' set vpn ipsec esp-group ESP-HUB mode 'transport' set vpn ipsec esp-group ESP-HUB pfs 'dh-group2' @@ -318,7 +315,6 @@ VyOS can also run in DMVPN spoke mode. set vpn ipsec esp-group ESP-HUB proposal 2 encryption '3des' set vpn ipsec esp-group ESP-HUB proposal 2 hash 'md5' set vpn ipsec ike-group IKE-HUB close-action 'none' - set vpn ipsec ike-group IKE-HUB ikev2-reauth 'no' set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' set vpn ipsec ike-group IKE-HUB lifetime '3600' set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' diff --git a/docs/configuration/vpn/ipsec.rst b/docs/configuration/vpn/ipsec.rst index 327f3abb..c91feea0 100644 --- a/docs/configuration/vpn/ipsec.rst +++ b/docs/configuration/vpn/ipsec.rst @@ -51,8 +51,6 @@ VyOS IKE group has the next options: * ``hold`` set action to hold; - * ``clear`` set action to clear; - * ``restart`` set action to restart; * ``dead-peer-detection`` controls the use of the Dead Peer Detection protocol @@ -73,11 +71,9 @@ VyOS IKE group has the next options: * ``timeout`` keep-alive timeout in seconds <2-86400> (default 120) IKEv1 only * ``ikev2-reauth`` whether rekeying of an IKE_SA should also reauthenticate - the peer. In IKEv1, reauthentication is always done: - - * ``yes`` enable remote host re-authentication during an IKE rekey; - - * ``no`` disable remote host re-authenticaton during an IKE rekey; + the peer. In IKEv1, reauthentication is always done. + Setting this parameter enables remote host re-authentication during an IKE + rekey. * ``key-exchange`` which protocol should be used to initialize the connection If not set both protocols are handled and connections will use IKEv2 when @@ -87,13 +83,10 @@ VyOS IKE group has the next options: * ``ikev2`` use IKEv2 for Key Exchange; -* ``lifetime`` IKE lifetime in seconds <30-86400> (default 28800); - -* ``mobike`` enable MOBIKE Support. MOBIKE is only available for IKEv2: +* ``lifetime`` IKE lifetime in seconds <0-86400> (default 28800); - * ``enable`` enable MOBIKE (default for IKEv2); - - * ``disable`` disable MOBIKE; +* ``disable-mobike`` disables MOBIKE Support. MOBIKE is only available for IKEv2 + and enabled by default. * ``mode`` IKEv1 Phase 1 Mode Selection: @@ -126,12 +119,8 @@ Multiple proposals can be specified in a single group. VyOS ESP group has the next options: -* ``compression`` whether IPComp compression of content is proposed - on the connection: - - * ``disable`` disable IPComp compression (default); - - * ``enable`` enable IPComp compression; +* ``compression`` Enables the IPComp(IP Payload Compression) protocol which + allows compressing the content of IP packets. * ``life-bytes`` ESP life in bytes <1024-26843545600000>. Number of bytes transmitted over an IPsec SA before it expires; -- cgit v1.2.3 From 24d9c9b9d08dedd46e6a7f39b8587656ee6a112c Mon Sep 17 00:00:00 2001 From: Nicolas Fort Date: Fri, 8 Sep 2023 09:49:02 -0300 Subject: Firewall refactor: add visible note in firewall docs: zone, quick-start and config blueprint zone-policy --- docs/configexamples/zone-policy.rst | 10 ++++ docs/configuration/firewall/general-legacy.rst | 6 +-- docs/configuration/firewall/zone.rst | 10 ++++ docs/quick-start.rst | 68 +++++++++++++++----------- 4 files changed, 62 insertions(+), 32 deletions(-) (limited to 'docs/configuration') diff --git a/docs/configexamples/zone-policy.rst b/docs/configexamples/zone-policy.rst index 90de8b24..08db13b9 100644 --- a/docs/configexamples/zone-policy.rst +++ b/docs/configexamples/zone-policy.rst @@ -5,6 +5,16 @@ Zone-Policy example ------------------- +.. note:: Starting from VyOS 1.4-rolling-202308040557, a new firewall + structure can be found on all vyos instalations, and zone based firewall is + no longer supported. Documentation for most of the new firewall CLI can be + found in the `firewall + `_ + chapter. The legacy firewall is still available for versions before + 1.4-rolling-202308040557 and can be found in the :ref:`firewall-legacy` + chapter. The examples in this section use the legacy firewall configuration + commands, since this feature has been removed in earlier releases. + .. note:: In :vytask:`T2199` the syntax of the zone configuration was changed. The zone configuration moved from ``zone-policy zone `` to ``firewall zone ``. diff --git a/docs/configuration/firewall/general-legacy.rst b/docs/configuration/firewall/general-legacy.rst index de91e54b..2e6b0061 100644 --- a/docs/configuration/firewall/general-legacy.rst +++ b/docs/configuration/firewall/general-legacy.rst @@ -1,6 +1,6 @@ :lastproofread: 2021-06-29 -.. _firewall: +.. _firewall-legacy: ############### Firewall-Legacy @@ -8,7 +8,7 @@ Firewall-Legacy .. note:: **Important note:** This documentation is valid only for VyOS Sagitta prior to - 1.4-rolling-YYYYMMDDHHmm + 1.4-rolling-202308040557 ******** Overview @@ -153,7 +153,7 @@ Groups ****** Firewall groups represent collections of IP addresses, networks, ports, -mac addresses or domains. Once created, a group can be referenced by +mac addresses or domains. Once created, a group can be referenced by firewall, nat and policy route rules as either a source or destination matcher. Members can be added or removed from a group without changes to, or the need to reload, individual firewall rules. diff --git a/docs/configuration/firewall/zone.rst b/docs/configuration/firewall/zone.rst index 6afd47e9..70ad7b65 100644 --- a/docs/configuration/firewall/zone.rst +++ b/docs/configuration/firewall/zone.rst @@ -6,6 +6,16 @@ Zone Based Firewall ################### +.. note:: Starting from VyOS 1.4-rolling-202308040557, a new firewall + structure can be found on all vyos instalations, and zone based firewall is + no longer supported. Documentation for most of the new firewall CLI can be + found in the `firewall + `_ + chapter. The legacy firewall is still available for versions before + 1.4-rolling-202308040557 and can be found in the :ref:`firewall-legacy` + chapter. The examples in this section use the legacy firewall configuration + commands, since this feature has been removed in earlier releases. + .. note:: For latest releases, refer the `firewall `_ main page to configure zone based rules. New syntax was introduced here diff --git a/docs/quick-start.rst b/docs/quick-start.rst index 19be7b66..a6055576 100644 --- a/docs/quick-start.rst +++ b/docs/quick-start.rst @@ -122,6 +122,15 @@ network via IP masquerade. Firewall ######## +.. note:: Starting from VyOS 1.4-rolling-202308040557, a new firewall + structure can be found on all vyos instalations. Documentation for most + of the new firewall CLI can be found in the `firewall + `_ + chapter. The legacy firewall is still available for versions before + 1.4-rolling-202308040557 and can be found in the :ref:`firewall-legacy` + chapter. The examples in this section use the new firewall configuration + commands. + Add a set of firewall policies for our outside/WAN interface. This configuration creates a proper stateful firewall that blocks all traffic @@ -129,19 +138,25 @@ which was not initiated from the internal/LAN side first. .. code-block:: none - set firewall name OUTSIDE-IN default-action 'drop' - set firewall name OUTSIDE-IN rule 10 action 'accept' - set firewall name OUTSIDE-IN rule 10 state established 'enable' - set firewall name OUTSIDE-IN rule 10 state related 'enable' - - set firewall name OUTSIDE-LOCAL default-action 'drop' - set firewall name OUTSIDE-LOCAL rule 10 action 'accept' - set firewall name OUTSIDE-LOCAL rule 10 state established 'enable' - set firewall name OUTSIDE-LOCAL rule 10 state related 'enable' - set firewall name OUTSIDE-LOCAL rule 20 action 'accept' - set firewall name OUTSIDE-LOCAL rule 20 icmp type-name 'echo-request' - set firewall name OUTSIDE-LOCAL rule 20 protocol 'icmp' - set firewall name OUTSIDE-LOCAL rule 20 state new 'enable' + set firewall ipv4 forward filter default-action 'drop' + set firewall ipv4 forward filter rule 10 action 'accept' + set firewall ipv4 forward filter rule 10 state established 'enable' + set firewall ipv4 forward filter rule 10 state related 'enable' + set firewall ipv4 forward filter rule 20 action 'drop' + set firewall ipv4 forward filter rule 20 state invalid 'enable' + set firewall ipv4 forward filter rule 30 inbound-interface interface-name 'eth1' + set firewall ipv4 forward filter rule 30 action 'accept' + + set firewall ipv4 input filter default-action drop + set firewall ipv4 input filter rule 10 action 'accept' + set firewall ipv4 input filter rule 10 state established 'enable' + set firewall ipv4 input filter rule 10 state related 'enable' + set firewall ipv4 input filter rule 20 action 'drop' + set firewall ipv4 input filter rule 20 state invalid 'enable' + set firewall ipv4 input filter rule 30 action 'accept' + set firewall ipv4 input filter rule 30 icmp type-name 'echo-request' + set firewall ipv4 input filter rule 30 protocol 'icmp' + set firewall ipv4 input filter rule 30 state new 'enable' If you wanted to enable SSH access to your firewall from the outside/WAN interface, you could create some additional rules to allow that kind of @@ -152,24 +167,19 @@ blocks brute-forcing attempts: .. code-block:: none - set firewall name OUTSIDE-LOCAL rule 30 action 'drop' - set firewall name OUTSIDE-LOCAL rule 30 destination port '22' - set firewall name OUTSIDE-LOCAL rule 30 protocol 'tcp' - set firewall name OUTSIDE-LOCAL rule 30 recent count '4' - set firewall name OUTSIDE-LOCAL rule 30 recent time 'minute' - set firewall name OUTSIDE-LOCAL rule 30 state new 'enable' - - set firewall name OUTSIDE-LOCAL rule 31 action 'accept' - set firewall name OUTSIDE-LOCAL rule 31 destination port '22' - set firewall name OUTSIDE-LOCAL rule 31 protocol 'tcp' - set firewall name OUTSIDE-LOCAL rule 31 state new 'enable' + set firewall ipv4 input filter rule 40 action 'drop' + set firewall ipv4 input filter rule 40 inbound-interface interface-name 'eth0' + set firewall ipv4 input filter rule 40 destination port '22' + set firewall ipv4 input filter rule 40 protocol 'tcp' + set firewall ipv4 input filter rule 40 recent count '4' + set firewall ipv4 input filter rule 40 recent time 'minute' + set firewall ipv4 input filter rule 40 state new 'enable' -Apply the firewall policies: - -.. code-block:: none + set firewall ipv4 input filter rule 41 action 'accept' + set firewall ipv4 input filter rule 41 destination port '22' + set firewall ipv4 input filter rule 41 protocol 'tcp' + set firewall ipv4 input filter rule 41 state new 'enable' - set firewall interface eth0 in name 'OUTSIDE-IN' - set firewall interface eth0 local name 'OUTSIDE-LOCAL' Commit changes, save the configuration, and exit configuration mode: -- cgit v1.2.3 From d80690d56318c401e881ad6e524c23aa9d0ffb8e Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 9 Sep 2023 07:27:57 +0200 Subject: vxlan: T3700: support VLAN tunnel mapping of VLAN aware bridges --- docs/configuration/interfaces/vxlan.rst | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) (limited to 'docs/configuration') diff --git a/docs/configuration/interfaces/vxlan.rst b/docs/configuration/interfaces/vxlan.rst index 86568686..2cb0b2f1 100644 --- a/docs/configuration/interfaces/vxlan.rst +++ b/docs/configuration/interfaces/vxlan.rst @@ -132,6 +132,36 @@ For optimal scalability, Multicast shouldn't be used at all, but instead use BGP to signal all connected devices between leaves. Unfortunately, VyOS does not yet support this. +Single VXLAN device (SVD) +========================= + +FRR supports a new way of configuring VLAN-to-VNI mappings for EVPN-VXLAN, when +working with the Linux kernel. In this new way, the mapping of a VLAN to a +:abbr:`VNI (VXLAN Network Identifier (or VXLAN Segment ID))` is configured +against a container VXLAN interface which is referred to as a +:abbr:`SVD (Single VXLAN device)`. + +Multiple VLAN to VNI mappings can be configured against the same SVD. This +allows for a significant scaling of the number of VNIs since a separate VXLAN +interface is no longer required for each VNI. + +.. cfgcmd:: set interfaces vxlan vlan-to-vni vni + + Maps the VNI to the specified VLAN id. The VLAN can then be consumed by + a bridge. + + Sample configuration of SVD with VLAN to VNI mappings is shown below. + + .. code-block:: none + + set interfaces bridge br0 member interface vxlan0 + set interfaces vxlan vxlan0 external + set interfaces vxlan vxlan0 source-interface 'dum0' + set interfaces vxlan vxlan0 vlan-to-vni 10 vni '10010' + set interfaces vxlan vxlan0 vlan-to-vni 11 vni '10011' + set interfaces vxlan vxlan0 vlan-to-vni 30 vni '10030' + set interfaces vxlan vxlan0 vlan-to-vni 31 vni '10031' + Example ------- @@ -252,7 +282,7 @@ advertised. set interfaces bridge br241 member interface 'eth1.241' set interfaces bridge br241 member interface 'vxlan241' -Binds eth1.241 and vxlan241 to each other by making them both member +Binds eth1.241 and vxlan241 to each other by making them both member interfaces of the same bridge. .. code-block:: none -- cgit v1.2.3 From 44f64352e388b22239861679fef69272ce8f421b Mon Sep 17 00:00:00 2001 From: Yuxiang Zhu Date: Sun, 10 Sep 2023 14:32:34 +0800 Subject: T5518: Document `protocols pim6` --- docs/configuration/protocols/index.rst | 1 + docs/configuration/protocols/pim6.rst | 94 ++++++++++++++++++++++++++++++++++ 2 files changed, 95 insertions(+) create mode 100644 docs/configuration/protocols/pim6.rst (limited to 'docs/configuration') diff --git a/docs/configuration/protocols/index.rst b/docs/configuration/protocols/index.rst index 29dc230f..237608a1 100644 --- a/docs/configuration/protocols/index.rst +++ b/docs/configuration/protocols/index.rst @@ -16,6 +16,7 @@ Protocols mpls segment-routing ospf + pim6 rip rpki static diff --git a/docs/configuration/protocols/pim6.rst b/docs/configuration/protocols/pim6.rst new file mode 100644 index 00000000..1d316cfb --- /dev/null +++ b/docs/configuration/protocols/pim6.rst @@ -0,0 +1,94 @@ +.. _pim6: + +############## +IPv6 Multicast +############## + +VyOS facilitates IPv6 Multicast by supporting **PIMv6** and **MLD**. + +PIMv6 (Protocol Independent Multicast for IPv6) must be configured in every +interface of every participating router. Every router must also have the +location of the Rendevouz Point manually configured. +Then, unidirectional shared trees rooted at the Rendevouz Point will +automatically be built for multicast distribution. + +Traffic from multicast sources will go to the Rendezvous Point, and receivers +will pull it from a shared tree using MLD (Multicast Listener Discovery). + +Multicast receivers will talk MLD to their local router, so, besides having +PIMv6 configured in every router, MLD must also be configured in any router +where there could be a multicast receiver locally connected. + +VyOS supports both MLD version 1 and version 2 +(which allows source-specific multicast). + +Basic commands +============== +These are the commands for a basic setup. + +.. cfgcmd:: set protocols pim6 interface + + Use this command to enable PIMv6 in the selected interface so that it + can communicate with PIMv6 neighbors. This command also enables MLD reports + and query on the interface unless :cfgcmd:`mld disable` is configured. + +.. cfgcmd:: set protocols pim6 interface mld disable + + Disable MLD reports and query on the interface. + + +Tuning commands +=============== +You can also tune multicast with the following commands. + + +.. cfgcmd:: set protocols pim6 interface mld interval + + Use this command to configure in the selected interface the MLD + host query interval (1-65535) in seconds that PIM will use. + The default value is 125 seconds. + +.. cfgcmd:: set protocols pim6 interface mld join + + Use this command to allow the selected interface to join a multicast group. + +.. cfgcmd:: set protocols pim6 interface mld join source + + Use this command to allow the selected interface to join a source-specific multicast + group. + +.. cfgcmd:: set protocols pim6 interface mld last-member-query-count + + Set the MLD last member query count. The default value is 2. + +.. cfgcmd:: set protocols pim6 interface mld last-member-query-interval + + Set the MLD last member query interval in milliseconds (100-6553500). The default value is 1000 milliseconds. + +.. cfgcmd:: set protocols pim6 interface mld max-response-time + + Set the MLD query response timeout in milliseconds (100-6553500). The default value is 10000 milliseconds. + +.. cfgcmd:: set protocols pim6 interface mld version + + Set the MLD version used on this interface. The default value is 2. + +********************* +Configuration Example +********************* + +To enable MLD reports and query on interfaces `eth0` and `eth1`: + +.. code-block:: none + + set protocols pim6 interface eth0 + set protocols pim6 interface eth1 + +The following configuration explicitly joins multicast group `ff15::1234` on interface `eth1` +and source-specific multicast group `ff15::5678` with source address `2001:db8::1` on interface +`eth1`: + +.. code-block:: none + + set protocols pim6 interface eth0 mld join ff15::1234 + set protocols pim6 interface eth1 mld join ff15::5678 source 2001:db8::1 -- cgit v1.2.3