The service used in the above is
http-all
which will allow web browsing from the protected
network but this does not include the DNS protocol to resolve URIs into IP addresses. To solve
this problem, a custom service could be used in the above IP policy which combines
http-all
with
the
dns-all
service. However, the recommended method, which provides the most clarity to a
configuration, is to create a separate IP policy just for DNS traffic:
Device:/> add IPPolicy Name=lan_to_wan
SourceInterface=LAN2
SourceNetwork=InterfaceAddresses/LAN2_net
DestinationInterface=WAN2
DestinationNetwork=all-nets
Service=dns-all
Action=Allow
SourceAddressTranslation=NAT
NATSourceAddressAction=OutgoingInterfaceIP
It is recommended that at least one DNS server is also defined in cOS Core. This DNS server or
servers (a maximum of three can be configured) will be used when cOS Core itself needs to
resolve URIs, which will be the case when an FQDN is specified in a configuration instead of an IP
address. If we assume an IP address object called
dns1_address
has already been defined for the
first DNS server, the command to specify the first DNS server is:
Device:/> set DNS DNSServer1=dns1_address
Assuming a second IP object called
dns2_address
has been defined, the second DNS server is
specified with:
Device:/> set DNS DNSServer2=dns2_address
B. DHCP - automatic configuration
Alternatively, all required IP addresses can be automatically retrieved from the ISP's DHCP server
by enabling DHCP on the interface connected to the ISP.
Note that the 100 Series, DHCP is already enabled on the WAN1 interface by default. If DHCP
needs to be enabled on any other interface then this can be done as shown in the example
below.
If the interface on which DHCP is to be enabled is
WAN2
then the command to do this is:
Device:/> set Interface Ethernet WAN2 DHCPEnabled=Yes
Once the required IP addresses are retrieved with DHCP, cOS Core automatically sets the relevant
address objects in the address book with these addresses.
For cOS Core to know on which interface to find the public Internet, a
route
has to be added to
the
main
cOS Core routing table which specifies that the network
all-nets
can be found on the
interface connected to the ISP and this route must also have the correct
Default Gateway
IP
address specified. This
all-nets
route is added automatically by cOS Core during the DHCP
address retrieval process. Automatic route generation is a setting for each interface that can be
manually enabled and disabled.
After all IP addresses are set via DHCP and an
all-nets
route is added, the connection to the
Internet is configured but no traffic can flow to or from the Internet until an IP rule set entry is
defined that allows the flow. As was done in the previous option (A) above, we must therefore
manually define an IP policy that will allow traffic from a designated source network and source
interface (in this example, the network
LAN2_net
and interface
LAN2
) to flow to the destination
network
all-nets
and the destination interface
WAN2
.
Chapter 4: cOS Core Configuration
62
