It is important to specify the default gateway for the DHCP server since this will be handed out to
DHCP clients on the internal network so that they know where to find the public Internet. The
default gateway is always the IP address of the interface on which the DHCP server is configured.
In this case,
LAN2_ip
.
NTP Server Setup
Network Time Protocol
(NTP) servers can be configured to maintain the accuracy of the system
date and time. By default, no time server is configured. Clavister provides its own time server
which can be used with the following command:
Device:/> set DateTime TimeSynchronization=Clavister
Alternatively, a custom time server can be configured. Suppose that synchronization is to be
setup with the two NTP servers at hostname
pool.ntp.org
and IPv4 address
203.0.113.5
. First, an
FQDNAddress
object needs to set up for the hostname:
Device:/> add Address FQDNAddress ts1_fqdn Address=pool.ntp.org
Next, set the servers to use for date and time synchronization:
Device:/> set DateTime TimeSynchronization=Custom
TimeSyncServer1=ts1_fqdn
TimeSyncServer2=203.0.113.5
External Syslog Server Setup
By default, only cOS Core's internal
memlog
feature will capture generated log messages. To send
logs to an external Syslog server, a log receiver object must be configured. For example, the
following command will send logs to a Syslog server at the IP address
192.0.2.10
:
Device:/> add LogReceiverSyslog my_syslog IPAddress=192.0.2.10
Allowing ICMP Ping Requests
As a further example of setting up IP policies, it can be useful to allow ICMP
ping
messages to
flow through the firewall. As discussed earlier, cOS Core will drop any traffic unless an IP rule set
entry explicitly allows it. Suppose that we wish to allow the pinging of external hosts by hosts
located on the protected network The command to define an IP policy called
allow_ping_outbound
to allow this traffic would be the following:
Device:/> add IPPolicy Name=allow_ping_outbound
SourceInterface=LAN2
SourceNetwork=InterfaceAddresses/LAN2_net
DestinationInterface=WAN2
DestinationNetwork=all-nets
Service=ping-outbound
Action=Allow
SourceAddressTranslation=NAT
NATSourceAddressAction=OutgoingInterfaceIP
The IP policy above assumes NAT will be used and this is necessary if the protected local hosts
have private IPv4 addresses. The ICMP requests will be sent out to the Internet with the IP
address of the firewall interface connected to the ISP. Responding hosts will send back ICMP
responses to this single IP and cOS Core will then forward the traffic to the correct private IP
address.
Chapter 4: cOS Core Configuration
65
