ARCHITECTURE TECHNOLOGY CORPORATION CRR-1000 Quick Start Manual - Page 7

Browse online or download pdf Quick Start Manual for Wireless Router ARCHITECTURE TECHNOLOGY CORPORATION CRR-1000. ARCHITECTURE TECHNOLOGY CORPORATION CRR-1000 18 pages.

Print Page

CRR-1000 Quick Start Guide

Important Note:

The default firewall policy is configured to make it easy for users to access the router

over SSH, test its features, and experiment with configuration when used for the first time. For

deployment scenarios, we highly recommend changing the filter policies to DENY for all chains and

allowing network traffic to/from known destination/sources only if possible for maximum security. The

suitable configuration for a specific scenario depends on the use case.

4.1 Viewing the Firewall Policy (show filter policy)

The current firewall policy can be viewed by entering the following CLI command:

admin@CRR> show filter policy

Firewall Mode: Router

Current Policy Settings

INPUT -

OUTPUT -

FORWARD – ALLOW

4.2 Setting the Firewall Policy (set filter policy)

To change the firewall policy, use the "set filter policy" command, e.g.,

crr@CRR> set filter policy <input/output/forward> <allow/deny>

Example:

crr@CRR> set filter policy forward deny

User root attempting to restart service firewall-post

firewall-post restart successful

4.3 Advanced Firewall Rules

Best security practices dictate that firewalls only allow input, output and forward traffic that is explicitly

defined and to deny all other traffic. The following CLI command is used to specifically configure the

firewall rules:

admin@CRR> configure filter

A text editor will open and the firewall rules can be modified. The firewall is implemented through the

use of IPtables and follows the standard rule specification format where all firewall rules are saved into

the file. Refer to the user guide for more information.

5 Network and Routing Protocol Configuration Examples

CRR supports many standards routing protocols as well as numerous proprietary protocols and network

functions. There are two services running on CRR that responsible for configuring such protocols and

functions. The first is FRR service which supports the standard routing protocols such as OSPF, PIM,

BGP, RIP, NHRP, etc. The second is ARES service which supports OSPF and PIM protocols as well as

proprietary protocols such ATCorp's link sensing, automatic tunneling, and Cut-through routing. The

VPN configuration is also handled by ARES using the VPN Gateway plugin, refer to CRR user guide for

information about the VPN configuration.

It is important to note that in general you have to pick FRR or ARES to configure a certain link and not

configure the same link using both services. Otherwise there is a risk of creating link configuration

conflicts resulting in undesirable behavior. The default CRR configuration is all done using the ARES

service. If you wish to use FRR for configuration instead, please remove all link configuration from

ARES first.

DENY

ALLOW