LBOの設定｜設定例｜ルータ・ネットワーク機器

Proxyサーバを利用しないネットワークではDNS snooping方式を、Proxyサーバを利用するネットワークではHTTP snooping方式を、それぞれご利用いただけます。下記リンクよりご確認ください。

アプリケーション毎の設定

2023年12月27日

アプリケーション	DNS snooping	HTTP snooping
Windows Update / Microsoft Update
Microsoft 365 / Microsoft Teams （o365 enable設定によりブレイクアウト）
Zoom
Webex
for update macOS/iPadOS		（動作未確認）
for update Adobe applications	FITELnetの設定（txt）	（動作未確認）
Box

DNS snooping方式使用例

	対象装置	設定例（txt）
ドメイン名ルーティング	F70/F71/F220/F221/F225/F310/F220 EX/F221 EX
Microsoft 365 / Microsoft Teams	F70/F71/F220/F221/F220 EX/F221 EX
Windows Update / Microsoft Update	F70/F71/F220/F221/F220 EX/F221 EX
Zoom,Webexをdns-snoopingによりブレイクアウトする	F70/F71/F220/F221/F225/F310/F220 EX/F221 EX
ProxyDNSを利用してMicrosoft 365をブレイクアウトする	F70/F71/F220/F221/F225/F310/F220 EX/F221 EX

HTTP snooping方式使用例

	対象装置	設定例（txt）
Proxy環境下で、Microsoft 365/Microsoft Teams、Zoomをhttp-snoopingによりブレイクアウトする	F70/F71/F220/F221/F225/F310/F220 EX/F221 EX
固定IPサービスでVPN/ローカルブレイクアウトを利用する	F70/F71/F220/F221/F220 EX/F221 EX	左記ページ参照
動的IPサービス（MAP-E）でVPN/ローカルブレイクアウトを利用する	F70/F71/F220/F221/F220 EX/F221 EX	左記ページ参照
Proxy環境下で、Microsoft 365のテナント制限とhttp-snoopingの併用	F70/F71/F220/F221/F225/F310/F220 EX/F221 EX

<pre>
ip name-server #DNSサーバアドレス#
local-breakout enable
local-breakout proxy-server ip #LBO対象パケットの宛先アドレス# port #LBO対象パケットのポート番号#
local-breakout LBO_WindowsUpdate #ネクストホップ(TunnelIF番号もしくはアドレス)#
!
lbo-profile LBO_WindowsUpdate
 http-snooping enable with-route
 domain update.microsoft.com
 domain *.update.microsoft.com
 domain download.windowsupdate.com
 domain *.download.windowsupdate.com
 domain download.microsoft.com
 domain *.download.microsoft.com
 domain windowsupdate.com
 domain *.windowsupdate.com
 domain ntservicepack.microsoft.com
 domain login.live.com
 domain mp.microsoft.com
 domain *.mp.microsoft.com
 domain *.do.dsp.mp.microsoft.com
 domain *.dl.delivery.mp.microsoft.com
 domain *.emdl.ws.microsoft.com
 domain *.prod.do.dsp.mp.microsoft.com
 domain emdl.ws.microsoft.com
 domain *.delivery.mp.microsoft.com
 domain adl.windows.com
 domain tsfe.trafficshaping.dsp.mp.microsoft.com
exit
!
interface Port-channel #LAN Port-channel番号#
 http-snooping enable
 mss #MSS(LBO回線のMSSよりも小さい値に設定)#
exit
</pre>

<pre>
access-list 100 permit udp any eq 500 192.0.2.1 0.0.0.0 eq 500
access-list 100 permit 50 any 192.0.2.1 0.0.0.0
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 0.0.0.0 0.0.0.0 192.168.0.1
ip route 192.168.1.0 255.255.255.0 tunnel 2
ip route 192.168.1.0 255.255.255.0 null 0 250
!
hostname CENTER
!
crypto ipsec policy P2-POLICY
 set pfs group14
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp keepalive
logging level informational
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
crypto isakmp tunnel-route ip interface tunnel 1
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
 match identity user id-kyoten
 local-address 192.0.2.1 
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto map KYOTEN ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0001
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 192.168.0.254 255.255.255.0
 mss 1300
exit
!
interface Tunnel 1
 description FLETS
 ip address 192.0.2.1  255.255.255.255
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
 tunnel mode ipsec map KYOTEN
 link-state sync-sa
exit
!
pppoe profile PPPOE_PROF
 account abc012@***.***.ne.jp xxxyyyzzz
exit
!
end
</pre>

<pre>
access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 500 any eq 500
access-list 100 permit 50 192.0.2.1 0.0.0.0 any
access-list 101 permit udp any any range 3478 3481
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 192.0.2.1 255.255.255.255 tunnel 1
ip route 0.0.0.0 0.0.0.0 tunnel 2
ip name-server 192.168.0.100
ip name-server source-interface port-channel 1
ip nat list 1 192.168.1.0 0.0.0.255
!
ip dhcp server-profile lan1
 address 192.168.1.1 192.168.1.200
 lease-time 28800
 dns 192.168.0.100
 gateway 192.168.1.254
exit
!
crypto ipsec policy P2-POLICY
 set pfs group14
 set security-association always-up
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp keepalive
logging level informational
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
hostname KYOTEN
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
 self-identity user-fqdn id-kyoten
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 set peer 192.0.2.1
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto map CENTER ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0001
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input PRMap_Teams
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 192.168.1.254 255.255.255.0
 ip dhcp service server
 ip dhcp server-profile lan1
 mss 1300
exit
!
interface Tunnel 1
 description FLETS
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
 tunnel mode ipsec map CENTER
 dns-snooping enable
exit
!
pppoe profile PPPOE_PROF
 account abc345@***.***.ne.jp zzzyyyxxx
exit
!
local-breakout enable
local-breakout LBO1 tunnel 1
!
lbo-profile LBO1
 o365 enable
 dns-snooping enable
exit
!
Class-map CMap_101
 match ip access-group 101
exit
!
Policy-route-map PRMap_Teams
 !
 class CMap_101
  count
  action nexthop tunnel 1
 exit
 !
exit
!
end
</pre>

crypto isakmp keepalive
logging level informational
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
crypto isakmp tunnel-route ip interface tunnel 1
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
 match identity user id-kyoten
 local-address 192.0.2.1 
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto map KYOTEN ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0001
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 192.168.0.254 255.255.255.0
 mss 1300
exit
!
interface Tunnel 1
 description FLETS
 ip address 192.0.2.1  255.255.255.255
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
 tunnel mode ipsec map KYOTEN
 link-state sync-sa
exit
!
pppoe profile PPPOE_PROF
 account abc012@***.***.ne.jp xxxyyyzzz
exit
!
end
</pre>

<pre>
access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 500 any eq 500
access-list 100 permit 50 192.0.2.1 0.0.0.0 any
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 192.0.2.1 255.255.255.255 tunnel 1
ip route 0.0.0.0 0.0.0.0 tunnel 2
ip nat list 1 192.168.1.0 0.0.0.255
!
ip dhcp server-profile lan1
 address 192.168.1.1 192.168.1.200
 lease-time 28800
 dns 192.168.0.100
 gateway 192.168.1.254
exit
!
crypto ipsec policy P2-POLICY
 set pfs group14
 set security-association always-up
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp keepalive
logging level informational
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
hostname KYOTEN
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
 self-identity user-fqdn id-kyoten
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 set peer 192.0.2.1
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto map CENTER ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0001
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 192.168.1.254 255.255.255.0
 ip dhcp service server
 ip dhcp server-profile lan1
 mss 1300
exit
!
interface Tunnel 1
 description FLETS
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
 tunnel mode ipsec map CENTER
 dns-snooping enable
exit
!
pppoe profile PPPOE_PROF
 account abc345@***.***.ne.jp zzzyyyxxx
exit
!
local-breakout enable
local-breakout LBO1 tunnel 1
!
lbo-profile LBO1
 dns-snooping enable
 dns-snooping expire 86400
 domain update.microsoft.com
 domain *.update.microsoft.com
 domain download.windowsupdate.com
 domain *.download.windowsupdate.com
 domain download.microsoft.com
 domain *.download.microsoft.com
 domain windowsupdate.com
 domain *.windowsupdate.com
 domain ntservicepack.microsoft.com
 domain login.live.com
 domain mp.microsoft.com
 domain *.mp.microsoft.com
 domain *.do.dsp.mp.microsoft.com
 domain *.dl.delivery.mp.microsoft.com
 domain *.emdl.ws.microsoft.com
 domain *.prod.do.dsp.mp.microsoft.com
 domain emdl.ws.microsoft.com
 domain *.delivery.mp.microsoft.com
 domain adl.windows.com
 domain tsfe.trafficshaping.dsp.mp.microsoft.com
exit
!
end
</pre>

<pre>
ip route 0.0.0.0 0.0.0.0 172.16.0.2
ip nat list 1 10.1.0.0 0.0.255.255
!
local-breakout enable
local-breakout LBO 192.168.1.2
!
lbo-profile LBO
 dns-snooping enable
 dns-snooping expire 10800
 domain *zoom.us
 domain *.wbx2.com
 domain *.ciscospark.com
 domain *.webexcontent.com
 domain *.webex.com
 domain *.identrust.com
 domain *.quovadisglobal.com
 domain *.digicert.com
 domain *.godaddy.com
 domain *.lencr.org
 domain *.intel.com
 domain *.accompany.com
 domain *.eum-appdynamics.com
 domain *.appdynamics.com
 domain *.vbrickrev.com
 domain *.slido.com
 domain *.sli.do
 domain *.data.logentries.com
 domain *.cisco.com
exit
!
snmp-server community public ro
snmp-server enable traps snmp
snmp-server host 10.0.0.3 public

logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $1$5jqHeXmk$V1/EnzL3rI24dQdtfSTo0/
!
hostname FITELnet
!
sntp server 10.0.0.4 source port-channel 1
sntp poll-interval 86400
sntp retry limit 10 interval 64
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
 speed-duplex 100 full
 mdi mdi
exit
!
interface GigaEthernet 3/1
 vlan-id 3
 bridge-group 3
 channel-group 3
 ip access-group default spi
exit
!
interface Port-channel 1
 ip dhcp service relay 10.0.0.5
 ip address 10.1.1.1 255.255.0.0
 link-state always-up
exit
!
interface Port-channel 2
 ip address 172.16.0.1 255.255.255.252
 dns-snooping enable
exit
!
interface Port-channel 3
 ip address 192.168.1.1 255.255.255.252
 ip nat inside source list 1 interface
exit
!
line console
 authorization exec default local
exit
!
sflow-agent address 172.16.0.1
!
sflow profile 1
 collector address 10.0.0.1
 collector address 10.0.0.2
 collector address local
 source-interface port-channel 2
exit
!
sflow interface gigaethernet 2/1 sflow-profile 1 sampling-rate 100
sflow interface gigaethernet 3/1 sflow-profile 1 sampling-rate 100
!
end
</pre>

<pre>
access-list 101 permit udp any any range 3478 3481
!
ip route 0.0.0.0 0.0.0.0 10.1.0.1
ip name-server 127.0.0.1
ip nat list 1 any
!
local-breakout enable
local-breakout LBO tunnel 1
!
lbo-profile LBO
 o365 enable
 dns-snooping enable
 domain endpoints.office.com
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $1$5jqHeXmk$V1/EnzL3rI24dQdtfSTo0/
!
hostname FITELnet
!
sntp server ntp.nict.jp
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input PRMap_Teams
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 10.1.1.1 255.255.0.0
 dns-snooping enable
 link-state always-up
exit
!
interface Tunnel 1
 description FLETS
 ip access-group default spi
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
exit
!
pppoe profile PPPOE_PROF
 account abc345@***.***.ne.jp zzzyyyxxx
exit
!
Class-map CMap_101
 match ip access-group 101
exit
!
Policy-route-map PRMap_Teams
 !
 class CMap_101
  count
  action nexthop tunnel 1
 exit
 !
exit
!
dns-server ip enable
!
proxydns domain 1 any * any static 10.1.2.1
proxydns address 1 any static 10.1.2.1
proxydns lbo enable
!
line console
 authorization exec default local
exit
!
end
</pre>

<pre>
access-list 101 permit udp any any range 3478 3481
!
!
ip route 0.0.0.0 0.0.0.0 172.16.0.2
ip name-server 172.16.1.2
ip nat list 1 any
!
local-breakout enable
local-breakout proxy-server ip any port <ポート番号>
local-breakout LBO_Zoom tunnel 1
local-breakout LBO_Microsoft365 tunnel 1
!
lbo-profile LBO_Zoom
 http-snooping enable with-route
 domain *zoom.us
exit
!
lbo-profile LBO_Microsoft365
 o365 enable
 http-snooping enable with-route
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $1$5jqHeXmk$V1/EnzL3rI24dQdtfSTo0/
!
hostname FITELnet
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input PRMap_Teams
exit
!
interface GigaEthernet 1/3
 vlan-id 3
 bridge-group 3
 pppoe enable
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
exit
!
interface Port-channel 1
 ip address 10.0.0.1 255.255.255.0
 http-snooping enable
 mss 1300
exit
!
interface Port-channel 2
 ip address 172.16.0.1 255.255.255.252
exit
!
interface Tunnel 1
 description FLETS
 ip access-group default spi
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 1/3
exit
!
pppoe profile PPPOE_PROF
 account abc345@***.***.ne.jp zzzyyyxxx
exit
!
Class-map CMap_101
 match ip access-group 101
exit
!
Policy-route-map PRMap_Teams
 !
 class CMap_101
  count
  action nexthop tunnel 1
 exit
 !
exit
!
end
</pre>

<pre>
access-list 101 permit udp any any range 3478 3481
!
ip route 0.0.0.0 0.0.0.0 172.16.0.2
ip name-server 172.16.1.2
ip nat list 1 any
!
local-breakout enable
local-breakout proxy-server ip any port <ポート番号>
local-breakout LBO_Microsoft365 tunnel 1
!
lbo-profile LBO_Microsoft365
 o365 enable
 http-snooping enable with-route
 domain login.microsoft.com bypass
 domain login.microsoftonline.com bypass
 domain login.windows.net bypass
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $1$5jqHeXmk$V1/EnzL3rI24dQdtfSTo0/
!
hostname FITELnet
!
sntp server ntp.nict.jp
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input PRMap_Teams
exit
!
interface GigaEthernet 1/3
 vlan-id 3
 bridge-group 3
 pppoe enable
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
exit
!
interface Port-channel 1
 ip address 10.0.0.1 255.255.255.0
 http-snooping enable
 mss 1300
exit
!
interface Port-channel 2
 ip address 172.16.0.1 255.255.255.252
exit
!
interface Tunnel 1
 description FLETS
 ip access-group default spi
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 1/3
exit
!
pppoe profile PPPOE_PROF
 account abc345@***.***.ne.jp zzzyyyxxx
exit
!
Class-map CMap_101
 match ip access-group 101
exit
!
Policy-route-map PRMap_Teams
 !
 class CMap_101
  count
  action nexthop tunnel 1
 exit
 !
exit
!
end
</pre>

ページの先頭へ

機能LBOの設定

アプリケーション毎の設定

DNS snooping方式使用例

HTTP snooping方式使用例