古河電工ネットワーク機器 [FITELnet]:FITELnet-Fシリーズ:設定例集

古河電工ネットワーク機器の総合ブランド　ファイテルネット

設定例

ローカルブレイクアウト機能を使う
対象機種：F70/F71/F220/F221/F220 EX/F221 EX

内容

　ローカルブレイクアウト機能については機能説明資料をご参照ください。
　Proxyサーバを利用しないネットワークではDNS snooping方式を、Proxyサーバを利用するネット
　ワークではHTTP snooping方式を、それぞれご利用いただけます。下記リンクよりご確認ください。

アプリケーション毎の設定　2023/11/14更新

アプリケーション	DNS snooping	HTTP snooping
1. Windows Update / Microsoft Update	この設定のご利用は	この設定のご利用は
2. Microsoft 365 / Microsoft Teams（o365 enable設定によりブレイクアウト）	この設定のご利用は	この設定のご利用は
3. Zoom	この設定のご利用は	この設定のご利用は
4. Webex	この設定のご利用は	この設定のご利用は
5. for update macOS/iPadOS	この設定のご利用は	（動作未確認）
6. for update Adobe applications	この設定のご利用はこちら	（動作未確認）
7. Box	この設定のご利用は	この設定のご利用は

DNS snooping方式使用例

設定例	設定例（txt）
1. ドメイン名ルーティング	この設定のご利用は
2. Microsoft 365 / Microsoft Teams	センタ側の設定は
2. Microsoft 365 / Microsoft Teams	拠点側の設定は
3. Windows Update / Microsoft Update	センタ側の設定は
3. Windows Update / Microsoft Update	拠点側の設定は
4. Zoom,Webexをdns-snoopingによりブレイクアウトする	この設定のご利用は
5. ProxyDNSを利用してMicrosoft 365をブレイクアウトする★NEW	この設定のご利用は

HTTP snooping方式使用例

設定例	設定例（txt）
1. Proxy環境下で、Microsoft 365/Microsoft Teams, Zoomをhttp-snoopingによりブレイクアウトする	この設定のご利用は
2. 固定IPサービスでVPN/ローカルブレイクアウトを利用する	左記ページ参照
3. 動的IPサービス（MAP-E）でVPN/ローカルブレイクアウトを利用する	左記ページ参照
4. Proxy環境下で、Microsoft 365のテナント制限とhttp-snoopingの併用★NEW	この設定のご利用は

商標について

Windows, Microsoft 365, Microsoft Teams は、Microsoft Corporation およびグループ会社の米国およびその他の国における商標です。
Zoomは、Zoom Video Communications, Inc.の米国およびその他の国における登録商標または商標です。
Webexは、Cisco Systems, Inc.の米国およびその他の国における登録商標または商標です。
macOS, iPadOS は、Apple inc.の商標です。
Adobeは、アドビシステムズ社の商標です。
Boxは、Boxの米国あるいはその他の国における登録商標または商標です。

<pre>
ip name-server #DNSサーバアドレス#
local-breakout enable
local-breakout proxy-server ip #LBO対象パケットの宛先アドレス# port #LBO対象パケットのポート番号#
local-breakout LBO_WindowsUpdate #ネクストホップ(TunnelIF番号もしくはアドレス)#
!
lbo-profile LBO_WindowsUpdate
 http-snooping enable with-route
 domain update.microsoft.com
 domain *.update.microsoft.com
 domain download.windowsupdate.com
 domain *.download.windowsupdate.com
 domain download.microsoft.com
 domain *.download.microsoft.com
 domain windowsupdate.com
 domain *.windowsupdate.com
 domain ntservicepack.microsoft.com
 domain login.live.com
 domain mp.microsoft.com
 domain *.mp.microsoft.com
 domain *.do.dsp.mp.microsoft.com
 domain *.dl.delivery.mp.microsoft.com
 domain *.emdl.ws.microsoft.com
 domain *.prod.do.dsp.mp.microsoft.com
 domain emdl.ws.microsoft.com
 domain *.delivery.mp.microsoft.com
 domain adl.windows.com
 domain tsfe.trafficshaping.dsp.mp.microsoft.com
exit
!
interface Port-channel #LAN Port-channel番号#
 http-snooping enable
 mss #MSS(LBO回線のMSSよりも小さい値に設定)#
exit
</pre>

<pre>
access-list 100 permit udp any eq 500 192.0.2.1 0.0.0.0 eq 500
access-list 100 permit 50 any 192.0.2.1 0.0.0.0
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 0.0.0.0 0.0.0.0 192.168.0.1
ip route 192.168.1.0 255.255.255.0 tunnel 2
ip route 192.168.1.0 255.255.255.0 null 0 250
!
hostname CENTER
!
crypto ipsec policy P2-POLICY
 set pfs group14
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp keepalive
logging level informational
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
crypto isakmp tunnel-route ip interface tunnel 1
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
 match identity user id-kyoten
 local-address 192.0.2.1 
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto map KYOTEN ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0001
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 192.168.0.254 255.255.255.0
 mss 1300
exit
!
interface Tunnel 1
 description FLETS
 ip address 192.0.2.1  255.255.255.255
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
 tunnel mode ipsec map KYOTEN
 link-state sync-sa
exit
!
pppoe profile PPPOE_PROF
 account abc012@***.***.ne.jp xxxyyyzzz
exit
!
end
</pre>

<pre>
access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 500 any eq 500
access-list 100 permit 50 192.0.2.1 0.0.0.0 any
access-list 101 permit udp any any range 3478 3481
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 192.0.2.1 255.255.255.255 tunnel 1
ip route 0.0.0.0 0.0.0.0 tunnel 2
ip name-server 192.168.0.100
ip name-server source-interface port-channel 1
ip nat list 1 192.168.1.0 0.0.0.255
!
ip dhcp server-profile lan1
 address 192.168.1.1 192.168.1.200
 lease-time 28800
 dns 192.168.0.100
 gateway 192.168.1.254
exit
!
crypto ipsec policy P2-POLICY
 set pfs group14
 set security-association always-up
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp keepalive
logging level informational
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
hostname KYOTEN
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
 self-identity user-fqdn id-kyoten
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 set peer 192.0.2.1
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto map CENTER ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0001
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input PRMap_Teams
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 192.168.1.254 255.255.255.0
 ip dhcp service server
 ip dhcp server-profile lan1
 mss 1300
exit
!
interface Tunnel 1
 description FLETS
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
 tunnel mode ipsec map CENTER
 dns-snooping enable
exit
!
pppoe profile PPPOE_PROF
 account abc345@***.***.ne.jp zzzyyyxxx
exit
!
local-breakout enable
local-breakout LBO1 tunnel 1
!
lbo-profile LBO1
 o365 enable
 dns-snooping enable
exit
!
Class-map CMap_101
 match ip access-group 101
exit
!
Policy-route-map PRMap_Teams
 !
 class CMap_101
  count
  action nexthop tunnel 1
 exit
 !
exit
!
end
</pre>

<pre>
access-list 100 permit udp 192.0.2.1 0.0.0.0 eq 500 any eq 500
access-list 100 permit 50 192.0.2.1 0.0.0.0 any
access-list 111 deny ip any any
access-list 121 spi ip any any
!
ip route 192.0.2.1 255.255.255.255 tunnel 1
ip route 0.0.0.0 0.0.0.0 tunnel 2
ip nat list 1 192.168.1.0 0.0.0.255
!
ip dhcp server-profile lan1
 address 192.168.1.1 192.168.1.200
 lease-time 28800
 dns 192.168.0.100
 gateway 192.168.1.254
exit
!
crypto ipsec policy P2-POLICY
 set pfs group14
 set security-association always-up
 set security-association lifetime seconds 28800
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
 set ip df-bit 0
 set ip fragment post
exit
!
crypto ipsec selector SELECTOR
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp keepalive
logging level informational
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
!
hostname KYOTEN
!
crypto isakmp policy P1-POLICY
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 86400
 hash sha-256
 initiate-mode aggressive
exit
!
crypto isakmp profile PROF0001
 self-identity user-fqdn id-kyoten
 set isakmp-policy P1-POLICY
 set ipsec-policy P2-POLICY
 set peer 192.0.2.1
 ike-version 1
 local-key SECRET-VPN
exit
!
crypto map CENTER ipsec-isakmp
 match address SELECTOR
 set isakmp-profile PROF0001
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 192.168.1.254 255.255.255.0
 ip dhcp service server
 ip dhcp server-profile lan1
 mss 1300
exit
!
interface Tunnel 1
 description FLETS
 ip access-group 100 in
 ip access-group 111 in
 ip access-group 121 out
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
exit
!
interface Tunnel 2
 tunnel mode ipsec map CENTER
 dns-snooping enable
exit
!
pppoe profile PPPOE_PROF
 account abc345@***.***.ne.jp zzzyyyxxx
exit
!
local-breakout enable
local-breakout LBO1 tunnel 1
!
lbo-profile LBO1
 dns-snooping enable
 dns-snooping expire 86400
 domain update.microsoft.com
 domain *.update.microsoft.com
 domain download.windowsupdate.com
 domain *.download.windowsupdate.com
 domain download.microsoft.com
 domain *.download.microsoft.com
 domain windowsupdate.com
 domain *.windowsupdate.com
 domain ntservicepack.microsoft.com
 domain login.live.com
 domain mp.microsoft.com
 domain *.mp.microsoft.com
 domain *.do.dsp.mp.microsoft.com
 domain *.dl.delivery.mp.microsoft.com
 domain *.emdl.ws.microsoft.com
 domain *.prod.do.dsp.mp.microsoft.com
 domain emdl.ws.microsoft.com
 domain *.delivery.mp.microsoft.com
 domain adl.windows.com
 domain tsfe.trafficshaping.dsp.mp.microsoft.com
exit
!
end
</pre>

<pre>
ip route 0.0.0.0 0.0.0.0 172.16.0.2
ip nat list 1 10.1.0.0 0.0.255.255
!
local-breakout enable
local-breakout LBO 192.168.1.2
!
lbo-profile LBO
 dns-snooping enable
 dns-snooping expire 10800
 domain *zoom.us
 domain *.wbx2.com
 domain *.ciscospark.com
 domain *.webexcontent.com
 domain *.webex.com
 domain *.identrust.com
 domain *.quovadisglobal.com
 domain *.digicert.com
 domain *.godaddy.com
 domain *.lencr.org
 domain *.intel.com
 domain *.accompany.com
 domain *.eum-appdynamics.com
 domain *.appdynamics.com
 domain *.vbrickrev.com
 domain *.slido.com
 domain *.sli.do
 domain *.data.logentries.com
 domain *.cisco.com
exit
!
snmp-server community public ro
snmp-server enable traps snmp
snmp-server host 10.0.0.3 public

logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $1$5jqHeXmk$V1/EnzL3rI24dQdtfSTo0/
!
hostname FITELnet
!
sntp server 10.0.0.4 source port-channel 1
sntp poll-interval 86400
sntp retry limit 10 interval 64
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
 speed-duplex 100 full
 mdi mdi
exit
!
interface GigaEthernet 3/1
 vlan-id 3
 bridge-group 3
 channel-group 3
 ip access-group default spi
exit
!
interface Port-channel 1
 ip dhcp service relay 10.0.0.5
 ip address 10.1.1.1 255.255.0.0
 link-state always-up
exit
!
interface Port-channel 2
 ip address 172.16.0.1 255.255.255.252
 dns-snooping enable
exit
!
interface Port-channel 3
 ip address 192.168.1.1 255.255.255.252
 ip nat inside source list 1 interface
exit
!
line console
 authorization exec default local
exit
!
sflow-agent address 172.16.0.1
!
sflow profile 1
 collector address 10.0.0.1
 collector address 10.0.0.2
 collector address local
 source-interface port-channel 2
exit
!
sflow interface gigaethernet 2/1 sflow-profile 1 sampling-rate 100
sflow interface gigaethernet 3/1 sflow-profile 1 sampling-rate 100
!
end
</pre>

<pre>
access-list 101 permit udp any any range 3478 3481
!
ip route 0.0.0.0 0.0.0.0 10.1.0.1
ip name-server 127.0.0.1
ip nat list 1 any
!
local-breakout enable
local-breakout LBO tunnel 1
!
lbo-profile LBO
 o365 enable
 dns-snooping enable
 domain endpoints.office.com
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $1$5jqHeXmk$V1/EnzL3rI24dQdtfSTo0/
!
hostname FITELnet
!
sntp server ntp.nict.jp
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input PRMap_Teams
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 10.1.1.1 255.255.0.0
 dns-snooping enable
 link-state always-up
exit
!
interface Tunnel 1
 description FLETS
 ip access-group default spi
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 2/1
exit
!
pppoe profile PPPOE_PROF
 account abc345@***.***.ne.jp zzzyyyxxx
exit
!
Class-map CMap_101
 match ip access-group 101
exit
!
Policy-route-map PRMap_Teams
 !
 class CMap_101
  count
  action nexthop tunnel 1
 exit
 !
exit
!
dns-server ip enable
!
proxydns domain 1 any * any static 10.1.2.1
proxydns address 1 any static 10.1.2.1
proxydns lbo enable
!
line console
 authorization exec default local
exit
!
end
</pre>

<pre>
access-list 101 permit udp any any range 3478 3481
!
!
ip route 0.0.0.0 0.0.0.0 172.16.0.2
ip name-server 172.16.1.2
ip nat list 1 any
!
local-breakout enable
local-breakout proxy-server ip any port <ポート番号>
local-breakout LBO_Zoom tunnel 1
local-breakout LBO_Microsoft365 tunnel 1
!
lbo-profile LBO_Zoom
 http-snooping enable with-route
 domain *zoom.us
exit
!
lbo-profile LBO_Microsoft365
 o365 enable
 http-snooping enable with-route
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $1$5jqHeXmk$V1/EnzL3rI24dQdtfSTo0/
!
hostname FITELnet
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input PRMap_Teams
exit
!
interface GigaEthernet 1/3
 vlan-id 3
 bridge-group 3
 pppoe enable
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
exit
!
interface Port-channel 1
 ip address 10.0.0.1 255.255.255.0
 http-snooping enable
 mss 1300
exit
!
interface Port-channel 2
 ip address 172.16.0.1 255.255.255.252
exit
!
interface Tunnel 1
 description FLETS
 ip access-group default spi
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 1/3
exit
!
pppoe profile PPPOE_PROF
 account abc345@***.***.ne.jp zzzyyyxxx
exit
!
Class-map CMap_101
 match ip access-group 101
exit
!
Policy-route-map PRMap_Teams
 !
 class CMap_101
  count
  action nexthop tunnel 1
 exit
 !
exit
!
end
</pre>

<pre>
access-list 101 permit udp any any range 3478 3481
!
ip route 0.0.0.0 0.0.0.0 172.16.0.2
ip name-server 172.16.1.2
ip nat list 1 any
!
local-breakout enable
local-breakout proxy-server ip any port <ポート番号>
local-breakout LBO_Microsoft365 tunnel 1
!
lbo-profile LBO_Microsoft365
 o365 enable
 http-snooping enable with-route
 domain login.microsoft.com bypass
 domain login.microsoftonline.com bypass
 domain login.windows.net bypass
exit
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username test privilege 15 password 2 $1$5jqHeXmk$V1/EnzL3rI24dQdtfSTo0/
!
hostname FITELnet
!
sntp server ntp.nict.jp
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
 policy-route input PRMap_Teams
exit
!
interface GigaEthernet 1/3
 vlan-id 3
 bridge-group 3
 pppoe enable
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 channel-group 2
exit
!
interface Port-channel 1
 ip address 10.0.0.1 255.255.255.0
 http-snooping enable
 mss 1300
exit
!
interface Port-channel 2
 ip address 172.16.0.1 255.255.255.252
exit
!
interface Tunnel 1
 description FLETS
 ip access-group default spi
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF
 pppoe interface gigaethernet 1/3
exit
!
pppoe profile PPPOE_PROF
 account abc345@***.***.ne.jp zzzyyyxxx
exit
!
Class-map CMap_101
 match ip access-group 101
exit
!
Policy-route-map PRMap_Teams
 !
 class CMap_101
  count
  action nexthop tunnel 1
 exit
 !
exit
!
end
</pre>

ページトップへ

サイトマップ古河電工HOME l 古河電工サーバのご利用にあたっての注意