Cisco-Cisco
R1#sh run
hostname R1
interface Loopback0
ip address 1.0.0.1 255.255.255.255
interface FastEthernet0/0
no ip address
shutdown
duplex full
interface Ethernet1/0
ip address 10.0.10.61 255.255.255.0
ip nat outside
duplex full
interface Ethernet1/1
ip address 12.12.12.1 255.255.255.252
ip nat inside
duplex full
interface Ethernet1/2
ip address 31.31.31.2 255.255.255.252
ip nat inside
duplex full
interface Ethernet1/3
no ip address
duplex full
router ospf 1
redistribute static subnets
network 1.0.0.0 0.0.0.0 area 0
network 12.12.12.0 0.0.0.3 area 0
network 31.31.31.0 0.0.0.3 area 0
default-information originate
ip nat inside source list LAN interface Ethernet1/0 overload
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 10.0.10.1
ip access-list standard LAN
permit 12.12.12.0 0.0.0.3
permit 23.23.23.0 0.0.0.3
permit 31.31.31.0 0.0.0.3
permit 1.0.0.0 0.0.0.7
R2#sh run
hostname R2
interface Loopback0
ip address 1.0.0.2 255.255.255.255
interface FastEthernet0/0
no ip address
shutdown
duplex full
interface Ethernet1/0
no ip address
duplex full
interface Ethernet1/1
ip address 12.12.12.2 255.255.255.252
duplex full
interface Ethernet1/2
ip address 23.23.23.1 255.255.255.252
duplex full
interface Ethernet1/3
no ip address
shutdown
duplex full
router ospf 1
network 1.0.0.0 0.0.0.0 area 0
network 12.12.12.0 0.0.0.3 area 0
network 23.23.23.0 0.0.0.3 area 0
ip forward-protocol nd
R3#sh run
hostname R3
interface Loopback0
ip address 1.0.0.3 255.255.255.255
interface FastEthernet0/0
no ip address
shutdown
duplex full
interface Ethernet1/0
no ip address
duplex full
interface Ethernet1/1
ip address 23.23.23.2 255.255.255.252
duplex full
interface Ethernet1/2
ip address 31.31.31.1 255.255.255.252
duplex full
interface Ethernet1/3
no ip address
shutdown
duplex full
router ospf 1
network 1.0.0.0 0.0.0.0 area 0
network 23.23.23.0 0.0.0.3 area 0
network 31.31.31.0 0.0.0.3 area 0
FortiGate-FortiGate
FGT1
config system interface
edit “port1”
set vdom “root”
set ip 10.0.10.61 255.255.255.0
set allowaccess ping https ssh http fgfm
set type physical
set snmp-index 1
next
edit “port2”
set vdom “root”
set ip 12.12.12.1 255.255.255.252
set allowaccess ping https ssh http fgfm
set type physical
set snmp-index 2
next
edit “port3”
set vdom “root”
set ip 31.31.31.2 255.255.255.252
set allowaccess ping https ssh http fgfm
set type physical
set snmp-index 3
next
edit “port4”
set vdom “root”
set type physical
set snmp-index 4
next
edit “ssl.root”
set vdom “root”
set type tunnel
set alias “SSL VPN interface”
set snmp-index 5
next
edit “loopback”
set vdom “root”
set ip 1.0.0.1 255.255.255.255
set type loopback
set snmp-index 6
next
end
config firewall policy
edit 1
set uuid ef6c951c-0627-51e6-739a-6ddf25cfc795
set srcintf “port2”
set dstintf “port3”
set srcaddr “all”
set dstaddr “all”
set action accept
set schedule “always”
set service “ALL”
next
edit 2
set uuid 6e9d6c2c-0708-51e6-17f6-3c373c555f2b
set srcintf “port3”
set dstintf “port2”
set srcaddr “all”
set dstaddr “all”
set action accept
set schedule “always”
set service “ALL”
next
edit 3
set uuid 0d34fb4c-070a-51e6-439a-725742a0b680
set srcintf “port2” “port3”
set dstintf “port1”
set srcaddr “all”
set dstaddr “all”
set action accept
set schedule “always”
set service “ALL”
set nat enable
next
end
config router static
edit 1
set gateway 10.0.10.1
set device “port1”
next
end
config router ospf
set default-information-originate enable
set router-id 1.0.0.1
config area
edit 0.0.0.0
next
end
config ospf-interface
edit “loopback”
set interface “loopback”
set ip 1.0.0.1
next
end
config network
edit 1
set prefix 12.12.12.0 255.255.255.252
next
edit 2
set prefix 31.31.31.0 255.255.255.252
next
edit 3
set prefix 1.0.0.1 255.255.255.255
next
end
config redistribute “connected”
end
config redistribute “static”
set status enable
end
config redistribute “rip”
end
config redistribute “bgp”
end
config redistribute “isis”
end
FGT2
config system interface
edit “port1”
set vdom “root”
set allowaccess ping https ssh http fgfm
set type physical
set snmp-index 1
next
edit “port2”
set vdom “root”
set ip 12.12.12.2 255.255.255.252
set allowaccess ping https ssh http fgfm
set type physical
set snmp-index 2
next
edit “port3”
set vdom “root”
set ip 23.23.23.1 255.255.255.252
set allowaccess ping https ssh http fgfm
set type physical
set snmp-index 3
next
edit “port4”
set vdom “root”
set type physical
set snmp-index 4
next
edit “ssl.root”
set vdom “root”
set type tunnel
set alias “SSL VPN interface”
set snmp-index 5
next
edit “loopback”
set vdom “root”
set ip 1.0.0.2 255.255.255.255
set type loopback
set snmp-index 6
next
end
config router ospf
set router-id 1.0.0.2
config area
edit 0.0.0.0
next
end
config ospf-interface
edit “loopback”
set interface “loopback”
set ip 1.0.0.2
next
end
config network
edit 1
set prefix 12.12.12.0 255.255.255.252
next
edit 2
set prefix 23.23.23.0 255.255.255.252
next
edit 3
set prefix 1.0.0.2 255.255.255.255
next
end
config redistribute “connected”
end
config redistribute “static”
end
config redistribute “rip”
end
config redistribute “bgp”
end
config redistribute “isis”
end
end
config firewall policy
edit 1
set uuid 5a630c00-071f-51e6-e8ae-2344f9e5a0e6
set srcintf “port2”
set dstintf “port3”
set srcaddr “all”
set dstaddr “all”
set action accept
set schedule “always”
set service “ALL”
set nat enable
next
edit 2
set uuid 5db36f80-071f-51e6-623f-42be7d156fd5
set srcintf “port3”
set dstintf “port2”
set srcaddr “all”
set dstaddr “all”
set action accept
set schedule “always”
set service “ALL”
next
FGT3
config system interface
edit “port1”
set vdom “root”
set allowaccess ping https ssh http fgfm
set type physical
set snmp-index 1
next
edit “port2”
set vdom “root”
set ip 23.23.23.2 255.255.255.252
set allowaccess ping https ssh http fgfm
set type physical
set snmp-index 2
next
edit “port3”
set vdom “root”
set ip 31.31.31.1 255.255.255.252
set allowaccess ping https ssh http fgfm
set type physical
set snmp-index 3
next
edit “port4”
set vdom “root”
set type physical
set snmp-index 4
next
edit “ssl.root”
set vdom “root”
set type tunnel
set alias “SSL VPN interface”
set snmp-index 5
next
edit “loopback”
set vdom “root”
set ip 1.0.0.3 255.255.255.255
set type loopback
set snmp-index 6
next
end
config router ospf
set router-id 1.0.0.3
config area
edit 0.0.0.0
next
end
config ospf-interface
edit “loopback”
set interface “loopback”
set ip 1.0.0.3
next
end
config network
edit 1
set prefix 23.23.23.0 255.255.255.252
next
edit 2
set prefix 31.31.31.0 255.255.255.252
next
edit 3
set prefix 1.0.0.3 255.255.255.255
next
end
config redistribute “connected”
end
config redistribute “static”
end
config redistribute “rip”
end
config redistribute “bgp”
end
config redistribute “isis”
end
end
config firewall policy
edit 1
set uuid 41d5f3a0-071f-51e6-df0e-727622495609
set srcintf “port2”
set dstintf “port3”
set srcaddr “all”
set dstaddr “all”
set action accept
set schedule “always”
set service “ALL”
set nat enable
next
edit 2
set uuid 46ddcb20-071f-51e6-0dc2-22dfea80d1d2
set srcintf “port3”
set dstintf “port2”
set srcaddr “all”
set dstaddr “all”
set action accept
set schedule “always”
set service “ALL”
next
end
NOTE:
-to refresh ospf db
# exe router clear ospf process
-to show route db
# get router info routing-table all
Juniper-Juniper
NOTE:
-With current config, I have problem ping to Internet from R1. I don’t know yet that is because in Unetlab or because I reduce the RAM in each router to 1GB
R1
# show
system {
host-name R1;
root-authentication {
encrypted-password “$1$7VWGeJRn$iG.WRousX9Fi5BKcaZGV7/”; ## SECRET-DATA
}
services {
ssh;
web-management {
http {
interface ge-0/0/0.0;
}
}
}
syslog {
file messages {
any any;
}
}
license {
autoupdate {
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
family inet {
address 10.0.10.61/24;
}
}
}
ge-0/0/1 {
unit 0 {
family inet {
address 12.12.12.1/30;
}
}
}
ge-0/0/2 {
unit 0 {
family inet {
address 31.31.31.2/30;
}
}
}
lo0 {
unit 0 {
family inet {
address 1.0.0.1/32;
}
}
}
}
routing-options {
static {
route 0.0.0.0/0 {
next-hop 10.0.10.1;
no-install;
}
}
}
protocols {
ospf {
export ospf-default;
area 0.0.0.0 {
interface ge-0/0/1.0;
interface ge-0/0/2.0;
interface lo0.0;
}
}
}
policy-options {
policy-statement ospf-default {
from {
protocol static;
route-filter 0.0.0.0/0 exact;
}
then accept;
}
}
security {
screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
queue-size 2000; ## Warning: ‘queue-size’ is deprecated
timeout 20;
}
land;
}
}
}
nat {
source {
rule-set trust-to-untrust {
from zone trust;
to zone untrust;
rule source-nat-rule {
match {
source-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
}
policies {
from-zone trust to-zone trust {
policy default-permit {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone trust to-zone untrust {
policy default-permit {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone untrust to-zone trust {
policy default-deny {
match {
source-address any;
destination-address any;
application any;
}
then {
deny;
}
}
}
}
zones {
security-zone trust {
tcp-rst;
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/1.0;
ge-0/0/2.0;
lo0.0;
}
}
security-zone untrust {
screen untrust-screen;
interfaces {
ge-0/0/0.0;
}
}
}
}
# run show ospf neighbor
Address Interface State ID Pri Dead
12.12.12.2 ge-0/0/1.0 Full 1.0.0.2 128 32
31.31.31.1 ge-0/0/2.0 Full 1.0.0.3 128 39
# run show route
inet.0: 12 destinations, 12 routes (12 active, 0 holddown, 0 hidden)
+ = Active Route, – = Last Active, * = Both
0.0.0.0/0 *[Static/5] 01:24:39
> to 10.0.10.1 via ge-0/0/0.0
1.0.0.1/32 *[Direct/0] 00:55:05
> via lo0.0
1.0.0.2/32 *[OSPF/10] 00:54:19, metric 1
> to 12.12.12.2 via ge-0/0/1.0
1.0.0.3/32 *[OSPF/10] 00:54:57, metric 1
> to 31.31.31.1 via ge-0/0/2.0
10.0.10.0/24 *[Direct/0] 01:09:05
> via ge-0/0/0.0
10.0.10.61/32 *[Local/0] 01:09:05
Local via ge-0/0/0.0
12.12.12.0/30 *[Direct/0] 01:09:05
> via ge-0/0/1.0
12.12.12.1/32 *[Local/0] 01:09:05
Local via ge-0/0/1.0
23.23.23.0/30 *[OSPF/10] 00:54:19, metric 2
> to 12.12.12.2 via ge-0/0/1.0
to 31.31.31.1 via ge-0/0/2.0
31.31.31.0/30 *[Direct/0] 01:09:05
> via ge-0/0/2.0
31.31.31.2/32 *[Local/0] 01:09:05
Local via ge-0/0/2.0
224.0.0.5/32 *[OSPF/10] 00:55:07, metric 1
# show
system {
host-name R2;
root-authentication {
encrypted-password “$1$ucm0iauC$pA0/LpyHYtln36Hmw12Gj0”; ## SECRET-DATA
}
services {
ssh;
web-management {
http {
interface ge-0/0/0.0;
}
}
}
syslog {
file messages {
any any;
}
}
license {
autoupdate {
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
family inet;
}
}
ge-0/0/1 {
unit 0 {
family inet {
address 12.12.12.2/30;
}
}
}
ge-0/0/2 {
unit 0 {
family inet {
address 23.23.23.1/30;
}
}
}
lo0 {
unit 0 {
family inet {
address 1.0.0.2/32;
}
}
}
}
protocols {
ospf {
area 0.0.0.0 {
interface ge-0/0/1.0;
interface ge-0/0/2.0;
interface lo0.0;
}
}
}
security {
zones {
security-zone trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/1.0;
ge-0/0/2.0;
lo0.0;
}
}
}
# show
system {
host-name R3;
root-authentication {
encrypted-password “$1$jYOE9h1/$8E0Rfv77QNRFiAEItVkTZ.”; ## SECRET-DATA
}
services {
ssh;
web-management {
http {
interface ge-0/0/0.0;
}
}
}
syslog {
file messages {
any any;
}
}
license {
autoupdate {
}
}
}
interfaces {
ge-0/0/0 {
unit 0 {
family inet;
}
}
ge-0/0/1 {
unit 0 {
family inet {
address 23.23.23.2/30;
}
}
}
ge-0/0/2 {
unit 0 {
family inet {
address 31.31.31.1/30;
}
}
}
lo0 {
unit 0 {
family inet {
address 1.0.0.3/32;
}
}
}
}
protocols {
ospf {
area 0.0.0.0 {
interface ge-0/0/1.0;
interface ge-0/0/2.0;
interface lo0.0;
}
}
}
security {
screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
queue-size 2000; ## Warning: ‘queue-size’ is deprecated
timeout 20;
}
land;
}
}
}
policies {
from-zone trust to-zone trust {
policy default-permit {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone trust to-zone untrust {
policy default-permit {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone untrust to-zone trust {
policy default-deny {
match {
source-address any;
destination-address any;
application any;
}
then {
deny;
}
}
}
}
zones {
security-zone trust {
tcp-rst;
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/1.0;
ge-0/0/2.0;
lo0.0;
}
}
security-zone untrust {
screen untrust-screen;
}
}
}
Mikrotik-Mikrotik
R1] > export
/interface bridge
add name=loopback
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/routing ospf instance
set [ find default=yes ] distribute-default=always-as-type-1 \
redistribute-static=as-type-1 router-id=1.0.0.1
/ip address
add address=10.0.10.61/24 interface=ether1 network=10.0.10.0
add address=12.12.12.1/30 interface=ether2 network=12.12.12.0
add address=31.31.31.2/30 interface=ether3 network=31.31.31.0
add address=1.0.0.1 interface=loopback network=1.0.0.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip route
add distance=1 gateway=10.0.10.1
/routing ospf network
add area=backbone network=1.0.0.1/32
add area=backbone network=12.12.12.0/30
add area=backbone network=31.31.31.0/30
/system identity
[admin@R2] > export
/interface bridge
add name=loopback
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/routing ospf instance
set [ find default=yes ] router-id=1.0.0.2
/ip address
add address=12.12.12.2/30 interface=ether2 network=12.12.12.0
add address=1.0.0.2 interface=loopback network=1.0.0.2
add address=23.23.23.1/30 interface=ether3 network=23.23.23.0
/routing ospf network
add area=backbone network=1.0.0.2/32
add area=backbone network=12.12.12.0/30
add area=backbone network=23.23.23.0/30
/system identity
[admin@R3] > export
/interface bridge
add name=loopback
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/routing ospf instance
set [ find default=yes ] router-id=1.0.0.3
/ip address
add address=23.23.23.2/30 interface=ether2 network=23.23.23.0
add address=31.31.31.1/30 interface=ether3 network=31.31.31.0
/routing ospf network
add area=backbone network=1.0.0.3/32
add area=backbone network=31.31.31.0/30
add area=backbone network=23.23.23.0/30
/system identity
Cisco-FortiGate-Juniper-Mikrotik
Nbctcp's Weblog 