Local LAN Segmentation Anybus Defender Compact 1004 - NAT/FW

Configurations can be performed using the GUI (Anybus Defender Compact Manager software V1.2.8), including NAT, firewall rules, general settings, and logs. However, the available configuration options are limited depending on advanced usage. 

The Compact 1004 - NAT/FW has been further developed to support SSH for a Command Line Interface (CLI). Through this CLI, the  Defender Compact can be configured for additional use-cases.

 One such use-case is Local LAN Segmentation, where each LAN port will have its own subnet. Each LAN interface will be setup with its own unique IP address and the Defender Compact will function as a Router and Stateful Firewall. 

NOTE: In this mode Network Address Translation use-cases are NOT supported. The unit does not have enough capacity to handle NAT and multiple subnets. 

APPLICABLE PRODUCTS

• Anybus Defender Compact 1004 - ABD1004-NATFW

VERSIONS USED IN THIS ARTICLE

• Anybus Defender Compact Firmware 1.4.1

Setup

A visual clarification is shown below.

How to configure

Start with connecting to the Compact 1004 - NAT/FW through SSH CLI

If WAN or LAN interfaces are set to anything other than disabled, then connecting through SSH is possible. In this use-case, connecting from client to destination USB port using SSH is executed with the command

ssh admin@169.254.0.1
 " admin@169.254.0.1's password: <back_of_the_device> " 

When connected, hold "shift + ?" 

This will print a list of options provided by the CLI menu.

DeviceName#
  config general system settings
  exit exit and logout
  reboot halt and perform a cold restart  
  show shows system values
  update firmware update
  write saves all current changes into the flash

The device's interfaces can be configured through "config" option. After running "config"

The name display-name in the console of the device will change to "DeviceName(config)#" and display options with "Shift + ?"

To configure the interfaces, set an IP address and subnet to each LAN port by running 

DeviceName(config)# interface ethernet <cr>
 " DeviceName(config-if-interface0)# "

Where: 

"0" is WAN interface.

"1" is LAN 1 interface.

"2" is LAN 2 interface.

"3" is LAN 3 interface.

Assigning each interface in a numeric order does not determine their function except

hw-interface <cr>

That changing "<cr>" in hw-interface to be entered as above from 0-3 and adding ip addresses with 

ip address <0.0.0.0 255.255.255.255> 

will change default configurations of LAN ports and WAN port. To display what interfaces are configured, exit back to "DeviceName#" and enter the following

show interfaces

or

show running-config

A list of interfaces/configurations are printed. 

Find "interface" and next to it, a number that was assigned during set up (interface ethernet <cr>), usually recent configurations at the bottom or just above NAT (example "nat-net") and Firewall (example "filter-wanlan"). 

Firewall rules are not automatically added once configurations are set through this article. Image for reference beneath this articles headline explains general topology and Firewall rules. By default, the Compact - NAT/FW denies traffic passing from each direction (WAN > LAN and LAN > WAN). 

For example; assigning an IP address to a LAN port

DeviceName(config)# interface ethernet 1
DeviceName(config-if-interface1)# hw-interface 1
DeviceName(config-if-interface1)# ip address 192.168.10.1 255.255.255.0

LAN port 1 is now assigned to IP address 192.168.10.1

Navigate to "config" -> "filter-lanwan"

"DeviceName(config-filter-lanwan)#"

and in this case, rules are set from traffic passing LAN to destination ip address through WAN 

" rule 0 <source_port> <any> <any> <from_ip_address> <protocol> <action> Comment <active/disabled> none none "
rule 0 any 172.10.0.14 any any 192.168.0.55 502 tcp accept Comment active none none
rule 1 any 10.10.0.99 any any 192.168.0.55 502 tcp accept Comment active none none
rule 2 any 192.168.10.20 any any 192.168.0.55 502 tcp accept Comment active none none

Save changes with 

DeviceName(config-filter-wanlan)# commit

and exit back to configuration menu. Once in configuration menu, type to select nat-snat. 

DeviceName(config)# nat-snat

Enter the following commands to activate SNAT

DeviceName(config-snat)# wan active
DeviceName(config-snat)# lan active
DeviceName(config-snat)# commit

Exit back to start menu and type

DeviceName# write

to save changes to disc