Virtual Interface Override Configuration

1. Select Configuration > Devices from the web UI.
   The Device Configuration screen displays a list of managed devices or peer controllers, service platforms, or access points.
2. Select Profile Overrides > Interface.
3. Select Virtual Interfaces.
   

   Note

   A blue override icon (to the left of a parameter) defines the parameter as having an override applied. To remove overrides from a device, go to the Basic Configuration screen for the device and select Clear Overrides.
4. Review the following parameters unique to each virtual interface configuration to determine whether a parameter override is warranted:

   Name	The name of each listed virtual interface assigned when it was created. The name is between 1 - 4094, and cannot be modified as part of a virtual interface edit.
   Type	The type of virtual interface for each listed interface.
   Description	The description defined for the virtual interface, either when it was created or when it was edited.
   Admin Status	A green check mark means the listed virtual interface configuration is active and enabled with its supported profile. A red “X” means the virtual interface is currently shut down. The interface status can be modified when a new virtual interface is created or an existing one modified.
   VLAN	The numerical VLAN ID associated with each listed interface.
   IP Address	Whether DHCP was used to obtain the primary IP address used by the virtual interface configuration.

   After reviewing the configurations of existing virtual interfaces, determine whether a new interface needs to be created, an existing virtual interface needs to be edited (overridden), or an existing virtual interface needs to be deleted.

5. Select Add to define a new virtual interface configuration, Edit to modify or override the configuration of an existing virtual interface, or Delete to permanently remove a selected virtual interface.
   The Basic Configuration screen displays by default, regardless of a whether a new virtual interface is being created or an existing one is being modified. Select the General tab if it is not selected by default..
6. If you are creating a new virtual interface, use the VLAN ID spinner control to define a numeric VLAN ID from 1 - 4094.
7. Define or override the following parameters in the Properties field:

   Description	Provide or edit a description (up to 64 characters) for the virtual interface that helps differentiate it from others with similar configurations.
   Admin Status	Select Disabled or Enabled to define this interface‘s current status within the managed network. When set to Enabled, the virtual interface is operational and available to the controller or service platform. The default value is enabled.

8. Define or override the Network Address Translation (NAT) direction.
   Select one of the following options:

   Inside	The inside network is transmitting data over the network its intended destination. On the way out, the source IP address is changed in the header and replaced by the (public) IP address.
   Outside	Packets passing through the NAT on the way back to the managed LAN are searched against to the records kept by the NAT engine. There the destination IP address is changed back to the specific internal private class IP address in order to reach the LAN over the switch managed network.
   None	No NAT activity takes place. This is the default setting.

   

   Note

   Refer to Setting the Profile's NAT Configuration for instructions on creating a profile‘s NAT configuration.
9. Set the following DHCPv6 Client Configuration.
   The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) provides a framework for passing configuration information.

   Stateless DHCPv6 Client	Select this option to request information from the DHCPv6 server using stateless DHCPv6. DHCPv6 is a networking protocol for configuring IPv6 hosts with IP addresses, IP prefixes or other configuration attributes required on an IPv6 network. This setting is disabled by default.
   Prefix Delegation Client	Specify a 32-character maximum request prefix for prefix delegation from a DHCPv6 server over this virtual interface. Devices use prefixes to distinguish destinations that reside on-link from those reachable using a router.
   Request DHCPv6 Options	Select this option to request DHCPv6 options on this virtual interface. DHCPv6 options provide configuration information for a node that must be booted using the network rather than locally. This setting is disabled by default.

10. Define the Bonjour Gateway settings.

    Bonjour is Apple‘s implementation of zeroconfiguration networking (Zeroconf). Zeroconf is a group of technologies that include service discovery, address assignment and hostname resolution. Bonjour locates devices such as printers, other computers, and services that these computers offer over a local network.

    Bonjour provides a general method to discover services on a local area network (LAN). It allows users to set up a network without any configuration. Services such as printers, scanners and file-sharing servers can be found using Bonjour. Bonjour works within a single broadcast domain. However, with special DNS configuration, it can be extended to find services across broadcast domains.

    Select the Bonjour Gateway discover policy from the drop-down menu. Click the Create icon to define a new Bonjour Gateway policy configuration, or click the Edit icon to modify an existing Bonjour Gateway policy configuration.

11. Define the following MTU settings for the virtual interface:

    Maximum Transmission Unit (MTU)

    Set the PPPoE client maximum transmission unit (MTU) from 500 - 1,492. The MTU is the largest physical packet size in bytes a network can transmit. Any messages larger than the MTU are divided into smaller packets before being sent. A PPPoE client should be able to maintain its point-to-point connection for this defined MTU size. The default MTU is 1,492.

    IPv6 MTU

    Set an IPv6 MTU for this virtual interface from 1,280 - 1,500. A larger MTU provides greater efficiency because each packet carries more user data while protocol overheads, such as headers or underlying per-packet delays, remain fixed; the resulting higher efficiency means a slight improvement in bulk protocol throughput. A larger MTU results in the processing of fewer packets for the same amount of data. The default is 1,500.

12. In the ICMP field, define whether ICMPv6 redirect messages are sent. Redirect requests data packets be sent on an alternative route.
    This setting is enabled by default.
13. In the Address Autoconfiguration field, define whether to configure IPv6 addresses on this virtual interface based on the prefixes received in router advertisement messages. Router advertisements contain prefixes used for link determination, address configuration and maximum hop limits.
    This setting is enabled by default.
14. Set the following Router Advertisement Processing settings for the virtual interface.
    Router advertisements are periodically sent to hosts or sent in response to solicitation requests. The advertisement includes IPv6 prefixes and other subnet and host information.

    Accept RA	Enable this option to allow router advertisements over this virtual interface. IPv6 hosts can configure themselves automatically when connected to an IPv6 network using the neighbor discovery protocol via ICMPv6 router discovery messages. When first connected to a network, a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to such a request with a router advertisement packet that contains Internet layer configuration parameters.This setting is enabled by default.
    No Default Router	Select this option to consider routers unavailable on this interface for default router selection. This setting is disabled by default.
    No MTU	Select this option to not use the existing MTU setting for router advertisements on this virtual interface. If the value is set to zero, no MTU options are sent. This setting is disabled by default.
    No Hop Count	Select this option to not use the hop count advertisement setting for router advertisements on this virtual interface. This setting is disabled by default.

15. Click OK to save the changes.
    Click Reset to revert to the last saved configuration.
16. Select the IPv4 tab to set IPv4 settings for this virtual interface.
    IPv4 is a connectionless protocol. It operates on a best effort delivery model that does not guarantee delivery or assures proper sequencing or avoidance of duplicate delivery (unlike TCP).
17. Set the following network information in the IPv4 Addresses field:

    Enable Zero Configuration	Zero configuration can be a means of providing a primary or secondary IP addresses for the virtual interface. Zero configuration (or zero config) is a wireless connection utility included with Microsoft Windows XP and later as a service dynamically selecting a network to connect based on a user's preferences and various default settings. Zero config can be used instead of a wireless network utility from the manufacturer of a computer's wireless networking device. This value is set to None by default.
    Primary IP Address	Define the IP address for the VLAN associated virtual interface.
    Use DHCP to Obtain IP	Select this option to allow DHCP to provide the IP address for the virtual interface. Selecting this option disables the Primary IP Address field.
    Use DHCP to Obtain Gateway/DNS Servers	Select this option to allow DHCP to obtain a default gateway address and DNS resource for one virtual interface. This setting is disabled by default and only available when the Use DHCP to Obtain IP option is selected.
    Secondary Addresses	Use this parameter to define additional IP addresses to associate with VLAN IDs. The address provided in this field is used if the primary IP address is unreachable.

18. Refer to the DHCP Relay field to set the DHCP relay server configuration used with the virtual interface.

    Respond to DHCP Relay Packets

    Select this option to allow the onboard DHCP server to respond to relayed DHCP packets on this interface. This setting is disabled by default.

    DHCP Relay

    Provide IP addresses for DHCP server relay resources. DHCP relays exchange messages between a DHCPv6 server and client. A client and relay agent exist on the same link. When A DHCP request is received from the client, the relay agent creates a relay forward message and sends it to a specified server address. If no addresses are specified, the relay agent forwards the message to all DHCP server relay multicast addresses. The server creates a relay reply and sends it back to the relay agent. The relay agent then sends back the response to the client.

19. Click OK to save the changes to the IPv4 configuration.
    Click Reset to revert to the last saved configuration.
20. Select the IPv6 tab to set IPv6 settings for this virtual interface.
    IPv6 is the latest revision of the Internet Protocol (IP), designed to replace IPv4. IPV6 provides enhanced identification and location information for computers on networks routing traffic across the Internet. IPv6 addresses are composed of eight groups of four hexadecimal digits separated by colons. IPv6 hosts can configure themselves automatically when connected to an IPv6 network using the neighbor discovery protocol via ICMPv6 router discovery messages. When first connected to a network, a host sends a link-local router solicitation multicast request for its configuration parameters; routers respond to such a request with a router advertisement packet that contains Internet layer configuration parameters.
21. Refer to the IPv6 Addresses field to define how IP6 addresses are created and utilized:

    IPv6 Mode	Select this option to enable IPv6 support on this virtual interface. IPv6 is disabled by default.
    IPv6 Address Static	Define up to 15 global IPv6 IP addresses that can created statically. IPv6 addresses are represented as eight groups of four hexadecimal digits separated by colons.
    IPv6 Address Static using EUI64	Optionally, set up to 15 global IPv6 IP addresses (in the EUI-64 format) that can created statically. The IPv6 EUI-64 format address is obtained through a 48-bit MAC address. The MAC is initially separated into two 24- bits, with one being an OUI (Organizationally Unique Identifier) and the other being client specific. A 16-bit 0xFFFE is then inserted between the two 24-bits for the 64-bit EUI address. IEEE has chosen FFFE as a reserved value which can only appear in EUI-64 generated from the an EUI-48 MAC address.
    IPv6 Address Link Local	Provide the IPv6 local link address. IPv6 requires a link local address assigned to every interface the IPv6 protocol is enabled, even when one or more routable addresses are assigned.

22. Enable the Enforce Duplicate Address option to enforce duplicate address protection when any wired port is connected and in a forwarding state.
    This option is enabled by default.
23. Refer to the IPv6 Address Prefix from Provider table to create IPv6 format prefix shortcuts as supplied by an ISP.
    Select + Add Row to launch a screen in which a new delegated prefix name and host ID can be defined.

    Designated Prefix Name	Enter a 32-character maximum name for the IPv6 address prefix from your provider.
    Host ID	Define the subnet ID, host ID, and prefix length.

24. Click OK to save the changes to the IPv6 configuration.
    Click Exit to close the screen without saving any updates.
25. Refer to the IPv6 Address Prefix from Provider EUI64 table to set an (abbreviated) IP address prefix in EUI64 format.
    Select + Add Row to launch a screen in which a new delegated prefix name and host ID can be defined in EUI64 format.

    Designated Prefix Name	Enter a 32-character maximum name for the IPv6 prefix from your provider in EUI format. Using EUI64, a host can automatically assign itself a unique 64-bit IPv6 interface identifier without manual configuration or DHCP.
    Host ID	Define the subnet ID and prefix length.

26. Click OK to save the changes to the new IPv6 prefix from provider in EUI64 format.
    Click Exit to close the screen without saving any updates.
27. Refer to the DHCPv6 Relay table to set the address and interface of the DHCPv6 relay.

    The DHCPv6 relay enhances an extended DHCP relay agent by providing support in IPv6. DHCP relays exchange messages between a DHCPv6 server and client. A client and relay agent exist on the same link. When A DHCP request is received from the client, the relay agent creates a relay forward message and sends it to a specified server address. If no addresses are specified, the relay agent forwards the message to all DHCP server relay multicast addresses. The server creates a relay reply and sends it back to the relay agent. The relay agent then sends back the response to the client.

    Select + Add Row to launch a screen in which a new DHCPv6 relay address and interface VLAN ID can be set.

    Address

    Enter an address for the DHCPv6 relay. These DHCPv6 relay receive messages from DHCPv6 clients and forward them to DHCPv6 servers. The DHCPv6 server sends responses back to the relay, and the relay then sends these responses to the client on the local network.

    Interface

    Select this option to enable a spinner control to define a VLAN ID from 1 - 4,094 used as the virtual interface for the DHCPv6 relay. The interface designation is only required for link local and multicast addresses. A local link address is a locally derived address designed for addressing on a single link for automatic address configuration, neighbor discovery or when no routing resources are available.

28. Click OK to save the changes to the DHCPv6 relay configuration.
    Click Exit to close the screen without saving any updates.
29. Select the IPv6 RA Prefixes tab.
30. Use the Router Advertisement Policy drop-down menu to select and apply a policy to the virtual interface.
    Router advertisements are periodically sent to hosts or sent in response to solicitation requests. The advertisement includes IPv6 prefixes and other subnet and host information.
31. Review the configurations of existing IPv6 advertisement policies.

    If necessary, select + Add Row to define the configuration for an additional IPv6 RA prefix.

32. Define the following IPv6 RA Prefix settings:

    Prefix Type	Set the prefix delegation type used with this configuration. Options include Prefix, and prefix-from-provider. The default setting is Prefix. A prefix allows an administrator to associate a user defined name to an IPv6 prefix. A provider assigned prefix is made available from an Internet Service Provider (ISP) to automate the process of providing and informing the prefixes used.
    Prefix or ID	Set the actual prefix or ID used with the IPv6 router advertisement.
    Site Prefix	The site prefix is added into a router advertisement prefix. The site address prefix signifies the address is only on the local link.
    Valid Lifetime Type	Set the lifetime for the prefix's validity. Options include External (fixed), decrementing, and infinite. If set to External (fixed), only the Valid Lifetime Sec setting is enabled to define the exact time interval for prefix validity. If set to decrementing,, use the lifetime date and time settings to refine the prefix expiry period. If set to infinite, no additional date or time settings are required for the prefix and the prefix will not expire. The default setting is External (fixed).
    Valid Lifetime Sec	If the lifetime type is set to External (fixed), set the Seconds, Minutes, Hours, or Days values used to measure the prefix's expiration. 30 days, 0 hours, 0 minutes, and 0 seconds is the default lifetime.
    Valid Lifetime Date	If the lifetime type is set to External (fixed), set the date in MM/DD/YYYY format for the expiration of the prefix.
    Valid Lifetime Time	If the lifetime type is set to decrementing, set the time for the prefix's validity.
    Preferred Lifetime Type	Set the administrator preferred lifetime for the prefix's validity. Options include External (fixed), decrementing, and infinite. If set to External (fixed), only the Preferred Lifetime Sec setting is enabled to define the exact time interval for prefix validity. If set to decrementing,, use the lifetime date and time settings to refine the prefix expiry period. If set to infinite, no additional date or time settings are required for the prefix and the prefix will not expire. The default setting is External (fixed).
    Preferred Lifetime Sec	If the administrator preferred lifetime type is set to External (fixed), set the Seconds, Minutes, Hours, or Days values used to measure the prefix's expiration. 30 days, 0 hours, 0 minutes, and 0 seconds is the default lifetime.
    Preferred Lifetime Date	If the administrator preferred lifetime type is set to External (fixed), set the date in MM/DD/YYYY format for the expiration of the prefix.
    Preferred Lifetime Time	If the administrator preferred lifetime type is set to decrementing, set the time for the prefix's validity.
    Autoconfig	Autoconfiguration includes generating a link-local address, global addresses via stateless address autoconfiguration and duplicate address detection to verify the uniqueness of the addresses on a link. This setting is enabled by default.
    On Link	Select this option to keep the IPv6 RA prefix on the local link. The default setting is enabled.

33. Click OK to save the changes to the IPv6 RA prefix configuration.
    Click Exit to close the screen without saving any updates.
34. Click OK to save the changes and overrides.
    Click Reset to revert to the last saved configuration.
35. Select the Security tab.
36. Use the IPv4 Inbound Firewall Rules drop-down menu to select the IPv4 specific inbound firewall rules to apply to this profile‘s virtual interface configuration.
    Click the Create icon to define a new IPv4 firewall rule configuration, or click the Edit icon to modify an existing configuration.

    IPv4 is a connectionless protocol for packet switched networking. IPv4 operates as a best effort delivery method, since it does not guarantee delivery, and does not ensure proper sequencing or duplicate delivery (unlike (TCP).

    IPv4 and IPv6 are different enough to warrant separate protocols. IPv6 devices can alternatively use stateless address autoconfiguration. IPv4 hosts can use link local addressing to provide local connectivity.

37. Use the IPv6 Inbound Firewall Rules drop-down menu to select the IPv6 specific inbound firewall rules to apply to this profile‘s virtual interface configuration.
    Click the Create icon to define a new IPv6 firewall rule configuration, or click the Edit icon to modify an existing configuration.

    IPv6 is the latest revision of the Internet Protocol (IP) replacing IPv4. IPV6 provides enhanced identification and location information for systems routing traffic across the Internet. IPv6 addresses are composed of eight groups of four hexadecimal digits separated by colons. For more information on creating IPv6 firewall rules, see Configuring IP Firewall Rules.

38. Use the VPN Crypto Map drop-down menu to select or override the Crypto Map configuration applied to this virtual interface.
    Crypto Map entries are sets of configuration parameters for encrypting packets that pass through the VPN Tunnel. If there is no Crypto Map configuration that meets the needs of this virtual interface, click the Create icon to define a new Crypto Map configuration or click the Edit icon to modify an existing configuration. For more information, see Overriding a Profile's VPN Configuration.
39. Use the URL Filter drop-down menu to select or override the URL Filter configuration applied to this virtual interface.
    URL filtering is used to restrict access to undesirable resources on the internet.
40. Select the Dynamic Routing tab.
    

    Note

    The Dynamic Routing tab is not available for some controllers or service platfrorms.
41. Define or override the following parameters in the OSPF Settings field:

    Priority	Select this option to set the OSPF priority used to select the network designated route. Use the spinner control to set the value from 0 - 255.
    Cost	Select this option to set the cost of the OSPF interface. Use the spinner control to set the value from 1 - 65,535.
    Bandwidth	Set the OSPF bandwidth from 1 - 10,000,000 KBps.

42. From the Chosen Authentication Type drop-down list, select the authentication type used to validate credentials within the OSPF dynamic route.
    The available options are None, null, simple-password, and message-digest. The default value is None.
43. Select + Add Row at the bottom of the MD5 Authentication table to add the Key ID and Password used for an MD5 validation of authenticator credentials.
    Use the spinner control to set the OSPF message digest authentication key ID. The available range is from 1 - 255. The password is the OSPF key either displayed as series or asterisks or in plain text (by selecting Show).
44. Click OK to save the changes and overrides to the Security screen.
    Click Reset to revert to the last saved configuration.