Subnets Tab

• RFC 2460 - Internet Protocol, Version 6 (IPv6) Specification
• RFC 3513 - Internet Protocol Version 6 (IPv6) Addressing Architecture

Select to display MAC configuration fields. You can also choose to display these fields by using the Subnet Profiles preferences.

Use the Global Settings button to launch the IPSec Global Rekey Settings window, in which you can specify global settings to initiate IPSec re-key connections across all tunnels simultaneously.

Use the Policy Generator button (Client Subnet only) to launch the IPSec Policy Generator Wizard, which simplifies the task of creating a large number of subnets with varying IPSec policy settings.

• Previous Select the previous row.
• Next Select the next row.
• Apply Apply all. Applies tab settings to all of the rows selected in a range of rows.
• Add Subnet Add a row to the end of the table.
• Delete Subnet Remove the selected row.

Example

The ranges 192.168.1.1-192.168.1.10 and 192.168.1.11-192.168.1.20 do not overlap, but subnets 192.168.1.1-192.168.1.10/24 and 192.168.1.11-192.168.1.20/24 actually belong to the same subnet because of the netmask bits, and are therefore bound to the same interface.

If you generate a flat subnet, the second range is acceptable.

Select to enable the Default Gateway option. By default, the first address of the IP range associated with the subnet appears in the Gateway Address field after you select this option. (See the next field.) Selecting Default Gateway also enables the Enable Static Routing Checkbox in the Static Routing tab.

Select the MAC option to enable MAC masquerading. Enter HEX values in the Byte 1 and Byte 2 fields, to use a separate MAC address for each emulated client or server. The first two bytes are as configured. The remaining four bytes are equivalent to the IP address of the client or server.

Example

3FFE::0200:FF:FE00:1-3FFE::0200:FF:FE00:FF

An IPv6 prefix indicates the fixed part of the address. (As in IPv4 CIDR notation, this defines the network portion of the address.)

Select to specify an IPv6 address range using an IPv6 prefix address and prefix length. This enables the Prefix Address and Prefix Length fields.

Enter an IPv6 prefix address using colon hexadecimal notation.

Example

Prefix Address = 3FFE::0

Interface ID = 200:FF:FE00:101-200:FF:FE00:1FF

Prefix Length = 64 bits

The first address in the range would be 3FFE::200:FF:FE00:101.

VLAN

Inner VLAN ID

Select the VLAN option and enter a VLAN ID to include a VLAN tag with the specified ID in every packet transmitted from this subnet.

If you use VLAN stacking via the VLAN subtab, this field is the inner VLAN ID, and the field displays "(QinQ)" next to the value.

Select to enable SSL VPN for this subnet. You enter additional SSL VPN parameters in the SSL VPN tab.

A Virtual eXtensible Local Area Network (VXLAN) provides an encapsulation scheme, whereby a Layer 2 network overlays a Layer 3 network. This encapsulation means a VXLAN is also considered a tunneling scheme.

Select to enable VXLAN for this subnet. You enter additional VXLAN parameters in the VxLAN tab.

GPRS Tunneling Protocol (GTP) is a group of IP-based communications protocols used to carry general packet radio service (GPRS). It allows end users of a GSM (Global System for Mobile Communications) or UMTS (Universal Mobile Telecommunications System) network to move from place to place, while continuing to connect to the Internet, as if from one location at the GGSN (gateway GPRS support node).

The Avalanche GTP implementation allows you to test your Layer 4-7 devices that are running in GPRS core networks, such as firewalls, intrusion detection and prevention systems (IDS/IPS), deep packet inspectors (DPI), and load balancers. The Avalanche client emulates SGSN (serving GPRS support node) Gn interface functionality, and the Avalanche server emulates GGSN Gn interface functionality.

Select to enable GTP for this subnet. You enter additional GTP parameters in the GTP tab.

Dual Stack Lite (DS-Lite) supports IPv4 over IPv6 network stacks. That is, it creates IPv4 clients over an IPv6 link. Avalanche simulates two gateways to send and receive DS-Lite packets, using a tunneling method.

Select to enable Dual Stack Lite (DS-Lite) for this subnet. You enter additional DS-Lite parameters in the DS-Lite tab.

IPv6 rapid deployment (6rd) is a mechanism used by an Internet service provider (ISP) to rapidly deploy IPv6 unicast service to IPv4 sites to which it provides customer-premises equipment (CPE). It is derived from 6to4, a preexisting mechanism to transfer IPv6 packets over the IPv4 network.

The Avalanche IPv6OverIPv4 implementation creates a tunnel to encapsulate IPv6 packets. It supports both 6rd and 6to4 methods of calculating the IPv6 addresses. IPv6OverIPv4 supports most application layer protocols that Avalanche supports.

Select to enable IPv6OverIPv4 for this subnet. You enter additional IPv6OverIPv4 parameters in the IPv6OverIPv4 tab.

Select to enable IPSec for this subnet. You enter additional Avalanche VPN parameters in the IPSec tab.

Select to enable the Vendor ID options in the IPSec tab. The Vendor ID Payload contains a vendor-defined constant. Vendors use this constant to identify and recognize remote instances of their implementations. See the following RFCs for more information:

• RFC 2408 - Internet Security Association and Key Management Protocol (ISAKMP)
• RFC 4306 - Internet Key Exchange (IKEv2) Protocol

The IP version of the gateways. (Enabled only for the Site-to-Site tunnel.)

Select to display a drop-down menu with these options:

• IPV4
• IPV6

The version of IKE to use to establish SAs.

Select to display a drop-down menu with these options:

• 1 - Displays IPSecIKEv1 subtab.
• 2 - Displays IPSecIKEv2 subtab.

The type of ISAKMP (Internet Security Association and Key Management Protocol) identification payload that corresponds to the ISAKMP ID field.

Select to display a drop-down menu with these options:

• IPv4 Address-A single four (4) octet IPv4 address.
• FQDN-A fully-qualified domain name string, such as foo.bar.com.
• User FQDN-A fully-qualified username string, such as piper@foo.bar.com.
• IPv4 Address Subnet-A range of IPv4 addresses, represented by two four (4) octet values. The first value is an IPv4 address, and the second value is an IPv4 network mask. Ones (1s) in the network mask indicate that the corresponding bit in the address is fixed, while zeros (0s) indicate a wildcard bit.
• IPv6 Address-A single sixteen (16) octet IPv6 address.
• IPv6 Address Subnet-A range of IPv6 addresses, represented by two sixteen (16) octet values. The first value is an IPv6 address, and the second value is an IPv6 network mask. Ones (1s) in the network mask indicate that the corresponding bit in the address is fixed, while zeros (0s) indicate a wildcard bit.
• IPv4 Address Range-A range of IPv4 addresses, represented by two four (4) octet values. The first value is the beginning IPv4 address (inclusive), and the second value is the ending IPv4 address (inclusive). All addresses falling between the two specified addresses are considered to be within the list.
• IPv6 Address Range-A range of IPv6 addresses, represented by two sixteen (16) octet values. The first value is the beginning IPv6 address (inclusive), and the second value is the ending IPv6 address (inclusive). All addresses falling between the two specified addresses are considered to be within the list.
• DER ASN1 DN-The binary DER encoding of an ASN.1 X.500 Distinguished Name [X.501] of the principal whose certificates are being exchanged to establish the SA.

  NOTE: When using DER ASN1 DN as the ISAKMP ID Type, you can either configure the ISAKMP ID in the subnet or leave it blank. If configured, it should follow the DER ASN1 DN syntax, as in the following example: C=US, OU=Public Safety, CN=su1 Otherwise, if left blank, Avalanche will get the ISAKMP ID from digital certificates.

• DER ASN1 GN-The binary DER encoding of an ASN.1 X.500 General Name [X.509] of the principal whose certificates are being exchanged to establish the SA.
• KEY ID-An opaque byte stream for passing vendor-specific information necessary to identify which pre-shared key should be used to authenticate Aggressive mode negotiations.

The Diffie-Hellman group for Phase 1. The size of the group determines the level of security of the Diffie-Hellman key exchange. (The higher the group number, the greater the security.) The groups use traditional exponentiation over a prime modulus (MODP). These options are key exchanges only, and do not encrypt the data.

Select to display a drop-down menu with the following options for both IKEv1 and IKEv2:

• Group 1 (MODP-768): 768-bit Modular Exponential (MODP) Group
• Group 2 (MODP-1024): 1024-bit MODP Group
• Group 5 (MODP-1536): 1536-bit MODP Group
• Group 14 (MODP-2048): 2048-bit MODP Group
• Group 15 (MODP-3072): 3072-bit MODP Group
• Group 16 (MODP-4096): 4096-bit MODP Group
• Group 19 (ECP-256): 256-bit Random Elliptic Curve Group modulo a Prime (ECP Group)
• Group 20 (ECP-384): 384-bit Random ECP Group
• Group 21 (ECP-521): 521-bit Random ECP Group
• Group 24 (MODP-2048-256): 2048-bit MODP Group with 256-bit Prime Order Subgroup

The hash authentication method used for Phase 1 to verify that the packets being received were sent by the stated source.

Select to display a drop-down menu with the following options, depending on the IKE Version:

• IKEv1
• • MD-5: A message-digest algorithm that derives a secure, irreversible, cryptographically strong hash value. This is considered less secure than SHA-1.
  • SHA-1: The Secure Hash Algorithm version one, part of the U.S. Digital Signature Standard (DSS). This algorithm is considered very secure.
  • SHA-256: The Secure Hash Algorithm version two that uses a 256-bit digest, part of the U.S. Digital Signature Standard (DSS). This algorithm is considered very secure.
  • SHA-384: The Secure Hash Algorithm version two that uses a 384-bit digest, part of the U.S. Digital Signature Standard (DSS). This algorithm is considered very secure.
  • SHA-512: The Secure Hash Algorithm version two that uses a 512-bit digest, part of the U.S. Digital Signature Standard (DSS). This algorithm is considered very secure.
• IKEv2
• • MD-5: See description above.
  • SHA-1: See description above.
  • SHA-256: A Secure Hash Algorithm that uses AUTH_HMAC_SHA2_256_128 as the integrity algorithm, as well as PRF-HMAC-SHA-256 (Pseudo-Random Function).
  • SHA-384: A Secure Hash Algorithm that uses AUTH_HMAC_SHA2_384_192 as the integrity algorithm, as well as PRF-HMAC-SHA-384.
  • SHA-512: A Secure Hash Algorithm that uses AUTH_HMAC_SHA2_512_256 as the integrity algorithm, as well as PRF-HMAC-SHA-512.
  • AES-XCBC-MAC: An Advanced Encryption Standard (AES) Message Authentication Code (MAC) algorithm in Cipher-Block-Chaining mode with a set of extensions (XCBC) to overcome the security limitation presented by messages of varying lengths.

The encryption method used for Phase 1 to transform the payload data in the packets from an intelligible form (plaintext) into an unintelligible form (ciphertext), and back.

Select to display a drop-down menu with these options, depending on the IKE Version:

• IKEv1
• • DES-CBC: The Data Encryption Standard (DES), defined by the U.S. government, in Cipher-Block-Chaining (CBC) mode. DES is a symmetric 64-bit block cipher that uses a 56-bit key.
  • 3DES-CBC: A variant of DES, the most accepted method, in CBC mode. 3DES is a combined set of two DES keys totaling 112 bits. Due to its larger size, 3DES is considered much more secure that DES.
  • AES-CBC-128: AES (Advanced Encryption Standard) in CBC mode, with a 128-bit key.
  • AES-CBC-192: AES in CBC mode, with a 192-bit key.
  • AES-CBC-256: AES in CBC mode, with a 256-bit key.
• IKEv2
• • DES-CBC: See description above.
  • 3DES-CBC: See description above.
  • AES-CBC-128: See description above.
  • AES-CBC-192: See description above.
  • AES-CBC-256: See description above.
  • AES-128-GCM-8: AES in Galois/Counter Mode (GCM), with a 128-bit key, and 8-octet Integrity Check Value (ICV) size.
  • AES-256-GCM-8: AES in GCM, with a 256-bit key, and 8-octet ICV size.
  • AES-128-GCM-12: AES in GCM, with a 128-bit key, and 12-octet ICV size.
  • AES-256-GCM-12: AES in GCM, with a 256-bit key, and 12-octet ICV size.
  • AES-128-GCM-16: AES in GCM, with a 128-bit key, and 16-octet ICV size.
  • AES-256-GCM-16: AES in GCM, with a 256-bit key, and 16-octet ICV size.

The authentication method for Phase 1. (Enabled for both the Site-to-Site and Remote Access scenarios.)

Select to display a drop-down menu with these options:

• Preshared Key
• Digital Certificates

The type of XAuth (Extended Authentication) for Phase 1. (Enabled only for the Remote Access scenario.)

Select to display a drop-down menu with these options:

• Generic: Supported by most IPSec gateways.
• RemoteVPN: Commonly used to test Cisco IPSec gateways.
• Nortel Contivity: Used to test Nortel Contivity gateways.
• Checkpoint Hybrid: Used to test Checkpoint VPN-1 gateways.
• No XAuth: Used for Remote Access scenarios in which tunnel establishment does not require XAuth.
• No XAuth with ModeConfig: Used for Remote Access scenarios in which tunnel establishment does not require XAuth, but requires a configuration transaction.

  NOTES:   Currently, this option only supports pushing an IPv4 address configuration, client side only. For more information about the ISAKMP Configuration Method, refer to http://tools.ietf.org/html/draft-ietf-ipsec-isakmp-mode-cfg-05.

(Client Subnet only) Select to use a forms database instead of the following fields. (These fields are disabled when you select this checkbox.)

First, create a forms database file, and then select the forms database name that you created in the File field in the IPSec tab. (Enabled only for the Remote Access scenario.)

Example1

You configure a test to use Remote Access with three IPs/hosts in the subnet range. You select Generic XAuth, and you want to use different Preshared Key values, different usernames and passwords, different ISAKMP ID values, but the same ISAKMP ID Type for each IP in the subnet. Enter the values in the forms database as follows:

Example2

You configure a test to use Remote Access (with any type of XAuth) and four IPs/hosts in the subnet range. You want to use unique digital certificates, keys, and CA certificates for each IP in the subnet.

Manually copy all the digital certificate and key files under the C:\Documents and Settings\...\Application Data\Avalanche\ProjectName\certs\ directory. Manually copy all the CA certificate files under the C:\Documents and Settings\...\Application Data\Avalanche\ProjectName\cacerts\ directory. Then enter the corresponding values in the forms database as follows:

,,,,,,,certfile1,keyfile1,cacert1

,,,,,,,certfile2,keyfile2,cacert2

,,,,,,,certfile3,keyfile3,cacert3

,,,,,,,certfile4,keyfile4,cacert4

The IP version of the remote network. (Enabled only for the Remote Access scenario.)

Select to display a drop-down menu with these options:

• IPV4
• IPV6

• IKEv1: Used when the authentication mode is XAuth.
• IKEv2: Used when Request Internal Address of Remote Network is selected.

(Server Subnet only) Enter an IPv6 prefix address using colon hexadecimal notation for the network specified by Internal IPv6 Addresses.

Example

Prefix Address = 3FFE::0

Interface ID = 200:FF:FE00:101-200:FF:FE00:1FF

Prefix Length = 64 bits

The first address in the range would be 3FFE::200:FF:FE00:101.

• IKEv1: Used when the authentication mode is XAuth.
• IKEv2: Used when Request Internal Address of Remote Network is selected.

Click the Add Route and Delete Route buttons to add and remove rows from the table that appear below the Static Routing tab; use the table to define static routing entries for IPv4 or IPv6 addresses as described below.

The IPv6 prefix address of the network for which this routing table entry applies. Use colon hexadecimal notation.

Example

3FFE::FF:FE:00:00

Add Route: Adds a row to the Static Routing table.

Delete Route: Deletes a selected row from the Static Routing table.

Select the bit rate (bits per second) that a simulated user will use to connect to a network, or link speed.

Select Max Speed (default), a predefined value, or User Defined from the drop-down menu. For the latter, enter the number of bits per second in the text field.

For the client, you configure Line Speed on a per-host basis. For the server, you configure Line Speed across all servers in the subnet.

Example

If you have three hosts on the client subnet, and set the Line Speed to 10 kbps, you will see that traffic is generated at 30 kbps in the client statistics. So, if you want traffic generated from the client at only 10 kbps, you should have one host on the client subnet with 10 kbps Line Speed.

(Sender side only) The Type of Service (ToS) value is an 8-bit hex value that is inserted in the IP header of all outgoing segments from the subnet. ToS is useful for device, application, and application infrastructure testing.

Example Use Cases

You can use ToS with Device testing to measure a device's ability to honor QoS settings:

• Verify device operation with QoS enabled. Does device latency increase under load? Does adding queues affect overall device performance?
• Ensure that the device services priority applications under load. Does the device drop prioritized frames?

• Determine the maximum usable number of QoS queues. How does end-to-end queue processing affect application latency?
• Ensure that the infrastructure services priority applications under load. Does the device drop prioritized frames? Which applications are most affected by loss and jitter?

Use the TOS calculator (click the icon next to the field) to obtain a ToS value.

Use PPP (client only)

Enable PPP (server only)

You configure PPP groups in the PPP Group window. Then, you can apply a PPP group to a subnet.

Select Use PPP and PPPoE, and then choose the PPP Group Name that you want to apply to the subnet.

Select the PPP Group Name that you want to use, or use the buttons in the pane to create, copy, edit, or delete a configuration.

Create a new configuration.

Copy the configuration selected in the drop-down menu.

Edit the configuration selected in the drop-down menu.

Delete the configuration selected in the associated drop-down menu. Note that if you delete a configuration associated with an advanced test, it becomes unavailable to other tests within the project.

Select Enable PPP. You can select Negotiation IP Range (IPv4 only) to enable IP negotiation from the PPP server through IPCP. The PPP client will be assigned an IPv4 address from the pool that you specify here (range or single address). You can also specify a Primary DNS Server IP and Secondary DNS Server IP (IPv4 only).

Additional settings and limitations

• The server does not store any state related to a PPP/PPPoE session, and expects the client to be intelligent about retransmissions, and so on.
• Enable MAC masquerading (individual MAC address) in the Client Subnet profile, with the first and second bytes set to zero.
• Disable MAC masquerading (individual MAC address) in the server Subnet profile.
• Ensure that the Magic Number under the client's PPP Group is deselected, so that there is no automatic generation of the magic number.

Use PPPoE (client only)

Enable PPPoE (server only)

You configure PPPoE groups in the PPPoE Group window. Then, you can apply a PPPoE group to a subnet.

Select Use PPP and PPPoE, and then choose the PPPoE Group Name that you want to apply to the subnet.

Select the PPPoE Group Name that you want to use, or use the buttons in the pane to create, copy, edit, or delete a configuration.

Create a new configuration.

Copy the configuration selected in the drop-down menu.

Edit the configuration selected in the drop-down menu.

Delete the configuration selected in the associated drop-down menu. Note that if you delete a configuration associated with an advanced test, it becomes unavailable to other tests within the project.

Select Enable PPPoE, and then enter an AC Name (access concentrator name) and Service Name based on the characteristics that apply to the PPPoE connection.

The value of option 60 (Vendor Class Identifier). This option identifies the vendor's equipment, for example, a set-top box manufacturer and software version. Enter a string, such as "Spirent."

Local Gateway Address

• client - 2001:DB8:1::1
• server - 2001:DB8:1::2

Remote Gateway Address

• client - 2001:DB8:1::2
• server - 2001:DB8:1::1

User Name

Password

Group Name

(Cisco only)

Unique ID

(Palo Alto only)

Use FormsDB

Select to specify a forms database for the User Name, Password, and Group Name/Unique ID fields, and then select the forms database name from the drop-down menu.

An example forms database for the Cisco vendor is as follows:

An example forms database for the Palo Alto vendor is as follows:

TCP Port

Enable FQDN

SSL VPN HTTPS IP Address/Hostname

(Enabled when Enable FQDN is selected.)

Select to perform a DNS query for each SimUser.

Deselect to perform one DNS query for the subnet (default).

See the TLS field descriptions in the Client Profiles TLS/SSL Configuration Fields.

(Cisco only)

Select to enable the Datagram Transport Layer Security (DTLS) tunnel setup. The DTLS tunnel is set up after the TLS tunnel has been established. All data message traffic over the SSL VPN tunnel is transmitted inside the DTLS tunnel, once established. All control message traffic is transmitted inside the TLS tunnel.

If deselected, a TLS tunnel is set up. All data and control message traffic is transmitted inside the TLS tunnel.

(Cisco only)

Select one of the following versions to use when DTLS is enabled:

• DTLS 1.0
• DTLS 1.2

Select to enable Encapsulating Security Payload (ESP) for IPSec. The ESP protocol provides authentication, as well as confidentiality through the use of encryption algorithms.

Applies to the GlobalProtect VPN. Select to disable sending ICMP ping commands from the client for an ESP tunnel setup.

The SSL VPN vendor. Select one of the following:

• Cisco
• Palo Alto

A string indicating information to be reflected in the CONNECT request packet in the tunnel connection phase. Select one of the following for Cisco vendor:

• AnyConnect Avalanche Client
• Avalanche Open Connect

The maximum transmission unit (MTU) inside the tunnel.

Available: Lists ciphers from which you can select.

Selected: Lists ciphers that you selected from the Available list and want to use with the profile. Select one or more entries in the Available list, and then click the arrow button to move them into the Selected list.

If you no longer want to use a cipher, select it in the Selected list, and then click the arrow button to move it back to the Available list.

To change the order of ciphers in the Selected list, select the cipher and then click the up or down buttons.

Signature Hash Algorithms

(Palo Alto only)

The hash algorithms that the client supports for digital signatures.

Address Version

SSL VPN HTTPS IP Address

Select the SSL VPN profile that you want to use from the drop-down menu, or use the buttons as follows:

Create a new profile. Configure the SSL VPN profile fields that appear.

Copy the currently selected profile, specifying a new name when prompted.

Edit the currently selected profile. Configure the SSL VPN profile fields that appear.

Select to enable the Datagram Transport Layer Security (DTLS) tunnel setup. The DTLS tunnel is set up after the TLS tunnel has been established. All data message traffic over the SSL VPN tunnel is transmitted inside the DTLS tunnel, once established. All control message traffic is transmitted inside the TLS tunnel.

If deselected, a TLS tunnel is set up. All data and control message traffic is transmitted inside the TLS tunnel.

The SSL VPN vendor.

The maximum transmission unit (MTU) inside the tunnel.

See the field descriptions in the Server TLS/SSL Configuration.

The VXLAN Network Identifier (VNI) or VXLAN Segment ID. Each VXLAN segment is identified through this 24-bit segment ID.

The default value is 100. The valid range is 0 to 16777215.

Select to configure the destination MAC address. This will override the outer ethernet destination MAC address. If deselected, the outer ethernet destination MAC address will use the MAC address of the Remote VTEP IP.

Default value: FF:FF:FF:FF:FF:FF

Example (where Start Address is blank and IPSec is disabled)

The VLAN ID of host A (vidA) is derived from the following formula:

vidA = startVid + (ipA – networkA) * vidInc

Where:

• startVid: The VLAN TAG value.
• ipA: The IP address (range) of host A.
• networkA: The first IP address of the configured Network for the subnet.
• vidInc: The VLAN TAG INCREMENT value.

For example:

• startVid = 1
• ipA = 192.168.43.2 – 192.168.43.5
• networkA = 192.168.43.1 (first IP address of 192.168.43.0/24)
• vidInc = 2

Result:

The tag protocol identifier (TPID) for the VLAN. The default value is 0x8100, which indicates that the frame carries 802.1Q/802.1p tag information.

Select to display a drop-down menu with these options:

• 0x8100
• 0x88a8
• 0x88e7
• 0x9100
• 0x9200

Delete: Deletes a selected row from the VLAN table.

Down: Moves the selected row down to the next entry.

Up: Moves the selected row up to the previous entry.

Copy: Copies the selected row and appends it to the end of the VLAN table.

New: Adds a row to the end of the VLAN table.