Datasheet

13-28
Cisco ONS 15454 SDH Reference Manual, R7.0
October 2008
Chapter 13 Management Network Connectivity
13.6 Open GNE
To configure an open GNE network, you can provision RS-DCC, MS-DCC, and GCC terminations to
include a far-end, non-ONS node using either the default IP address of 0.0.0.0 or a specified IP address.
You provision a far-end, non-ONS node by checking the “Far End is Foreign” check box during
RS-DCC, MS-DCC, and GCC creation. The default 0.0.0.0 IP address allows the far-end, non-ONS node
to provide the IP address; if you set an IP address other than 0.0.0.0, a link is established only if the
far-end node identifies itself with that IP address, providing an extra level of security.
By default, the proxy server only allows connections to discovered ONS peers and the firewall blocks
all IP traffic between the DCC network and LAN. You can, however, provision proxy tunnels to allow
up to 12 additional destinations for SOCKS version 5 connections to non-ONS nodes. You can also
provision firewall tunnels to allow up to 12 additional destinations for direct IP connectivity between the
DCC network and LAN. Proxy and firewall tunnels include both a source and destination subnet. The
connection must originate within the source subnet and terminate within the destination subnet before
either the SOCKS connection or IP packet flow is allowed.
To set up proxy and firewall subnets in CTC, use the Provisioning > Network > Proxy and Firewalls
subtabs. The availability of proxy and/or firewall tunnels depends on the network access settings of the
node:
• If the node is configured with the proxy server enabled in GNE or ENE mode, you must set up a
proxy tunnel and/or a firewall tunnel.
• If the node is configured with the proxy server enabled in proxy-only mode, you can set up proxy
tunnels. Firewall tunnels are not allowed.
• If the node is configured with the proxy server disabled, neither proxy tunnels or firewall tunnels
are allowed.
Figure 13-18 shows an example of a foreign node connected to the DCC network. Proxy and firewall
tunnels are useful in this example because the GNE would otherwise block IP access between the PC
and the foreign node.