2025-12-21 22:32:09 -08:00
|
|
|
|
# ER605 Router Configuration Guide
|
|
|
|
|
|
|
|
|
|
|
|
**Last Updated:** 2025-01-20
|
|
|
|
|
|
**Document Version:** 1.0
|
|
|
|
|
|
**Hardware:** 2× TP-Link ER605 (v1 or v2)
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## Overview
|
|
|
|
|
|
|
|
|
|
|
|
This guide provides step-by-step configuration for the ER605 routers in the enterprise orchestration setup, including:
|
|
|
|
|
|
|
|
|
|
|
|
- Dual router roles (ER605-A primary, ER605-B standby)
|
|
|
|
|
|
- WAN configuration with 6× /28 public IP blocks
|
|
|
|
|
|
- VLAN routing and inter-VLAN communication
|
|
|
|
|
|
- Role-based egress NAT pools
|
|
|
|
|
|
- Break-glass inbound NAT rules
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## Hardware Setup
|
|
|
|
|
|
|
|
|
|
|
|
### ER605-A (Primary Edge Router)
|
|
|
|
|
|
|
|
|
|
|
|
**Physical Connections:**
|
|
|
|
|
|
- WAN1: Spectrum ISP (Block #1: 76.53.10.32/28)
|
|
|
|
|
|
- WAN2: ISP #2 (failover/alternate)
|
|
|
|
|
|
- LAN: Trunk to ES216G-1 (core switch)
|
|
|
|
|
|
|
|
|
|
|
|
**WAN1 Configuration:**
|
|
|
|
|
|
- IP Address: `76.53.10.34/28`
|
|
|
|
|
|
- Gateway: `76.53.10.33`
|
|
|
|
|
|
- DNS: ISP-provided or 8.8.8.8, 1.1.1.1
|
|
|
|
|
|
|
|
|
|
|
|
### ER605-B (Standby Edge Router)
|
|
|
|
|
|
|
|
|
|
|
|
**Physical Connections:**
|
|
|
|
|
|
- WAN1: ISP #2 (alternate/standby)
|
|
|
|
|
|
- WAN2: (optional, if available)
|
|
|
|
|
|
- LAN: Trunk to ES216G-1 (core switch)
|
|
|
|
|
|
|
|
|
|
|
|
**Role Decision Required:**
|
|
|
|
|
|
- **Option A:** Standby edge (failover only)
|
|
|
|
|
|
- **Option B:** Dedicated sovereign edge (separate policy domain)
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## WAN Configuration
|
|
|
|
|
|
|
|
|
|
|
|
### ER605-A WAN1 (Primary - Block #1)
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Interface: WAN1
|
|
|
|
|
|
Connection Type: Static IP
|
|
|
|
|
|
IP Address: 76.53.10.34
|
|
|
|
|
|
Subnet Mask: 255.255.255.240 (/28)
|
|
|
|
|
|
Gateway: 76.53.10.33
|
|
|
|
|
|
Primary DNS: 8.8.8.8
|
|
|
|
|
|
Secondary DNS: 1.1.1.1
|
|
|
|
|
|
MTU: 1500
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
### ER605-A WAN2 (Failover - ISP #2)
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Interface: WAN2
|
|
|
|
|
|
Connection Type: [DHCP/Static as per ISP]
|
|
|
|
|
|
Failover Mode: Enabled
|
|
|
|
|
|
Priority: Lower than WAN1
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
### ER605-B Configuration
|
|
|
|
|
|
|
|
|
|
|
|
**If Standby:**
|
|
|
|
|
|
- Configure same as ER605-A but with lower priority
|
|
|
|
|
|
- Enable failover monitoring
|
|
|
|
|
|
|
|
|
|
|
|
**If Dedicated Sovereign Edge:**
|
|
|
|
|
|
- Configure separate policy domain
|
|
|
|
|
|
- Independent NAT pools for sovereign tenants
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## VLAN Configuration
|
|
|
|
|
|
|
|
|
|
|
|
### Create VLAN Interfaces
|
|
|
|
|
|
|
|
|
|
|
|
For each VLAN, create a VLAN interface on ER605:
|
|
|
|
|
|
|
|
|
|
|
|
| VLAN ID | VLAN Name | Interface IP | Subnet | Gateway |
|
|
|
|
|
|
|--------:|-----------|--------------|--------|---------|
|
|
|
|
|
|
| 11 | MGMT-LAN | 192.168.11.1 | 192.168.11.0/24 | 192.168.11.1 |
|
|
|
|
|
|
| 110 | BESU-VAL | 10.110.0.1 | 10.110.0.0/24 | 10.110.0.1 |
|
|
|
|
|
|
| 111 | BESU-SEN | 10.111.0.1 | 10.111.0.0/24 | 10.111.0.1 |
|
|
|
|
|
|
| 112 | BESU-RPC | 10.112.0.1 | 10.112.0.0/24 | 10.112.0.1 |
|
|
|
|
|
|
| 120 | BLOCKSCOUT | 10.120.0.1 | 10.120.0.0/24 | 10.120.0.1 |
|
|
|
|
|
|
| 121 | CACTI | 10.121.0.1 | 10.121.0.0/24 | 10.121.0.1 |
|
|
|
|
|
|
| 130 | CCIP-OPS | 10.130.0.1 | 10.130.0.0/24 | 10.130.0.1 |
|
|
|
|
|
|
| 132 | CCIP-COMMIT | 10.132.0.1 | 10.132.0.0/24 | 10.132.0.1 |
|
|
|
|
|
|
| 133 | CCIP-EXEC | 10.133.0.1 | 10.133.0.0/24 | 10.133.0.1 |
|
|
|
|
|
|
| 134 | CCIP-RMN | 10.134.0.1 | 10.134.0.0/24 | 10.134.0.1 |
|
|
|
|
|
|
| 140 | FABRIC | 10.140.0.1 | 10.140.0.0/24 | 10.140.0.1 |
|
|
|
|
|
|
| 141 | FIREFLY | 10.141.0.1 | 10.141.0.0/24 | 10.141.0.1 |
|
|
|
|
|
|
| 150 | INDY | 10.150.0.1 | 10.150.0.0/24 | 10.150.0.1 |
|
|
|
|
|
|
| 160 | SANKOFA-SVC | 10.160.0.1 | 10.160.0.0/22 | 10.160.0.1 |
|
|
|
|
|
|
| 200 | PHX-SOV-SMOM | 10.200.0.1 | 10.200.0.0/20 | 10.200.0.1 |
|
|
|
|
|
|
| 201 | PHX-SOV-ICCC | 10.201.0.1 | 10.201.0.0/20 | 10.201.0.1 |
|
|
|
|
|
|
| 202 | PHX-SOV-DBIS | 10.202.0.1 | 10.202.0.0/20 | 10.202.0.1 |
|
|
|
|
|
|
| 203 | PHX-SOV-AR | 10.203.0.1 | 10.203.0.0/20 | 10.203.0.1 |
|
|
|
|
|
|
|
|
|
|
|
|
### Configuration Steps
|
|
|
|
|
|
|
2026-01-06 01:46:25 -08:00
|
|
|
|
<details>
|
|
|
|
|
|
<summary>Click to expand detailed VLAN configuration steps</summary>
|
|
|
|
|
|
|
2025-12-21 22:32:09 -08:00
|
|
|
|
1. **Access ER605 Web Interface:**
|
|
|
|
|
|
- Default: `http://192.168.0.1` or `http://tplinkrouter.net`
|
|
|
|
|
|
- Login with admin credentials
|
|
|
|
|
|
|
|
|
|
|
|
2. **Enable VLAN Support:**
|
|
|
|
|
|
- Navigate to: **Advanced** → **VLAN** → **VLAN Settings**
|
|
|
|
|
|
- Enable VLAN support
|
|
|
|
|
|
|
|
|
|
|
|
3. **Create VLAN Interfaces:**
|
|
|
|
|
|
- For each VLAN, create a VLAN interface:
|
|
|
|
|
|
- **VLAN ID**: [VLAN ID]
|
|
|
|
|
|
- **Interface IP**: [Gateway IP]
|
|
|
|
|
|
- **Subnet Mask**: [Corresponding subnet mask]
|
|
|
|
|
|
|
|
|
|
|
|
4. **Configure DHCP (Optional):**
|
|
|
|
|
|
- For each VLAN, configure DHCP server if needed
|
|
|
|
|
|
- DHCP range: Exclude gateway (.1) and reserved IPs
|
|
|
|
|
|
|
2026-01-06 01:46:25 -08:00
|
|
|
|
</details>
|
|
|
|
|
|
|
2025-12-21 22:32:09 -08:00
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## Routing Configuration
|
|
|
|
|
|
|
|
|
|
|
|
### Static Routes
|
|
|
|
|
|
|
|
|
|
|
|
**Default Route:**
|
|
|
|
|
|
- Destination: 0.0.0.0/0
|
|
|
|
|
|
- Gateway: 76.53.10.33 (WAN1 gateway)
|
|
|
|
|
|
- Interface: WAN1
|
|
|
|
|
|
|
|
|
|
|
|
**Inter-VLAN Routing:**
|
|
|
|
|
|
- ER605 automatically routes between VLANs
|
|
|
|
|
|
- Ensure VLAN interfaces are configured
|
|
|
|
|
|
|
|
|
|
|
|
### Route Priority
|
|
|
|
|
|
|
|
|
|
|
|
- WAN1: Primary (higher priority)
|
|
|
|
|
|
- WAN2: Failover (lower priority)
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## NAT Configuration
|
|
|
|
|
|
|
|
|
|
|
|
### Outbound NAT (Role-based Egress Pools)
|
|
|
|
|
|
|
|
|
|
|
|
**Critical:** Configure outbound NAT pools using the /28 blocks for role-based egress.
|
|
|
|
|
|
|
|
|
|
|
|
#### CCIP Commit (VLAN 132) → Block #2
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Source Network: 10.132.0.0/24
|
|
|
|
|
|
NAT Type: PAT (Port Address Translation)
|
|
|
|
|
|
NAT Pool: <PUBLIC_BLOCK_2>/28
|
|
|
|
|
|
Interface: WAN1
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
#### CCIP Execute (VLAN 133) → Block #3
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Source Network: 10.133.0.0/24
|
|
|
|
|
|
NAT Type: PAT
|
|
|
|
|
|
NAT Pool: <PUBLIC_BLOCK_3>/28
|
|
|
|
|
|
Interface: WAN1
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
#### RMN (VLAN 134) → Block #4
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Source Network: 10.134.0.0/24
|
|
|
|
|
|
NAT Type: PAT
|
|
|
|
|
|
NAT Pool: <PUBLIC_BLOCK_4>/28
|
|
|
|
|
|
Interface: WAN1
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
#### Sankofa/Phoenix/PanTel (VLAN 160) → Block #5
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Source Network: 10.160.0.0/22
|
|
|
|
|
|
NAT Type: PAT
|
|
|
|
|
|
NAT Pool: <PUBLIC_BLOCK_5>/28
|
|
|
|
|
|
Interface: WAN1
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
#### Sovereign Tenants (VLAN 200-203) → Block #6
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Source Network: 10.200.0.0/20, 10.201.0.0/20, 10.202.0.0/20, 10.203.0.0/20
|
|
|
|
|
|
NAT Type: PAT
|
|
|
|
|
|
NAT Pool: <PUBLIC_BLOCK_6>/28
|
|
|
|
|
|
Interface: WAN1
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
#### Management (VLAN 11) → Block #1 (Restricted)
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Source Network: 192.168.11.0/24
|
|
|
|
|
|
NAT Type: PAT
|
|
|
|
|
|
NAT Pool: 76.53.10.32/28 (restricted, tightly controlled)
|
|
|
|
|
|
Interface: WAN1
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
### Inbound NAT (Break-glass Only)
|
|
|
|
|
|
|
|
|
|
|
|
**Default: None**
|
|
|
|
|
|
|
|
|
|
|
|
**Optional Break-glass Rules:**
|
|
|
|
|
|
|
|
|
|
|
|
#### Emergency SSH/Jumpbox
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Rule Name: Break-glass SSH
|
|
|
|
|
|
External IP: 76.53.10.35 (or other VIP from Block #1)
|
|
|
|
|
|
External Port: 22
|
|
|
|
|
|
Internal IP: [Jumpbox IP on VLAN 11]
|
|
|
|
|
|
Internal Port: 22
|
|
|
|
|
|
Protocol: TCP
|
|
|
|
|
|
Access Control: IP allowlist (restrict to admin IPs)
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
#### Emergency RPC (if needed)
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Rule Name: Emergency Besu RPC
|
|
|
|
|
|
External IP: 76.53.10.36
|
|
|
|
|
|
External Port: 8545
|
|
|
|
|
|
Internal IP: [RPC node IP on VLAN 112]
|
|
|
|
|
|
Internal Port: 8545
|
|
|
|
|
|
Protocol: TCP
|
|
|
|
|
|
Access Control: IP allowlist (restrict to known clients)
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
**Note:** All break-glass rules should have strict IP allowlists and be disabled by default.
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## Firewall Rules
|
|
|
|
|
|
|
|
|
|
|
|
### Default Policy
|
|
|
|
|
|
|
|
|
|
|
|
- **WAN → LAN**: Deny (default)
|
|
|
|
|
|
- **LAN → WAN**: Allow (with NAT)
|
|
|
|
|
|
- **Inter-VLAN**: Allow (for routing)
|
|
|
|
|
|
|
|
|
|
|
|
### Security Rules
|
|
|
|
|
|
|
|
|
|
|
|
#### Block Public Access to Proxmox
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Rule: Block Proxmox Web UI from WAN
|
|
|
|
|
|
Source: Any (WAN)
|
|
|
|
|
|
Destination: 192.168.11.0/24
|
|
|
|
|
|
Port: 8006
|
|
|
|
|
|
Action: Deny
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
#### Allow Cloudflare Tunnel Traffic
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Rule: Allow Cloudflare Tunnel
|
|
|
|
|
|
Source: Cloudflare IP ranges
|
|
|
|
|
|
Destination: [Cloudflare tunnel endpoints]
|
|
|
|
|
|
Port: [Tunnel ports]
|
|
|
|
|
|
Action: Allow
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
#### Inter-VLAN Isolation (Sovereign Tenants)
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Rule: Deny East-West for Sovereign Tenants
|
|
|
|
|
|
Source: 10.200.0.0/20, 10.201.0.0/20, 10.202.0.0/20, 10.203.0.0/20
|
|
|
|
|
|
Destination: 10.200.0.0/20, 10.201.0.0/20, 10.202.0.0/20, 10.203.0.0/20
|
|
|
|
|
|
Action: Deny (except for specific allowed paths)
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## DHCP Configuration
|
|
|
|
|
|
|
|
|
|
|
|
### VLAN 11 (MGMT-LAN)
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
VLAN: 11
|
|
|
|
|
|
DHCP Range: 192.168.11.100-192.168.11.200
|
|
|
|
|
|
Gateway: 192.168.11.1
|
|
|
|
|
|
DNS: 8.8.8.8, 1.1.1.1
|
|
|
|
|
|
Lease Time: 24 hours
|
|
|
|
|
|
Reserved IPs:
|
|
|
|
|
|
- 192.168.11.1: Gateway
|
|
|
|
|
|
- 192.168.11.10: ML110 (Proxmox)
|
|
|
|
|
|
- 192.168.11.11-14: R630 nodes (if needed)
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
### Other VLANs
|
|
|
|
|
|
|
|
|
|
|
|
Configure DHCP as needed for each VLAN, or use static IPs for all nodes.
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## Failover Configuration
|
|
|
|
|
|
|
|
|
|
|
|
### ER605-A WAN Failover
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Primary WAN: WAN1 (76.53.10.34)
|
|
|
|
|
|
Backup WAN: WAN2
|
|
|
|
|
|
Failover Mode: Auto
|
|
|
|
|
|
Health Check: Ping 8.8.8.8 every 30 seconds
|
|
|
|
|
|
Failover Threshold: 3 failed pings
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
### ER605-B Standby (if configured)
|
|
|
|
|
|
|
|
|
|
|
|
- Monitor ER605-A health
|
|
|
|
|
|
- Activate if ER605-A fails
|
|
|
|
|
|
- Use same configuration as ER605-A
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## Monitoring & Logging
|
|
|
|
|
|
|
|
|
|
|
|
### Enable Logging
|
|
|
|
|
|
|
|
|
|
|
|
- **System Logs**: Enable
|
|
|
|
|
|
- **Firewall Logs**: Enable
|
|
|
|
|
|
- **NAT Logs**: Enable (for egress tracking)
|
|
|
|
|
|
|
|
|
|
|
|
### SNMP (Optional)
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
SNMP Version: v2c or v3
|
|
|
|
|
|
Community: [Secure community string]
|
|
|
|
|
|
Trap Receivers: [Monitoring system IPs]
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## Backup & Recovery
|
|
|
|
|
|
|
|
|
|
|
|
### Configuration Backup
|
|
|
|
|
|
|
|
|
|
|
|
1. **Export Configuration:**
|
|
|
|
|
|
- Navigate to: **System Tools** → **Backup & Restore**
|
|
|
|
|
|
- Click **Backup** to download configuration file
|
|
|
|
|
|
- Store securely (encrypted)
|
|
|
|
|
|
|
|
|
|
|
|
2. **Regular Backups:**
|
|
|
|
|
|
- Schedule weekly backups
|
|
|
|
|
|
- Store in multiple locations
|
|
|
|
|
|
- Version control configuration changes
|
|
|
|
|
|
|
|
|
|
|
|
### Configuration Restore
|
|
|
|
|
|
|
|
|
|
|
|
1. **Restore from Backup:**
|
|
|
|
|
|
- Navigate to: **System Tools** → **Backup & Restore**
|
|
|
|
|
|
- Upload configuration file
|
|
|
|
|
|
- Restore and reboot
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## Troubleshooting
|
|
|
|
|
|
|
|
|
|
|
|
### Common Issues
|
|
|
|
|
|
|
|
|
|
|
|
#### VLAN Not Routing
|
|
|
|
|
|
|
|
|
|
|
|
- **Check:** VLAN interface is created and enabled
|
|
|
|
|
|
- **Check:** VLAN ID matches switch configuration
|
|
|
|
|
|
- **Check:** Subnet mask is correct
|
|
|
|
|
|
|
|
|
|
|
|
#### NAT Not Working
|
|
|
|
|
|
|
|
|
|
|
|
- **Check:** NAT pool IPs are in the correct /28 block
|
|
|
|
|
|
- **Check:** Source network matches VLAN subnet
|
|
|
|
|
|
- **Check:** Firewall rules allow traffic
|
|
|
|
|
|
|
|
|
|
|
|
#### Failover Not Working
|
|
|
|
|
|
|
|
|
|
|
|
- **Check:** WAN2 is configured and connected
|
|
|
|
|
|
- **Check:** Health check settings
|
|
|
|
|
|
- **Check:** Failover priority settings
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## Security Best Practices
|
|
|
|
|
|
|
|
|
|
|
|
1. **Change Default Credentials:** Immediately change admin password
|
|
|
|
|
|
2. **Disable Remote Management:** Only allow LAN access to web interface
|
|
|
|
|
|
3. **Enable Firewall Logging:** Monitor for suspicious activity
|
|
|
|
|
|
4. **Regular Firmware Updates:** Keep ER605 firmware up to date
|
|
|
|
|
|
5. **Restrict Break-glass Rules:** Use IP allowlists for all inbound NAT
|
|
|
|
|
|
6. **Monitor NAT Pools:** Track egress IP usage by role
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
## References
|
|
|
|
|
|
|
|
|
|
|
|
- **[NETWORK_ARCHITECTURE.md](NETWORK_ARCHITECTURE.md)** - Complete network architecture
|
|
|
|
|
|
- **[ORCHESTRATION_DEPLOYMENT_GUIDE.md](ORCHESTRATION_DEPLOYMENT_GUIDE.md)** - Deployment guide
|
|
|
|
|
|
- [ER605 User Guide](https://www.tp-link.com/us/support/download/er605/)
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
|
|
**Document Status:** Complete (v1.0)
|
|
|
|
|
|
**Maintained By:** Infrastructure Team
|
|
|
|
|
|
**Review Cycle:** Quarterly
|
|
|
|
|
|
**Last Updated:** 2025-01-20
|
|
|
|
|
|
|
