Netopia 4000-Series Bedienungsanleitung

N N N N e e e e t t t t o o o o p p p p ii i i a a a a ® ® ® ® F F F F ii i i r r r r m m m m w w w w a a a a r r r r e e e e U U U U s s s s e e e e r r r r G G G G u u u u ii i i d d d d e e e e N N N N e e e e t t t t o o o o p p p p ii i i a a a a ® ® ® ® 4 4 4 4 0 0 0 0 0 0 0 0 0 0 0 0 - - - - S S S S e e e e r r r r ii i i e e e e s s[...]

C o p yright Copyright© 2004, Netopia, Inc. Netopia and the Netopia logo are register ed trademarks belonging to Netopia, Inc., registered U.S. Patent and Trademark Of fice. Broadband Without Boundaries and 3-D Reach are trademarks belonging to Netopia, Inc. All other trademarks are the proper ty of their respective owners. All rights reser ved. [...]

Contents iii G Chapter 1 — Introduction.......................................................... 1-1 What’s New in Netopia Fir mware V ersion 5.4 ................... 1-1 Console-based Management........................................... 1-2 Netopia Console Menus ................................................. 1-2 Netopia Models ............[...]

iv Firmware User Guide Modifying a scheduled connection ....................... 2-34 Deleting a scheduled connection......................... 2-34 System Configuration Screens ...................................... 2-35 System configuration features............................. 2-35 IP Setup .......................................................[...]

Contents v G IP profile parameters .......................................... 3-21 IP Parameters (W AN Default Profile) .................... 3-23 NA T Associations ......................................................... 3-25 IP Passthrough ............................................................ 3-27 MultiNA T Configuration Example .......[...]

vi Firmware User Guide Adding an IKE Phase 1 Profile ............................... 5-4 Changing an IKE Phase 1 Profile ........................... 5-8 Key Management ........................................................... 5-9 IPsec W AN Configuration Screens ................................. 5-18 IPsec Manual Key Entr y ...................[...]

Contents vii G Event Logs .................................................................. 7-12 SNMP Suppor t ............................................................ 7-13 Backup Default Gateway............................................... 7-13 Backup Configuration screen .............................. 7-13 IP Setup screen ................[...]

viii Firmware User Guide Advanced Security Options ................................. 10-5 User access password ....................................... 10-7 User menu dif ferences ....................................... 10-8 User Accounts ........................................................... 10-15 T elnet Access ...............................[...]

Contents ix G Updating fir mware .............................................. 11-7 Downloading configuration files ........................... 11-8 Uploading configuration files ............................... 11-9 T ransferring Configuration and Fir mware Files with XMODEM .............................................................. 11-9[...]

x Firmware User Guide Packet header types .......................................... B-14 Appendix C — Binary Conversion T able ......................................C-1 Index[...]

Introduction 1-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 II I I n n n n t t t t r r r r o o o o d d d d u u u u c c c c t t t t ii i i o o o o n n n n This Fir mware User Guide covers the advanced features of the Netopia 4000-Series Router and IAD families. Y our Netopia equipment of fers advanced configuration features in [...]

1-2 Firmware User Guide Console-based Management Console-based management is a fast menu-driven inter face for the capabilities built into the Netopia Fir mware V ersion 5.4. Console-based management provides access to a wide variety of featur es that the router suppor ts. Y ou can customize these features for your individual setup. This chapter de[...]

Introduction 1-3 reconfiguring the manner in which you may be using the r outer to connect to more than one ser vice provider or r emote site. See “W AN Configuration,” beginning on page 2-1 . See also Chapter 4, “Vir tual Private Networks (VPNs).” ■ The System Configuration menus display and per mit changing: See “System Configurat[...]

1-4 Firmware User Guide Connecting thr ough a T elnet Session Features of the Netopia Fir mware V ersion 5.4 can be configur ed through the console screens. Before you can access the console scr eens through T elnet, you must have: ■ A network connection locally to the router or IP access to the r outer . Note: Alternatively , you may have a dir[...]

Introduction 1-5 Connecting a Console Cable to y our Equipment Many Netopia models include a serial console por t labeled “Console” on the back panel. Y ou can per for m all of the system configuration activities for your Netopia equipment through a local serial console connection, if available, using ter minal emulation software, such as Hype[...]

1-6 Firmware User Guide Launch your ter minal emulation software and configure the communications softwar e for the values shown in the table below . These are the default communication parameters that the Netopia Fir mware V ersion 5.4 uses. Parameter Suggested V alue T er minal type PC : ANSI-BBS Mac : ANSI, VT-100, or VT-200 Data bits 8 Parity [...]

Introduction 1-7 Na vigating thr ough the Console Screens Use your keyboard to navigate the Netopia Fir mware V ersion 5.4’s configuration screens, enter and edit infor mation, and make choices. The following table lists the keys to use to navigate through the console screens. T o help you find your way to par ticular scr eens, some sections in[...]

1-8 Firmware User Guide[...]

W AN and System Configuration 2-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 2 2 2 2 W W W W A A A A N N N N a a a a n n n n d d d d S S S S y y y y s s s s t t t t e e e e m m m m C C C C o o o o n n n n f f f f ii i i g g g g u u u u r r r r a a a a t t t t ii i i o o o o n n n n This chapter describes how to use the console-based m[...]

2-2 Firmware User Guide ADSL Line Configuration screen The ADSL Line Configuration screen is shown below: 1. Select Circuit Type and from the pop-up menu choose the type of cir cuit to which you will be connecting: Multimode, T1.413, G.dmt/G.lite, or ADI. 2. Select Trellis Coding Enabled . T oggle it to On (the default) or Of f. 3. Select Signali[...]

W AN and System Configuration 2-3 SDSL/IDSL Configuration screen The SDSL/IDSL Line Configuration screen is shown below: ■ Select a Line Type from the pull-down menu. Y ou can choose SDSL-A TM , SDSL-HDLC , IDSL , or IDSL-CM . For IDSL connections, choose IDSL if your ser vice provider uses most common central of fice equipment; choose IDSL-C[...]

2-4 Firmware User Guide Some of these selections will reset the defaults for the r emaining options in this screen. Y ou will be challenged to confir m your choice. The SDSL-HDLC and IDSL Line Types do not of fer these choices. ■ The Data Rate Mode pull-down menu allows you to select either Hunt or Locked mode. ■ If you choose Hunt , the route[...]

W AN and System Configuration 2-5 IDSL Line Configuration screen The IDSL Line Configuration screen is shown below: ■ For IDSL lines, the Data Rate (kbps) pull-down menu of fers 64 (B1) , 64 (B2) , 128 (B1+B2) , or 144 (2B+D) . ■ The Data Link Encapsulation pull-down menu of fers PPP , HDLC , or Frame Relay . ■ If you are using Frame Relay[...]

2-6 Firmware User Guide G.SHDSL Line Configuration screen The G.SHDSL Line Configuration screen is shown below: Each access concentrator (DSLAM) has a dif ferent set of defaults and other parameters. Y our ser vice provider should supply you with the appr opriate information about the type and capabilities of the access concentrator equipment the[...]

W AN and System Configuration 2-7 T1 Line Configuration screen The T1 Line Configuration screen is shown below: ■ Select Operation Mode and press Retur n. From the pop-up menu, highlight the mode your telephone ser vice provider uses: HDLC (Cisco), CM-HDLC (Copper Mountain), or AT M . The default setting is HDLC. Press Retur n. ■ Select Line[...]

2-8 Firmware User Guide default setting is 1 (one). Press Retur n. Note: Y ou can change the First DS0 Channel number , which has a valid range fr om one to the maximum number minus the number of active channels. If the number of active DS0 channels is 24 (maximum), First DS0 Channel is hidden. If you specify a number of DS0 channels less than the [...]

W AN and System Configuration 2-9 Note: If you used Easy Setup to configure your r outer , you have already cr eated a connection profile called Easy Setup Profile. If you r eturn to the Easy Setup menus and change the Data Link Encapsulation method you set up in this step, the Easy Setup Data Link Encapsulation method will over ride this one a[...]

2-10 Firmware User Guide 1. Select LMI Type (Link Management Type) and press Return. Fr om the pop-up menu, highlight either ANSI (Annex D) , CCITT (Annex A) , LMI , or None . The default is None . Press Retur n. See “Frame Relay DLCI configuration” on page 2-11 for instr uctions. Specifying the Link Management Type is the first step in con?[...]

W AN and System Configuration 2-11 ting defaults to 64000, but you may modify the capacity rate if this setting will not be applicable to you. ■ The Default Bc (Bc also refer red to as Committed Burst Size) repr esents the maximum amount of data that your Frame Relay ser vice provider agr ees to transfer from a given PVC (Per manent Vir tual Cir[...]

2-12 Firmware User Guide T o go to the Frame Relay DLCI configuration scr een, select Frame Relay DLCI Configuration in the W AN Configuration screen. Displaying a Frame Rela y DLCI configuration table T o display a view-only table of the Frame Relay DLCIs, select Display/Change DLCIs in the Frame Relay DLCI Configuration screen, and pr ess Re[...]

W AN and System Configuration 2-13 Changing a Frame Relay DLCI configuration T o modify a Frame Relay DLCI configuration, select Display/Change DLCIs in the Frame Relay DLCI Configuration screen. Select a DLCI Name from the table and pr ess Return to go to the Change DLCI screen. The parameters in this screen ar e the same as the parameters in [...]

2-14 Firmware User Guide Adding a Frame Rela y DLCI configuration T o add a new Frame Relay DLCI, select Add DLCI in the Frame Relay DLCI Configuration scr een and press Return. The Add DLCI scr een appears. 1. Select DLCI Name and enter a name for this individual Frame Relay DLCI profile. It can be any name you want. For example: the name of yo[...]

W AN and System Configuration 2-15 provider agr ees to transfer from a given PVC (Per manent Vir tual Circuit) or DLCI (Data Link Connection Identifier). The setting defaults to 64000, but you may modify the committed burst size by toggling the selection in the Use Default field to No . Y ou can then enter a dif fer ent committed burst size in t[...]

2-16 Firmware User Guide Multiple A TM P ermanent Vir tual Cir cuits The Netopia Fir mware V ersion 5.4 suppor ts up to eight per manent vir tual circuits. Multiple A TM PVC o verview On cell-based DSL W AN inter faces, the A TM connection between the device and the central of fice equipment (DSLAM) is divided logically into one or more vir tual c[...]

W AN and System Configuration 2-17 3. T o add a cir cuit, select Add Circuit and press Retur n. The Add Circuit scr een appears. ■ Enter a name for the circuit in the Cir cuit Name field. ■ T oggle Cir cuit Enabled to Y es. ■ Enter the Vir tual Path Identifier and the Vir tual Channel Identifier in the Circuit VPI and Cir cuit VCI fields[...]

2-18 Firmware User Guide Quality of Service (QoS) settings ■ Select the QoS (Quality of Ser vice) setting from the pop-up menu: UBR . or CBR . UBR : No configuration is needed for UBR VCs. Leave the default value 0 (maximum line rate). CBR : One parameter is requir ed for CBR VCs. Enter the Peak Cell Rate that applies to the VC. This value shoul[...]

W AN and System Configuration 2-19 Note: With multiple VCs you must explicitly statically bind the second (and all subsequent) VCs to a profile. The first VC will automatically statically bind according to pr e-defined dynamic binding rules when you add the second VC. It will rever t back to dynamic binding if the number of VCs is reduced to on[...]

2-20 Firmware User Guide Editing cir cuits Y ou configure Vir tual Cir cuits in the A TM Circuits Configuration scr een. From the Main Menu, navigate to the A TM Cir cuits Configuration screen. Select Show/Change Circuit and pr ess Return. Main Menu WA N Conf iguration A TM Cir cuits Conf iguration ATM Circuits Configuration Show/Change Circuit.[...]

W AN and System Configuration 2-21 Choosing Show/Change Circuit (or Delete Circuit) displays a pop-up menu that allows you to select the circuit to be modified or deleted. Changing a cir cuit If you want to make any changes to the circuit you select, you make them in the Change Cir cuit screen. ■ Circuit Name allows you to associate a one- to f[...]

2-22 Firmware User Guide ■ Circuit Enabled allows you to enable or disable the cir cuit, using the T ab key . The default is enabled. ■ Traffic Type allows you to select which type of traf fic will be routed on this circuit, V oice or Data. If you choose V oice, the Connection Profile is field becomes unavailable and does not display . ■ [...]

W AN and System Configuration 2-23 Select VC Traffic Statistics . The A TM VC Statistics scr een appears. ■ T o display mor e information about each cir cuit associated with the selected W AN module, use the up or down ar row key to highlight the circuit you want to view . Press Retur n. A pop-up window appears, displaying detailed infor mation[...]

2-24 Firmware User Guide Creating a Ne w Connection Pr ofile Connection profiles ar e useful for configuring the connection and authentication settings for negotiating a PPP connection on a DSL link. If you are using the PPP data link encapsulation method, you can stor e your authentication infor mation in the connection profile so that your us[...]

W AN and System Configuration 2-25 Multiple Data Link Encapsulation Settings 4. Select Encapsulation Options and press Retur n. ❥ If you selected A TMP , PPTP , L2TP , or IPSec, see Chapter 4, “Vir tual Private Networks (VPNs).” ❥ If you selected PPP or RFC1483, the screen of fers dif fer ent options: If you are using PPP , when you select[...]

2-26 Firmware User Guide Return to the Add Connection Pr ofile screen by pressing Escape. 5. Select IP Profile Parameters and press Retur n. The IP Profile Parameters scr een appears. Datalink (PPP/MP) Options Data Compression... Standard LZS Send Authentication... PAP Send User Name: Send Password: Receive User Name: Receive Password: ❥ If yo[...]

W AN and System Configuration 2-27 6. T oggle or enter any IP Parameters you r equire and retur n to the Add Connection Profile scr een by pressing Escape. For more infor mation, see “IP Setup” on page 6-2 . 7. Select COMMIT and press Retur n. Y our new Connection Pr ofile will be added. If you want to view the Connection Profiles in your d[...]

2-28 Firmware User Guide The Default Pr ofile If you are using RFC1483 data link encapsulation, the Default Pr ofile screen controls whether or not the DSL link will come up without an explicitly configured connection pr ofile. (PPP datalink encapsulation does not suppor t a default profile, and the cor responding menu item is unavailable.) Se[...]

W AN and System Configuration 2-29 IP parameters (default pr ofile) screen If you are using RFC1483 datalink encapsulation, the IP Parameters (Default Pr ofile) screen allows you to configure various IP parameters for DSL connections established without an explicitly configur ed connection profile: For an DSL link, Network Address T ranslatio[...]

2-30 Firmware User Guide Viewing sc heduled connections T o display a table of scheduled connections, select Display/Change Scheduled Connection in the Scheduled Connections screen. Each scheduled connection occupies one r ow of the table. The first column in the table shows a one-letter repr esentation of the Days of the week, from Monday (M or m[...]

W AN and System Configuration 2-31 The other columns show: ■ The time of day that the connection will Begin At ■ The duration of the connection ( HH:MM ) ■ Whether it’s a recur ring W eekly connection or used Once Only ■ Which connection profile ( Conn. Pr of. ) is used to connect ■ Whether the scheduled connection is cur rently Enabl[...]

2-32 Firmware User Guide demand call on the line. ■ Demand-Allowed , meaning that this schedule will per mit a demand call on the line. ■ Demand-Blocked , meaning that this schedule will prevent a demand call on the line. ■ Periodic , meaning that the connection is retried several times during the scheduled time. ■ If How Often is set to W [...]

W AN and System Configuration 2-33 Set Once-Only Sc hedule If you set How Often to Once Only , select Set Once-Only Schedule and go to the Set Once-Only Schedule screen. ■ Select Place Call On (Date) and enter a date in the for mat MM/DD/YY or MM/DD/YYYY (month, day , year). Note: Y ou must enter the date in the for mat specified. The slashes a[...]

2-34 Firmware User Guide Modifying a scheduled connection T o modify a scheduled connection, select Display/Change Scheduled Connection in the Scheduled Connections screen to display a table of scheduled connections. Select a scheduled connection from the table and pr ess Return. The Change Scheduled Connection screen appears. The parameters in thi[...]

W AN and System Configuration 2-35 System Configuration Screens System configuration features The Netopia Fir mware V ersion 5.4 default settings may be all you need to configure your Router. Some users, however , require advanced settings or pr efer manual control over the default selections. For these users, Netopia Fir mware V ersion 5.4 pro[...]

2-36 Firmware User Guide The System Configuration menu screen appears: IP Setup These screens allow you to configur e your network’s use of the IP networking protocol. ■ Details are given in “IP Setup” on page 6-2 . Filter Sets These screens allow you to configur e security on your network by means of filter sets and a basic firewall. [...]

W AN and System Configuration 2-37 Stateful Inspection firewall Stateful inspection firewall is a security featur e that prevents unsolicited inbound access when NA T is disabled. Y ou can configure UDP and TCP “no-activity” periods that will also apply to NA T time-outs if stateful inspection is enabled on the inter face. Stateful Inspecti[...]

2-38 Firmware User Guide Stateful Inspection Options Enable and configure stateful inspection on a WAN inter face. When you create or modify a Connection Pr ofile, the IP Profile Parameters screen allows you to enable Stateful Inspection on that profile by toggling Stateful Inspection Enabled to Ye s . By default, this is tur ned of f (No). If [...]

W AN and System Configuration 2-39 ■ Max. TCP Sequence Number Dif ference : Enter a value in this field. This value repr esents the maximum sequence number dif ference allowed between subsequent TCP packets. If this number is exceeded, the packet is dropped. The acceptable range is 0 – 65535. A value of 0 (zer o) disables this check. ■ Enab[...]

2-40 Firmware User Guide Exposed Addresses Y ou can specify the IP addresses you want to expose by selecting Add Exposed Address List and pr essing Return. The Add Exposed Addr ess List screen appears. Add, Edit, or delete exposed addresses options ar e active only if NA T is disabled on an W AN inter face. The hosts specified in exposed addresses[...]

W AN and System Configuration 2-41 ■ Star t Addr ess: Star t IP Address of the exposed host range. ■ End Address: End IP Addr ess of the exposed host range ■ Protocol : Select the Pr otocol of the traf fic to be allowed to the host range fr om the pull-down menu. Options are Any , TCP , UDP , or TCP/UDP . ■ Star t Por t: Star t por t of t[...]

2-42 Firmware User Guide Date and time Y ou can set the system’s date and time parameters in the Set Date and Time screen. Select Date and Time in the System Configuration screen and pr ess Return. The Set Date and Time screen appears. Follow these steps to set the system’s date and time: 1. T oggle NTP (Network Time Pr ot.) Enabled to On to s[...]

W AN and System Configuration 2-43 Console Configuration Y ou can change the default ter minal communications parameters to suit your requirements. T o go to the Console Configuration scr een, select Console Configuration in the System Configuration screen. Follow these steps to change a parameter’s value: 1. Select 57600, 38400, 19200, or 9[...]

2-44 Firmware User Guide RFC-1483 T ransparent Bridging This feature allows you to tur n of f the r outing features and use your device as a bridge. If you select this option, the device will restar t itself, and reset all the settings to factor y defaults. Any configurations you have made will be erased. Use this feature with caution. If you deci[...]

W AN and System Configuration 2-45 Y ou can reinstate r outer mode by returning to the System Configuration menu. Select Change Device to a Router . Press Return , confir m your choice, and the device will restar t in router mode. Bridged Frame-Relay . Note: Netopia Fir mware V ersion 5.4 now suppor ts additional Frame Relay configuration optio[...]

2-46 Firmware User Guide Logging Y ou can configure a UNIX-compatible syslog client to r epor t a number of subsets of the events entered in the router’s WAN Event Histor y . See “WAN Event Histor y” on page 9-5 . Select Logging from the System Configuration menu. The Logging Configuration screen appears. By default, all events are logged [...]

W AN and System Configuration 2-47 Y ou will need to install a Syslog client daemon program on your PC and configur e it to repor t the W AN events you specified in the Logging Configuration screen. The following screen shows a sample syslog dump of WAN events: May 5 10:14:06 tsnext.netopia.com Link 1 down: PPP PAP failure May 5 10:14:06 tsnext[...]

2-48 Firmware User Guide[...]

Multiple Network Address T ranslation 3-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 3 3 3 3 M M M M u u u u ll l l t t t t ii i i p p p p ll l l e e e e N N N N e e e e t t t t w w w w o o o o r r r r k k k k A A A A d d d d d d d d r r r r e e e e s s s s s s s s T T T T r r r r a a a a n n n n s s s s ll l l a a a a t t t t ii i i o[...]

3-2 Firmware User Guide Features MultiNA T featur es can be divided into several categories that can be used simultaneously in dif fer ent combinations on a per-Connection Profile basis. The following is a general description of these features: P or t Address T ranslation The simplest for m of classic Network Address T ranslation is PAT (Por t Add[...]

Multiple Network Address T ranslation 3-3 Dynamic mapping Dynamic mapping , often refer red to as many-to-few , of fers an extension to the advantages provided by static mapping. Instead of requiring a one-to-one association of public addr esses and private addresses, as is requir ed in static mapping, dynamic mapping uses a group of public IP addr[...]

3-4 Firmware User Guide Exterior addresses ar e allocated to internal hosts on a demand, or as-needed, basis and then made available when traf fic from that host ceases. Once an internal host has been allocated an addr ess, it will use that address for all traf fic. Five minutes after all traf fic ceases – no pings, all TCP connections closed,[...]

Multiple Network Address T ranslation 3-5 Complex maps Map lists and ser ver lists are completely independent of each other . A Connection Profile can use one or the other or both. MultiNA T allows complex mapping and r equires more complex configuration than in earlier fir mware versions. Multiple mapped interior subnets are suppor ted, and the[...]

3-6 Firmware User Guide Cur rently there is a r estriction that the remote user must be routed to via the WAN inter face, other wise the connections will fail. There is no r estriction as to the number of connections. There is no user configuration r equired for this feature. MultiNA T Configuration Y ou configure the MultiNA T features through [...]

Multiple Network Address T ranslation 3-7 Server Lists and Dynamic NA T configuration Y ou use the advanced NA T featur e sets by first defining a series of mapping rules and then gr ouping them into a list . There ar e two kinds of lists -- map lists , made up of dynamic, P A T and static mapping r ules, and ser ver lists , a list of internal s[...]

3-8 Firmware User Guide Select Network Address Translation (NA T) and press Retur n. The Network Address T ranslation screen appears. Public Range defines an external addr ess range and indicates what type of mapping to apply when using this range. The types of mapping available are dynamic , static and pat . Map Lists define collections of mappi[...]

Multiple Network Address T ranslation 3-9 NA T rules The following r ules apply to assigning NA T ranges and ser ver lists: ■ Static public address ranges must not overlap other static, P A T , public addr esses, or the public address assigned to the router’s WAN inter face. ■ A P A T public addr ess must not overlap any static address ranges[...]

3-10 Firmware User Guide Select First Public Address and enter the first exterior IP addr ess in the range you want to assign. Select Last Public Address and enter an IP addr ess at the end of the range. ■ Select ADD NA T PUBLIC RANGE and press Retur n. The range will be added to your list and you will be retur ned to the Network Address T ransl[...]

Multiple Network Address T ranslation 3-11 ■ Select Add Map and press Retur n. The Add NA T Map screen appears. ■ Select First and Last Private Address and enter the first and last interior IP addresses you want to assign to this mapping. ■ Select Use NA T Public Range and press Retur n. A screen appears displaying the public ranges you have[...]

3-12 Firmware User Guide mapping and press Retur n. If none of your preconfigur ed ranges are suitable for this mapping, you can select <<NEW RANGE>> and create a new range. If you choose <<NEW RANGE>> , the Add NA T Public Range scr een displays and you can create a new public range to be used by this map. See Add NA T Pub[...]

Multiple Network Address T ranslation 3-13 Modifying map lists Y ou can make changes to an existing map list after you have created it. Since ther e may be more than one map list you must select which one you are modifying. From the Network Addr ess T ranslation scr een select Show/Change Map List and press Retur n. ■ Select the map list you want[...]

3-14 Firmware User Guide ■ Add Map allows you to add a new map to the map list. ■ Show/Change Maps allows you to modify the individual maps within the list. ■ Delete Map allows you to delete a map from the list. Selecting Show/Change Maps or Delete Map displays the same pop-up menu. Scroll to the map you want to modify using the ar row keys a[...]

Multiple Network Address T ranslation 3-15 Adding Server Lists Ser ver lists, also known as Expor ts, are handled similarly to map lists. If you want to make a par ticular ser ver’s por t accessible (and it isn’t accessible through other means, such as a static mapping), you must create a ser ver list. Select Add Ser ver List from the Network A[...]

3-16 Firmware User Guide ■ Select Add Ser ver and press Return. The Add NA T Ser ver screen appears. ■ Select Ser vice and press Return. A pop-up menu appears listing a selection of commonly expor ted ser vices. ■ Choose the ser vice you want to expor t and press Retur n. Y ou can choose a preconfigur ed ser vice from the list, or define yo[...]

Multiple Network Address T ranslation 3-17 ■ Enter the First and Last Por t Number between por ts 1 and 65535. Select OK and press Retur n. Y ou will be retur ned to the Add NA T Ser ver screen. ■ Enter the Ser ver Private IP Address of the ser ver whose ser vice you are expor ting. Since MultiNA T per mits the mapping of multiple private IP ad[...]

3-18 Firmware User Guide Modifying server lists Once a ser ver list exists, you can select it for modification or deletion. ■ Select Show/Change Ser ver List from the Network Address T ranslation screen. ■ Select the Ser ver List Name you want to modify from the pop-up menu and pr ess Return. The Show/Change NA T Ser ver List scr een appears. [...]

Multiple Network Address T ranslation 3-19 ■ Selecting Show/Change Ser ver or Delete Server displays the same pop-up menu. Select any ser ver from the list and pr ess Return. The Change NA T Ser ver scr een appears. Y ou can make changes to the ser ver’s ser vice and por t or internal or exter nal address. Select CHANGE NA T SERVER and press Re[...]

3-20 Firmware User Guide Deleting a server T o delete a ser ver fr om the list, select Delete Server fr om the Show/Change NA T Ser ver List menu and press Return. A pop-up menu lists your configured ser vers. Select the one you want to delete and pr ess Return. A dialog box asks you to confir m your choice. Choose CONTINUE and press Retur n. The[...]

Multiple Network Address T ranslation 3-21 Binding Map Lists and Server Lists Once you have created your map lists and ser ver lists, for most Netopia Router models you must bind them to a profile, either a Connection Pr ofile or the Default Profile. Y ou do this in one of the following screens: ■ the IP profile parameters scr een (see below)[...]

3-22 Firmware User Guide ■ Select NA T Map List and press Retur n. A pop-up menu displays a list of your defined map lists. ■ Select the map list you want to bind to this Connection Profile and pr ess Return. The map list you selected will now be bound to this Connection Profile. ■ Select NA T Ser ver List and press Retur n. A pop-up menu [...]

Multiple Network Address T ranslation 3-23 IP P arameter s (W AN Default Profile) The Netopia Fir mware V ersion 5.4 using RFC 1483 suppor ts a W AN default profile that per mits several parameters to be configured without an explicitly configur ed Connection Profile. The procedur e is similar to the procedure to bind map lists and ser ver lis[...]

3-24 Firmware User Guide ■ Select NA T Map List and press Retur n. A pop-up menu displays a list of your defined map lists. ■ Select the map list you want to bind to the default profile and pr ess Return. The map list you selected will now be bound to the default profile. ■ Select NA T Ser ver List and press Retur n. A pop-up menu displays[...]

Multiple Network Address T ranslation 3-25 NA T Associations Configuration of map and ser ver lists alone is not suf ficient to enable NA T for a WAN connection because map and ser ver lists must be linked to a profile that contr ols the W AN inter face. This can be a Connection Pr ofile, a W AN Ethernet inter face, a default pr ofile, or a de[...]

3-26 Firmware User Guide keys. Select the item by pressing Retur n to display a pop-up menu of all of your configured lists. ■ Select the list name you want to assign and press Retur n again. Y our selection will then be associated with the cor responding profile or inter face. NAT Associations +NAT Map List Name-+ Profile/Interface Name-------[...]

Multiple Network Address T ranslation 3-27 IP P assthrough Netopia Fir mware V ersion 5.4 of fers an IP passthrough feature. The IP passthr ough feature allows for a single PC on the LAN to have the router’s public addr ess assigned to it. It also provides P A T (NAPT) via the same public IP address for all other hosts on the private LAN subnet. [...]

3-28 Firmware User Guide The IP Profile Parameters screen, found under the WAN Configuration menu, Add/Change Connection Profile screen, appears as shown. If you select NA T Options , in either case, the NA T Options screen appears. If you toggle IP Passthrough Enabled to Ye s , additional field(s) appear . IP Profile Parameters Address Transla[...]

Multiple Network Address T ranslation 3-29 T oggling IP Passthr ough DHCP Enabled to Ye s displays the IP Passthrough DHCP MAC addr ess field. This is an editable field in which you can enter the MAC (hardwar e) address of the designated PC be used as the DHCP Client Identifier for dynamic address r eser vation. The MAC address must be six colon[...]

3-30 Firmware User Guide A restriction Since both the router and the passthr ough host will use same IP address, new sessions that conflict with existing sessions will be rejected by the r outer . For example, suppose you are a teleworker using an IPSec tunnel from the r outer and from the passthrough host. Both tunnels go to the same remote endpo[...]

Multiple Network Address T ranslation 3-31 MultiNA T Configuration Example T o help you understand a typical MultiNA T configuration, this section describes an example of the type of configuration you may want to implement on your site. The values shown are for example purposes only . Make your own appropriate substitutions. A typical DSL ser vi[...]

3-32 Firmware User Guide Enter your ISP-supplied values as shown below . Select NEXT SCREEN and press Retur n. Y our IP values are shown her e. Then navigate to the Network Address T ranslation (NA T) scr een. Connection Profile 1: Easy Setup Profile Connection Profile Name: Easy Setup Profile Address Translation Enabled: Yes IP Addressing... Numbe[...]

Multiple Network Address T ranslation 3-33 Select Show/Change Public Range , then Easy-P A T Range , and pr ess Return. Enter the value your ISP assigned for your public address (206.1.1.6, in this example). T oggle Type to pat. Y our public address is then mapped to the remaining private IP addr esses using P A T . (If you wer e not using the Easy[...]

3-34 Firmware User Guide Select ADD NA T PUBLIC RANGE and press Retur n. Y ou are r eturned to the Network Address Translation screen. Next, select Show/Change Map List and choose Easy-P A T List . Select Add Map . The Add NA T Map scr een appears. (Now the name Easy-P A T List is a misnomer since it has a static map included in its list.) Enter in[...]

Multiple Network Address T ranslation 3-35 T o make these changes, first limit the range of r emapped addresses on the Static Map and then edit the default ser ver list called Easy-Ser vers. ■ First, navigate to the Show/Change Map List screen, select Easy-P A T List and then Show/Change Maps . Choose the Static Map you created and change the Fi[...]

3-36 Firmware User Guide[...]

Virtual Private Networks (VPNs) 4-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 4 4 4 4 V V V V ii i i r r r r t t t t u u u u a a a a ll l l P P P P r r r r ii i i v v v v a a a a t t t t e e e e N N N N e e e e t t t t w w w w o o o o r r r r k k k k s s s s ( ( ( ( V V V V P P P P N N N N s s s s ) ) ) ) The Netopia Fir mware V ersio[...]

4-2 Firmware User Guide The Netopia Fir mware V ersion 5.4 can be used in VPNs either to initiate the connection or to answer it. When used in this way , the routers ar e said to be tunnelling through the public network (Internet). The advantages ar e that, like your long distance phone call, you don't need a direct line between one computer o[...]

Virtual Private Networks (VPNs) 4-3 protocol over IP . A TMP is more ef ficient than PPTP for network-to-network tunnels. ■ IPsec stands for IP Security , a set of protocols that suppor ts secur e exchange of IP packets at the IP layer . IPsec is deployed widely to implement Vir tual Private Networks (VPNs). IPsec suppor ts two encr yption modes[...]

4-4 Firmware User Guide About PPTP T unnels T o set up a PPTP tunnel, you cr eate a Connection Profile including the IP address and other r elevant information for the remote PPTP par tner . Y ou use the same pr ocedure to initiate a PPTP tunnel that ter minates at a remote PPTP ser ver or to ter minate a tunnel initiated by a remote PPTP client. [...]

Virtual Private Networks (VPNs) 4-5 When you define a Connection Profile as using PPTP by selecting PPTP as the datalink encapsulation method, and then select Data Link Options , the PPTP T unnel Options scr een appears. ■ Enter the PPTP Par tner IP Addr ess . This specifies the address of the other end of the tunnel. If you do not specify the[...]

4-6 Firmware User Guide Note: The Netopia Fir mware V ersion 5.4 suppor ts 128-bit (“strong”) encr yption. Unlike MS-CHAP version 1, which suppor ts one-way authentication, MS-CHAP version 2 suppor ts mutual authentication between connected routers and is incompatible with MS-CHAP version 1 (MS-CHAP-V1). When you choose MS-CHAP as the authentic[...]

Virtual Private Networks (VPNs) 4-7 The IP Profile Parameters scr een appears. ■ Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel. About IPsec T unnels IPsec stands for IP Security , a set of protocols that suppor ts secur e exchange of IP packets at the IP layer . IPsec is deployed widely to implement Vir [...]

4-8 Firmware User Guide About A TMP T unnels T o set up an A TMP tunnel, you create a Connection Pr ofile including the IP address and other relevant infor mation for the remote A TMP par tner . A TMP uses the ter minology of a foreign agent that initiates tunnels and a home agent that ter minates them. Y ou use the same procedur e to initiate or [...]

Virtual Private Networks (VPNs) 4-9 When you define a Connection Profile as using A TMP by selecting A TMP as the datalink encapsulation method, and then select Data Link Options , the A TMP T unnel Options screen appears. Note: An A TMP tunnel cannot be assigned a dynamic IP addr ess by the remote ser ver , as in a PPP connection. When you defi[...]

4-10 Firmware User Guide them, acting as a home agent ( No ). ■ T unnels are nor mally initiated On Demand ; however , you can disable this feature. When disabled, the tunnel must be manually established through the call management scr eens. ■ Y ou can specify the Idle Timeout , an inactivity timer , whose expiration will ter minate the tunnel.[...]

Virtual Private Networks (VPNs) 4-11 MS-CHAP V2 and 128-bit strong encryption Notes: ■ The Netopia Fir mware V ersion 5.4 suppor ts 128-bit (“strong”) encr yption when using PPTP tunnels. A TMP does not have an option of using 128-bit MPPE. If you ar e using A TMP between two Netopia routers you can optionally set 56-bit DES encr yption. ■ [...]

4-12 Firmware User Guide ■ T oggle Answer A TMP/PPTP Connections to Ye s if you want the r outer to accept VPN connections or No (the default) if you do not. ■ For PPTP tunnel connections only , you must define what type of authentication these connections will use. Select Receive Authentication and press Retur n. A pop-up menu of fers the fol[...]

Virtual Private Networks (VPNs) 4-13 VPN Quic kVie w Y ou can view the status of your VPN connections in the VPN QuickView screen. From the Main Menu select QuickView and then VPN QuickView . The VPN QuickView screen appears. Profile Name: Lists the name of the Connection Pr ofile being used, if any . Type: Shows the data link encapsulation metho[...]

4-14 Firmware User Guide Dial-Up Netw orking f or VPN Microsoft Windows Dial-Up Networking softwar e permits a r emote standalone workstation to establish a VPN tunnel to a PPTP ser ver such as a Netopia Router located at a central site. Dial-Up Networking also allows a mobile user who may not be connected to a P AC to dial into an inter mediate IS[...]

Virtual Private Networks (VPNs) 4-15 The Communications window appears. 5. In the Communications window , select Dial-Up Networking and click the OK button. This retur ns you to the Windows Setup screen. Click the OK button. 6. Respond to the prompts to install Dial-Up Networking fr om the system disks or CDROM. 7. When prompted, r eboot your PC. C[...]

4-16 Firmware User Guide Configuring a Dial-Up Netw orking pr ofile Once you have created your Dial-Up Networking pr ofile, you configure it for TCP/IP networking to allow you to connect to the Internet thr ough your Internet connection device. Do the following: 1. Double-click the My Computer (or whatever you have named it) icon on your deskto[...]

Virtual Private Networks (VPNs) 4-17 4. Click the TCP/IP Settings button. ■ If your ISP uses dynamic IP addressing (DHCP), select the Ser ver assigned IP addr ess radio button. ■ If your ISP uses static IP addressing, select the Specify an IP addr ess radio button and enter your assigned IP address in the fields pr ovided. Also enter the IP ad[...]

4-18 Firmware User Guide This displays a list of possible selections for the communications option. Active components will have a check in the checkboxes to their left. 6. Check Dial Up Networking at the top of the list and Vir tual Private Networking at the bottom of the list. 7. Click OK at the bottom right on each screen until you r eturn to the[...]

Virtual Private Networks (VPNs) 4-19 Connecting using Dial-Up Netw orking A Dial-Up Networking connection will be automatically launched whenever you r un a TCP/IP application, such as a web browser or email client. When you first r un the application a Connect T o dialog box appears in which you enter your User name and Password. If you check the[...]

4-20 Firmware User Guide PPTP example T o enable a fir ewall to allow PPTP traf fic, you must pr ovision the firewall to allow inbound and outbound TCP packets specifically destined for por t 1723. The source por t may be dynamic, so often it is not useful to apply a compare function upon this por tion of the control/negotiation packets. Y ou m[...]

Virtual Private Networks (VPNs) 4-21 In the Display/Change Filter Set screen select Display/Change Output Filter . Display/Change Output Filter screen Select Output Filter 1 and press Retur n. In the Change Output Filter 1 screen, set the Protocol Type and Destination Por t infor mation as shown below . Change Input Filter 2 Enabled: Yes Forward: Y[...]

4-22 Firmware User Guide Select Output Filter 2 and press Retur n. In the Change Output Filter 2 screen, set the Protocol Type to allow GRE as shown below . A TMP example T o enable a fir ewall to allow A TMP traf fic, you must provision the firewall to allow inbound and outbound UDP packets specifically destined for por t 5150. The source por [...]

Virtual Private Networks (VPNs) 4-23 Select Input Filter 1 and press Retur n. In the Change Input Filter 1 screen, set the Destination Por t infor mation as shown below . Select Input Filter 2 and press Retur n. In the Change Input Filter 2 screen, set the Protocol Type to allow GRE as shown below . Change Input Filter 1 Enabled: Yes Forward: Yes S[...]

4-24 Firmware User Guide In the Display/Change Filter Set screen select Display/Change Output Filter . Display/Change Output Filter screen Select Output Filter 1 and press Retur n. In the Change Output Filter 1 screen, set the Protocol Type and Destination Por t infor mation as shown below . Select Output Filter 2 and press Retur n. In the Change O[...]

Virtual Private Networks (VPNs) 4-25 Windo ws Netw orking Br oadcasts Netopia fir mware provides the ability to for war d Windows Networking NetBIOS broadcasts. This is useful for , for example, a Vir tual Private Network, in which you want to be able to browse the remote network to which you ar e tunnelling, as par t of your Windows Network Neigh[...]

4-26 Firmware User Guide Configuration for Router A Configuration for Router B IP Profile Parameters Address Translation Enabled: No Remote IP Address: 192.168.2.1 Remote IP Mask: 255.255.255.0 Filter Set... Remove Filter Set NetBIOS Proxy Enabled Yes RIP Profile Options... Enter an IP address in decimal and dot form (xxx.xxx.xxx.xxx). Configure [...]

Virtual Private Networks (VPNs) 4-27 Note: Microsoft Network br owsing is available with or without a Windows Internet Name Ser vice (WINS) ser ver . Shar ed volumes on the remote network are accessible with or without a WINS ser ver . Local LAN shared volumes that have Por t Address T ranslation (P A T) applied to them ar e not available to hosts [...]

4-28 Firmware User Guide[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 5 5 5 5 II I I n n n n t t t t e e e e r r r r n n n n e e e e t t t t K K K K e e e e y y y y E E E E x x x x c c c c h h h h a a a a n n n n g g g g e e e e ( ( ( ( II I I K K K K E E E E ) ) ) ) II I I P P P P s s s s e e e e c c[...]

5-2 Firmware User Guide the two devices on the Internet to communicate secur ely . ■ Phase 2 establishes the tunnel and provides for secur e transpor t of data. IPsec can be configured without IKE, but IKE of fers additional features, flexibility , and ease of configuration. Key exchange between your local router and a r emote point can be con[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-3 The Add Connection Profile scr een appears. ■ From the Encapsulation Type pop-up menu select IPsec . ■ Then select Encapsulation Options . The IPsec T unnel Options scr een appears. Main Menu WA N Conf iguration Add Connection Profile Add Connection Profile Profile Name: Profile 1 P[...]

5-4 Firmware User Guide For Key Management you can use either IKE or Manual . If you choose Manual, skip to “IPsec Manual Key Entr y” on page 5-19 . If you choose IKE (the default) continue below . ■ Select IKE Phase 1 Profile and press Retur n. ■ A pop-up window displays a list of IKE Phase 1 Profiles that you have configur ed. If you h[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-5 ■ The Profile Name field accepts any name of up to 16 characters. Sixteen IKE Phase 1 pr ofiles are suppor ted, since each of the potential sixteen Connection Profiles may be associated with a separate IKE Phase 1 profile. ■ The Mode pop-up menu allows you to choose between Main[...]

5-6 Firmware User Guide that will be used to generate key material for IKE Phase 1. ■ The Encryption Algorithm pop-up menu specifies the IKE Phase 1 encr yption algorithm, and may be either DES (the default) or 3DES. ■ The Hash Algorithm pop-up menu specifies the IKE Phase 1 hash algorithm, and may be either SHA1 (the default) or MD5. ■ The[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-7 the Phase 1 SAs under which they were cr eated. Phase 2 SAs “dangle” when the Phase 1 SA under which they were cr eated expires before they do. There is no r equirement that the Phase 1 SA exist for the duration of the Phase 2 SA ’s lifetime, but it is convenient because a Delete m[...]

5-8 Firmware User Guide Changing an IKE Phase 1 Pr ofile Selecting Display/Change IKE Phase 1 Profile or Delete IKE Phase 1 Profile displays an IKE Phase 1 pr ofile pop-up menu listing the names of all cur rently defined IKE Phase 1 profiles: Selecting Display/Change IKE Phase 1 Profile and choosing an IKE phase 1 profile name fr om the pop[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-9 K ey Mana gement Y ou specify your IKE key management on a per-Connection Profile basis. Y ou can do this in one of three ways: ■ Y ou can create your IKE Phase 1 Pr ofile first, and then associate it with an existing Connection Profile ■ Y ou can create a Connection Pr ofile an[...]

5-10 Firmware User Guide Note: The Change Connection Profile scr een will of fer dif ferent options, depending on the model of router you are using. For a r outer with the Dial Backup feature, you can associate an IPsec profile with the Primar y , the Backup, or choose to apply it to Any Por t of the W AN inter face by choosing the inter face fro[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-11 The Key Management pop-up menu at the top of the IPsec T unnel Options screen allows you to choose between IKE key management (the default for a new IPsec profile) and Manual key management. If you select Manual , the IKE Phase 1 Profile option does not display , and you must enter yo[...]

5-12 Firmware User Guide This screen allows you to specify the lifetime associated with each IPsec Security Association (SA) and contr ol when the SA will expire and become invalid. ■ SA Lifetime (seconds) specifies the duration in seconds for which the SA will remain valid. The range of per missible values is the set of non-negative integer val[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-13 Netopia Fir mware V ersion 5.4 provides a new Dead Peer Detection mechanism. An IPsec IP net inter face sends ICMP ping requests to a specific IP addr ess on a Remote Member network. The ping is periodic, and the reply is expected within a cer tain amount of time. If the ICMP reply doe[...]

5-14 Firmware User Guide If you enable IKE key management the IP Profile Parameters scr een appears. ■ The Remote T unnel Endpoint field accepts either an IP address in the familiar dotted–quad notation a.b.c.d or a hostname to be resolved using the Domain Name System (DNS). Multiple Network IPsec Netopia Fir mware V ersion 5.4 of fers an enh[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-15 ■ suppor t for sub-netting, host and network range addressing modes ■ works with manual keying and Internet Key Exchange (IKE) ■ each IPsec network works under the same local/remote tunnel endpoints ■ Select Add Network and press Retur n. The Add Network Configuration screen ap[...]

5-16 Firmware User Guide If you retur n to the IP Profile Parameters screen, two new fields ar e displayed: ■ Display/Change Network allows you to make changes to existing network configurations you have made. If you select Display/Change Network, a list of your configured networks displays. ■ Scroll down and up with the ar row keys to sele[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-17 ■ Specifying IKE key management alters the Advanced IP Profile Options screen as follows: ■ Y ou can specify a Local Tunnel Endpoint Address . If not 0.0.0.0, this value must be one of the assigned inter face addresses, either WAN or LAN. This is used as the source address of all I[...]

5-18 Firmware User Guide IPsec W AN Configuration Screens Y ou can also configure IKE Phase 1 Pr ofiles in the W AN Configuration menus. The W AN Configuration screen now includes IKE Phase 1 Configuration as shown: Select IKE Phase 1 Configuration and press Retur n. The IKE Phase 1 Configuration screen appears. W AN Conf iguration Main Men[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-19 The IKE Phase 1 Configuration screen allows configuration of global (non-connection-pr ofile-specific) IPsec parameters. This screen allows you to Display , Change, Add, or Delete an IKE Phase 1 pr ofile. IPsec Manual K e y Entry The V ersion 5.3 fir mware has a redesigned layout [...]

5-20 Firmware User Guide Select IPsec Manual Keys and press Retur n. Depending on your selections of Encapsulation, Encr yption T ransform, and Authentication Transform in the IPsec T unnel Options screen, the IPsec Manual Keys screen will display dif fering entr y fields to enter authorization keys and encr yption keys. With Manual Keys, you must[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-21 If the remote tunnel end point is a hostname (or “0.0.0.0”) 0.0.0.0 is displayed until a Security Association is established. Previously the r emote members network was displayed. W AN Event Histor y Err or Reporting The following events are logged and displayed in the WAN Event His[...]

5-22 Firmware User Guide IKE: no matching ph2 proposal Either the local router r ejected the proposals of the remote or the remote r ejected the local router’s. IKE: ph2 resend timeout The attempt to resend the phase 2 authentication timed out. IKE: phase 2 complete The phase 2 negotiation completed successfully . Event message: Meaning:[...]

IP Setup 6-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 6 6 6 6 II I I P P P P S S S S e e e e t t t t u u u u p p p p The Netopia Fir mware V ersion 5.4 uses Inter net Protocol (IP) to communicate both locally and with remote networks. This chapter shows you how to configure the r outer to route IP traf fic. Y ou also lear n how to [...]

6-2 Firmware User Guide IP Setup The IP Setup options screen is wher e you configure the Ethernet side of the Router. The infor mation you enter here contr ols how the router routes IP traf fic. Consult your network administrator or ISP to obtain the IP setup infor mation (such as the Ethernet IP address, Ethernet subnet mask, default IP gateway [...]

IP Setup 6-3 The Netopia Fir mware V ersion 5.4 suppor ts multiple IP subnets on the Ether net inter face. Y ou may want to configure multiple IP subnets to ser vice mor e hosts than are possible with your primar y subnet. It is not always possible to obtain a lar ger subnet from your ISP . For example, if you already have a full Class C subnet, y[...]

6-4 Firmware User Guide that the addresses distributed by the Router and those that ar e manually configured are not the same. Each method of distribution must have its own exclusive range of addresses to draw fr om. IP subnets The IP Subnets screen allows you to configur e up to eight Ethernet IP subnets on unlimited-user models, one “primar y[...]

IP Setup 6-5 For example: ■ T o delete a configur ed subnet, set both the IP address and subnet mask values to 0.0.0.0, either explicitly or by clearing each field and pressing Retur n to commit the change. When a configured subnet is deleted, the values in subsequent rows adjust up to fill the vacant fields. The subnets configured on this [...]

6-6 Firmware User Guide If you have configured multiple Ether net IP subnets, the IP Setup screen changes slightly: The IP address and Subnet mask items ar e hidden, and the Define Additional Subnets... item becomes Subnet Configuration... . If you select Subnet Configuration , you will retur n to the IP Subnets screen that allows you to defin[...]

IP Setup 6-7 The Static Routes screen will appear . Viewing static r outes T o display a view-only table of static r outes, select Display/Change Static Route . The table shown below will appear . The table has the following columns: Dest. Network: The network IP address of the destination network. Static Routes Display/Change Static Route... Add S[...]

6-8 Firmware User Guide Subnet Mask: The subnet mask associated with the destination network. Next Gateway: The IP address of the r outer that will be used to reach the destination network. Priority: An indication of whether the Router will use the static route when it conflicts with infor mation received from RIP packets. Enabled: An indication o[...]

IP Setup 6-9 infor mation; Low means that the RIP information takes pr ecedence over the static route. ■ If the static route conflicts with a connection pr ofile, the connection profile will always take precedence. ■ T o make sur e that the static route is known only to the Router, select Adver tise Route Via RIP and toggle it to No . T o al[...]

6-10 Firmware User Guide RIP-2 MD5 A uthentication Fir mware version 5.3.7 suppor ts RIP-2 MD5 Authentication (RFC2082 Routing Internet Pr otocol V ersion 2, Message Digest 5). The purpose of MD5 authentication is to provide an additional level of confidence that a RIP packet received was generated by a r eliable source. In other words, MD5 authen[...]

IP Setup 6-11 The IP Setup screen appears. ■ Select RIP Options . The Ethernet LAN RIP Options scr een appears. IP Setup Ethernet IP Address: 192.168.1.1 Ethernet Subnet Mask: 255.255.255.0 Define Additional Subnets... Default IP Gateway: 0.0.0.0 Backup IP Gateway: 0.0.0.0 Primary Domain Name Server: 0.0.0.0 Secondary Domain Name Server: 0.0.0.0 [...]

6-12 Firmware User Guide ■ Select Receive RIP , and from the pull-down menu choose v2 MD5 Authentication . ■ Y ou can also select T ransmit RIP , and choose v2 MD5 (broadcast) or v2 MD5 (multicast) from the pull-down menu. ■ RIP v2 Authentication Keys is visible only if v2 MD5 Authentication is enabled for either Receive or Ethernet LAN RIP O[...]

IP Setup 6-13 T ransmit RIP . Note: • All of the changes on this menu requir e a reboot. This is unique to the Ethernet LAN. RIP changes on all other inter faces are immediately ef fective. • If you set the RIP Receive option to Both v1 and v2 , the inter face will ignore authenticated RIP packets since authenticated v1 packets do not exist. On[...]

6-14 Firmware User Guide Adding a ke y Select Add Key . The Add Key Screen appears. ■ The key identifier Key ID can be any numeric value from 0 – 255, and must be unique per inter face. Y ou can not have two keys with the same key ID on an inter face. ■ The Authentication Key may consist of from 1 – 16 ASCII characters. These appear as ast[...]

IP Setup 6-15 Changing or deleting a key Y ou change or delete a key by selecting it from a pop-up menu. In the RIP v2 Authentication Keys menu, select Display/Change Key . Note: The date and time for mats are deter mined by the system date and time formats. If the cur rent date and time fall within the range of dates and times, the V alid field i[...]

6-16 Firmware User Guide Connection Pr ofiles and Default Pr ofile RIP-2 MD5 authentication may be configured in Connection Pr ofiles, as well. If you are not using NA T , your public Internet connection can benefit fr om sending authenticated RIP packets as well as receiving them. T o configure RIP-2 MD5 authentication for a Connection Pro?[...]

IP Setup 6-17 press COMMIT in the Add or Change Key scr een, then press Escape three times to retur n to the Add or Change Connection Profile scr een. ■ Select COMMIT in the Connection Profile screen and pr ess Return. Y our changes become ef fective for the specified Connection Profile. P ower interruptions Netopia 4000 Series routers use NT[...]

6-18 Firmware User Guide Go to the System Configuration screen. Select IP Address Ser ving and press Retur n. The IP Address Ser ving screen will appear . Follow these steps to configure IP Addr ess Ser ving: ■ If you enabled IP Address Ser ving, then DHCP , BootP clients and Dynamic WAN clients are automatically enabled. ■ The IP Address Ser[...]

IP Setup 6-19 Consequently , the DHCP lease time is configurable. The DHCP Lease Time (Hours) setting allows you to modify the router’s default lease time of one hour . Y ou can enter any number up to and including 168 hours (one week) for the DHCP lease. Note: About DHCP Auto-configuration: Beginning with Fir mware V ersion 5.3.4, routers whos[...]

6-20 Firmware User Guide IP Address P ools The IP Address Pools scr een allows you to configure a separate IP address ser ving pool for each of up to eight configured Ether net IP subnets: This screen consists of between two and eight r ows of four columns each. There are exactly as many r ows as there ar e Ethernet IP subnets configured on the [...]

IP Setup 6-21 Numerous factors influence the choice of ser ved addr ess. It is dif ficult to specify the address that will be ser ved to a par ticular client in all circumstances. However , when the address ser ver has been configured, and the clients involved have no prior address ser ving interactions, the Router will generally ser ve the fir[...]

6-22 Firmware User Guide DHCP NetBIOS Options If your network uses NetBIOS, you can enable the Router to use DHCP to distribute NetBIOS infor mation. NetBIOS stands for Network Basic Input/Output System. It is a layer of software originally developed by IBM and Sytek to link a network operating system with specific hardwar e. NetBIOS has been adop[...]

IP Setup 6-23 ■ From the NetBIOS Type pop-up menu, select the type of NetBIOS used on your network. ■ T o ser ve DHCP clients with the NetBIOS scope, select Ser ve NetBIOS Scope and toggle it to Ye s . Select NetBIOS Scope and enter the scope. ■ T o ser ve DHCP clients with the IP addr ess of a NetBIOS name ser ver , select Ser ve NetBIOS Nam[...]

6-24 Firmware User Guide Select Release BootP Leases and press Retur n. ■ Back in IP Address Ser ving, the Ser ve Dynamic WAN Clients toggle More Address Serving Options The Netopia Fir mware V ersion 5.4 includes a number of enhancements in the built-in DHCP IP address ser ver . These enhancements include: ■ The ability to exclude one or more [...]

IP Setup 6-25 Configuring the IP Address Server options T o access the enhanced DHCP ser ver functions, fr om the Main Menu navigate to Statistics & Logs and then Ser ved IP Addresses . The following example shows the Ser ved IP Addresses scr een after three clients have leased IP addresses. The first client did not provide a Host Name in its[...]

6-26 Firmware User Guide Y ou can select the entries in the Ser ved IP Addresses screen. Use the up and down ar r ow keys to move the selection to one of the entries in the list of ser ved IP addresses. Once you select an entr y , pressing Retur n displays an action pop-up menu that lists operations that can be per for med on that entr y . Possible[...]

IP Setup 6-27 ■ Details… is displayed if the entr y is associated with both a host name and a client identifier . Selecting Details… displays a pop-up menu that provides additional infor mation associated with the IP address. The pop-up menu includes the IP addr ess as well as the host name and client identifier supplied by the client to wh[...]

6-28 Firmware User Guide ■ Include is displayed if the entr y is either excluded or declined. An IP address is marked declined when a client to whom the DHCP ser ver of fers the address declines the address. A client declines an addr ess if it determines that a leased addr ess is already in use by another device. Selecting Include restor es the s[...]

IP Setup 6-29 The router’s Ether net IP address(es) will be automatically excluded from the addr ess ser ving pool(s) on star tup. Entries in the ser ved IP address list cor responding to the r outer’s Ethernet IP address(es) that have been automatically excluded on star tup are not selectable. Served IP Addresses -IP Address------Type----Expir[...]

6-30 Firmware User Guide DHCP Rela y Agent The Netopia Fir mware V ersion 5.4 of fers DHCP Relay Agent functionality , as defined in RFC1542. A DHCP r elay agent is a computer system or a router that is configur ed to for ward DHCP requests fr om clients on the LAN to a remote DHCP ser ver , and to pass the replies back to the requesting client s[...]

IP Setup 6-31 Select IP Address Ser ving and press Retur n. The IP Address Ser ving screen appears. Select IP Address Ser ving Mode . The pop-up menu of fers the choices of Disabled , DHCP Ser ver (the default), and DHCP Relay Agent . If you select DHCP Relay Agent and press Retur n, the screen changes as shown below . Now you can enter the IP addr[...]

6-32 Firmware User Guide Note: The remote DHCP ser ver(s) to which the Netopia Router is relaying DHCP r equests must be capable of ser vicing relayed r equests. Not all DHCP ser vers suppor t this featur e. For example, the DHCP ser ver in the Netopia Router does not . The DHCP ser ver(s) to which the Netopia Router is relaying DHCP r equests must[...]

IP Setup 6-33 1. Select Profile Name and enter a name for this connection pr ofile. It can be any name you wish. For example: the name of your ISP . 2. T oggle the Pr ofile Enabled value to Ye s or No . The default is Y es. 3. Select IP Profile Parameters and press Retur n. The IP Profile Parameters scr een appears. 4. T oggle or enter any IP [...]

6-34 Firmware User Guide 5. Select ADD PROFILE NOW and press Retur n. Y our new connection pr ofile will be added. If you want to view the connection profiles in your r outer , retur n to the W AN Configuration screen, and select Display/Change Connection Profile . The list of connection profiles is displayed in a scr olling pop-up screen. Mul[...]

IP Setup 6-35 By default, Multicast For warding is tuned of f (None). Y ou enable the r outer to transmit multicast data by selecting Tx. from the pull-down menu. If you enable Multicast For warding, you will see a new option IGMP V ersion . This lets you choose V1 or V2. If you know you will be communicating with other hosts that are limited to V1[...]

6-36 Firmware User Guide Typically , you will have a Connection Profile that you cr eated in Easy Setup. Y ou may have mor e. Select the Connection Profile that you want to use fr om the Display/Change Connection Profile menu, and then select IP Profile Parameters . By default, Multicast For warding is tur ned of f (None) on Connection Pr ofil[...]

Line Backup 7-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 7 7 7 7 L L L L ii i i n n n n e e e e B B B B a a a a c c c c k k k k u u u u p p p p The fir mware of fers line backup functionality in the event of a line failure on a DSL, Ethernet, or leased-line primar y W AN link. The fir mware suppor ts backup ■ to an external modem[...]

7-2 Firmware User Guide External Dial Bac kup Suppor t Netopia equipment that suppor ts the external dial backup featur e automatically display the serial por t configuration menus described in the following sections. Models that do not suppor t external dial backup do not display exter nal dial backup-related menus, but of fer menus for backup to[...]

Line Backup 7-3 The Choose Inter face to Configur e screen appears. Choose the inter face to configure for backup, Serial Por t Setup . The Serial Por t Configuration screen appears. WA N W AN Conf iguration Main Menu Setup WAN Configuration WAN (Wide Area Network) Setup... Display/Change Connection Profile... Add Connection Profile... Delete Co[...]

7-4 Firmware User Guide ■ The default mode is Console Only . This is the nor mal state for using a terminal emulation application to manage the router . See “Connecting a Console Cable to your Equipment” on page 1-5 . If you select Modem/Auto from the pull-down menu, the r outer becomes capable of auto detecting the presence of a modem or a c[...]

Line Backup 7-5 Note: • The modem cable should have a standard DB-9 female connector to connect to the console por t. This is the standard type of modem cable connector . • Macintosh users who use a USB-to-serial adapter to connect to the console serial por t can use a modem in Modem/Auto mode. However , your terminal emulator softwar e will no[...]

7-6 Firmware User Guide backup mode and connect via your modem. Note: Backup and Recover y have resolutions of five seconds. This is how often the r outer evaluates the state of the connections and makes decisions. ■ Select Ping Host Name or IP Address and enter an IP address or r esolvable DNS name that the router will ping. This is an optional[...]

Line Backup 7-7 Connection Pr ofiles The line backup feature allows you to configur e a complete Connection Profile for the backup por t, just as you do for your primar y W AN connection. In this way profiles ar e associated with a par ticular inter face. The profile should reflect the por t it is associated with. It should have switched char[...]

7-8 Firmware User Guide ■ From the Dial pop-up menu, you can choose whether to Dial Out Only , Dial In Only , or Dial In/Out (default). ■ Y ou can add the Number to Dial and an Alternate Site to Dial , if available. ■ Y ou can toggle Dial on Demand to Y es or No. This allows the r outer to determine whether or not to dial the backup number wh[...]

Line Backup 7-9 The Scheduled Connections screen appears. ■ Select Add Scheduled Connection and press Retur n. The Add Scheduled Connection screen appears. ■ T oggle Scheduled Connection Enable to On . ■ From the How Often pop-up menu, select Weekly and press Return. ■ From the Schedule Type pop-up menu, accept the default Forced Up and pre[...]

7-10 Firmware User Guide ■ T oggle all the days of the week to Ye s , and set the Scheduled Window Duration Per Day to 24:00 . This guarantees a 24X7 connection. Press Escape to r eturn to the Add Scheduled Connection screen. ■ Select Use Connection Profile , and press Retur n. A screen displays all of your Connection Pr ofiles. Select the on[...]

Line Backup 7-11 Select Backup Management/Statistics and press Retur n. Note: This option is only visible if backup is not Disabled. The Backup Management/Statistics screen appears. ■ Current Por t is a display-only field that shows which por t is cur r ently in operation. ■ Backup State is a display-only field that shows the cur rent state o[...]

7-12 Firmware User Guide connection. ■ Switchover Time is a display-only field that is only visible if backup or recover y is in pr ogress. It displays the time until either automatic Backup or Recover y . ■ The FORCE BACKUP/FORCE RECOVERY option is a selectable option that, depending on the cur rent state of backup, will force the switching o[...]

Line Backup 7-13 SNMP Suppor t The router suppor ts objects for deter mining the state of backup, as well as providing traps for the backup and recover y events. No objects suppor t configuration of backup or recover y . Bac kup Default Gate wa y Introduced in version 5.1.2, the fir mware of fers backup functionality to an alternate gateway typic[...]

7-14 Firmware User Guide The Backup Configuration screen appears. This screen is used to configur e the conditions under which backup will occur , if it will recover, and how the alternate gateway is configur ed. ■ Select Backup is and press Retur n. A pop-up menu allows you to select Disabled, Manual, or Automatic. Y ou enable backup by selec[...]

Line Backup 7-15 Use this setting with caution. Setting it to Y es may induce alter nating switching between Backup and Recover y Mode. This field will deter mine the recover y behavior of a Manual backup and Ping failure backup. These two failures ar e treated as Layer 2 failures. ■ If you enable Auto-Recover y on loss of Layer 2, the Layer 2 F[...]

7-16 Firmware User Guide Bac kup Management/Statistics If backup is enabled, the Statistics & Logs menu of fers a Backup Management/Statistics option. T o view Backup Management/Statistics, fr om the Main Menu select Statistics & Logs then Backup Management/Statistics and press Retur n. The Backup Management/Statistics screen appears. ■ C[...]

Line Backup 7-17 either one and pressing Retur n will force the link to switch to the other mode. Quic kView The QuickView screen now has an infor mation element to indicate which gateway is in use. Quick View 1/29/2002 01:05:35 PM Default IP Gateway: 0.0.0.0 CPU Load: 5% Unused Memory: 5582 KB Primary DNS Server: 0.0.0.0 Gateway installed -- Backu[...]

7-18 Firmware User Guide[...]

V oice Configuration 8-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 8 8 8 8 V V V V o o o o ii i i c c c c e e e e C C C C o o o o n n n n f f f f ii i i g g g g u u u u r r r r a a a a t t t t ii i i o o o o n n n n This chapter describes the telephony ser vices and configuration of the Netopia 4700-Series Integrated Access Devices [...]

8-2 Firmware User Guide central of fice, but not long distance or local calls. T oll Restriction Operation - PBX/Local Switching Mode: When you pick up the phone, you r eceive local PBX dial tone. When a 9 (or outside line code) is pressed, the IAD detects the digit and r eturns busy (locally generated). Incoming calls are allowed. Extension calls[...]

V oice Configuration 8-3 ■ Select V oice Gateway and from the pop-up menu, choose the type of voice gateway device to which you will be connected. The choices are: CopperCom, JetStr eam, T ollBridge, TDSoft, Zhone, or Alcatel. ■ Select Ring Cadence and press Retur n. A pop-up menu allows you to choose between 20Hz (the default), 25Hz, or 50Hz [...]

8-4 Firmware User Guide Echo cancellation is set to Y es by default. For or dinar y telephone handsets, echo cancellation should be set to Y es (tur ned on) to eliminate echoes on the voice line. T oggling a por t to No allows you to connect a fax machine or modem to the phone por t (since fax machines and modems automatically cancel echoes). If yo[...]

Monitoring T ools 9-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 9 9 9 9 M M M M o o o o n n n n ii i i t t t t o o o o r r r r ii i i n n n n g g g g T T T T o o o o o o o o ll l l s s s s This chapter discusses the Router’s device and network monitoring tools. These tools can provide statistical infor mation, repor t on cur rent ne[...]

9-2 Firmware User Guide General status Current Date: The cur rent date; this can be set with the Date and Time utility (see “Date and time” on page 2-42 ). Default IP Gateway: The router’s default gateway , which may be either manually configur ed or learned via DHCP . This is the value you assigned in the Default IP Gateway field. If you a[...]

Monitoring T ools 9-3 Current status The cur rent status section is a table showing the cur rent status of the DSL connection. For example: Profile Name: Lists the name of the connection pr ofile being used, if any . Rate: Shows the line rate for this connection. %Use: Indicates the average percent utilization of the maximum capacity of the chann[...]

9-4 Firmware User Guide Statistics & Logs When you are tr oubleshooting your Router, the Statistics & Logs screens provide insight into the r ecent event activities of the router . From the Main Menu go to Statistics & Logs and select one of the options described in the sections below . Event Histories The Netopia Fir mware V ersion 5.4[...]

Monitoring T ools 9-5 W AN Event Histor y The W AN Event Histor y screen lists a total of 128 events on the WAN. The most recent events appear at the top. Each entr y in the list contains the following infor mation: Date: Date of the event. Time: Time of the event. Event: A brief description of the event. Ch.: The channel involved in the event. The[...]

9-6 Firmware User Guide In the Statistics & Logs screen, select Device Event Histor y . The Device Event Histor y scr een appears. If the event histor y exceeds the size of the screen, you can scr oll through it by using SCROLL UP and SCROLL DOWN. T o scr oll up, select SCROLL UP at the top of the list and press Retur n. T o scroll down, select[...]

Monitoring T ools 9-7 IP Routing T able The IP routing table displays all of the IP r outes curr ently known to the Router. The routing table scr een represents a snapshot of the r outing table information at the time the scr een is first invoked. T o take a new snapshot, select Update at the bottom of the scr een and press Return. General Statist[...]

9-8 Firmware User Guide Physical Interface The top left side of the screen lists total packets r eceived and total packets transmitted for the following data por ts: ■ Ethernet ■ DSL Network Interface The bottom left side of the screen lists total packets r eceived and total packets transmitted: ■ IP (IP packets on the Ethernet) The right sid[...]

Monitoring T ools 9-9 System Inf ormation The System Infor mation screen gives a summar y view of the general system level values in the Router. From the Statistics & Logs menu select System Information . The System Infor mation screen appears. The infor mation display varies by model, firmwar e version, feature set, and so on. Y ou can tell a[...]

9-10 Firmware User Guide Simple Netw ork Management Pr otocol (SNMP) - V2c The Netopia Fir mware V ersion 5.4 includes a Simple Network Management Protocol (SNMP) agent, allowing monitoring and configuration by a standard SNMP manager . Netopia Routers and IADs now suppor t both SNMP-V1 and SNMP-V2c. Enterprise-specific SNMP Changes Enterprise-sp[...]

Monitoring T ools 9-11 The SNMP Setup screen From the Main Menu, select SNMP in the System Configuration screen and pr ess Return. The SNMP Setup screen appears. Follow these steps to configure the first thr ee items in the screen: 1. Select System Name and enter a descriptive name for the Router’s SNMP agent. 2. Select System Location and ent[...]

9-12 Firmware User Guide Community strings The Read-Only Community String and the Read/W rite Community String ar e like passwords that must be used by an SNMP manager quer ying or configuring the Netopia Fir mware V ersion 5.4. An SNMP manager using the Read-Only Community String can examine statistics and configuration infor mation from the rou[...]

Monitoring T ools 9-13 T o go to the IP Trap Receivers screen, select IP T rap Receivers . The IP T rap Receivers screen appears. Setting the IP trap receivers 1. Select Add IP Trap Receiver . 2. Select Receiver IP Address or Domain Name . Enter the IP address or domain name of the SNMP manager you want to receive the trap. 3. Select Community Stri[...]

9-14 Firmware User Guide[...]

Security 10-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 0 0 0 0 S S S S e e e e c c c c u u u u r r r r ii i i t t t t y y y y The Netopia Fir mware V ersion 5.4 provides a number of security featur es to help protect its configuration screens and your local network fr om unauthorized access. Although these features are optio[...]

10-2 Firmware User Guide Console Tiered Access – T w o P assw ord Le vels Netopia Fir mware V ersion 5.4 of fers tiered access control for gr eater security and protection against accidental or malicious misconfiguration. Ser vice providers and network administrators can now limit the access of other users to the various configuration screens t[...]

Security 10-3 For Windows XP users, the automatic discover y feature places an icon r epresenting the Netopia Gateway automatically in the “My Network Places” folder . Be sur e that the Windows XP ser vice Universal Plug and Play Device Host is enabled and r unning, other wise you might not see the icon. Double clicking the icon will launch a t[...]

10-4 Firmware User Guide Limited user configuration The Add Access Name/Password and Show/Change Access Name/Passwor ds screens allow you to select which configuration features a limited (non-Super user) user can access. From the Security Options scr een, select Add Access Name/Password . The Add Access Name/Passwor d screen appears. ■ Assign a[...]

Security 10-5 Y ou can toggle the default user privileges for each user . The defaults ar e set to minimize the possibility of an individual user inadver tently damaging the W AN connection. Exercise caution in assigning privileges other than these defaults to limited users. Adv anced Security Options The Advanced Security Options screen allows you[...]

10-6 Firmware User Guide ■ Select RADIUS Access Privileges , and from the pull-down menu, choose which access privilege you want this user to have: All , LAN , WA N , or for IADs only , VOX . If you assign any of these privileges, limited users will have full access to privileges associated with these inter faces. Y ou can customize these privile[...]

Security 10-7 User access passw ord Users must be able to change their names and passwords, r egardless of other security access restrictions. If a user does not have security access, then they will only be able to modify the password for their account. When a limited-access user logs into the router . and accesses the System Configuration menus, [...]

10-8 Firmware User Guide User menu diff erences Menus reflect the security access level of the user . Consequently , configuration menus will display dif fering options based upon the parameters a par ticular user is allowed to change. Some dif fer ences include: ■ Limited users (non-Super users) do not have access to Easy Setup. ■ All users [...]

Security 10-9 Based on access level, the Main Menu displays its configuration options according to the following diagram: W AN Configuration screens If a limited user is allowed W AN, Connection Profile, or PVC configuration access, the WAN Configuration option in the Main Menu is visible. If a limited user selects W AN Configuration in the M[...]

10-10 Firmware User Guide Connection Profiles The Super user can disallow limited user access to a par ticular Connection Profile. When adding a Connection Profile in the Add Connection Pr ofile screen the Super user can toggle the Superuser Accessible Only option to Ye s or No . This option is visible whether or not there ar e authorized usern[...]

Security 10-11 System Configuration menu The System Configuration menu is always available to all users. Based on access level, the System Configuration menu displays its configuration options according to the following diagram: Note: Network Address Translation (NA T) is displayed in this screen in or der to make access control simpler . Secur[...]

10-12 Firmware User Guide Utilities & Diagnostics menu Based on access level, the Utilities & Diagnostics menu displays its configuration options according to the following diagram: X-Modem File T ransfer menu Based on access level, the X-Modem File T ransfer menu displays its configuration options according to the following diagram: Stat[...]

Security 10-13 Based on access level, the Statistics & Logs menu displays its options according to the following diagram: Statistics & Logs WAN Event History... Device Event History... Voice Log... Voice Accounting Log... Voice Error Log... IP Routing Table... Served IP Addresses... Served IP Addresses... Accounting Statistics... Backup Man[...]

10-14 Firmware User Guide Quick Men us Quick Menus var y considerably between models, features, and access levels. The following is an example comparison of the Quick Menu as seen by the Super user and by a Limited user . Note: Console Configuration is always visible. A TM Circuits Configuration menu Y ou select A TM Circuits Configuration fr om[...]

Security 10-15 The A TM Cir cuits Configuration menu screen appears as follows: Note: Multiple A TM cir cuit configuration is suppor ted on multiple A TM-capable routers. Although some of the parameters of the Circuit Configuration scr eens per tain to V oice and Connection Pr ofiles, it is assumed that if the user has been granted PVC configu[...]

10-16 Firmware User Guide Protecting the Security Options screen The first screen you should pr otect is the Security Options screen, because it controls access to the configuration screens. Access to the Security Options scr een can be protected with a password. Select Password for This Scr een in the Security Options screen and enter a password[...]

Security 10-17 T o add a new user account, select Add User in the Security Options scr een and press Return. The Add Name With Write Access screen appears. Follow these steps to configure the new account: 1. Select Enter Name and enter a descriptive name (for example, the user’s first name). 2. Select Enter Password and enter a passwor d. 3. T [...]

10-18 Firmware User Guide T o r estrict T elnet access, select Security in the Advanced Configuration menu. The Security Options screen will appear . Ther e are two levels of T elnet restriction available: ■ T o r estrict T elnet access to the SNMP scr eens, select Enable T elnet Access to SNMP Screens and toggle it to No . (See “SNMP traps”[...]

Security 10-19 Each inspector has a specific task. One inspector’s task may be to examine the destination address of all outgoing packages. That inspector looks for a cer tain destination—which could be as specific as a street address or as br oad as an entire countr y—and checks each package’s destination address to see if it matches tha[...]

10-20 Firmware User Guide If the package does not match the first inspector’s criteria, it goes to the second inspector , and so on. Y ou can see that the order of the inspectors in the line is ver y impor tant. For example, let’s say the first inspector’s orders ar e to send along all packages that come from Rome, and the second inspector?[...]

Security 10-21 P arts of a filter A filter consists of criteria based on packet attributes. A typical filter can match a packet on any one of the following attributes: ■ The source IP addr ess (where the packet was sent from) ■ The destination IP address (wher e the packet is going) ■ The type of higher-layer Internet pr otocol the packet [...]

10-22 Firmware User Guide P or t number comparisons A filter can also use a comparison option to evaluate a packet’s source or destination por t number . The comparison options are: No Compare: No comparison of the por t number specified in the filter with the packet’s por t number . Not Equal T o: For the filter to match, the packet’s po[...]

Security 10-23 Putting the parts tog ether When you display a filter set, its filters are displayed as r ows in a table: The table’s columns cor respond to each filter’s attributes: #: The filter’s priority in the set. Filter number 1, with the highest priority , is first in the table. Source IP Addr: The packet sour ce IP address to mat[...]

10-24 Firmware User Guide Filtering example #1 Returning to our filtering r ule example fr om above (see page 10-20 ), look at how a rule is translated into a filter. Star t with the r ule, then fill in the filter’s attributes: 1. The r ule you want to implement as a filter is: Block all T elnet attempts that originate fr om the remote host [...]

Security 10-25 This filter blocks any packets coming from a r emote network with the IP network address 200.233.14.0. The 0 at the end of the address signifies any host on the class C IP network 200.233.14.0. If, for example, the filter is applied to a packet with the source IP addr ess 200.233.14.5, it will block it. In this case, the mask, whi[...]

10-26 Firmware User Guide An approac h to using filters The ultimate goal of network security is to prevent unauthorized access to the network without compr omising authorized access. Using filter sets is par t of reaching that goal. Each filter set you design will be based on one of the following approaches: ■ That which is not expressly pr o[...]

Security 10-27 3. View , change, or delete individual filters and filter sets. The sections below explain how to execute these steps. Adding a filter set Y ou can create up to eight dif ferent custom filter sets. Each filter set can contain up to 16 output filters and up to 16 input filters. T o add a new filter set, select Add Filter Set i[...]

10-28 Firmware User Guide Adding filter s to a filter set There ar e two kinds of filters you can add to a filter set: input and output. Input filters check packets received from the Inter net, destined for your network. Output filters check packets transmitted from your network to the Internet. Packets in the Netopia Firmware V ersion 5.4 pa[...]

Security 10-29 Note: There ar e two groups of items in this screen, one for input filters and one for output filters. In this section, you’ll learn how to add an input filter to a filter set. Adding an output filter works exactly the same way , providing you keep the dif ferent sour ce and destination perspectives in mind. 1. T o add a filt[...]

10-30 Firmware User Guide 3. If you want the filter to for ward packets that match its criteria to the destination IP addr ess, select For ward and toggle it to Ye s . If For war d is toggled to No , packets matching the filter’s criteria will be discarded. 4. Select Source IP Address and enter the sour ce IP address this filter will match on.[...]

Security 10-31 Deleting filters T o delete a filter, select Delete Input Filter or Delete Output Filter in the Display/Change Filter Set screen to display a table of filters. Select the filter from the table and pr ess Return to delete it. Press Escape to exit the table without deleting the filter . Moving filter s T o r eor ganize the filte[...]

10-32 Firmware User Guide Basic Firewall blocks undesirable traf fic originating from the WAN (in most cases, the Internet), but for wards all traf fic originating from the LAN. It follows the conser vative “that which is not expressly per mitted is prohibited” approach: unless an incoming packet expr essly matches one of the constituent inpu[...]

Security 10-33 Output filter 1: This filter for wards all outgoing traf fic to make sure that no outgoing connections from the LAN are blocked. Basic Firewall is suitable for a LAN containing only client hosts that want to access ser vers on the WAN, but not for a LAN containing ser vers providing ser vices to clients on the WAN. Basic Firewall?[...]

10-34 Firmware User Guide FTP sessions. T o allow WAN-originated FTP sessions to a LAN-based FTP ser ver with the IP address a.b.c.d (cor responding to a numbered IP addr ess such as 163.176.8.243), inser t the following input filter ahead of the cur rent input filter 1: ■ Enabled: Y es ■ For ward: Y es ■ Source IP Addr ess: 0.0.0.0 ■ Sou[...]

Security 10-35 The new filterset screen appears as follows: T o use the policy-based r outing feature, you create a filter that for war ds the traf fic. ■ T oggle For war d to Ye s . This will display the For ce Routing options. ■ T oggle For ce Routing to Ye s . ■ Enter the Gateway IP Address in standar d dotted-quad notation to which the[...]

10-36 Firmware User Guide Note: Default For warding Filter If you create one or mor e filters that have a matching action of for ward , then action on a packet matching none of the filters is to block any traf fic. Therefor e, if the behavior you want is to force the routing of a cer tain type of packet and pass all others thr ough the nor mal r[...]

Security 10-37 Fire wall T utorial General firewall terms Filter rule : A filter set is comprised of individual filter r ules. Filter set : A grouping of individual filter r ules. Firewall : A component or set of components that r estrict access between a protected network and the Internet, or between two networks. Host : A workstation on the n[...]

10-38 Firmware User Guide Example TCP/UDP P or ts Firewall design rules There ar e two basic rules to fir ewall design: ■ “What is not explicitly allowed is denied.” and ■ “What is not explicitly denied is allowed.” The first r ule is far more secure, and is the best appr oach to firewall design. It is far easier (and more secur e) t[...]

Security 10-39 and a packet goes through these r ules destined for FTP , the packet would for ward thr ough the first filter r ule (WWW), match the second r ule (FTP), and the packet is allowed through. Even though the next r ule is to deny all FTP traf fic, the FTP packet will never make it to this rule. Binary representation It is easiest when[...]

10-40 Firmware User Guide Established connections The TCP header contains one bit called the ACK bit (or TCP Ack bit). This ACK bit appears only with TCP , not UDP . The ACK bit is par t of the TCP mechanism that guarantees the deliver y of data. The ACK bit is set whenever one side of a connection has received data fr om the other side. Only the ?[...]

Security 10-41 Example network Example filters Example 1 Incoming packet has the source addr ess of 200.1.1.28 Less Than or Equal Any por t less than or equal to the por t defined Equal Matches only the por t defined Greater Than or Equal Matches the por t or any por t greater Greater Than Matches anything gr eater than the por t defined Filter[...]

10-42 Firmware User Guide This incoming IP packet has a source IP addr ess that matches the network address in the Source IP Addr ess field (00000000) in the Netopia Fir mware V ersion 5.4. This will not for ward this packet. Example 2 Incoming packet has the source addr ess of 200.1.1.184. This incoming IP packet (10000000) has a source IP addr e[...]

Security 10-43 Since the Source IP Network Addr ess in the Router is 01100000, and the source IP address after the logical AND is 1011000, this r ule does not match and this packet will be for warded. Example 4 Incoming packet has the source addr ess of 200.1.1.104. Since the Source IP Network Addr ess in the Router is 01100000, and the source IP a[...]

10-44 Firmware User Guide Since the Source IP Network Addr ess in the Router is 01100000, and the source IP address after the logical AND is 01100000, this r ule does match and this packet will not be for warded. This r ule masks of f a single IP address. Configuration Management Netopia Fir mware V ersion 5.4 of fers a Configuration Management f[...]

Security 10-45 Select Save Current Configuration as , and press Retur n. The Save Cur rent Configuration screen appears. Enter a descriptive name for your cur rent configuration, select SA VE , and press Retur n. Y our configuration will be saved to the flash memor y , and you will be retur ned to the Configuration Management screen. If you c[...]

10-46 Firmware User Guide A warning scr een will ask you to confirm your choice. Configuration Management Save Current Configuration as... +-Configuration Name---Type---+ Replace Existing Configuration... +-----------------------------+ Boot from a Configuration... | Backup Config Binary | Delete a Configuration... | HappyInternet Binary | | | +--[...]

Security 10-47 TFTP and X-Modem Y ou can also send or receive your stor ed configuration files via TFTP or X-Modem. Y ou select the stored configuration files from pull-down menus in the TFTP or X-Modem File T ransfer screens in the Utilities & Diagnostics menu, as shown. Trivial File Transfer Protocol (TFTP) TFTP Server Name: Firmware File[...]

10-48 Firmware User Guide Call Filtering Netopia Fir mware V ersion 5.4 suppor ts a call filtering mechanism that lets you control which packets cause connections to be established and which packets cause connections to be maintained (that is, to not time out due to inactivity). This feature is par t of the Filter Set management component of the ?[...]

Security 10-49 This pop-up menu allows you to configure what action will be taken for packets that the filter r ule specifies should be for warded. ■ If you set Call Placement/Idle Reset to No Change (the default), no change will be made to the call filtering attribute associated with the packet. If no other filter r ule with its Call Placem[...]

10-50 Firmware User Guide[...]

Utilities and Diagnostics 11-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 1 1 1 1 U U U U t t t t ii i i ll l l ii i i t t t t ii i i e e e e s s s s a a a a n n n n d d d d D D D D ii i i a a a a g g g g n n n n o o o o s s s s t t t t ii i i c c c c s s s s A number of utilities and tests are available for system diagnostic a[...]

11-2 Firmware User Guide Ping The Netopia Fir mware V ersion 5.4 Router includes a standar d Ping test utility . A Ping test generates IP packets destined for a par ticular (Ping-capable) IP host. Each time the tar get host receives a Ping packet, it retur ns a packet to the original sender . Ping allows you to see whether a par ticular IP destinat[...]

Utilities and Diagnostics 11-3 Status: The cur rent status of the Ping test. This item can display the status messages shown in the able below: Packets Out: The number of packets sent by the Ping test. Packets In: The number of retur n packets received from the tar get host. T o be considered on time, r eturn packets are expected back befor e the n[...]

11-4 Firmware User Guide Packets Lost: The number of packets unaccounted for , shown in total and as a per centage of total packets sent. This statistic may be updated during the Ping test, and may not be accurate until after the test is over . However , if an escalating one-to-one corr espondence is seen between Packets Out and Packets Lost , and [...]

Utilities and Diagnostics 11-5 3. Select Timeout (seconds) to set when the trace will timeout for each hop, up to 10 seconds. The default is 3 seconds. 4. Select Use Reverse DNS to learn the names of the routers between the Netopia Router and the destination router . The default is Y es. 5. Select ST ART TRACE ROUTE and pr ess Return. A scrolling s[...]

11-6 Firmware User Guide menu and press Retur n. ■ T o end a suspended session, select T er minate Suspended Session . Select a session from the pop-up menu and press Retur n. F actory Defaults Y ou can reset the Router to its factor y default settings. In the Utilities & Diagnostics screen, select Rever t to Factor y Defaults and press Retur[...]

Utilities and Diagnostics 11-7 The sections below describe how to update the Router’s fir mware and how to download and upload configuration files. Updating firmware Fir mware updates may be available periodically from Netopia or fr om a site maintained by your organization’s network administrator . The Router ships with an embedded operati[...]

11-8 Firmware User Guide ■ Select GET ROUTER FIRMW ARE FROM SERVER and press Retur n. Y ou will see the following dialog box: ■ Select CANCEL to exit without downloading the file, or select CONTINUE to download the file. The system will reset at the end of the file transfer to put the new fir mware into ef fect. While the system resets, the[...]

Utilities and Diagnostics 11-9 ■ If you choose to download the configuration file, the TFTP T ransfer State item will change from Idle to Reading Config . The TFTP Current Transfer Bytes item will reflect the number of bytes transfer red. Uploading configuration files Using TFTP , you can send a file containing a snapshot of the router’s[...]

11-10 Firmware User Guide Updating firmware Fir mware updates may be available periodically from Netopia or fr om a site maintained by your organization’s network administration. Follow these steps to update the Router’s fir mware: 1. Make sure you have the fir mware file on disk and know the path to its location. 2. Select Send Firmwar e t[...]

Utilities and Diagnostics 11-11 Caution! Do not manually power down or reset the Router while it is automatically r esetting or it could be damaged. Downloading configuration files The Router can be configured by downloading a configuration file. The downloaded file r econfigures all of the Router’s parameters. Configuration files are av[...]

11-12 Firmware User Guide 3. Select CANCEL to exit without uploading the file, or select CONTINUE to upload the file. If you choose CONTINUE, you will have ten seconds to use your ter minal emulation software to initiate an XMODEM transfer of the configuration file. If you fail to initiate the transfer in that time, the dialog box will disappea[...]

Utilities and Diagnostics 11-13 Select T1 Line Statistics / Diagnostics and press Retur n. The T1 Line Statistics / Diagnostics screen appears. The screen displays the cur rent condition of tests that you r un. The counters display the occur rences of the indicated events in fifteen-minute increments, shifting the totals to the column to the right[...]

11-14 Firmware User Guide 24 hours: Cumulative statistics, for the preceding 24-hour period. Line Status: Conditions may be Nor mal Operation, Red Alarm, Y ellow Alar m, or (Rmt/Lcl) LoopBack Loopback Status: Cur rent loopback condition T ests: Of fers a pop-up menu with the following options: ■ Normal - Clear Loopback clears any local loopbacks [...]

T roubleshooting A-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x A A A A T T T T r r r r o o o o u u u u b b b b ll l l e e e e s s s s h h h h o o o o o o o o t t t t ii i i n n n n g g g g This appendix is intended to help you troubleshoot pr oblems you may encounter while setting up and using the Netopia Fir mware V ersion 5.4[...]

A-2 Firmware User Guide Note: If you are attempting to modify the IP addr ess or subnet mask from a previous, successful configuration attempt, you will need to clear the IP address or r eset your Router to the factor y default before reinitiating the configuration pr ocess. For fur ther information on resetting your Router to factor y default, s[...]

T roubleshooting A-3 Ho w to Reset the Router to F actory Defaults Lose your password? This section shows how to r eset the router so that you can access the console screens once again. Keep in mind that all of your connection profiles and settings will need to be r econfigured. If you don't have a password, the only way to get back into the[...]

A-4 Firmware User Guide Technical Support Netopia, Inc. is committed to providing its customers with r eliable products and documentation, backed by excellent technical suppor t. Before contacting Netopia Look in this guide for a solution to your problem. Y ou may find a solution in this tr oubleshooting appendix or in other sections. Check the in[...]

Understanding IP Addressing B-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x B B B B U U U U n n n n d d d d e e e e r r r r s s s s t t t t a a a a n n n n d d d d ii i i n n n n g g g g II I I P P P P A A A A d d d d d d d d r r r r e e e e s s s s s s s s ii i i n n n n g g g g This appendix is a brief general introduction to I[...]

B-2 Firmware User Guide IP addresses indicate both the identity of the network and the identity of the individual host on the network. The number of bits used for the network number and the number of bits used for the host number can var y , as long as cer tain r ules are followed. The local network manager assigns IP host numbers to individual mac[...]

Understanding IP Addressing B-3 Subnet numbers appear within IP addresses, along with network numbers and host numbers. Since an IP address is always 32 bits long, using subnet numbers means either the network number or the host numbers must use fewer bits in order to leave r oom for the subnet numbers. Since the InterNIC assigns the network number[...]

B-4 Firmware User Guide Network configuration Below is a diagram of a simple network configuration. The ISP is providing a Class C addr ess to the customer site, and both networks A and B want to gain Internet access thr ough this address. Router B connects to Router A and is provided Inter net access through Routers A and B. Router A: IP Address[...]

Understanding IP Addressing B-5 Backgr ound The IP addresses and r outing configurations for the devices shown in the diagram are outlined below . In addition, each individual field and its meaning are described. The IP Address and Subnet Mask fields define the IP addr ess and subnet mask of the device's Ethernet connection to the network [...]

B-6 Firmware User Guide There ar e two schemes for distributing the remaining IP addresses: ■ Manually give each computer an address ■ Let the Router automatically distribute the addresses These two methods are not mutually exclusive; you can manually issue some of the addr esses while the rest are distributed by the Router. Using the r outer i[...]

Understanding IP Addressing B-7 Configuration This section describes the specific IP address lease, r enew , and r elease mechanisms for both the Mac and PC, with either DHCP or MacIP address ser ving. DHCP address serving Windows 95 workstation: ■ The Win95 workstation requests and r enews its lease ever y half hour . ■ The Win95 workstation[...]

B-8 Firmware User Guide ■ The Router releases the DHCP addr ess back to the available DHCP address pool exactly one hour after the last-heard lease r equest. Some other DHCP implementations may hold on to the lease for an additional time after the lease expired to act as a buf fer for variances in clocks between the client and ser ver . MacIP ser[...]

Understanding IP Addressing B-9 In any situation where a device is dialing into a Netopia r outer , the router may need to be configur ed to ser ve IP via the W AN inter face. This is only a requir ement if the calling device has not been configured locally to know what its address(es) ar e. So when a client, dialing into a Netopia router's [...]

B-10 Firmware User Guide The figure above shows an example of a block of IP addr esses being distributed corr ectly . The example follows these r ules: ■ An IP address must not be used as a static addr ess if it is also in a range of addresses being distributed by DHCP or MacIP . ■ A single IP address range is used by all the addr ess-ser ved [...]

Understanding IP Addressing B-11 Nested IP Subnets Under cer tain circumstances, you may want to cr eate remote subnets from the limited number of IP addr esses issued by your ISP or other authority . Y ou can do this using connection profiles. These subnets can be nested within the range of IP addresses available to your network. For example, sup[...]

B-12 Firmware User Guide Routers B and C (which could also be Routers) ser ve the two remote networks that ar e subnets of a.b.c.0. The subnetting is accomplished by configuring the Router with connection profiles for Routers B and C (see the following table). The Router’s connection profiles for Routers B and C cr eate entries in its IP routi[...]

Understanding IP Addressing B-13 Let’s see how a packet from the Inter net gets routed to the host with IP address a.b.c.249, which is ser ved by Router C. The packet first ar rives at Router A, which delivers it to its local network (a.b.c.0). The packet is then received by the Router, which examines its destination IP addr ess. The Router comp[...]

B-14 Firmware User Guide The following diagram illustrates the IP address space taken up by the two r emote IP subnets. Y ou can see from the diagram why the ter m nested is appropriate for describing these subnets. Br oadcasts As mentioned earlier , binar y IP host or subnet addresses composed entirely of ones or zeros ar e reser ved for broadcast[...]

Binary Conversion T able C-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x C C C C B B B B ii i i n n n n a a a a r r r r y y y y C C C C o o o o n n n n v v v v e e e e r r r r s s s s ii i i o o o o n n n n T T T T a a a a b b b b ll l l e e e e This table is provided to help you choose subnet numbers and host numbers for IP and [...]

C-2 Firmware User Guide Decimal Binar y Decimal Binary Decimal Binar y Decimal Binary 128 10000000 160 10100000 192 11000000 224 11100000 129 10000001 161 10100001 193 11000001 225 11100001 130 10000010 162 10100010 194 11000010 226 11100010 131 10000011 163 10100011 195 11000011 227 11100011 132 10000100 164 10100100 196 11000100 228 11100100 133 [...]

Index-1 II I I n n n n d d d d e e e e x x x x A add static route 6-8 ADSL Line Configuration 2-2 advanced configuration features 2-35 ATMP 4-10 tunnel options 4-8 B backup default gateway 7-13 backup, line 7-1 basic firewall 10-32 BootP 6-17 clients 6-23 broadcasts B-14 C change static route 6-9 community strings 9-12 configuration troubleshooting[...]

Index-2 11 with TFTP 11-8 with XMODEM 11-11 Dynamic Host Configuration Protocol (DHCP) 6-17 Dynamic Host Configuration Protocol, see DHCP Dynamic WAN 6-17 E Easy Setup navigating 1-7 encryption 4-3 , 4-7 , 4-10 , 5-1 event history device 9-5 WAN 9-5 Exposed Addresses 2-40 F filter parts 10-21 parts of 10-21 filter priority 10-19 filter set adding 1[...]

Index-3 static B-8 IP passthrough 3-27 IP setup 6-2 IP trap receivers deleting 9-13 modifying 9-13 setting 9-13 viewing 9-13 IPsec 4-3 , 4-7 , 5-1 L latency 10-35 LED status 9-3 LEDs 9-3 line backup 7-1 backup IP gateway 7-15 connection profiles 7-7 management and statistics 7-10 , 7- 16 scheduled connections 7-8 WAN configuration 7-2 , 7-3 M MIBs [...]

Index-4 port number comparisons 10-22 port numbers 10-21 PPTP 4-10 tunnel options 4-4 PVC 2-16 Q quality of service 10-35 Quick View 9-1 R restarting the system 11-12 restricting telnet access 10-17 RFC-1483 Transparent Bridging 2-44 RIP-2 MD5 Authentication 6-10 router to serve IP addresses to hosts 6- 1 routing tables IP 6-6 , 9-7 S scheduled con[...]

Index-5 defined 11-6 downloading configuration files 11-8 updating firmware 11-7 uploading configuration files 11-9 TFTP, transferring files 11-6 tiered access 10-2 TOS bit 10-35 Trivial File Transfer Protocol (TFTP) 11-6 Trivial File Transfer Protocol, see TFTP troubleshooting A-1 configuration PC A-1 event histories 9-4 trusted host 10-33 trusted[...]

Index-6[...]