Netopia R910 Bedienungsanleitung

Net opia ™ R910 Ethernet R outer f or DSL and Cable Modems User’s Refer ence Guide[...]

Copyright ©2000, Netopia, Inc., v .0800 All rights reser ved. Printed in the U.S.A. This manual and any associated ar twork, software, and product designs are copyrighted with all rights reser ved. Under the copyright laws such materials may not be copied, in whole or par t, without the prior written consent of Netopia, Inc. Under the law , copyin[...]

G B Chapter 1 — Introduction .......................................................... 1-9 Over view ........................................................................ 1-9 Features and capabilities ................................................ 1-9 How to use this guide ................................................... 1-10 Chapter 2 ?[...]

iv User’ s Reference Guide Connecting a console cable to your router ...................... 6-33 Navigating through the console scr eens ......................... 6-34 Chapter 7 — Easy Setup ......................................................... 7-35 Easy Setup console screens .......................................... 7-35 Accessing the Eas[...]

Contents v G Static routes ....................................................... 9-62 IP address ser ving ........................................................ 9-66 IP Address Pools ................................................. 9-68 DHCP NetBIOS Options ........................................ 9-70 Chapter 10 — Vir tual Private Networks [...]

vi User’ s Reference Guide Chapter 12 — Monitoring T ools ........................................... 12-109 Quick View status over view ....................................... 12-109 General status ................................................ 12-110 Status lights ................................................... 12-110 Statistics & L[...]

Contents vii G Example filters ................................................ 13-147 RADIUS Client Suppor t .............................................. 13-151 RADIUS client configuration .............................. 13-151 Chapter 14 — Utilities and Diagnostics ............................... 14-155 Ping .................................[...]

viii User’ s Reference Guide Example: Working with a Class C subnet ............. B-177 Distributing IP addresses ............................................ B-177 T echnical note on subnet masking ...................... B-178 Configuration .................................................... B-179 Manually distributing IP addresses ...........[...]

Introduction 1-9 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 II I I n n n n t t t t r r r r o o o o d d d d u u u u c c c c t t t t ii i i o o o o n n n n Overview The Netopia R910 Ethernet Router is a stand-alone, multipr otocol broadband r outer for connecting diverse local area networks (LANs) to the Inter net and other remot[...]

1-10 User’ s Reference Guide How to use this guide This guide is designed to be your single source for infor mation about your Netopia R910 Ether net Router. It is intended to be viewed on-line, using the power ful featur es of the Adobe Acrobat Reader . The infor mation display has been deliberately designed to present the maximum infor mation i[...]

Setting Up Internet Services 2-11 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 2 2 2 2 S S S S e e e e t t t t t t t t ii i i n n n n g g g g U U U U p p p p II I I n n n n t t t t e e e e r r r r n n n n e e e e t t t t S S S S e e e e r r r r v v v v ii i i c c c c e e e e s s s s This chapter describes how to obtain and set up Interne[...]

2-12 User’ s Reference Guide Local LAN IP address information to obtain Y our ISP will need to pr ovide you with the following infor mation: ■ The default gateway IP address ■ Remote IP address ■ Local IP address or addr esses and subnet mask Note: In a single IP address ser vice, your ISP will r efer to your computer’s IP address. Howeve[...]

Making the Physical Connections 3-13 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 3 3 3 3 M M M M a a a a k k k k ii i i n n n n g g g g t t t t h h h h e e e e P P P P h h h h y y y y s s s s ii i i c c c c a a a a ll l l C C C C o o o o n n n n n n n n e e e e c c c c t t t t ii i i o o o o n n n n s s s s This section tells you how to[...]

3-14 User’ s Reference Guide What you need Locate all items that you need for the installation. Included in your router package ar e: ■ The Netopia R910 Ethernet Router ■ A power adapter and cord with a mini-DIN8 connector ■ Two RJ-45 cables (one for the Ethernet por t on your PC; one for the Line por t on the router) ■ A DB-9 console cab[...]

Making the Physical Connections 3-15 2. Connect one end of one of the RJ-45 cables to the Line 1 por t and the other end to your Inter net modem’s Ethernet por t. DO NOT CONNECT IT DIRECTL Y TO A TELCO LINE OUTLET . 3. Connect one end of one of the RJ-45 cables to any of the Ethernet hub por ts on the router , and the other end to the Ethernet po[...]

3-16 User’ s Reference Guide Netopia R910 Ethernet Router status lights The figure below r epresents the Netopia R910 status light (LED) panel. Netopia R910 LED front panel The following table summarizes the meaning of the various LED states and colors: When this happens... the LEDs... Power is on 1 is green . Data is transmitted or received 8 ?[...]

Connecting to Y our Local Area Network 4-17 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 4 4 4 4 C C C C o o o o n n n n n n n n e e e e c c c c t t t t ii i i n n n n g g g g t t t t o o o o Y Y Y Y o o o o u u u u r r r r L L L L o o o o c c c c a a a a ll l l A A A A r r r r e e e e a a a a N N N N e e e e t t t t w w w w o o o o r r [...]

4-18 User’ s Reference Guide After Using the Netopia R910 Ethernet Router, you can connect multiple computers to the Inter net with a single user account. using a DSL modem with a Netopia R910 using a cable modem with a Netopia R910 While this network model is typical, other network models are possible. For example, you may choose to attach the E[...]

Connecting to Y our Local Area Network 4-19 Application software: This is the softwar e you use to send e-mail, browse the World Wide W eb, r ead newsgroups, etc. These applications may r equire some configuration. Examples include the Eudora e-mail client and the Web browsers Microsoft Inter net Explorer and Netscape Navigator . TCP/IP stack: Thi[...]

4-20 User’ s Reference Guide Connecting to an Ethernet network The Netopia R910 suppor ts Ether net connections through its four Ether net por ts. The r outer automatically detects which Ethernet por t is in use. Y ou can connect 10Base-T networks to the Netopia R910. The following table displays some impor tant attributes of these connections. 1[...]

Connecting to Y our Local Area Network 4-21 The Netopia R910 in a 10Base-T network T o connect your 10Base-T network to the Netopia R910 thr ough an Ethernet por t, use a 10Base-T cable with RJ-45 connectors. If you have more than four devices to connect, you can attach additional devices using a 10Base-T hub, using a cross-over cable. The Netopia [...]

4-22 User’ s Reference Guide[...]

Configuring TCP/IP 5-23 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 5 5 5 5 C C C C o o o o n n n n f f f f ii i i g g g g u u u u r r r r ii i i n n n n g g g g T T T T C C C C P P P P // / / II I I P P P P Be sure the computer you use to configur e your Netopia R910 has TCP/IP software and har dware pr operly configured to work wit[...]

5-24 User’ s Reference Guide Configuring TCP/IP on Windows 95 or 98 Be sure TCP/IP is installed and configur ed on your Windows computer . The following is a quick guide to configuring TCP/IP for Windows machines. Configuring TCP/IP in a Windows machine requir es the following: ■ An Ethernet car d (also known as a network adapter) ■ The T[...]

Configuring TCP/IP 5-25 Static configuration (optional) If you are manually configuring fr om a fixed or static IP address, per for m the following: Note: More details about Windows 95 TCP/IP configuration (including dial-up) can be found in T echnote NIR_027, “Windows 95 TCP/IP Proper ties and the Netopia Router ,” located on the Netopia [...]

5-26 User’ s Reference Guide Configuring TCP/IP on a Macintosh Computer The following is a quick guide to configuring TCP/IP for MacOS computers. Configuring TCP/IP on a Macintosh computer requir es the following: ■ Y ou must have either Open T ranspor t or MacTCP installed. Note: If you want to use the Dynamic Host Configuration Protocol ([...]

Configuring TCP/IP 5-27 Static configuration (optional) If you are manually configuring fr om a fixed or static IP address, then per for m the following: 1. Go to the Apple menu. Select Control Panels and then TCP/IP or MacTCP . 2. With the TCP/IP window open, go to the Edit menu and select User Mode . Choose Advanced and click OK . In the MacT[...]

5-28 User’ s Reference Guide Dynamic configuration using MacIP (optional) If you want to use MacIP to dynamically assign IP addresses to the Macintosh computers on your network you must install the optional AppleT alk feature set kit. Note: Y ou cannot use MacIP dynamic configuration to configur e your Netopia R910 Ethernet to Ether net Router[...]

Configuring TCP/IP 5-29 Using Classic Networking (MacTCP) 1. Go to the Apple Menu. Select Control Panels and then Network . 2. In the Network window , select EtherT alk . 3. Go back to the Apple menu. Select Control Panels and then MacTCP . 4. Select EtherT alk . From the pull-down menu under EtherT alk, select an available zone; then click the Mo[...]

5-30 User’ s Reference Guide[...]

Console-Based Management 6-31 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 6 6 6 6 C C C C o o o o n n n n s s s s o o o o ll l l e e e e - - - - B B B B a a a a s s s s e e e e d d d d M M M M a a a a n n n n a a a a g g g g e e e e m m m m e e e e n n n n t t t t Console-based management is a menu-driven inter face for the capabilities[...]

6-32 User’ s Reference Guide more than one ser vice pr ovider or remote site. ■ The System Configuration menus display and per mit changing: ■ Network protocols setup. See Chapter 9, “IP Setup and Network Addr ess T ranslation.” ■ Filter sets (firewalls). See “About filters and filter sets” on page 13-126. ■ IP address ser vin[...]

Console-Based Management 6-33 Configuring T elnet software If you are configuring your r outer using a T elnet session, your computer must be r unning a T elnet software program. ■ If you connect a PC with Microsoft Windows, you can use a Windows T elnet application or simply r un T elnet from the Star t menu. ■ If you connect a Macintosh com[...]

6-34 User’ s Reference Guide Launch your ter minal emulation software and configur e the communications software for the values shown in the table below . These ar e the default communication parameters that the Netopia R910 uses. Navigating thr ough the console screens Use your keyboard to navigate the Netopia R910’s configuration scr eens, [...]

Easy Setup 7-35 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 7 7 7 7 E E E E a a a a s s s s y y y y S S S S e e e e t t t t u u u u p p p p This chapter describes how to use the Easy Setup console screens on your Netopia R910 Ether net Router. After completing the Easy Setup console screens, your r outer will be ready to connect to the [...]

7-36 User’ s Reference Guide A screen similar to the following Main Menu appears: If you do not see the Main Menu, verify that: ■ The computer used to view the console screen has its serial por t connected to the Netopia R910’s Console por t or an Ether net connection to one of its Ethernet por ts. See “Connecting a console cable to your ro[...]

Easy Setup 7-37 Quick Easy Setup connection path This section may be all you need to do to configure your Netopia R910 Ether net Router to connect to the Internet. If your ISP supports DHCP Y our Netopia R910 Ether net Router comes preconfigur ed with the ability to accept an IP address dynamically assigned by your ISP . T o do this, it acts as a[...]

7-38 User’ s Reference Guide The Main Menu appears. 2. Select the first item on the Main Menu list, Easy Setup . Press Retur n to bring up the Easy Setup menu screen. 3. Press the Down ar r ow key until the editable field labelled Local W AN IP Addr ess is highlighted. 4. Type the IP Address your ISP gave you. Pr ess Return. The next field Loc[...]

Easy Setup 7-39 Mor e Easy Setup options Y ou always begin Easy Setup by selecting Easy Setup in the Main Menu, then pressing Retur n. The W AN Ethernet Configuration scr een appears. W AN Ethernet Configuration The W AN Ethernet Configuration scr een is where you configur e the parameters that control the Netopia R910’s connection to a speci[...]

7-40 User’ s Reference Guide IP Easy Setup The IP Easy Setup screen is wher e you enter infor mation about your Netopia Router’s: ■ Ethernet IP addr ess ■ Ethernet Subnet mask ■ Domain Name ■ Domain Name Ser ver IP address ■ Default gateway IP address ■ Whether to ser ve IP addresses or not Consult with your network administrator to[...]

Easy Setup 7-41 Note: If the Netopia R910’s W AN inter face is acting as a DHCP client, do not change the default settings for Steps 3, 4, and 5. 4. Select Primar y Domain Name Ser ver and enter the IP address your ISP has given you. An alter nate or Secondar y Domain Name Ser ver field will appear , where you can enter a secondar y DNS IP addre[...]

7-42 User’ s Reference Guide 1. Select REST ART DEVICE . A prompt asks you to confir m your choice. 2. Select CONTINUE to restar t the Netopia Router and have your selections take ef fect. Note: Y ou can also r estar t the system at any time by using the Restar t System utility (see “Restar ting the system” on page 14-166 ) or by turning the[...]

W AN and System Configuration 8-43 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 8 8 8 8 W W W W A A A A N N N N a a a a n n n n d d d d S S S S y y y y s s s s t t t t e e e e m m m m C C C C o o o o n n n n f f f f ii i i g g g g u u u u r r r r a a a a t t t t ii i i o o o o n n n n Console-based management is a menu-driven inter face[...]

8-44 User’ s Reference Guide ■ Address Translation Enabled allows you to specify whether or not the router per for ms Network Addr ess T ranslation (NA T) on the Ether net WAN por t. NA T is enabled by default. ■ Local W AN IP Address allows you to manually configure an IP addr ess for use on the Ether net W AN por t. The value 0.0.0.0 indic[...]

W AN and System Configuration 8-45 The console screen will open to the Main Menu , similar to the screen shown below: Navigating thr ough the system configuration screens T o help you find your way to par ticular scr eens, some sections in this guide begin with a graphical path guide similar to the following example: This par ticular path guide [...]

8-46 User’ s Reference Guide System configuration featur es The Netopia R910 Ethernet Router’s default settings may be all you need to configur e your Netopia R910. Some users, however , requir e advanced settings or prefer manual contr ol over the default selections. For these users, the Netopia R910 provides system configuration options. T[...]

W AN and System Configuration 8-47 IP setup These screens allow you to configur e your network’s use of IP . ■ Details are given in Chapter 9, “IP Setup and Network Addr ess T ranslation.” Filter sets (firewalls) These screens allow you to configur e security on your network by means of filter sets and a basic firewall. ■ Details ar[...]

8-48 User’ s Reference Guide 3. Select AM or PM and choose AM or PM . Console configuration Y ou can change the default ter minal communications parameters to suit your r equirements. T o go to the Console Configuration scr een, select Console Configuration in the System Configuration screen. Follow these steps to change a parameter’s value[...]

W AN and System Configuration 8-49 See the release notes that came with your r outer or feature set upgrade, or visit the Netopia Web site at www .netopia.com for infor mation on new feature sets, how to obtain them, and how to install them on your Netopia R910. Logging Y ou can configur e a UNIX-compatible syslog client to repor t a number of su[...]

8-50 User’ s Reference Guide Installing the Syslog client The Goodies folder on the Netopia CD contains a Syslog client daemon program that can be configur ed to repor t the WAN events you specified in the Logging Configuration screen. T o install the Syslog client daemon, exit fr om the graphical Netopia CD program and locate the CD dir ector[...]

IP Setup and Network Address T ranslation 9-51 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 9 9 9 9 II I I P P P P S S S S e e e e t t t t u u u u p p p p a a a a n n n n d d d d N N N N e e e e t t t t w w w w o o o o r r r r k k k k A A A A d d d d d d d d r r r r e e e e s s s s s s s s T T T T r r r r a a a a n n n n s s s s ll l l a[...]

9-52 User’ s Reference Guide Network Address T ranslation works by remapping the sour ce IP address of traf fic from the LAN to a single static or dynamically assigned IP address shown to the r emote side of the router . When NA T is enabled, the Netopia R910 can use either a statically assigned IP address or one dynamically assigned each time t[...]

IP Setup and Network Address T ranslation 9-53 Using Network Addr ess T ranslation The following procedur e describes how to use Network Address T ranslation. 1. Pick a network number for your local network (refer r ed to as the inter nal network). This can be any IP address range you want. The Netopia R910 Router has a default IP addr ess of 192.1[...]

9-54 User’ s Reference Guide Or , fr om the Main Menu, select Easy Setup . The Easy Setup W AN Ether net Configuration screen appears. T oggle Addr ess Translation Enabled to Ye s or No (Y es to enable NA T) and press Retur n. For more infor mation see Appendix B, “Understanding IP Addr essing” and Appendix C, “Understanding Netopia NA T B[...]

IP Setup and Network Address T ranslation 9-55 Associating port numbers with nodes When an IP client such as a Netscape Navigator or Microsoft Inter net Explorer, wants to establish a session with an IP ser ver such as a Web ser ver , the client machine must know the IP address to use and the TCP ser vice por t wher e the traf fic is to be dir ect[...]

9-56 User’ s Reference Guide IP setup The IP Setup options screen is wher e you configure the Ether net side of the Netopia R910. The infor mation you enter here contr ols how the router r outes IP traf fic. Consult your network administrator or Internet ser vice provider to obtain the IP setup infor mation (such as the Ethernet IP addr ess, Et[...]

IP Setup and Network Address T ranslation 9-57 The Netopia R910 Router suppor ts multiple IP subnets on the Ether net inter face. Y ou may want to configure multiple IP subnets to ser vice mor e hosts that are possible with your primar y subnet. It is not always possible to obtain a lar ger subnet from your ISP . For example, if you alr eady have [...]

9-58 User’ s Reference Guide Expor ts, Add Expor t, and Delete Expor t. ■ Select Add Expor t . The Add Expor ted Ser vice scr een appears. Exported Services (Local Port to IP Address Remapping) Show/Change Exports... Add Export... Delete Export... Return/Enter to configure UDP/TCP Port-to-IP Address redirection. Add Exported Service Service... [...]

IP Setup and Network Address T ranslation 9-59 ■ Select Ser vice . A pop-up menu of ser vices and por ts appears. 5. Select any of the ser vices/por ts and pr ess Return to associate it with the addr ess of a ser ver on your local area network. For example, if we select www-http 80 , press Retur n, and type 10.0.0.2 , the Netopia R910 redir ects [...]

9-60 User’ s Reference Guide Press Escape when you ar e finished configuring expor ted ser vices. Y ou are r eturned to the IP Setup screen. ■ If you select Filter Sets you will be taken directly to the screen for configuring IP packet filters. For infor mation see “About filters and filter sets,” beginning on page 13-126 . IP subnets[...]

IP Setup and Network Address T ranslation 9-61 Note: Y ou need not use this scr een if you have only a single Ethernet IP subnet. In that case, you can continue to enter or edit the IP address and subnet mask for the single subnet on the IP Setup scr een. This screen displays up to eight r ows of two editable columns, preceded by a r ow number betw[...]

9-62 User’ s Reference Guide If you have configured multiple Ether net IP subnets, the IP Setup screen changes slightly: The IP address and Subnet mask items ar e hidden, and the “Define Additional Subnets...” item becomes “Subnet Configuration...”. If you select Subnet Configuration , you will retur n to the IP Subnets screen that al[...]

IP Setup and Network Address T ranslation 9-63 The Static Routes screen will appear . Viewing static r outes T o display a view-only table of static r outes, select Display/Change Static Route . The table shown below will appear . The table has the following columns: Dest. Network: The network IP address of the destination network. Static Routes Di[...]

9-64 User’ s Reference Guide Subnet Mask: The subnet mask associated with the destination network. Next Gateway: The IP address of the r outer that will be used to reach the destination network. Priority: An indication of whether the Netopia R910 will use the static route when it conflicts with infor mation received fr om RIP packets. Enabled: A[...]

IP Setup and Network Address T ranslation 9-65 Via RIP and toggle it to Ye s . When Adver tise Route Via RIP is toggled to Y es, a new item called RIP Metric appears below Adver tise Route Via RIP . With RIP Metric you set the number of routers, fr om 1 to 15, between the sending router and the destination router . The maximum number of r outers on[...]

9-66 User’ s Reference Guide IP addr ess serving In addition to being a router , the Netopia R910 is also an IP address ser ver . There are thr ee protocols it can use to distribute IP addresses. ■ The first, called Dynamic Host Configuration Protocol (DHCP) , is widely suppor ted on PC networks, as well as Apple Macintosh computers using Ope[...]

IP Setup and Network Address T ranslation 9-67 Follow these steps to configure IP Addr ess Ser ving: ■ If you enabled IP Address Ser ving, DHCP , BootP clients, Dynamic WAN clients, and MacIP/KIP clients (if you have the AppleT alk kit installed) are automatically enabled. ■ Select Number of Client IP Addresses and enter the total number of co[...]

9-68 User’ s Reference Guide IP Addr ess Pools The IP Address Pools scr een allows you to configure a separate IP addr ess ser ving pool for each of up to eight configured Ether net IP subnets: This screen consists of between two and eight r ows of four columns each. There ar e exactly as many rows as there ar e Ethernet IP subnets configur ed[...]

IP Setup and Network Address T ranslation 9-69 Numerous factors influence the choice of ser ved addr ess. It is dif ficult to specify the address that will be ser ved to a par ticular client in all cir cumstances. However , when the addr ess ser ver has been configured, and the clients involved have no prior address ser ving interactions, the Ne[...]

9-70 User’ s Reference Guide DHCP NetBIOS Options If your network uses NetBIOS, you can enable the Netopia R910 to use DHCP to distribute NetBIOS infor mation. NetBIOS stands for Network Basic Input/Output System. It is a layer of software originally developed by IBM and Sytek to link a network operating system with specific hardwar e. NetBIOS h[...]

IP Setup and Network Address T ranslation 9-71 ■ From the NetBios Type pop-up menu, select the type of NetBIOS used on your network. ■ T o ser ve DHCP clients with the NetBIOS scope, select Ser ve NetBios Scope and toggle it to Ye s . Select NetBios Scope and enter the scope. ■ T o ser ve DHCP clients with the IP addr ess of a NetBIOS name se[...]

9-72 User’ s Reference Guide Select Release BootP Leases and press Retur n. Y ou have finished your IP setup. IP Address Lease Management Reset All Leases Release BootP Leases Reclaim Declined Addresses Hit RETURN/ENTER, you will return to the previous screen.[...]

Virtual Private Networks (VPN) 10-73 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 0 0 0 0 V V V V ii i i r r r r t t t t u u u u a a a a ll l l P P P P r r r r ii i i v v v v a a a a t t t t e e e e N N N N e e e e t t t t w w w w o o o o r r r r k k k k s s s s ( ( ( ( V V V V P P P P N N N N ) ) ) ) The Netopia R910 Router of f[...]

10-74 User’ s Reference Guide T unneling is a pr ocess of creating a private path between a r emote user or private network and another private network over some inter mediate network, such as the IP-based Inter net. A VPN allows remote of fices or employees access to your internal business LAN thr ough means of encr yption allowing the use of t[...]

Virtual Private Networks (VPN) 10-75 When used to initiate the tunnelled connection, the Netopia Router is called a PPTP Access Concentrator ( PA C , in PPTP language), or a foreign agent (in A TMP language). When used to answer the tunnelled connection, the Netopia Router is called a PPTP Network Ser ver ( PNS , in PPTP language) or a home agent ([...]

10-76 User’ s Reference Guide A A A A b b b b o o o o u u u u t t t t P P P P P P P P T T T T P P P P T T T T u u u u n n n n n n n n e e e e ll l l s s s s T o set up a PPTP tunnel, you cr eate a Connection Profile including the IP addr ess and other relevant infor mation for the remote PPTP par tner . Y ou use the same pr ocedure to initiate a[...]

Virtual Private Networks (VPN) 10-77 When you define a Connection Profile as using PPTP by selecting PPTP as the datalink encapsulation method, and then select Data Link Options , the PPTP T unnel Options screen appears. Note: Profiles using PPTP do not of fer a T elco Options scr een. ■ Enter the PPTP Par tner IP Address . This specifies the[...]

10-78 User’ s Reference Guide Note: The Netopia R910 Router suppor ts 128-bit (“strong”) encr yption and MS-CHAP V ersion 2. Unlike MS-CHAP version 1, which suppor ts one-way authentication, MS-CHAP version 2 suppor ts mutual authentication between connected routers and is incompatible with MS-CHAP version 1 (MS-CHAP-V1). When you choose MS-C[...]

Virtual Private Networks (VPN) 10-79 The IP Profile Parameters scr een appears. ■ Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel. Note: A peculiarity associated with VPNs is that when a P AC has NA T applied to a Connection Pr ofile set for PPTP data link encapsulation, the PNS and devices behind it, can[...]

10-80 User’ s Reference Guide ■ The Netopia R910 Router suppor ts 128-bit (“strong”) encr yption. If the router you ar e connecting to does not suppor t 128-bit encr yption, the Netopia r outer will default to 40-bit encr yption. US encr yption regulations changed mid-Febr uar y , 2000, making it possible to include this new encr yption fea[...]

Virtual Private Networks (VPN) 10-81 The Add Connection Profile scr een appears. ■ From the Data Link Encapsulation pop-up menu select IPsec . ■ Then select Data Link Options . The IPsec Encr yption & Authentication Options screen appears. The screen of fers the following Data Link Options for an IPsec Connection Profile. ■ Y ou must sp[...]

10-82 User’ s Reference Guide ■ Y ou must enter an Encr yption Key or keys if the Encr yption T ransfor m is DES. The key must be a hexadecimal entr y of eight bytes (16 bytes of input). No key entr y appears if the encr yption transfor m is NULL. ■ Y ou must specify an Authentication Type . The default is ESP , and the choices are ESP , None[...]

Virtual Private Networks (VPN) 10-83 II I I P P P P P P P P r r r r o o o o f f f f ii i i ll l l e e e e P P P P a a a a r r r r a a a a m m m m e e e e t t t t e e e e r r r r s s s s The following IP Profile Options scr een is displayed for an IPsec Connection Profile. ■ Y ou must specify an SPI (Security Parameters Index) , which is the ESP[...]

10-84 User’ s Reference Guide following section). Note: The SPI title field above changes to SPI (Security Parameters Index) -- Use Advanced IP Profile Options if any of the SPI values dif fer fr om each other . A A A A d d d d v v v v a a a a n n n n c c c c e e e e d d d d II I I P P P P P P P P r r r r o o o o f f f f ii i i ll l l e e e e O[...]

Virtual Private Networks (VPN) 10-85 V V V V P P P P N N N N D D D D e e e e f f f f a a a a u u u u ll l l t t t t A A A A n n n n s s s s w w w w e e e e r r r r P P P P r r r r o o o o f f f f ii i i ll l l e e e e The W AN Configuration menu of fers a VPN Default Answer Pr ofile option. Use this selection when your router is acting as the ser[...]

10-86 User’ s Reference Guide ■ For PPTP tunnel connections only , you must define what type of authentication these connections will use. Select Receive Authentication and press Retur n. A pop-up menu of fers the following options: P AP (the default), CHAP , or MS-CHAP . ■ If you chose P AP or CHAP authentication, fr om the Data Compression[...]

Virtual Private Networks (VPN) 10-87 Profile Name: Lists the name of the Connection Pr ofile being used, if any . Type: Shows the data link encapsulation method (PPTP or A TMP). Rx Pckts: Shows the number of packets received via the VPN tunnel. Tx Pckts : Shows the number of packets transmitted via the VPN tunnel. Est: Indicates whether the conne[...]

10-88 User’ s Reference Guide D D D D ii i i a a a a ll l l - - - - U U U U p p p p N N N N e e e e t t t t w w w w o o o o r r r r k k k k ii i i n n n n g g g g f f f f o o o o r r r r V V V V P P P P N N N N Microsoft Windows Dial-Up Networking softwar e per mits a remote standalone workstation to establish a VPN tunnel to a PPTP ser ver such [...]

Virtual Private Networks (VPN) 10-89 The Communications window appears. 5. In the Communications window , select Dial-Up Networking and click the OK button. This retur ns you to the Windows Setup screen. Click the OK button. 6. Respond to the prompts to install Dial-Up Networking fr om the system disks or CD-ROM. 7. When prompted, r eboot your PC. [...]

10-90 User’ s Reference Guide C C C C o o o o n n n n f f f f ii i i g g g g u u u u r r r r ii i i n n n n g g g g a a a a D D D D ii i i a a a a ll l l - - - - U U U U p p p p N N N N e e e e t t t t w w w w o o o o r r r r k k k k ii i i n n n n g g g g p p p p r r r r o o o o f f f f ii i i ll l l e e e e Once you have created your Dial-Up Ne[...]

Virtual Private Networks (VPN) 10-91 4. Click the TCP/IP Settings button. ■ If your ISP uses dynamic IP addressing (DHCP), select the Ser ver assigned IP addr ess radio button. ■ If your ISP uses static IP addressing, select the Specify an IP addr ess radio button and enter your assigned IP address in the fields pr ovided. Also enter the IP ad[...]

10-92 User’ s Reference Guide II I I n n n n s s s s t t t t a a a a ll l l ll l l ii i i n n n n g g g g t t t t h h h h e e e e V V V V P P P P N N N N C C C C ll l l ii i i e e e e n n n n t t t t Before installing the VPN Client you must have TCP/IP installed and have an established Inter net connection. W W W W ii i i n n n n d d d d o o o o[...]

Virtual Private Networks (VPN) 10-93 3. Click the Windows Setup tab. The Windows Setup screen will be displayed within the top center box. 4. Double-click Communications . This displays a list of possible selections for the communications option. Active components will have a check in the checkboxes to their left. 5. Check Dial Up Networking at the[...]

10-94 User’ s Reference Guide A A A A b b b b o o o o u u u u t t t t A A A A T T T T M M M M P P P P T T T T u u u u n n n n n n n n e e e e ll l l s s s s T o set up an A TMP tunnel, you cr eate a Connection Profile including the IP addr ess and other relevant infor mation for the remote A TMP par tner . A TMP uses the ter minology of a foreig[...]

Virtual Private Networks (VPN) 10-95 When you define a Connection Profile as using A TMP by selecting A TMP as the datalink encapsulation method, and then select Data Link Options , the A TMP T unnel Options scr een appears. Note: An A TMP tunnel cannot be assigned a dynamic IP address by the r emote ser ver , as in a PPP connection. When you de?[...]

10-96 User’ s Reference Guide ■ When you specify the A TMP Par tner IP Address, and the addr ess is in the same subnet as the Remote IP Address you specified in the IP Pr ofile Parameters, you can specify the route ( Tunnel Via Gateway ) by which the gateway par tner is reached. If you do not specify the A TMP Par tner IP Address, the r outer[...]

Virtual Private Networks (VPN) 10-97 ■ Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel. Note: A peculiarity associated with VPNs is that when a foreign agent has NA T applied to a Connection Pr ofile set for A TMP data link encapsulation, the home agent and devices behind it, cannot Ping the foreign agent&[...]

10-98 User’ s Reference Guide A A A A ll l l ll l l o o o o w w w w ii i i n n n n g g g g V V V V P P P P N N N N s s s s t t t t h h h h r r r r o o o o u u u u g g g g h h h h a a a a F F F F ii i i r r r r e e e e w w w w a a a a ll l l ll l l An administrator interested in securing a network will usually combine the use of VPNs with the use [...]

Virtual Private Networks (VPN) 10-99 P P P P P P P P T T T T P P P P e e e e x x x x a a a a m m m m p p p p ll l l e e e e T o enable a fir ewall to allow PPTP traf fic, you must pr ovision the firewall to allow inbound and outbound TCP packets specifically destined for por t 1723. The source por t may be dynamic, so often it is not useful to [...]

10-100 User’ s Reference Guide For Input Filter 2 set the Protocol Type to allow GRE as shown below . In the Display/Change IP Filter Set screen select Display/Change Output Filter . Display/Change Output Filter screen For Output Filter 1 set the Protocol Type and Destination Por t infor mation as shown below . Change Input Filter 2 Enabled: Yes [...]

Virtual Private Networks (VPN) 10-101 For Output Filter 2 set the Protocol Type to allow GRE as shown below . Change Output Filter 2 Enabled: Yes Forward: Yes Source IP Address: 0.0.0.0 Source IP Address Mask: 0.0.0.0 Dest. IP Address: 0.0.0.0 Dest. IP Address Mask: 0.0.0.0 Protocol Type: GRE[...]

10-102 User’ s Reference Guide A A A A T T T T M M M M P P P P e e e e x x x x a a a a m m m m p p p p ll l l e e e e T o enable a fir ewall to allow A TMP traf fic, you must pr ovision the firewall to allow inbound and outbound UDP packets specifically destined for por t 5150. The source por t may be dynamic, so often it is not useful to app[...]

Virtual Private Networks (VPN) 10-103 For Input Filter 2 set the Protocol Type to allow GRE as shown below . In the Display/Change IP Filter Set screen select Display/Change Output Filter . Display/Change Output Filter screen For Output Filter 1 set the Protocol Type and Destination Por t infor mation as shown below . Change Input Filter 2 Enabled:[...]

10-104 User’ s Reference Guide For Output Filter 2 set the Protocol Type to allow GRE as shown below . Change Output Filter 2 Enabled: Yes Forward: Yes Source IP Address: 0.0.0.0 Source IP Address Mask: 0.0.0.0 Dest. IP Address: 0.0.0.0 Dest. IP Address Mask: 0.0.0.0 Protocol Type: GRE[...]

PPP over Ethernet 11-105 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 1 1 1 1 P P P P P P P P P P P P o o o o v v v v e e e e r r r r E E E E t t t t h h h h e e e e r r r r n n n n e e e e t t t t The Netopia R910 Router suppor ts the Point-to-Point protocol over Ether net (PPPoE) for use of PPP to connect through a DSL or cable[...]

11-106 User’ s Reference Guide From the Data Link Encapsulation pop-up menu, select PPP . Select Data Link Options and press Return . The Datalink (PPP/MP) Options screen appears. Enter your User Name and Password and pr ess Return . Press Escape to retur n to the Add Connection Pr ofile screen. Select ADD PROFILE NOW and press Return . Y our Co[...]

PPP over Ethernet 11-107 P P P P P P P P P P P P E E E E t t t t h h h h e e e e r r r r n n n n e e e e t t t t L L L L A A A A N N N N R R R R e e e e c c c c o o o o n n n n f f f f ii i i g g g g u u u u r r r r a a a a t t t t ii i i o o o o n n n n The Netopia R910 of fers the ability for PPP to r econfigure the r outer’s Ether net LAN whe[...]

11-108 User’ s Reference Guide Q Q Q Q u u u u ii i i c c c c k k k k V V V V ii i i e e e e w w w w The Quick View screen (as shown below) displays both Primar y and Secondar y DNS Ser ver addresses. This is useful because both may be ser ved via PPP . Quick View 8/8/2000 10:46:14 AM Default IP Gateway: 163.176.12.1 CPU Load: 6% Unused Memory: 2[...]

Monitoring T ools 12-109 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 2 2 2 2 M M M M o o o o n n n n ii i i t t t t o o o o r r r r ii i i n n n n g g g g T T T T o o o o o o o o ll l l s s s s This chapter discusses the Netopia R910’s device and network monitoring tools. These tools can provide statistical infor mation, repor[...]

12-110 User’ s Reference Guide General status Current Date: The cur r ent date; this can be set with the Date and Time utility (see “Date and time” on page 8-47 ). Default IP Gateway: Actual IP address of the default gateway , if entered. 0.0.0.0 indicates automatic addressing. Domain Name Ser ver: IP address of your DNS ser ver . Domain Name[...]

Monitoring T ools 12-111 Each LED repr esentation can repor t one of four states: –: A dash means the LED is of f. R: The letter “R” means the LED is red. G: The letter “G” means the LED is green. Y: The letter “Y” means the LED is yellow . The section “Netopia R910 Ethernet Router status lights” on page 3-16 describes the meaning[...]

12-112 User’ s Reference Guide Physical Interface The top left side of the screen lists total packets r eceived and total packets transmitted for the following data por ts: ■ Ethernet Hub ■ Ethernet WAN Network Interface The bottom left side of the screen lists total packets r eceived and total packets transmitted for the IP protocol (IP pack[...]

Monitoring T ools 12-113 W AN Event History The W AN Event Histor y screen lists a total of 128 events on the WAN. The most recent events appear at the top. Each entr y in the list contains the following infor mation: Date: Date of the event. Time: Time of the event. Event: A brief description of the event. The first event in each call sequence is[...]

12-114 User’ s Reference Guide If the event histor y exceeds the size of the screen, you can scr oll through it by using SCROLL UP and SCROLL DOWN. T o scr oll up, select SCROLL UP at the top of the list and press Retur n. T o scr oll down, select SCROLL DOWN at the bottom of the list and press Retur n. T o obtain mor e infor mation about any eve[...]

Monitoring T ools 12-115 IP routing table In the Statistics & Logs screen, select IP Routing T able and press Retur n. The IP routing table displays all of the IP r outes cur rently known to the Netopia R910. If the list of routes shown exceeds the size of the scr een, you can scroll thr ough it by using SCROLL UP and SCROLL DOWN. T o scr oll u[...]

12-116 User’ s Reference Guide Served IP Addresses Y ou can view all of the IP addr esses cur rently being ser ved by the Netopia R910 Ethernet Router fr om the Ser ved IP Addresses scr een. From the Statistics & Logs menu, select Ser ved IP Addr esses . The Ser ved IP Addresses scr een appears. T o manage DHCP leases, select Lease Management[...]

Monitoring T ools 12-117 This screen has thr ee options: ■ Reset All Leases : Resets all cur rent IP addr esses leased through DHCP without waiting for the default one–hour lease period to elapse ■ Release BootP Leases : Releases any BootP leases that may be in place, and which may no longer be requir ed. ■ Reclaim Declined Addresses : Recl[...]

12-118 User’ s Reference Guide SNMP The Netopia R910 includes a Simple Network Management Protocol (SNMP) agent, allowing monitoring and configuration by a standard SNMP manager . The Netopia R910 suppor ts the following management infor mation base (MIB) documents: ■ MIB II (RFC 1213) ■ Inter face MIB (RFC 1229) ■ Ethernet MIB (RFC 1643) [...]

Monitoring T ools 12-119 2. Select System Location and enter the router’s physical location (r oom, floor , building, etc.). 3. Select System Contact and enter the name of the person responsible for maintaining the r outer . System Name, System Location, and System Contact set the values retur ned by the Netopia R910 SNMP agent for the SysName, [...]

12-120 User’ s Reference Guide ■ A cold star t trap is generated after the router is r eset. ■ An inter face down trap (ifDown) is generated when one of the r outer’s inter faces, such as a por t, stops functioning or is disabled. ■ An inter face up trap (ifUp) is generated when one of the r outer’s inter faces, such as a por t, begins [...]

Monitoring T ools 12-121 2. Select an IP trap receiver fr om the table and press Retur n. 3. In the Change IP Trap Receiver screen, edit the infor mation as needed and pr ess Retur n. Deleting IP trap receivers 1. T o delete an IP trap r eceiver , select Delete IP Trap Receiver in the IP T rap Receivers screen. 2. Select an IP trap receiver fr om t[...]

12-122 User’ s Reference Guide[...]

Security 13-123 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 3 3 3 3 S S S S e e e e c c c c u u u u r r r r ii i i t t t t y y y y The Netopia R910 provides a number of security featur es to help protect its configuration scr eens and your local network from unauthorized access. Although these featur es are optional, it is str [...]

13-124 User’ s Reference Guide Once user accounts are cr eated, users who attempt to access protected scr eens will be challenged. Users who enter an incor rect name or passwor d are r etur ned to a screen r equesting a name/password combination to access the Main Menu. T o set up user accounts, in the System Configuration scr een select Securit[...]

Security 13-125 T o add a new user account, select Add User in the Security Options screen and pr ess Retur n. The Add Name With Write Access screen appears. Follow these steps to configure the new account: 1. Select Enter Name and enter a descriptive name (for example, the user’s first name). 2. Select Enter Password and enter a passwor d. 3. [...]

13-126 User’ s Reference Guide T o r estrict T elnet access to the SNMP screens, select Enable T elnet Access to SNMP Screens and toggle it to No . (See “SNMP traps” on page 12-119. ) T o r estrict T elnet access to all of the configuration screens, select Enable T elnet Console Access and toggle it to No . About filters and filter sets Se[...]

Security 13-127 Each inspector has a specific task. One inspector’s task may be to examine the destination address of all outgoing packages. That inspector looks for a cer tain destination—which could be as specific as a street address or as br oad as an entire countr y—and checks each package’s destination addr ess to see if it matches t[...]

13-128 User’ s Reference Guide If the package does not match the first inspector’s criteria, it goes to the second inspector , and so on. Y ou can see that the order of the inspectors in the line is ver y impor tant. For example, let’s say the first inspector’s orders ar e to send along all packages that come from Rome, and the second ins[...]

Security 13-129 Parts of a filter A filter consists of criteria based on packet attributes. A typical filter can match a packet on any one of the following attributes: ■ The source IP addr ess (where the packet was sent fr om) ■ The destination IP address (wher e the packet is going) ■ The type of higher-layer Internet pr otocol the packet[...]

13-130 User’ s Reference Guide Less Than: For the filter to match, the packet’s por t number must be less than the por t number specified in the filter . Less Than or Equal: For the filter to match, the packet’s por t number must be less than or equal to the por t number specified in the filter . Equal: For the filter to match, the pac[...]

Security 13-131 Proto: The pr otocol to match. This can be entered as a number (see the table below) or as TCP or UDP if those protocols ar e used. Src. Por t: The sour ce por t to match. This is the por t on the sending host that originated the packet. D. Por t: The destination por t to match. This is the por t on the r eceiving host for which the[...]

13-132 User’ s Reference Guide 4. The filter should be enabled and instr ucted to block the T elnet packets containing the sour ce addr ess shown in step 2: ■ On? = Y es ■ Fwd = No This four-step process is how we pr oduced the following filter from the original r ule: Filtering example #2 Suppose a filter is configured to block all incom[...]

Security 13-133 ■ Discarded if all the filters ar e configured to pass (for war d) ■ Discarded if the set contains a combination of pass and discar d filters Disadvantages of filters Although using filter sets can greatly enhance network security , there ar e disadvantages: ■ Filters are complex. Combining them in filter sets intr oduce[...]

13-134 User’ s Reference Guide The procedur e for creating and maintaining filter sets is as follows: 1. Add a new filter set. 2. Create the filters for the new filter set. 3. View , change, or delete individual filters and filter sets. The sections below explain how to execute these steps. Adding a filter set Y ou can cr eate up to eight [...]

Security 13-135 Naming a new filter set All new filter sets have a default name. The first filter set you add will be called Filter Set 1, the next filter will be Filter Set 2, and so on. T o give a new filter set a dif ferent name, select Filter Set Name and enter a new name for the filter set. T o save the filter set, select ADD FIL TER S[...]

13-136 User’ s Reference Guide Input and output filters—source and destination There ar e two kinds of filters you can add to a filter set: input and output. Input filters check packets received from the Inter net, destined for your network. Output filters check packets transmitted from your network to the Internet. Packets in the Netopia [...]

Security 13-137 1. T o make the filter active in the filter set, select Enabled and toggle it to Ye s . If Enabled is toggled to No , the filter can still exist in the filter set, but it will have no ef fect. 2. If you want the filter to for ward packets that match its criteria to the destination IP addr ess, select For ward and toggle it to Y[...]

13-138 User’ s Reference Guide 10. When you are finished configuring the filter , select ADD THIS FIL TER NOW to save the filter in the filter set. Select CANCEL to discard the filter and r eturn to the Add IP Filter Set scr een. Viewing filters T o display a view-only table of input (output) filters, select Display/Change Input Filter or[...]

Security 13-139 Modifying filter sets T o modify a filter set, select Display/Change IP Filter Set in the IP Filter Sets screen to display a list of filter sets. Select a filter set from the list and pr ess Return. The Change IP Filter Set scr een appears. The items in this screen ar e the same as the ones in the Add Filter screen (see “Addin[...]

13-140 User’ s Reference Guide The five input filters and one output filter that make up Basic Firewall ar e shown in the table below . Basic Firewall’s filters play the following r oles. Input filters 1 and 2: These block W AN-originated OpenWindows and X-Windows sessions. Ser vice origination requests for these pr otocols use por ts 2000[...]

Security 13-141 Basic Firewall is suitable for a LAN containing only client hosts that want to access ser vers on the WAN, but not for a LAN containing ser vers providing ser vices to clients on the W AN. Basic Firewall’s general strategy is to explicitly pass W AN-originated TCP and UDP traf fic to por ts gr eater than 1023. Por ts lower than 1[...]

13-142 User’ s Reference Guide FTP sessions. T o allow WAN-originated FTP sessions to a LAN-based FTP ser ver with the IP addr ess a.b.c.d (cor responding to a number ed IP address such as 163.176.8.243), inser t the following input filter ahead of the cur rent input filter 1: ■ Enabled: Y es ■ For ward: Y es ■ Source IP Addr ess: 0.0.0.0[...]

Security 13-143 Fir ewall tutorial General firewall terms Filter rule : A filter set is comprised of individual filter r ules. Filter set : A grouping of individual filter r ules. Firewall : A component or set of components that r estrict access between a protected network and the Inter net, or between two networks. Host : A workstation on the [...]

13-144 User’ s Reference Guide Example TCP/UDP Ports Fir ewall design rules There ar e two basic r ules to firewall design: ■ “What is not explicitly allowed is denied.” and ■ “What is not explicitly denied is allowed.” The first r ule is far more secur e, and is the best approach to fir ewall design. It is far easier (and more sec[...]

Security 13-145 and a packet goes through these r ules destined for FTP , the packet would pass thr ough the first filter r ule (WWW), match the second r ule (FTP), and the packet is allowed through. Even though the next r ule is to deny all FTP traf fic, the FTP packet will never make it to this r ule. Binary representation It is easiest when d[...]

13-146 User’ s Reference Guide Established connections The TCP header contains one bit called the ACK bit (or TCP Ack bit). This ACK bit appears only with TCP , not UDP . The ACK bit is par t of the TCP mechanism that guaranteed the deliver y of data. The ACK bit is set whenever one side of a connection has received data fr om the other side. Onl[...]

Security 13-147 Example network Example filters Example 1 Incoming packet has the source addr ess of 200.1.1.28 Less Than or Equal Any por t less than or equal to the por t defined Equal Matches only the por t defined Greater Than or Equal Matches the por t or any por t greater Greater Than Matches anything greater than the por t defined Filter[...]

13-148 User’ s Reference Guide This incoming IP packet has a source IP addr ess that matches the network address in the Sour ce IP Address field (00000000) in the Netopia R910. This will not for ward this packet. Example 2 Incoming packet has the source addr ess of 200.1.1.184. This incoming IP packet (10000000) has a source IP addr ess that doe[...]

Security 13-149 Since the Source IP Network Addr ess in the Netopia R910 is 01100000, and the sour ce IP address after the logical AND is 1011000, this r ule does not match and this packet will be passed. Example 4 Incoming packet has the source addr ess of 200.1.1.104. Since the Source IP Network Addr ess in the Netopia R910 is 01100000, and the s[...]

13-150 User’ s Reference Guide Since the Source IP Network Addr ess in the Netopia R910 is 01100000, and the sour ce IP address after the logical AND is 01100000, this r ule does match and this packet will NOT be passed. This r ule masks of f a single IP address.[...]

Security 13-151 R R R R A A A A D D D D II I I U U U U S S S S C C C C ll l l ii i i e e e e n n n n t t t t S S S S u u u u p p p p p p p p o o o o r r r r t t t t TheNetopia R910 implements a Remote Authentication Dial-In User Ser vice (RADIUS) client (RFC 2138) and adds the ability to authenticate console configuration access using a RADIUS ser[...]

13-152 User’ s Reference Guide If you select Advanced Security Options and press Retur n, the Advanced Security Options screen appears. ■ Y ou select your desir ed mode by using the Security Databases… pop-up menu. ■ Choosing Local Only , the default, selects the standar d authentication mechanism. ■ Choosing RADIUS Only causes the r oute[...]

Security 13-153 hostname to be resolved using the Domain Name System (DNS) infor mation configur ed in the router , or by using an IP address in dotted-quad notation. The RADIUS Ser ver Addr/Name items ar e limited to 63 characters. ■ In addition to specifying the ser ver’s hostname or IP address, you must also specify a RADIUS Ser ver Secret [...]

13-154 User’ s Reference Guide Security Options +-------------------------------------------------------------+ +-------------------------------------------------------------+ | | | You are about to delete the only local password. If you | | continue you will be unable to configure this device unless | | a Radius Server is available to authentica[...]

Utilities and Diagnostics 14-155 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 4 4 4 4 U U U U t t t t ii i i ll l l ii i i t t t t ii i i e e e e s s s s a a a a n n n n d d d d D D D D ii i i a a a a g g g g n n n n o o o o s s s s t t t t ii i i c c c c s s s s A number of utilities and tests are available for system diagnostic[...]

14-156 User’ s Reference Guide Ping The Netopia R910 includes a standard Ping test utility . A Ping test generates IP packets destined for a par ticular (Ping-capable) IP host. Each time the tar get host r eceives a Ping packet, it retur ns a packet to the original sender . Ping allows you to see whether a par ticular IP destination is reachable [...]

Utilities and Diagnostics 14-157 Status: The cur rent status of the Ping test. This item can display the status messages shown in the able below: Packets Out: The number of packets sent by the Ping test. Packets In: The number of retur n packets received fr om the tar get host. T o be considered “on time,” retur n packets are expected back befo[...]

14-158 User’ s Reference Guide Packets Lost: The number of packets unaccounted for , shown in total and as a per centage of total packets sent. This statistic may be updated during the Ping test, and may not be accurate until after the test is over . However , if an escalating one-to-one cor r espondence is seen between Packets Out and Packets Lo[...]

Utilities and Diagnostics 14-159 4. Select Use Reverse DNS to lear n the names of the routers between the Netopia Router and the destination router . The default is Y es. 5. Select ST ART TRACE ROUTE and press Retur n. A scr olling screen will appear that lists the destination, number of hops, IP addresses of each hop, and DNS names, if selected. 6[...]

14-160 User’ s Reference Guide Disconnect T elnet console session If you want to close your T elnet Console session, select Disconnect T elnet Console Session and pr ess Return. A dialog box appears asking you to cancel or continue your selection. If you select Continue , you will immediately ter minate your session. Factory defaults Y ou can r e[...]

Utilities and Diagnostics 14-161 The sections below describe how to update the Netopia R910’s fir mware and how to download and upload configuration files. Updating firmwar e Fir mware updates may be available periodically fr om Netopia or from a site maintained by your or ganization’s network administrator . There ar e two types of fir mw[...]

14-162 User’ s Reference Guide press Retur n. Y ou will see the following dialog box: ■ Select CANCEL to exit without downloading the file, or select CONTINUE to download the file. The system will reset at the end of the file transfer to put the new fir mwar e into ef fect. While the system r esets, the LEDs will blink on and of f. Caution![...]

Utilities and Diagnostics 14-163 ■ Select GET CONFIG FROM SERVER and press Retur n. Y ou will see the following dialog box: ■ Select CANCEL to exit without downloading the file, or select CONTINUE to download the file. The system will reset at the end of the file transfer to put the new configuration into ef fect. ■ If you choose to downl[...]

14-164 User’ s Reference Guide Updating firmwar e Fir mware updates may be available periodically fr om Netopia or from a site maintained by your or ganization’s network administration. The procedur e below applies whether you are using the console or the WAN inter face module. Follow these steps to update the Netopia R910’s fir mware: 1. M[...]

Utilities and Diagnostics 14-165 The system will reset at the end of a successful file transfer to put the new fir mwar e into ef fect. While the system resets, the LEDs will blink on and of f. Caution! Do not manually power down or reset the Netopia R910 while it is automatically r esetting or it could be damaged. Downloading configuration fil[...]

14-166 User’ s Reference Guide The procedur e below applies whether you are using the console or the WAN inter face. T o upload a configuration file: 1. Decide on a name for the file and a path for saving it. 2. Select Receive Config from Netopia and press Retur n. The following dialog box appears: 3. Select CANCEL to exit without uploading t[...]

T roubleshooting A-167 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x A A A A T T T T r r r r o o o o u u u u b b b b ll l l e e e e s s s s h h h h o o o o o o o o t t t t ii i i n n n n g g g g This appendix is intended to help you troubleshoot pr oblems you may encounter while setting up and using the Netopia R910. It also includ[...]

A-168 User’ s Reference Guide Console connection pr oblems Can’t see the configuration scr eens (nothing appears) ■ Make sure the cable connection fr om the Netopia R910’s console por t to the computer being used as a console is securely connected. ■ Make sure the ter minal emulation softwar e is accessing the cor rect por t on the compu[...]

T roubleshooting A-169 How to r eset the router to factory defaults Lose your password? This section shows how to r eset the router so that you can access the console scr eens once again. Keep in mind that all of your connection profiles and settings will need to be r econfigured. If you don't have a password, the only way to get back into t[...]

A-170 User’ s Reference Guide Technical support Netopia, Inc. is committed to providing its customers with r eliable products and documentation, backed by excellent technical suppor t. Before contacting Netopia Look in this guide for a solution to your problem. Y ou may find a solution in this troubleshooting appendix or in other sections. Check[...]

T roubleshooting A-171 Online product information Product infor mation can be found in the following: Netopia World Wide W eb ser ver via http://www .netopia.com Internet via anonymous FTP to ftp.netopia.com/pub Online T echnical Support T echnical notes and Fr equently Asked Questions which answer the most commonly asked questions and of fer solut[...]

A-172 User’ s Reference Guide[...]

Understanding IP Addressing B-173 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x B B B B U U U U n n n n d d d d e e e e r r r r s s s s t t t t a a a a n n n n d d d d ii i i n n n n g g g g II I I P P P P A A A A d d d d d d d d r r r r e e e e s s s s s s s s ii i i n n n n g g g g This appendix is a brief general introduction to[...]

B-174 User’ s Reference Guide IP addresses indicate both the identity of the network and the identity of the individual host on the network. The number of bits used for the network number and the number of bits used for the host number can var y , as long as cer tain r ules ar e followed. The local network manager assigns IP host numbers to indiv[...]

Understanding IP Addressing B-175 Subnet masks T o cr eate subnets, the network manager must define a subnet mask, a 32-bit number that indicates which bits in an IP address ar e used for network and subnetwork addresses and which ar e used for host addresses. One subnet mask should apply to all IP networks that are physically connected together a[...]

B-176 User’ s Reference Guide Network configuration Below is a diagram of a simple network configuration. The ISP is providing a Class C addr ess to the customer site, and both networks A and B want to gain Internet access thr ough this address. Netopia R910 B connects to Netopia R910 A and is provided Inter net access through Routers A and B. [...]

Understanding IP Addressing B-177 Background The IP addresses and r outing configurations for the devices shown in the diagram are outlined below . In addition, each individual field and its meaning are described. The IP Address and Subnet Mask fields define the IP addr ess and subnet mask of the device's Ethernet connection to the network[...]

B-178 User’ s Reference Guide There ar e two schemes for distributing the remaining IP addr esses: ■ Manually give each computer an address ■ Let the Netopia R910 automatically distribute the addresses These two methods are not mutually exclusive; you can manually issue some of the addr esses while the rest are distributed by the Netopia R910[...]

Understanding IP Addressing B-179 Configuration This section describes the specific IP address lease, r enew , and r elease mechanisms for both the Mac and PC, with either DHCP or MacIP address ser ving. DHCP address serving Windows 95 workstation: ■ The Win95 workstation requests and r enews its lease ever y half hour . ■ The Win95 workstati[...]

B-180 User’ s Reference Guide ■ The Netopia R910 does release the DHCP addr ess back to the available DHCP address pool pr ecisely one hour after the last-heard lease r equest as some other DHCP implementations may hold on to the lease for an additional time after the lease expired, to act as a buf fer for variances in clocks between the client[...]

Understanding IP Addressing B-181 addresses. ■ Note any planned and cur rently used static addr esses before you use DHCP and MacIP . ■ Avoid fragmenting your block of IP addresses. For example, tr y to use a continuous range for the static addresses you choose. The figure above shows an example of a block of IP addr esses being distributed co[...]

B-182 User’ s Reference Guide A DHCP example Suppose, for example, that your ISP gave your network the IP address 199.1.1.32 and a 4-bit subnet mask. Address 199.1.1.32 is r eser ved as the network address. Addr ess 199.1.1.47 is reser ved as the broadcast address. This leaves 14 addr esses to allocate, from 199.1.1.33 thr ough 199.1.1.46. If you[...]

Understanding IP Addressing B-183 Routers B and C (which could also be Netopia R910s) ser ve the two remote networks that ar e subnets of a.b.c.0. The subnetting is accomplished by configuring the Netopia R910 with connection profiles for Routers B and C (see the following table). The Netopia R910’s connection profiles for Routers B and C cr e[...]

B-184 User’ s Reference Guide Let’s see how a packet from the Inter net gets routed to the host with IP addr ess a.b.c.249, which is ser ved by Router C. The packet first ar rives at Router A, which delivers it to its local network (a.b.c.0). The packet is then received by the Netopia R910, which examines its destination IP addr ess. The Netop[...]

Understanding IP Addressing B-185 The following diagram illustrates the IP address space taken up by the two r emote IP subnets. Y ou can see fr om the diagram why the ter m nested is appropriate for describing these subnets. Br oadcasts As mentioned earlier , binar y IP host or subnet addr esses composed entirely of ones or zer os are r eser ved f[...]

B-186 User’ s Reference Guide[...]

Understanding Netopia NA T Behavior C-187 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x C C C C U U U U n n n n d d d d e e e e r r r r s s s s t t t t a a a a n n n n d d d d ii i i n n n n g g g g N N N N e e e e t t t t o o o o p p p p ii i i a a a a N N N N A A A A T T T T B B B B e e e e h h h h a a a a v v v v ii i i o o o o [...]

C-188 User’ s Reference Guide When the Netopia R910 establishes a connection over its W AN inter face with another router it uses the Point-to-Point Protocol (PPP). Within PPP ther e is a Network Control Pr otocol (NCP) called Internet Pr otocol Control Pr otocol (IPCP), which handles the negotiation of IP addresses between the two r outers, in t[...]

Understanding Netopia NA T Behavior C-189 When the Netopia R910 receives this IP packet, it cannot simply for war d it to the WAN inter face and the Internet since the IP addr esses on the LAN inter face ar e not valid or globally unique for the Inter net. Instead, the Netopia R910 has to change the IP packet to reflect the IP addr ess that was ac[...]

C-190 User’ s Reference Guide The reasons for the IP addr ess changes are obvious fr om the preceding diagram, but what is not so obvious is why the TCP or UDP source por ts need to be changed as well. These ar e changed and maintained in an inter nal table so the Netopia R910 can deter mine which host on the local LAN inter face sent the IP pack[...]

Understanding Netopia NA T Behavior C-191 Now both IP packets have the exact same source IP addr ess (200.1.1.40) and sour ce por ts (400). The Netopia R910 is then able to distinguish between the two IP packets by changing the source TCP or UDP por ts and keeping this infor mation in an inter nal table. As seen above, the source por t for Workstat[...]

C-192 User’ s Reference Guide If the WWW ser ver on the Inter net then tries to open a connection to the IP address of 200.1.1.40 with the appropriate Expor ted Ser vice defined, the Netopia R910 will look at the destination por t and will find that it is destined for por t 21 (FTP). The Netopia R910 then looks at the inter nal user-defined ex[...]

Understanding Netopia NA T Behavior C-193 Configuration Y ou can toggle Addr ess Translation Enabled to No or Y es in the W AN Ether net Configuration screen in WAN Configuration under the Main Menu. An example of enabling NA T is as follows: T oggling Addr ess T ranslation Enabled to Y es enables the Netopia R910 to send out an all-zeros IPCP a[...]

C-194 User’ s Reference Guide Expor ted ser vices ar e configured under IP Setup in System Configuration. This is where a par ticular type of TCP or UDP ser vice originating from the Inter net is r edirected to a host on the Netopia R910’s LAN inter face. An example of this screen follows: Within expor ted ser vices is a pop-up list of well-k[...]

Binary Conversion T able D-195 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x D D D D B B B B ii i i n n n n a a a a r r r r y y y y C C C C o o o o n n n n v v v v e e e e r r r r s s s s ii i i o o o o n n n n T T T T a a a a b b b b ll l l e e e e This table is provided to help you choose subnet numbers and host numbers for IP an[...]

D-196 User’ s Reference Guide Decimal Binar y Decimal Binar y Decimal Binar y Decimal Binar y 128 10000000 160 10100000 192 11000000 224 11100000 129 10000001 161 10100001 193 11000001 225 11100001 130 10000010 162 10100010 194 11000010 226 11100010 131 10000011 163 10100011 195 11000011 227 11100011 132 10000100 164 10100100 196 11000100 228 111[...]

Further Reading E-197 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x E E E E F F F F u u u u r r r r t t t t h h h h e e e e r r r r R R R R e e e e a a a a d d d d ii i i n n n n g g g g Alexander , S. & R. Dr oms, DHCP Options and BOOTP V endor Extensions , RFC 2131, Silicon Graphics, Inc., Bucknell University , Mar ch 1997. A[...]

E-198 User’ s Reference Guide Garcia-Luna-Aceves, J.J. "Loop-Fr ee Routing Using Dif fusing Computations." Publication pending in IEEE/ACM T ransactions on Networking, V ol. 1, No. 1, 1993. Gar finkel, Simson. PGP: Pretty Good Privacy Sebastopol, CA: O’Reilly & Associates, 1991. A guide to the fr ee data encr yption program PGP a[...]

Further Reading E-199 Sidhu, G.S., R.F . Andr ews, and A.B. Oppenheimer . Inside AppleT alk, 2nd ed. Reading, MA: Addison-Wesley Publishing Company , 1990. Siyan, Karanjit. Internet Fir ewall and Network Security Indianapolis, IN: New Riders Publishing, 1995. Similar to the Chapman and Zwicky book. Smith, Philip. Frame Relay Principles and Applicat[...]

E-200 User’ s Reference Guide[...]

T echnical Specifications and Safety Information F-201 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x F F F F T T T T e e e e c c c c h h h h n n n n ii i i c c c c a a a a ll l l S S S S p p p p e e e e c c c c ii i i f f f f ii i i c c c c a a a a t t t t ii i i o o o o n n n n s s s s a a a a n n n n d d d d S S S S a a a a f f [...]

F-202 User’ s Reference Guide The Netopia R910 Ethernet Router has met the safety standar ds (per UL-1950) of the Under writers Laboratories for the United States. Regulatory notices Warning This is a Class A product. In a domestic envir onment this product may cause radio inter ference, in which case the user may be requir ed to take adequate me[...]

T echnical Specifications and Safety Information F-203 Repairs to the cer tified equipment should be made by an authorized Canadian maintenance facility designated by the supplier . Any repairs or alterations made by the user to this equipment, or equipment malfunctions, may give the telecommunications company cause to request the user to disconn[...]

F-204 User’ s Reference Guide[...]

Index-205 II I I n n n n d d d d e e e e x x x x Numerics 10Base-T 4- 20 10Base-T , connecting 4- 20 A add static route 9-64 advanced configuration features 8- 46 application software 4-19 A TMP 10- 79 tunnel options 10- 94 AURP tunnel 13- 142 B back panel 3-14 por ts 3-15 basic firewall 13- 140 BootP 9- 66 clients 9- 71 broadcasts B-185 C capabi[...]

Index-206 DHCP NetBIOS options 9-70 display static routes 9- 63 distributing IP addresses B- 177 downloading configuration files 14-162 , 14-165 with TFTP 14-162 with XMODEM 14-165 Dynamic Host Configuration Protocol (DHCP) 9- 66 Dynamic Host Configuration Protocol, see DHCP Dynamic W AN 9-66 E Easy Setup connection profile 7- 39 IP setup 7- 4[...]

Index-207 IP setup 9-56 IP trap receivers deleting 12-121 modifying 12- 120 setting 12-120 viewing 12- 120 IPsec 10-74 , 10- 80 ISP account types 2- 11 infor mation to obtain 2- 11 L LED status 12-110 LEDs 3-16 , 12- 110 M MacIP defined B-180 MIBs suppor ted 12-118 MPPE 10-79 MS-CHAPv2 10- 80 multiple subnets 9- 60 N NA T defined 9-51 features 9-[...]

Index-208 S screens, connecting to 8- 44 security filters 13- 126 – 142 measures to incr ease 13-123 telnet 13-125 user accounts (passwords) 13-123 security options screen 13-124 protecting 13-124 Simple Network Management Protocol, see SNMP Smar tIP 9-51 SNMP community strings 12- 119 MIBs suppor ted 12-118 setup screen 12-118 traps 12- 119 src[...]

Index-209 V Vir tual Private Networks (VPN) 10-73 VPN 10- 73 allowing through a fir ewall 10-98 A TMP tunnel options 10-94 default answer profile 10-85 encr yption suppor t 10-79 PPTP tunnel options 10-76 W WA N configuration 9- 53 event histor y 12-113 statistics 12-111 W AN event histor y 12-113 X XMODEM 14- 163 XMODEM file transfers download[...]