Netopia Firmware 4000-Series manuel d'utilisation

N N N N e e e e t t t t o o o o p p p p ii i i a a a a ® ® ® ® F F F F ii i i r r r r m m m m w w w w a a a a r r r r e e e e U U U U s s s s e e e e r r r r G G G G u u u u ii i i d d d d e e e e N N N N e e e e t t t t o o o o p p p p ii i i a a a a ® ® ® ® 4 4 4 4 0 0 0 0 0 0 0 0 0 0 0 0 - - - - S S S S e e e e r r r r ii i i e e e e s s[...]

C o p yright Copyright© 2004, Netopia, Inc. Netopia and the Netopia logo are r egistered trademarks belonging to Netopia, Inc., register ed U.S. Patent and T rademark Of fice. Broadband Without Boundaries and 3-D Reach are trademarks belonging to Netopia, Inc. All other trademarks are the pr oper ty of their respective owners. All rights r eser v[...]

Contents iii G Chapter 1 — Introduction .......................................................... 1-1 What’s New in Netopia Fir mware V ersion 5.4 ................... 1-1 Console-based Management ........................................... 1-2 Netopia Console Menus ................................................. 1-2 Netopia Models ..........[...]

iv Firmware User Guide Modifying a scheduled connection ....................... 2-34 Deleting a scheduled connection......................... 2-34 System Configuration Screens ...................................... 2-35 System configuration features............................. 2-35 IP Setup .......................................................[...]

Contents v G IP profile parameters .......................................... 3-21 IP Parameters (W AN Default Pr ofile) .................... 3-23 NA T Associations ......................................................... 3-25 IP Passthrough ............................................................ 3-27 MultiNA T Configuration Example ......[...]

vi Firmware User Guide Adding an IKE Phase 1 Profile ............................... 5-4 Changing an IKE Phase 1 Profile ........................... 5-8 Key Management ........................................................... 5-9 IPsec W AN Configuration Scr eens ................................. 5-18 IPsec Manual Key Entr y ..................[...]

Contents vii G Event Logs .................................................................. 7-12 SNMP Suppor t ............................................................ 7-13 Backup Default Gateway ............................................... 7-13 Backup Configuration screen .............................. 7-13 IP Setup screen ...............[...]

viii Firmware User Guide Advanced Security Options ................................. 10-5 User access password ....................................... 10-7 User menu dif fer ences ....................................... 10-8 User Accounts ........................................................... 10-15 T elnet Access ..............................[...]

Contents ix G Updating fir mware .............................................. 11-7 Downloading configuration files ........................... 11-8 Uploading configuration files ............................... 11-9 T ransfer ring Configuration and Fir mware Files with XMODEM .............................................................. 11-[...]

x Firmware User Guide Packet header types .......................................... B-14 Appendix C — Binar y Conversion T able ...................................... C-1 Index[...]

Introduction 1-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 II I I n n n n t t t t r r r r o o o o d d d d u u u u c c c c t t t t ii i i o o o o n n n n This Fir mware User Guide covers the advanced features of the Netopia 4000-Series Router and IAD families. Y our Netopia equipment of fers advanced configuration featur es in[...]

1-2 Firmware User Guide Console-based Management Console-based management is a fast menu-driven inter face for the capabilities built into the Netopia Fir mwar e V ersion 5.4. Console-based management pr ovides access to a wide variety of features that the router suppor ts. Y ou can customize these features for your individual setup. This chapter d[...]

Introduction 1-3 reconfiguring the manner in which you may be using the r outer to connect to more than one ser vice provider or r emote site. See “W AN Configuration,” beginning on page 2-1 . See also Chapter 4, “Vir tual Private Networks (VPNs).” ■ The System Configuration menus display and per mit changing: See “System Configurat[...]

1-4 Firmware User Guide Connecting thr ough a T elnet Session Features of the Netopia Fir mwar e V ersion 5.4 can be configured thr ough the console screens. Before you can access the console scr eens through T elnet, you must have: ■ A network connection locally to the router or IP access to the r outer . Note: Alter natively , you may have a d[...]

Introduction 1-5 Connecting a Console Cable to y our Equipment Many Netopia models include a serial console por t labeled “Console” on the back panel. Y ou can per for m all of the system configuration activities for your Netopia equipment through a local serial console connection, if available, using ter minal emulation software, such as Hype[...]

1-6 Firmware User Guide Launch your ter minal emulation software and configur e the communications software for the values shown in the table below . These are the default communication parameters that the Netopia Fir mwar e V ersion 5.4 uses. Parameter Suggested V alue T er minal type PC : ANSI-BBS Mac : ANSI, VT-100, or VT-200 Data bits 8 Parity[...]

Introduction 1-7 Na vigating thr ough the Console Screens Use your keyboard to navigate the Netopia Fir mwar e V ersion 5.4’s configuration screens, enter and edit infor mation, and make choices. The following table lists the keys to use to navigate through the console screens. T o help you find your way to par ticular screens, some sections in[...]

1-8 Firmware User Guide[...]

W AN and System Configuration 2-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 2 2 2 2 W W W W A A A A N N N N a a a a n n n n d d d d S S S S y y y y s s s s t t t t e e e e m m m m C C C C o o o o n n n n f f f f ii i i g g g g u u u u r r r r a a a a t t t t ii i i o o o o n n n n This chapter describes how to use the console-based m[...]

2-2 Firmware User Guide ADSL Line Configuration screen The ADSL Line Configuration screen is shown below: 1. Select Circuit Type and from the pop-up menu choose the type of cir cuit to which you will be connecting: Multimode, T1.413, G.dmt/G.lite, or ADI. 2. Select Trellis Coding Enabled . T oggle it to On (the default) or Of f. 3. Select Signali[...]

W AN and System Configuration 2-3 SDSL/IDSL Configuration screen The SDSL/IDSL Line Configuration screen is shown below: ■ Select a Line T ype fr om the pull-down menu. Y ou can choose SDSL-A TM , SDSL-HDLC , IDSL , or IDSL-CM . For IDSL connections, choose IDSL if your ser vice pr ovider uses most common central of fice equipment; choose IDS[...]

2-4 Firmware User Guide Some of these selections will reset the defaults for the r emaining options in this screen. Y ou will be challenged to confir m your choice. The SDSL-HDLC and IDSL Line Types do not of fer these choices. ■ The Data Rate Mode pull-down menu allows you to select either Hunt or Locked mode. ■ If you choose Hunt , the route[...]

W AN and System Configuration 2-5 IDSL Line Configuration screen The IDSL Line Configuration screen is shown below: ■ For IDSL lines, the Data Rate (kbps) pull-down menu of fers 64 (B1) , 64 (B2) , 128 (B1+B2) , or 144 (2B+D) . ■ The Data Link Encapsulation pull-down menu of fers PPP , HDLC , or Frame Relay . ■ If you are using Frame Relay[...]

2-6 Firmware User Guide G.SHDSL Line Configuration screen The G.SHDSL Line Configuration screen is shown below: Each access concentrator (DSLAM) has a dif fer ent set of defaults and other parameters. Y our ser vice pr ovider should supply you with the appropriate infor mation about the type and capabilities of the access concentrator equipment t[...]

W AN and System Configuration 2-7 T1 Line Configuration screen The T1 Line Configuration screen is shown below: ■ Select Operation Mode and press Retur n. From the pop-up menu, highlight the mode your telephone ser vice pr ovider uses: HDLC (Cisco), CM-HDLC (Copper Mountain), or AT M . The default setting is HDLC. Press Retur n. ■ Select Lin[...]

2-8 Firmware User Guide default setting is 1 (one). Press Retur n. Note: Y ou can change the First DS0 Channel number , which has a valid range from one to the maximum number minus the number of active channels. If the number of active DS0 channels is 24 (maximum), First DS0 Channel is hidden. If you specify a number of DS0 channels less than the m[...]

W AN and System Configuration 2-9 Note: If you used Easy Setup to configure your r outer , you have alr eady created a connection pr ofile called Easy Setup Profile. If you r eturn to the Easy Setup menus and change the Data Link Encapsulation method you set up in this step, the Easy Setup Data Link Encapsulation method will over ride this one [...]

2-10 Firmware User Guide 1. Select LMI T ype (Link Management Type) and pr ess Retur n. From the pop-up menu, highlight either ANSI (Annex D) , CCITT (Annex A) , LMI , or None . The default is None . Press Retur n. See “Frame Relay DLCI configuration” on page 2-11 for instr uctions. Specifying the Link Management Type is the first step in con[...]

W AN and System Configuration 2-11 ting defaults to 64000, but you may modify the capacity rate if this setting will not be applicable to you. ■ The Default Bc (Bc also refer r ed to as Committed Burst Size) repr esents the maximum amount of data that your Frame Relay ser vice pr ovider agrees to transfer from a given PVC (Per manent Vir tual Ci[...]

2-12 Firmware User Guide T o go to the Frame Relay DLCI configuration screen, select Frame Relay DLCI Configuration in the W AN Configuration screen. Displa ying a Frame Relay DLCI configuration table T o display a view-only table of the Frame Relay DLCIs, select Display/Change DLCIs in the Frame Relay DLCI Configuration screen, and pr ess Ret[...]

W AN and System Configuration 2-13 Changing a Frame Rela y DLCI configuration T o modify a Frame Relay DLCI configuration, select Display/Change DLCIs in the Frame Relay DLCI Configuration screen. Select a DLCI Name from the table and pr ess Return to go to the Change DLCI screen. The parameters in this screen ar e the same as the parameters in[...]

2-14 Firmware User Guide Adding a Frame Rela y DLCI configuration T o add a new Frame Relay DLCI, select Add DLCI in the Frame Relay DLCI Configuration screen and press Retur n. The Add DLCI screen appears. 1. Select DLCI Name and enter a name for this individual Frame Relay DLCI profile. It can be any name you want. For example: the name of you[...]

W AN and System Configuration 2-15 provider agr ees to transfer from a given PVC (Per manent Vir tual Cir cuit) or DLCI (Data Link Connection Identifier). The setting defaults to 64000, but you may modify the committed burst size by toggling the selection in the Use Default field to No . Y ou can then enter a dif fer ent committed burst size in [...]

2-16 Firmware User Guide Multiple A TM P ermanent Vir tual Cir cuits The Netopia Fir mware V ersion 5.4 suppor ts up to eight per manent vir tual cir cuits. Multiple A TM PVC overview On cell-based DSL W AN inter faces, the A TM connection between the device and the central of fice equipment (DSLAM) is divided logically into one or more vir tual c[...]

W AN and System Configuration 2-17 3. T o add a circuit, select Add Cir cuit and press Retur n. The Add Circuit scr een appears. ■ Enter a name for the circuit in the Cir cuit Name field. ■ T oggle Circuit Enabled to Y es. ■ Enter the Vir tual Path Identifier and the Vir tual Channel Identifier in the Circuit VPI and Cir cuit VCI fields,[...]

2-18 Firmware User Guide Quality of Service (QoS) settings ■ Select the QoS (Quality of Ser vice) setting from the pop-up menu: UBR . or CBR . UBR : No configuration is needed for UBR VCs. Leave the default value 0 (maximum line rate). CBR : One parameter is requir ed for CBR VCs. Enter the Peak Cell Rate that applies to the VC. This value shoul[...]

W AN and System Configuration 2-19 Note: With multiple VCs you must explicitly statically bind the second (and all subsequent) VCs to a profile. The first VC will automatically statically bind according to pr e-defined dynamic binding r ules when you add the second VC. It will rever t back to dynamic binding if the number of VCs is r educed to [...]

2-20 Firmware User Guide Editing cir cuits Y ou configure Vir tual Cir cuits in the A TM Circuits Configuration scr een. From the Main Menu, navigate to the A TM Cir cuits Configuration screen. Select Show/Change Circuit and pr ess Return. Main Menu WA N Conf iguration A TM Cir cuits Conf iguration ATM Circuits Configuration Show/Change Circuit.[...]

W AN and System Configuration 2-21 Choosing Show/Change Circuit (or Delete Circuit) displays a pop-up menu that allows you to select the cir cuit to be modified or deleted. Changing a cir cuit If you want to make any changes to the circuit you select, you make them in the Change Cir cuit screen. ■ Circuit Name allows you to associate a one- to [...]

2-22 Firmware User Guide ■ Circuit Enabled allows you to enable or disable the cir cuit, using the T ab key . The default is enabled. ■ Traf fic T ype allows you to select which type of traf fic will be routed on this cir cuit, V oice or Data. If you choose V oice, the Connection Profile is field becomes unavailable and does not display . ?[...]

W AN and System Configuration 2-23 Select VC Traf fic Statistics . The A TM VC Statistics scr een appears. ■ T o display more infor mation about each cir cuit associated with the selected W AN module, use the up or down ar row key to highlight the cir cuit you want to view . Pr ess Return. A pop-up window appears, displaying detailed infor mati[...]

2-24 Firmware User Guide Creating a Ne w Connection Pr ofile Connection profiles ar e useful for configuring the connection and authentication settings for negotiating a PPP connection on a DSL link. If you are using the PPP data link encapsulation method, you can stor e your authentication infor mation in the connection profile so that your us[...]

W AN and System Configuration 2-25 Multiple Data Link Encapsulation Settings 4. Select Encapsulation Options and press Retur n. ❥ If you selected A TMP , PPTP , L2TP , or IPSec, see Chapter 4, “Vir tual Private Networks (VPNs).” ❥ If you selected PPP or RFC1483, the screen of fers dif fer ent options: If you are using PPP , when you select[...]

2-26 Firmware User Guide Retur n to the Add Connection Profile screen by pr essing Escape. 5. Select IP Profile Parameters and pr ess Return. The IP Pr ofile Parameters screen appears. Datalink (PPP/MP) Options Data Compression... Standard LZS Send Authentication... PAP Send User Name: Send Password: Receive User Name: Receive Password: ❥ If y[...]

W AN and System Configuration 2-27 6. T oggle or enter any IP Parameters you requir e and retur n to the Add Connection Profile scr een by pressing Escape. For more infor mation, see “IP Setup” on page 6-2 . 7. Select COMMIT and press Retur n. Y our new Connection Profile will be added. If you want to view the Connection Profiles in your de[...]

2-28 Firmware User Guide The Default Pr ofile If you are using RFC1483 data link encapsulation, the Default Pr ofile screen contr ols whether or not the DSL link will come up without an explicitly configured connection pr ofile. (PPP datalink encapsulation does not suppor t a default profile, and the cor responding menu item is unavailable.) S[...]

W AN and System Configuration 2-29 IP parameters (default pr ofile) screen If you are using RFC1483 datalink encapsulation, the IP Parameters (Default Pr ofile) screen allows you to configure various IP parameters for DSL connections established without an explicitly configur ed connection profile: For an DSL link, Network Address T ranslatio[...]

2-30 Firmware User Guide Viewing sc heduled connections T o display a table of scheduled connections, select Display/Change Scheduled Connection in the Scheduled Connections screen. Each scheduled connection occupies one r ow of the table. The first column in the table shows a one-letter repr esentation of the Days of the week, from Monday (M or m[...]

W AN and System Configuration 2-31 The other columns show: ■ The time of day that the connection will Begin At ■ The duration of the connection ( HH:MM ) ■ Whether it’s a recur ring Weekly connection or used Once Only ■ Which connection profile ( Conn. Pr of. ) is used to connect ■ Whether the scheduled connection is cur rently Enable[...]

2-32 Firmware User Guide demand call on the line. ■ Demand-Allowed , meaning that this schedule will per mit a demand call on the line. ■ Demand-Blocked , meaning that this schedule will prevent a demand call on the line. ■ Periodic , meaning that the connection is retried several times during the scheduled time. ■ If How Often is set to W [...]

W AN and System Configuration 2-33 Set Once-Only Sc hedule If you set How Often to Once Only , select Set Once-Only Schedule and go to the Set Once-Only Schedule screen. ■ Select Place Call On (Date) and enter a date in the for mat MM/DD/YY or MM/DD/YYYY (month, day , year). Note: Y ou must enter the date in the for mat specified. The slashes a[...]

2-34 Firmware User Guide Modifying a scheduled connection T o modify a scheduled connection, select Display/Change Scheduled Connection in the Scheduled Connections screen to display a table of scheduled connections. Select a scheduled connection from the table and pr ess Return. The Change Scheduled Connection scr een appears. The parameters in th[...]

W AN and System Configuration 2-35 System Configuration Screens System configuration features The Netopia Fir mware V ersion 5.4 default settings may be all you need to configur e your Router. Some users, however , requir e advanced settings or prefer manual control over the default selections. For these users, Netopia Fir mware V ersion 5.4 pr[...]

2-36 Firmware User Guide The System Configuration menu screen appears: IP Setup These screens allow you to configur e your network’s use of the IP networking protocol. ■ Details are given in “IP Setup” on page 6-2 . Filter Sets These screens allow you to configur e security on your network by means of filter sets and a basic firewall. [...]

W AN and System Configuration 2-37 Stateful Inspection firewall Stateful inspection firewall is a security featur e that prevents unsolicited inbound access when NA T is disabled. Y ou can configure UDP and TCP “no-activity” periods that will also apply to NA T time-outs if stateful inspection is enabled on the inter face. Stateful Inspecti[...]

2-38 Firmware User Guide Stateful Inspection Options Enable and configure stateful inspection on a WAN inter face. When you create or modify a Connection Pr ofile, the IP Profile Parameters scr een allows you to enable Stateful Inspection on that profile by toggling Stateful Inspection Enabled to Ye s . By default, this is tur ned of f (No). If[...]

W AN and System Configuration 2-39 ■ Max. TCP Sequence Number Dif fer ence : Enter a value in this field. This value represents the maximum sequence number dif fer ence allowed between subsequent TCP packets. If this number is exceeded, the packet is dropped. The acceptable range is 0 – 65535. A value of 0 (zer o) disables this check. ■ Ena[...]

2-40 Firmware User Guide Exposed Addresses Y ou can specify the IP addresses you want to expose by selecting Add Exposed Address List and pr essing Retur n. The Add Exposed Address List screen appears. Add, Edit, or delete exposed addresses options ar e active only if NA T is disabled on an WAN inter face. The hosts specified in exposed addresses [...]

W AN and System Configuration 2-41 ■ Star t Address: Star t IP Address of the exposed host range. ■ End Address: End IP Addr ess of the exposed host range ■ Protocol : Select the Pr otocol of the traf fic to be allowed to the host range fr om the pull-down menu. Options are Any , TCP , UDP , or TCP/UDP . ■ Star t Por t: Star t por t of th[...]

2-42 Firmware User Guide Date and time Y ou can set the system’s date and time parameters in the Set Date and Time screen. Select Date and Time in the System Configuration screen and pr ess Return. The Set Date and Time scr een appears. Follow these steps to set the system’s date and time: 1. T oggle NTP (Network Time Prot.) Enabled to On to s[...]

W AN and System Configuration 2-43 Console Configuration Y ou can change the default ter minal communications parameters to suit your requir ements. T o go to the Console Configuration screen, select Console Configuration in the System Configuration screen. Follow these steps to change a parameter’s value: 1. Select 57600, 38400, 19200, or 9[...]

2-44 Firmware User Guide RFC-1483 T ransparent Bridging This feature allows you to tur n of f the r outing features and use your device as a bridge. If you select this option, the device will restar t itself, and r eset all the settings to factor y defaults. Any configurations you have made will be erased. Use this feature with caution. If you dec[...]

W AN and System Configuration 2-45 Y ou can reinstate r outer mode by retur ning to the System Configuration menu. Select Change Device to a Router . Press Return , confir m your choice, and the device will r estar t in router mode. Bridged Frame-Relay . Note: Netopia Fir mware V ersion 5.4 now suppor ts additional Frame Relay configuration opt[...]

2-46 Firmware User Guide Logging Y ou can configure a UNIX-compatible syslog client to r epor t a number of subsets of the events entered in the router’s WAN Event Histor y . See “W AN Event Histor y” on page 9-5 . Select Logging from the System Configuration menu. The Logging Configuration screen appears. By default, all events are logged[...]

W AN and System Configuration 2-47 Y ou will need to install a Syslog client daemon program on your PC and configur e it to repor t the WAN events you specified in the Logging Configuration screen. The following screen shows a sample syslog dump of WAN events: May 5 10:14:06 tsnext.netopia.com Link 1 down: PPP PAP failure May 5 10:14:06 tsnext.[...]

2-48 Firmware User Guide[...]

Multiple Network Address T ranslation 3-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 3 3 3 3 M M M M u u u u ll l l t t t t ii i i p p p p ll l l e e e e N N N N e e e e t t t t w w w w o o o o r r r r k k k k A A A A d d d d d d d d r r r r e e e e s s s s s s s s T T T T r r r r a a a a n n n n s s s s ll l l a a a a t t t t ii i i o[...]

3-2 Firmware User Guide Features MultiNA T featur es can be divided into several categories that can be used simultaneously in dif fer ent combinations on a per-Connection Profile basis. The following is a general description of these features: P ort Address T ranslation The simplest for m of classic Network Address T ranslation is PAT (Por t Addr[...]

Multiple Network Address T ranslation 3-3 Dynamic mapping Dynamic mapping , often refer r ed to as many-to-few , of fers an extension to the advantages pr ovided by static mapping. Instead of requiring a one-to-one association of public addr esses and private addresses, as is requir ed in static mapping, dynamic mapping uses a group of public IP ad[...]

3-4 Firmware User Guide Exterior addresses ar e allocated to internal hosts on a demand, or as-needed, basis and then made available when traf fic fr om that host ceases. Once an inter nal host has been allocated an address, it will use that address for all traf fic. Five minutes after all traf fic ceases – no pings, all TCP connections closed[...]

Multiple Network Address T ranslation 3-5 Complex maps Map lists and ser ver lists ar e completely independent of each other . A Connection Pr ofile can use one or the other or both. MultiNA T allows complex mapping and r equires mor e complex configuration than in earlier fir mware versions. Multiple mapped interior subnets are suppor ted, and [...]

3-6 Firmware User Guide Cur rently ther e is a restriction that the r emote user must be routed to via the W AN inter face, other wise the connections will fail. There is no r estriction as to the number of connections. There is no user configuration r equired for this featur e. MultiNA T Configuration Y ou configure the MultiNA T features thr o[...]

Multiple Network Address T ranslation 3-7 Server Lists and Dynamic NA T configuration Y ou use the advanced NA T featur e sets by first defining a series of mapping r ules and then grouping them into a list . There ar e two kinds of lists -- map lists , made up of dynamic, P A T and static mapping r ules, and ser ver lists , a list of inter nal [...]

3-8 Firmware User Guide Select Network Address Translation (NA T) and press Retur n. The Network Address T ranslation scr een appears. Public Range defines an external addr ess range and indicates what type of mapping to apply when using this range. The types of mapping available are dynamic , static and pat . Map Lists define collections of mapp[...]

Multiple Network Address T ranslation 3-9 NA T rules The following r ules apply to assigning NA T ranges and ser ver lists: ■ Static public address ranges must not overlap other static, P A T , public addresses, or the public addr ess assigned to the router’s WAN inter face. ■ A P A T public addr ess must not overlap any static address ranges[...]

3-10 Firmware User Guide Select First Public Address and enter the first exterior IP addr ess in the range you want to assign. Select Last Public Address and enter an IP addr ess at the end of the range. ■ Select ADD NA T PUBLIC RANGE and pr ess Return. The range will be added to your list and you will be retur ned to the Network Address T ransl[...]

Multiple Network Address T ranslation 3-11 ■ Select Add Map and press Retur n. The Add NA T Map scr een appears. ■ Select First and Last Private Address and enter the first and last interior IP addr esses you want to assign to this mapping. ■ Select Use NA T Public Range and pr ess Return. A scr een appears displaying the public ranges you h[...]

3-12 Firmware User Guide mapping and press Retur n. If none of your preconfigur ed ranges are suitable for this mapping, you can select <<NEW RANGE>> and create a new range. If you choose <<NEW RANGE>> , the Add NA T Public Range screen displays and you can create a new public range to be used by this map. See Add NA T Publ[...]

Multiple Network Address T ranslation 3-13 Modifying map lists Y ou can make changes to an existing map list after you have created it. Since ther e may be more than one map list you must select which one you are modifying. From the Network Addr ess T ranslation screen select Show/Change Map List and press Retur n. ■ Select the map list you want [...]

3-14 Firmware User Guide ■ Add Map allows you to add a new map to the map list. ■ Show/Change Maps allows you to modify the individual maps within the list. ■ Delete Map allows you to delete a map from the list. Selecting Show/Change Maps or Delete Map displays the same pop-up menu. Scroll to the map you want to modify using the ar r ow keys [...]

Multiple Network Address T ranslation 3-15 Adding Server Lists Ser ver lists, also known as Expor ts, ar e handled similarly to map lists. If you want to make a par ticular ser ver’s por t accessible (and it isn’t accessible through other means, such as a static mapping), you must cr eate a ser ver list. Select Add Ser ver List from the Network[...]

3-16 Firmware User Guide ■ Select Add Ser ver and press Retur n. The Add NA T Ser ver screen appears. ■ Select Ser vice and press Retur n. A pop-up menu appears listing a selection of commonly expor ted ser vices. ■ Choose the ser vice you want to expor t and pr ess Return. Y ou can choose a preconfigur ed ser vice from the list, or define [...]

Multiple Network Address T ranslation 3-17 ■ Enter the First and Last Por t Number between por ts 1 and 65535. Select OK and press Retur n. Y ou will be retur ned to the Add NA T Ser ver screen. ■ Enter the Ser ver Private IP Address of the ser ver whose ser vice you are expor ting. Since MultiNA T per mits the mapping of multiple private IP ad[...]

3-18 Firmware User Guide Modifying server lists Once a ser ver list exists, you can select it for modification or deletion. ■ Select Show/Change Ser ver List from the Network Addr ess T ranslation screen. ■ Select the Ser ver List Name you want to modify fr om the pop-up menu and press Retur n. The Show/Change NA T Ser ver List screen appears.[...]

Multiple Network Address T ranslation 3-19 ■ Selecting Show/Change Ser ver or Delete Ser ver displays the same pop-up menu. Select any ser ver fr om the list and press Retur n. The Change NA T Ser ver screen appears. Y ou can make changes to the ser ver’s ser vice and por t or internal or exter nal addr ess. Select CHANGE NA T SERVER and pr ess[...]

3-20 Firmware User Guide Deleting a server T o delete a ser ver from the list, select Delete Ser ver fr om the Show/Change NA T Ser ver List menu and pr ess Retur n. A pop-up menu lists your configured ser vers. Select the one you want to delete and press Retur n. A dialog box asks you to confir m your choice. Choose CONTINUE and press Retur n. T[...]

Multiple Network Address T ranslation 3-21 Binding Map Lists and Server Lists Once you have created your map lists and ser ver lists, for most Netopia Router models you must bind them to a profile, either a Connection Pr ofile or the Default Profile. Y ou do this in one of the following scr eens: ■ the IP profile parameters scr een (see below[...]

3-22 Firmware User Guide ■ Select NA T Map List and pr ess Return. A pop-up menu displays a list of your defined map lists. ■ Select the map list you want to bind to this Connection Profile and pr ess Return. The map list you selected will now be bound to this Connection Profile. ■ Select NA T Ser ver List and pr ess Return. A pop-up menu [...]

Multiple Network Address T ranslation 3-23 IP P arameters (W AN Default Pr ofile) The Netopia Fir mware V ersion 5.4 using RFC 1483 suppor ts a W AN default pr ofile that per mits several parameters to be configured without an explicitly configur ed Connection Profile. The procedur e is similar to the procedur e to bind map lists and ser ver l[...]

3-24 Firmware User Guide ■ Select NA T Map List and pr ess Return. A pop-up menu displays a list of your defined map lists. ■ Select the map list you want to bind to the default profile and pr ess Return. The map list you selected will now be bound to the default profile. ■ Select NA T Ser ver List and pr ess Return. A pop-up menu displays[...]

Multiple Network Address T ranslation 3-25 NA T Associations Configuration of map and ser ver lists alone is not suf ficient to enable NA T for a WAN connection because map and ser ver lists must be linked to a pr ofile that controls the W AN inter face. This can be a Connection Profile, a W AN Ether net inter face, a default pr ofile, or a de[...]

3-26 Firmware User Guide keys. Select the item by pressing Retur n to display a pop-up menu of all of your configured lists. ■ Select the list name you want to assign and press Retur n again. Y our selection will then be associated with the cor responding pr ofile or inter face. NAT Associations +NAT Map List Name-+ Profile/Interface Name------[...]

Multiple Network Address T ranslation 3-27 IP P assthrough Netopia Fir mware V ersion 5.4 of fers an IP passthr ough feature. The IP passthr ough feature allows for a single PC on the LAN to have the router’s public addr ess assigned to it. It also provides P A T (NAPT) via the same public IP address for all other hosts on the private LAN subnet.[...]

3-28 Firmware User Guide The IP Profile Parameters scr een, found under the W AN Configuration menu, Add/Change Connection Profile screen, appears as shown. If you select NA T Options , in either case, the NA T Options screen appears. If you toggle IP Passthrough Enabled to Ye s , additional field(s) appear . IP Profile Parameters Address Trans[...]

Multiple Network Address T ranslation 3-29 T oggling IP Passthrough DHCP Enabled to Ye s displays the IP Passthr ough DHCP MAC address field. This is an editable field in which you can enter the MAC (hardwar e) address of the designated PC be used as the DHCP Client Identifier for dynamic address r eser vation. The MAC address must be six colon-[...]

3-30 Firmware User Guide A restriction Since both the router and the passthr ough host will use same IP address, new sessions that conflict with existing sessions will be rejected by the r outer . For example, suppose you ar e a teleworker using an IPSec tunnel from the r outer and from the passthr ough host. Both tunnels go to the same remote end[...]

Multiple Network Address T ranslation 3-31 MultiNA T Configuration Example T o help you understand a typical MultiNA T configuration, this section describes an example of the type of configuration you may want to implement on your site. The values shown are for example purposes only . Make your own appropriate substitutions. A typical DSL ser vi[...]

3-32 Firmware User Guide Enter your ISP-supplied values as shown below . Select NEXT SCREEN and press Retur n. Y our IP values are shown her e. Then navigate to the Network Address T ranslation (NA T) screen. Connection Profile 1: Easy Setup Profile Connection Profile Name: Easy Setup Profile Address Translation Enabled: Yes IP Addressing... Number[...]

Multiple Network Address T ranslation 3-33 Select Show/Change Public Range , then Easy-P A T Range , and pr ess Return. Enter the value your ISP assigned for your public address (206.1.1.6, in this example). T oggle Type to pat. Y our public address is then mapped to the remaining private IP addr esses using P A T . (If you wer e not using the Easy[...]

3-34 Firmware User Guide Select ADD NA T PUBLIC RANGE and pr ess Return. Y ou ar e retur ned to the Network Address T ranslation screen. Next, select Show/Change Map List and choose Easy-P A T List . Select Add Map . The Add NA T Map screen appears. (Now the name Easy-P A T List is a misnomer since it has a static map included in its list.) Enter i[...]

Multiple Network Address T ranslation 3-35 T o make these changes, first limit the range of remapped addr esses on the Static Map and then edit the default ser ver list called Easy-Ser vers. ■ First, navigate to the Show/Change Map List screen, select Easy-P A T List and then Show/Change Maps . Choose the Static Map you created and change the Fi[...]

3-36 Firmware User Guide[...]

Virtual Private Networks (VPNs) 4-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 4 4 4 4 V V V V ii i i r r r r t t t t u u u u a a a a ll l l P P P P r r r r ii i i v v v v a a a a t t t t e e e e N N N N e e e e t t t t w w w w o o o o r r r r k k k k s s s s ( ( ( ( V V V V P P P P N N N N s s s s ) ) ) ) The Netopia Fir mware V ersio[...]

4-2 Firmware User Guide The Netopia Fir mware V ersion 5.4 can be used in VPNs either to initiate the connection or to answer it. When used in this way , the r outers are said to be tunnelling through the public network (Inter net). The advantages are that, like your long distance phone call, you don't need a direct line between one computer o[...]

Virtual Private Networks (VPNs) 4-3 protocol over IP . A TMP is more ef ficient than PPTP for network-to-network tunnels. ■ IPsec stands for IP Security , a set of pr otocols that suppor ts secure exchange of IP packets at the IP layer . IPsec is deployed widely to implement Vir tual Private Networks (VPNs). IPsec suppor ts two encr yption modes[...]

4-4 Firmware User Guide About PPTP T unnels T o set up a PPTP tunnel, you create a Connection Pr ofile including the IP address and other relevant infor mation for the remote PPTP par tner . Y ou use the same pr ocedure to initiate a PPTP tunnel that ter minates at a r emote PPTP ser ver or to ter minate a tunnel initiated by a r emote PPTP client[...]

Virtual Private Networks (VPNs) 4-5 When you define a Connection Profile as using PPTP by selecting PPTP as the datalink encapsulation method, and then select Data Link Options , the PPTP T unnel Options screen appears. ■ Enter the PPTP Par tner IP Address . This specifies the addr ess of the other end of the tunnel. If you do not specify the [...]

4-6 Firmware User Guide Note: The Netopia Fir mware V ersion 5.4 suppor ts 128-bit (“strong”) encr yption. Unlike MS-CHAP version 1, which suppor ts one-way authentication, MS-CHAP version 2 suppor ts mutual authentication between connected routers and is incompatible with MS-CHAP version 1 (MS-CHAP-V1). When you choose MS-CHAP as the authentic[...]

Virtual Private Networks (VPNs) 4-7 The IP Profile Parameters scr een appears. ■ Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel. About IPsec T unnels IPsec stands for IP Security , a set of pr otocols that suppor ts secure exchange of IP packets at the IP layer . IPsec is deployed widely to implement Vir [...]

4-8 Firmware User Guide About A TMP T unnels T o set up an A TMP tunnel, you cr eate a Connection Profile including the IP addr ess and other relevant infor mation for the remote A TMP par tner . A TMP uses the ter minology of a foreign agent that initiates tunnels and a home agent that ter minates them. Y ou use the same procedur e to initiate or[...]

Virtual Private Networks (VPNs) 4-9 When you define a Connection Profile as using A TMP by selecting A TMP as the datalink encapsulation method, and then select Data Link Options , the A TMP T unnel Options scr een appears. Note: An A TMP tunnel cannot be assigned a dynamic IP addr ess by the remote ser ver , as in a PPP connection. When you de?[...]

4-10 Firmware User Guide them, acting as a home agent ( No ). ■ T unnels are nor mally initiated On Demand ; however , you can disable this feature. When disabled, the tunnel must be manually established through the call management scr eens. ■ Y ou can specify the Idle Timeout , an inactivity timer , whose expiration will ter minate the tunnel.[...]

Virtual Private Networks (VPNs) 4-11 MS-CHAP V2 and 128-bit str ong encryption Notes: ■ The Netopia Fir mware V ersion 5.4 suppor ts 128-bit (“strong”) encr yption when using PPTP tunnels. A TMP does not have an option of using 128-bit MPPE. If you ar e using A TMP between two Netopia r outers you can optionally set 56-bit DES encr yption. ?[...]

4-12 Firmware User Guide ■ T oggle Answer A TMP/PPTP Connections to Ye s if you want the r outer to accept VPN connections or No (the default) if you do not. ■ For PPTP tunnel connections only , you must define what type of authentication these connections will use. Select Receive Authentication and press Retur n. A pop-up menu of fers the fol[...]

Virtual Private Networks (VPNs) 4-13 VPN Quic kVie w Y ou can view the status of your VPN connections in the VPN QuickView screen. From the Main Menu select QuickView and then VPN QuickView . The VPN QuickView screen appears. Profile Name: Lists the name of the Connection Pr ofile being used, if any . Type: Shows the data link encapsulation metho[...]

4-14 Firmware User Guide Dial-Up Netw orking f or VPN Microsoft Windows Dial-Up Networking softwar e per mits a remote standalone workstation to establish a VPN tunnel to a PPTP ser ver such as a Netopia Router located at a central site. Dial-Up Networking also allows a mobile user who may not be connected to a P AC to dial into an inter mediate IS[...]

Virtual Private Networks (VPNs) 4-15 The Communications window appears. 5. In the Communications window , select Dial-Up Networking and click the OK button. This retur ns you to the Windows Setup screen. Click the OK button. 6. Respond to the prompts to install Dial-Up Networking fr om the system disks or CDROM. 7. When prompted, r eboot your PC. C[...]

4-16 Firmware User Guide Configuring a Dial-Up Netw orking profile Once you have created your Dial-Up Networking pr ofile, you configure it for TCP/IP networking to allow you to connect to the Inter net through your Inter net connection device. Do the following: 1. Double-click the My Computer (or whatever you have named it) icon on your deskto[...]

Virtual Private Networks (VPNs) 4-17 4. Click the TCP/IP Settings button. ■ If your ISP uses dynamic IP addressing (DHCP), select the Ser ver assigned IP address radio button. ■ If your ISP uses static IP addressing, select the Specify an IP addr ess radio button and enter your assigned IP address in the fields pr ovided. Also enter the IP add[...]

4-18 Firmware User Guide This displays a list of possible selections for the communications option. Active components will have a check in the checkboxes to their left. 6. Check Dial Up Networking at the top of the list and Vir tual Private Networking at the bottom of the list. 7. Click OK at the bottom right on each screen until you r eturn to the[...]

Virtual Private Networks (VPNs) 4-19 Connecting using Dial-Up Netw orking A Dial-Up Networking connection will be automatically launched whenever you r un a TCP/IP application, such as a web browser or email client. When you first r un the application a Connect T o dialog box appears in which you enter your User name and Password. If you check the[...]

4-20 Firmware User Guide PPTP example T o enable a firewall to allow PPTP traf fic, you must provision the fir ewall to allow inbound and outbound TCP packets specifically destined for por t 1723. The sour ce por t may be dynamic, so often it is not useful to apply a compare function upon this por tion of the contr ol/negotiation packets. Y ou [...]

Virtual Private Networks (VPNs) 4-21 In the Display/Change Filter Set screen select Display/Change Output Filter . Display/Change Output Filter screen Select Output Filter 1 and press Retur n. In the Change Output Filter 1 screen, set the Pr otocol Type and Destination Por t infor mation as shown below . Change Input Filter 2 Enabled: Yes Forward: [...]

4-22 Firmware User Guide Select Output Filter 2 and press Retur n. In the Change Output Filter 2 screen, set the Pr otocol Type to allow GRE as shown below . A TMP example T o enable a firewall to allow A TMP traf fic, you must pr ovision the firewall to allow inbound and outbound UDP packets specifically destined for por t 5150. The sour ce po[...]

Virtual Private Networks (VPNs) 4-23 Select Input Filter 1 and press Retur n. In the Change Input Filter 1 screen, set the Destination Por t infor mation as shown below . Select Input Filter 2 and press Retur n. In the Change Input Filter 2 screen, set the Pr otocol Type to allow GRE as shown below . Change Input Filter 1 Enabled: Yes Forward: Yes [...]

4-24 Firmware User Guide In the Display/Change Filter Set screen select Display/Change Output Filter . Display/Change Output Filter screen Select Output Filter 1 and press Retur n. In the Change Output Filter 1 screen, set the Pr otocol Type and Destination Por t infor mation as shown below . Select Output Filter 2 and press Retur n. In the Change [...]

Virtual Private Networks (VPNs) 4-25 Windo ws Netw orking Broadcasts Netopia fir mware pr ovides the ability to for ward Windows Networking NetBIOS br oadcasts. This is useful for , for example, a Vir tual Private Network, in which you want to be able to browse the r emote network to which you are tunnelling, as par t of your Windows Network Neigh[...]

4-26 Firmware User Guide Configuration for Router A Configuration for Router B IP Profile Parameters Address Translation Enabled: No Remote IP Address: 192.168.2.1 Remote IP Mask: 255.255.255.0 Filter Set... Remove Filter Set NetBIOS Proxy Enabled Yes RIP Profile Options... Enter an IP address in decimal and dot form (xxx.xxx.xxx.xxx). Configure [...]

Virtual Private Networks (VPNs) 4-27 Note: Microsoft Network br owsing is available with or without a Windows Internet Name Ser vice (WINS) ser ver . Shared volumes on the r emote network are accessible with or without a WINS ser ver . Local LAN shar ed volumes that have Por t Address T ranslation (P A T) applied to them ar e not available to hosts[...]

4-28 Firmware User Guide[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 5 5 5 5 II I I n n n n t t t t e e e e r r r r n n n n e e e e t t t t K K K K e e e e y y y y E E E E x x x x c c c c h h h h a a a a n n n n g g g g e e e e ( ( ( ( II I I K K K K E E E E ) ) ) ) II I I P P P P s s s s e e e e c c[...]

5-2 Firmware User Guide the two devices on the Inter net to communicate securely . ■ Phase 2 establishes the tunnel and provides for secur e transpor t of data. IPsec can be configured without IKE, but IKE of fers additional features, flexibility , and ease of configuration. Key exchange between your local router and a r emote point can be con[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-3 The Add Connection Profile scr een appears. ■ From the Encapsulation Type pop-up menu select IPsec . ■ Then select Encapsulation Options . The IPsec T unnel Options screen appears. Main Menu WA N Conf iguration Add Connection Prof ile Add Connection Profile Profile Name: Profile 1 P[...]

5-4 Firmware User Guide For Key Management you can use either IKE or Manual . If you choose Manual, skip to “IPsec Manual Key Entr y” on page 5-19 . If you choose IKE (the default) continue below . ■ Select IKE Phase 1 Profile and pr ess Return. ■ A pop-up window displays a list of IKE Phase 1 Profiles that you have configur ed. If you h[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-5 ■ The Profile Name field accepts any name of up to 16 characters. Sixteen IKE Phase 1 pr ofiles are suppor ted, since each of the potential sixteen Connection Profiles may be associated with a separate IKE Phase 1 profile. ■ The Mode pop-up menu allows you to choose between Main[...]

5-6 Firmware User Guide that will be used to generate key material for IKE Phase 1. ■ The Encryption Algorithm pop-up menu specifies the IKE Phase 1 encr yption algorithm, and may be either DES (the default) or 3DES. ■ The Hash Algorithm pop-up menu specifies the IKE Phase 1 hash algorithm, and may be either SHA1 (the default) or MD5. ■ The[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-7 the Phase 1 SAs under which they were cr eated. Phase 2 SAs “dangle” when the Phase 1 SA under which they were cr eated expires befor e they do. There is no requir ement that the Phase 1 SA exist for the duration of the Phase 2 SA ’s lifetime, but it is convenient because a Delete [...]

5-8 Firmware User Guide Changing an IKE Phase 1 Pr ofile Selecting Display/Change IKE Phase 1 Profile or Delete IKE Phase 1 Profile displays an IKE Phase 1 pr ofile pop-up menu listing the names of all cur rently defined IKE Phase 1 pr ofiles: Selecting Display/Change IKE Phase 1 Profile and choosing an IKE phase 1 pr ofile name from the po[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-9 K ey Mana g ement Y ou specify your IKE key management on a per-Connection Profile basis. Y ou can do this in one of thr ee ways: ■ Y ou can create your IKE Phase 1 Pr ofile first, and then associate it with an existing Connection Profile ■ Y ou can create a Connection Pr ofile [...]

5-10 Firmware User Guide Note: The Change Connection Profile scr een will of fer dif ferent options, depending on the model of r outer you are using. For a r outer with the Dial Backup feature, you can associate an IPsec pr ofile with the Primar y , the Backup, or choose to apply it to Any Por t of the W AN inter face by choosing the inter face f[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-11 The Key Management pop-up menu at the top of the IPsec T unnel Options screen allows you to choose between IKE key management (the default for a new IPsec profile) and Manual key management. If you select Manual , the IKE Phase 1 Profile option does not display , and you must enter yo[...]

5-12 Firmware User Guide This screen allows you to specify the lifetime associated with each IPsec Security Association (SA) and contr ol when the SA will expire and become invalid. ■ SA Lifetime (seconds) specifies the duration in seconds for which the SA will remain valid. The range of per missible values is the set of non-negative integer val[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-13 Netopia Fir mware V ersion 5.4 pr ovides a new Dead Peer Detection mechanism. An IPsec IP net inter face sends ICMP ping requests to a specific IP addr ess on a Remote Member network. The ping is periodic, and the reply is expected within a cer tain amount of time. If the ICMP r eply d[...]

5-14 Firmware User Guide If you enable IKE key management the IP Profile Parameters scr een appears. ■ The Remote Tunnel Endpoint field accepts either an IP address in the familiar dotted–quad notation a.b.c.d or a hostname to be resolved using the Domain Name System (DNS). Multiple Netw ork IPsec Netopia Fir mware V ersion 5.4 of fers an enh[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-15 ■ suppor t for sub-netting, host and network range addressing modes ■ works with manual keying and Inter net Key Exchange (IKE) ■ each IPsec network works under the same local/remote tunnel endpoints ■ Select Add Network and press Retur n. The Add Network Configuration screen a[...]

5-16 Firmware User Guide If you retur n to the IP Profile Parameters scr een, two new fields are displayed: ■ Display/Change Network allows you to make changes to existing network configurations you have made. If you select Display/Change Network, a list of your configured networks displays. ■ Scroll down and up with the ar r ow keys to sel[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-17 ■ Specifying IKE key management alters the Advanced IP Profile Options screen as follows: ■ Y ou can specify a Local Tunnel Endpoint Address . If not 0.0.0.0, this value must be one of the assigned inter face addr esses, either W AN or LAN. This is used as the sour ce address of al[...]

5-18 Firmware User Guide IPsec W AN Configuration Screens Y ou can also configure IKE Phase 1 Pr ofiles in the W AN Configuration menus. The W AN Configuration scr een now includes IKE Phase 1 Configuration as shown: Select IKE Phase 1 Configuration and press Retur n. The IKE Phase 1 Configuration screen appears. W AN Conf iguration Main Me[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-19 The IKE Phase 1 Configuration screen allows configuration of global (non-connection-pr ofile-specific) IPsec parameters. This screen allows you to Display , Change, Add, or Delete an IKE Phase 1 profile. IPsec Manual K e y Entr y The V ersion 5.3 fir mware has a r edesigned layout[...]

5-20 Firmware User Guide Select IPsec Manual Keys and press Retur n. Depending on your selections of Encapsulation, Encr yption T ransfor m, and Authentication T ransfor m in the IPsec T unnel Options screen, the IPsec Manual Keys scr een will display dif fering entr y fields to enter authorization keys and encr yption keys. With Manual Keys, you [...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-21 If the remote tunnel end point is a hostname (or “0.0.0.0”) 0.0.0.0 is displayed until a Security Association is established. Previously the r emote members network was displayed. W AN Event Histor y Err or Repor ting The following events are logged and displayed in the WAN Event Hi[...]

5-22 Firmware User Guide IKE: no matching ph2 proposal Either the local router r ejected the proposals of the r emote or the remote r ejected the local router’s. IKE: ph2 resend timeout The attempt to resend the phase 2 authentication timed out. IKE: phase 2 complete The phase 2 negotiation completed successfully . Event message: Meaning:[...]

IP Setup 6-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 6 6 6 6 II I I P P P P S S S S e e e e t t t t u u u u p p p p The Netopia Fir mware V ersion 5.4 uses Inter net Pr otocol (IP) to communicate both locally and with remote networks. This chapter shows you how to configure the r outer to route IP traf fic. Y ou also lear n how to[...]

6-2 Firmware User Guide IP Setup The IP Setup options screen is wher e you configure the Ether net side of the Router. The infor mation you enter here contr ols how the router r outes IP traf fic. Consult your network administrator or ISP to obtain the IP setup infor mation (such as the Ether net IP address, Ether net subnet mask, default IP gate[...]

IP Setup 6-3 The Netopia Fir mware V ersion 5.4 suppor ts multiple IP subnets on the Ether net inter face. Y ou may want to configure multiple IP subnets to ser vice more hosts than ar e possible with your primar y subnet. It is not always possible to obtain a lar ger subnet from your ISP . For example, if you alr eady have a full Class C subnet, [...]

6-4 Firmware User Guide that the addresses distributed by the Router and those that ar e manually configured ar e not the same. Each method of distribution must have its own exclusive range of addresses to draw fr om. IP subnets The IP Subnets screen allows you to configur e up to eight Ethernet IP subnets on unlimited-user models, one “primar [...]

IP Setup 6-5 For example: ■ T o delete a configured subnet, set both the IP addr ess and subnet mask values to 0.0.0.0, either explicitly or by clearing each field and pressing Retur n to commit the change. When a configured subnet is deleted, the values in subsequent rows adjust up to fill the vacant fields. The subnets configured on this [...]

6-6 Firmware User Guide If you have configured multiple Ether net IP subnets, the IP Setup screen changes slightly: The IP address and Subnet mask items ar e hidden, and the Define Additional Subnets... item becomes Subnet Configuration... . If you select Subnet Configuration , you will retur n to the IP Subnets screen that allows you to defin[...]

IP Setup 6-7 The Static Routes screen will appear . Viewing static r outes T o display a view-only table of static routes, select Display/Change Static Route . The table shown below will appear . The table has the following columns: Dest. Network: The network IP address of the destination network. Static Routes Display/Change Static Route... Add St[...]

6-8 Firmware User Guide Subnet Mask: The subnet mask associated with the destination network. Next Gateway: The IP address of the r outer that will be used to reach the destination network. Priority: An indication of whether the Router will use the static route when it conflicts with infor mation r eceived from RIP packets. Enabled: An indication [...]

IP Setup 6-9 infor mation; Low means that the RIP infor mation takes precedence over the static r oute. ■ If the static route conflicts with a connection pr ofile, the connection profile will always take pr ecedence. ■ T o make sure that the static r oute is known only to the Router, select Adver tise Route Via RIP and toggle it to No . T o [...]

6-10 Firmware User Guide RIP-2 MD5 A uthentication Fir mware version 5.3.7 suppor ts RIP-2 MD5 Authentication (RFC2082 Routing Inter net Pr otocol V ersion 2, Message Digest 5). The purpose of MD5 authentication is to provide an additional level of confidence that a RIP packet received was generated by a r eliable source. In other wor ds, MD5 auth[...]

IP Setup 6-11 The IP Setup screen appears. ■ Select RIP Options . The Ethernet LAN RIP Options scr een appears. IP Setup Ethernet IP Address: 192.168.1.1 Ethernet Subnet Mask: 255.255.255.0 Define Additional Subnets... Default IP Gateway: 0.0.0.0 Backup IP Gateway: 0.0.0.0 Primary Domain Name Server: 0.0.0.0 Secondary Domain Name Server: 0.0.0.0 [...]

6-12 Firmware User Guide ■ Select Receive RIP , and from the pull-down menu choose v2 MD5 Authentication . ■ Y ou can also select T ransmit RIP , and choose v2 MD5 (br oadcast) or v2 MD5 (multicast) from the pull-down menu. ■ RIP v2 Authentication Keys is visible only if v2 MD5 Authentication is enabled for either Receive or Ethernet LAN RIP [...]

IP Setup 6-13 T ransmit RIP . Note: • All of the changes on this menu requir e a reboot. This is unique to the Ether net LAN. RIP changes on all other inter faces ar e immediately ef fective. • If you set the RIP Receive option to Both v1 and v2 , the inter face will ignore authenticated RIP packets since authenticated v1 packets do not exist. [...]

6-14 Firmware User Guide Adding a ke y Select Add Key . The Add Key Screen appears. ■ The key identifier Key ID can be any numeric value from 0 – 255, and must be unique per inter face. Y ou can not have two keys with the same key ID on an inter face. ■ The Authentication Key may consist of from 1 – 16 ASCII characters. These appear as ast[...]

IP Setup 6-15 Changing or deleting a key Y ou change or delete a key by selecting it from a pop-up menu. In the RIP v2 Authentication Keys menu, select Display/Change Key . Note: The date and time for mats are deter mined by the system date and time for mats. If the cur r ent date and time fall within the range of dates and times, the V alid field[...]

6-16 Firmware User Guide Connection Pr ofiles and Default Profile RIP-2 MD5 authentication may be configured in Connection Pr ofiles, as well. If you are not using NA T , your public Inter net connection can benefit from sending authenticated RIP packets as well as receiving them. T o configur e RIP-2 MD5 authentication for a Connection Pro?[...]

IP Setup 6-17 press COMMIT in the Add or Change Key scr een, then press Escape three times to r etur n to the Add or Change Connection Profile scr een. ■ Select COMMIT in the Connection Profile screen and pr ess Return. Y our changes become ef fective for the specified Connection Profile. P o wer interruptions Netopia 4000 Series routers use [...]

6-18 Firmware User Guide Go to the System Configuration screen. Select IP Addr ess Ser ving and press Retur n. The IP Address Ser ving screen will appear . Follow these steps to configure IP Addr ess Ser ving: ■ If you enabled IP Address Ser ving, then DHCP , BootP clients and Dynamic W AN clients ar e automatically enabled. ■ The IP Address [...]

IP Setup 6-19 Consequently , the DHCP lease time is configurable. The DHCP Lease Time (Hours) setting allows you to modify the router’s default lease time of one hour . Y ou can enter any number up to and including 168 hours (one week) for the DHCP lease. Note: About DHCP Auto-configuration: Beginning with Fir mware V ersion 5.3.4, r outers who[...]

6-20 Firmware User Guide IP Address P ools The IP Address Pools scr een allows you to configure a separate IP addr ess ser ving pool for each of up to eight configured Ether net IP subnets: This screen consists of between two and eight r ows of four columns each. There ar e exactly as many rows as there ar e Ethernet IP subnets configur ed on th[...]

IP Setup 6-21 Numerous factors influence the choice of ser ved address. It is dif ficult to specify the address that will be ser ved to a par ticular client in all cir cumstances. However , when the address ser ver has been configur ed, and the clients involved have no prior address ser ving interactions, the Router will generally ser ve the fi[...]

6-22 Firmware User Guide DHCP NetBIOS Options If your network uses NetBIOS, you can enable the Router to use DHCP to distribute NetBIOS infor mation. NetBIOS stands for Network Basic Input/Output System. It is a layer of software originally developed by IBM and Sytek to link a network operating system with specific hardwar e. NetBIOS has been adop[...]

IP Setup 6-23 ■ From the NetBIOS Type pop-up menu, select the type of NetBIOS used on your network. ■ T o ser ve DHCP clients with the NetBIOS scope, select Ser ve NetBIOS Scope and toggle it to Ye s . Select NetBIOS Scope and enter the scope. ■ T o ser ve DHCP clients with the IP address of a NetBIOS name ser ver , select Serve NetBIOS Name [...]

6-24 Firmware User Guide Select Release BootP Leases and press Retur n. ■ Back in IP Address Ser ving, the Ser ve Dynamic W AN Clients toggle More Address Serving Options The Netopia Fir mware V ersion 5.4 includes a number of enhancements in the built-in DHCP IP addr ess ser ver . These enhancements include: ■ The ability to exclude one or mor[...]

IP Setup 6-25 Configuring the IP Address Server options T o access the enhanced DHCP ser ver functions, from the Main Menu navigate to Statistics & Logs and then Ser ved IP Addresses . The following example shows the Ser ved IP Addr esses screen after three clients have leased IP addr esses. The first client did not provide a Host Name in its[...]

6-26 Firmware User Guide Y ou can select the entries in the Ser ved IP Addr esses screen. Use the up and down ar row keys to move the selection to one of the entries in the list of ser ved IP addr esses. Once you select an entr y , pr essing Return displays an action pop-up menu that lists operations that can be per for med on that entr y . Possibl[...]

IP Setup 6-27 ■ Details… is displayed if the entr y is associated with both a host name and a client identifier . Selecting Details… displays a pop-up menu that provides additional infor mation associated with the IP address. The pop-up menu includes the IP addr ess as well as the host name and client identifier supplied by the client to wh[...]

6-28 Firmware User Guide ■ Include is displayed if the entr y is either excluded or declined. An IP address is marked declined when a client to whom the DHCP ser ver of fers the addr ess declines the address. A client declines an addr ess if it deter mines that a leased address is alr eady in use by another device. Selecting Include restor es the[...]

IP Setup 6-29 The router’s Ether net IP address(es) will be automatically excluded fr om the address ser ving pool(s) on star tup. Entries in the ser ved IP addr ess list cor responding to the router’s Ether net IP addr ess(es) that have been automatically excluded on star tup are not selectable. Served IP Addresses -IP Address------Type----Exp[...]

6-30 Firmware User Guide DHCP Rela y Ag ent The Netopia Fir mware V ersion 5.4 of fers DHCP Relay Agent functionality , as defined in RFC1542. A DHCP r elay agent is a computer system or a router that is configur ed to for war d DHCP requests from clients on the LAN to a remote DHCP ser ver , and to pass the r eplies back to the requesting client[...]

IP Setup 6-31 Select IP Address Ser ving and pr ess Return. The IP Addr ess Ser ving scr een appears. Select IP Address Ser ving Mode . The pop-up menu of fers the choices of Disabled , DHCP Ser ver (the default), and DHCP Relay Agent . If you select DHCP Relay Agent and press Retur n, the screen changes as shown below . Now you can enter the IP ad[...]

6-32 Firmware User Guide Note: The remote DHCP ser ver(s) to which the Netopia Router is relaying DHCP r equests must be capable of ser vicing r elayed requests. Not all DHCP ser vers suppor t this featur e. For example, the DHCP ser ver in the Netopia Router does not . The DHCP ser ver(s) to which the Netopia Router is r elaying DHCP requests must[...]

IP Setup 6-33 1. Select Profile Name and enter a name for this connection pr ofile. It can be any name you wish. For example: the name of your ISP . 2. T oggle the Profile Enabled value to Ye s or No . The default is Y es. 3. Select IP Profile Parameters and pr ess Return. The IP Pr ofile Parameters screen appears. 4. T oggle or enter any IP p[...]

6-34 Firmware User Guide 5. Select ADD PROFILE NOW and press Retur n. Y our new connection profile will be added. If you want to view the connection profiles in your r outer , retur n to the W AN Configuration screen, and select Display/Change Connection Pr ofile . The list of connection profiles is displayed in a scrolling pop-up screen. Mult[...]

IP Setup 6-35 By default, Multicast For war ding is tuned of f (None). Y ou enable the r outer to transmit multicast data by selecting Tx. from the pull-down menu. If you enable Multicast For war ding, you will see a new option IGMP V ersion . This lets you choose V1 or V2. If you know you will be communicating with other hosts that are limited to [...]

6-36 Firmware User Guide Typically , you will have a Connection Pr ofile that you created in Easy Setup. Y ou may have more. Select the Connection Profile that you want to use fr om the Display/Change Connection Profile menu, and then select IP Profile Parameters . By default, Multicast For war ding is turned of f (None) on Connection Profiles[...]

Line Backup 7-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 7 7 7 7 L L L L ii i i n n n n e e e e B B B B a a a a c c c c k k k k u u u u p p p p The fir mware of fers line backup functionality in the event of a line failure on a DSL, Ether net, or leased-line primar y W AN link. The fir mwar e suppor ts backup ■ to an exter nal mo[...]

7-2 Firmware User Guide External Dial Bac kup Suppor t Netopia equipment that suppor ts the exter nal dial backup feature automatically display the serial por t configuration menus described in the following sections. Models that do not suppor t exter nal dial backup do not display external dial backup-r elated menus, but of fer menus for backup t[...]

Line Backup 7-3 The Choose Inter face to Configur e screen appears. Choose the inter face to configur e for backup, Serial Por t Setup . The Serial Por t Configuration screen appears. WA N W AN Conf iguration Main Menu Setup WAN Configuration WAN (Wide Area Network) Setup... Display/Change Connection Profile... Add Connection Profile... Delete C[...]

7-4 Firmware User Guide ■ The default mode is Console Only . This is the nor mal state for using a ter minal emulation application to manage the router . See “Connecting a Console Cable to your Equipment” on page 1-5 . If you select Modem/Auto from the pull-down menu, the r outer becomes capable of auto detecting the presence of a modem or a [...]

Line Backup 7-5 Note: • The modem cable should have a standard DB-9 female connector to connect to the console por t. This is the standard type of modem cable connector . • Macintosh users who use a USB-to-serial adapter to connect to the console serial por t can use a modem in Modem/Auto mode. However , your ter minal emulator software will no[...]

7-6 Firmware User Guide backup mode and connect via your modem. Note: Backup and Recover y have r esolutions of five seconds. This is how often the router evaluates the state of the connections and makes decisions. ■ Select Ping Host Name or IP Address and enter an IP address or r esolvable DNS name that the router will ping. This is an optional[...]

Line Backup 7-7 Connection Pr ofiles The line backup feature allows you to configur e a complete Connection Profile for the backup por t, just as you do for your primar y W AN connection. In this way pr ofiles are associated with a par ticular inter face. The profile should reflect the por t it is associated with. It should have switched char[...]

7-8 Firmware User Guide ■ From the Dial pop-up menu, you can choose whether to Dial Out Only , Dial In Only , or Dial In/Out (default). ■ Y ou can add the Number to Dial and an Alternate Site to Dial , if available. ■ Y ou can toggle Dial on Demand to Y es or No. This allows the router to deter mine whether or not to dial the backup number wh[...]

Line Backup 7-9 The Scheduled Connections screen appears. ■ Select Add Scheduled Connection and press Retur n. The Add Scheduled Connection screen appears. ■ T oggle Scheduled Connection Enable to On . ■ From the How Often pop-up menu, select W eekly and pr ess Retur n. ■ From the Schedule Type pop-up menu, accept the default Forced Up and [...]

7-10 Firmware User Guide ■ T oggle all the days of the week to Ye s , and set the Scheduled Window Duration Per Day to 24:00 . This guarantees a 24X7 connection. Press Escape to r eturn to the Add Scheduled Connection scr een. ■ Select Use Connection Profile , and press Retur n. A scr een displays all of your Connection Profiles. Select the o[...]

Line Backup 7-11 Select Backup Management/Statistics and press Retur n. Note: This option is only visible if backup is not Disabled. The Backup Management/Statistics screen appears. ■ Current Por t is a display-only field that shows which por t is cur rently in operation. ■ Backup State is a display-only field that shows the cur rent state of[...]

7-12 Firmware User Guide connection. ■ Switchover Time is a display-only field that is only visible if backup or recover y is in progr ess. It displays the time until either automatic Backup or Recover y . ■ The FORCE BACKUP/FORCE RECOVER Y option is a selectable option that, depending on the cur r ent state of backup, will force the switching[...]

Line Backup 7-13 SNMP Suppor t The router suppor ts objects for deter mining the state of backup, as well as pr oviding traps for the backup and recover y events. No objects suppor t configuration of backup or recover y . Bac kup Default Gate way Introduced in version 5.1.2, the fir mwar e of fers backup functionality to an alter nate gateway typ[...]

7-14 Firmware User Guide The Backup Configuration screen appears. This screen is used to configur e the conditions under which backup will occur , if it will r ecover , and how the alter nate gateway is configured. ■ Select Backup is and press Retur n. A pop-up menu allows you to select Disabled, Manual, or Automatic. Y ou enable backup by sel[...]

Line Backup 7-15 Use this setting with caution. Setting it to Y es may induce alter nating switching between Backup and Recover y Mode. This field will deter mine the r ecover y behavior of a Manual backup and Ping failure backup. These two failures ar e treated as Layer 2 failur es. ■ If you enable Auto-Recover y on loss of Layer 2, the Layer 2[...]

7-16 Firmware User Guide Bac kup Management/Statistics If backup is enabled, the Statistics & Logs menu of fers a Backup Management/Statistics option. T o view Backup Management/Statistics, from the Main Menu select Statistics & Logs then Backup Management/Statistics and press Retur n. The Backup Management/Statistics screen appears. ■ Cu[...]

Line Backup 7-17 either one and pressing Retur n will for ce the link to switch to the other mode. Quic kView The QuickView screen now has an infor mation element to indicate which gateway is in use. Quick View 1/29/2002 01:05:35 PM Default IP Gateway: 0.0.0.0 CPU Load: 5% Unused Memory: 5582 KB Primary DNS Server: 0.0.0.0 Gateway installed -- Back[...]

7-18 Firmware User Guide[...]

V oice Configuration 8-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 8 8 8 8 V V V V o o o o ii i i c c c c e e e e C C C C o o o o n n n n f f f f ii i i g g g g u u u u r r r r a a a a t t t t ii i i o o o o n n n n This chapter describes the telephony ser vices and configuration of the Netopia 4700-Series Integrated Access Devices [...]

8-2 Firmware User Guide central of fice, but not long distance or local calls. T oll Restriction Operation - PBX/Local Switching Mode: When you pick up the phone, you receive local PBX dial tone. When a 9 (or outside line code) is pressed, the IAD detects the digit and r eturns busy (locally generated). Incoming calls are allowed. Extension calls [...]

V oice Configuration 8-3 ■ Select V oice Gateway and fr om the pop-up menu, choose the type of voice gateway device to which you will be connected. The choices are: CopperCom, JetStr eam, T ollBridge, TDSoft, Zhone, or Alcatel. ■ Select Ring Cadence and press Retur n. A pop-up menu allows you to choose between 20Hz (the default), 25Hz, or 50Hz[...]

8-4 Firmware User Guide Echo cancellation is set to Y es by default. For ordinar y telephone handsets, echo cancellation should be set to Y es (tur ned on) to eliminate echoes on the voice line. T oggling a por t to No allows you to connect a fax machine or modem to the phone por t (since fax machines and modems automatically cancel echoes). If you[...]

Monitoring T ools 9-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 9 9 9 9 M M M M o o o o n n n n ii i i t t t t o o o o r r r r ii i i n n n n g g g g T T T T o o o o o o o o ll l l s s s s This chapter discusses the Router’s device and network monitoring tools. These tools can provide statistical infor mation, repor t on cur r ent n[...]

9-2 Firmware User Guide General status Current Date: The cur r ent date; this can be set with the Date and Time utility (see “Date and time” on page 2-42 ). Default IP Gateway: The router’s default gateway , which may be either manually configur ed or lear ned via DHCP . This is the value you assigned in the Default IP Gateway field. If you[...]

Monitoring T ools 9-3 Current status The cur rent status section is a table showing the cur r ent status of the DSL connection. For example: Profile Name: Lists the name of the connection pr ofile being used, if any . Rate: Shows the line rate for this connection. %Use: Indicates the average percent utilization of the maximum capacity of the chan[...]

9-4 Firmware User Guide Statistics & Logs When you are tr oubleshooting your Router, the Statistics & Logs screens pr ovide insight into the recent event activities of the router . From the Main Menu go to Statistics & Logs and select one of the options described in the sections below . Event Histories The Netopia Fir mware V ersion 5.4[...]

Monitoring T ools 9-5 W AN Event History The W AN Event Histor y scr een lists a total of 128 events on the W AN. The most r ecent events appear at the top. Each entr y in the list contains the following infor mation: Date: Date of the event. Time: Time of the event. Event: A brief description of the event. Ch.: The channel involved in the event. T[...]

9-6 Firmware User Guide In the Statistics & Logs screen, select Device Event Histor y . The Device Event Histor y scr een appears. If the event histor y exceeds the size of the scr een, you can scroll through it by using SCROLL UP and SCROLL DOWN. T o scroll up, select SCROLL UP at the top of the list and pr ess Return. T o scr oll down, select[...]

Monitoring T ools 9-7 IP Routing T ab le The IP routing table displays all of the IP r outes cur rently known to the Router. The routing table scr een repr esents a snapshot of the routing table infor mation at the time the screen is first invoked. T o take a new snapshot, select Update at the bottom of the screen and press Retur n. General Statis[...]

9-8 Firmware User Guide Ph ysical Interface The top left side of the screen lists total packets r eceived and total packets transmitted for the following data por ts: ■ Ether net ■ DSL Netw ork Interface The bottom left side of the screen lists total packets r eceived and total packets transmitted: ■ IP (IP packets on the Ether net) The right[...]

Monitoring T ools 9-9 System Inf ormation The System Infor mation screen gives a summar y view of the general system level values in the Router. From the Statistics & Logs menu select System Information . The System Infor mation scr een appears. The infor mation display varies by model, fir mware version, featur e set, and so on. Y ou can tell[...]

9-10 Firmware User Guide Simple Netw ork Management Pr otocol (SNMP) - V2c The Netopia Fir mware V ersion 5.4 includes a Simple Network Management Pr otocol (SNMP) agent, allowing monitoring and configuration by a standard SNMP manager . Netopia Routers and IADs now suppor t both SNMP-V1 and SNMP-V2c. Enterprise-specific SNMP Changes Enterprise-s[...]

Monitoring T ools 9-11 The SNMP Setup screen From the Main Menu, select SNMP in the System Configuration scr een and press Retur n. The SNMP Setup screen appears. Follow these steps to configure the first thr ee items in the screen: 1. Select System Name and enter a descriptive name for the Router’s SNMP agent. 2. Select System Location and en[...]

9-12 Firmware User Guide Comm unity strings The Read-Only Community String and the Read/W rite Community String are like passwor ds that must be used by an SNMP manager quer ying or configuring the Netopia Fir mwar e V ersion 5.4. An SNMP manager using the Read-Only Community String can examine statistics and configuration infor mation from the r[...]

Monitoring T ools 9-13 T o go to the IP T rap Receivers screen, select IP Trap Receivers . The IP T rap Receivers scr een appears. Setting the IP trap receivers 1. Select Add IP Trap Receiver . 2. Select Receiver IP Address or Domain Name . Enter the IP address or domain name of the SNMP manager you want to receive the trap. 3. Select Community Str[...]

9-14 Firmware User Guide[...]

Security 10-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 0 0 0 0 S S S S e e e e c c c c u u u u r r r r ii i i t t t t y y y y The Netopia Fir mware V ersion 5.4 pr ovides a number of security features to help pr otect its configuration screens and your local network fr om unauthorized access. Although these features ar e opt[...]

10-2 Firmware User Guide Console Tiered Access – T w o P ass wor d Levels Netopia Fir mware V ersion 5.4 of fers tier ed access control for greater security and pr otection against accidental or malicious misconfiguration. Ser vice pr oviders and network administrators can now limit the access of other users to the various configuration screens[...]

Security 10-3 For Windows XP users, the automatic discover y featur e places an icon representing the Netopia Gateway automatically in the “My Network Places” folder . Be sure that the Windows XP ser vice Universal Plug and Play Device Host is enabled and r unning, other wise you might not see the icon. Double clicking the icon will launch a te[...]

10-4 Firmware User Guide Limited user configuration The Add Access Name/Password and Show/Change Access Name/Passwor ds screens allow you to select which configuration features a limited (non-Super user) user can access. Fr om the Security Options screen, select Add Access Name/Password . The Add Access Name/Passwor d screen appears. ■ Assign a[...]

Security 10-5 Y ou can toggle the default user privileges for each user . The defaults are set to minimize the possibility of an individual user inadver tently damaging the W AN connection. Exer cise caution in assigning privileges other than these defaults to limited users. Adv anced Security Options The Advanced Security Options screen allows you[...]

10-6 Firmware User Guide ■ Select RADIUS Access Privileges , and from the pull-down menu, choose which access privilege you want this user to have: All , LAN , WA N , or for IADs only , VOX . If you assign any of these privileges, limited users will have full access to privileges associated with these inter faces. Y ou can customize these privile[...]

Security 10-7 User access passw or d Users must be able to change their names and passwords, r egardless of other security access r estrictions. If a user does not have security access, then they will only be able to modify the password for their account. When a limited-access user logs into the router . and accesses the System Configuration menus[...]

10-8 Firmware User Guide User menu diff erences Menus reflect the security access level of the user . Consequently , configuration menus will display dif fering options based upon the parameters a par ticular user is allowed to change. Some dif ferences include: ■ Limited users (non-Super users) do not have access to Easy Setup. ■ All users h[...]

Security 10-9 Based on access level, the Main Menu displays its configuration options according to the following diagram: W AN Configuration screens If a limited user is allowed W AN, Connection Pr ofile, or PVC configuration access, the W AN Configuration option in the Main Menu is visible. If a limited user selects W AN Configuration in the[...]

10-10 Firmware User Guide Connection Pr ofiles The Super user can disallow limited user access to a par ticular Connection Pr ofile. When adding a Connection Profile in the Add Connection Pr ofile screen the Super user can toggle the Superuser Accessible Only option to Ye s or No . This option is visible whether or not there ar e authorized use[...]

Security 10-11 System Configuration menu The System Configuration menu is always available to all users. Based on access level, the System Configuration menu displays its configuration options according to the following diagram: Note: Network Address Translation (NA T) is displayed in this scr een in order to make access control simpler . Secur[...]

10-12 Firmware User Guide Utilities & Diagnostics men u Based on access level, the Utilities & Diagnostics menu displays its configuration options according to the following diagram: X-Modem File T ransfer men u Based on access level, the X-Modem File T ransfer menu displays its configuration options according to the following diagram: St[...]

Security 10-13 Based on access level, the Statistics & Logs menu displays its options according to the following diagram: Statistics & Logs WAN Event History... Device Event History... Voice Log... Voice Accounting Log... Voice Error Log... IP Routing Table... Served IP Addresses... Served IP Addresses... Accounting Statistics... Backup Man[...]

10-14 Firmware User Guide Quic k Menus Quick Menus var y considerably between models, featur es, and access levels. The following is an example comparison of the Quick Menu as seen by the Super user and by a Limited user . Note: Console Configuration is always visible. A TM Cir cuits Configuration menu Y ou select A TM Cir cuits Configuration fr[...]

Security 10-15 The A TM Cir cuits Configuration menu screen appears as follows: Note: Multiple A TM cir cuit configuration is suppor ted on multiple A TM-capable routers. Although some of the parameters of the Circuit Configuration scr eens per tain to V oice and Connection Pr ofiles, it is assumed that if the user has been granted PVC configu[...]

10-16 Firmware User Guide Pr otecting the Security Options screen The first screen you should pr otect is the Security Options screen, because it contr ols access to the configuration screens. Access to the Security Options scr een can be protected with a passwor d. Select Password for This Scr een in the Security Options screen and enter a passw[...]

Security 10-17 T o add a new user account, select Add User in the Security Options screen and press Retur n. The Add Name With Write Access screen appears. Follow these steps to configure the new account: 1. Select Enter Name and enter a descriptive name (for example, the user’s first name). 2. Select Enter Password and enter a passwor d. 3. T [...]

10-18 Firmware User Guide T o restrict T elnet access, select Security in the Advanced Configuration menu. The Security Options screen will appear . There ar e two levels of T elnet r estriction available: ■ T o restrict T elnet access to the SNMP scr eens, select Enable T elnet Access to SNMP Scr eens and toggle it to No . (See “SNMP traps”[...]

Security 10-19 Each inspector has a specific task. One inspector’s task may be to examine the destination address of all outgoing packages. That inspector looks for a cer tain destination—which could be as specific as a street address or as br oad as an entire countr y—and checks each package’s destination addr ess to see if it matches th[...]

10-20 Firmware User Guide If the package does not match the first inspector’s criteria, it goes to the second inspector , and so on. Y ou can see that the order of the inspectors in the line is ver y impor tant. For example, let’s say the first inspector’s orders ar e to send along all packages that come from Rome, and the second inspector?[...]

Security 10-21 P ar ts of a filter A filter consists of criteria based on packet attributes. A typical filter can match a packet on any one of the following attributes: ■ The source IP addr ess (where the packet was sent fr om) ■ The destination IP address (wher e the packet is going) ■ The type of higher-layer Inter net protocol the packe[...]

10-22 Firmware User Guide P ort number comparisons A filter can also use a comparison option to evaluate a packet’s source or destination por t number . The comparison options are: No Compare: No comparison of the por t number specified in the filter with the packet’s por t number . Not Equal T o: For the filter to match, the packet’s por[...]

Security 10-23 Putting the par ts together When you display a filter set, its filters are displayed as r ows in a table: The table’s columns cor respond to each filter’s attributes: #: The filter’s priority in the set. Filter number 1, with the highest priority , is first in the table. Source IP Addr: The packet sour ce IP address to mat[...]

10-24 Firmware User Guide Filtering example #1 Retur ning to our filtering r ule example from above (see page 10-20 ), look at how a r ule is translated into a filter . Star t with the r ule, then fill in the filter’s attributes: 1. The r ule you want to implement as a filter is: Block all T elnet attempts that originate from the r emote hos[...]

Security 10-25 This filter blocks any packets coming from a r emote network with the IP network address 200.233.14.0. The 0 at the end of the address signifies any host on the class C IP network 200.233.14.0. If, for example, the filter is applied to a packet with the source IP addr ess 200.233.14.5, it will block it. In this case, the mask, whi[...]

10-26 Firmware User Guide An appr oach to using filters The ultimate goal of network security is to prevent unauthorized access to the network without compr omising authorized access. Using filter sets is par t of reaching that goal. Each filter set you design will be based on one of the following approaches: ■ That which is not expressly pr o[...]

Security 10-27 3. View , change, or delete individual filters and filter sets. The sections below explain how to execute these steps. Adding a filter set Y ou can create up to eight dif ferent custom filter sets. Each filter set can contain up to 16 output filters and up to 16 input filters. T o add a new filter set, select Add Filter Set i[...]

10-28 Firmware User Guide Adding filter s to a filter set There ar e two kinds of filters you can add to a filter set: input and output. Input filters check packets received from the Inter net, destined for your network. Output filters check packets transmitted from your network to the Inter net. Packets in the Netopia Firmware V ersion 5.4 p[...]

Security 10-29 Note: There ar e two groups of items in this scr een, one for input filters and one for output filters. In this section, you’ll lear n how to add an input filter to a filter set. Adding an output filter works exactly the same way , providing you keep the dif ferent sour ce and destination perspectives in mind. 1. T o add a fi[...]

10-30 Firmware User Guide 3. If you want the filter to for war d packets that match its criteria to the destination IP address, select For ward and toggle it to Ye s . If For war d is toggled to No , packets matching the filter’s criteria will be discarded. 4. Select Source IP Address and enter the sour ce IP address this filter will match on.[...]

Security 10-31 Deleting filters T o delete a filter , select Delete Input Filter or Delete Output Filter in the Display/Change Filter Set screen to display a table of filters. Select the filter from the table and pr ess Return to delete it. Pr ess Escape to exit the table without deleting the filter . Mo ving filters T o reor ganize the filt[...]

10-32 Firmware User Guide Basic Firewall blocks undesirable traf fic originating from the WAN (in most cases, the Internet), but for war ds all traf fic originating fr om the LAN. It follows the conser vative “that which is not expressly per mitted is pr ohibited” approach: unless an incoming packet expr essly matches one of the constituent i[...]

Security 10-33 Output filter 1: This filter for war ds all outgoing traf fic to make sure that no outgoing connections fr om the LAN are blocked. Basic Firewall is suitable for a LAN containing only client hosts that want to access ser vers on the W AN, but not for a LAN containing ser vers pr oviding ser vices to clients on the W AN. Basic Fir [...]

10-34 Firmware User Guide FTP sessions. T o allow W AN-originated FTP sessions to a LAN-based FTP ser ver with the IP addr ess a.b.c.d (cor responding to a number ed IP address such as 163.176.8.243), inser t the following input filter ahead of the cur rent input filter 1: ■ Enabled: Y es ■ For war d: Y es ■ Source IP Addr ess: 0.0.0.0 ■ [...]

Security 10-35 The new filterset screen appears as follows: T o use the policy-based routing featur e, you create a filter that for war ds the traf fic. ■ T oggle For ward to Ye s . This will display the For ce Routing options. ■ T oggle Force Routing to Ye s . ■ Enter the Gateway IP Address in standar d dotted-quad notation to which the t[...]

10-36 Firmware User Guide Note: Default For war ding Filter If you create one or mor e filters that have a matching action of for war d , then action on a packet matching none of the filters is to block any traf fic. Therefor e, if the behavior you want is to force the r outing of a cer tain type of packet and pass all others through the nor mal[...]

Security 10-37 Fire wall T utorial General firewall terms Filter rule : A filter set is comprised of individual filter r ules. Filter set : A grouping of individual filter r ules. Firewall : A component or set of components that r estrict access between a protected network and the Inter net, or between two networks. Host : A workstation on the [...]

10-38 Firmware User Guide Example TCP/UDP P or ts Firewall design rules There ar e two basic r ules to firewall design: ■ “What is not explicitly allowed is denied.” and ■ “What is not explicitly denied is allowed.” The first r ule is far more secur e, and is the best approach to fir ewall design. It is far easier (and more secur e) [...]

Security 10-39 and a packet goes through these r ules destined for FTP , the packet would for ward thr ough the first filter r ule (WWW), match the second r ule (FTP), and the packet is allowed through. Even though the next r ule is to deny all FTP traf fic, the FTP packet will never make it to this r ule. Binary representation It is easiest whe[...]

10-40 Firmware User Guide Established connections The TCP header contains one bit called the ACK bit (or TCP Ack bit). This ACK bit appears only with TCP , not UDP . The ACK bit is par t of the TCP mechanism that guarantees the deliver y of data. The ACK bit is set whenever one side of a connection has received data fr om the other side. Only the ?[...]

Security 10-41 Example netw ork Example filters Example 1 Incoming packet has the source addr ess of 200.1.1.28 Less Than or Equal Any por t less than or equal to the por t defined Equal Matches only the por t defined Greater Than or Equal Matches the por t or any por t gr eater Greater Than Matches anything gr eater than the por t defined Filt[...]

10-42 Firmware User Guide This incoming IP packet has a source IP addr ess that matches the network address in the Sour ce IP Address field (00000000) in the Netopia Fir mware V ersion 5.4. This will not for war d this packet. Example 2 Incoming packet has the source addr ess of 200.1.1.184. This incoming IP packet (10000000) has a source IP addr [...]

Security 10-43 Since the Source IP Network Addr ess in the Router is 01100000, and the source IP addr ess after the logical AND is 1011000, this r ule does not match and this packet will be for war ded. Example 4 Incoming packet has the source addr ess of 200.1.1.104. Since the Source IP Network Addr ess in the Router is 01100000, and the source IP[...]

10-44 Firmware User Guide Since the Source IP Network Addr ess in the Router is 01100000, and the source IP addr ess after the logical AND is 01100000, this r ule does match and this packet will not be for war ded. This r ule masks of f a single IP address. Configuration Management Netopia Fir mware V ersion 5.4 of fers a Configuration Management[...]

Security 10-45 Select Save Current Configuration as , and press Retur n. The Save Cur rent Configuration scr een appears. Enter a descriptive name for your cur rent configuration, select SA VE , and press Retur n. Y our configuration will be saved to the flash memor y , and you will be r eturned to the Configuration Management scr een. If you[...]

10-46 Firmware User Guide A war ning screen will ask you to confir m your choice. Configuration Management Save Current Configuration as... +-Configuration Name---Type---+ Replace Existing Configuration... +-----------------------------+ Boot from a Configuration... | Backup Config Binary | Delete a Configuration... | HappyInternet Binary | | | +-[...]

Security 10-47 TFTP and X-Modem Y ou can also send or receive your stor ed configuration files via TFTP or X-Modem. Y ou select the stored configuration files from pull-down menus in the TFTP or X-Modem File T ransfer scr eens in the Utilities & Diagnostics menu, as shown. Trivial File Transfer Protocol (TFTP) TFTP Server Name: Firmware Fil[...]

10-48 Firmware User Guide Call Filtering Netopia Fir mware V ersion 5.4 suppor ts a call filtering mechanism that lets you control which packets cause connections to be established and which packets cause connections to be maintained (that is, to not time out due to inactivity). This feature is par t of the Filter Set management component of the ?[...]

Security 10-49 This pop-up menu allows you to configure what action will be taken for packets that the filter r ule specifies should be for war ded. ■ If you set Call Placement/Idle Reset to No Change (the default), no change will be made to the call filtering attribute associated with the packet. If no other filter r ule with its Call Place[...]

10-50 Firmware User Guide[...]

Utilities and Diagnostics 11-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 1 1 1 1 U U U U t t t t ii i i ll l l ii i i t t t t ii i i e e e e s s s s a a a a n n n n d d d d D D D D ii i i a a a a g g g g n n n n o o o o s s s s t t t t ii i i c c c c s s s s A number of utilities and tests are available for system diagnostic a[...]

11-2 Firmware User Guide Ping The Netopia Fir mware V ersion 5.4 Router includes a standar d Ping test utility . A Ping test generates IP packets destined for a par ticular (Ping-capable) IP host. Each time the tar get host r eceives a Ping packet, it retur ns a packet to the original sender . Ping allows you to see whether a par ticular IP destina[...]

Utilities and Diagnostics 11-3 Status: The cur rent status of the Ping test. This item can display the status messages shown in the able below: Packets Out: The number of packets sent by the Ping test. Packets In: The number of retur n packets received fr om the tar get host. T o be considered on time, r eturn packets are expected back befor e the [...]

11-4 Firmware User Guide Packets Lost: The number of packets unaccounted for , shown in total and as a percentage of total packets sent. This statistic may be updated during the Ping test, and may not be accurate until after the test is over . However , if an escalating one-to-one cor respondence is seen between Packets Out and Packets Lost , and P[...]

Utilities and Diagnostics 11-5 3. Select Timeout (seconds) to set when the trace will timeout for each hop, up to 10 seconds. The default is 3 seconds. 4. Select Use Reverse DNS to learn the names of the r outers between the Netopia Router and the destination router . The default is Y es. 5. Select ST AR T TRACE ROUTE and press Retur n. A scrolling[...]

11-6 Firmware User Guide menu and press Retur n. ■ T o end a suspended session, select T er minate Suspended Session . Select a session from the pop-up menu and press Retur n. F actor y Defaults Y ou can reset the Router to its factor y default settings. In the Utilities & Diagnostics screen, select Rever t to Factor y Defaults and press Retu[...]

Utilities and Diagnostics 11-7 The sections below describe how to update the Router’s fir mware and how to download and upload configuration files. Updating firmware Fir mware updates may be available periodically fr om Netopia or from a site maintained by your or ganization’s network administrator . The Router ships with an embedded operat[...]

11-8 Firmware User Guide ■ Select GET ROUTER FIRMW ARE FROM SERVER and press Retur n. Y ou will see the following dialog box: ■ Select CANCEL to exit without downloading the file, or select CONTINUE to download the file. The system will reset at the end of the file transfer to put the new fir mwar e into ef fect. While the system r esets, t[...]

Utilities and Diagnostics 11-9 ■ If you choose to download the configuration file, the TFTP T ransfer State item will change fr om Idle to Reading Config . The TFTP Current Transfer Bytes item will reflect the number of bytes transfer red. Uploading configuration files Using TFTP , you can send a file containing a snapshot of the router’[...]

11-10 Firmware User Guide Updating firmware Fir mware updates may be available periodically fr om Netopia or from a site maintained by your or ganization’s network administration. Follow these steps to update the Router’s fir mware: 1. Make sure you have the fir mwar e file on disk and know the path to its location. 2. Select Send Firmwar e[...]

Utilities and Diagnostics 11-11 Caution! Do not manually power down or reset the Router while it is automatically r esetting or it could be damaged. Downloading configuration files The Router can be configured by downloading a configuration file. The downloaded file r econfigures all of the Router’s parameters. Configuration files are av[...]

11-12 Firmware User Guide 3. Select CANCEL to exit without uploading the file, or select CONTINUE to upload the file. If you choose CONTINUE, you will have ten seconds to use your ter minal emulation software to initiate an XMODEM transfer of the configuration file. If you fail to initiate the transfer in that time, the dialog box will disappea[...]

Utilities and Diagnostics 11-13 Select T1 Line Statistics / Diagnostics and press Retur n. The T1 Line Statistics / Diagnostics screen appears. The screen displays the cur r ent condition of tests that you r un. The counters display the occur rences of the indicated events in fifteen-minute increments, shifting the totals to the column to the righ[...]

11-14 Firmware User Guide 24 hours: Cumulative statistics, for the preceding 24-hour period. Line Status: Conditions may be Nor mal Operation, Red Alar m, Y ellow Alar m, or (Rmt/Lcl) LoopBack Loopback Status: Cur rent loopback condition T ests: Of fers a pop-up menu with the following options: ■ Normal - Clear Loopback clears any local loopbacks[...]

T roubleshooting A-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x A A A A T T T T r r r r o o o o u u u u b b b b ll l l e e e e s s s s h h h h o o o o o o o o t t t t ii i i n n n n g g g g This appendix is intended to help you troubleshoot pr oblems you may encounter while setting up and using the Netopia Fir mware V ersion 5.4[...]

A-2 Firmware User Guide Note: If you are attempting to modify the IP addr ess or subnet mask from a pr evious, successful configuration attempt, you will need to clear the IP address or r eset your Router to the factor y default before reinitiating the configuration pr ocess. For fur ther infor mation on resetting your Router to factor y default,[...]

T roubleshooting A-3 Ho w to Reset the Router to F actor y Defaults Lose your password? This section shows how to r eset the router so that you can access the console scr eens once again. Keep in mind that all of your connection profiles and settings will need to be r econfigured. If you don't have a password, the only way to get back into t[...]

A-4 Firmware User Guide Technical Support Netopia, Inc. is committed to providing its customers with r eliable products and documentation, backed by excellent technical suppor t. Bef ore contacting Netopia Look in this guide for a solution to your problem. Y ou may find a solution in this tr oubleshooting appendix or in other sections. Check the i[...]

Understanding IP Addressing B-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x B B B B U U U U n n n n d d d d e e e e r r r r s s s s t t t t a a a a n n n n d d d d ii i i n n n n g g g g II I I P P P P A A A A d d d d d d d d r r r r e e e e s s s s s s s s ii i i n n n n g g g g This appendix is a brief general introduction to I[...]

B-2 Firmware User Guide IP addresses indicate both the identity of the network and the identity of the individual host on the network. The number of bits used for the network number and the number of bits used for the host number can var y , as long as cer tain r ules ar e followed. The local network manager assigns IP host numbers to individual ma[...]

Understanding IP Addressing B-3 Subnet numbers appear within IP addresses, along with network numbers and host numbers. Since an IP address is always 32 bits long, using subnet numbers means either the network number or the host numbers must use fewer bits in order to leave r oom for the subnet numbers. Since the InterNIC assigns the network number[...]

B-4 Firmware User Guide Netw ork configuration Below is a diagram of a simple network configuration. The ISP is providing a Class C addr ess to the customer site, and both networks A and B want to gain Inter net access through this address. Router B connects to Router A and is provided Inter net access through Routers A and B. Router A: IP Addres[...]

Understanding IP Addressing B-5 Bac kground The IP addresses and r outing configurations for the devices shown in the diagram are outlined below . In addition, each individual field and its meaning are described. The IP Address and Subnet Mask fields define the IP addr ess and subnet mask of the device's Ethernet connection to the network [...]

B-6 Firmware User Guide There ar e two schemes for distributing the remaining IP addr esses: ■ Manually give each computer an address ■ Let the Router automatically distribute the addresses These two methods are not mutually exclusive; you can manually issue some of the addr esses while the rest are distributed by the Router. Using the r outer [...]

Understanding IP Addressing B-7 Configuration This section describes the specific IP address lease, r enew , and release mechanisms for both the Mac and PC, with either DHCP or MacIP address ser ving. DHCP address serving Windows 95 workstation: ■ The Win95 workstation requests and r enews its lease ever y half hour . ■ The Win95 workstation [...]

B-8 Firmware User Guide ■ The Router releases the DHCP addr ess back to the available DHCP address pool exactly one hour after the last-heard lease r equest. Some other DHCP implementations may hold on to the lease for an additional time after the lease expired to act as a buf fer for variances in clocks between the client and ser ver . MacIP ser[...]

Understanding IP Addressing B-9 In any situation where a device is dialing into a Netopia r outer , the router may need to be configured to ser ve IP via the W AN inter face. This is only a requir ement if the calling device has not been configured locally to know what its address(es) ar e. So when a client, dialing into a Netopia router's W[...]

B-10 Firmware User Guide The figure above shows an example of a block of IP addr esses being distributed cor rectly . The example follows these r ules: ■ An IP address must not be used as a static addr ess if it is also in a range of addresses being distributed by DHCP or MacIP . ■ A single IP address range is used by all the addr ess-ser ved [...]

Understanding IP Addressing B-11 Nested IP Subnets Under cer tain cir cumstances, you may want to create remote subnets fr om the limited number of IP addresses issued by your ISP or other authority . Y ou can do this using connection pr ofiles. These subnets can be nested within the range of IP addresses available to your network. For example, su[...]

B-12 Firmware User Guide Routers B and C (which could also be Routers) ser ve the two r emote networks that are subnets of a.b.c.0. The subnetting is accomplished by configuring the Router with connection profiles for Routers B and C (see the following table). The Router’s connection profiles for Routers B and C cr eate entries in its IP routi[...]

Understanding IP Addressing B-13 Let’s see how a packet from the Inter net gets routed to the host with IP addr ess a.b.c.249, which is ser ved by Router C. The packet first ar rives at Router A, which delivers it to its local network (a.b.c.0). The packet is then received by the Router, which examines its destination IP addr ess. The Router com[...]

B-14 Firmware User Guide The following diagram illustrates the IP address space taken up by the two r emote IP subnets. Y ou can see from the diagram why the ter m nested is appropriate for describing these subnets. Br oadcasts As mentioned earlier , binar y IP host or subnet addresses composed entir ely of ones or zeros ar e reser ved for broadcas[...]

Binary Conversion T able C-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x C C C C B B B B ii i i n n n n a a a a r r r r y y y y C C C C o o o o n n n n v v v v e e e e r r r r s s s s ii i i o o o o n n n n T T T T a a a a b b b b ll l l e e e e This table is provided to help you choose subnet numbers and host numbers for IP and [...]

C-2 Firmware User Guide Decimal Binar y Decimal Binar y Decimal Binary Decimal Binar y 128 10000000 160 10100000 192 11000000 224 11100000 129 10000001 161 10100001 193 11000001 225 11100001 130 10000010 162 10100010 194 11000010 226 11100010 131 10000011 163 10100011 195 11000011 227 11100011 132 10000100 164 10100100 196 11000100 228 11100100 133[...]

Index-1 II I I n n n n d d d d e e e e x x x x A add static route 6-8 ADSL Line Configuration 2-2 advanced configuration features 2-35 ATMP 4-10 tunnel options 4-8 B backup default gateway 7-13 backup, line 7-1 basic firewall 10-32 BootP 6-17 clients 6-23 broadcasts B-14 C change static route 6-9 community strings 9-12 configuration troubleshooting[...]

Index-2 11 with TFTP 11-8 with XMODEM 11-11 Dynamic Host Configuration Protocol (DHCP) 6-17 Dynamic Host Configuration Protocol, see DHCP Dynamic WAN 6-17 E Easy Setup navigating 1-7 encryption 4-3 , 4-7 , 4-10 , 5-1 event history device 9-5 WAN 9-5 Exposed Addresses 2-40 F filter parts 10-21 parts of 10-21 filter priority 10-19 filter set adding 1[...]

Index-3 static B-8 IP passthrough 3-27 IP setup 6-2 IP trap receivers deleting 9-13 modifying 9-13 setting 9-13 viewing 9-13 IPsec 4-3 , 4-7 , 5-1 L latency 10-35 LED status 9-3 LEDs 9-3 line backup 7-1 backup IP gateway 7-15 connection profiles 7-7 management and statistics 7-10 , 7- 16 scheduled connections 7-8 WAN configuration 7-2 , 7-3 M MIBs [...]

Index-4 port number comparisons 10-22 port numbers 10-21 PPTP 4-10 tunnel options 4-4 PVC 2-16 Q quality of service 10-35 Quick View 9-1 R restarting the system 11-12 restricting telnet access 10-17 RFC-1483 Transparent Bridging 2-44 RIP-2 MD5 Authentication 6-10 router to serve IP addresses to hosts 6- 1 routing tables IP 6-6 , 9-7 S scheduled con[...]

Index-5 defined 11-6 downloading configuration files 11-8 updating firmware 11-7 uploading configuration files 11-9 TFTP, transferring files 11-6 tiered access 10-2 TOS bit 10-35 Trivial File Transfer Protocol (TFTP) 11-6 Trivial File Transfer Protocol, see TFTP troubleshooting A-1 configuration PC A-1 event histories 9-4 trusted host 10-33 trusted[...]

Index-6[...]