Lancom Systems LCOS 3.50 manuale d’uso

Refer ence Manual LA NCOM L COS 3.50[...]

© 2004 LANCOM Systems GmbH , Wuerselen (Germany) Wh ile th e in fo rm ati on in t hi s ma nu al h as bee n c omp il ed w it h gr ea t c ar e, i t m ay n ot be d ee med an ass ur an ce o f p ro duc t characterist ics. LANCOM shall be liable only t o the degree specified in the terms of sale and delivery . The repr oduction and distribution o f the [...]

 Contents LANCOM Refer ence Manual LC OS 3.50 3 Contents Contents 1 Preface 10 2 System design 13 3 Configuration and management 15 3.1 Configuration tools and approaches 15 3.2 Configuration software 16 3.2.1 Confi guration using LANconfig 16 3.2.2 Confi guration with WEBconfig 18 3.2.3 Confi guration using Telnet 19 3.2.4 Confi guration using [...]

LANCOM Refer ence Manual LC OS 3.50  Contents 4 Contents 4.1.1 Applic ation examples 38 4.1.2 Confi guration 42 4.1.3 45 5 Diagnosis 46 5.1 LANmonitor—know what's happening 46 5.1.1 Extended dis play options 46 5.1.2 Monitor Internet connect ion 47 5.2 Trace information—for advanced users 48 5.2.1 How to s tart a trace 48 5.2.2 Overview[...]

 Contents LANCOM Refer ence Manual LC OS 3.50 5 Contents 7.4 N:N mapping 80 7.4.1 Applic ation examples 81 7.4.2 Confi guration 85 7.5 Configuration of remote stations 89 7.5.1 Name list 89 7.5.2 Layer list 90 7.6 Establishing connection with PPP 91 7.6.1 The protoc ol 92 7.6.2 Everythi ng o.k.? Chec king the line with LCP 94 7.6.3 Assignme nt o[...]

LANCOM Refer ence Manual LC OS 3.50  Contents 6 Contents 8.3.10 Fir ewall limitations 159 8.4 Protection against break- in atte mpts: Intru sion Detection 160 8.4.1 Examples for break- in attempts 160 8.4.2 Confi guration of the IDS 161 8.5 Protection against “Den ial of Service” attacks 162 8.5.1 Examples of Denial of Service att acks 162 8[...]

 Contents LANCOM Refer ence Manual LC OS 3.50 7 Contents 10.3.4 Configuration with WEBconfig or Telnet 201 11 Wireless LAN – WLAN 203 11.1 What is a Wireless LAN? 203 11.1.1 Standardized radio transmissi on by IEEE 203 11.1.2 Operation modes of Wirel ess LANs and base stations 206 11.2 Developments in WLAN se curity 213 11.2.1 Some basic conce[...]

LANCOM Refer ence Manual LC OS 3.50  Contents 8 Contents 13 Server services for the LAN 272 13.1 Automatic IP address administ ration with DHCP 272 13.1.1 The DHCP server 272 13.1.2 DHCP—'on', 'off' or 'auto'? 273 13.1.3 How are the addresses assigned? 274 13.2 DNS 277 13.2.1 What does a DNS server do? 277 13.2.2 [...]

 Contents LANCOM Refer ence Manual LC OS 3.50 9 Contents 14.5.5 Prepare VPN network rel ationships 311 14.5.6 Configuration with LANconfig 314 14.5.7 Configuration with WEBconfig 318 14.5.8 Diagnosis of VPN connections 322 14.6 Specif ic exam ples of connections 322 14.6.1 Static/static 323 14.6.2 Dynamic/static 323 14.6.3 Static/dynamic (with L[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 1: Preface 10 Pref ace 1P r e f a c e User’s manual and r eference manual The documentation of your device cons ists of two parts: The user’ s manual and th e ref eren ce man ua l.  The hardware of the LANCOM devices is documented in the respective user’s manuals. Apart from a de scription of[...]

 Chapter 1: Preface LANCOM Reference Manual L COS 3.50 11 Pref ace ucts. The extens ive feature s et is available thr oughout all LANCOM products (p rovi ded res pec ti ve sup por t b y h ardw are) , a nd con ti nuo us ly re ce ive s f urt he r enhancements by fr ee, regular software updates. Th is re fere nc e m anu al app li es to t he fo llow[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 1: Preface 12 Pref ace info@lancom.de Our online services ( www.lancom.de ) are available to you around the clock should you have any queries regarding the topic s discussed in this manual or requir e any further support. In ad dition, support from LANCOM S ystems is also availabl e to you. T elephone[...]

 Chapter 2: System design LANCOM Reference Manual LCOS 3.50 13 System design 2 S ystem design The LANCOM operating system L CO S is a collection of differ ent software mod- ules, the LANCOM devices themselves ha ve different interf aces to the W AN and LAN. Depending on the particular application, data packets f low through different modules on [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 2: System design 14 System design  LAN CO M W irel es s ac ces s p oin ts resp . L AN COM rou ter s w ith wire le ss modules offer additional ly one or , depending on the respective model, also two wireless interfaces for the connection of Wireless LANs.  A DMZ interface enables for some models [...]

 Chapter 3: Conf iguration and manage me nt LA NCOM Reference Manual L COS 3.50 15 Configuration and manage- ment 3 Configuration and management This section will sh ow you the method s a nd ways you can use to acce ss the device and specify further settings. Y ou will find descriptio ns on the following topics:  Configuration tools  Monit[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 3: Configurat ion and management 16 Configuration and manage- ment 3.2 Configuration softwar e Situations in which the device is configured vary—as do the personal require- ments and prefer ences of the person do ing the configur ation. LANCOM rout- ers thus f eature a br oad selection of configurat[...]

 Chapter 3: Conf iguration and manage me nt LA NCOM Reference Manual L COS 3.50 17 Configuration and manage- ment Once LANconfig has finished its search, it displays a list of all the devices it has found, together with their name s and, perhaps a description, the IP address and its status. The expanded range of functions for professionals T wo [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 3: Configurat ion and management 18 Configuration and manage- ment Management of multiple devices LANconfig supports multi device r emote management. Simply select the desired devices, and LANcon fig performs all actions for all selected devi ces then, one after t he other . The onl y require ment: Th[...]

 Chapter 3: Conf iguration and manage me nt LA NCOM Reference Manual L COS 3.50 19 Configuration and manage- ment Secure with HT TPS WEBconfig offers an encrypted transmi ssion of the configuration data for secure (remote) management via HT TPS. https://<IP address or device name> For maximum security , please ensure to have installed the [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 3: Configurat ion and management 20 Configuration and manage- ment The syntax of the TFTP call is depend ent on the oper ating system. With Win- dows 2000 and Windows NT the syntax is: tftp -i <IP address Host> [get|put] source [target] With numerous TFTP cl ients the ASCII format is pr eset. Th[...]

 Chapter 3: Conf iguration and manage me nt LA NCOM Reference Manual L COS 3.50 21 Configuration and manage- ment Y ou can also reserve a special calling number for remote configuration. The n the support technician can always access th e router even if it is really no longer accessible due to incorr ect settings. 3.3.1 This is what you need for[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 3: Configurat ion and management 22 Configuration and manage- ment 햳 Open a T elnet session to t he LANCOM. Use t he following IP address for this purpose:  '172.17.17 .18', if you hav e not defined an IP address for the PPP cli- ent. The LANCOM automatically uses this addr ess if no ot[...]

 Chapter 3: Conf iguration and manage me nt LA NCOM Reference Manual L COS 3.50 23 Configuration and manage- ment 햲 Switch to the 'Security' tab in the 'Management' configuration section. 햳 Enter a number at your location which is not being used for other pur- poses in the 'C onfiguration access' area. Alternati[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 3: Configurat ion and management 24 Configuration and manage- ment time under Window s operating system s—of all of the LANCOM routers in t he network. Many of the internal messages gene rated by the devices are converted to plain text, ther eby helping you to troubleshoot. Y ou can also use LANmoni[...]

 Chapter 3: Conf iguration and manage me nt LA NCOM Reference Manual L COS 3.50 25 Configuration and manage- ment monitor . If the configuration of the devic e is protected by password, enter the password too. Alternatively , you can select the device via the LANconfig and monitor it using Tools / Monitor Device . 햳 LANmonitor automatically cr[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 3: Configurat ion and management 26 Configuration and manage- ment specify whether LANmonitor should create a log file daily , monthly , or on an ongoing basis. 3.5 T r ace information—for advanced users T race outputs may be used to monitor the internal processes in the router dur- ing or after con[...]

 Chapter 3: Conf iguration and manage me nt LA NCOM Reference Manual L COS 3.50 27 Configuration and manage- ment 3.5.2 Overview of the keys 3.5.3 Overview of the parameters The available traces depend individually on the particular model and can be listed by entering trace with no arguments on the com- mand line. This code... ... in combination[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 3: Configurat ion and management 28 Configuration and manage- ment 3.5.4 Combination commands Any appended parameters are pr ocessed fr om left to right. This means that it is possible to call a par ameter and then rest rict it. NetBIOS NetBIOS managemen t DNS Domain Name Service Protocol Packet dump [...]

 Chapter 3: Conf iguration and manage me nt LANCOM Reference Manual L COS 3.50 29 Configuration and manage- ment 3.5.5 Examples 3.6 Working with configur ation files The curre nt configurat ion of an LANCOM can be saved as a fi le and reloaded in the device (or in another device of the same type) if necessary . Additionally , configur ation file[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 3: Configurat ion and management 30 Configuration and manage- ment Convenient series configuration However , even when you are faced with the task of configuring several LANCOM of the same type, you will come to appreciate the function for saving and restoring configurations. In this ca se you can sa [...]

 Chapter 3: Conf iguration and manage me nt LANCOM Reference Manual L COS 3.50 31 Configuration and manage- ment  The device no longer responds af ter loading the new firmwar e. If an error occurs during the upload, th e device autom atically reactivates the pr evious firmware v ersion and reboots the device.  'Login': T o avoid [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 3: Configurat ion and management 32 Configuration and manage- ment LANconfig then te lls you the v ersion number and the date of the firmware in the description and offers to upload the file. The firmware you already have installed will be r eplaced by the selected release by clicking Open . Y ou also[...]

 Chapter 3: Conf iguration and manage me nt LANCOM Reference Manual L COS 3.50 33 Configuration and manage- ment  Stat us Contains all read- only statistics of the indivi dual SW modules  Setup Contains all configurable parameters of all SW modules of the devic e  Firmware Contains all firmware- managemen t relevant actions and t ables [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 3: Configurat ion and management 34 Configuration and manage- ment  All commands and directory/item na mes may be abbreviated as long as no ambiguity ex ists. For example, it i s valid to shorten the ” sysinfo ” command to ” sys ” or a ” cd Management ” to ” c ma ”. Not allowed woul[...]

 Chapter 3: Conf iguration and manage me nt LANCOM Reference Manual L COS 3.50 35 Configuration and manage- ment  regular firmwar e or configuration updates The data is stored in a table with t he following layou t: For example, the entry given below would conne ct the device each week day at 6 PM with a re mote site ’HEADQUARTERS’ Config[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 3: Configurat ion and management 36 Configuration and manage- ment Time- controlled rules will not necessarily be executed at precisely zero seconds of real time, but at some indeterminate point of time in the minute in question.[...]

 Chapter 4: Management LANCOM Refer ence Manual LC OS 3.50 37 Management 4 Management 4.1 N:N mapping Network Address T ransl ation (NAT) can be used for seve ral different matters:  for bette r utilizing the IP4 a ddresses ever becoming s carcer  for coupling of networks with same (private) address ranges  for pr oducing unique addr es[...]

LANCOM Refer ence Manual LC OS 3.50  Chapte r 4: Manage ment 38 Management the defined translation range. An “inbound” addr ess mapping, whe- reby the sour ce address is transl ated (instead of the d estination address), needs to be re alized b y an appropriate “ outbound” address translation on the r emote sid e. 4.1.1 Application examp[...]

 Chapter 4: Management LANCOM Refer ence Manual LC OS 3.50 39 Management With the help of N:N mapping, all addr es ses of the LAN can be translat ed to a new address range for the coupling wi th the other network. The network of company A e. g. will be transl ated to 192.168.1.x, the network of company B to 192.168.2.x. Under these new addr esse[...]

LANCOM Refer ence Manual LC OS 3.50  Chapte r 4: Manage ment 40 Management In this example, a serv ice provider monitors the net works of different clients out of a central control. For this purpose, the SNMP- capable devices should send the respective traps of important e vents automatically to the SNMP trap addressee (e. g. LANmonitor) of the [...]

 Chapter 4: Management LANCOM Refer ence Manual LC OS 3.50 41 Management The networks of client A and B use different address ranges in the respective head office and the connected branches. A standard net- work coupling via VPN is therefor e possible between these networks. In order to avoid the effort to building up its own VPN tunnel to each [...]

LANCOM Refer ence Manual LC OS 3.50  Chapte r 4: Manage ment 42 Management with actual same address r ange looks li ke two different networks for the gate- way of the service provider . The administr ator selects the address ra nges 192.168.2.x and 192.168.3.x for client C and D, so that t he addresses of these networks do differ from the own ne[...]

 Chapter 4: Management LANCOM Refer ence Manual LC OS 3.50 43 Management The addr ess range for tr anslation must be at minimum as lar ge as the source address r ang e. Please notice that the N:N mappi ng functions are only effective when the fir ewall has been activated. (’Fir ewall/QoS enabled’ → page 121)! Additional configuration hints[...]

LANCOM Refer ence Manual LC OS 3.50  Chapte r 4: Manage ment 44 Management ped” original addres ses. The entries of the remote network use the “mapped” addresses of the remote side, valid on the VPN connection. Configuration with different tools LANconfig With LANconfig you adjust the addr ess tr anslation for the configur ation range ’I[...]

 Chapter 4: Management LANCOM Refer ence Manual LC OS 3.50 45 Management WEBconfig, T eln et Under W EBconfig and T elnet you find the NA T table for configuration of N:N mapping at the following positions of the menu tree: When starting a new ent ry under WEBconfig, the NA T table shows up as fol- lows: 4.1.3 Configuration tool Run WEBconfig Ex[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 5: D iagnosis 46 Diagnosis 5 Diagnosis 5.1 LANmonitor — know what's happening The LANmonitor incl udes a monitoring tool with which you can view the most important information on the status of your routers on your monitor at any time under Window s operating system s—of all of the LANCOM rout[...]

 Chapter 5: Diagnosis LANCOM Refer ence Manual LC OS 3.50 47 Diagnosis 5.1.2 Monitor Internet connection T o demonstrate the functions of LANmonit or we wi ll first show you the types of information LANmonitor provides about connections be ing established to your Internet pr ovider. 햲 T o start LANmo nitor, go to Start  Programs  LANCOM [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 5: D iagnosis 48 Diagnosis Under the general information you can watch the transmission r ates at which data is currently be ing exchanged with the Internet. 햴 T o br eak the connection manually , click on the active channel with th e right mouse button. Y ou may be required to enter a configuration[...]

 Chapter 5: Diagnosis LANCOM Refer ence Manual LC OS 3.50 49 Diagnosis 5.2.2 Overview of the keys 5.2.3 Overview of the parameters The available traces depend individually on the particular model and can be listed by entering trace with no arguments on the com- mand line. This code... ... in combination with the trace causes the following: ? dis[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 5: D iagnosis 50 Diagnosis 5.2.4 Combination commands Any appended parameters are pr ocessed fr om left to right. This means that it is possible to call a par ameter and then rest rict it. NetBIOS NetBIOS managemen t DNS Domain Name Service Protocol Packet dump display of the f irst 64 bytes of a pack[...]

 Chapter 5: Diagnosis LANCOM Refer ence Manual LC OS 3.50 51 Diagnosis 5.2.5 Examples This code... ... in combination with the trace causes the following: trace displays a ll protocols that can generate outputs durin g the config- uration, and the status o f each output (ON or OFF) trace + all switches on all t race outputs trace + protocol dis-[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 6: Security 52 Security 6 Security Y ou certainly would not like any outsider to have easy access to or to be able to modify the data on your computer . Therefore this chapter covers an impor- tant topic: safety . The description of th e security settings is divided i nto the following sections:  P[...]

 Chapter 6: Security LANCOM Reference Manual L COS 3.50 53 Security Note: If a password has not been set, the P ower LED flashes, until the devices have been configured correctly . Tips for proper use of passwords We would like to give you a fe w tips here for using passwor ds:  Keep a pas sword as secret as possible. Never write down a passw[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 6: Security 54 Security ard Security Settin gs . In a terminal or T elnet session you set o r change the password with the command passwd . Protecting the SNMP access At the same time you should also pr otec t the SNMP read access with a pass- word. F or SNMP the general configur ation password is use[...]

 Chapter 6: Security LANCOM Reference Manual L COS 3.50 55 Security  Lock configur ation for ( Lock-minutes ) 6.1.3 Restriction of the access rights on the configuration Access to the internal functions of the devices can be restri cted separately for each access method as follows:  ISDN administrative account  Network  LAN  WA N [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 6: Security 56 Security 햲 Change to the re gister card 'Secur ity in the 'Management' configur ation area: 햳 Enter as call number within 'configu ration access' a call number of your connection, which is not used for other purposes. Enter alternativ ely the following instr[...]

 Chapter 6: Security LANCOM Reference Manual L COS 3.50 57 Security rately . The configuration access can gene rally be permitted or forbid den, a p ur e r e ad a c ce s s o r - if y o ur m od e l is equipped with VPN - also can be per- mitted only over VPN. If you want to r emove the network access to the rout er over the WAN completely , set t[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 6: Security 58 Security By default, this tabl e does not contain entries. Thus the device can be a c c e s s e d o v e r T C P / I P f r o m c o m p u t e r s w i t h a r b i t r a r y I P a d d r e s s e s . W i t h t h e first entry of a IP address (as well as th e associated net mask) the filter is[...]

 Chapter 6: Security LANCOM Reference Manual L COS 3.50 59 Security Y ou have a choice of the following:  all: Calls are accepted fr om any remote station.  by number: Only call s from those remote stations whose Calling Line Id en- tification number (CLIP) is entere d in the number list are accepted.  by appro ved number: Only calls fr[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 6: Security 60 Security Checking th e number Wh en a c all is pl ac ed o ve r a n IS DN li ne , th e c al le r' s nu mb er is n or ma lly se nt over the D channel before a connectio n is even ma de (CLI – C alling Line Iden- tifier ). Access to your own network is granted if the call number app[...]

 Chapter 6: Security LANCOM Reference Manual L COS 3.50 61 Security An especially effective ca llback method is the fast- callback procedur e (patent pending). This speeds up the callback proc edure considerabl y . The procedur e only works if it is supported by both stations. All current LANCOM router s are capable of fast callback. Additional [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 6: Security 62 Security When a call is placed over an IS DN line, the call er's number is normally sent over the D channel before a connection is even made (CLI – C alling L ine I dentifier). Access to your own netw ork is granted if the call numb er appears in the number list, or the caller is[...]

 Chapter 6: Security LANCOM Reference Manual L COS 3.50 63 Security will be permitted to use the internal functions. The cir cle of authorized users can be expand ed by inputting further ent ries. The filter entries can describe both individual computers and whole networks . The access li st can be found in LANconfig in the ' TCP/IP' c[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 64 Routing and W AN connections 7 Routing and W AN connections This chapter describes the most import ant pr otocols and configuration entries used for WAN connections. It also shows ways to optimize WAN connecti ons. 7.1 General informatio n on W AN connections WAN con[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 65 Routing and W AN connections A s i m p l i f i e d e x a m p l e w i l l c l a r i f y t h i s p r o c e s s . H e r e w e a s s u m e t h a t t h e I P address of the computer being searched for is known in the Internet. 햲 Selecting the correct route A data packet[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 66 Routing and W AN connections 햵 Transmission of dat a packets As soon as the connection is establ ished, the router can send the data packet to the Internet. 7.2 IP routing An IP router works between networks which use TCP/IP as the network proto- col. This only all[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 67 Routing and W AN connections Configuration of the routing table An IP routing table can, fo r example, look like this: What do the various entr ies on the list mean?  IP addresses and netmasks This is the address of the destinat io n network to which data packets [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 68 Routing and W AN connections That way routes whi ch are forbidden on the Internet (pri vate address spaces, e. g. '10.0.0.0'), for ex ample, are excluded fr om transmissi on. If an IP address is input as router name , this is a locally avai lable router , w[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 69 Routing and W AN connections How can you assist the workstation computer now? By default, the router sends the computer a response with the address of the router which knows t he route to the destination network (this response is known as an ICMP redir ect). The wo r[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 70 Routing and W AN connections Although the entries in t he static routing table are set manually , this informa- tion changes according to the connection s t at u s o f t he r o ut e r an d so d o th e RIP packets tr ansmitted.  If the router has established a conn[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 71 Routing and W AN connections column shows which router has r evealed th is route. This leaves the 'Time'. The dynamic table thus shows how old the relevant route is. The value in this col- umn acts as a multiplier for the interval s at which the RIP packets[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 72 Routing and W AN connections packets and look on them as normal broadcast or multicast packets. Connec- tions are cont inually established by the RIPs if this route r holds the default rou t e t o a re m ot e ro u te r . Th is c an be p r evented by entering the RIP [...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 73 Routing and W AN connections  'address ': The network mask is derived from the first bit that is set in the IP address entered. This and all high- order bits within the network mask ar e set. Thus, for e xample, the address 12 7.128.128.64 yiel ds the IP[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 74 Routing and W AN connections assume a certain order that differs from the pr otocol st andard. In this case th e SYN/ACK speedup can be dea ctivated: 7.3 The hiding place—IP masquerading (NA T , P A T) One of today's most common tasks for routers is connecting[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 75 Routing and W AN connections any number . It also enters this new po rt on the table and forwards the packet with the new information. T h e r e s p o n s e t o t h i s n e w p a ck e t i s n o w s en t t o t h e I P a d d r e s s o f t h e r o u te r with the new se[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 76 Routing and W AN connections Which protocols can be transmitted using IP masquerading? IP masquerading for all IP protocols that are based on TCP , UDP , or ICMP and communicate excl usively through ports. One example of this type of uncom- plicated protocol is the o[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 77 Routing and W AN connections On the local side, the r outer supports two different networks: The Intranet and the DMZ (’ de- militar ized zone’). The DMZ marks a distinct, separ ate local network, usuall y for servers, that mu st be accessibl e from the Internet.[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 78 Routing and W AN connections 7.3.2 Inverse masquerading This masking operates in both direct ions: The local network behind the IP address of t he router is maske d if a computer from the LAN sends a packet to the Internet (simple masquer ading). If , on the other ha[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 79 Routing and W AN connections Configuration of the inverse masquerading Stateful Inspection and inverse masquerading If in the Masquerading module a port is exposed (i.e. all packets received on this port should be forwarded to a server in t he local area network), t [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 80 Routing and W AN connections Example: Y ou are assigned the IP network address 12 3.45.67.0 with the net- mask 255.255.255.248 by your provider . Then you can assign the IP addresses as follows: All computers and devices in the Intr an et have no public IP address, a[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 81 Routing and W AN connections In the first application the so- called N: 1 NAT , also known as IP masquerading (’The hiding place—IP masquerading (NA T , P A T)’ → page 74) is used. All addresses (“N”) of the local network are mapped to only one (“1”) [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 82 Routing and W AN connections Network coupling An often appearing scenario is the co upling of two company networks which internally use the same address range (e. g. 10.0.0.x). This is often the case, when one company should get access to one (or mor e) server(s) of [...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 83 Routing and W AN connections Remote moni toring and remo te control of networks Remote maintenance and control of ne tworks become more and more impor- tance because of the possibili ties given by VPN. With the use of the nearly ubiquitous broadband Internet connect [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 84 Routing and W AN connections client C oper ates a network with sever a l public WLAN base stations as hot spots, and client D has got an addition al router for ISDN dial- up accesses in his LAN. The networks of client A and B use different address ranges in the respe[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 85 Routing and W AN connections head office. On this occasion, also all subn etworks locate d “behind” the head office are supplied with the needed new IP addresses. In this example, the administrator of the servic e provider selects 10.2.x .x as central address tr [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 86 Routing and W AN connections of the mapping address. Therefore, in an assi gnment of 10.0.0.0/ 255.255. 255.0 to 192.168.1 .0, a server of the LAN with IP address 10.1.1.99 will get assigned the mapping address 192.168. 1.99 . The addr ess range for tr anslation must[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 87 Routing and W AN connections use the “mapped” addresses of the r emote side, valid on the VPN con- nection. Source ad dress T arget address Firewall / IDS / DoS / QoS IP router LAN bridge with “isolated mode” Virtual LANs ( VLAN) N:N mapping ISDN ADSL DSL LAN[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 88 Routing and W AN connections Configuration with different tools LANconfig With LANconfig you adjust the addr ess tr anslation for the configur ation range ’IP router’ on register car d 'N:N- Mapping': WEBconfig, T eln et Under W EBconfig and T elnet you[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 89 Routing and W AN connections When starting a new ent ry under WEBconfig, the NA T table shows up as fol- lows: 7.5 Configuration of remote stations Remote stations are confi gured in two tables:  In the name list(s ) all information is set that applies individuall[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 90 Routing and W AN connections 7.5.2 Layer list With a layer , a collection of protocol settings are defined, which should be used when connecting to specific remote stations. The list of the communica- tion layers can be found under: In the communication layer list th[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 91 Routing and W AN connections 7.6 Establishing connection with PPP LANCOM routers also support the point- to- point pr otocol (PPP). PPP is a generic term for a whole se ries of WAN pr otocols which enable the interaction Layer- 3 The followin g options are avail able[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 92 Routing and W AN connections of routers made by different manufactur ers since this protocol is supported by practically all manufacturers. Due to the inc reasing importance of this pr otocol family an d the fact that PPP is no t a sso ci at ed wit h a ny sp eci fi c[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 93 Routing and W AN connections The phases of PPP negotiation Establishment of a connection using PPP always begins with a negotiation of the parameters to be used for the conn ection. This negotiation is carried out in four phases which should be un ders tood for the s[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 94 Routing and W AN connections to begin output of the PPP protocol fr ames exchanged during a terminal ses- sion. Y ou can perform a detailed analysis once the connection has been bro- ken if this termi nal session has been lo gged in a log file. 7.6.2 Everything o.k.?[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 95 Routing and W AN connections telecomputer), the LANCOM assigns it an IP address for the dura tion of the connection, enabling communications to take place. This type of address assignment is carried out during PPP negotiation and implemented only for connections via [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 96 Routing and W AN connections Windows users are able to view the assi gned addresses via LANm onitor. In addition to the name of the r emote station, the current IP addr ess as well as the addresses of DNS and NBNS servers can be found ther e. Options such as channel [...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 97 Routing and W AN connections 7.7 Extended connection for flat rates—K eep- alive The term flat rate is used to r efer to all- inclus ive connection rates that are not billed according to connection times, b ut instead as a flat fee f or fixed period s. With flat ra[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 98 Routing and W AN connections holding time of 0 seconds then. Howe ver , connections interrupted by the remote site ar e not automatically re- establ ished with this setting. With a holding time of 9,999 seconds the conn ection is always re- established after any disc[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 99 Routing and W AN connections No callback For this setting, the callback entry must be set to 'off' when c onfiguring via WEBconfig or in the console. Callback number specified by caller For this setti ng the callback entry must be set to 'Call back the[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 100 Routing and W AN connections  The callback party selects 'Call back the remote site (fast procedur e)' in the name list and enters the calling number ('LANCOM' when configuring via WEBconfig, terminal program or T e lnet). For fast callback us[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 101 Routing and W AN connections The setting 'Name' offers the greate st security when an entry is made into the number list as well as the PPP list. The setting 'LANCOM' offers the fastes t callback method between two LANCOM router s. With Windows r[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 7: Routing and WAN conn ections 102 Routing and W AN connections T wo methods of channel bundling  Static channel bundling If a connection is established with static channel bu ndling, the LANCOM tries to establish the second B cha nnel immediately after setting up the first B channel. If this does[...]

 Chapter 7: Routing an d WAN co nnections LANCOM Reference Ma nual LCOS 3.50 103 Routing and W AN connections  Depending on the type of application, the B1 hold time should be increased to such a level s o that the connect ion is not dropped pre- matur ely because of packe ts not be ing transmitted for a short time. Experience has shown that [...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 104 Firewall 8F i r e w a l l For most companies and many private us ers a work without t he Internet is no longer conceivab le. E- mail and web are indispensable for communication and information search. But each connectio n of the workstations from the own, local network to the Internet[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 105 Firewall  Destroy data on the w orkstations of the LAN.  Par alyse workstations of the LAN or the connection to the Internet. We restrict ourselves in this section to t he attacks of loc al networks (LAN) resp. to workstations and servers in such LANs. 8.1.2 The ways of the perpetr[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 106 Firewall protocol, the search for open ports is al so called “port scanning”. On the occa- sion, the attacker starts an inquiry for particular services with a certain pr o- gram, either generally fr om the Internet, or , only on certain networks and unprotected wor kstations, whic[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 107 Firewall that a defenceless workstat ion installed in the Int ernet will - perhaps even accidentally - become the victim of attacks. 8.2 What is a Firewall? The term “Firewall” is interpreted very differ ently . We want to define at this point the meaning of “Fir ewall” within th[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 108 Firewall which are used f or creation of the rules and which are checked during the operation of the Firewall, one distin guishes differ ent types of Firewalls. Above all, the aspect of the “central” positioning is very Important: Only wh en the entire data tr affic between “ins[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 109 Firewall Packet filters One speaks about a packet filter- based Fi rewall, if the router only checks the details in the header o f the data packet s and decides on the basis of this infor- mation, whether the pac ket may pass or not. The following detail s belong to the analyzed informat[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 110 Firewall it is expecting the connection. The s erver will es tablish as a result from its port 20 a connection to the desir ed port of the client. T o enable this process, the ad ministrator of the packet filter must open all ports for incoming connections, becaus e he does not know i[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 111 Firewall packets that do not belong to one of the tracked session of the connection state table will be automatically discarded. Additionally , the Stateful Inspection is able to track fr om the connection set up, whether additional ch annels are negotiated fo r data exchange or not. Som[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 112 Firewall table, because the connection to the LA N has been init iated from the client. Afterwards, the server can send so the desired data to the client. But if another workstation from the Internet tries to use the just opened port 4322 of the LAN to file itself data from its port 2[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 113 Firewall only the one with the correct delivery note will pass. Li kewise, a s econd cou- rier demanding access to the em ployee will be rejected, too. Application Gateway By checking of contents on application level, Applicati on Gateways increase the address checking of the packet fi l[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 114 Firewall Application Gateways: It never exists a direct connection e.g. between a client of the local network and a server of the Internet. T he LAN workstations only see the proxy , the workstations of the Internet likewise. Thi s physical separa- tion of LAN and W AN, makes it quite[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 115 Firewall 8.3.1 How the LANCOM Firewall inspects data packets The Firewall filt ers only those data packets out of the entire data str eam run- ning through the IP r outer of the LA NCOM, for which a special t reatment has been defined.[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 116 Firewall The Firewall only check s routed data packets! The Firewall only checks data packets routed by the IP r outer of the LANCOM . In general, these are the data packets, which are exchan ged between one of the WA N interfaces and the internal networks (LAN, WLAN, DMZ). For exam p[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 117 Firewall Th e L AN COM Fi re wa ll use s s ev er al li st s fo r c he ck ing da ta pa cke ts , w hic h a r e automaticall y generated from Firewall rules, resulting Firewall actions or by active data connections:  Host block list  Port block list  Connection list  Filter list[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 118 Firewall list will be carried out. I f the action intend s to accept the packet, then an entry is made in the connection list, as well as for any further actions. If no explicit Firewa ll rule exists for a dat a packet, th e packet will be accepted (’Allow - All’). T hat grants a [...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 119 Firewall a dynamic one, new entries can be a dded continuously with the appropri- ate Firewall actions. Entries automa ticall y disappear after exceeding the timeout.  For each established connection an e ntry is made in the connection list , if the checked packet has bee n accepted b[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 120 Firewall Ho we v er , if t he se r ve r w a nt s t o se nd l arg er s et s o f da ta ( e. g. TF T P) an d wo ul d not like or can not differentiate on th e well known port be tween requests and acknowledges, then it sends the response packets to the so urce port of the sender of the o[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 121 Firewall ICMP connections For ICMP two case s must be diffe rent iated: The ICMP request/reply connec- t i o n s , l i k e t o b e u s e d w i t h " p i n g " , and the ICMP error messages, which can be received as an answer to any IP packet. ICMP request/reply connections can [...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 122 Firewall Please notice that the N:N ma pping fu nctions (’N:N mapping’ → page 80) are only active when the Firewall has been sw itched on! Default VPN rules A VPN rule consists, apart from some VPN specific information and among other things, of the definition of sour ce and des[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 123 Firewall  Route : Fr agmented packets are passed on without any further checking by the Firewall, as long as permit ted by valid filter setti ngs.  Re- assemble : Fragmented packets ar e buffered and re- assembled to complete IP packets. The re- assembled packets will then be check[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 124 Firewall route" are als o suppressed, so that the LANCOM cannot be found, neither by "pi ng " no r by "t race rout e" . Poss ible settings are:  Off : ICMP answers are not blocked.  Always : ICMP answers are always blocked .  WAN only : ICMP answers a[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 125 Firewall the needed port will be ope ned for a short time (20 sec onds) sole ly for the authentication inquiry . This behaviour of the Firewall in TCP Stealth mode can be suppressed specif- ically with the par ameter “ A lways mask authentication por t, too“. The activation of the op[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 126 Firewall  Create VPN rule : Is this Fire wall rule also used to create a VPN rule? ( → page 127) Priority When setting up the filter list of the Fi rewall rules, the LANCOM will automat- ically sort the entries. The reby the “grade of detail“ will be consider ed: All specifie[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 127 Firewall  either a rule applies to the packet, for which observe further rules is not activated.  or the list of the Firewall rules has been completely worked through with- out applying a further rule to the packet. T o realize this aforementioned scenario it is nece ssary to insta[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 128 Firewall action sets. If the same tri gger is used for several action sets, th e sequence of action sets can be adjusted. In section ’How th e LANCOM Firewall inspect s data packet s’ → page 115 we have already described that in the end the lists for checking data packets are cr[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 129 Firewall  The entire local network (LAN)  Certain remote stations (described by the name of the name list)  Certain stations of the LAN described by the host name)  Certain MA C 1 a ddresses  Ranges of IP addresses  Complete IP networ ks Y ou c an onl y o pe ra te wi th[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 130 Firewall Limit / Trigger The limit or trigger describes a quan tified threshol d value that must be exceeded on the defi ned connection before the fi lter action gets executed for a data packet. A limit is composed by the following paramet ers:  Unit (kbit, kbyte or packets)  Am[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 131 Firewall  SNMP/LANmonitor : Sends a SNM P trap, that wi ll be analyzed e. g. by LANmonitor. Each of these three message measures leads automatically to an entry in the Fi rewall event t able.  Disconnect : Cuts the connection, ov er which the filtered pack et has been rece iv ed. O[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 132 Firewall Firewall . The specific parameters for th e different alerting types such as th e relevant em ail account can be set at the following places: An example: Let us assume a filter na med 'BL OCKHTTP', which blocks all access to a HTTP server 192. 168.200.10. In case so[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 133 Firewall FROM: LANCOM_Firewa ll@MyCompany.com TO: Administrator@MyComp any.com SUBJECT: packet filtered Date: 9/24/2002 15: 06:46 The packet below Src: 10.0.0.37:4353 {cs2} Dst: 192.168.200.10:80 {ntserver} (TCP) 45 00 00 2c ed 50 40 00 80 06 7a a3 0a 00 00 25 | E..,.P@. ..z....% c0 a8 c[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 134 Firewall SNMP: Generic trap = enterpriseSpecific (6) SNMP: Specific trap = 26 (0x1A) SNMP: Time stamp = 1442 (0x5A2) System descriptor SNMP: OID = 1.3.6.1 .2.1.1.1.0 1. SNMP: String Value = L ANCOM Business 6021 2.80.0001 / 23.09.2002 8699.000 .036 Device string SNMP: OID = 1.3.6.1 .2[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 135 Firewall This contradiction shows the dilemm a of the responsible a dministrators who have developed subsequently differen t strategies to solve thi s problem. Allow All The Allow All strategy favours unhind ered communication of the employees compared over security . Any communica tion [...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 136 Firewall Some LANCOM models support this stru cture by a separate LAN interface only used for the DMZ. Looking at the path of data thr ough the LANCOM, then the function of the Firewall for shielding the LAN against the DMZ becomes visi- ble. Internet DMZ Local netwo rk FTP server Web[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 137 Firewall A direct data exchange between LAN an d DMZ via LAN bridge is not possible if a dedicated DMZ port is used. The pa th from LAN to DMZ and vice versa is therefore only possible through the r outer , and thus also only through the Firewall! This shield s the LAN against inquir ies[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 138 Firewall If you operate a web server in yo u r L A N , t h a t h a s b e e n p e r m i t t e d access to this se rvice from the outside (see ’T he hiding place—IP masquerading (NA T , P AT)’ → page 74), stations from the Internet can establish from the outside connections to t[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 139 Firewall  Example configuratio n “Basic Intern et”  If you want to permit a VPN dial- in to a LANCOM acting as VPN gateway , then you need a Firewall rule allowi ng incoming communi cation from the client to the local network:  In c as e a V PN is no t te rm in a te d b y th[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 140 Firewall  For a netw ork coupling you permit additionally the communicati on between the involved networks:  If you operate e.g. an ow n web server , you selectively allow acc ess to the server:  For diagnostic purposes it is hel pfu l to allow ICMP protocols (e.g. ping): The[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 141 Firewall 8.3.8 Configuration of Fir ewall rules Firewall wizar d The fastest method to configu re the Firewa ll i s p r o v i d e d b y t h e F i r e w a l l w i z a r d in LANconfig:[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 142 Firewall LANconfig The filters can be installed v ery comfortably with LANconfig. Sta rting from the gen era l reg ist er ca rd "F ire wal l / QoS / Rules", you reach after "Add" or "Edit" the dialogue to define the Fi rewall rules: Within the dialogue fo[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 143 Firewall  The option 'Observe further rules ...' can be us ed to create complex functions ensuring e.g. certain ba ndwidths with QoS (’Conn ection’ → page 128)  The option 'This rule is used to create VPN rule s' enables to utilize the information about so[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 144 Firewall  Stations : Here the stations – as sender or addressee of the packe ts – are specified, for which the filt er rule shall match.  Services : Here the IP protocols, source and destination ports are specified for which the filter rule shall apply . For exampl e, it can[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 145 Firewall WEBconfig, T elnet Under WEBconfi g or T elnet the Firewall rules are configured in the follow ing menus and lists: There is a spe cial syntax in L COS for the description of the Firewal l rules. This syntax allows to describe also comple x relations f or checking and treatment [...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 146 Firewall action table for Firewall actions( → page 147). It can also contain dir ect descriptions in th e appropriate LC OS syntax (e. g. %P6 for TCP). For direct entering of rule paramete rs in LCOS synt ax, the same guide- lines apply as described in the following sections for pro[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 147 Firewall Stations and services can be described according to the following rules in the object ta ble: Equal identifier ca n generate comma- separated l ists as for example host lists/ address lists (%A10.0.0.1, 10.0.0.2 ), or hyphen- separated ranges like po rt ranges (%S20- 25). The oc[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 148 Firewall  Conditions If no further actions are specified in a “connect” or “Internet” filter , then implicitly a combination of t hese filters with the “reje ct” action is assumed.  Limits/T rigger Each Firewall action can be ti ed together with a limit, whose excess[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 149 Firewall If an action is given without any ass ociated limit, the n implicitly a packet limit is assu med that is im mediately exceeded with the first packet.  Pa cket action These packet actions can be combined arbitrarily . If you choose absurd or ambiguous actions (e. g.: Accept + [...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 150 Firewall  Further measures If t he "c l os e p or t " a ct io n is ex ec u te d, an e nt ry i n a bl oc k li st i s m ad e, b y which all packets, which are sent at the respective computer and port, get rejected. For the "close port" object a timeout can be give[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 151 Firewall send at the same time an email to the administr ator , then the description of the object for the action r eads as follows:  This descript ion permits traff ic ( %a ) at the beginning. A simple %a at the beginning of the descriptio n is equivalent to a %l p0%a (= accept, if t[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 152 Firewall la s t f iv e ev en ts , th at we r e t ri g ge r ed ei t he r b y a F ir ew a ll ru l e, th e D o S, or th e IDS system with activated ’SNMP/LANmonitor’ option. A new window with the complete loggin g table opens by clicking the right mouse button in the Firewall Event L[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 153 Firewall If you call up the logging table vi a LANmonitor, it looks like the follow ing depiction: If you call up the logging tabl e via WEBconfig, it looks like the following depiction: The table contai ns the following values: Element Element meaning Idx. Current index (so that the tab[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 154 Firewall All Firewall actions are likewise displaye d within the IP router trace (’How to start a trace’ → page 48). Furthermore, s ome LANCOM mod- els have a Firewall LED, which signals each filtered packet. The filter list The filter lis t allows to exam ine filters generated [...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 155 Firewall O n T e l n e t l e v e l , t h e c o n te n t o f t h e f il t e r l i s t c a n b e d i s p l a y e d w i t h t h e c o m- mand show filter : Under WEBconfig the filter list has the following structure: The individual fields i n the filter list have the follow ing meaning: Ent[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 156 Firewall The connection list The connection table files source address, destination addr ess, protocol, source port, destina tion port, etc. of a connection, as we ll as possible actions. This table is sorted accor ding to source address, destination addr ess, protocol, source port an[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 157 Firewall The table contains the followi ng elements: Element Element meaning Src addr . Source address o f the connection Dst addr . De stination a ddress of the conn ection Protocol Used protocol (TCP/UDP etc.). Th e protocol is decimally indicated. Src port Source port of the connectio[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 158 Firewall Meaning of the flags of the connection list Port block list Address, protocol and port of a destinat ion station are filed in the port block list, if blocking of the destination port on t he destination station was selected as a filter’s packet action. This table is likewi [...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 159 Firewall Sorting is done accor ding to address, pr otocol and port. The table contains the following elements: Host block list The address of a station is filed in the ho st b lock list, if bl ocking of the sender was selected in a filter’s packet action . This table is a sender addres[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 160 Firewall 8.4 Protection against br eak- in attempts: Intrusion Detection A Firewall has the task to exami ne da ta traf fic ac ross bo rder s be tw ee n ne t- wo rk s , a nd to re je ct t ho se p ac ke t s, wh ic h do n ot ha ve a pe rm i ss io n fo r t ran s - mission. Beside attempt[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 161 Firewall 8.4.2 Configuration of the IDS LANconfig Par ameters of the Intrusion Detection S ystem are set in LANconfig in the con- figuration tool 'Fir ewall/QoS' on index card 'IDS': Apart from the maximum number of port inquiries, f ragment action and the possible re[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 162 Firewall 8.5 Protection against “Denial of Service” attacks Attacks from the Internet can be br eak- in attem pts, as well as attacks aiming to block the accessibility and functional ity of indivi dual servic es. Therefore a LANCOM is equipped with appropriat e protective mechani [...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 163 Firewall during the attack and, moreover , the owner of the falsified address cannot receive normal data any more during the attack. If the falsified sender address is the broadcast address of the second network, also al l workst ations are blocked in this network, too. I n t h i s c a s[...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 164 Firewall a new Denial of Service attack can resu lt thereby if the memory of the vi ctim is exhausted. Te a r d r o p The T ear drop attack works with overl a pping fragments. After the first frag- ment another one is sent, which overlaps completely within the first one, i.e . the end[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 165 Firewall 8.5.2 Configuration of DoS blocking LANconfig Par ameters against DoS attacks are set in the LANconfig in the configur ation tool 'Firewall/QoS' on the r egister card 'DoS': In order to dr astically reduce the susceptibility of the network for DoS attacks in [...]

LANCOM Refer ence Manual LC OS 3.50  Ch apter 8: Firewall 166 Firewall  The connection will be cut off .  The sender address will be blocked for an adjustable period of time.  The destination port of the scan will be blocked for an adjustab le period of time. WEBconfig, T eln et The behaviour of the DoS detection an d blocking can be co[...]

 Chapter 8: Firewall LANCOM Reference Manual LCOS 3.50 167 Firewall WEBconfig, T eln et With WEBconfig or T eln et the suppress ion of responses can be configur ed here: Configuration tool Run WEBconfig Expert Configuration: Setup/IP Rout er Module/Firewall T erminal/T elnet Setup/IP Rout er Module/Firewal l[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 9: Quality of Service 168 Quality of Service 9 Quality of Service This chapter d edicates itse lf to quality: Under the generic term Quality of Serv- ice (short: QoS) those LCOS function s ar e summarized, which are concerned with the guarantee of cert ain service availa bilities. 9.1 Why QoS? The mai[...]

 Chapter 9: Quality of Service LANCOM Refer ence Manual LC OS 3.50 169 Quality of Service desired data transfer , certain da ta packet s must be treated preferentially . It is necessary for this, that at first a LA NCOM recognizes which data packe ts should be preferred at all. There are two possibilities to signal the need for a preferential tr[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 9: Quality of Service 170 Quality of Service  Limited maximum bandwidth What is DiffServ? DiffServ stands for “Differentiated Services” and is a quite recent model to signal the priority of data packets. DiffServ is based on the kn own T ype- of- Service(T oS) fi eld and uses the same byte with[...]

 Chapter 9: Quality of Service LANCOM Refer ence Manual LC OS 3.50 171 Quality of Service 9.2.1 Guaranteed minimum bandwidths Hereby you give priority to enterprise- c ritical applications, e.g. Voice- over- IP (VoIP) PBX systems or certain user groups. Full dynamic bandwidth m anagement for se nding Concerning the sending direction, th e bandwi[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 9: Quality of Service 172 Quality of Service 9.2.2 Limited maximum bandwidths Hereby you limit e.g. the entir e or connection- related maximum bandwidth for server accesses. An example: Y ou operate both a W eb server and a local network on a shared Internet access. T o pr event that your product ive [...]

 Chapter 9: Quality of Service LANCOM Refer ence Manual LC OS 3.50 173 Quality of Service As long as the interval for the mini mum bandwidth is no t exceeded (i.e. up to the end of the current second), all pack ets in this queue are treated without further speci al priority . All packets of this queue, of the "s ecured queue" and the &[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 9: Quality of Service 174 Quality of Service data packets it is still able to r eceive, and thus brakes the data stream already within the router . As a result, the queues wi ll automatica lly fill up. Different is the cas e, if an Ethernet in terface represents th e connection to the WAN. Fr om the L[...]

 Chapter 9: Quality of Service LANCOM Refer ence Manual LC OS 3.50 175 Quality of Service standard DSL connection, th e DSL in terface is thus adjusted in the LANCO M to the appropriate upstream rate (e.g. 128 kbps). 9.3.2 Queues for receiving direction Apart from the data tr ansfer rate in transmis sion direction, the same consid- eration appli[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 9: Quality of Service 176 Quality of Service  Standard r eception queue All packets that do not need special tr eatment because of an active QoS rule on the receiving side end up here. P ackets of this queue are directly passed on resp. confirm ed withou t consideration of maximum band- widths. 9.4[...]

 Chapter 9: Quality of Service LANCOM Refer ence Manual LC OS 3.50 177 Quality of Service A resulti ng delay has no disadvantageou s effect to the TCP- secur ed FTP trans- fer . T wo different procedures exist to influence the packet length:  The LANCOM can inf orm the peers of a data connection that they should only send data packets up to a[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 9: Quality of Service 178 Quality of Service office via VPN connection, over whic h the Internet traffic is not running simultaneously . 9.5 QoS parameters for V oice over IP applications An important task when configuring V oIP systems is to guarantee a sufficient voice quality . T wo factors conside[...]

 Chapter 9: Quality of Service LANCOM Refer ence Manual LC OS 3.50 179 Quality of Service Accordingly , a VoIP connection should be config ured such that the criteria for good speech qu ality are met: Packet loss up to 10%, delay up to 150 ms and jitter up to 10ms.  Jitter can be removed in the receivin g station by an appropriate buffer . In[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 9: Quality of Service 180 Quality of Service In detail, delay is determined especially by the codec used, the resulting packet size and the available bandwidth:  The time for processing is de termined by the used codec. For a sampling time of 20 ms, exactl y each 20 ms a new packet is generated. T [...]

 Chapter 9: Quality of Service LANCOM Refer ence Manual LC OS 3.50 181 Quality of Service the IPSec header must be added (RTP and IPSec headers can be larger , depending on the configuration). Since packets encr ypted with DES, 3DES , or AES, are only able to grow in block sizes of 64 bytes, the IPSec packet for G.711 consists of 160 bytes paylo[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 9: Quality of Service 182 Quality of Service The transfer time of the packets to the interface (serialization) assumes a PMTU of 512 bytes on a 128 Kbps conn ection. Theref ore, for slower inte r- faces or other codecs it is eventually necessary to adjust jitter buffers and/ or PMTU values. Please not[...]

 Chapter 9: Quality of Service LANCOM Refer ence Manual LC OS 3.50 183 Quality of Service tion always the physical data tran sfer via the r espective interface applies as the direction! 9.7 QoS configuration 9.7.1 Evaluating T oS and DiffServ fields T oS or Dif fServ? LANconfig For configuration with LANconfig, sele ct the configuration field &a[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 9: Quality of Service 184 Quality of Service  DiffServ : The T oS/DiffServ field is interpreted as DiffServ field and evalu- ated as follows: DiffServ in Firewall rules The code points from the DiffServ field can be evaluated by Firewall rules for further control of QoS parameters such as minimum b[...]

 Chapter 9: Quality of Service LANCOM Refer ence Manual LC OS 3.50 185 Quality of Service WEBconfig, T eln et For configur ation with WEBconfi g or T elnet, t he parameters ar e entere d at the following places into a new Firewall rule: The Firewall rule is extended by condition “@d” and th e DSCP (Differentiate d Services C ode Point ). The[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 9: Quality of Service 186 Quality of Service  The guaranteed bandwidth is defined on index card 'QoS'.  The option 'A ction only for default r oute' limits the rule to those pack- ets, which are sent or received via default route.  The option 'Action only for VPN r ou[...]

 Chapter 9: Quality of Service LANCOM Refer ence Manual LC OS 3.50 187 Quality of Service A maximum bandwidth is s imply defined by a limi t rule, which di scards by a “Drop” action all packets, which exceed the defined bandwidth. Examples:  %Qcds32 : Minimum bandwidt h of 32 kb ps for each connection  %Lgds 256 %d : Maximum bandwidth [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 9: Quality of Service 188 Quality of Service (e.g. Voice over IP), this extr a overhe ad is quite noticeable. Examples for the external overhead: WEBconfig, T eln et Under WEBconfig or T elnet the restrictions of data tr ansfer rates for Ethernet, DSL and DSLoL interfaces are en ter ed at the f ollowi[...]

 Chapter 9: Quality of Service LANCOM Refer ence Manual LC OS 3.50 189 Quality of Service 9.7.4 Sending and receiving dir ection LANconfig The interpretation of the data transfer direct ion can be adjusted in LANconfig when defining the QoS rule: WEBconfig, T eln et For configuration with WEBconfig or T elnet, the interpr etation of the data tra[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 9: Quality of Service 190 Quality of Service  Not packets of certain protocols ar e re duced, rather than all packets glo- bally on that interface. LANconfig The length reduction of the data pack ets is set in LA Nconfig when defining the QoS rule: WEBconfig, T eln et For co nfiguration with WEBcon[...]

 Chapter 9: Quality of Service LANCOM Refer ence Manual LC OS 3.50 191 Quality of Service The following example shows a settin g for V oice over IP tele phony: This rule defines the minimum bandwi dt h for sending and r eceiving to 32 Kbps, forces and reduces the PMTU while sending and receiving to packets of 256 byte size. F or the TCP connecti[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 10: Virtual LANs (VL ANs) 192 Virt ua l LAN s ( VLAN s) 10 Virtual LANs (VLANs) 10.1 What is a Virtual LAN? The increasin g availability of inexpensive layer 2 switches enables the setup of LANs much larger than in t he past. Until now, smaller parts of a network had been combined with hubs. These in [...]

 Chapter 10: Virtual LANs (VL ANs) LANCOM Refer ence Manual L COS 3.50 193 Virt ua l LAN s ( VLAN s)  Data traffic of certain logi cal units should be transmitted with a specific priority compar ed to other network users. An example to clarify: A switch is co nnected to a hub within a LAN, which connects four stations from the marketing depar[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 10: Virtual LANs (VL ANs) 194 Virt ua l LAN s ( VLAN s) The tagging is realized by an additional field within the MA C frame. This field contains two important information for the virtual LAN:  VLAN ID : A unique num ber describes the virtual LAN. This ID defines the belonging of data packets a log[...]

 Chapter 10: Virtual LANs (VL ANs) LANCOM Refer ence Manual L COS 3.50 195 Virt ua l LAN s ( VLAN s) rules for generating and processing of the VLAN tags are assigned to the sin- gle interfaces. Coming back again to the first example: A workstation from the marketing sends a data packet to a workstation of the sales department. The marketing hub[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 10: Virtual LANs (VL ANs) 196 Virt ua l LAN s ( VLAN s) Management and user traffic on a LAN Several hot spots are installed on an univer sity campus, so that students equipped with notebooks and WLAN cards have access to the Inte rnet and to the server of the library . The hot spots are connected to [...]

 Chapter 10: Virtual LANs (VL ANs) LANCOM Refer ence Manual L COS 3.50 197 Virt ua l LAN s ( VLAN s) But this task is very bur densome to re alize by har dware changes, or even not at all, because e.g. only one single central cabling exi sts in the office building. Virtual LANs enable to perform this task in a very s mart way . Also when departm[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 10: Virtual LANs (VL ANs) 198 Virt ua l LAN s ( VLAN s) 10.3 Configuration of VLANs VLAN technology functions are presently only supported by LANCOM Wireless devices. The configuration of LANC OM Wireless devices wi thin the VLAN realm has to perform two important tasks:  Defining virtual LANs and [...]

 Chapter 10: Virtual LANs (VL ANs) LANCOM Refer ence Manual L COS 3.50 199 Virt ua l LAN s ( VLAN s) Example for a network table: 10.3.2 The port table The port table configures the individual ports of the device for use by the VLAN. The table has got an entry for each port of the device wi th the following values:  Port : Name of t he port, [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 10: Virtual LANs (VL ANs) 200 Virt ua l LAN s ( VLAN s) 10.3.3 Configuration with LANconfig Pa rameters for virtual networks can be set with LANconfig under ' Manage- ment' on the r egister card 'VLAN': P2P- 2 Off On Off 1 P2P- 3 Off On Off 1 P2P- 4 Off On Off 1 P2P- 5 Off On Off 1[...]

 Chapter 10: Virtual LANs (VL ANs) LANCOM Refer ence Manual L COS 3.50 201 Virt ua l LAN s ( VLAN s) The definition of the used virtual ne tworks can be a ccessed via the button VLAN table : The button Port table o p e n s a d r o p d o w n l i s t w h e r e a V L A N p o r t c a n b e selected for editing: 10.3.4 Configuration wit h WEBconfig o[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 10: Virtual LANs (VL ANs) 202 Virt ua l LAN s ( VLAN s) The VLAN configuration shows up under WEBco nfig as follows:[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 203 Wireless LAN – WLAN 11 Wireless LAN – WLAN 11.1 What is a Wireless LAN? The following sect ions are a general description of the L COS operating system functions in wir eless networks. The precise functions suppor- ted by your device are described in its manual. In thi[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 204 Wireless LAN – WLAN IEEE 802.11a: 54 Mbps IEEE 802.11a describes the operation of Wir eless LANs in the 5 GHz frequency band (5,15 GHz to 5,75 GHz), with up to 54 Mbps maximum transfer rate. The real thr oughput depends however on the distance and/or on the quality of [...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 205 Wireless LAN – WLAN transmission. If exactl y this range is us ed by another transmitter , interferences in transmiss ion would be the result. With the DSSS procedur e the transmitter uses a broader spread of the possible frequenc ies and becomes m ore insensi- tive to n[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 206 Wireless LAN – WLAN Y our LANCOM base station supports - according to the model type - the standards IEEE 802.11g (downward- compat ible to IEEE 802.11b), and/or IEEE 802.11a. The operation of the integrated wireless card of your base station is only pos- sible in one [...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 207 Wireless LAN – WLAN  Larger Wireless LANs, connection to LA Ns with one or more base stations (infrastructure networ k)  Connecting two LANs via a direct radio link (point- to- point mode)  Connecting of devices with Ethernet interface via base st ations (client[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 208 Wireless LAN – WLAN  Connecting the Wire less LAN to an existing LAN  Extending the coverage of a Wire less LAN Additionally , the use of a base station enables a central administration of the Wireless LAN. Connection to an existing LAN An infrastructure network [...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 209 Wireless LAN – WLAN In the example above, the roaming functi on of the mobile st ation enables the access to the workstation in r adio cell A also after changing into radio cell B. After the radio cell change, the base station in radio cell B passes on the data of the mo[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 210 Wireless LAN – WLAN also possible t o specifically cont rol the access of w orkstations in the LAN to the IP routing function of the device. VPN pass- through VPN technology (VPN=Virtual Private Ne two rk) i s mo re a nd mo re f requ en tly in use to protect sen sitive[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 211 Wireless LAN – WLAN By the use of narrow beam antennas (e.g . AirLancer Extender ), also larger dis- tances can be bridged securely . An additional incr ease of reach can be achieved by use of further base statio ns, which operate in relay mode between two LAN segments. [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 212 Wireless LAN – WLAN base station. Due to the client mode, it is also possible to integrate devices like PCs or printers having only one Ethernet interface in to a Wireless LAN. Multiple radio cells with Multi- SSID Conventionally , a wireless networ k ca rd supports ex[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 213 Wireless LAN – WLAN In some applications, however , it may be desirable to divide the clients the radio cell into different groups, each of which is tr eated in a certain way by the access point. It may be nece ssary , for example, to operate a public wireless network wi[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 214 Wireless LAN – WLAN On the way from the original WEP of th e 802.11 standard to 802.11i, a whole s e r i e s o f c o n c e p t s h a v e a r i s e n t h a t have tended to increase confusion and i n s e c u r i t y a m o n g t h e u s e r s . T h i s d o c u m e n t s [...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 215 Wireless LAN – WLAN case, so- called assymetric encryption methods such as RSA can b e used, that is, to decrypt the data, a differ ent key is used than the one used to encrypt it. Such methods are, however , much slower than symmetric encryption methods, which leads to [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 216 Wireless LAN – WLAN data packet—a double application of the XOR operation with the same values cancels out. The advantage of RC4 is that the operations  generation of the byte s equence from the key  XOR operation on the data str eam on the sending and receivin[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 217 Wireless LAN – WLAN combination of two clear te xt packets. If one already knows the contents of one of the two packets, then the clear te xt of the other is easily determined. Thus WEP does not directly use the key entered by the user for the RC4 algorithm, but rather c[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 218 Wireless LAN – WLAN usually weaker than 40 or 104 bits (t he current IEEE standards, for instance, assume that a typical password has a str e ngth of about 2.5 bits per character .) The IEEE standard specifies that up to fo ur different WEP keys can exist in one WLAN. [...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 219 Wireless LAN – WLAN for certain values of the RC4 key , conclusions may be drawn about the first values of the pseudo- random sequence it gener ates—thus about the bytes with which the beginning of the packet are encrypted. This property of RC4 can be relatively easily[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 220 Wireless LAN – WLAN which could au tomatically crack an arb itrary WLAN connection within a few hours. With this, WEP wa s essentiall y worthless. A first 'quick shot' to secur e WLANs against this kind of program was th e simple notion that the weak I V valu[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 221 Wireless LAN – WLAN the possibilit y of installing a valid WE P key for the next sessio n is more or less a byproduct. Figure 2 shows the basic p rocess of a session sec ured by EAP . In the first phase, the client r egisters with the access point as usual, and enters th[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 222 Wireless LAN – WLAN The access point is thus a sort of middle man betwee n client and server . it doesn't have to check the contents of these packets, it just has to check that no other data traffic to or fr om the client can occur . This process has two advantage[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 223 Wireless LAN – WLAN Further adv antages of this procedur e include its simple implementation i n the access point, with l ittle extension to existing hardwar e. The disadvantage of the procedure is its complexity . The maintenance of the central RADIUS server and the cer[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 224 Wireless LAN – WLAN  A simplified procedure for deriving the Master Secret mentioned in the last section, which can be perf ormed without a RADIUS server .  Negotiation of encryption procedur e between access point and client. TKIP TKIP stands for T emporal K ey [...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 225 Wireless LAN – WLAN a new component (green), however , besides the CRC, the unenc rypted package also has a so- called Michael- MI C attac hed. This is a has h algorithm developed especi ally for WLAN, whic h was designed so that it can be computed on older WLAN hardwar [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 226 Wireless LAN – WLAN decryption par t of TKIP checks this se quentiality and di scards packets which contain an already- used IV , wh i ch prevents replay at tacks. As a further detail , TKIP also mixes the MAC addr ess of the sender into the first phase. This ensures t[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 227 Wireless LAN – WLAN The key handshake breaks down into two phases: first the pairwise key handshake, then the group key handshake (Figure 4). As you can see, the handshake consists of pairs of packets which each cons ist in turn of a 'query' of the access point[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 228 Wireless LAN – WLAN The client still can't be 'approved', ho wev er , because the access point must still tr ansmit a further key—the group key , which it uses to transmit br oadcast and multicast pac kets simultaneo usly to all stations. T his must be[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 229 Wireless LAN – WLAN point to show whether encryption sh ould be used or not. This became insufficient the moment WEP was used with key lengths other than 40 bits— the user just had to take care that not only the same value but that the same length was defined as well. [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 230 Wireless LAN – WLAN 11.2.6 AES and 802.11i In mid- 2004, the long awaited 802.11 i standard was approved by the IEEE, which should put the entir e security concept of the WLAN on a new basis — which is to be expected, since errors as serious as those encountered duri[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 231 Wireless LAN – WLAN Similar to TKIP , CCM uses a 48- bit Initial V ector in each packet—an IV repetition is impossible in practice. As in TKIP , the receiver notes the last IV used and discards packets with an IV which is equal to or less than the comparison value. Pre[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 232 Wireless LAN – WLAN steps like WP A, the IEEE committee has now pr esented the new WLAN security standard 802.11i. The TKIP procedure us ed by WP A is based on the older RC4 algorithm, the foundation of WEP . AES is the first important and conclusive step towards a tru[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 233 Wireless LAN – WLAN example, is not a particularly secure SSI D. (’Network sett ings’ → page 251) 햴 If you know exactly which wireless network cards ar e permitted to access your WLAN, you can ent er the MAC ad dresses of these cards into the access contr ol list[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 234 Wireless LAN – WLAN apply to all of the logical wireless ne tworks su pported by this card. These parameters include, for example, the transmitt ing power of the antenna and the operating mode of the WLAN card (access point or client).  Other parameter s are related[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 235 Wireless LAN – WLAN stations. If t he stations do not answer these packet s, then the charging systems recognises the stat ion as no longer active. Configura tion with LANconfig For configuration with LANconfig you will find the general WLAN access settings under the con[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 236 Wireless LAN – WLAN Check that the setting 'filter out data from th e listed stations, transfer all other' is activated. New stations that ar e to participate in your wireles s network are added with the button 'Stati ons'. Configura tion with WEBco[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 237 Wireless LAN – WLAN Configura tion with LANconfig For configuration with LANconfig you wi ll find the protocol filter under the configuration area 'WLAN Securit y' on the 'Protocols' tab. M a k e a n e n t r y i n t h e p r o t o c o l l i s t f o r e[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 238 Wireless LAN – WLAN  Redirect address when the 'Redirect' action is selected Example: A R P , D H C P , I C M P w i l l b e l e t t h r o u g h , T e l n e t a n d H T T P w i l l b e r e d i r e c t e d t o 192.168.11 .5, all other packets will be reject [...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 239 Wireless LAN – WLAN i n c o r p o ra t ed i n t h e 8 0 2 . 1 1 s t a n d a rd f or t h e e n c r y p t i o n o f d a t a i n w i re l e s s transmissio n. This method uses keys of 40 (WEP64), 104 (WEP1 28) or 128 bits (WEP152) in length. A number of security loopholes i[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 240 Wireless LAN – WLAN Key 1/passphr ase In line with the encryption method ac tivated, you can enter a special WEP key for the respective logical WLAN i nterface or a passphrase when using WP A- PSK:  The passphrase, or the 'password' for the WP A- PSK metho[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 241 Wireless LAN – WLAN Rules of the entr y of the keys can be fo un d in the descriptio n of the WEP group key ’Rules for entering WEP keys ’ → page 243. Configura tion with LANconfig For configuration with LANc onfig you will fi nd the private WEP se ttings under the[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 242 Wireless LAN – WLAN keys: a special key for eac h logical WLAN interface and three common group WEP keys for each physical WLAN interface. If 802.1x/EAP is in use and th e 'dynamic key generation and transmission' is ac tivated, t he gr oup keys from 802.1x/E[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 243 Wireless LAN – WLAN Rules for entering WEP keys WEP keys can be entered as ASCII char acters or in hexadecimal form. The hexadecimal form begins with the char acters '0x'. The keys have a length depending on the WEP method: The ASCII character set includes th e[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 244 Wireless LAN – WLAN Configura tion with LANconfig For the configur ation with LANconfig, the country settings can be found in the configur ation area 'Management' on the tab 'Wir eless LAN' in the group 'General': This group i ncludes two [...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 245 Wireless LAN – WLAN the list of physical WLAN interfaces by clicking on the button Physical WLAN settings . WLAN card oper ation Operation mode LANCOM Wireless devices ca n be operated in two basic operation modes:  As an access point, it forms the link between the WL[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 246 Wireless LAN – WLAN Configura tion with WEBconfig or T elnet Under WEBconfig or T elnet you can se t the oper ation mode for the physical WLAN interface under the following paths: Radio settings Frequency band, Subband When selecting the fr equency band on the 'Ra[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 247 Wireless LAN – WLAN this mode, the WLAN card in the access point principally works with the faster standard and falls back on the slower mo de should a client of thi s type log into the WLAN . In the '2 Mbit compa t ible' mode, the access point supports older 8[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 248 Wireless LAN – WLAN possible range and, in particular , the highest possible data transfer rat e s. Access point density The more access points there are in a given area, the more the r eception areas of the antennae intersect. The setting 'A ccess point density&a[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 249 Wireless LAN – WLAN  Point - to- point 'Off': The access point only communicates with mobile clients  Point- to- point 'On': The access point can communicate with othe r access points and with mob ile clients  Po int- to- point 'Exclusiv[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 250 Wireless LAN – WLAN Create IBBS If the station can establish an IBBS (I ndependent Basic Service Set), meaning an adhoc network, then the s tation ca n connect to other WLAN clients. For the connection of devices with a client station, this is mostly unwanted or not re[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 251 Wireless LAN – WLAN LAN' tab. Open the list of logical WLAN interfaces by clicking on the button Logical WLAN settings and sele ct the required logical interface. Network settin gs Set the SSID Define a n unambiguous SSI D (network name) for e ach of the logical wir[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 252 Wireless LAN – WLAN Configura tion with WEBconfig or T elnet Under WEBconfig or T elnet you can set the network sett ings for the logical WLAN interface under the following paths: T ransmission settings Details for the data transfer over the logical interface are set o[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 253 Wireless LAN – WLAN RTS threshold The RTS thr eshol d prevents the occurren ce of the "hidden station“ phenomenon. Here, the t hree access points 쐃 , 쐇 , and 쐋 are positioned such that no direct wir eless connection between the two outer devices is possible.[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 254 Wireless LAN – WLAN 11.4.5 Additional WLAN functions Apart from the di fferent encryption me th ods 802.11i/AES, WP A/TKIP or WEP and the closed network, a va riety of other functions exis t for securing the operation of a wire less network. Th e Redirect function prov[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 255 Wireless LAN – WLAN IEEE 802.1x/EAP The international industry standard IEEE 802.1x and the E xtensible A uthentication P rotocol (EAP) enable access points to carry out reliable and secure access checks. The access data can be managed centrally on a RADIUS server and ca[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 256 Wireless LAN – WLAN IPSec over WLAN Only with th e LANCOM VPN Option. Not available w ith all LANCOM devices. With the help of the IPSec- over- WLAN technology in addition to the security measur es described al ready , a wireless network for th e exchange of especially[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 257 Wireless LAN – WLAN transmitter and re ceive r . The ar eas where the waves amplify or cancel themselves out are known as Fresnel zones. T o ensur e an optimal signal re ceptio n between transmitter and re ceiver , the Fresnel zone 1 should remain fr ee fr om any obstruc[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 258 Wireless LAN – WLAN T o ensure that the Fr esnel zone 1 remains unobstructed, the height of the antennae must exceed that of the highes t obstruction by this radius. The full height of the antenna mast (M) should be as depicted: M = R + 1m + H + E (Earth's curvatu[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 259 Wireless LAN – WLAN connections, and even the air , and amplifying elem ents such as the extern al antennae. 햲 The calculation of the pow er over the path begins at the tr ansmitters's radio module. The radio module in the LANCO M access points in 802.11a mode emi[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 260 Wireless LAN – WLAN The dat a transmissi on rate is set according to the recept ion power . A WLAN module has an input sensitivity equiv alent to a power level of , for example, - 80dBm. If the received power fall s below this level, then a lower data rate can be switc[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 261 Wireless LAN – WLAN 햸 The receiving end als o has amplifying and attenuating elements. If the s a m e a n t e n n a i s u s e d a s a t t h e t r a n s m itter , the antenna gain i s 18 dB and the loss from cable (again 4m), lightning protection and plug connectors is [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 262 Wireless LAN – WLAN (P2mP , connection from an access poin t to the register ed clients, e.g. notebooks). The last column in the table shows the transmission power r eduction to be set so that the upper limits of 30 dBm (802 .11a) or 20 dBm (802.1 1b/g) cannot be excee[...]

 Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LC OS 3.50 263 Wireless LAN – WLAN  Assumed cable loss: 9 dB AirLancer Extender O- 70 (802.11b/g)  Antenna gain: 8.5 dBi  Assumed cable loss: 6 dB Maximum distanc e [km] Mbps P2P P2mP 1,0 2,82 1,58 2,0 2,51 1,41 5,5 2,24 1,26 6,0 2,24 1,26 9,0 2,24 1,26 11,0 2,00 1,12 12,0 1,7[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 11: Wireless L AN – WLAN 264 Wireless LAN – WLAN 11.5.4 T ransmission power r eduction Every country has regulations concerni ng the permissible output power fr om WLAN antennae, often with d ifferences according to the WLAN standard or divided according to indoor or outdoor use. The output power [...]

 Chapter 12: Office communications with LANCAPI LANCOM Refere nce Manual LCOS 3.50 265 Office communi cations with LANCA PI 12 Office communications with LANCAPI LANCAPI from LANCOM is a special version of the popular CAPI interface. CAPI (Comm on ISDN Ap plicatio n Programming In terface ) establis hes the co n- nection between ISDN ad apters a[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 12: Office communications with LANC API 266 Office communi cations with LANCA PI  Which of th e computers in t he local network should be able to acce ss the telephone network via LANC API? The LANCAPI server is configured in the following menus: Example configuration with LANconfig 햲 Open the co[...]

 Chapter 12: Office communications with LANCAPI LANCOM Refere nce Manual LCOS 3.50 267 Office communi cations with LANCA PI 햴 Activate the LANC API server for the outgoing and incoming calls, or allow only outgoing calls. 햵 In the latter case, the LANCAPI wi ll not respond to incoming calls—to receive faxes, for example. P ermitting outgoi[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 12: Office communications with LANC API 268 Office communi cations with LANCA PI 햹 Switch to the 'A vailability' tab. Here you can deter mine how the LANCOM should respond if a connection is to be established via the LANCA PI (incoming or outgoing) when both B channels ar e already busy (p[...]

 Chapter 12: Office communications with LANCAPI LANCOM Refere nce Manual LCOS 3.50 269 Office communi cations with LANCA PI If necessary , the system is restarted an d LANCAPI is then ready to accept all jobs from the office communica tions software. After succes sful installation, an icon for LANCAPI will be available in the toolbar . A double-[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 12: Office communications with LANC API 270 Office communi cations with LANCA PI  It is also possible to s et the interval at which the client checks whet her the found or list ed servers are stil l active. 12.3 How to use the LANCAPI T wo options are available for the use of the LANCAPI:  Y ou [...]

 Chapter 12: Office communications with LANCAPI LANCOM Refere nce Manual LCOS 3.50 271 Office communi cations with LANCA PI Installation T h e C A P I F a x m o d e m c a n b e i n s t a l l e d f r o m t h e C D s e t u p . A l w a y s i n s t a l l t h e CAPI Fa xmodem together with the current version of LANC API. After restart- ing, the CAPI[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 13: Server services for the LAN 272 Server services for the LAN 13 Server services for the LAN An LANCOM off ers a number of servic es for the PCs in th e LAN. These are cen- tral functions that can be used by work station computers. They are in part ic- ular:  Automatic address admini stration wit[...]

 Chapter 13: Server services for the LAN LA NCOM Reference Manual L COS 3.50 273 Server services for the LAN  period of validity for the parameters assigned The DHCP server takes the IP addresses either from a freely defined address pool or determines the addresses auto matically from its own IP addr ess (or intranet address). In DHCP mode, a[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 13: Server services for the LAN 274 Server services for the LAN 13.1.3 How are the addresses assigned? IP address assignment Before the DHCP server can assign I P addresses to the computers i n the net- work, it first needs to know which addr esses are available for assignment. Three options exist for[...]

 Chapter 13: Server services for the LAN LA NCOM Reference Manual L COS 3.50 275 Server services for the LAN Otherwise, the network mask fr om the TC P/IP module is used. The order is the same as during the assi gnment of the addresses. Broadcast addr ess assignment Normally , an addr ess yielded from th e val id IP addresses and the network mas[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 13: Server services for the LAN 276 Server services for the LAN it requested. The DHCP module prov ides two setti ngs for influencing the period of validity:  Maximum lease time i n minutes Here you can enter t he maximum period of validity that the DHCP server assigns a host. If a host re quests a[...]

 Chapter 13: Server services for the LAN LA NCOM Reference Manual L COS 3.50 277 Server services for the LAN Checking of IP ad dresses in the LAN The DHCP table provides a list of the IP addresses in the LAN. This table con- tains the assigned or used IP addr ess, the MAC addres s, the validity , the name of the computer (if available) an d the [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 13: Server services for the LAN 278 Server services for the LAN part specifies the domain. Specifying the domain is opt ional within a local network. These names could thus be ' www .domain.co m' or 'ftp.doma in.com', for example. If there is no DNS serv er in the local network, al[...]

 Chapter 13: Server services for the LAN LA NCOM Reference Manual L COS 3.50 279 Server services for the LAN  Finally , the DNS server checks whether the request to another DNS server is to be forwarded to another DNS se rver via a WAN inte rface (special DNS forwarding via the DNS destination table). If the requested name cannot be found in [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 13: Server services for the LAN 280 Server services for the LAN  Initially the router checks whether a DNS server has been enter ed in its own settings. If it is s uccessful there, it obta ins the desired informati on from this server . Up to two higher- level DNS servers can be specified.  I f [...]

 Chapter 13: Server services for the LAN LA NCOM Reference Manual L COS 3.50 281 Server services for the LAN 햳 Enter the domain in which t he DNS serv er is located. The DNS server uses this domain to determine whether th e r equested name is located in the LAN. Entering the domain is opt ional. 햴 Specify whether information from the DHCP se[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 13: Server services for the LAN 282 Server services for the LAN  that are accessible via the router . With the foll owing commands you add stations to the Hos t names table: Fo r ex amp le, if wo uld lik e to acce ss t he ma il s erv er at you r he adq uart ers (name: mail.your domain.com, IP: 10.0[...]

 Chapter 13: Server services for the LAN LA NCOM Reference Manual L COS 3.50 283 Server services for the LAN The DNS server m ay either be specified by the r emote site name (for automatic setting via PPP), or by an ex plicit IP address of the accord- ing name server . 13.2.4 URL blocking 햲 Finally , one can r estrict access to ce rtain names [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 13: Server services for the LAN 284 Server services for the LAN T o o n l y b l o c k t h e a c c e s s o f a c e r t a i n c o m p u t e r ( e . g . w i t h I P 1 0 . 0 . 0 . 1 2 3 ) t o COM domains, enter the fol lowing values: In the console mode the command is: set 002 *.com 10 .0.0.123 255.255.25[...]

 Chapter 13: Server services for the LAN LA NCOM Reference Manual L COS 3.50 285 Server services for the LAN The current W AN IP address of a LANCOM can be picked under the following address: http://<address of LANCOM>/config/ 1/6/8/3/ Figure: Picking the current IP address out of a LANCOM 13.3 Call charge management The capability of the [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 13: Server services for the LAN 286 Server services for the LAN mum of 830 c harge units may be used in six days . The router will not p ermit the establishment of any further connectio ns once this limit has been reached. The best way to use the router 's call charge monitoring function is if yo[...]

 Chapter 13: Server services for the LAN LA NCOM Reference Manual L COS 3.50 287 Server services for the LAN 13.3.3 Settings in the charge module In the charges m odule, the online time can be monitor ed and used to control call establishm ent.  Day(s)/P eriod The duration of the monitor ing peri od in days can be specified here.  Budget u[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 13: Server services for the LAN 288 Server services for the LAN 13.4.1 Setting up the SYSLOG module 13.4.2 Example configuration with LANconfig Create SYSL OG client 햲 Start LANconfig. Under 'Management', select the 'Log & T race' tab. 햳 T urn the module on and click SYSLOG[...]

 Chapter 13: Server services for the LAN LA NCOM Reference Manual L COS 3.50 289 Server services for the LAN shows the alignment between the internal sour ces of the LANCOM and the SYSL OG facilities. The eight priority stages defined initia lly in the SYSL OG are reduced to five stages in the LANCOM. T he followin g table shows the rel ationshi[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 13: Server services for the LAN 290 Server services for the LAN 햶 After you have set all the par ame ters, confirm the entries with OK . Th e SYSL OG client is then entered with its parameters into the SYSLOG table. Facilities All messages from LANCOM can be a ssigned to a facility with the Facility[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 291 Virtual Pri vate Networks— VPN 14 Virtual Private Networks—VPN 14.1 What does VPN offer? A VPN ( V irtual P rivate N etwork can be used to set up cost- effectiv e, public IP networks, for exampl e via the Inte rnet. While this may so und unspectacular at fi [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 292 Virtual Pri vate Networks— VPN  The central LAN has a connection to the Internet so that its users can access the Web, and se nd and receive e- mail. All connections to the outside world are based on dedi cated lines, i. e. switched or leased li nes. Dedica[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 293 Virtual Pri vate Networks— VPN  The subsidiary also has its own connection to the Internet.  The RAS PCs connect to the headquarters LAN via the Internet. The Internet is available vi rtually ever ywhere and typically has lo w access costs. Significant s[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 294 Virtual Pri vate Networks— VPN Routing at the IP level with VPN IP connections must be established betw een routers with public IP addresses in order to link networks via the Internet. These routers provide the connections between multiple subnetwo rks. When a[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 295 Virtual Pri vate Networks— VPN the Internet. With the pr oper technology , thir d parties can monitor and even recor d data traffic. As the packet s are encrypted by VPN, the actual content of the packets is inaccessible. Experts compar e this state to a tunne[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 296 Virtual Pri vate Networks— VPN following example il lustrates a typical application that is often used in practice. The principal components and features of these applications:  The coupling of networks, for ex ample between headquarters and a branc h offic[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 297 Virtual Pri vate Networks— VPN  When VPN clients are dialing in with the appropriate client software, extended functions in the IKE hand shake of LANCOM VPN allow t he use of different Preshar ed Keys (PSK s). Other conventional VPN client connections can u[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 298 Virtual Pri vate Networks— VPN  DES, key length 56 bit  IKE key exchange with Preshared K eys  Key exchange via Oakley , Diffi e- Hell man algorithm with key lengths 768 bit, 1024 bit or 1536 bit, well- known groups 1, 2 and 5  Key management in ac[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 299 Virtual Pri vate Networks— VPN In practice, LAN- LAN couplings are frequently used between company headquarters and subsidiaries, or fo r connections to partner compani es. A VPN- enabled router (VPN gateway) is located at ei ther end of the tunnel. The config[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 300 Virtual Pri vate Networks— VPN software then sets up a tunnel to the VPN gateway of the LAN using this Internet connection. The VPN gateway of the LAN must support the es tablishment of VPN tunnels with the VPN client s oftware of the remote PC. 14.4 What is L[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 301 Virtual Pri vate Networks— VPN of the Internet and a private one by which the computer can be reached within the local network . Static and dynamic IP addresses Public IP addresses must be applie d for and ma naged, which inv olves costs. T h e re i s a l s o [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 302 Virtual Pri vate Networks— VPN  static – dynamic  dynamic – dynamic Dynamic – static If a user on compu ter B in LAN 2 wishes to connect to computer A i n LAN 1, then gateway 2 receives a request and tries to establish a VPN tunnel to gateway 1. Ga[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 303 Virtual Pri vate Networks— VPN Static – dynamic If , on the other hand, computer A in LAN 1 requires a connection to computer B in LAN 2, for ex ample when headquarters carries out remote maintenance at the external locations, then gateway 1 r eceives the re[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 304 Virtual Pri vate Networks— VPN translation via dynamic DNS services, a solution often used with flatrat e connections. The describ ed connection set up r equ ires an ISDN connection for both VPN gateways. But usually no charges will arise for this procedure. D[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 305 Virtual Pri vate Networks— VPN The LLC element is not available in 1TR6, the German national ISDN. The pr ocedure describe d above thus will not work with 1TR6.  As a subaddress via the D- channel. If it is not possible to send the address via the LL C elem[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 306 Virtual Pri vate Networks— VPN address for the DNS name translation. This can be set up very conveniently with a Wizard under LANconfig (als o see ’Dynamic D NS’ auf Se ite 284): For r easons of security and availabili ty , LANCOM recommends the us e of Dy[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 307 Virtual Pri vate Networks— VPN individual computers (RAS) or the connection of structured networks will be cove red subsequent ly . 14.5.1 VPN tunnel: Connections between VPN gateways Virtual Private Networks (VPNs) are used to interconnect local networks over[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 308 Virtual Pri vate Networks— VPN 14.5.2 Set up VPN connections with the Setup Wizard If possib le, make use of the Setup Wi zard within LANconfig to set up VPN connections between loca l networks. The Wizard guides you t hrough the configuration and makes all th[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 309 Virtual Pri vate Networks— VPN 14.5.3 Inspect VPN rules VPN rules represent a combination of various pieces of information and they are not directly defined in a LANCOM de vice; instead, they ar e compiled from a variety of sources. This is why it is not possi[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 310 Virtual Pri vate Networks— VPN  Definition of the tunnel endpoints  Definition of the security- related parameters (IKE and IPSec)  Definition of the VPN netw ork relationships, i.e. the IP address r anges to be connected. Should the IP ranges overlap[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 311 Virtual Pri vate Networks— VPN 14.5.5 Prepar e VPN network relationships The firewall integrated into LANCOM routers is a powerful instrument for defining source and target addr ess ra nges between which data transfer (and limitations to it) can be enabled or [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 312 Virtual Pri vate Networks— VPN  When only a portion of the local intranet is to be availabl e to the remote network, then the autom atic method is unsuited as the IP address range that is open to the VPN connection is too lar ge.  In many network structu[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 313 Virtual Pri vate Networks— VPN The firewall rules for generating VP N rul es are active even when the actual fire wall function in the LANCOM device is not r equired and is switched off!  Make sure that t he firewall action is s et to “T ransfer”.  S[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 314 Virtual Pri vate Networks— VPN 14.5.6 Configuration with LANconfig The section demonstrates how LANconfi g can be used to configure a LAN- LAN coupling with additional subnets. I n this section, VPN gateway 1 will be configured an d then the configuration of g[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 315 Virtual Pri vate Networks— VPN gateway” , enter the pu blic address of the remote s tation: eithe r the fixed IP address or the name for tr anslation by DNS. 햵 When using LANCOM Dynamic VPN: Change to the “Communication” configuration ar ea. Using the [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 316 Virtual Pri vate Networks— VPN accessible in the remote and in the local LAN. In each cas e, define the rout er as t he re mo te V PN gat ew ay a nd swi tch th e IP ma squ erad in g o ff . For the “VPN gat eway 1”, the following entries are necess ary so t[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 317 Virtual Pri vate Networks— VPN As a rule, i t is recommended that you keep the r ules used for making network relationships separa te from those fir ewall rules that affect the servi ces used in communicat ions, for example. 햸 On the “ A ctions ” tab for[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 318 Virtual Pri vate Networks— VPN The only difference is that the sour ce and the destination networks are swapped. 14.5.7 Configuration with WEBconfig 햲 Under Configuration  VPN  IK E- Param.  IKE key set a new IKE key for the connection: 햳 Under Co[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 319 Virtual Pri vate Networks— VPN 햴 Under Configuration  VPN  Connection list generate a new entry with the name of the remote ga teway s et to “Name”. For the “Remote gateway” , enter the pu blic address of the remote s tation: eithe r the fixed [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 320 Virtual Pri vate Networks— VPN accessible in the remote and in the local LAN. In each cas e, define the rout er as t he re mo te V PN gat ew ay a nd swi tch th e IP ma squ erad in g o ff . For the “VPN gat eway 2”, the following entries are necess ary so t[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 321 Virtual Pri vate Networks— VPN “VPN- GW 1- REMOTE”). Enter each su bnet in the form “%A10.1. 0.0 %M255.25 5.0.0”. 햸 Under Configuration  Firewall/QoS  Rules table define a new f i r e w a l l r u l e n a m e d “ V P N -G W 1 -O U T ”. Set t[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 322 Virtual Pri vate Networks— VPN only difference is that the sour ce and the destination networks are swapped. 14.5.8 Diagnosis of VPN connections If the VPN connections fail to work after the configur ation of the parameters, the following diag nostic methods c[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 323 Virtual Pri vate Networks— VPN 14.6.1 Static/static A VPN tunnel via the Internet serves as the connection between the LANCOM Headquarters and branch office . Bo th gateways have static I P addresses. Thus, both can initiate the connection. 14.6.2 Dynamic/stat[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 324 Virtual Pri vate Networks— VPN Headquarters has a fixed, static address. When the connection is set up, Branch office transmits its actual IP address to Headquarters . This is accomplished by a special ICMP packet (alternatively UDP , port 87). 14.6.3 Static/d[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 325 Virtual Pri vate Networks— VPN Alternatively , this application can be solv ed with the help of dynamic DNS. In this constellation, the headquarters with its static IP address connects to the branch office with the help of a dynamic DNS name which is assigned [...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 326 Virtual Pri vate Networks— VPN The entries f or the ISDN connection are needed f or the transmission of the actual dynamic IP address solely . The Internet acce ss wizard configures the connection to the Internet. Alternatively , this application can be solv e[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 327 Virtual Pri vate Networks— VPN 14.7.1 IPSec—The basis for LANCOM VPN The original IP protocol does not cont ain any provisions for security . Security problems ar e compounded by the fact that IP packets do not go directly to a specific recipie nt, but are s[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 328 Virtual Pri vate Networks— VPN 14.7.2 Alternatives to IPSec IPSec is an open st andard. It is not dependent on individu al manufacturer s and is being developed by the IETF with input from the intere sted public. The IETF is a nonprofit organization th at is o[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 329 Virtual Pri vate Networks— VPN All of these layer- 2 protocols only supp ort end- to- end connections; they are therefore not suitable for coupling entire networks. On the other hand, these mechanisms do not r equire the slightest changes to the network device[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 330 Virtual Pri vate Networks— VPN  Security Parameter Index (SPI) ID to distingu ish multiple l ogical connectio ns to the same target device with the same protocols  Target IP address  Security protocol used Designates the security protocol used for the[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 331 Virtual Pri vate Networks— VPN In transport m ode, the IP header of the original packet is left unchanged and the ESP header , encrypted data and both trailers are inserted. The IP header contains the unchange d IP address. T ransport mode can therefore only b[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 332 Virtual Pri vate Networks— VPN The result is a nominal key length of 168 bit, with an effective ke y length of 112 bits. T riple- DES combines the sophisticated DES technology with a suffi- ciently long key and is therefore consid e r e d t o b e h i g h l y s[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 333 Virtual Pri vate Networks— VPN The AH process in the sender In the sender , the authentication data is generate d in 3 steps. 햲 A checksum is calculated for the complete package using a hash algorithm. 햳 This checksum is once again sent th rough a hash alg[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 334 Virtual Pri vate Networks— VPN packet. The comparison with the sent ICV of the packet determines the integrity and authenticity of the pack et. Determining t he checksum for the in tegrity check A H a d d s a c h e c k s u m t o e a c h p a c k e t b e f o r e[...]

 Chapter 14: Virtual Priva te Networks —VPN LANCOM Refe rence Manual LCOS 3.50 335 Virtual Pri vate Networks— VPN Generation of the authenticatio n data In the second step, AH generates a new hash code using the checksum and a key , the final authentication data. A va riety of standards ar e available under IPSec for this pr ocess as well. L[...]

LANCOM Refer ence Manual LC OS 3.50  Chapter 14: Virtual Private Netw orks—VPN 336 Virtual Pri vate Networks— VPN 햵 In two further messages, the devices ex change their p ublic keys for Diffie - Hellman. The further co mmunicat ion is encrypted with Diffie- Hellman. 햶 Both ends use numbers t hat have been transferr ed (with the Diffie- H[...]

 Chapter 15: Appendix LANCOM Refer ence Manual LC OS 3.50 337 15 Appendix: Overview of functions for LANCOM models and LCOS versions 1) P ort Separation (Private Mode) 2) only if VPN option activated 3) not with in conjunction with 802.11b WLAN card s 4) optional VPN 500 and VPN 1000 5) compatible to ADSL and ADSL2 800 1000 1100 I- 10 821 1511 1[...]

LANCOM Refer ence Manual LC OS 3.42  Chapter 16: Index 338 Index 16 Index Numerics 1 1 mapping 41 , 84 3 DES 297 , 331 3- D ES 337 4- Port Switch 337 802.11i 213 , 230 PMK caching 231 VoIP 231 802.11x Rekeying 222 A AAL- 5 91 Access Control List 235 Access protection 58 for the configuration 58 by name or number 59 by number 59 via TCP/IP 55 Add[...]

 Chapter 16: Index L ANCOM Reference Man ual LC OS 3.42 339 Index Command line reference 33 Common ISDN Application Programming Interface (CAPI) 265 Computer names 277 Conf 97 Configuration procedure 15 SNMP 20 Configuration files 29 Configuration interface 15 Connection limit 286 Cost reduction 285 CRON 337 D D channel 28 , 50 , 60 Data compres[...]

LANCOM Refer ence Manual LC OS 3.42  Chapter 16: Index 340 Index Dynamic – static 302 , 323 Examples 323 How it works 301 ICMP 324 Introduction 300 PPP list 310 Static – dynamic 303 , 324 UDP 324 E EAP 220 Process of a session secured by EAP 221 RADIUS server 221 EAP/802.1x 22 3 Master Secr et 222 E- mail viru s 138 Encaps ulation 90 Encrypt[...]

 Chapter 16: Index L ANCOM Reference Man ual LC OS 3.42 341 Index IKE 298 , 335 Inband 15 inband Configuration via Inband 15 with Telnet 19 Initial Vector 217 Install software 30 Internet 74 Internet access 95 Intranet IP address assignment 27 4 Intranet address 77 Intrusion Detection 160 Intrusion- Detection IP- Spoofing 160 Inverse masqueradin[...]

LANCOM Refer ence Manual LC OS 3.42  Chapter 16: Index 342 Index MAC frame 194 Mail server 282 Main mode 297 Maximum bandwidth 170 , 172 Microsoft Network 276 Minimum bandwidth 169 , 171 , 172 Reception 17 1 Sending 171 Modem 91 Monitoring 23 , 46 MS- CHAP 92 , 93 Multi SSI D 250 Multilink PPP (MLPPP) 92 , 101 Multi- SSID 212 N N N mapping 37 , [...]

 Chapter 16: Index L ANCOM Reference Man ual LC OS 3.42 343 Index Precedence 170 Pre- Shared Ke y 214 Preshared key 298 Priority control 268 Private Mode 337 Private WEP settings 239 Protection for the configuration 52 for the LAN 74 Protocol filter 237 PSK 214 Public key 336 Q QoS 176 , 337 Direction of data transfer 182 QoS – siehe Quality- [...]

LANCOM Refer ence Manual LC OS 3.42  Chapter 16: Index 344 Index TCP- Stealth- Modus 124 Teardrop 164 Telnet 21 Temporal Key Integrity Protocol 224 Term 97 Terminal program 31 TFTP 19 Throughput 102 Time 97 Time budget 286 Time dependent connection- limit 286 Time- out 102 , 103 ToS 169 , 170 High Reliability 169 IPSec 169 Low Delay 169 , 172 Pr[...]

 Chapter 16: Index L ANCOM Reference Man ual LC OS 3.42 345 Index Static – dynamic 32 4 static - static 323 VPN client 299 VPN connections Diagnosis 322 Manual set- up 309 Setup Wizard 308 VPN example application 295 VPN network relationships 311 VPN rules 309 W WAN- layer 90 WEBconfig 16 , 18 , 31 HTTPS 19 Well known groups 298 WEP 238 , 241 [...]

LANCOM Refer ence Manual LC OS 3.42  Chapter 16: Index 346 Index VPN pass- through 207 WEP group keys 241 WLAN interface logical 250 physical 244 WLAN security 214 802.11i 23 0 802.1x 22 0 AES 230 EAP 220 Sniffer tools 219 TKIP 223 WEP 215 WEPplus 219 WPA 223 WPA 213 , 223 Group Key 227 Handshake procedure 223 Key handshake 226 Key mixing phase [...]