Nortel Networks BCM50a manuale d’uso

BCM50a BCM50a Integrated Router Document Number : N0115791 Document Vers ion: 1.0 Date: September 2006 BCM50a Integrated Router Configuration — Advanced[...]

2 N0115791 N0115791 Copyright © Nortel 2005–2006 All rights reserved. The information in this document is subj ect to change without notic e. The statements, configur ations, techni cal data, and recommendations in this document are belie ved to be accurate and re liable, but are presented wi thout express or implied warranty. Users must take fu[...]

3 BCM50a Integrated Router Configuration — Advanced Contents Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Text conventions . . . . . . . . . . . . .[...]

4 Contents N0115791 Autosensing 10/100 Mb/s Ethernet LA N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Time and date . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Reset button . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 [...]

Contents 5 BCM50a Integrated Router Configuration — Advanced Initial screen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Logging on to the SMT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Navigating the SMT interface . . . . . . . . . .[...]

6 Contents N0115791 Remote Node setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Remote Node profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Encapsulation and Multiplexing scenarios . . . . . . . . . . . . . . . . . . . . . . . . .[...]

Contents 7 BCM50a Integrated Router Configuration — Advanced Chapter 10 Introducing the firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Using SMT menus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Activating the firewall . . . . . . . . . . .[...]

8 Contents N0115791 System information and console port speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 System Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Console port speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

Contents 9 BCM50a Integrated Router Configuration — Advanced Chapter 16 System Maintenance menus 8 to 1 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 Command Interpreter mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 Command syntax . . . . . . . . . . . . . . . . . . . . . . . . [...]

10 Contents N0115791 Triangle Route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 The Ideal Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 The Triangle Route Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

Contents 11 BCM50a Integrated Router Configuration — Advanced Appendix G Command Interpreter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 Command Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 41 Command usage . . . . . . . . . . . . . . . .[...]

12 Contents N0115791 Appendix J Log descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289 VPN/IPSec logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297 VPN responder IPSec log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

13 BCM50a Integrated Router Configuration — Advanced Figures Figure 1 Secure Internet Access and VPN Applicat ion . . . . . . . . . . . . . . . . . . . . . 38 Figure 2 Initial screen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Figure 3 SMT Login . . . . . . . . . . . . . . . . . . . . . . . . .[...]

14 Figures N0115791 Figure 30 Menu 4 – Applying NAT for Internet Access . . . . . . . . . . . . . . . . . . . . . . . 90 Figure 31 Menu 11.3 – Applying NAT to the Remo te Node . . . . . . . . . . . . . . . . . . . 91 Figure 32 Menu 15 – NA T Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Figure 33 Menu [...]

Figures 15 BCM50a Integrated Router Configuration — Advanced Figure 65 Filtering Remote Node Traf fic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Figure 66 Menu 22 – SNMP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Figure 67 Menu 23 – System security . . . . . . . . . . . . . . . .[...]

16 Figures N0115791 Figure 100 Windows XP: Start menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 Figure 101 Windows XP: Control Pane l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197 Figure 102 Windows XP: Contro l Panel: Network Connections: Properties . . . . . . . 198 Figure 103 Windows XP[...]

Figures 17 BCM50a Integrated Router Configuration — Advanced Figure 135 NetBIOS Display Filter Settings Co mmand Example . . . . . . . . . . . . . . . 280 Figure 136 Example VPN initiator IPSec log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298 Figure 137 Example VPN responder IPSec log . . . . . . . . . . . . . . . . . . . . . .[...]

18 Figures N0115791[...]

19 BCM50a Integrated Router Configuration — Advanced Tables Table 1 Feature specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Table 2 Main menu commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Table 3 Main menu summary . . . . . . . . . . . . . . . . . . . . [...]

20 Tables N0115791 Table 30 Menu 24.1 System Mainten ance: Status . . . . . . . . . . . . . . . . . . . . . . . . 147 Table 31 Menu 24.2.1 System Ma intenance: Information . . . . . . . . . . . . . . . . . . . 1 50 Table 32 Syste m Maintenance Menu Syslog Parame ters . . . . . . . . . . . . . . . . . . . 152 Table 33 System Maintenance menu diagnos[...]

Tables 21 BCM50a Integrated Router Configuration — Advanced Table 65 NetBIOS filter default settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280 Table 66 System error logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289 Table 67 System maintenance logs . . . . . . . . . . . . . . . .[...]

22 Tables N0115791[...]

23 BCM50a Integrated Router Configuration — Advanced Preface Before you begin This guide is designed to assist you with advanced configuration of your BCM50a Integrated Router for its various applicatio ns. The SMT parts of this manual contain background information solely on features not configurable by the WebGUI. The Web GUI parts of the basic[...]

24 Preface N0115791 Related publicatio ns For more information about using the BCM50a Integrated Router, refer to the following publications: • BCM50a Integrated Router Configuration - Basics ( N0115790 ) The basic manual cov ers how to use the Web GUI to configure yo ur BCM50a Integrated Router. • WebGUI Online Help Embedded WebGUI help for de[...]

Preface 25 BCM50a In tegrated Rou ter Configur ation — Adva nced USA and Canada Authorized Distributors Technical Support - GNTS/GNPS Telephone: 1-800-4NORTEL (1-800-466-7835) If you alr eady have a PIN Code , you can enter Express Routing Code (ERC) 196#. If you do not yet have a PIN Code, or for g eneral questions and first line supp ort, you c[...]

26 Preface N0115791 CALA (Caribbean & Latin America) Technical Support - CTAS Telephone: 1-954-858-777 7 E-mail: csrmgmt@nortel.com APAC (Asia Pacific) Service Business Centre & Pre-Sales Help Desk: +61-2-8870-551 1 (Sydney) Technical Support - GNTS Telephone: +612 8870 88 00 Fax: +612 8870 55 69 E-mail: asia_support@nortel.com Australia 1-[...]

Preface 27 BCM50a In tegrated Rou ter Configur ation — Adva nced Thailand 001-8 00-611-3007 Service Business Centre & Pre-Sales Help Desk +61-2-8870-551 1[...]

28 Preface N0115791[...]

29 BCM50a Integrated Router Configuration — Advanced Chapter 1 Getting to know your BCM50a Integrated Router This chapter introduces the main feat ures and applications of the BCM50a Integrated Router. Introducing the BCM50a Integrated Router The BCM50a Integrated Router is an id eal secure gateway for all data pas sing between the Internet and t[...]

30 Chapter 1 Getting to know your BCM50a Integrated Router N0115791 Physical features High-speed Internet access Your BCM50a Integrated Rout er supports ADSL2+ (Asymmetrical Digital Subscriber Line) for high transmission speeds and long connection distances. ADSL standards • Multimode standard (ANSI (American Na tional Standards Institute) T1.413[...]

Chapter 1 Getting to know your BCM50a Integrate d Router 31 BCM50a In tegrated Rou ter Configur ation — Adva nced • Extended-reach ADSL (ER ADSL) • SRA (Seamless Rate Adaptation) • Autonegotiating rate adaptation • ADSL physical connection ATM (Async hronous Transfer Mode) AAL5 (Adaptation Laye r type 5)· • Multiprotocol over AAL5 (Req[...]

32 Chapter 1 Getting to know your BCM50a Integrated Router N0115791 Autonegotiating 10/100 Mb/s Ethernet LAN The LAN interfaces automatically detect if they are on a 10 or a 100 Mb/s Ethernet. Autosensing 10/100 Mb/s Ethernet LAN The LAN interfaces automatically adjust to either a cro ssover or straight through Ethernet cable. Time and date Using t[...]

Chapter 1 Getting to know your BCM50a Integrate d Router 33 BCM50a In tegrated Rou ter Configur ation — Adva nced Certificates The BCM50a Integrated Router can use certificates (also called digital IDs) to authenticate users. Certificates are based on public-private key pairs. Certificates provide a way to exchange public keys for use in authenti[...]

34 Chapter 1 Getting to know your BCM50a Integrated Router N0115791 Content filtering The BCM50a Integrated Ro uter can block web features such as ActiveX controls, Java applets, and cookies, as we ll as disa ble web proxies. The BCM50a Integrated Router can block specific URLs by using th e keyword feature. The administrator can also define time p[...]

Chapter 1 Getting to know your BCM50a Integrate d Router 35 BCM50a In tegrated Rou ter Configur ation — Adva nced IP Multicast The BCM50a Integrated Router can use IP multicast to deli ver IP packets to a specific group of hosts. IGMP (Internet Group Man agement Protocol) is the protocol used to supp ort multicast groups. The BCM50a Integrated Ro[...]

36 Chapter 1 Getting to know your BCM50a Integrated Router N0115791 Traffic Redirect Traffic Redirect forwards WAN traffic to a backup gateway when the BCM50a Integrated Router cannot connect to th e Internet, thus acting as an auxiliary backup when your re gular WAN connection fails. Port Forwarding Use this feature to forward incoming serv ice re[...]

Chapter 1 Getting to know your BCM50a Integrate d Router 37 BCM50a In tegrated Rou ter Configur ation — Adva nced Upgrade BCM50a Integrat ed Router Firmware The firmware of the BCM50a Integrated Router can be upgraded manually through the WebGUI. Embedded FTP and TFTP Servers The embedded FTP and TFTP servers enable fast firmware upgrades, as wel[...]

38 Chapter 1 Getting to know your BCM50a Integrated Router N0115791 Figure 1 Secure Inter net Access and VPN Application Caution: Electro-static Discharge can disrupt the router. Use appropriate handl ing precautions to av oid ESD. Avoid touchin g the connectors on the router, particularly when it is in use. BCM50a Integrated Router[...]

39 BCM50a Integrated Router Configuration — Advanced Chapter 2 Introducing the SMT This chapter explains how to access the System Management Terminal and gives an overview of its menus. Introduction to the SMT T he BCM50a Integrated Router SMT (System Managemen t Terminal) is a menu-driven interface that you can access over a Telnet connection. T[...]

40 Chapter 2 Introducing the SMT N0115791 Type the username (“nnadmin “is the default) and press [ENTER] . The logon screen promp ts you to enter the password. Figure 3 SMT Login Type the password (“PlsChgMe!” is the default) and press [ENTER] . As you type the password, the screen displays an X for each character you type. Note that if the[...]

Chapter 2 In troducing t he SMT 41 BCM50a In tegrated Rou ter Configur ation — Adva nced Main menu After you enter the password, th e SMT displays the BCM50a In tegrated Router Main Menu , as shown in Figure 4 . Not all models have all the features shown. Move the cursor [ENTER] or [UP] or [DOWN] arrow keys Within a menu, press [E NTER] to move t[...]

42 Chapter 2 Introducing the SMT N0115791 Figure 4 Main menu Table 3 describes the fields in Figure 4 . BCM50a Integrated Router Main Menu Getting Started Advanced Management 1. General Setup 2. WAN Setup 3. LAN Setup 4. Internet Access Setup Advanced Applications 11. Remote Node Setup 12. Static Routing Setup 14. Dial-in User Setup 15. NAT Setup 2[...]

Chapter 2 In troducing t he SMT 43 BCM50a In tegrated Rou ter Configur ation — Adva nced Changing the system password To change the BCM50a Integrated Router administrator password:. 1 From the main menu, enter 23 to display Menu 23 – System Security . 2 Enter 1 to display Menu 23.1 – System Security – Change Password . Figure 5 Menu 23.1 ?[...]

44 Chapter 2 Introducing the SMT N0115791 SMT menus at a glance Figure 6 SMT overvie w[...]

45 BCM50a Integrated Router Configuration — Advanced SMT menu 1 - general setup Introduction to general setup Menu 1 - general setup contains administrative and system-related information. Configuring general setup Enter 1 in the main menu to open Menu 1: general setup . The Menu 1 - General Setup screen appears, as shown in Figure 7 . Fill in th[...]

46 Chapter 2 SMT menu 1 - general setup N0115791 Table 4 describes the fields in Figure 7 . Table 4 General setup menu fields Field Description Example System name Choose a descriptive name for identification purposes. Nortel recommends you en ter your computer name in this field. This name can be up to 30 alphan umeric characters long. Spaces, das[...]

Chapter 2 SMT menu 1 - genera l setup 47 BCM50a In tegrated Rou ter Configur ation — Adva nced First system DNS server Second system DNS server Third system DNS server DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server i s extremel y important because withou t it, you must know the[...]

48 Chapter 2 SMT menu 1 - general setup N0115791 Configuring dynamic DNS To configure Dynamic DNS, go to Menu 1: General Setup an d press [SPACE BAR] to select Yes in the Edit Dynamic DNS field. Press [ENTER] to display Menu 1.1— Configure Dynamic DNS ( Figure 8 ). Not all models have every field shown. You must also configure a VPN branch office[...]

Chapter 2 SMT menu 1 - genera l setup 49 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 8 Menu 1.1 – C onfigure Dynamic DNS Follow the instructions in Table 5 to configure Dynamic DNS parameters. Menu 1.1 - Configure Dynamic DNS Service Provider= WWW.DynDNS.ORG Active= No DDNS Type= DynamicDNS Host Name 1= Host Name 2= Host Name 3[...]

50 Chapter 2 SMT menu 1 - general setup N0115791 Enable Wildcard Your BCM50a Integrated Router supports DYNDNS Wildcard. Press [SPACE BAR] and then [ENTER] to select Yes or No This field is N/A when you choose DDNS client as your service provider. Offline This field is only available when CustomDNS is selected in the DDNS Type field. Press [SPACE B[...]

Chapter 2 SMT menu 1 - genera l setup 51 BCM50a In tegrated Rou ter Configur ation — Adva nced The IP address updates when you reconfigure menu 1 or p erform DHCP client renewal.[...]

52 Chapter 2 SMT menu 1 - general setup N0115791[...]

53 BCM50a Integrated Router Configuration — Advanced Chapter 3 WAN Setup This chapter describes how to co nfigure the WAN using Menu 2. Introduction to WAN setup This chapter explains how to conf igure the settings for your WAN port. WAN setup From the main menu, enter 2 to open Menu 2.[...]

54 Chapter 3 WAN Setup N0115791 Figure 9 Menu 2 – WAN Setup Table 6 describes the fields in Figure 9 . Menu 2 - WAN Setup Route Selection: WAN Metric= 1 Traffic Redirect Metric= 14 Dial Backup Metric= N/A Edit Traffic Redirect= No Dial-Backup: Active= N/A Port Speed= N/A AT Command String: Init= N/A Edit Advanced Setup= N/A Press ENTER to Confirm[...]

Chapter 3 WAN Setup 55 BCM50a In tegrated Rou ter Configur ation — Adva nced Traffic redirect setup Configure parameters that determine when the BCM50a Integrated Router forwards WAN traffi c to the backup gateway usi ng Menu 2.2 - Traffic Redirect Setup . Edit Traffic Redirect Press [SPACE BAR] to select Yes or No . Select No (default) if you do[...]

56 Chapter 3 WAN Setup N0115791 Figure 10 Menu 2.2 – Traffic Redirect Setup Table 7 describes the fields in Figure 10 . Menu 2.2 - Traffic Redirect Setup Active= No Configuration: Backup Gateway IP Address= 0.0.0.0 Metric= 15 Press ENTER to Confirm or ESC to Cancel: Table 7 Menu 2.2 Traf fic Redirect Setup Field Descrip tion Active Press [SPACE B[...]

57 BCM50a Integrated Router Configuration — Advanced Chapter 4 LAN setup This chapter describes how to configure the LAN using Menu 3: LAN Setup . Introduction to LAN setup This section describes how to configure the BCM50a Integrated Router for LAN connections. Accessing the LAN menus From the main menu, enter 3 to open Menu 3 – LAN setup Figu[...]

58 Chapter 4 LAN setup N0115791 Figure 12 Menu 3.1 – LAN Port Filter Setup TCP/IP and DHCP ethernet setup menu From the main menu, enter 3 to open Menu 3 - LAN Setup to configure TCP/IP (RFC 1155) and DHCP Ethernet setup. Figure 13 Menu 3 – LAN Setup From menu 3, select th e submenu opt ion TCP/IP and DHCP Setup and press [ ENTER ]. The screen [...]

Chapter 4 LAN setup 59 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 14 Menu 3.2 – TCP/IP and DHCP Ethernet setup Menu 3.2 - TCP/IP and DHCP Ethernet Setup DHCP= Server TCP/IP Setup: Client IP Pool: Starting Address= 192.168.1.2 IP Address= 192.168.1.1 Size of Client IP Pool= 126 IP Subnet Mask= 255.255.255.0 First DNS Server= Fr[...]

60 Chapter 4 LAN setup N0115791 Size of Client IP Pool This field specifies the si ze or count of the IP address pool. 126 First DNS Server Second DNS Server Third DNS Server The BCM50a In tegrated Router passes a DNS (Domain Name System) server IP address (in the order you specify here) to the DHCP clients. Select From ISP if your ISP dynamically [...]

Chapter 4 LAN setup 61 BCM50a In tegrated Rou ter Configur ation — Adva nced Use the instructions in Table 9 to configure TCP/IP para meters for the LAN port. IP Alias Setup You must use menu 3.2 to configure the first network. Move the cursor to the Edit IP Alias field, press [SPACE BAR] to choose Yes and press [ENTER] to configure the second an[...]

62 Chapter 4 LAN setup N0115791 Figure 15 Menu 3.2.1 – IP Alias setup Use the instructions in Table 10 to configure IP Alias parameters.s Menu 3.2.1 - IP Alias Setup IP Alias 1= No IP Address= N/A IP Subnet Mask= N/A RIP Direction= N/A Version= N/A Incoming protocol filters= N/A Outgoing protocol filters= N/A IP Alias 2= No IP Address= N/A IP Sub[...]

Chapter 4 LAN setup 63 BCM50a In tegrated Rou ter Configur ation — Adva nced RIP Direction Press [SPACE BAR] and then [ENTER] to select the RIP directi on. Options are Both , In Only, Out Only or None . None Version Press [SPACE BAR] and then [ENTER] to select the RIP version. Options are RIP-1 , RIP-2B or RIP-2M . RIP-1 Incoming Protocol Filters[...]

64 Chapter 4 LAN setup N0115791[...]

65 BCM50a Integrated Router Configuration — Advanced Chapter 5 Internet access This chapter shows you ho w to configure your BCM50 a Integrated Router for Internet access. Internet access configuration Using Menu 4 you can enter the Internet Access information in one screen. Menu 4 is actually a simplified setup for one of the remote nodes that y[...]

66 Chapter 5 Inte rnet access N0115791 Figure 16 Menu 4 – Internet Access Setup Table 11 describes the fields in Figure 16 . Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= ENET ENCAP Multiplexing= LLC-based VPI #= 8 VCI #= 35 My Login= N/A My Password= N/A ENET ENCAP Gateway= N/A IP Address Assignment= Dynamic IP Address=[...]

Chapter 5 Internet access 67 BCM50a In tegrated Rou ter Configur ation — Adva nced Basic setup complete You have successfully conne cted, installe d, and set up your BCM50a Integrated Router to operate on your network, as well as access the Internet. If all your settings are correct, your BCM 50a Integrated Router can connect automatically to the[...]

68 Chapter 5 Inte rnet access N0115791[...]

69 BCM50a Integrated Router Configuration — Advanced Chapter 6 Remote Node setup This chapter shows you h ow to configure a remote node. Introduction to Remote Node setup This section describes the pro tocol-independent parameters for a remote no de. A remote node is required fo r placing calls to a remote gateway. A remote node represents both t[...]

70 Chapter 6 Remote Node setup N0115791 Nailed-Up Connection A nailed-up connection is a dial-up lin e where the connection is always up regardless of traffic demand. Th e BCM50a Integrated Router does two things when you specify a nailed-up connection. The first is that idle timeout is disabled. The second is that the BCM50a Integrat ed Router wil[...]

Chapter 6 Remote Node setup 71 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 17 Menu 11 – Remote Node Setup Encapsulation and Mult iplexing scenarios For Internet access you should use the encapsulation and multiplexing methods used by your ISP. Co nsult your telephone compan y for information on encapsulation and multiplexing me[...]

72 Chapter 6 Remote Node setup N0115791 Selecting RFC-148 3 encapsulation with VC-based multiplexing r equires the least amount of overhead (0 octets). Ho wever, if there is a potential need for multiple protocol support in the fu ture, it may be safer to select PPPoA encapsulation instead of RFC-1483 , so you do not need to reconfigure eith er com[...]

Chapter 6 Remote Node setup 73 BCM50a In tegrated Rou ter Configur ation — Adva nced Encapsula tion PPPoA refers to RFC-2364 (PPP Encapsulation over ATM Adaptation Layer 5). If RFC-1483 (Multiprotocol Encapsulation over ATM Adaptation Layer 5) of ENET ENCAP are selected, then the Rem Login , Rem Password , My Lo gin , My Pass word and Authen fiel[...]

74 Chapter 6 Remote Node setup N0115791 Edit IP/Bridge 1 For the TCP/IP parameters, perf orm the following steps to edit Men u 11.3 – Remote Node Network Layer Options as shown ne xt. Edit ATM Options Press [SPACE BAR] to select Yes and press [ENTER] to display Menu 11.6 – Remote Node ATM Layer Options . No Edit Advance Options This field is on[...]

Chapter 6 Remote Node setup 75 BCM50a In tegrated Rou ter Configur ation — Adva nced 2 In menu 11.1, make sure IP is among the protocols in the Route field. 3 Move the cu rs or to the Edit IP/Bridge field, press [ SPACE BAR ] to select Yes, then press [ENTER] to display Menu 11.3 – Remote No de Network Layer Options. Figure 19 Menu 11.3 – Rem[...]

76 Chapter 6 Remote Node setup N0115791 My WAN Addr Some implementations, especially UNIX derivatives, require separate IP network n umbers for the WAN and LAN links and each end to have a uniq ue address within the WAN network number. In that case, type the IP address assigned to the WAN port of your BCM50a Integrated Router. NOTE: Refers to local[...]

Chapter 6 Remote Node setup 77 BCM50a In tegrated Rou ter Configur ation — Adva nced Remote Node filter Move the cu rsor to the field Edit Filter Sets in menu 11.1, and then press [SPACE BAR] to set the value to Yes . Press [ENTER] to open Menu 11.1.4 - Remote Node Filter . Use menu 11.1.4 to specify the filter sets to apply to the incoming and o[...]

78 Chapter 6 Remote Node setup N0115791 Figure 20 Menu 11.1.4 – Re mote Node Filter (E thernet Encaps ulation) Figure 21 Menu 11.1.4 – Remote Node Filter (PPPoE or PPPoA Encapsulation) To configure the parameters for traffic redirect, see “Traffic redirect setup” on page 55 . Menu 11.1.4 - Remote Node Filter Input Filter Sets: protocol filt[...]

Chapter 6 Remote Node setup 79 BCM50a In tegrated Rou ter Configur ation — Adva nced Editing ATM Layer Options Follow the steps shown next to edit Menu 11.6 – Remote Node ATM Layer Options . In menu 11.1, move the cursor to the Edit ATM Options field and then press [SPACE BAR] to select Yes . Press [ENTER] to display Menu 11.6 – Remote Node A[...]

80 Chapter 6 Remote Node setup N0115791 Figure 23 Menu 11.6 for LLC-based Multip lexing or PPP Encapsulation In this case, only one set of VPI and VCI numbers need be specified for all protocols. The valid range for th e VPI is 0 to 255 and for the VCI is 32 to 6553 5 (1 to 31 is reserved for local management of ATM traffic). Advance Setup Options [...]

Chapter 6 Remote Node setup 81 BCM50a In tegrated Rou ter Configur ation — Adva nced Move the cu rs or to the Edit Advance Options field, press [SPACE BAR] to select Yes , then press [ENTER] to display Menu 11.8 – Advance S etup Options . Figure 25 Menu 11.8 – Ad vance Setup Options Table 14 describes the fields in Figure 25 . Menu 11.8 - Adv[...]

82 Chapter 6 Remote Node setup N0115791[...]

83 BCM50a Integrated Router Configuration — Advanced Chapter 7 IP Static Route Setup This chapter shows you how to config ure static routes with your BCM50a Integrated Router. IP Static Route Setup Enter 12 from the main menu . Select one of the IP static routes as shown in Figure 26 to configure IP static routes in menu 12. 1.[...]

84 Chapter 7 IP Static Route Setup N0115791 Figure 26 Menu 12 – IP Static Route Setup Now, enter the index number of the static ro ute that you want to conf igure. The reserved entry is for the WAN interface and you cannot edit it here. Menu 12 - IP Static Route Setup 1. Reserved 2. ________ 3. ________ 4. ________ 5. ________ 6. ________ 7. ____[...]

Chapter 7 IP Static Route Setup 85 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 27 Menu 12.1 – Edit IP Static Ro ute Table 15 describes the fields in Figure 27 . Menu 12.1 - Edit IP Static Route Route #: 1 Route Name= ? Active= No Destination IP Address= ? IP Subnet Mask= ? Gateway IP Address= ? Metric= 2 Private= No Press ENTER[...]

86 Chapter 7 IP Static Route Setup N0115791 Private This parameter determines if the BC M50a Integrated Ro uter includes the route to this remote node in its RIP broadcasts. If set to Yes , this route is kept private and not included in RIP broadcast. If No , the ro ute to this remote node is propagated to other hosts through RIP broadcasts. After [...]

87 BCM50a Integrated Router Configuration — Advanced Chapter 8 Dial-in User Setup This chapter shows you how to create user accounts on the BCM50a Integrated Router. Dial-in User Setup By storing user profiles locally, your BCM 50a Integrat ed Router can authenticate users without interacting with a network RADIUS server. Follow the steps below t[...]

88 Chapter 8 Dial-in User Setup N0115791 Figure 29 Menu 14.1 – Edit Dial-in User Table 16 describes the fields in Figure 29 . Menu 14.1 - Edit Dial-in User User Name= test Active= Yes Password= ******** Press ENTER to Confirm or ESC to Cancel: Leave name field blank to delete profile Table 16 Menu 14.1- Edit Dial-in User Field Description User Na[...]

89 BCM50a Integrated Router Configuration — Advanced Chapter 9 Network Address Translation (NAT) This chapter discusses how to configure NAT on the BCM50a Integrated Router. Using NAT SUA (Single User Account) Versus NAT SUA (Single User Account) is an impl ementation of a subset of NAT that supports two types of mapping, Many-to-One and Server .[...]

90 Chapter 9 Network Address Translation (NAT) N0115791 Figure 30 Menu 4 – Applying NAT for Internet Access Figure 31 shows how you apply NAT to th e remote node in menu 11.1. Enter 11 from the main menu. Move the cu rs or to the Edit IP/Bridge field, press [SPACE BAR] to select Yes and then press [ENTER] to bring up Menu 11.3 - Remote Node Netwo[...]

Chapter 9 Netwo rk Address Translation (NAT) 91 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 31 Menu 11.3 – Applying NAT to the Rem ote Node Table 17 describes the fields in Figure 31 . Menu 11.3 - Remote Node Network Layer Options IP Options: Bridge Options: IP Address Assignment = Dynamic Ethernet Addr Timeout(min)= N/A Rem IP[...]

92 Chapter 9 Network Address Translation (NAT) N0115791 NAT setup Use the address mapping sets menus and submenus to create the mapping table used to assign global addresses to computers on the LAN. You can see two NAT address mapping sets in menu 15.1. You can only config ure Set 1 . Set 255 is used for SUA. When you select Full Feature in menu 4 [...]

Chapter 9 Netwo rk Address Translation (NAT) 93 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 33 Menu 15.1 – Address M apping Sets SUA Address Mapping Set Enter 255 to display th e screen shown in Figure 34 (see “SUA ( Single Use r Account) Versus NAT” on page 89 ) . The fields in this menu cannot be changed. Menu 15.1 — Ad[...]

94 Chapter 9 Network Address Translation (NAT) N0115791 Figure 34 Menu 15.1.255 – SUA Address Ma pping Rules Table 18 explains the fields in Figure 34 . Menu 15.1.255 - Address Mapping Rules Set Name= SUA Idx Local Start IP Local End IP Global Start IP Global End IP Type --- --------------- --------------- --------------- --------------- ------ 1[...]

Chapter 9 Netwo rk Address Translation (NAT) 95 BCM50a In tegrated Rou ter Configur ation — Adva nced User-Defined Address Mapping Sets Go to menu 15.1. Enter 1 to bring up the menu shown in figure below. Look at the differences from the previous menu. Note the extra Action and Select Rule fields means you can configure rules in this scr een. Not[...]

96 Chapter 9 Network Address Translation (NAT) N0115791 Figure 35 Menu 15.1. 1: First Se t Ordering your rules Ordering your rules is important becau se the BCM50a Integrated Router applies the rules in the order that you specify. Wh en a rule matches the current packet, the BCM50a Integrated Router takes the co rresponding action and the remaining[...]

Chapter 9 Netwo rk Address Translation (NAT) 97 BCM50a In tegrated Rou ter Configur ation — Adva nced your configured rule is pushed up by that number of empty rules. For examp le, if you have already co nfigured rules 1 to 6 in yo ur current set and now you configure rule number 9. In the set summary screen, the new rule will be rule 7, not 9. I[...]

98 Chapter 9 Network Address Translation (NAT) N0115791 Figure 36 Menu 15.1.1.1: Editing or configuring an individual ru le in a set Table 20 describes the fields in Figure 36 . Menu 15.1.1.1 Address Mapping Rule Type= One-to-One Local IP: Start= End = N/A Global IP: Start= End = N/A Press ENTER to Confirm or ESC to Cancel: Table 20 Menu 15.1.1.1: [...]

Chapter 9 Netwo rk Address Translation (NAT) 99 BCM50a In tegrated Rou ter Configur ation — Adva nced Configuring a server behi nd NAT Note: If you do not assign a Default Serve r IP address, the BCM50a Integrated Rout er discards all packets received for ports tha t are not specified here or in the remot e management setup. Follow these steps to[...]

100 Chapter 9 Network Address Tr anslation (NAT) N0115791 Figure 37 Menu 15.2 – NAT Server Sets 3 Select Edit Rule in the Select Command field; type the index number of the NAT server you want to co nfigure in the Select Rule field and press [ENTER] to open Menu 15.2.1 - NAT Server Configuration (see the ne xt figure). Menu 15.2 - NAT Server Setu[...]

Chapter 9 Ne twork Address T ranslation (NAT ) 101 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 38 15.2.1 – NAT Server Configuration 15.2.1 - NAT Server Configuration Index= 1 ----------------------------------------------------------------- Name= Active= No Start port= 0 End port= 0 IP Address= 0.0.0.0 Press ENTER to Confirm or[...]

102 Chapter 9 Network Address Tr anslation (NAT) N0115791 5 Enter the inside IP address of the server in the IP Address field. In the following figure, you have a computer acting as an FTP, Telnet and SMTP server (ports 21, 23 and 25) at 192 .168.1.33. 6 Press [ENTER] at the “Press ENTER to confirm …” prompt to save your configuration afte r [...]

Chapter 9 Ne twork Address T ranslation (NAT ) 103 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 40 Multiple servers behind NAT exa mple General NAT examples The following are some exam ples of NAT configuration. Internet access only In the Internet access example shown in Figure 41 , you only need one rule where all your ILAs (Ins[...]

104 Chapter 9 Network Address Tr anslation (NAT) N0115791 Figure 41 NAT Example 1 Figure 42 Menu 4: Int ernet acce ss & NAT exam ple From menu 4 sh own above, simp ly choose the SUA Only option from the Network Address Translation field. This is the Many-to-One mapping discussed in section “General NAT examples” on page 103 . The SUA Only r[...]

Chapter 9 Ne twork Address T ranslation (NAT ) 105 BCM50a In tegrated Rou ter Configur ation — Adva nced Example 2: Internet access with an inside server Figure 43 NAT Example 2 In this case, you do exactly as shown in Figure 43 (use the convenient pre-configured SUA Only set), and als o go to menu 15.2 to specify the Inside Server behind th e NA[...]

106 Chapter 9 Network Address Tr anslation (NAT) N0115791 Figure 44 Menu 15.2: Specifying an inside serv er Example 3: Multiple public IP addresses with inside servers In this example, there are 3 IGAs from our ISP. There are many departments but two have their own FTP server. All de partments share the same router. The example reserves one IGA for[...]

Chapter 9 Ne twork Address T ranslation (NAT ) 107 BCM50a In tegrated Rou ter Configur ation — Adva nced The example situation looks like this: Figure 45 NAT exam ple 3 1 In this case you must configure Address Mapping Set 1 from Menu 15.1 - Address Mapping Sets. Therefore, you must choose the Full F eature option from the Network Address Transla[...]

108 Chapter 9 Network Address Tr anslation (NAT) N0115791 Figure 46 Example 3: Menu 11.3 Figure 47 shows how to configure the first rule. Menu 11.3 - Remote Node Network Layer Options IP Options: Bridge Options: IP Address Assignment = Dynamic Ethernet Addr Timeout(min)= N/A Rem IP Addr = 0.0.0.0 Rem Subnet Mask= 0.0.0.0 My WAN Addr= 0.0.0.0 NAT= F[...]

Chapter 9 Ne twork Address T ranslation (NAT ) 109 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 47 Example 3: Menu 15.1.1 .1 Menu 15.1.1.1 Address Mapping Rule Type= One-to-One Local IP: Start= 192.168.1.10 End = N/A Global IP: Start= 10.132.50.1 End = N/A Press ENTER to Confirm or ESC to Cancel:[...]

110 Chapter 9 Network Address Tr anslation (NAT) N0115791 Figure 48 Example 3: Final Menu 15.1.1 Now configure the IGA3 to map to our web server and mail server on the LAN. 8 Enter 15 from the main menu. 9 Now enter 2 from this menu and config ure it as shown in Example 3: Menu 15.2. Menu 15.1.1 - Address Mapping Rules Set Name= Example3 Idx Local [...]

Chapter 9 Ne twork Address T ranslation (NAT ) 111 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 49 Example 3: Menu 15.2 Configuring Trigger Port forwarding Enter 3 in menu 15 to display Menu 15.3 — Trigger Port Setup , shown in Figure 50 . Menu 15.2 - NAT Server Setup Default Server: 0.0.0.0 Rule Act. Start Port End Port IP Addr[...]

112 Chapter 9 Network Address Tr anslation (NAT) N0115791 Figure 50 Menu 15.3 – Trigge r Port Setup Table 22 describes the fields in Figure 50 . Menu 15.3 - Trigger Port Setup Incoming Trigger Rule Name Start Port End Port Start Port End Port ---------------------------------------------------------------------- 1. Real Audio 6970 7170 7070 7070 [...]

Chapter 9 Ne twork Address T ranslation (NAT ) 113 BCM50a In tegrated Rou ter Configur ation — Adva nced Trigger The trigger port is a port (or a range of ports) that causes (or triggers) the BCM5 0a Integrated Ro ute r to record the IP address of the LAN computer that sen t th e traffic to a serve r on the WAN. Start Port Enter a port number or [...]

114 Chapter 9 Network Address Tr anslation (NAT) N0115791[...]

115 BCM50a Integrated Router Configuration — Advanced Chapter 10 Introducing the firewall This chapter shows you how to get started with the firewall. Using SMT menus From the main menu enter 21 to go to Menu 21 - Filter Set and Firewall Configuration to display the screen shown in Fi gure 51 . Figure 51 Menu 21– Filt er and Firewall Setup Acti[...]

116 Chapter 10 Introducing the fir ewall N0115791 Figure 52 Menu 21.2 – Firewall Set up Menu 21.2 - Firewall Setup The firewall protects against Denial of Service (DoS) attacks when it is active. Your network is vulnerable to attacks when the firewall is turned off. Refer to the User’s Guide for details about the firewall default policies. You [...]

117 BCM50a Integrated Router Configuration — Advanced Chapter 11 Filter configuration This chapter shows you how to create and apply filters. Introduction to filters Your BCM50a Integrated Router uses filte rs to decide whe ther to allow passage of a data packet, make a call, or both. Th ere are two types of filter applications: data filtering an[...]

118 Chapter 11 Filter configuration N0115791 Figure 53 Outgoing packet filtering process For incoming p ackets, yo ur BCM50a Integrat ed Router appli es data filters o nly. Packets are processed depending upon wh ether a match is found. The following sections describe how to configure filter sets. Filter Structure A filter set consists of one or mo[...]

Chapter 11 Filter configuration 119 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 54 Filter rule process You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter set having up to six rules , you can have a maximum of 24 rules active for a single port. Start Fetch First Filter Se[...]

120 Chapter 11 Filter configuration N0115791 Configuring a Filter Set The BCM50a Integrated Ro uter includes filtering for NetBIOS over T CP/IP packets by default. To conf igure another filter set, fo llow the procedure below. 1 Enter 21 in the main me nu to open menu 2 1. Figure 55 Menu 21 – Filter and Firewall Setup 2 Enter 1 to bring up the me[...]

Chapter 11 Filter configuration 121 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 56 Menu 21.1– Filter Set Configuration 3 Select the filter set you wish to configure (1-12) and press [ENTER] . 4 Enter a descriptive name or comment in the Edit Comments field and press [ENTER] . 5 Press [ENTER] at the message “Press ENTER to con[...]

122 Chapter 11 Filter configuration N0115791 The next section provides informa tion on configuring the filter rules. Table 23 Abbreviations use d in the Filter Rules Summary Menu Field Description # The filter rule numbe r: 1 to 6. A Active: “Y” means the rule is active . “N” means the rule is inactive. Type The type of filter rule: “GEN [...]

Chapter 11 Filter configuration 123 BCM50a In tegrated Rou ter Configur ation — Adva nced Configuring a Filter Rule To configure a filter rule, type its number in Menu 21.1.1 - Filter Rules Summary and press [ENTER] to open menu 21.1 .1.1 for the rule. To speed up filtering, all rules in a filter set must be of the same class, for example, protoc[...]

124 Chapter 11 Filter configuration N0115791 Figure 57 Menu 21.1.1. 1 – TCP/IP Filter Rule Table 25 describes how to configure your TCP/IP filter rule. Menu 21.1.1.1 - TCP/IP Filter Rule Filter #: 1,1 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 0 IP Source Route= No Destination: IP Addr= IP Mask= Port #= Port # Comp= None Source: IP [...]

Chapter 11 Filter configuration 125 BCM50a In tegrated Rou ter Configur ation — Adva nced IP Mask Enter the IP mask to apply to the Destination: IP Addr . 0.0.0.0 Port # Enter the destination port of th e packets that you wish to filter. The range of this field is 0 to 65 535. This field is ignored if it is 0. 0-65535 Port # Comp Press [SPACE BAR[...]

126 Chapter 11 Filter configuration N0115791 Figure 58 illustrates the logic flow of an IP filter. Action Matched Press [SPACE BAR] and then [ENTER] to select the action for a matching packet. Check Next Rule Forward Drop Action Not Matched Press [SPACE BAR] and then [ENTER] to select the action for a packet not matching the rule. Check Next Rule F[...]

Chapter 11 Filter configuration 127 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 58 Executing an IP filter Pack et into I P F ilter Matched Matched Yes Acti on Matched A ctio n N o t M a tc he d More? No Fi l t er Act iv e? Che c k IP P r otocol Drop Drop P ac ket Accept Packet Drop Fo rwar d Ch eck Next Rul e Che c k N e xt Rule [...]

128 Chapter 11 Filter configuration N0115791 Configuring a Generic Filter Rule This section shows you how to configure a generic filter rule. With generic rules you can filter non-IP packets. For IP packet s, it is gener ally easier to use the IP rules directly. For generic rules, the BCM50a Integrated Router treats a pa cket as a byte stream as op[...]

Chapter 11 Filter configuration 129 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 59 Menu 21.1.1. 1 – Generic Filter Rule Table 26 describes the fields in the Generic Filt er Rule menu. Menu 21.1.1.1 - Generic Filter Rule Filter #: 2,3 Filter Type= Generic Filter Rule Active= No Offset= 0 Length= 0 Mask= N/A Value= N/A More= No L[...]

130 Chapter 11 Filter configuration N0115791 Example Filter The exampl e shown in Figure 60 is set to block outside users from accessing the BCM50a Integrated Router via Telnet. See the included disk for more Filter Rules example. Value Enter the value (in Hexadecimal notation) to comp are with the data portion. More If Yes , a matching packet is p[...]

Chapter 11 Filter configuration 131 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 60 Telnet filter Example 1 Enter 21 from the main menu to open Menu 21 - Filter and Firewall Setup . 2 Enter 1 to open Menu 21.1 - Filter Set Configuration . 3 Enter the index of the f ilter set you wish to configure (for example 3) and press [ENTER] [...]

132 Chapter 11 Filter configuration N0115791 Figure 61 Example Filt er: Menu 2 1.1.3.1 When you press [ENTER] to confirm, the screen shown in Figure 62 is displayed. Note that there is only one filter rule in this set. The screen shows you that you have configur ed and activated ( A = Y ) a TCP/IP filter rule ( Type = IP , Pr = 6 ) for destination [...]

Chapter 11 Filter configuration 133 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 62 Example Filter Rules Summary: Menu 21.1.3 After you have created the filter set, you must apply it. 1 Enter 11 from the main me nu to go to menu 11. 2 Then enter 1 to open Menu 11.1 Remote Node Profile . 3 Go to the Edit Filter Sets field, press [S[...]

134 Chapter 11 Filter configuration N0115791 are replaced on a connection-by-connection basis, which ma kes it impossible to know the exact address and port on the wi re. Therefore, the BCM50a Integrated Router applies the protocol filters to the native IP address and port number before NAT for outgoing packets and after NAT for incoming packet s. [...]

Chapter 11 Filter configuration 135 BCM50a In tegrated Rou ter Configur ation — Adva nced Applying LAN Filters LAN traffic filter sets are useful to bloc k certain packets, reduce traffic and prevent security breaches. Go to menu 3. 1 (shown next) and enter the numbers of the filter sets that you want to apply, as appropriate. You can choose up t[...]

136 Chapter 11 Filter configuration N0115791 Figure 65 Filtering Remote Node Tr affic Menu 11.1.4 - Remote Node Filter Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Call Filter Sets: protocol filters= device filters= Enter here to CONFIRM or ESC to CANCEL:[...]

137 BCM50a Integrated Router Configuration — Advanced Chapter 12 SNMP Configuration This chapter explains SNMP configuratio n menu 22. SNMP Configuration To configure SNMP, en ter 22 from the main menu to display Menu 22 - SNMP Configuration as shown next. The community for Get , Set and Trap fields is SNMP terminology for password. Note: SNMP is[...]

138 Chapter 12 SNMP Configuration N0115791 Figure 66 Menu 22 – SNMP Configuration Table 27 describes the SNMP configuration parameters. Menu 22 - SNMP Configuration SNMP: Get Community= Set Community= Trusted Host= 0.0.0.0 Trap: Community= Destination= 0.0.0.0 Press ENTER to Confirm or ESC to Cancel: Table 27 SNMP Configuration Menu Fie lds Field[...]

Chapter 12 SNMP Configuration 139 BCM50a In tegrated Rou ter Configur ation — Adva nced SNMP Traps The BCM50a Integrated Router will sends traps to the SNMP manager when any one of the following events occurs: Table 28 SNMP Trap s Trap # Trap Name Description 0 coldStart (defined in RFC-1215 ) A trap is sent after booting (power on). 1 warmStart [...]

140 Chapter 12 SNMP Configuration N0115791[...]

141 BCM50a Integrated Router Configuration — Advanced Chapter 13 System security This chapter describes how to configur e the system security on the BCM50a Integrated Router. System security You can configure the system password, an external RADIUS server and 802.1x in this menu. System password Figure 67 Menu 23 – System security Nortel recomm[...]

142 Chapter 13 Sys tem security N0115791 Configuring external RADIUS server Enter 23 in the main menu to display Menu 23 – System security . Figure 68 Menu 23 – System Security From Menu 23- System Security , enter 2 to display Menu 23.2 – System Security – RADIUS Server, as shown in Figure 69 . Figure 69 Menu 23.2 – System S ecurity – [...]

Chapter 13 System security 143 BCM50a In tegrated Rou ter Configur ation — Adva nced Table 29 describes the fields in Figure 69 . Table 29 Menu 23.2 System Secu rity: RADIUS Server Field Description Authentication Server Active Press [SPACE BAR] to select Yes and press [ENTER] to enable user authenticatio n through an external authentication serv[...]

144 Chapter 13 Sys tem security N0115791[...]

145 BCM50a Integrated Router Configuration — Advanced Chapter 14 System information and diagnosis This chapter covers SMT menus 24.1 to 24.4. Introduction to System Status This chapter covers the diagnostic tools that help you to ma intain your BCM50a Integrated Router. These tools include upda tes on system status, port status and log and trace [...]

146 Chapter 14 System information an d diagnosis N0115791 Figure 70 Menu 24 – System Maintenance System Status The first selection, System Status, gives you information on the ve rsion of your system firmware and the status and statis tics of the ports, as shown in th e next figure. System Status is a tool that can be used to monitor your BCM50a [...]

Chapter 14 System information and diagnosis 147 BCM50a In tegrated Rou ter Configur ation — Adva nced 3 There are three commands in Menu 24.1 - System Maintenance - Status . Entering 1 drops the WAN connectio n, 9 resets the co unters and [ESC] takes you back to the previous screen. Table 30 describes the fields present in Menu 24.1 - System Main[...]

148 Chapter 14 System information an d diagnosis N0115791 System information and console port speed With your system you can choose differe nt console port speeds. To get to the System Information an d Console Port Speed. 1 Enter 24 to go to Menu 24 – System Maintenance . 2 Enter 2 to open Menu 24.2 - System Informat ion and Console Port Speed . [...]

Chapter 14 System information and diagnosis 149 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 72 System Inform ation and Console Port Speed System Information System Information giv es you information about your sy stem, as shown in Figure 73 . More specifically, it gives you information on yo ur routing protocol, Ethernet address [...]

150 Chapter 14 System information an d diagnosis N0115791 Figure 73 Menu 24.2.1 – System Maintenan ce – Information Menu 24.2.1 - System Maintenance - Information Name: Routing: IP RAS F/W Version: VBCM252_2.6.0.0.001b3 | 06/29/2006 Country Code: 255 ADSL Chipset Vendor: STMI 2.6.4 Standard: Multi-Mode LAN Ethernet Address: 00:13:49:00:00:01 IP[...]

Chapter 14 System information and diagnosis 151 BCM50a In tegrated Rou ter Configur ation — Adva nced Console port speed You can change the speed of the console p ort through Menu 24.2.2 – Consol e Port Speed . Your BCM50a Integrated Router supports 9 600 (default), 19 200, 38 400, 57 600, and 115 200 b/s for the console port. Press [SPACE BAR][...]

152 Chapter 14 System information an d diagnosis N0115791 Figure 75 Menu 24.3 – System Maintenance: Log an d Trace Syslog logging The BCM50a Integrated Router uses the syslog facility to log the CDR (Call Detail Record) and system messages to a syslog server. Syslog and accounting can be configured in Menu 24.3.2 - System Main tenance - Syslog Lo[...]

Chapter 14 System information and diagnosis 153 BCM50a In tegrated Rou ter Configur ation — Adva nced Your BCM50a Integrated Router sends five types of syslog messages. Some examples of these syslog messages with their message formats are shown next: CDR Syslog Server IP Address Enter the IP Address of the serv er that logs the CDR (Call Detail R[...]

154 Chapter 14 System information an d diagnosis N0115791 Packet triggered Filter log Packet triggered Message Format SdcmdSyslogSend( SYSLOG_PKTTRI, SYSLOG_NOTICE, String ); String = Packet trigger: Protocol=xx Data=xxxxxxxxxx…..x Protocol: (1:IP 2:IPX 3:IPXHC 4:BPDU 5:ATALK 6:IPNG) Data: We will send forty-eight Hex characters to the server Jul[...]

Chapter 14 System information and diagnosis 155 BCM50a In tegrated Rou ter Configur ation — Adva nced PPP log spo: Source port dpo: Destination port Mar 03 10:39:43 202.132.155.97 RAS: GEN[fffffffffffnordff0080] }S05>R01mF Mar 03 10:41:29 202.132.155.97 RAS: GEN[00a0c5f502fnord010080] }S05>R01mF Mar 03 10:41:34 202.132.155.97 RAS: IP[Src=19[...]

156 Chapter 14 System information an d diagnosis N0115791 Firewall log Call-Triggering packet Call-Triggering Packet disp lays information about the packet that triggered a dial-out call in an easily readable format . Equivalent informa tion is available in menu 24.1 in hex format. An example is shown in Figure 77 . Figure 77 Call-Triggerin g packe[...]

Chapter 14 System information and diagnosis 157 BCM50a In tegrated Rou ter Configur ation — Adva nced With the diagnostic facility, you can t est the different aspects of your BCM50a Integrated Router to determine if it is workin g properly. In Menu 24 .4, you can choose among various types of diagnostic tests to evaluate your system, as shown in[...]

158 Chapter 14 System information an d diagnosis N0115791 Follow the procedure below to get to Menu 24.4 - System Maintenance – Diagnostic. 1 From the main menu, sel ect option 24 to open Menu 24 - System Maintenance . 2 From this menu, select optio n 4. Diagnostic. This opens Menu 24.4 - System Maintenance - Diagnostic . Figure 78 Menu 24.4 – [...]

Chapter 14 System information and diagnosis 159 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 79 WAN & LAN DHCP Table 33 describes the diagnostic tests available in menu 24.4 for your BCM5 0a Integrated Router and associated connections. Table 33 System Maintenance menu dia gnostic Field Description Ping Host Enter 1 to ping an[...]

160 Chapter 14 System information an d diagnosis N0115791[...]

161 BCM50a Integrated Router Configuration — Advanced Chapter 15 Firmware and configuration file maintenance This chapter tells you how to backup and restore your configuration file, as well as upload new firmware and config uration files. Filename conventions The configuration file (often called the romfile or rom-0) contains the factory default[...]

162 Chapter 15 Firmware and configu ration file maintenance N0115791 If your (T)FTP client does not allow you to have a de stination filename different than the source, you must ren ame the firmware and config file names as the BCM50a Integrated Route r only recognizes rom-0 an d ras. Be sure you keep unaltered copies of both files for later use. T[...]

Chapter 15 Firmware and configuration file maintenance 163 BCM50a In tegrated Rou ter Configur ation — Adva nced Backup configuration Follow the instructions as shown in Menu 24.5 ( Figure 80 ). Figure 80 Menu 24.5 – System Ma intenance – Ba ckup Config uration Using the FTP command from the command line 1 Launch the FTP client on your comput[...]

164 Chapter 15 Firmware and configu ration file maintenance N0115791 Example of FTP commands from the command line Figure 81 FTP Session Example GUI-based FTP clients Table 35 describes some of the commands that you can see in GUI-based FTP clients. TFTP and FTP over WAN Management Limitations TFTP, FTP and Telnet over WAN do not work when: 331 Ent[...]

Chapter 15 Firmware and configuration file maintenance 165 BCM50a In tegrated Rou ter Configur ation — Adva nced • You disable Telnet service in menu 24 .11. • You apply a filter in menu 3.1 (LAN) or in menu 11.1. 4 (WAN) to block Telnet service. • The IP address in the Secured Client IP field in menu 24.11 does not match the client IP. If [...]

166 Chapter 15 Firmware and configu ration file maintenance N0115791 5 Use the TFTP client (see the example be low) to transfer files betw een the BCM50a Integrated Route r and the computer. The file name for the configuration file is “rom-0” (rom-zero, not capital o). TFTP command example The following is an example TFTP command: tftp [-i] hos[...]

Chapter 15 Firmware and configuration file maintenance 167 BCM50a In tegrated Rou ter Configur ation — Adva nced Refer to Chapter 17, “Remote Mana gement,” on page 185 for information about configurations that disallow TFTP and FTP over WAN. Restore configuration This section shows you how to restore a pr eviously saved config uration. Note t[...]

168 Chapter 15 Firmware and configu ration file maintenance N0115791 Figure 82 Telnet into Menu 24.6 1 Launch the FTP client on your computer. 2 Enter open , followed by a space and the IP address of your BCM50a Integrated Router. 3 Press [ENTER] when prompted for a username. 4 Enter your password as requested (the default is “PlsChgMe!”). 5 En[...]

Chapter 15 Firmware and configuration file maintenance 169 BCM50a In tegrated Rou ter Configur ation — Adva nced Restore using FT P session example Figure 83 Restore using FTP sessio n example Refer to Chapter 17, “Remote Mana gement,” on page 185 to read about configurations that disallow TFTP and FTP over WAN. Uploading Firmware and Configu[...]

170 Chapter 15 Firmware and configu ration file maintenance N0115791 Figure 84 Telnet Into Menu 24.7.1 Upload System Firmware Configuration file upload The screen shown in Figure 85 appears when you access menu 24.7.2 via Telne t. Figure 85 Telnet Into Menu 24.7 .2 System Maintenance Menu 24.7.1 - System Maintenance - Upload System Firmware To uplo[...]

Chapter 15 Firmware and configuration file maintenance 171 BCM50a In tegrated Rou ter Configur ation — Adva nced To upload the firmware and the configuration files, foll ow the examples in the rest of this chapter: FTP file upload command from the DOS prompt example 1 Launch the FTP client on your computer. 2 Enter “open”, followed by a space[...]

172 Chapter 15 Firmware and configu ration file maintenance N0115791 FTP Session Example of Firmware File Upload Figure 86 FTP Session Example of Firmware File Upload More commands (found in GUI-based FTP clients) are listed earlier in this chapter. Refer to the “Remote Manage ment” on page 185 section to read about configurations that disallow[...]

Chapter 15 Firmware and configuration file maintenance 173 BCM50a In tegrated Rou ter Configur ation — Adva nced 5 Launch the TFTP client on your co mputer and connect to the BCM50a Integrated Router. Set the transfer mo de to binary before starting data transfer. 6 Use the TFTP client (see the example be low) to transfer files betw een the BCM50[...]

174 Chapter 15 Firmware and configu ration file maintenance N0115791[...]

175 BCM50a Integrated Router Configuration — Advanced Chapter 16 System Maintenance menus 8 to 10 This chapter leads you through SM T menus 24.8 to 24.10 . Command Interpreter mode The Command Interpreter (CI) is a part of the main router firmware. The CI provides much of the same functionality as the SMT, while adding some low-level setup and di[...]

176 Chapter 1 6 System Ma intenance me nus 8 to 10 N0115791 Figure 87 Command mode in Me nu 24 Command syntax The command keywords ar e in Courier New font. Enter the command keywords exactly as shown, do not abbreviate. The required fields in a comm and are en closed in an gle brackets < >. The optional fields in a command are enclosed in sq[...]

Chapter 16 System Maintenance menus 8 to 10 177 BCM50a In tegrated Rou ter Configur ation — Adva nced means that yo u must specify the type of ne tbios filter and whether to turn it on or off. Command usage A list of command s can be found by typing “help” or “?” at the command prompt. Always type the full command. Type “ex it” to ret[...]

178 Chapter 1 6 System Ma intenance me nus 8 to 10 N0115791 Figure 88 Call Control Budget management Menu 24.9.1 shows th e budget management statisti cs for outgoing calls. Enter 1 from Menu 24.9 - System Maintenance - Call Control to bring up the Budget Management menu ( Figure 89 ). Menu 24.9 - System Maintenance - Call Control 1.Budget Manageme[...]

Chapter 16 System Maintenance menus 8 to 10 179 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 89 Budget Manage ment The total budget is the time limit on the accumulated time for outgoing calls to a remote node. When this lim it is reached, the call is dropped and further outgoing calls to that remote node is blocked. After each pe[...]

180 Chapter 1 6 System Ma intenance me nus 8 to 10 N0115791 Call History This is the second option in Menu 24.9 - System Maintenance - Call Control . It displays information about past incoming and outgoing calls. Enter 2 from Menu 24.9 - System Maintenance - Call Control . Figure 90 Call History Table 38 describes the fields in Figure 90 . Menu 24[...]

Chapter 16 System Maintenance menus 8 to 10 181 BCM50a In tegrated Rou ter Configur ation — Adva nced Time and Date setting There is a software me chanism to set the time manually or get the current time and date from an external server when you turn on your BCM50a Integrated Router. With Menu 24.10, you can update the time and date settings of y[...]

182 Chapter 1 6 System Ma intenance me nus 8 to 10 N0115791 Figure 92 Menu 24.10 System Maintenance: Time and Date Setting Table 39 describes the fields in Figure 92 . Menu 24.10 - System Maintenance - Time and Date Setting Time Protocol= NTP (RFC-1305) Time Server Address= a.ntp.alphazed.net Current Time: 01 : 07 : 41 New Time (hh:mm:ss): N/A N/A [...]

Chapter 16 System Maintenance menus 8 to 10 183 BCM50a In tegrated Rou ter Configur ation — Adva nced Current Date This field displays an updated date only when you reenter this menu. New Date Enter the new date in year, month and day format. This field is available when you select Manual in the Time Protoco l field. Time Zone Press [SPACE BAR] a[...]

184 Chapter 1 6 System Ma intenance me nus 8 to 10 N0115791 Resetting the Time The BCM50a Integrated Ro uter r esets the time in three instance s: • After you make changes to and leave menu 24.10 • After starting up the BCM50a Integrated Router starts up, if a time server configured in menu 24.10 • After starting the BCM50a Integrat ed Router[...]

185 BCM50a Integrated Router Configuration — Advanced Chapter 17 Remote Management This chapter covers remote management found in SMT menu 24.11. Remote Management With remote management , you can determine which se rvices and protocols c an access which BCM50a Integra ted Router interface (if any) from which computers. You can manage your BCM50 [...]

186 Chapter 17 Remo te Management N0115791 Figure 93 Menu 24.11 – Remote Mana gement Control Table 40 describes the fields in Figure 93 . Menu 24.11 - Remote Management Control TELNET Server: Port = 23 Access = Disable Secure Client IP = 0.0.0.0 FTP Server: Port = 21 Access = Disable Secure Client IP = 0.0.0.0 SSH Server: Certificate = auto_gener[...]

Chapter 17 Remote Man agement 187 BCM50a In tegrated Rou ter Configur ation — Adva nced Remote Management Limitati ons Remote management over LAN o r WAN does not work when: 1 A filter in menu 3.1 (LAN) or in menu 11.1.4 (WAN) is applied to block a Telnet, FTP, or Web service. 2 You disable that service in menu 24.11. 3 The IP address in the Secu[...]

188 Chapter 17 Remo te Management N0115791[...]

189 BCM50a Integrated Router Configuration — Advanced Chapter 18 Call scheduling Using call scheduling (app licable only for PPPoA or PPPoE encapsulation), you can dictate when a remote node is called and for how long. Introduction Using the call scheduling feature, the BC M50a Integrated Router can manage a remote node and dictate when a remote [...]

190 Chapter 18 Call scheduling N0115791 Lower numbered sets take precedence over higher numbered sets, thereby avoiding scheduling conflicts. For example, if sets 1, 2, 3, and 4 are applied in the remote node then set 1 takes precedenc e over sets 2, 3, and 4 as the BCM5 0a Integrated Router, by default, applies the lowest numbered set first. Set 2[...]

Chapter 18 Call scheduling 19 1 BCM50a In tegrated Rou ter Configur ation — Adva nced If a connection is already established, yo ur BCM50a Integrated Router does not drop it. After the connection is dropped ma nually or it times out, then that remote node cannot be triggered until the end of the Duration . Table 41 Menu 26.1 Schedule Set Setup Fi[...]

192 Chapter 18 Call scheduling N0115791 After you configure your schedule sets, you must ap ply them to the desired remote nodes. Enter 11 from the Main Menu and then enter the target remote node index. Using [SPACE BAR] , select PPPoE or PPPoA in the Encapsula tion field and then press [ENTER] to make the schedule sets field available, as shown in[...]

193 BCM50a Integrated Router Configuration — Advanced Appendix A Setting up your computer IP address All computers must have a 10M or 10 0M Ethernet adapter card and TCP/IP installed. Windows 95/98/Me/NT/2 000/XP, and Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software comp onents you need to install and[...]

194 Appendix A Setting up your computer IP address N0115791 Figure 97 WIndows 95/9 8/Me: networ k: configuration Installing components The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protoc ol and Client for Microsoft Networks. If you need the adapter: a In the Network window, cli[...]

Appendix A Setting up your computer IP ad dress 195 BCM50a In tegrated Rou ter Configur ation — Adva nced a Click Add . b Select Client and click Add . c Select Microsoft from the list of manufacturers. d Select Client for Microsoft Networks from the list of network clients and click OK . e Restart your computer so your changes take effect. Confi[...]

196 Appendix A Setting up your computer IP address N0115791 — If you know your DNS in formation, select Enable DNS and type the information in the fields below (you do not need to fill them all in). Figure 99 Windows 95/98/Me: TCP/IP Properties: DNS configuration 4 Click the Gateway tab. — If you do not know your gateway’s IP address, remove [...]

Appendix A Setting up your computer IP ad dress 197 BCM50a In tegrated Rou ter Configur ation — Adva nced Windows 2000/NT/XP 1 For Windows XP, click Start , Control Panel . In Wind ows 2000/NT, click Start , Settings , Control Panel . Figure 100 Windows XP: Start menu 2 For Windows XP, click Network Conne ctions . For Windows 2000/NT, click Netwo[...]

198 Appendix A Setting up your computer IP address N0115791 3 Right-click Local Area Connection and then click Properties . Figure 102 Windows XP: Control Panel: Network Connections: Proper ties 4 Select Internet Protocol (TCP/IP) (under the Gene ral tab in Win XP) and click Properties . Figure 103 Windows XP: Local Area Conne ction Properties[...]

Appendix A Setting up your computer IP ad dress 199 BCM50a In tegrated Rou ter Configur ation — Adva nced 5 The Internet Protocol TCP/IP Properties window appears (the General tab in Windows XP). — If you have a dyna mic IP address, click Obtain an IP address automatically . — If you have a static IP address, click Use the following IP Addres[...]

200 Appendix A Setting up your computer IP address N0115791 —I n TCP/IP Gateway Address , type the IP address of the default gateway in Gateway . To manuall y configure a default metric (the number of transmission hops), clear the Automatic metric check box and type a metric in Metric . — Click Add . — Repeat the previous three steps for e ac[...]

Appendix A Setting up your computer IP ad dress 201 BCM50a In tegrated Rou ter Configur ation — Adva nced 10 Turn on your BCM50a Integ rated Router and restart yo ur computer (if prompted). Verifying Settings 1 Click Start , All Programs , Accessories and then Command Prompt . 2 In the Command Prompt window, type ip config and press [ENTER]. You [...]

202 Appendix A Setting up your computer IP address N0115791 2 Select Ethernet built-in from the Connect via list. Figure 107 Macintosh O S 8/9: TC P/IP 3 For dynamically assigned settings, select Using DHCP Server from the Configure: list. 4 For statically assigned settings, do the following: —F r o m t h e Configure box, select Manually . — Ty[...]

Appendix A Setting up your computer IP ad dress 203 BCM50a In tegrated Rou ter Configur ation — Adva nced Macintosh OS X 1 Click the Apple menu, and click System Pr eferences to open the System Preferences window. Figure 108 Macintosh O S X: Appl e menu 2 Click Network i n the icon bar. — Select Automatic from the Location list. — Select Buil[...]

204 Appendix A Setting up your computer IP address N0115791 4 For statically assigned settings, do the following: —F r o m t h e Configure box, select Manually . — Type your IP address in the IP Address box. — Type your su bnet mask in the Subnet mask box. — Type the IP address of your BCM 50a Integrated Route r in the Router address box. 5[...]

205 BCM50a Integrated Router Configuration — Advanced Appendix B Triangle Route The Ideal Setup When the firewall is on, your BCM50a Inte grated Router acts as a secure gateway between your LAN and the Inte rnet. In an ideal network topology, all incoming and outgoing network traffic passe s through the BCM50a Integrate d Router to protect your L[...]

206 Appendix B Triangle Route N0115791 1 A computer on the LAN initiates a conn ection by sending out a SYN packet to a receiving server on the WAN. 2 The BCM50a Integrated Router rerout es the SYN packet through Gateway B on the LAN to the WAN. 3 The reply from the WAN goes directly to the computer on the LAN without going through the BCM50 a Inte[...]

Appendix B Triangle Route 207 BCM50a In tegrated Rou ter Configur ation — Adva nced 2 The BCM50a Integrated Router reroutes the packet to Ga teway B, which is in Subnet 2. 3 The reply from WAN go es to the BCM50a Integrated Rou ter. 4 The BCM50a Integrated Router ends the response to the computer in Subnet 1. Figure 112 IP Alias BCM50a Integrated[...]

208 Appendix B Triangle Route N0115791[...]

209 BCM50a Integrated Router Configuration — Advanced Appendix C Importing certificates This appendix shows examples for importing certificates. Import BCM50a Integrated Router certificates into Netscape Navigator In Netscape Navigator, you can permanently trust the BCM50a Integrated Router server certificate by importing it into your operating s[...]

210 Appendix C Importing certificates N0115791 Importing the BCM50a Integrated Router Certificate into Internet Explorer For Internet Explorer to trust a self-sig ned certificate from the BCM50a Integrated Router, simply import the self-signed certif icate into your operating system as a trusted certification authority. To have Internet Explorer tr[...]

Appendix C Importing certificates 21 1 BCM50a In tegrated Rou ter Configur ation — Adva nced 2 Click Install Certificate to open the Install Certificate wizard. Figure 115 Certificate General Information befor e Import[...]

212 Appendix C Importing certificates N0115791 3 Click Next to begin the Install Certificate wizard. Figure 116 Certificate Import Wizard 1[...]

Appendix C Importing certificates 21 3 BCM50a In tegrated Rou ter Configur ation — Adva nced 4 Select where you want to store the certificate and click Next . Figure 117 Certificate Import Wizard 2[...]

214 Appendix C Importing certificates N0115791 5 Click Finish to complete the Import Certificate wizard. Figure 118 Certificate Import Wizard 3 6 Click Yes to add the BCM50a Integrated Router certificate to the root store. Figure 119 Root Certificate Store[...]

Appendix C Importing certificates 21 5 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 120 Certificate General Information afte r Import Enrolling and Importing SSL Client Certificates The SSL client needs a certificate if Authenticate C lient Certificates is selected on the BCM50a Integrated Router. You must have imported at least o[...]

216 Appendix C Importing certificates N0115791 Figure 121 BCM50a Integrated Router Trusted CA screen The CA sends yo u a package co ntaining the CA’s trusted certificates, your personal certificates and a password to install the personal certificates.[...]

Appendix C Importing certificates 21 7 BCM50a In tegrated Rou ter Configur ation — Adva nced Installing the CA’s certificate 1 Double click the CA’s trusted certificate to produce a screen similar to the one shown in Figure 122 . Figure 122 CA certificate example 2 Click Install Certificate and follow the wizard as shown earlier in this appen[...]

218 Appendix C Importing certificates N0115791 1 Click Next to begin the wizard. Figure 123 Personal certificate import wizard 1[...]

Appendix C Importing certificates 21 9 BCM50a In tegrated Rou ter Configur ation — Adva nced 2 The file name and path of the certif icate you double-clicked automatically appears in the File name text box. Click Browse if you wish to import a different certificate. Figure 124 Personal certificate import wizard 2[...]

220 Appendix C Importing certificates N0115791 3 Enter the password give n to you by the CA. Figure 125 Personal certificate import wizard 3[...]

Appendix C Importing certificates 22 1 BCM50a In tegrated Rou ter Configur ation — Adva nced 4 Have the wizard determine where the ce rtificate should be saved on your computer or select Place all certificates in the following store and choose a different location. Figure 126 Personal certificate import wizard 4[...]

222 Appendix C Importing certificates N0115791 5 Click Finish to complete the wizard and begin the import process. Figure 127 Personal certificate import wizard 5 6 Figure 128 shows the screen that appears wh en the certificate is correctly installed on your co mputer. Figure 128 Personal certificate import wizard 6[...]

Appendix C Importing certificates 22 3 BCM50a In tegrated Rou ter Configur ation — Adva nced Using a certificate wh en accessing the BCM50a Integrated Router example Use the following procedure to access th e BCM50a Integrated Router via HTTPS. 1 Enter https://BCM50a Integrated Router IP Address/ in your browser’s web address field. Figure 129 [...]

224 Appendix C Importing certificates N0115791 3 The BCM50a Integrated Router login screen appears. Figure 131 BCM50a Integrated Router secure login screen[...]

225 BCM50a Integrated Router Configuration — Advanced Appendix D PPPoE PPPoE in action An ADSL modem bridges a PPP session over Ethernet (PPP over Ethernet, RFC 2516) from your PC to an ATM PVC (Permanent Virtual Circuit), which connects to a DSL Access Concentrator where the PPP session terminates (see Figure 132 ). One PVC can support any numbe[...]

226 Appendix D PPPoE N0115791 Figure 132 Single-PC per router har dware configuration How PPPoE works The PPPoE driver makes the Ethernet appear as a serial link to the PC and the PC runs PPP over the Ethernet, while the m odem bridges the Ethernet frames to the Access Concentrator (AC). Between the AC and an ISP, the AC acts as an L2TP (Layer 2 Tu[...]

Appendix D PPPoE 227 BCM50a In tegrated Rou ter Configur ation — Adva nced Figure 133 BCM50a Integrated Ro uter as a PPPoE Client BCM50a Integrated Router BCM50a Integrated Router[...]

228 Appendix D PPPoE N0115791[...]

229 BCM50a Integrated Router Configuration — Advanced Appendix E Hardware specifications Cable pin assignments Figure 134 Ethernet cable pin assign ments Table 42 General specifications Power Specification I/P AC 100~240V 50/6 0Hz; O/P DC 18V 1.1A MTBF 266997 hrs (Mean T ime Between Failu res) Operation Temperature 0º C ~ 40º C ADSL Specificati[...]

230 Appendix E Hardware specifications N0115791[...]

231 BCM50a Integrated Router Configuration — Advanced Appendix F IP subnetting IP addressing Routers route based on the network numb er. The router that delivers the data packet to th e correct dest in ation host uses the host ID. IP classes An IP address is made up of four octets (eight bits), written in dotted decimal notation, for example, 192[...]

232 Appendix F IP subnetting N0115791 Therefore: A class C network (8 host bits) can have 2 8 –2 or 254 hosts. A class B address (16 host bits) can have 2 16 –2 or 65 534 h osts. A class A address (24 host bits) can have 2 24 –2 hosts (approximately 16 million hosts). Since the first octet of a class A IP address must contain a 0, the first o[...]

Appendix F IP subnetting 233 BCM50a In tegrated Rou ter Configur ation — Adva nced Subnet masks A subnet mask is used to determine which bits are pa rt of the network number, and which bits are part of the host ID (u sing a logical AND operation). A subnet mask contains 32 bits. If there is a 1 in th e bit, then the corresponding bit of the IP ad[...]

234 Appendix F IP subnetting N0115791 Table 46 shows all possible subnet masks for a class C address using both notations. The first mask shown is the class C natural mask. Normally, if no mask is specified, it is understood that the natural mask is being used. Example: two subnets As an example, you have a class C ad dress 192.168.1.0 with subnet [...]

Appendix F IP subnetting 235 BCM50a In tegrated Rou ter Configur ation — Adva nced Divide the network 192.168 .1.0 into two separate subn ets by converting one o f the host ID bits of the IP address to a network number bit. The borrowed host ID bit can be either 0 or 1, thus gi ving two subnets; 192.168.1. 0 with mask 255.255.255 .128 and 192.16 [...]

236 Appendix F IP subnetting N0115791 192.168.1.0 with mask 255.255 .255.128 is the subnet itsel f, and 192.168.1. 127 with mask 255.255.255 .128 is the directed broadcast address for the first subnet. Therefore, the lowest IP address that can be assigned to a n actual host for the first subnet is 192.168.1.1 and the high est is 192.168.1.126. Simi[...]

Appendix F IP subnetting 237 BCM50a In tegrated Rou ter Configur ation — Adva nced Example: eight subnets Similarly, use a 27-bit mask to create 8 subnets (001, 010, 011, 100, 101, 110). Table 53 shows class C IP address last-octet values for each subnet. Table 51 Subnet 3 Network numbe r Last Octet Bit Value IP Address 192.168.1. 128 IP Address [...]

238 Appendix F IP subnetting N0115791 Table 54 is a summary for class C subnet planning. Subnetting with Class A and Class B networks. For class A and class B addresses the subne t mask also determ ines which bits are part of the network numb er and which are part of the host ID. A class B address has two host ID oct ets available for subnetting an[...]

Appendix F IP subnetting 239 BCM50a In tegrated Rou ter Configur ation — Adva nced 5 255.255.248.0 (/21) 32 20 4 6 6 255.255.252.0 (/22) 64 10 2 2 7 255.255.254.0 (/23) 128 510 8 255.255.255.0 (/24) 256 254 9 255.255.255.128 (/25) 512 126 10 255.255.255.192 (/26) 10 2 4 62 11 255.255.255.224 (/27) 2 048 30 12 255.255.255.240 (/28) 40 9 6 14 13 25[...]

240 Appendix F IP subnetting N0115791[...]

241 BCM50a Integrated Router Configuration — Advanced Appendix G Command Interpreter The following describes ho w to use the comm and interpreter. Ente r 24 in the main menu to bring up the system mainte nance menu. Enter 8 to go to Menu 24.8 - Command Interpreter Mode . See the included disk or www.nortel.com for more detailed informatio n on th[...]

242 Appendix G Command Interpreter N0115791 Sys commands Table 56 lists and describes the system commands. Each of these commands must be preceded by sys . For example, type sys stdio 60 to set the management session inactivity timeout to 60 minutes. Table 56 Sys commands Command Descrip tion atsh Displays the MRD field. callhist display Displays t[...]

Appendix G Command Interprete r 243 BCM50a In tegrated Rou ter Configur ation — Adva nced logs category 8021x Records logs for IEEE 802.1X. access [0:none/1:log/ 2:alert/3:both] Records, sends alerts, or both for access control logs. attack [0:none/1:log/ 2:alert/3:both] Records, sends alerts, or both for firewall attack logs. cdr [0:none/1:log] [...]

244 Appendix G Command Interpreter N0115791 disp Displays the error log. online Turns the error log online display on or off. load Loads the log settin gs buffer. Use this command before you configure the log settings. Use sys logs save after you configure the log settings. mail alertAddr [mail address] Sends alerts to this e-mail address. clearLog[...]

Appendix G Command Interprete r 245 BCM50a In tegrated Rou ter Configur ation — Adva nced display Displays the syslog settings. facility [Local ID(1-7)] Specifies the file to which the device logs the syslog messages. server [domainName/IP] Specifies the IP address of the syslog server the syslogs are sent. consolidate switch <0:on|1:off> T[...]

246 Appendix G Command Interpreter N0115791 igmp Sets the IGMP session idle timeout value. tcpsyn Sets the SYN TCP session idle timeout value. tcp Sets the TCP session idle timeout value. tcpfin Sets the TCP FIN session idle timeout value. udp Sets the UDP-session idle-timeout value. gre Sets the GRE-session idle-timeout value. esp Sets the ESP-ses[...]

Appendix G Command Interprete r 247 BCM50a In tegrated Rou ter Configur ation — Adva nced trcpacket Uses trace packets to capture parts of packets in o rder to see the packet flow from one interface to another. create <entry> <size> Creates a packet trace buffer. destroy Removes the packet trace buffer. channel <name> [none|inco[...]

248 Appendix G Command Interpreter N0115791 romreset Restores the factory default configuration file. server Use these commands to configure remote server mana gement. access <telnet|ftp|web|icmp|snmp| dns> <value> Sets the server access type. load Loads server information. disp Displays server information. port <telnet|ftp|web|snmp&[...]

Appendix G Command Interprete r 249 BCM50a In tegrated Rou ter Configur ation — Adva nced Exit Command Ethernet Commands Table 58 lists and describes the Ethernet commands. Each of these commands must be preceded by ether . For example, type ether config to display information on the LAN configuration. disp Displays the current NetBIOS filter mod[...]

250 Appendix G Command Interpreter N0115791 IP commands Table 59 lists and describes the IP commands . Each of these commands must be preceded by ip . For example, type ip address to display the host IP address. disp <name> Displays the Ethernet driver counters. status <ch_name> Shows the LAN status. version Displays the Ethernet device[...]

Appendix G Command Interprete r 251 BCM50a In tegrated Rou ter Configur ation — Adva nced status <iface> Displays an i nterface’s IP Address Resolution Protocol status. attpret <on|off> Allows or disallow s the device to receive ARP from a different networ k or not. force <on|off> Enables or disables th e ARP timeout function.[...]

252 Appendix G Command Interpreter N0115791 ifconfig [iface] [ipaddr] [broadcast <addr> |mtu <value>|dynamic] Configures a network interface. ping <hostid> Pings a remote host. route status [if] Displays the routing table . add <dest_addr|defaul t>[/<bits>] <gateway> [<metric>] Adds a route. addiface <de[...]

Appendix G Command Interprete r 253 BCM50a In tegrated Rou ter Configur ation — Adva nced <iface> in [mode] Sets the BCM50a Integrated Router to use the RIP information it receives. <iface> out [mode] Sets the BCM50a Integrated Router to broadcast its routing table. dialin_user [show|in|out|both |none] Shows the dial-in user RIP direc[...]

254 Appendix G Command Interpreter N0115791 actionFlags [act(1-7)] [enable/disable] Sets the content fi ltering custom ize action flags. logFlags [type(1-3)][enabl e/disable] Sets the content filtering customi ze log flags. add [string] [trust/untrust/ keyword] Adds a trusted Web site, forbidden Web site or keyword blocking string. delete [string] [...]

Appendix G Command Interprete r 255 BCM50a In tegrated Rou ter Configur ation — Adva nced srv Records the most heavily use d protocols or service ports. stroute display [rule # | buf] Displays the list of static routes or detailed information on a specified rule. load <rule #> Loads the specified static route rule into the buffer. save Save[...]

256 Appendix G Command Interpreter N0115791 <iface> leave <group> Removes an interface from a group. <iface> query Send s an IGMP query on the specified interface. <iface> rsptime [time] Sets the IGMP response time. <iface> start Turns on IGMP on the specified inter face. <iface> stop Turns off IGMP on the sp eci[...]

Appendix G Command Interprete r 257 BCM50a In tegrated Rou ter Configur ation — Adva nced IPSec commands Table 60 lists and describes the IP Sec commands. Each of these commands must be preceded by ipsec . For example, type ipsec display 3 to display the third IPSec rule, if you have it configured. Table 60 IPSec commands Command Description debu[...]

258 Appendix G Command Interpreter N0115791 chk_input <0~255> Adjusts autotimer to check if any inbound IPsec traffic has passed during the specified period. If not, the BCM5 0a Integrated Router di sconnects the tunne l. show_runtime sa Displays runtime phase 1 and phase 2 SA information. spd When a dynami c rule accepts a request and a tunn[...]

Appendix G Command Interprete r 259 BCM50a In tegrated Rou ter Configur ation — Adva nced lcIdType <0:IP | 1:DNS | 2:Email> Sets the local ID type. lcIdContent <content> Sets the local ID cont ent. myIpAddr <IP address> Sets the My IP Address. peerIdType <0:IP | 1:DNS | 2:Email> Sets the peer ID type. peerIdContent <con[...]

260 Appendix G Command Interpreter N0115791 encap <0:Tunnel | 1:Transport> Sets the encapsulation mode . pfs <0:None | 1:DH1 | 2:DH2> Sets Perfect Forward Secrecy. antiReplay <Yes | No> Turns replay detection on or off. connType <0:Branch Office | 1:Contivity Client> Specifies whether the ru le is for a branch office or Cont[...]

Appendix G Command Interprete r 261 BCM50a In tegrated Rou ter Configur ation — Adva nced ikeDelete <rule index> Deletes the specif ied IPSec rule. policyEdit <rule index> Edits the specified IP p olicy. policySave Saves the IP policy. ipsecList Displays a summary of the IPSec (phase 2) rules. policyList Displays the IP policies. poli[...]

262 Appendix G Command Interpreter N0115791 btNatType <0:single | 1:range | 2:all> Sets the type of NAT address mapping. btNatAddrStart <IP address> Sets the branch tunnel NAT starting IP address. btNatArEnd <IP address> Sets the branch tunnel NAT end ing IP address or subnet ma sk. swSkipOverlapIP <on|off> Turn this option [...]

Appendix G Command Interprete r 263 BCM50a In tegrated Rou ter Configur ation — Adva nced clientTerm load Loads client termination configuration from ROM to working buffer, you must execute this command before configuring client termination. active <yes | no> Enables or disables client termination. display [user | cfg] Displays configura ti[...]

264 Appendix G Command Interpreter N0115791 ipPool <index> Select which IP pool, index is b ased on 1, and inactive IP pool cannot be selected. ipPool load <index> Before you configure an IP pool for client termination, you must load the specified IP pool. Currently 3 IP pools are supported, so the valid index is: 1~3 save After changin[...]

Appendix G Command Interprete r 265 BCM50a In tegrated Rou ter Configur ation — Adva nced rekeyTo <hh:mm:ss> Sets the lifetime of a single key used for data encryption. rekeyDc Sets how much data you expect to transmit via the tunnel with a single key. A setting of 0 kb disables the Rekey D ata Count, rekey data count must be more than 5. d[...]

266 Appendix G Command Interpreter N0115791 WAN Commands The following chart lists and describes the wan commands. Each of these commands must be preceded by wan when you use them. Table 61 WAN Commands Command Description wan adsl bert Displays ADSL ber. cellcnt Displays the ADSL cell counter. chandata Displays the ADSL operational mode (standard)[...]

Appendix G Command Interprete r 267 BCM50a In tegrated Rou ter Configur ation — Adva nced Add <remoteNodeI ndex> <vpi> <vci> Adds an entry to the hunting pool. <remote node> : input the remote node index 1-8 <vpi> : vpi val ue <vci> : vci value Need to save a fter this command. Remove <removeNodeI d> <[...]

268 Appendix G Command Interpreter N0115791 Sys firewall commands Table 62 lists and describes the system firewall commands. Each of these commands must be preceded by sys firewall . For examp le, type sys firewall active yes to turn on the firewall. Table 62 Sys firewall commands Command Descrip tion acl disp Displays ACLs or a specific ACL set # [...]

Appendix G Command Interprete r 269 BCM50a In tegrated Rou ter Configur ation — Adva nced Bandwidth management commands Table 63 lists and describes the bandwidth management commands. Each of these commands must be preceded by bm . For example, type bm show lan to display the LAN port’s bandwidt h management settings. Table 63 Bandwidth managem[...]

270 Appendix G Command Interpreter N0115791 <borrow on|off> The class can borrow bandwidth from its pare nt class when borrowing is turned on, and vice versa. del # Deletes the class # and its filter and all i ts children classes and their filters in LAN. mod # <bandwidth xxx> Modifies the parameters of the class in the LAN. A bandwidth[...]

Appendix G Command Interprete r 271 BCM50a In tegrated Rou ter Configur ation — Adva nced <borrow on|off> The class can borrow bandwidth from its pare nt class when borrowing is turned on, and vice versa. filter lan add # Daddr <mask Dmask> Dport Saddr <mask Smask> Sport protocol Adds a filter for class # in LAN. The filter cont[...]

272 Appendix G Command Interpreter N0115791 Certificates commands Table 64 describes the certific ate commands. Each of these commands mus t be preceded by certificates (or cert for short). For example, type cert my_cert list to display all of your certific ate names and basic information. All of these commands start with certificates . monitor lan[...]

Appendix G Command Interprete r 273 BCM50a In tegrated Rou ter Configur ation — Adva nced create selfsigned <name> <subject> [key size] Creates a self-signed lo cal host certificate. <name> specifies a descriptive name for the generated certificate. <subject> specifies a subject name (required) and alternative name (requir[...]

274 Appendix G Command Interpreter N0115791 create cmp_enroll <name> <CA addr> <CA cert> <auth key> <subject> [key size] Creates a certificate re quest and enrolls for a certificate immediately online using CMP protocol. <name> specifies a descriptive name for the enrolled certificate. <CA addr> specifies t[...]

Appendix G Command Interprete r 275 BCM50a In tegrated Rou ter Configur ation — Adva nced rename <old name> <new name> Renames the specified certificate. <old name> specifies the nam e of the c ertificat e to be renamed. <new name> specifies the new na me the certificate is saved as. def_self_sign ed [name] Sets the specif[...]

276 Appendix G Command Interpreter N0115791 crl_issuer <name> [on|off] Specifies whether or not the specified CA issues CRL. <name> specifies the name of the CA certificate. [on|off] specifies whether or not the CA issues CRL. If [on|off] is not specifie d, the current cr l_issuer status of the CA is u sed. remote_trusted import <nam[...]

Appendix G Command Interprete r 277 BCM50a In tegrated Rou ter Configur ation — Adva nced add <name> <addr[:port]> [login:pswd] Adds a new directory service. <name> specifies a descriptive name for the directory server. <addr[:port]> specifies the serve r address (required) and port (optional). The format is "server-a[...]

278 Appendix G Command Interpreter N0115791[...]

279 BCM50a Integrated Router Configuration — Advanced Appendix H NetBIOS filter commands The following describes the Ne tBIOS packet filter commands. Introduction NetBIOS (Network Basic Input/Output Sy stem) are TCP or UDP packets that enable a computer to connect to and communicate with a LAN. For some dial-up services, such as PPP oE or PPPoA, [...]

280 Appendix H NetBIOS filter commands N0115791 Display NetBIOS filter settings Figure 135 NetBIOS Display Filter Se ttings Command Example Syntax: sys filter netbios disp This command gives a read-only list of the current NetBIOS filter modes. The filter types and their defa ult settings are as follows: NetBIOS filter configuration Syntax: sys fil[...]

Appendix H NetBIOS filter command s 281 BCM50a In tegrated Rou ter Configur ation — Adva nced • 0 = LAN to WAN and WAN to LAN • 3 = IPSec packet pass through <on|off> is a switch to enable or disable the filter. • For type 0, use on to enable the filter and block Net BIOS packets. Use off to disable the filter and forward NetBIOS pack[...]

282 BCM50a Integrated Router Configuration — Advanced Appendix I Enhanced DHCP option commands The following describes the DHCP option commands. Enhanced DHCP option commands introduction The enhanced DHCP feature allows you to use DHCP option commands to add site-specific options to the DHCP server’s offer messages. Specifying the Nortel BCM50[...]

Appendix I Enhanced DHCP option command s 283 BCM50a In tegrated Rou ter Configur ation — Adva nced The following exa mple sets the BCM50a Integrated Router to assign an IP address of 11.12.13.10 to the Nortel BCM50. ip dhcp <interface> server m50ipreserve ip 11.12.13.10 Nortel BCM50 DHCP server options Use these commands to add site-specif[...]

284 Appendix I Enhanced DHCP option commands N0115791 Use this command to configure the Nortel BCM50 DHCP server’s settings. BCM50 IP sets override setting Syntax: ip dhcp <interface> server overrideipsetinfo [0|1] [0:disable | 1:IP phones only | 2:All devices | 3:automatic] This is the Nortel BCM50 DHCP server setting. “0” disables the[...]

Appendix I Enhanced DHCP option command s 285 BCM50a In tegrated Rou ter Configur ation — Adva nced where: Use this command to set the Nortel BCM50 DHCP to assign VoIP server and VLAN settings to Nortel’s IP Tele phone 2004. You must also c onfigure the VoIP server and VLAN settings assignment, see the “ Nortel i2004 IP phone op tions section[...]

286 Appendix I Enhanced DHCP option commands N0115791 Use this command to assign VoIP server inform ation to Nortel’s i2004 VoIP telephon es. This command sets DHCP option 128. The following example co mmands set the BCM50a Integrated Router to assign information for two VoIP serv ers. The first command sets it to assign the first VoIP server’s[...]

Appendix I Enhanced DHCP option command s 287 BCM50a In tegrated Rou ter Configur ation — Adva nced This command sets DHCP option 191. The following exa mple sets the BCM50a Integrated Router to assign a VLAN ID of five to VoIP telephones. ip dhcp enif0 server vlanid 5 Nortel WLAN handsets 2210 & 2211 phone options Nortel's WLAN Handsets[...]

288 Appendix I Enhanced DHCP option commands N0115791 WLAN IP Telephony Manage r IP Address Assignment Syntax: ip dhcp <interface> server wlantelmanager [none |<serverIP>] where: Use this command to assign a WLAN Telephony Man ager 2245 IP address to WL AN Handsets 2210 & 2211. This command sets DHCP option 151. The following exampl[...]

289 BCM50a Integrated Router Configuration — Advanced Appendix J Log descriptions This appendix provides descript ions of log messages. Table 66 System error logs Log Message Description %s exceeds the max. number of session per host! This attempt to create a SUA/NAT session exceeds the maximum number of SUA/NAT session table entries allowed to b[...]

290 Appendix J Log descriptions N0115791 TELNET Login Fail Someon e has failed to log on to the router via Telnet. FTP Login Successfully Someone has log ged on to the router via FTP. FTP Login Fail Someone has failed to log on to the router via FTP. NAT Session Table is Full! The maximum n umber of SUA/NAT session ta ble entries has been exceeded [...]

Appendix J Log descriptions 291 BCM50a In tegrated Rou ter Configur ation — Adva nced Table 70 Attack logs Log Message Description attack TCP The firewall detecte d a TCP attack. attack UDP The firewall detecte d an UDP attack. attack IGMP The firewall detected an IGMP attack. attack ESP The firewall detected an ESP attack. attack GRE The firewal[...]

292 Appendix J Log descriptions N0115791 See Table 73 for type and code details. teardrop TCP The firewall detecte d a TCP teardrop attack. teardrop UDP The firewall detecte d an UDP teardrop attack. teardrop ICMP (type:%d, code:%d) The firewall detecte d an ICMP teardrop attack. illegal command TCP The fi rewall detected a TCP illegal command atta[...]

Appendix J Log descriptions 293 BCM50a In tegrated Rou ter Configur ation — Adva nced Table 71 Access logs Log Message Description Firewall default policy: TCP (set:%d) TCP access matched the default policy of the li sted ACL set and the BCM50a Integrat ed Router blocked or forwarded it according to the ACL se t’s configuration. Firewall defaul[...]

294 Appendix J Log descriptions N0115791 Firewall rule match: GRE (set:%d, rule:%d) GRE access matched the listed firewall rule and the BCM50a Integrated Router blocke d or forwarded it according to the rule’s configuration. Firewall rule match: OSPF (set:%d, rule:%d) OSPF access matched the liste d a firewall rule a nd the BCM50a Integrated Rout[...]

Appendix J Log descriptions 295 BCM50a In tegrated Rou ter Configur ation — Adva nced See Table 73 for type and code details. (set:%d) With firewall messages, this i s the number of the ACL policy set and denotes the packet's direction (see Table 72 ). With filter messages, this is the number of the filter set. (rule:%d) With firewall messag[...]

296 Appendix J Log descriptions N0115791 Table 72 ACL setting notes ACL Set Number Direction Description 1 LAN to WAN ACL set 1 for packets traveling from the LAN to the WAN. 2 WAN to LAN ACL set 2 for packets traveling from the WAN to the LAN. 7 LAN to LAN/BCM50a Integrated Router ACL set 7 for packets traveling from t he LAN to the LAN o r the BC[...]

Appendix J Log descriptions 297 BCM50a In tegrated Rou ter Configur ation — Adva nced VPN/IPSec logs To view the IPSec and IKE connection log, type 3 in menu 27 and press [ENTER] to display the IPSec log as shown next. Figure 136 shows a typical log from the initiator of a VPN connection. 0 Echo message 11 Time Exceeded 0 Time to live e xceeded i[...]

298 Appendix J Log descriptions N0115791 Figure 136 Example VPN initiator IPSec log Index: Date/Time: Log: ------------------------------------------------------------ 001 01 Jan 08:02:22 Send Main Mode request to <192.168.100.101> 002 01 Jan 08:02:22 Send:<SA> 003 01 Jan 08:02:22 Recv:<SA> 004 01 Jan 08:02:24 Send:<KE><N[...]

Appendix J Log descriptions 299 BCM50a In tegrated Rou ter Configur ation — Adva nced VPN responder IPSec log Figure 137 shows a typical log from the VPN connection peer. Figure 137 Example VPN respon der IPSec log This menu is useful for troubleshooting. A log index number, the date and time the log was created, and a log me ssage are displayed.[...]

300 Appendix J Log descriptions N0115791 Table 75 Sample IKE key exchange lo gs Log Message Description Send <Symbol> Mode request to <IP>Send <Symbol> Mode request to <IP> The BCM50a Integrated Router has started negotiation with the peer. Recv <Symbol> Mode request from <IP>Recv <Symbol> Mode request from[...]

Appendix J Log descriptions 301 BCM50a In tegrated Rou ter Configur ation — Adva nced !! Active connection allowed exceeded The BCM50a Integrated Router limits the nu mber of simultaneous Phase 2 SA negotiations. The IKE key exchange process fails if this limit is exceeded. !! IKE Packet Retransmit The BCM50a Integrated Ro uter did not receive a [...]

302 Appendix J Log descriptions N0115791 Table 76 shows sample log messages during packet transmissio n. Table 77 shows RFC-24 08 ISAKMP payload types that the log displays. Refer to the RFC for detailed in f ormation on each type. Table 76 Sample IPSec logs durin g packet transmission LOG MESSAGE DESCRIPTION !! WAN IP changed to <IP> If the [...]

Appendix J Log descriptions 303 BCM50a In tegrated Rou ter Configur ation — Adva nced CER Certificate CER_REQ Certificate Request HASH Hash SIG Signature NONCE Nonce NOTFY Notification DEL Delete VID Vendor ID Table 78 PKI l ogs Log Message Description Enrollment successful The SCEP on line certif icate enrol lment was su ccessful. The Destinatio[...]

304 Appendix J Log descriptions N0115791 Rcvd ARL <size>: <issuer name> The router received an ARL (Authority Revocation List), with size and issuer name as recorded, from the LDAP server whose address an d port are recorded in the Source field. Failed to decode the received ca cert The router received a corrupted certifi cation authori[...]

Appendix J Log descriptions 305 BCM50a In tegrated Rou ter Configur ation — Adva nced Log commands Go to the command inte rpreter interface (see Appendix G, “Command Interpreter” on page 241 for information on how to access and use the commands). 9 Certificate decoding failed. 10 Certificate was not found (anywhere). 11 Certificate chain loop[...]

306 Appendix J Log descriptions N0115791 Configuring what you want th e BCM50a Integrated Router to log Use the sys logs load comm and to load the log setting buffer that is used to configure which logs the BCM50a In tegrated Router is to record. Use sys logs category followed by a log ca tegory and a parameter to decide what to record. Use the sys[...]

Appendix J Log descriptions 307 BCM50a In tegrated Rou ter Configur ation — Adva nced Use the sys logs display [log category] comm and to show the logs in an individual BCM50a Integrated Router log c ategory. Use the sys logs clear command to erase all of the BCM50a Integrated Router’s logs. Log command example This example shows how to set the[...]

308 Appendix J Log descriptions N0115791[...]

309 BCM50a Integrated Router Configuration — Advanced Appendix K Brute force password guessing protection Table 81 describes the commands for enablin g, disabling and con figuring the brute force password guessing prot ection mechanism for the password. Example sys pwderrtm 5 This command sets the password protectio n to block all access attempts[...]

310 Appendix K Brute force password guessing protection N0115791[...]

BCM50a Integrated Router Configuration — Advanced 311 Index Numbers 4-Port Switch 31 A ADSL standards 30 Alternative Subnet Mask Notation 234 Applications 37 AT command 55, 162 ATM Options 79 Authentication 69, 73 Authentication Protocol 69 Autonegotiating 10/100 Mb/s Ethernet LAN 32 Autosensing 10/100 Mb/s Ethernet LAN 32 B Backup 162 Brute Forc[...]

312 Index N0115791 E-mail Address 49 Enable Wildcard 50 Encapsulation 66, 71 encapsulation 31 Entering Information 41 Ethernet Encapsulation 78 F F/W Version 162 Features 29 Filename Conven tions 161 Filter 77 Applying 134 Configuration 117 Configuring 120 Example 130 Generic Filter Rule 128 Generic Rule 129 NAT 133 Remote Node 135 Structure 118 TC[...]

Index 313 BCM50a In tegrated Rou ter Configur ation — Adva nced L LAN 148 LAN Port Filter Setup 57 LAN Setup 57, 58 LAN-to-LAN application 71 Link type 147 LLC 79 LLC-based Multiplexing 79 Log 151 Log Facility 153 Logging 36 Logging In to the SMT 39 Login Screen 39, 40 M Main Menu 41 Mean Time Between Failures 229 Metric 76, 85 MTBF 229 Multicast[...]

314 Index N0115791 Required fields 41 Reset Button 32 Resetting the Time 184 Restore Configuration 167 RFC-1483 72 RFC-2364 71 RIP 61, 63, 76 Direction 63 Version 63 S Schedule Sets Duration 191 Server 92, 95, 98, 99 , 105, 106, 182 setup a schedule 190 SMT 40 SNMP 35 Community 138 Configuration 137 Trusted Host 138 SNMP (Simple Network Management [...]

Index 315 BCM50a In tegrated Rou ter Configur ation — Adva nced W WAN DHCP 158, 159 WAN Setup 53, 54 WebGUI 116 www.dyndns.org 50[...]