Patton electronic 2800 manuale d’uso

OnSite 2800 Series Managed VPN Router User Manual Sales Office: +1 (301) 97 5-1000 Techni cal Su ppor t: +1 (301) 97 5-1007 E-mail: suppor t@patton.com WWW: www .patton.com Part Number: 07M2800-GS, Rev . F Revised : February 22, 2012 Impor tant This is a Class A de vice and is intended for use in a light ind ustrial environment. It is not intended [...]

Patton Electronics Company , Inc. 7622 Ric kenbacker Drive Gaithersburg , MD 20879 USA Tel: +1 (301 ) 975- 1000 Fax: +1 ( 301) 8 69-929 3 Support: +1 (30 1) 975 -1007 URL: www.patton.com E-Mai l: suppo rt@patton.com T rademark Statement The term OnSite is a trad emark of Patto n Electro nics Com pany. Al l other t radema rks presented in this docum[...]

3 Summar y T able of Contents 1 General information ..... ...... ..... ...... ...... ......... ...... ..... ...... ......... ...... ...... ..... ...... ......... ...... ..... ...... ......... ...... ...... . 17 2 Hardware installa tion ... ...... ..... ...... ...... ......... ...... ..... ...... ......... ...... ...... ..... ...... ......... ......[...]

4 T able of Contents Summary Table of Contents ...... ...... ...... ...... ........ ...... ...... ...... ...... ........ ...... ...... ...... ......... ..... ...... ...... ...... ......... 3 Table of Contents .. ...... ......... ..... ...... ...... ...... ........ ...... ...... ...... ......... ..... ...... ...... ...... ......... ..... ...... ....[...]

5 OnSite 2800 Series User Manual Table of Con tents Installin g the T1/E1 twisted pai r cables ........ ........... ............ ........... ................. ........... ........... ............ . 34 Insta lling t he E1 du al coax ial cabl es .................... ........... ........... ............ ........... ................. ........... ......[...]

6 OnSite 2800 Series User Manual Table of Con tents Configuring Chan nel-Grou p Timeslots ... ................. ........... ............ ........... ................. ........... ........... ............ . 63 Confi guring Channe l-Gro up Enca psulati on ............. ........... ............ ........... ................. ........... ........... ...[...]

7 OnSite 2800 Series User Manual Table of Con tents Addin g an IC MP fil ter rule to the current acces s contro l list profile ...... ................. ........... ............ ........... .......85 Addin g a TCP , UDP or SCTP fi lter rule to th e curre nt ac cess con trol l ist pro file ................... ........... .............87 Bind ing and [...]

8 OnSite 2800 Series User Manual Table of Con tents Status LEDs ............. ........... ........... ........... ................. ............ ........... ........... ............ ................ .. .......... ........... .....113 10 Contacting Patton for assista nce ............... ...... ..... ...... ...... ......... ...... ..... ...... ......[...]

9 OnSite 2800 Series User Manual Table of Con tents Ethernet 10Base-T an d 100 Base-T ........... ............ ........... ................. ........... ............ ........... ........... ................. .....126 D Port pin-outs ...... ...... ......... ..... ...... ...... ......... ...... ..... ...... ...... ......... ...... ..... ...... ......[...]

10 List of Fi gures 1 OnSite Managed VPN Router (2 805 shown) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 2 OnSite 2800 Seri es X.21, an d V.35 connectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 3 OnSite 2800 Seri es 10Base-T Ether [...]

11 List of T ables 1 General conven tions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 2 Rear panel ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 3[...]

12 About this guide This guid e desc ribes OnS ite VPN r outer hardwar e, instal lation, and config uration. Audien ce This guid e is intended f or the followi ng user s: • Opera tors • Installers • Maintenance technicians Struct ure This guid e contai ns the foll owing c hapters and appendic es: • Chapte r 1 on page 17 provid es inf ormati[...]

13 OnSite 2800 Series User Manual About this guide Precau tions Notes, ca utions, and warnings, which have t he foll owing meani ngs, are us ed thro ughout th is guide to help yo u become aware of potential problems. Warnin gs are intended to prev ent safety hazards that co uld result in per- sona l inju ry. Cau ti on s are intended to pr event sit[...]

14 OnSite 2800 Series User Manual About this guide Safety when working wi th electricity The OnSite co ntains no user se rviceab le parts. The equ ipment shall be returned to P atton Electronics for repairs, or re paired by qualified se rvice per- sonne l. Openi ng the OnSite case wi ll voi d the w arranty . Mains V oltage : Do not ope n the ca se [...]

15 OnSite 2800 Series User Manual About this guide General observat ions • Clean the cas e with a soft slightly moist ant i-static cloth • Place the unit on a flat surfac e and ensure free air circul ation • Avoid exposing the unit to direct sunlight and other heat sources • Protec t the unit from moisture, vap ors, and corros ive liquid s [...]

16 OnSite 2800 Series User Manual About this guide T ypographic al conventions used in this document This section de scribes th e typographical con ventions and terms use d in this guide. Gener al conven tions The procedures d escribed in this manual use the following text conventions: Table 1 . Gene ral conve ntion s Convention Meaning Garamond bl[...]

17 Chapter 1 General i nformation Chapter cont ents OnSite Model 28 00 Ser ies overvi ew ....... ................. ............ ........... ........... ............ ................ ............ ........... .......18 OnSite 2800 Seri es detailed descrip tion ............ ............ ........... ........... ............ ................ ...........[...]

OnSite Model 2800 Series overview 18 OnSite 2800 Series User Manual 1 • Gen eral info rmation OnSite Model 2800 Series o vervi ew The OnSit e Model 2800 Seri es Managed VPN Ro uter (se e figur e 1 ) de livers secu re, o ptimized commun ica- tions acr oss unsecure d IP net works bet ween any ent erprise headquart ers and r emote of fices, home of [...]

OnSite Model 2800 Series overview 19 OnSite 2800 Series User Manual 1 • Gen eral info rmation • VPN tunneling for secure traversal of unsecured IP networks • IPSec payload encryption with authenti cation header (AH, specifi ed in RFC 2402) and encap sulating secu- rity p ayload ( ESP, spe cified in RFC 2 406) pr otects da t a integr ity and c[...]

OnSite Model 2800 Series overview 20 OnSite 2800 Series User Manual 1 • Gen eral info rmation Figure 3. OnSite 280 0 Series 10Base-T Etherne t port connectors Eth erne t WA N mo del s. T he followi ng models com e equipped wi th 10/100 Base-T Ethernet ports only (see figu re 3 ): • OnSite 2 802 —Dual 1 0/100Base-T Ethernet p orts, on e for LA[...]

OnSite Model 2800 Series overview 21 OnSite 2800 Series User Manual 1 • Gen eral info rmation Figure 4. OnSite 28 00 Series power input connector s Model code extensions A model-code extens ion indicates the type o f power supply the Router mo del provides. The model-code co n- ventions are: • UI stands f or internal 10 0–240V AC uni versal i[...]

OnSite Model 2800 Series overview 22 OnSite 2800 Series User Manual 1 • Gen eral info rmation Ports desc riptions The OnSit e 2800 Se ries r ear-panel por ts are d escrib ed in table 2 . Figure 5. OnSite 2800 Series front panels Table 2. Rear panel ports Port Location Descri ption 10/100 Ethernet ETH 0/0 (W AN) & ETH 0/1–0/4 (LAN) Rear pane[...]

Applications overview 23 OnSite 2800 Series User Manual 1 • Gen eral info rmation Note For LED d escription s, refer to c hapter 9, “LEDs status and monitor- ing” on page 11 2. Applications overview Patton’s OnSite managed VPN routers deliver the features you need for se cure, optimized c ommunication over non-secured IP networks. Combining[...]

Applications overview 24 OnSite 2800 Series User Manual 1 • Gen eral info rmation X.21 ser ial interfac es, or an Ethe rnet WAN in terface. For r emote site s where PPP service is av ailable, the 2800 Series also supports PPP network access over all the standard WAN interface options mentioned above. In this specific application, all traffi c bet[...]

Applications overview 25 OnSite 2800 Series User Manual 1 • Gen eral info rmation In figur e 7 , the blue p ipes represent V PN connecti ons for priv ate traffic within the corpor ate intranet, w hile the green pipe s represent the Inter net traffic. The red pipe is a Frame Relay PVC trans porting Internet traffic and private corpo rate traffic o[...]

26 Chapter 2 Hardware installation Chapter cont ents Planning the installation .......... ................ ............ ........... ........... ............ ................. ........... ........... ........... .............27 Installation check list ......... ................ ............ ........... ........... ............ ................. ....[...]

Plan ning t he instal lation 27 OnSite 2800 Series User Manual 2 • Hardware installation Planning th e installatio n Before you start the actual installation, we strongly recommend that you gather all the information you will need to in stall and setu p the devi ce. See table 3 for an examp le of what pre-i nstallment chec ks you might need to ca[...]

Plan ning t he instal lation 28 OnSite 2800 Series User Manual 2 • Hardware installation Inst allat ion c heck list The installa tion check list (see table 3 ) lists th e tasks fo r instal ling an OnSite 2800 Ser ies VPN Router . Make a copy of this che cklist and mark the entries as you comp lete each task. For each OnSite 2800 Series VP N Route[...]

Plan ning t he instal lation 29 OnSite 2800 Series User Manual 2 • Hardware installation Site log Patton recom mends that you maintain a site log to reco rd all actions relevant to the system, if you do not already keep such a log. Site log entries s hould include information such as li sted in table 4 . Netwo rk infor matio n When planning your [...]

Installing the VPN router 30 OnSite 2800 Series User Manual 2 • Hardware installation Location and mounting req uirements The OnSite VPN Router is intende d to be placed on a de sktop o r similar sturdy, flat surface t hat offe rs easy access to the cables. Al low sufficient space at the rear of the chassis for cab le connections. Additionally, y[...]

Installing the VPN router 31 OnSite 2800 Series User Manual 2 • Hardware installation connected to the OnSi te’s Ethern et ports (see tab le 5 for port pin-out listing) via a cable terminated with RJ-45 plug s. Note Pins not listed are not used. Figure 1. Connec ting an OnSite 2800 Series device to a hub Installing th e serial WAN cable The OnS[...]

Installing the VPN router 32 OnSite 2800 Series User Manual 2 • Hardware installation • E1 (Du al coaxial c onnectos )—Model 2 803, see se ction “Install ing the E1 dual coaxial c ables” on page 35 for det ails on i nstalling the coax ial cables Instal ling the V.3 5 interfa ce cabl e. The OnSite Mode l 2835 comes w ith a V.35 inte rface [...]

Installing the VPN router 33 OnSite 2800 Series User Manual 2 • Hardware installation The ro uter’s V.35 inte rface i s wired as a DTE. No DCE co nfigurat ion is possibl e. If you are d irect ly connect- ing the router’s V.35 interface to third-party equipmen t that cannot be configured as a DCE, you must use a tail-c ircui t cable. You can p[...]

Installing the VPN router 34 OnSite 2800 Series User Manual 2 • Hardware installation The sig nal pin- outs fo r the Mode l 2821 X.21 i nterface are sh own in table 6 . The the router ’s X.21 in terface is wire d as a DCE. No DTE config urati on is possi ble. The r outer ’s X.21 int er- face requires a cab le with a male DB-15 connec tor. Att[...]

Installing the VPN router 35 OnSite 2800 Series User Manual 2 • Hardware installation Note Pins not listed are not used. Installing the E1 dua l coaxial cabl es. If the PBX or swit ch connecti on provid es dual coax ial cables fo r the E1 connectio n, the trans mit cable fr om the PBX /switch c onnects to the RX coaxi al connect or. Simil arly, t[...]

Installing the VPN router 36 OnSite 2800 Series User Manual 2 • Hardware installation Connec ting to external po wer sourc e The VPN Router comes wi th one of the fo llowing pow er supply opti ons as best -suited to t he expected i nstalla- tion environment: • 120/140VAC in ternal po wer suppl y (de signated by t he model code e xtension UI ) ?[...]

Installing the VPN router 37 OnSite 2800 Series User Manual 2 • Hardware installation 3. Verify that the AC power cord included with your VPN Router is compat ible wi th local standards . If it is not, refer to chapt er 10, “Contacting Patton for assistance” on page 11 4 to find out ho w to replace it with a compatible power cord. 4. Connect [...]

38 Chapter 3 Getting star ted with th e OnSite Managed VPN Router Chapter cont ents Introd uction ................. ................. ........... ............ ........... ................. ........... ............ ........... ........... ........... ............ . 39 1. Confi gure IP add ress ........... ................ ............ ........... ..[...]

Introduction 39 OnSite 2800 Series User Manual 3 • Getting started w ith the OnSit e Managed VPN Router Intr oduction This chapter lead s you through the b asic steps to set up a new OnSite VPN Ro uter. Figure 9 show th e main steps fo r settin g up a new O nSite VP N Rout er. Figu re 9. S teps f or sett ing up a ne w OnSite VPN Rout er Link 100M[...]

1. Configure IP add ress 40 OnSite 2800 Series User Manual 3 • Getting started w ith the OnSit e Managed VPN Router 1. Configure IP address Power co nnection and default configur ation First the OnS ite VPN Router must be co nnected to the ma ins power supply with the power cable. W ait until the Run LED stops blinking and lights constant ly. Now[...]

1. Configure IP add ress 41 OnSite 2800 Series User Manual 3 • Getting started w ith the OnSit e Managed VPN Router • 1 stop bit • No flo w cont rol Login Access ing your OnSit e VPN Rout er via the local co nsole po rt (or vi a a Telnet session) causes th e login screen to display. Type the factor y default login: admin istrat or and leave t[...]

2. Connect the OnSite VPN Router to the network 42 OnSite 2800 Series User Manual 3 • Getting started w ith the OnSit e Managed VPN Router 2. Connect the OnSite VPN Router to the network Depending whether you connect the OnSite V PN Router to a host directly or vi a a hub or switch either straight- through wired or cr oss-over c ables mu st be us[...]

3. Load configurati on 43 OnSite 2800 Series User Manual 3 • Getting started w ith the OnSit e Managed VPN Router After the OnS ite VPN Router has b een rebooted the new start up configurat ion will be activated. 172.1 6.1.9 9(i f-ip)[ eth0]# reloa d Runni ng confi gur ation has been chang ed. Do yo u wan t t o copy the ' runni ng-config &ap[...]

44 Chapter 4 Serial por t configuration Chapter cont ents Introd ucti on ............................. ........... ........... ........... ............ ................. ........... ........... ........... ............ ........... .......45 Serial port config uration task list .................... ........... ............ ........... ........... ..[...]

Introduction 45 OnSite 2800 Series User Manual 4 • Seri al por t config uration Intr oduction This chapter p rovides an over view of the ser ial port and descr ibes t he task s involve d in it s configur ation through the OnSite router, it includes the follo wing sections: • Serial port configuration task li st • Configuratio n tasks • Exam[...]

Serial port configuration task list 46 OnSite 2800 Series User Manual 4 • Seri al por t config uration Note Use the no sh utdown command to enable the serial interface after the configuration procedure. This pr oced ure de scribes how to shut down a se rial i nterface Mode: Admi nistrator ex ecutio n Exampl e: Dis abling an interfac e The example[...]

Serial port configuration task list 47 OnSite 2800 Series User Manual 4 • Seri al por t config uration Exampl e: Enabli ng an interface The example show s how to enable the built-in serial inte rface on slot 0 and port 0 of an OnSite router. Check that State is set to OPENED i n the command output of show port serial . 2800(cfg)#port serial 0 0 2[...]

Serial port configuration task list 48 OnSite 2800 Series User Manual 4 • Seri al por t config uration Transmit Edge : normal Port Type : DTE CRC Type : CRC-16 Max Frame Length: 2048 Recv Threshold : 1 Encapsulation : framerelay Enter Frame Relay mode This sectio n describes h ow to configu re Frame Relay on the s erial interface of an O nSite ro[...]

Serial port configuration task list 49 OnSite 2800 Series User Manual 4 • Seri al por t config uration 2800(cfg)#port serial 0 0 2800(prt-ser)[0/0]#framerelay 2800(frm-rel)[0/0]#lmi-type ansi Configurin g the keep-ali ve interval A keep-alive interval must be set to c onfigure the L MI. By default, this interv al is 10 secon ds and, according to [...]

Serial port configuration task list 50 OnSite 2800 Series User Manual 4 • Seri al por t config uration Mode: Fra me R ela y Exampl e: Entering Frame Relay PVC configuration mode The follow ing example enters the c onfiguration mod e fo r PVC with the ass igned DLCI of 1 for Fr ame Relay over the serial interface on slot 0 and port 0 of an OnSite [...]

Serial port configuration task list 51 OnSite 2800 Series User Manual 4 • Seri al por t config uration Frame Relay PVC. If serial Fram e Relay PVC shall be us ed as WAN access, a suitable name for the logical IP inte rface coul d be wan as in figur e 12 below. Figure 12. IP interface wan i s bound to PVC 1 on port serial 0 0 This procedure descri[...]

Serial port configuration task list 52 OnSite 2800 Series User Manual 4 • Seri al por t config uration Enabling a Fr ame Relay PVC After bindi ng Framerelay P VC to an ip inter face it must b e enabled fo r packet pro cessing. This pr ocedure acti- vates the PV C by opening the bound ip interface. This proce dure descri bes how to enab le Framere[...]

Serial port configuration task list 53 OnSite 2800 Series User Manual 4 • Seri al por t config uration 2800(frm-rel)[0/0]#pvc 1 2800(pvc)[1]#shutdown Check the PV C 1 status by us ing show runn ing- confi g and verify that the entry shutdo wn occurs in the con- figura tion part res ponsible fo r this PVC. 2800(pvc)[1]#show running-config Running [...]

Serial port configuration task list 54 OnSite 2800 Series User Manual 4 • Seri al por t config uration Displ aying Frame Relay info rmation Since Frame Relay configuration for the serial interface is c omplex and req uires many commands , it is help ful to list the frame relay configuration on screen. This proc edu re d escri bes how t o dis pla [...]

Serial port configuration task list 55 OnSite 2800 Series User Manual 4 • Seri al por t config uration Figure 13. Typical Integrated Service Access Scenario with dedicated PVCs Integrated service access The ex ampl e in figure 13 shows a typi cal integrated se rvice acces s scenario, wher e different se rvice provi ders are accessed via per manen[...]

Serial port configuration task list 56 OnSite 2800 Series User Manual 4 • Seri al por t config uration Figure 14. IP Context with l ogical IP interfaces bound to Ethernet port , serial port PVC 1 and PVC 2 The related IP, serial interface and Frame Relay config ura tion procedu re is lis ted below. Wh ere nec essar y, comments are added to the co[...]

Serial port configuration task list 57 OnSite 2800 Series User Manual 4 • Seri al por t config uration 5. Conf igure t he introd uced P VCs. 2800(frm-rel)[0/0]#pvc 1 2800(pvc)[1]#encapsulation rfc1490 2800(pvc)[1]#bind interface external r outer 2800(pvc)[1]#no shutdown 2800(pvc)[1]#pvc 2 2800(pvc)[2]#encapsulation rfc1490 2800(pvc)[2]#bind inter[...]

58 Chapter 5 T1/E1 por t configuration Chapter cont ents Introd ucti on ............................. ........... ........... ........... ............ ................. ........... ........... ........... ............ ........... .......59 T1/E 1 port con figurat ion task list ................... ........... ............ ........... ...............[...]

Introduction 59 OnSite 2800 Series User Manual 5 • T1/E1 port configuration Intr oduction This chapter p rovides an over view of the T1/E1 WAN por t, their ch aracteri stics a nd desc ribes the confi gura- tion tasks. The model 2803 has a T 1/E1 WAN port on the rear panel of the unit . The T1 ver sion (Model 2 803T) has an RJ-48C co nnector , and[...]

T1/E1 port configurati on task list 60 OnSite 2800 Series User Manual 5 • T1/E1 port configuration Mode: port e1t1 <slot> <port> Configurin g T1/E1 port-type T h e T 1 / E 1 P o r t c a n e i t h e r w o r k i n T 1 o r i n E 1 ( G . 7 0 4 ) m o d e . T h i s m o d e c a n b e c h a ng ed d y n a m i c a l ly a s l o n g as no encapsu[...]

T1/E1 port configurati on task list 61 OnSite 2800 Series User Manual 5 • T1/E1 port configuration Configurin g T1/E1 fr aming Four framing formats are available for selec tion on the T1/E1 port. Unframed can only be u sed if the encaps u- lation is set for hdlc . All other currently a vailable upper layer ( encapsu lation) pr otocols d o not run[...]

T1/E1 port configurati on task list 62 OnSite 2800 Series User Manual 5 • T1/E1 port configuration Configurin g T1/E1 application mode T h e T 1 / E 1 p o r t ca n b e c on f ig u r e d t o w o rk i n e i t h e r s h o r t - h a u l o r i n l on g - h a u l m o d e. Short- haul is the def ault application and should be used for transmission dista[...]

T1/E1 port configurati on task list 63 OnSite 2800 Series User Manual 5 • T1/E1 port configuration tion “Configuring T1/E1 encapsulation” .) On creating a new channel-gr ou p the channel-group configuration mode is imme diately entere d. To remove an existing channel-group the ‘ no’ form of the com mand has to be used. Mode: port e1t1 <[...]

T1/E1 port configurati on task list 64 OnSite 2800 Series User Manual 5 • T1/E1 port configuration ration mod e the encapsulation must b e set to ‘hdlc’ as well follow ed by configuring at least one timeslot per the ‘tim eslots ’ comma nd. Mode: port e1t1 <slot> <port> Mode: channel-group <group> Configu ring HDLC CRC-T [...]

T1/E1 port configurati on task list 65 OnSite 2800 Series User Manual 5 • T1/E1 port configuration Example 1: Frame R elay without a chann el-group port e1t1 0 0 port-type e1 framing crc4 encapsulation hdlc hdlc encapsulation framerelay framerelay lmi-type itu pvc 100 encapsulation rfc1490 bind interface pvc100 router no shutdown port e1t1 0 0 no[...]

T1/E1 port configurati on task list 66 OnSite 2800 Series User Manual 5 • T1/E1 port configuration Example 2: Framer elay with a channel- group port e1t1 0 0 port-type e1 framing crc4 encapsulation channelized channel-group myGroup timeslots 13-17 encapsulation hdlc hdlc encapsulation framerelay framerelay lmi-type itu pvc 100 encapsulation rfc14[...]

67 Chapter 6 VPN configuration Chapter cont ents Introd ucti on ............................. ........... ........... ........... ............ ................. ........... ........... ........... ............ ........... .......68 Authenti cati on ....... ............ ................ ............ ........... ........... ................. ........[...]

Introduction 68 OnSite 2800 Series User Manual 6 • V PN conf igu ratio n Intr oduction This chapter d escribes how to conf igure the VPN connec tions between two OnSite routers or between an OnSite and a third-party device. A virtual private ne twork (VPN) is a private data network that uses the public telecommunica tions infrastruc- ture, mainta[...]

VPN co nfiguration task list 69 OnSite 2800 Series User Manual 6 • V PN conf igu ratio n T ra nsport an d tunne l mode s The mode de termines the p ayload of the ESP pac ket and hence the appli cation: • Transport mo de: Encapsulates only the payload of the original IP pa cket, but not its header, so th e IPsec peers m ust be at the endpo ints [...]

VPN co nfiguration task list 70 OnSite 2800 Series User Manual 6 • V PN conf igu ratio n Crea tin g an IP sec pol icy pro fi le The IPsec policy p rofi le s upplies the keys for the e ncryp tion and/or the authentic ators for the authenticat ion, the security para meters indexes (SP Is), and IP addr ess of the peer of the secured c ommunica tion.[...]

VPN co nfiguration task list 71 OnSite 2800 Series User Manual 6 • V PN conf igu ratio n Mode: Config ure Use no in front of the above comm ands to de lete a profile or a configuration entr y. Step Comman d Purp ose 1 nod e (cfg)#pr ofile ipsec-policy -man- ual name Creates the IPsec policy profile name 2 nod e (pf- ipstr)[nam e]#use p rofi le ip[...]

VPN co nfiguration task list 72 OnSite 2800 Series User Manual 6 • V PN conf igu ratio n Exampl e: C reate an IPsec policy profile The follow ing example defi nes a profile fo r AES-encryp tion at a key length of 128. 2800(cfg)#profile ipsec-policy-manual ToBurg 2800(pf-ipsma)[ToBurg]#use profile ips ec-transform AES_128 2800(pf-ipsma)[ToBurg]#se[...]

VPN co nfiguration task list 73 OnSite 2800 Series User Manual 6 • V PN conf igu ratio n Con fig urati on of an IP in te rface and t he I P r oute r for IPse c The IP inter face that prov ides connectivi ty to the IPse c peer, must now activate the outgoing ACL profile c on- figured in the previou s section. Fu rthermore , the IP router m ust hav[...]

VPN co nfiguration task list 74 OnSite 2800 Series User Manual 6 • V PN conf igu ratio n Exampl e: D isplay IP sec transf ormatio n prof iles 2800(cfg)#show profile ipsec-transform IPSEC transform profiles: Name: AES_128 ESP Encryption: AES-CBC, Key length: 128 Exampl e: Display IPsec policy profi les 2800(cfg)#show profile ipsec-policy-ma nual M[...]

Sample co nfigur ation s 75 OnSite 2800 Series User Manual 6 • V PN conf igu ratio n IN MANUAL ToBurg Tunnel n o 200.200.200.1 - 1111 - - AES-CBC 128 3622/unlimited 19047/un limited OUT MANUAL ToBurg Tunnel n o 200.200.200.1 - 2222 - - AES-CBC 128 2857/unlimited 19047/un limited Sample configura tions The fol lowing samp le config urations e stab[...]

Sample co nfigur ation s 76 OnSite 2800 Series User Manual 6 • V PN conf igu ratio n ipaddress 200.200.200.2 255.255.255. 252 use profile acl VPN_In in use profile acl VPN_Out out context ip router route 0.0.0.0 0.0.0.0 200.200.200.1 0 route 172.16.0.0 255.255.0.0 WAN 0 Cisco router configuration crypto ipsec transform-set DES esp-des ! crypto ma[...]

Sample co nfigur ation s 77 OnSite 2800 Series User Manual 6 • V PN conf igu ratio n Rest of the configuration, see above, just change the name of the IPsec policy pro- file in the ACL profile ‘VPN_Out’ Cisco router configuration crypto ipsec transform-set AES_SHA1 ah -sha-hmac esp-aes 256 ! crypto map VPN_AES_SHA1 local-address FastEthernet0[...]

Sample co nfigur ation s 78 OnSite 2800 Series User Manual 6 • V PN conf igu ratio n set session-key inbound esp 8888 ciph er FEDCBA0987654321FEDCBA0987654321FEDCBA 0987654321 authenticator FEDCBA0987654321FEDCBA0987654321 set session-key outbound esp 7777 cip her 1234567890ABCDEF1234567890ABCDEF123456 7890ABCDEF authenticator 1234567890ABCDEF123[...]

79 Chapter 7 Access control list configuration Chapter cont ents Introd ucti on ............................. ........... ........... ........... ............ ................. ........... ........... ........... ............ ........... .......80 About access control list s ............... ........... ............ ................. ........... ...[...]

Introduction 80 OnSite 2800 Series User Manual 7 • Access control l ist configuration Intr oduction This chapter provides an overview o f IP Access Contro l Lis ts and descri bes the t asks invo lved in c onfiguring them through the OnSi te router. This chapt er inc ludes t he fol lowing se ctions: • About access contro l lists • Access cont [...]

About access control lists 81 OnSite 2800 Series User Manual 7 • Access control l ist configuration For example, access lists c an allow one host to access a part of your network, and prevent another ho st fr om accessing t he same area. In figur e 15 hos t A is all owed to acce ss the Human Resourc es netwo rk and host B i s prevented from acces[...]

Access control list conf iguration task list 82 OnSite 2800 Series User Manual 7 • Access control l ist configuration • All acces s control li sts have an implicit deny ip any any at the end. A packet that does not match the criteria of the f irst statement is subjected to the c riteria of th e second stateme nt and so o n until th e end of the[...]

Access control list conf iguration task list 83 OnSite 2800 Series User Manual 7 • Access control l ist configuration Before you begin to en ter the commands that c reate and configure the IP access control list, be sure that you are clear about w hat you want to ac hieve with the list. Co nsider whether it is better to deny spe cific accesses an[...]

Access control list conf iguration task list 84 OnSite 2800 Series User Manual 7 • Access control l ist configuration Mode: Profil e acces s control l ist Where the s yntax is: If you place a deny i p an y any rule at the top of an acce ss control list pr ofi le, no pac kets will pass r egardle ss of the ot her rules y ou defi ned. Exampl e: Crea[...]

Access control list conf iguration task list 85 OnSite 2800 Series User Manual 7 • Access control l ist configuration Adding an ICMP filter rule to the current access contr ol list pr ofil e The command perm it or deny are used to defi ne an ICMP filter rule. Eac h ICMP filter rule rep resents an ICMP access of cont rol list entry. This procedure[...]

Access control list conf iguration task list 86 OnSite 2800 Series User Manual 7 • Access control l ist configuration Where the s yntax is as follo wing: If you place a deny ip any any rul e at t he to p of a n ac cess -lis t pro fil e, no pack ets will p ass r ega rdle ss of the o the r rules y ou de fined . Exampl e: C reate ICMP ac cess co ntr[...]

Access control list conf iguration task list 87 OnSite 2800 Series User Manual 7 • Access control l ist configuration The same e ffect can also be obtained by u sing the simpler mes sage name optio n. See the followin g example. 2800(cfg)#profile acl WanRx 2800(pf-acl)[WanRX]#deny icmp any any msg echo 2800(pf-acl)[WanRX]#exit 2800(cfg)# Adding a[...]

Access control list conf iguration task list 88 OnSite 2800 Series User Manual 7 • Access control l ist configuration Where the s yntax is: Exampl e: Create TCP or UDP ac cess co ntrol l ist ent ries Select th e access-list pro file named WanRx and create the rules for: Permitting any TCP traf fic to hos t 193.14.2 .10 via port 80, and permitting[...]

Access control list conf iguration task list 89 OnSite 2800 Series User Manual 7 • Access control l ist configuration Binding and unbin ding an access control list pr ofile to an IP interface The command use is u s e d t o bi n d a n a c c e s s c o n t r o l l i s t p r o f i l e to an IP interface. This pr ocedure describ es how to bind an acce[...]

Access control list conf iguration task list 90 OnSite 2800 Series User Manual 7 • Access control l ist configuration Unbind an access control list profile from an interface. 2800(cfg)#context ip router 2800(cfg-ip)[router]#interface wan 2800(cfg-if)[wan]#no use profile acl i n Note When unbindi ng an access control list p rofile th e name argume[...]

Access control list conf iguration task list 91 OnSite 2800 Series User Manual 7 • Access control l ist configuration Mode: Interface Where the s yntax is: Exampl e: De bugging acce ss contr ol list p rofiles The fol lowin g example sho ws how to en able debuggi ng for incoming tr affic of acce ss contr ol list s on inte rface wan . On level 7 al[...]

Examples 92 OnSite 2800 Series User Manual 7 • Access control l ist configuration Examples Denying a specific subnet Figure 16 shows an example in which a server attached to ne t work 172.16.1.0 shall not be accessibl e from outsi de networks c onnected to IP in terface lan of the OnSite device. To pr event access, an incoming filter rule named J[...]

93 Chapter 8 Link scheduler configuration Chapter cont ents Introd ucti on ............................. ........... ........... ........... ............ ................. ........... ........... ........... ............ ........... .......94 Configuring access contr ol lists ...... ........... ............ ................. ........... ...........[...]

Introduction 94 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on Intr oduction This chapter des cribes how to use and conf igure the OnSite Quality of Service (QoS) feature s. Refer to 7, “Acc ess con trol lis t confi gurati on” on page 79 for mo re in formation on t he use o f access contro l lis ts. This chapt er inc lude[...]

Conf iguring qua lity of s ervic e (QoS ) 95 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on Figure 17. IP context and related elements Configuring quali ty of service (QoS) In the OnSit e 2800, t he link sched uler enab les the de finition o f QoS prof iles fo r networ k traffic on a certai n interface, as shown in figure 1 7[...]

Conf iguring qua lity of s ervic e (QoS ) 96 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on can be used to mark a sp ecific packet type fo r the other network no des. By default the traffi c-class tag is empty. Refer to figur e 18 on page 96 when u sing the AC L to clas sify traffi c. It illustr ates t he seque nce of p roces[...]

Conf iguring qua lity of s ervic e (QoS ) 97 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on Each traffic-class is in fact assigned a relat ive wei ght, which is used to share the bandw idth among the cur rently active classes. Patton recommends that yo u specif y the weight as percent which is best readable. Shaping Ther e is[...]

Quick references 98 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on Figure 19. Example of Hierarchical Scheduling Quick references The following sections provide a mini mal “standard” link schedu ler conf igurat ion fo r the c ase where a (DSL/cable) modem link is shared for all traffic. You will al so find a command cross[...]

Link scheduler configuration task list 99 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on • “modem-512” is the ti tle of the pr ofile wh ich is re ferred to when inst alling the schedu ler • “rate-limi t 512” allo ws no more than 51 2 kbit/se c to pass wh ich avoids queuei ng in the modem. • “header-length 20?[...]

Link scheduler configuration task list 100 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on • Displaying link scheduling pr ofile informati on (see page 110 ) • Enable statistics gathering (see page 11 0) Figure 20. Elements of link scheduler configuration Defining the access contr ol list pr ofile Packet classification The[...]

Link scheduler configuration task list 101 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on Some types of packets you do not h ave to tag with ACL. Voi ce and data packets fr om of for the On Site itself are automatically tagged with pr edefined traffi c-clas s names: Pred efined internal classes for da ta are: • local-def au[...]

Link scheduler configuration task list 102 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on Mode: Config ure Exampl e: Defi ning the access control list profile In the example b elow a new access control list prof ile named Webserver i s cre ate d. In addi tio n an IP ac ces s co n- trol list entry that permit s access for ho s[...]

Link scheduler configuration task list 103 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on Figure 22. Str ucture of a Service- Policy Profile The template show n above specif ies an arbiter with three inputs which w e call “sour c es”: x, y and “default”. The traffic-class “default” s tands for all other packets th[...]

Link scheduler configuration task list 104 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on At a some poi nt the so urce tr affic- class default mu st be li sted. T his clas s mus t be pre sent, becaus e it de fines h ow packets, w hich do not be long to any of the traffic -classe s listed in the p rofile are to be handled. Whe[...]

Link scheduler configuration task list 105 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on Mode: Sourc e Defining the bit-rate The command rate is used with shaper link arbitration to assi gn the (average) bit-rate to the selec ted source. When enough band width is availabl e each source wil l exactly receiv e this bandwidth ([...]

Link scheduler configuration task list 106 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on The ty pe-of-s ervice (T OS) byt e in an IP header specifie s preced ence (priori ty) and type of service (RFC791, RFC1349 ). The precedenc e field is defi ned by the first thr ee bits and supports e ight levels of priority. The next fou[...]

Link scheduler configuration task list 107 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on “traffic-class” number called. W ith OnSite you can inspe ct the DSCP value in the ACL rules and modify the DSCP value with the link scheduler se t ip dscp command. Note When conf iguring se rvice d ifferent iation on the OnSi te rou[...]

Link scheduler configuration task list 108 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on Defining random e arly detection The command random-dete ct is us ed to reques t random early detecti on (RED). W hen a que ue carries l ots of TCP transfers that last longer than simple web requ ests, there is a risk that TC P flow-cont[...]

Link scheduler configuration task list 109 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on Devoting the ser vice policy profile to an inter face Any servic e policy profil e needs to be bound to a certai n IP interface to get activated. According the te rminol- ogy of OnSite a service policy profi le is used on a certain IP in[...]

Link scheduler configuration task list 110 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on 2800>enable 2800#configure 2800(cfg)#context ip router 2800(ctx-ip)[router]#interface wan 2800(if-ip)[wan]#use profile service-p olicy Voice_Prio out Displaying lin k arbitration status The show service-p olic y command di splays link[...]

Link scheduler configuration task list 111 OnSite 2800 Series User Manual 8 • Link s chedul er conf igurati on The command has op tional values (in the range of 1 to 4) that def ine the level of detail (see tab le 13 ). Note The debug feature s offe red by OnSi te requi re th e CPU resour ces of your OnSite ro uter. Therefo re do not enable stati[...]

112 Chapter 9 LEDs status and monitori ng Chapter cont ents Status LEDs ................. ................. ........... ............ ........... ........... ................. ............ ........... ........ . ............. ...........113[...]

Status LEDs 113 OnSite 2800 Series User Manual 9 • LEDs status and monitoring Status LEDs This chapter d escribes OnSite gatew ay router front panel LE Ds. Figure 24 shows OnSi te 2800 Ser ies LEDs. LED defi nitions are list ed in t able 1 4 on page 11 3. Figure 24. Examples of O nSite 2800 Series front panels Table 14. OnSite L ED Indications LE[...]

114 Chapter 10 Contacting Patton for assistance Chapter cont ents Introd ucti on ............................. ........... ........... ........... ............ ................. ........... ........... ........... ... ... ................. .....115 Contact inf ormati on ................. ........... ........... ........... ............ ............[...]

Introduction 115 OnSite 2800 Series User Manual 10 • Contacting Patton for assistance Intr oduction This chapte r contains t he foll owing info rmation: • “Contact information”—des cribes how to contac t Patton technical sup port for assistance . • “Warranty Service and Returned Mer chandise Author izations (RMAs) ”—contains infor[...]

Warranty Service and Returned Merch andise Authorizations (RMAs) 116 OnSite 2800 Series User Manual 10 • Contacting Patton for assistance Out-of-war ranty serv ice Patton servic es what we sell, no matter how you ac quired it, inc luding malfunctioning p roducts that are no longer under warranty. Our products have a flat fee for repairs. Un its d[...]

117 Appendix A Compliance information Chapter cont ents Comp liance .................. ................. ........... ............ ........... ........... ................. ............ ........... ....... .... ................. .....118 EMC ........... ........... ................. ........... ............ ........... ........... ................. [...]

Compl iance 11 8 OnSite 2800 Series User Manual A • Compliance information Complia nce EMC • FCC Pa rt 1 5, Cl ass A • EN55022, Clas s A • EN55024 Safety • UL 60950-1/CSA C 22.2 N0.60 950-1 • IEC/EN60950-1 • AS/NZS 60950- 1 PSTN Re gulator y • ACTA Part 68 (Model 2803) • CS03 (Model 2803) • AS/ACIF S016 (Model 2 803) Radio and T[...]

Authorized European Representative 119 OnSite 2800 Series User Manual A • Compliance information Authorized Eur opean R epresentative D R M Green European Co mpliance Ser vices Limited. Oakdene House, Oak Road Watc hfie ld, Swindon, Wilts SN6 8TD, UK FCC Par t 68 (ACT A) St atement (Model 2803 only) This equipme nt complies with P art 68 of FCC r[...]

120 Appendix B Spe cifi cations Chapter cont ents Ethernet interfa ces .................... ........... ................. ........... ........... ............ ........... ................. ........... ...... ..... ...........121 Sync serial int erface ............ ........... ........... ............ ................. ........... ........... ......[...]

Ethernet interfaces 121 OnSite 2800 Series User Manual B • Specifications Ethernet interfaces 10/100Base -TX Etherne t WAN po rt 4-port 10/1 00Base- TX Ethernet LAN switch ( Model 2805) 10/100Base- TX Etherne t LAN port (all o ther model s) All port s full dup lex, autosens ing, auto- MDIX 10/100 Full Dupl ex/Autos ensing Ethe rnet RJ-45 Sync ser[...]

IP services 122 OnSite 2800 Series User Manual B • Specifications PPP, PAP, CHAP , LCP, IPCP IP ser vices IPv4 route r; RIPv1, v2 (RFC 1058 and 2453) Program mable sta tic ro utes ICMP redirect (RFC 792); Packe t fragmentatio n DiffServ e/ToS set or q ueue per head er bits Packet Pol icing disc ards exce ss traffic 802.1p VLAN t agging IPSEC AH &[...]

Power supply 123 OnSite 2800 Series User Manual B • Specifications Power supply Inte rnal A C v ersion Internal po wer supp ly 100–240 VAC, 50/60 Hz, 2 00 mA 12VDC versio n with E xtern al AC Po wer Adap ter (Models 280 2, 2821, 2835) Uses external AC Adaptor which provides 12VDC via barrel type conne ctor AC Adapter Input: 90- 264VAC, 47-63 Hz[...]

124 Appendix C Cabling Chapter cont ents Introd uction ................. ................. ........... ............ ........... ................. ........... ............ ........... ........ . ............. ...........125 Serial console .................... ........... ................. ........... ............ ........... ........... ............[...]

Introduction 125 OnSite 2800 Series User Manual C • C abling Intr oduction This section prov ides information on the cables used to c onnect the OnSite to the existing network i nfrastruc- ture and to thir d party products. Seria l consol e The OnSit e can be connected to a serial t erminal over its serial console port, as depicted in figure 2 5 [...]

Ethernet 10Base-T and 100Base-T 126 OnSite 2800 Series User Manual C • C abling Ethernet 10Base- T and 100Base-T Etherne t device s (10Base- T/100Base- T) are conne cted to the OnSite over a cabl e with RJ- 45 plugs. Use a cross- over cable to a host, or a straight cab le to a hub. See figure 2 6 (host) and figur e 27 on page 127 (hub) for the di[...]

Ethernet 10Base-T and 100Base-T 127 OnSite 2800 Series User Manual C • C abling Figure 27. Ethernet straight-through Hub Straight-through cable RJ-45, male Tx+ Tx- Rx+ Rx- 1 2 3 6 RJ-45, male 1 Rx+ 2 Rx- 3 Tx+ 6 Tx-[...]

128 Appendix D Por t pin-outs Chapter cont ents Introd uction ................. ................. ........... ............ ........... ................. ........... ............ ........... ........ . ............. ...........129 Consol e port, RJ -45, EI A-561 (RS- 232) ....... ........... ............ ................. ........... ........... ...[...]

Introduction 129 OnSite 2800 Series User Manual D • Port pin- outs Intr oduction This section pr ovides pin-out i nformation for the p orts of the OnS ite router. Console por t, RJ-45 , EIA-561 (RS -232) The RS-232 serial console p ort of the OnSi te is configured to operate as a DCE . View the image i n figure 28 showing the RJ-4 5 receptacle wi[...]

Ethernet 10Base-T and 100Base-T por t 130 OnSite 2800 Series User Manual D • Port pin- outs Ethernet 10Base- T and 100Base-T por t The Ethe rne t port s a re a uto -de tec t MDI -X. Note Pins not listed are not used. Sync seri al port V. 3 5 s e r i a l p o r t Table 16. RJ-45 socket Pin Signal Direction 1 TX+ from OnSi te 2 TX- from OnSi te 3 RX[...]

Sync serial port 131 OnSite 2800 Series User Manual D • Port pin- outs X.21 serial port Note Pins not labeled are not used. Table 18. X.21 Female DB-15 connector X.21 Inter face Pin-Out Pin Signal 1 Fram e Gro und 2 TD-a 3 CNTRL- a 4 RD-a 5 IND-a 6 SET-a 8 Signal Ground 9 TD-b 10 CNTRL- b 11 RD-b 12 IND-b 13 SET-b[...]

132 Appendix E OnSite 280 0 Seri es factor y configuration Chapter cont ents Introd ucti on ............................. ........... ........... ........... ............ ................. ........... ........... ........... ... ... ................. .....133[...]

Introduction 133 OnSite 2800 Series User Manual E • OnSite 28 00 Ser ies fact ory confi gura tion Intr oduction The fact ory configur ation set tings for the OnSite 2800 Seri es devic es are as follow s: #------------------------------------- ---------------------------# # 2800 Series # R3.xx BUILDxxxxx # 2005-01-18T00:00:00 # Factory configurati[...]

134 Appendix F Installation check list Chapter cont ents Introd uction ................. ................. ........... ............ ........... ................. ........... ............ ........... ........ . ............. ...........135[...]

Introduction 135 OnSite 2800 Series User Manual F • Ins tall ation che cklis t Intr oduction This ap pendix lists th e tasks fo r instal ling a n OnSi te 2800 Se ries Ma naged V PN Rou ter (se e table 19 ). Make a copy of this che cklist and mark the entries as you complete eac h task. For each OnSi te 2800 Series Router, inclu de a copy of t he [...]