Netopia 3300-ENT manual

N N N N e e e e t t t t o o o o p p p p ii i i a a a a ® ® ® ® F F F F ii i i r r r r m m m m w w w w a a a a r r r r e e e e U U U U s s s s e e e e r r r r G G G G u u u u ii i i d d d d e e e e 3 3 3 3 3 3 3 3 0 0 0 0 0 0 0 0 - - - - E E E E N N N N T T T T E E E E n n n n t t t t e e e e r r r r p p p p r r r r ii i i s s s s e e e e S S S [...]

C o p yright Copyright© 2004, Netopia, Inc. Netopia and the Netopia logo are register ed trademarks belonging to Netopia, Inc., registered U.S. Patent and Trademark Of fice. Broadband Without Boundaries and 3-D Reach are trademarks belonging to Netopia, Inc. All other trademarks are the proper ty of their respective owners. All rights reser ved. [...]

Contents iii G Chapter 1 — Introduction.......................................................... 1-1 What’s New in 8.4 ......................................................... 1-1 T elnet-based Management .............................................. 1-2 Netopia T elnet Menus .................................................... 1-2 Netopia M[...]

iv Firmware User Guide Logging ............................................................. 2-38 Chapter 3 — Multiple Network Address Translation ................... 3-1 Over view ....................................................................... 3-1 Features ............................................................. 3-2 Suppor ted traf [...]

Contents v G A TMP configuration ............................................ 4-15 Encr yption Suppor t ...................................................... 4-17 MS-CHAP V2 and 128-bit strong encr yption ......... 4-18 A TMP/PPTP Default Pr ofile............................................ 4-18 VPN QuickView ....................................[...]

vi Firmware User Guide Authentication configuration................................ 6-10 Connection Profiles and Default Pr ofile ................ 6-15 IP Address Ser ving ...................................................... 6-17 IP Address Pools................................................ 6-20 DHCP NetBIOS Options ........................[...]

Contents vii G Simple Network Management Protocol (SNMP)............... 8-10 The SNMP Setup screen ..................................... 8-11 SNMP traps ....................................................... 8-12 Chapter 9 — Security ............................................................... 9-1 Suggested Security Measures..................[...]

viii Firmware User Guide TFTP ................................................................. 9-44 Chapter 10 — Utilities and Diagnostics ................................... 10-1 Ping ............................................................................ 10-2 T race Route ................................................................. 1[...]

Contents ix G Broadcasts.................................................................. B-14 Packet header types .......................................... B-14 Appendix C — Binary Conversion T able ......................................C-1 Appendix D — T echnical Specifications and Safety Information .. D-1 Description.....................[...]

x Firmware User Guide[...]

Introduction 1-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 II I I n n n n t t t t r r r r o o o o d d d d u u u u c c c c t t t t ii i i o o o o n n n n This Fir mware User Guide covers the advanced features of the Netopia 3300-Series Router family . Y our Netopia equipment of fers advanced configuration features accessed thr[...]

1-2 Firmware User Guide T elnet-based Management T elnet-based management is a fast menu-driven inter face for the capabilities built into the Netopia Fir mware V ersion 8.4. T elnet-based management provides access to a wide variety of featur es that the Router suppor ts. Y ou can customize these featur es for your individual setup. This chapter d[...]

Introduction 1-3 provider or r emote site. See “W AN Configuration,” beginning on page 2-1 . See also Chapter 4, “Vir tual Private Networks (VPNs).” • The System Configuration menus display and per mit changing: and more. See “System Configuration Screens,” beginning on page 2-22 . • The Utilities & Diagnostics menus provide [...]

1-4 Firmware User Guide Configuring T elnet software If you are configuring your device using a T elnet session, your computer must be r unning a T elnet software program. • If you connect a PC with Microsoft Windows, you can use a Windows T elnet application or r un T elnet from the Star t menu. • If you connect a Macintosh computer r unning[...]

Introduction 1-5 T o help you find your way to par ticular screens, some sections in this guide begin with a graphical path guide similar to the following example: This par ticular path guide shows how to get to the Network Protocols Setup screens. The path guide r epresents these steps: 1. Beginning in the Main Menu, select System Configuration [...]

1-6 Firmware User Guide[...]

W AN and System Configuration 2-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 2 2 2 2 W W W W A A A A N N N N a a a a n n n n d d d d S S S S y y y y s s s s t t t t e e e e m m m m C C C C o o o o n n n n f f f f ii i i g g g g u u u u r r r r a a a a t t t t ii i i o o o o n n n n This chapter describes how to use the T elnet-based m[...]

2-2 Firmware User Guide W AN Ethernet Configuration screen The W AN Ether net Configuration screen appears as follows: • Address Translation Enabled allows you to specify whether or not the router per for ms Network Address T ranslation (NA T) on the Ether net W AN por t. NA T is enabled by default. • Local W AN IP Addr ess allows you to manu[...]

W AN and System Configuration 2-3 • The W AN Ethernet Speed Setting is now configurable via a pop-up menu. Options are: Auto-Negotiation (the default), 100 Mbps Full Duplex, 100 Mbps Half Duplex, 10 Mbps Full Duplex, and 10 Mbps Half Duplex. This may be useful in mixed networks, where multiple r outers have dif fer ent ethernet speed capability[...]

2-4 Firmware User Guide If you want the Netopia Router to adver tise its routing table to other routers via RIP , select T ransmit RIP and select v1 , v2 (broadcast) , or v2 (multicast) from the popup menu. With T ransmit RIP v1 selected, the Netopia Fir mware V ersion 8.4 will generate RIP packets only to other RIP v1 routers. With Transmit RIP v2[...]

W AN and System Configuration 2-5 VCs are identified by a Vir tual Path Identifier (VPI) and Vir tual Channel Identifier (VCI). A VPI is an 8-bit value between 0 and 255, inclusive, while a VCI is a 16-bit value between 0 and 65535, inclusive. • Circuits suppor t attributes in addition to their VPI and VCI values. When configuring a cir cuit[...]

2-6 Firmware User Guide • Enter a name for the circuit in the Cir cuit Name field. • T oggle Circuit Enabled to Y es. • Enter the Vir tual Path Identifier and the Vir tual Channel Identifier in the Cir cuit VPI and Circuit VCI fields, respectively . • The Peak Cell Rate field is editable. Netopia Firmwar e V ersion 8.4 suppor ts three [...]

W AN and System Configuration 2-7 VBR : This class is characterized by: • a Peak Cell Rate (PCR), which is a temporar y burst, not a sustained rate, and • a Sustained Cell Rate (SCR), • a Burst T olerance (BT), specified in ter ms of Maximum Burst Size (MBS). The MBS is the maximum number of cells that can be transmitted at the peak cell ra[...]

2-8 Firmware User Guide Note: With multiple VCs you must explicitly statically bind the second (and all subsequent) VCs to a profile. The first VC will automatically statically bind according to pr e-defined dynamic binding rules when you add the second VC. It will rever t back to dynamic binding if the number of VCs is reduced to one; for examp[...]

W AN and System Configuration 2-9 Creating a New Connection Pr ofile Connection profiles ar e useful for configuring the connection and authentication settings for negotiating a PPP connection. If you are using the PPP data link encapsulation method, you can stor e your authentication infor mation in the connection profile so that your user na[...]

2-10 Firmware User Guide Multiple Data Link Encapsulation Settings 4. Select Encapsulation Options and press Retur n. • If you selected A TMP , PPTP , L2TP , or IPSec, see Chapter 4, “ Vir tual Private Networks (VPNs) .” • If you selected PPP or RFC1483, the screen of fers dif fer ent options: If you are using PPP , when you select Encapsul[...]

W AN and System Configuration 2-11 Return to the Add Connection Pr ofile screen by pressing Escape. 5. Select IP Profile Parameters and press Retur n. The IP Profile Parameters scr een appears. Datalink (PPP/MP) Options Data Compression... Standard LZS Send Authentication... PAP Send User Name: Send Password: Receive User Name: Receive Password[...]

2-12 Firmware User Guide 6. T oggle or enter your IP Parameters. For more infor mation, see: • “IP Setup” on page 6-2 • “Network Address T ranslation (NA T)” on page 2-23 • “Stateful Inspection Options” on page 2-24 • “Filter Sets” on page 2-23 • The RIP Profile Options selection displays the RIP Pr ofile Parameters scre[...]

W AN and System Configuration 2-13 • The Receive RIP pop-up menu controls the r eception and transmission of Routing Information Pr otocol (RIP) packets on the W AN por t. The default is Both v1 and v2. A Transmit RIP pop-up menu is hidden if NA T is enabled. Routing Infor mation Protocol (RIP) is needed if there ar e IP routers on other segment[...]

2-14 Firmware User Guide Adv anced Connection Options Configuration Changes Reset W AN Connection The menu suppor ts delaying some configuration changes until after the Netopia Router is restar ted. If your Netopia Router is preconfigur ed by your ser vice provider , or if you ar e not remotely configuring the router , you can leave this settin[...]

W AN and System Configuration 2-15 When you toggle Configuration Changes Reset W AN Connection either to Y es or No using the T ab key and press Retur n, a pop-up window asks you to confirm your choice. T oggling from Ye s to No makes the router r eady to be configured. If you toggle from No to Ye s after any configuration changes have been en[...]

2-16 Firmware User Guide Viewing scheduled connections T o display a table of scheduled connections, select Display/Change Scheduled Connection in the Scheduled Connections screen. Each scheduled connection occupies one r ow of the table. The first column in the table shows a one-letter repr esentation of the Days of the week, fr om Monday (M or m[...]

W AN and System Configuration 2-17 • The time of day that the connection will Begin At • The duration of the connection ( HH:MM ) • Whether it’s a recur ring W eekly connection or used Once Only • Which connection profile ( Conn. Pr of. ) is used to connect • Whether the scheduled connection is cur rently Enabled The Router checks the[...]

2-18 Firmware User Guide • Demand-Blocked , meaning that this schedule will prevent a demand call on the line. • Periodic , meaning that the connection is retried several times during the scheduled time. • Random Retr y , which operates as follows: First, it will wait 0 to 60 seconds before star ting, then it will tr y three times to bring th[...]

W AN and System Configuration 2-19 • Select Scheduled Window Duration Per Day and enter the maximum duration allowed for this scheduled connection, per call. • Retr y interval (minutes) becomes visible if you have selected Random Retr y . This option allows you to set the upper limit for the number of minutes to use for the retr y time (the at[...]

2-20 Firmware User Guide Y ou ar e finished configuring the once-only options. Return to the Add Scheduled Connection scr een to continue. • In the Add Scheduled Connection screen, select Use Connection Profile and choose fr om the list of connection profiles you have alr eady created. A scheduled connection must be associated with a connecti[...]

W AN and System Configuration 2-21 The Router will recognize a delay-sensitive packet as having the low-latency bit set in the TOS field of the IP header . If you toggle Prioritize Delay-Sensitive Data to Ye s the r outer will place these packets at the front of the transmission queue to the W AN link, over taking non-delay-sensitive traf fic. A[...]

2-22 Firmware User Guide System Configuration Screens System configuration features The Netopia Router’s default settings may be all you need to configure. Some users, however , requir e advanced settings or prefer manual contr ol over the default selections. For these users, the Netopia Firmwar e V ersion 8.4 provides system configuration op[...]

W AN and System Configuration 2-23 IP Setup These screens allow you to configur e your network’s use of the IP networking protocol. • Details are given in “ IP Setup” on page 6-2 . Filter Sets These screens allow you to configur e security on your network by means of filter sets and a basic firewall. • Details are given in “ Securi[...]

2-24 Firmware User Guide • UDP no-activity time-out: The time in seconds after which a UDP session will be ter minated, if there is no traf fic on the session. • TCP no-activity time-out: The time in seconds after which an TCP session will be ter minated, if there is no traf fic on the session. • Exposed Addresses: The hosts specified in E[...]

W AN and System Configuration 2-25 Select Stateful Inspection Options and press Retur n. The Stateful Inspection Parameters screen appears. • Max. TCP Sequence Number Dif ference : Enter a value in this field. This value repr esents the maximum sequence number dif ference allowed between subsequent TCP packets. If this number is exceeded, the p[...]

2-26 Firmware User Guide Note: If Stateful Inspection is enabled on a base connection profile (for example, for PPP , RFC1483 bridged/routed, or PPPoE), Enable default mapping to router must be yes to allow inbound VPN ter minations. (for example. for PPTP/A TMP client access to the r outer) • Deny Fragmented Packets : T oggling this option to Y[...]

W AN and System Configuration 2-27 Exposed Addresses Y ou can specify the IP addr esses you want to expose by selecting Add Exposed Address List and pressing Return. The Add Exposed Addr ess List screen appears. Add, Edit, or delete exposed addresses options ar e active only if NA T is disabled on an W AN inter face. The hosts specified in expose[...]

2-28 Firmware User Guide • Protocol : Select the Pr otocol of the traf fic to be allowed to the host range fr om the pull-down menu. Options are Any , TCP , UDP , or TCP/UDP . • Star t Por t: Star t por t of the range to be allowed to the host range. The acceptable range is fr om 1 - 65535 • End Por t: Pr otocol of the traf fic to be allowe[...]

W AN and System Configuration 2-29 Date and time Y ou can set the system’s date and time parameters in the Set Date and Time scr een. Select Date and Time in the System Configuration screen and pr ess Return. The Set Date and Time screen appears. Follow these steps to set the system’s date and time: 1. T oggle NTP (Network Time Prot.) Enabled[...]

2-30 Firmware User Guide W ireless configuration If your Router is a wireless model (such as a 3347W) you can enable or disable the wir eless LAN by selecting Wir eless Configuration . The Wireless Configuration screen appears. Enable Wir eless is set to Ye s by default. When Enable Wir eless is disabled ( No ), the Gateway will not provide or b[...]

W AN and System Configuration 2-31 region. The widest range available is fr om 1 to 14. However , in Nor th America only 1 to 11 may be selected. Europe, France, Spain and Japan will dif fer . Channel selection can have a significant impact on per for mance, depending on other wireless activity close to this Gateway . Channel selection is not nec[...]

2-32 Firmware User Guide The Pre Shar ed Key field becomes visible to allow you to enter a Pre Shared Key . The key can be between 8 and 63 characters, but for best security it should be at least 20 characters. Clients wishing to connect must also be configured to use WP A with this same key . • WEP : Alternatively , you can provide a level of [...]

W AN and System Configuration 2-33 Y ou select a single key for encr yption of outbound traf fic. The WEP-enabled client must have an identical key of the same length, in the identical slot (1 – 4) as the Gateway , in or der to successfully receive and decr ypt the traf fic. Similarly , the client also has a ‘default’ key that it uses to e[...]

2-34 Firmware User Guide needs to be done once. Avoid the temptation to enter all the same characters. Default Key (#1 – #4): Specifies which key the Router will use to encr ypt transmitted traf fic. The default is key #1. Key (#1 – #4): The encr yption keys. Y ou enter keys using hexadecimal digits. For 40/64bit encr yption, you need ten dig[...]

W AN and System Configuration 2-35 The Wireless MAC Authorization scr een appears. T o enable Wireless Mac Authorization, toggle Enable MAC Authentication to Ye s . Y ou can toggle it to No to disable it at any time. Select Add MAC Address and pr ess Return. The Add Wireless MAC Addr ess screen appears. Enter the MAC (hardwar e) address of the cli[...]

2-36 Firmware User Guide Y our entr y will be added to a list of up to 32 authorized addr esses. T o display the list of authorized MAC addresses, select Display/Change MAC Addr esses from the Authorized Wireless MAC Addresses menu. The list is displayed as shown below . Y ou can continue to Add , Change , or Delete addr esses to the list by select[...]

W AN and System Configuration 2-37 Change Device to a Bridge For Netopia DSL Routers, this feature allows you to tur n of f the r outing features and use your device as a bridge. It is not an option for Ethernet WAN models. If you select this option, the device will restar t itself, and reset all the settings to factor y defaults. Any configurati[...]

2-38 Firmware User Guide Y ou can r einstate Router mode by retur ning to the System Configuration menu. Select Change Device to a Router . Press Return , confir m your choice, and the device will restar t in router mode. Logging Y ou can configur e a UNIX-compatible syslog client to repor t a number of subsets of the events entered in the Route[...]

W AN and System Configuration 2-39 The Logging Configuration screen appears. By default, all events are logged in the event histor y . • By toggling each event descriptor to either Ye s or No , you can deter mine which ones are logged and which are ignor ed. • Y ou can enable or disable the syslog client dynamically . When enabled, it will re[...]

2-40 Firmware User Guide Y ou will need to install a Syslog client daemon pr ogram on your PC and configure it to repor t the WAN events you specified in the Logging Configuration screen. The following screen shows a sample syslog dump of WAN events: May 5 10:14:06 tsnext.netopia.com Link 1 down: PPP PAP failure May 5 10:14:06 tsnext.netopia.com[...]

Multiple Network Address T ranslation 3-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 3 3 3 3 M M M M u u u u ll l l t t t t ii i i p p p p ll l l e e e e N N N N e e e e t t t t w w w w o o o o r r r r k k k k A A A A d d d d d d d d r r r r e e e e s s s s s s s s T T T T r r r r a a a a n n n n s s s s ll l l a a a a t t t t ii i i o[...]

3-2 Firmware User Guide Features MultiNA T featur es can be divided into several categories that can be used simultaneously in dif fer ent combinations on a per-Connection Profile basis. The following is a general description of these features: Port Address T ranslation The simplest for m of classic Network Address T ranslation is PAT (Por t Addre[...]

Multiple Network Address T ranslation 3-3 Dynamic mapping Dynamic mapping , often refer red to as many-to-few , of fers an extension to the advantages provided by static mapping. Instead of requiring a one-to-one association of public addr esses and private addresses, as is requir ed in static mapping, dynamic mapping uses a group of public IP addr[...]

3-4 Firmware User Guide Exterior addresses ar e allocated to internal hosts on a demand, or as-needed, basis and then made available when traf fic from that host ceases. Once an internal host has been allocated an addr ess, it will use that address for all traf fic. Five minutes after all traf fic ceases – no pings, all TCP connections closed,[...]

Multiple Network Address T ranslation 3-5 Complex maps Map lists and ser ver lists are completely independent of each other . A Connection Profile can use one or the other or both. MultiNA T allows complex mapping and r equires more complex configuration than in earlier fir mware versions. Multiple mapped interior subnets are suppor ted, and the[...]

3-6 Firmware User Guide Support for Y ahoo Messenger Netopia Fir mware V ersion 8.4 provides Application Level Gateway (ALG) suppor t for Y ahoo Messenger. This allows Y ahoo Messenger users to exchange files, even when both users are behind NA T . Previously , the file transfer function would work only if one or neither of the two users were beh[...]

Multiple Network Address T ranslation 3-7 The two map lists, Easy-P A T List and Easy-Ser vers, ar e created by default and NA T configuration becomes ef fective.This will map all your private addresses (0.0.0.0 through 255.255.255.255) to your public address. These map lists are bound to the Easy Setup Pr ofile. See Binding Map Lists and Ser ver[...]

3-8 Firmware User Guide Select Network Address Translation (NA T) and press Return. The Network Address T ranslation scr een appears. Public Range defines an external addr ess range and indicates what type of mapping to apply when using this range. The types of mapping available are dynamic , static and pat . Map Lists define collections of mappi[...]

Multiple Network Address T ranslation 3-9 NA T rules The following r ules apply to assigning NA T ranges and ser ver lists: • Static public address ranges must not overlap other static, P A T , public addresses, or the public addr ess assigned to the Router’s W AN inter face. • A P A T public addr ess must not overlap any static address range[...]

3-10 Firmware User Guide Select First Public Address and enter the first exterior IP addr ess in the range you want to assign. Select Last Public Address and enter an IP addr ess at the end of the range. • Select ADD NA T PUBLIC RANGE and press Return. The range will be added to your list and you will be retur ned to the Network Address T ransla[...]

Multiple Network Address T ranslation 3-11 • Select First and Last Private Address and enter the first and last interior IP addresses you want to assign to this mapping. • Select Use NA T Public Range and press Return. A scr een appears displaying the public ranges you have defined. • From the list of public ranges you defined, select the [...]

3-12 Firmware User Guide • The Add NA T Map scr een now displays the range you have assigned. • Select ADD NA T MAP and press Return. Y our mapping is added to your map list. Modifying map lists Y ou can make changes to an existing map list after you have cr eated it. Since there may be more than one map list you must select which one you are m[...]

Multiple Network Address T ranslation 3-13 The Show/Change NA T Map List scr een appears. • Add Map allows you to add a new map to the map list. • Show/Change Maps allows you to modify the individual maps within the list. • Delete Map allows you to delete a map from the list. Selecting Show/Change Maps or Delete Map displays the same pop-up m[...]

3-14 Firmware User Guide The Change NA T Map scr een appears. Make any modifications you need and then select CHANGE NA T MAP and press Return. Y our changes will become ef fective and you will be returned to the Show/Change NA T Map List screen. Change NAT Map ("my_map") First Private Address: 192.168.1.253 Last Private Address: 192.168[...]

Multiple Network Address T ranslation 3-15 Adding Server Lists Ser ver lists, also known as Expor ts, are handled similarly to map lists. If you want to make a par ticular ser ver’s por t accessible (and it isn’t accessible through other means, such as a static mapping), you must create a ser ver list. Select Add Ser ver List from the Network A[...]

3-16 Firmware User Guide • Select Ser vice and press Return. A pop-up menu appears listing a selection of commonly expor ted ser vices. • Choose the ser vice you want to expor t and press Retur n. Y ou can choose a pr econfigured ser vice from the list, or define your own by selecting Other . If you select Other , a scr een is displayed that [...]

Multiple Network Address T ranslation 3-17 • Enter the First and Last Por t Number between por ts 1 and 65535. Select OK and press Retur n. Y ou will be retur ned to the Add NA T Ser ver screen. • Enter the Ser ver Private IP Address of the ser ver whose ser vice you are expor ting. Since MultiNA T per mits the mapping of multiple private IP ad[...]

3-18 Firmware User Guide • Select the Ser ver List Name you want to modify from the pop-up menu and pr ess Return. The Show/Change NA T Ser ver List scr een appears. • Selecting Show/Change Ser ver or Delete Server displays the same pop-up menu. Network Address Translation +-NAT Server List Name-+ +----------------------+ A| my_servers | S| |..[...]

Multiple Network Address T ranslation 3-19 Select any ser ver from the list and pr ess Return. The Change NA T Ser ver scr een appears. Y ou can make changes to the ser ver’s ser vice and por t or inter nal or external address. Select CHANGE NA T SERVER and press Return. Y our changes take ef fect and you ar e retur ned to the Show/Change NA T Se[...]

3-20 Firmware User Guide A pop-up menu lists your configured ser vers. Select the one you want to delete and pr ess Return. A dialog box asks you to confir m your choice. Choose CONTINUE and press Retur n. The ser ver is deleted from the list. Show/Change NAT Server List +-Internal Address-External Address--Port------------+ +--------------------[...]

Multiple Network Address T ranslation 3-21 Binding Map Lists and Server Lists Once you have created your map lists and ser ver lists, for most Netopia Router models you must bind them to a profile, either a Connection Pr ofile or the Default Profile. Y ou do this in one of the following scr eens: • the IP profile parameters screen (see below)[...]

3-22 Firmware User Guide • Select the map list you want to bind to this Connection Profile and pr ess Return. The map list you selected will now be bound to this Connection Profile. • Select NA T Server List and pr ess Return. A pop-up menu displays a list of your defined ser ver lists. • Select the ser ver list you want to bind to this Co[...]

Multiple Network Address T ranslation 3-23 IP Parameters (W AN Default Profile) The Netopia Fir mware V ersion 8.4 using RFC 1483 suppor ts a W AN default pr ofile that permits several parameters to be configured without an explicitly configur ed Connection Profile. The procedur e is similar to the procedure to bind map lists and ser ver lists[...]

3-24 Firmware User Guide • Select the map list you want to bind to the default profile and pr ess Return. The map list you selected will now be bound to the default profile. • Select NA T Server List and pr ess Return. A pop-up menu displays a list of your defined ser ver lists. • Select the ser ver list you want to bind to the default pro[...]

Multiple Network Address T ranslation 3-25 NA T Associations Configuration of map and ser ver lists alone is not suf ficient to enable NA T for a W AN connection because map and ser ver lists must be linked to a profile that contr ols the W AN inter face. This can be a Connection Pr ofile, a W AN Ether net inter face, a default profile, or a d[...]

3-26 Firmware User Guide • Select the list name you want to assign and press Retur n again. Y our selection will then be associated with the cor responding profile or inter face. NAT Associations +NAT Map List Name-+ Profile/Interface Name-------------Nat+------------------+Server List Name Easy Setup Profile On | Easy-PAT List |my_servers Profi[...]

Multiple Network Address T ranslation 3-27 IP P assthrough Netopia Fir mware V ersion 8.4 of fers an IP passthrough feature. The IP passthr ough feature allows for a single PC on the LAN to have the router’s public addr ess assigned to it. It also provides P A T (NAPT) via the same public IP address for all other hosts on the private LAN subnet. [...]

3-28 Firmware User Guide The IP Profile Parameters screen, found under the WAN Configuration menu, Add/Change Connection Profile screen, appears as shown. If you select NA T Options , in either case, the NA T Options screen appears. If you toggle IP Passthrough Enabled to Ye s , additional field(s) appear . IP Profile Parameters Address Transla[...]

Multiple Network Address T ranslation 3-29 T oggling IP Passthrough DHCP Enabled to Ye s displays the IP Passthr ough DHCP MAC address field. This is an editable field in which you can enter the MAC (hardwar e) address of the designated PC be used as the DHCP Client Identifier for dynamic address r eser vation. The MAC address must be six colon-[...]

3-30 Firmware User Guide A restriction Since both the router and the passthr ough host will use same IP address, new sessions that conflict with existing sessions will be rejected by the r outer . For example, suppose you are a teleworker using an IPSec tunnel from the r outer and from the passthrough host. Both tunnels go to the same remote endpo[...]

Multiple Network Address T ranslation 3-31 MultiNA T Configuration Example T o help you understand a typical MultiNA T configuration, this section describes an example of the type of configuration you may want to implement on your site. The values shown are for example purposes only . Make your own appropriate substitutions. A typical DSL ser vi[...]

3-32 Firmware User Guide Enter your ISP-supplied values as shown below . Select NEXT SCREEN and press Retur n. Y our IP values ar e shown here. Then navigate to the Network Address T ranslation (NA T) screen. Connection Profile 1: Easy Setup Profile Connection Profile Name: Easy Setup Profile Address Translation Enabled: Yes IP Addressing... Number[...]

Multiple Network Address T ranslation 3-33 Select Show/Change Public Range , then Easy-P A T Range , and press Return. Enter the value your ISP assigned for your public address (206.1.1.6, in this example). T oggle Type to pat. Y our public address is then mapped to the remaining private IP addr esses using P A T . (If you were not using the Easy-P[...]

3-34 Firmware User Guide Select ADD NA T PUBLIC RANGE and press Return. Y ou are retur ned to the Network Address T ranslation screen. Next, select Show/Change Map List and choose Easy-P A T List . Select Add Map . The Add NA T Map scr een appears. (Now the name Easy-P A T List is a misnomer since it has a static map included in its list.) Enter in[...]

Multiple Network Address T ranslation 3-35 • First, navigate to the Show/Change Map List screen, select Easy-P A T List and then Show/Change Maps . Choose the Static Map you created and change the First Private Address fr om 192.168.1.1 to 192.168.1.4. Now the Router , W eb, and Mail ser vers’ IP addr esses are no longer included in the range o[...]

3-36 Firmware User Guide[...]

Virtual Private Networks (VPNs) 4-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 4 4 4 4 V V V V ii i i r r r r t t t t u u u u a a a a ll l l P P P P r r r r ii i i v v v v a a a a t t t t e e e e N N N N e e e e t t t t w w w w o o o o r r r r k k k k s s s s ( ( ( ( V V V V P P P P N N N N s s s s ) ) ) ) The Netopia Fir mware V ersio[...]

4-2 Firmware User Guide Netopia Fir mware V ersion 8.4 can be used in VPNs either to initiate the connection or to answer it. When used in this way , the Routers are said to be tunnelling thr ough the public network (Internet). The advantages are that, like your long distance phone call, you don't need a direct line between one computer or LAN[...]

Virtual Private Networks (VPNs) 4-3 leaves the header untouched. The more secur e T unnel mode encr ypts both the header and the payload. On the receiving side, an IPsec-compliant device decr ypts each packet. The Netopia Fir mware V ersion 8.4 suppor ts the more secure Tunnel mode. DES stands for Data Encr yption Standard, a popular symmetric-key [...]

4-4 Firmware User Guide About PPTP T unnels T o set up a PPTP tunnel, you create a Connection Pr ofile including the IP address and other relevant infor mation for the remote PPTP par tner . Y ou use the same pr ocedure to initiate a PPTP tunnel that ter minates at a remote PPTP ser ver or to ter minate a tunnel initiated by a remote PPTP client. [...]

Virtual Private Networks (VPNs) 4-5 When you define a Connection Profile as using PPTP by selecting PPTP as the datalink encapsulation method, and then select Data Link Options , the PPTP T unnel Options scr een appears. • Enter the PPTP Par tner IP Addr ess . This specifies the address of the other end of the tunnel. If you do not specify the[...]

4-6 Firmware User Guide Note: Netopia Fir mware V ersion 8.4 suppor ts 128-bit (“strong”) encr yption. Unlike MS-CHAP version 1, which suppor ts one-way authentication, MS-CHAP version 2 suppor ts mutual authentication between connected gateways and is incompatible with MS-CHAP version 1 (MS-CHAP-V1). When you choose MS-CHAP as the authenticati[...]

Virtual Private Networks (VPNs) 4-7 The IP Profile Parameters scr een appears. • Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel. About IPsec T unnels IPsec stands for IP Security , a set of protocols that suppor ts secur e exchange of IP packets at the IP layer . IPsec is deployed widely to implement Vir [...]

4-8 Firmware User Guide About L2TP T unnels L2TP stands for Layer 2 T unnelling Protocol, an extension to the PPP pr otocol. L2TP combines features of two other tunneling protocols: PPTP and L2F. Like PPTP , L2TP is a Datalink Encapsulation option in Connection Profiles. It is not an option in device or link configuration scr eens, as L2TP is not[...]

Virtual Private Networks (VPNs) 4-9 When you define a Connection Profile as using L2TP by selecting L2TP as the datalink encapsulation method, and then select Encapsulation Options , the L2TP T unnel Options scr een appears. • Enter the L2TP Par tner IP Addr ess . This specifies the address of the other end of the tunnel. If you do not specify[...]

4-10 Firmware User Guide • Y ou can specify that this Router will Initiate Connections (acting as a P AC) or only answer them (acting as a PNS). • T unnels are nor mally initiated On Demand ; however , you can disable this featur e. When disabled, the tunnel must be manually established or may be scheduled using the scheduled connections featur[...]

Virtual Private Networks (VPNs) 4-11 About GRE T unnels Generic Routing Encapsulation (GRE) protocol is another for m of tunneling that Netopia routers suppor t. A GRE tunnel is brought up when a valid GRE pr ofile is installed, and brought down when the profile is disabled, or deleted. GRE tunnels are not connection-based , but rather are instal[...]

4-12 Firmware User Guide • Enter a GRE Par tner IP Addr ess in standard dotted-quad for mat to specify the address of the other end of the tunnel. • Y ou can optionally toggle Send Checksums to Ye s to verify that no data cor r uption or loss is incurr ed in transmission. Ordinarily , it is not necessar y to send checksums, and you can leave th[...]

Virtual Private Networks (VPNs) 4-13 The IP Profile Parameters scr een appears. • Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel. • Press Escape to r eturn to the Add Connection profile scr een, select COMMIT and press Retur n. Y our GRE Connection Profile will be enabled. IP Profile Parameters Addres[...]

4-14 Firmware User Guide VPN for ce-all GRE tunnelling suppor ts “VPN force-all,” which for ces all traf fic coming fr om the LAN onto the GRE tunnel. Y ou accomplish this by setting the default route to go thr ough the GRE tunnel. A secondar y host route where all tunneled GRE packets route to the actual WAN inter face can be configured as a[...]

Virtual Private Networks (VPNs) 4-15 About A TMP T unnels T o set up an A TMP tunnel, you cr eate a Connection Profile including the IP address and other r elevant infor mation for the remote A TMP par tner . A TMP uses the ter minology of a for eign agent that initiates tunnels and a home agent that ter minates them. Y ou use the same procedur e [...]

4-16 Firmware User Guide When you define a Connection Profile as using A TMP by selecting A TMP as the datalink encapsulation method, and then select Data Link Options , the A TMP T unnel Options scr een appears. Note: An A TMP tunnel cannot be assigned a dynamic IP addr ess by the remote ser ver , as in a PPP connection. When you define an A TM[...]

Virtual Private Networks (VPNs) 4-17 • Y ou can specify that this Router will Initiate Connections , acting as a foreign agent ( Ye s ), or only answer them, acting as a home agent ( No ). • T unnels are nor mally initiated On Demand ; however , you can disable this featur e. When disabled, the tunnel must be manually established through the ca[...]

4-18 Firmware User Guide MS-CHAP V2 and 128-bit strong encryption Notes: • Netopia Fir mware V ersion 8.4 suppor ts 128-bit (“strong”) encr yption when using PPTP tunnels. A TMP does not have an option of using 128-bit MPPE. If you ar e using A TMP between two Netopia Routers you can optionally set 56-bit DES encr yption. • When you choose [...]

Virtual Private Networks (VPNs) 4-19 • T oggle Answer A TMP/PPTP Connections to Ye s if you want the Router to accept VPN connections or No (the default) if you do not. • For PPTP tunnel connections only , you must define what type of authentication these connections will use. Select Receive Authentication and press Retur n. A pop-up menu of f[...]

4-20 Firmware User Guide VPN Quic kView Y ou can view the status of your VPN connections in the VPN QuickView scr een. From the Main Menu select QuickView and then VPN QuickView . The VPN QuickView screen appears. Profile Name: Lists the name of the Connection Pr ofile being used, if any . Type: Shows the data link encapsulation method (PPTP or A[...]

Virtual Private Networks (VPNs) 4-21 Dial-Up Netw orking for VPN Microsoft Windows Dial-Up Networking softwar e permits a r emote standalone workstation to establish a VPN tunnel to a PPTP ser ver such as a Netopia Router located at a central site. Dial-Up Networking also allows a mobile user who may not be connected to a P AC to dial into an inter[...]

4-22 Firmware User Guide The Communications window appears. 5. In the Communications window , select Dial-Up Networking and click the OK button. This retur ns you to the Windows Setup screen. Click the OK button. 6. Respond to the prompts to install Dial-Up Networking fr om the system disks or CDROM. 7. When prompted, r eboot your PC. Creating a ne[...]

Virtual Private Networks (VPNs) 4-23 Configuring a Dial-Up Networking profile Once you have created your Dial-Up Networking pr ofile, you configure it for TCP/IP networking to allow you to connect to the Internet thr ough your Internet connection device. Do the following: 1. Double-click the My Computer (or whatever you have named it) icon on y[...]

4-24 Firmware User Guide 4. Click the TCP/IP Settings button. • If your ISP uses dynamic IP addressing (DHCP), select the Ser ver assigned IP addr ess radio button. • If your ISP uses static IP addressing, select the Specify an IP addr ess radio button and enter your assigned IP address in the fields pr ovided. Also enter the IP address in the[...]

Virtual Private Networks (VPNs) 4-25 For PPTP negotiation to work, TCP packets inbound and outbound destined for por t 1723 must be allowed. Likewise, for A TMP negotiation to work, UDP packets inbound and outbound destined for por t 5150 must be allowed. Source por ts ar e dynamic, so, if possible, make this flexible, too. Additionally , PPTP and[...]

4-26 Firmware User Guide PPTP example T o enable a firewall to allow PPTP traf fic, you must provision the firewall to allow inbound and outbound TCP packets specifically destined for por t 1723. The source por t may be dynamic, so often it is not useful to apply a compare function upon this por tion of the control/negotiation packets. Y ou mus[...]

Virtual Private Networks (VPNs) 4-27 In the Display/Change Filter Set screen select Display/Change Output Filter . Display/Change Output Filter screen Select Output Filter 1 and press Retur n. In the Change Output Filter 1 screen, set the Protocol Type and Destination Por t infor mation as shown below . Change Input Filter 2 Enabled: Yes Forward: Y[...]

4-28 Firmware User Guide Select Output Filter 2 and press Retur n. In the Change Output Filter 2 screen, set the Protocol Type to allow GRE as shown below . A TMP example T o enable a firewall to allow A TMP traf fic, you must provision the firewall to allow inbound and outbound UDP packets specifically destined for por t 5150. The source por t[...]

Virtual Private Networks (VPNs) 4-29 Select Input Filter 1 and press Retur n. In the Change Input Filter 1 screen, set the Destination Por t infor mation as shown below . Select Input Filter 2 and press Retur n. In the Change Input Filter 2 screen, set the Protocol Type to allow GRE as shown below . Change Input Filter 1 Enabled: Yes Forward: Yes S[...]

4-30 Firmware User Guide In the Display/Change Filter Set screen select Display/Change Output Filter . Display/Change Output Filter screen Select Output Filter 1 and press Retur n. In the Change Output Filter 1 screen, set the Protocol Type and Destination Por t infor mation as shown below . Select Output Filter 2 and press Retur n. In the Change O[...]

Virtual Private Networks (VPNs) 4-31 Windows Netw orking Broadcasts Netopia fir mware provides the ability to for war d Windows Networking NetBIOS broadcasts. This is useful for , for example, a Vir tual Private Network, in which you want to be able to browse the remote network to which you ar e tunnelling, as par t of your Windows Network Neighbo[...]

4-32 Firmware User Guide Configuration for Router A Configuration for Router B IP Profile Parameters Address Translation Enabled: No Remote IP Address: 192.168.2.1 Remote IP Mask: 255.255.255.0 Filter Set... Remove Filter Set NetBIOS Proxy Enabled Yes RIP Profile Options... Enter an IP address in decimal and dot form (xxx.xxx.xxx.xxx). Configure [...]

Virtual Private Networks (VPNs) 4-33 Note: Microsoft Network br owsing is available with or without a Windows Internet Name Ser vice (WINS) ser ver . Shar ed volumes on the remote network are accessible with or without a WINS ser ver . Local LAN shared volumes that have Por t Address T ranslation (P A T) applied to them are not available to hosts o[...]

4-34 Firmware User Guide[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 5 5 5 5 II I I n n n n t t t t e e e e r r r r n n n n e e e e t t t t K K K K e e e e y y y y E E E E x x x x c c c c h h h h a a a a n n n n g g g g e e e e ( ( ( ( II I I K K K K E E E E ) ) ) ) II I I P P P P s s s s e e e e c c[...]

5-2 Firmware User Guide The advantage of using IKE is that it automatically negotiates IPsec Security Associations and enables IPsec secure communications without having to manually enter the lengthy encr yption keys at both ends of the connection. Y ou enter a human-r eadable pass phrase or shared secret English sentence, like “my dog has fleas[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-3 The Add Connection Profile scr een appears. • From the Encapsulation Type pop-up menu select IPsec . • Then select Encapsulation Options . The IPsec T unnel Options scr een appears. For Key Management you can use either IKE or Manual . If you choose Manual, skip to “IPsec Manual K[...]

5-4 Firmware User Guide • A pop-up window displays a list of IKE Phase 1 Profiles that you have configur ed. If you have not previously configured an IKE Phase 1 Pr ofile, the selection ADD PH1 PROFILE allows you to do that now . Adding an IKE Phase 1 Profile IKE Phase 1 Profiles contain the infor mation that the two ends of a tunnel use to[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-5 • The Profile Name field accepts any name of up to 16 characters. Sixteen IKE Phase 1 pr ofiles are suppor ted, since each of the potential sixteen Connection Profiles may be associated with a separate IKE Phase 1 profile. • The Mode pop-up menu allows you to choose between Main[...]

5-6 Firmware User Guide Nor mally it is not necessar y to change the settings of the items on the Advanced IKE Phase 1 Options screen. Most of these settings exist for ensuring compatibility with remote IKE implementations that may have cer tain limitations. • The Negotiation pop-up menu allows you to specify the way the device will respond to a [...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-7 • Include V endor-ID Payload toggles whether or not the Router includes the vendor-ID payload in its IKE Phase 1 messages. • Independent Phase 2 Re-keys toggles whether or not a Phase 2 re-keys requir es a Phase 1 re-key . If this item is set to Y es (the default), Phase 2 r e-keys w[...]

5-8 Firmware User Guide Selecting Delete IKE Phase 1 Profile and choosing an IKE phase 1 profile name fr om the pop-up list displays a confir mation aler t asking you to confirm that you r eally want to delete the specified IKE phase 1 profile: Ke y Management Y ou specify your IKE key management on a per-Connection Pr ofile basis. Y ou can [...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-9 A Change Connection Profile scr een is shown below . Note: The Change Connection Profile scr een will of fer dif ferent options, depending on the model of gateway you are using. Y ou can associate an IPsec profile with the Primar y , the Backup, or choose to apply it to Any Por t of t[...]

5-10 Firmware User Guide The Key Management pop-up menu at the top of the IPsec T unnel Options screen allows you to choose between IKE key management (the default for a new IPsec profile) and Manual key management. If you select Manual , the IKE Phase 1 Profile option does not display , and you must enter your IPsec Manual Keys under the IPsec M[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-11 • The ESP Authentication T ransform pop-up menu (which is visible only if you have selected ESP or AH+ESP encapsulation) allows you to specify the type of ESP authentication: None, HMAC-MD5-96, or HMAC-SHA1–96. Advanced IPsec Options If you select Advanced IPsec Options , the Advanc[...]

5-12 Firmware User Guide • Maximum Packet Size per mits you to modify the MTU setting for the tunnel. Some ISPs require a setting of e.g. 1492 (or other value). The default 1500 is the most common and you usually don’t need to change this unless other wise instr ucted. Accepted values are from 100 – 1500. This is the star ting value that is u[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-13 The defaults are 5 seconds and 90 seconds, r espectively . Y ou may adjust these to suit your network’s tolerances. Note: • ICMP Dead Peer Detection is not available when using manual re-keying. • ICMP Dead Peer Detection does not initiate a series of phase 2 exchanges upon detect[...]

5-14 Firmware User Guide Advantages of Multiple Network IPsec are: • scalability • flexibility , by adding any combination of remote/local network ranges • suppor t for sub-netting, host and network range addressing modes • works with manual keying and Internet Key Exchange (IKE) • each IPsec network works under the same local/remote tun[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-15 Last Address . Y ou supply these values. Complete the Local Member 1st Address and Local Member Last Addr ess fields. • If you choose Host Address , you need only supply the Remote Member Addr ess and the Local Mem- ber Address ; the other fields ar e hidden. • Select COMMIT and p[...]

5-16 Firmware User Guide • Scroll down and up with the ar row keys to select the one you want to change, and pr ess Return. Y ou will be retur ned to the Network Configuration screen where you can make any r equired changes. • If you select Delete Network in the IP Profile Parameters screen, the same scr olling list will display . When you se[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-17 • Specifying IKE key management alters the Advanced IP Profile Options screen as follows: • Y ou can specify a Local Tunnel Endpoint Address . If not 0.0.0.0, this value must be one of the assigned inter face addresses, either WAN or LAN. This is used as the source address of all I[...]

5-18 Firmware User Guide IPsec W AN Configuration Screens Y ou can also configur e IKE Phase 1 Profiles in the W AN Configuration menus. The W AN Configuration screen now includes IKE Phase 1 Configuration as shown: Select IKE Phase 1 Configuration and press Retur n. The IKE Phase 1 Configuration screen appears. W AN Conf iguration Main Men[...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-19 The IKE Phase 1 Configuration screen allows configuration of global (non-connection-pr ofile-specific) IPsec parameters. This screen allows you to Display , Change, Add, or Delete an IKE Phase 1 pr ofile. IPsec Manual K ey Entry The V ersion 7.0.2 fir mware has a redesigned layout[...]

5-20 Firmware User Guide Select IPsec Manual Keys and press Retur n. Depending on your selections of Encapsulation, Encr yption T ransfor m, and Authentication T ransfor m in the IPsec T unnel Options screen, the IPsec Manual Keys scr een will display dif fering entr y fields to enter authorization keys and encr yption keys. With Manual Keys, you [...]

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-21 If the remote tunnel end point is a hostname (or “0.0.0.0”) 0.0.0.0 is displayed until a Security Association is established. Previously the r emote members network was displayed. W AN Event History Error Reporting The following events are logged and displayed in the WAN Event Histo[...]

5-22 Firmware User Guide IKE: no matching ph2 proposal Either the local Router rejected the pr oposals of the remote or the r emote rejected the local Router’s. IKE: ph2 resend timeout The attempt to resend the phase 2 authentication timed out. IKE: phase 2 complete The phase 2 negotiation completed successfully . Event message: Meaning:[...]

IP Setup 6-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 6 6 6 6 II I I P P P P S S S S e e e e t t t t u u u u p p p p The Netopia Fir mware V ersion 8.4 uses Inter net Protocol (IP) to communicate both locally and with remote networks. This chapter shows you how to configure the gateway to r oute IP traf fic. Y ou also learn how to [...]

6-2 Firmware User Guide IP Setup The IP Setup options screen is wher e you configure the Ethernet side of the Router. The infor mation you enter here contr ols how the gateway routes IP traf fic. Consult your network administrator or ISP to obtain the IP setup infor mation (such as the Ethernet IP address, Ethernet subnet mask, default IP gateway[...]

IP Setup 6-3 The Netopia Fir mware V ersion 8.4 suppor ts multiple IP subnets on the Ether net inter face. Y ou may want to configure multiple IP subnets to ser vice mor e hosts than are possible with your primar y subnet. It is not always possible to obtain a lar ger subnet from your ISP . For example, if you already have a full Class C subnet, y[...]

6-4 Firmware User Guide that the addresses distributed by the Router and those that ar e manually configured are not the same. Each method of distribution must have its own exclusive range of addresses to draw fr om. IP subnets The IP Subnets screen allows you to configur e up to eight Ethernet IP subnets on unlimited-user models, one “primar y[...]

IP Setup 6-5 For example: • T o delete a configured subnet, set both the IP addr ess and subnet mask values to 0.0.0.0, either explicitly or by clearing each field and pressing Retur n to commit the change. When a configured subnet is deleted, the values in subsequent rows adjust up to fill the vacant fields. The subnets configured on this [...]

6-6 Firmware User Guide If you have configured multiple Ether net IP subnets, the IP Setup screen changes slightly: The IP address and Subnet mask items ar e hidden, and the Define Additional Subnets... item becomes Subnet Configuration... . If you select Subnet Configuration , you will retur n to the IP Subnets screen that allows you to defin[...]

IP Setup 6-7 The Static Routes screen will appear . Viewing static r outes T o display a view-only table of static routes, select Display/Change Static Route . The table shown below will appear . The table has the following columns: Dest. Network: The network IP address of the destination network. Static Routes Display/Change Static Route... Add St[...]

6-8 Firmware User Guide Subnet Mask: The subnet mask associated with the destination network. Next Gateway: The IP address of the gateway that will be used to r each the destination network. Priority: An indication of whether the Router will use the static route when it conflicts with infor mation received from RIP packets. Enabled: An indication [...]

IP Setup 6-9 • T o make sure that the static r oute is known only to the Router, select Adver tise Route V ia RIP and toggle it to No . T o allow other RIP-capable gateways to know about the static route, select Adver tise Route Via RIP and toggle it to Ye s . When Adver tise Route Via RIP is toggled to Ye s , a new item called RIP Metric appears[...]

6-10 Firmware User Guide RIP-2 MD5 A uthentication Fir mware version 5.3.7 suppor ts RIP-2 MD5 Authentication (RFC2082 Routing Internet Pr otocol V ersion 2, Message Digest 5). The purpose of MD5 authentication is to provide an additional level of confidence that a RIP packet received was generated by a r eliable source. In other words, MD5 authen[...]

IP Setup 6-11 • Select RIP Options . The Ethernet LAN RIP Options scr een appears. • Select Receive RIP , and fr om the pull-down menu choose v2 MD5 Authentication . IP Setup Ethernet IP Address: 192.168.1.1 Ethernet Subnet Mask: 255.255.255.0 Define Additional Subnets... Default IP Gateway: 0.0.0.0 Backup IP Gateway: 0.0.0.0 Primary Domain Nam[...]

6-12 Firmware User Guide • Y ou can also select Transmit RIP , and choose v2 MD5 (br oadcast) or v2 MD5 (multicast) from the pull-down menu. • RIP v2 Authentication Keys is visible only if v2 MD5 Authentication is enabled for either Receive or T ransmit RIP . Note: • All of the changes on this menu requir e a reboot. This is unique to the Eth[...]

IP Setup 6-13 • Select RIP v2 Authentication Keys . The RIP v2 Authentication Keys screen appears. Adding a key Select Add Key . The Add Key Screen appears. • The key identifier Key ID can be any numeric value from 0 – 255, and must be unique per inter face. Y ou can not have two keys with the same key ID on an inter face. • The Authentica[...]

6-14 Firmware User Guide • The Star t Date and End Date for mats are deter mined by the System Date For mat, set on the Set Date and Time menu under the System Configuration menus. • The Star t T ime and End Time formats ar e determined by the System Time For mat. The AM or PM pull-down menus do not appear if the time for mat is 24 hour time. [...]

IP Setup 6-15 Connection Profiles and Default Profile RIP-2 MD5 authentication may be configured in Connection Pr ofiles, as well. If you are not using NA T , your public Internet connection can benefit fr om sending authenticated RIP packets as well as receiving them. T o configure RIP-2 MD5 authentication for a Connection Profile, you can [...]

6-16 Firmware User Guide • Receive RIP is always visible. Here you select Of f, v1, v2, Both v1 and v2, or v2 MD5 Authentication from the pull-down menu. For MD5 authentication, you must select v2 MD5 Authentication . • If NA T is disabled, Transmit RIP is visible. Here you select Of f, v1, v2 (broadcast), v2 (multicast), v2 MD5 (broadcast), or[...]

IP Setup 6-17 IP Address Serving In addition to being a gateway , the Router is also an IP address ser ver . Ther e are three pr otocols it can use to distribute IP addresses. • The first, called Dynamic Host Configuration Protocol (DHCP), is widely suppor ted on PC networks, as well as Apple Macintosh computers using Open T ranspor t and compu[...]

6-18 Firmware User Guide Follow these steps to configure IP Addr ess Ser ving: • If you enabled IP Address Ser ving, then DHCP , BootP clients and Dynamic W AN clients are automatically enabled. • The IP Address Ser ving Mode pop-up menu allows you to choose the way in which the Router will ser ve IP addresses. The device can act as either a D[...]

IP Setup 6-19 If you have configured multiple Ether net IP subnets, the appearance of the IP Address Ser ving screen is alter ed slightly: Three menu items ar e hidden, and Configure Address Pools... appears instead. If you select Configure Address Pools... you will be taken to the IP Addr ess Pools screen that allows you to configure an addr e[...]

6-20 Firmware User Guide IP Address Pools The IP Address Pools scr een allows you to configure a separate IP address ser ving pool for each of up to eight configured Ether net IP subnets: This screen consists of between two and eight r ows of four columns each. There are exactly as many r ows as there ar e Ethernet IP subnets configured on the I[...]

IP Setup 6-21 Numerous factors influence the choice of ser ved addr ess. It is dif ficult to specify the address that will be ser ved to a par ticular client in all circumstances. However , when the address ser ver has been configur ed, and the clients involved have no prior address ser ving interactions, the Router will generally ser ve the fi[...]

6-22 Firmware User Guide • T o ser ve DHCP clients with the type of NetBIOS used on your network, select Serve NetBIOS Type and toggle it to Ye s . • From the NetBIOS Type pop-up menu, select the type of NetBIOS used on your network. • T o ser ve DHCP clients with the NetBIOS scope, select Serve NetBIOS Scope and toggle it to Ye s . Select Ne[...]

IP Setup 6-23 Select NetBIOS Name Ser ver IP Addr and enter the IP address for the NetBIOS name ser ver . Y ou ar e now finished setting up DHCP NetBIOS Options. T o return to the IP Addr ess Ser ving screen, press Escape. • T o enable BootP’s address ser ving capability , select Ser ve BOOTP Clients and toggle to Ye s . Note: Addresses assign[...]

6-24 Firmware User Guide • The ability to view the host name associated with a client to which the gateway has leased an IP address. • The ability for the gateway’s Ethernet IP addr ess(es) to overlap the DHCP address ser ving pool(s). • The ability to ser ve as a DHCP Relay Agent. The Netopia Fir mware V ersion 8.4 suppor ts reser ving an [...]

IP Setup 6-25 Y ou can select the entries in the Ser ved IP Addr esses screen. Use the up and down ar row keys to move the selection to one of the entries in the list of ser ved IP addresses. Once you select an entr y , pressing Retur n displays an action pop-up menu that lists operations that can be per for med on that entr y . Possible operations[...]

6-26 Firmware User Guide Selecting Details… displays a pop-up menu that provides additional infor mation associated with the IP address. The pop-up menu includes the IP addr ess as well as the host name and client identifier supplied by the client to which the address is leased. • Exclude is displayed if the entr y is not already excluded. Sel[...]

IP Setup 6-27 An IP address is marked declined when a client to whom the DHCP ser ver of fers the address declines the address. A client declines an addr ess if it determines that a leased addr ess is already in use by another device. Selecting Include restor es the selected IP address to the address ser ving pool so that the IP address is once aga[...]

6-28 Firmware User Guide DHCP Rela y Ag ent The Netopia Fir mware V ersion 8.4 of fers DHCP Relay Agent functionality , as defined in RFC1542. A DHCP relay agent is a computer system or a gateway that is configured to for war d DHCP requests from clients on the LAN to a remote DHCP ser ver , and to pass the replies back to the r equesting client [...]

IP Setup 6-29 Select IP Address Ser ving and press Retur n. The IP Address Ser ving screen appears. Select IP Address Ser ving Mode . The pop-up menu of fers the choices of Disabled , DHCP Ser ver (the default), and DHCP Relay Agent . If you select DHCP Relay Agent and press Retur n, the screen changes as shown below . Main Menu System Conf igurati[...]

6-30 Firmware User Guide Now you can enter the IP address(es) of your r emote DHCP ser ver(s), such as might be located in your company’s corporate headquar ters. Each time you enter an IP address and press Retur n, an additional field appears. Y ou can enter up to four DHCP ser ver addr esses. In the example above, DHCP requests fr om clients o[...]

IP Setup 6-31 The Add Connection Profile scr een appears. On a Router you can add up to 15 more connection pr ofiles, for a total of 16, although only one can be used at a time, unless you are using VPNs. 1. Select Profile Name and enter a name for this connection pr ofile. It can be any name you wish. For example: the name of your ISP . 2. T o[...]

6-32 Firmware User Guide 4. T oggle or enter any IP parameters you requir e and return to the Add Connection Pr ofile screen by pressing Escape. For more infor mation on NA T , see “Multiple Network Address Translation,” beginning on page 3-1 . The Local W AN IP Address is displayed for number ed or NA T pr ofiles. The Local W AN IP Mask is d[...]

IP Setup 6-33 Multicast Forwar ding Multicast is a method for transmitting lar ge amounts of information to many , but not all, hosts over an Internet. One common use is to distribute real time audio and video to the set of hosts which have joined a distributed conference. Multicast is similar to radio or TV broadcasts in the sense that only those [...]

6-34 Firmware User Guide Typically , you will have a Connection Profile that you cr eated in Easy Setup. Y ou may have mor e. Select the Connection Profile that you want to use fr om the Display/Change Connection Profile menu, and then select IP Profile Parameters . By default, Multicast For warding is tur ned of f (None) on Connection Pr ofil[...]

Line Backup 7-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 7 7 7 7 L L L L ii i i n n n n e e e e B B B B a a a a c c c c k k k k u u u u p p p p Netopia Fir mware V ersion 8.4 of fers line backup functionality in the event of a line failure on the primar y W AN link: • to an internal V .92 modem (suppor ted models) or • to a backu[...]

7-2 Firmware User Guide • the Backup IP Gateway menu item in the IP Setup screen under the System Configuration menu Here you enter a Backup Gateway IP addr ess. See “ IP Setup” on page 7-7 . Alter natively , you can choose a dif ferent backup gateway device; see “Backup Default Gateway” on page 7-14 . Detailed descriptions follow . Conn[...]

Line Backup 7-3 Assuming you selected PPP , new fields appear . Underlying Encapsulation and PPP Mode do not usually need to be changed for a PPP connection. • From the Inter face Gr oup pull-down menu, select Backup . • Select Encapsulation Options . Add Connection Profile Profile Name: Profile 1 Profile Enabled: +-------------+ +------------[...]

7-4 Firmware User Guide The Datalink (PPP/MP) Options screen appears. • Data Compression should r emain set to Standard LZS. • Usually , you use PA P Authentication, with a dial-up connection, but you can also use CHAP , or None . For P AP Authentication, you enter your User Name and Password , and a User Name and Passwor d for authorization of[...]

Line Backup 7-5 • Select IP Profile Parameters . The IP Profile Parameters scr een appears. • Unless other wise instr ucted, accept the defaults, except the following: • Set Remote IP Address to 127.0.0.2. • Set Remote IP Mask to 255.255.255.0. These allow your ISP to supply your IP address and subnet mask when you connect via dial-up. Pr[...]

7-6 Firmware User Guide • From the Dial pop-up menu, you can choose whether to Dial Out Only , Dial In Only , or Dial In/Out (default). • Dialing Prefix : If you ar e connected to a Centrex or PBX phone system that requir es you to dial a prefix number (such as “9” for an outside line), enter it here. • Y ou can add the Number to Dial a[...]

Line Backup 7-7 IP Setup Here, you set the IP addr ess of the alternate gateway . Navigate to the IP Setup screen under the System Configuration menu. • Set Backup IP Gateway to 127.0.0.2. • Set Secondar y Domain Name Server to the IP Address DNS of your dial-up ISP . For infor mation about the Backup Default Gateway option, see “Backup Defa[...]

7-8 Firmware User Guide W AN Configuration T o configure the modem characteristics, fr om the Main Menu select W AN Configuration and then W AN Setup . The Choose Inter face to Configur e screen appears. These settings govern the general modem behavior . WA N W AN Conf iguration Main Menu Setup WAN Configuration WAN (Wide Area Network) Setup...[...]

Line Backup 7-9 Choose the inter face to configure for backup, MODEM (W an Module 2) Setup . The Internal Modem Setup scr een appears. • Modem Dialing Prefix : A TDT is the standard Hayes-compatible code for aler ting the modem itself. Y ou probably don’t need to change this, unless you have a good r eason and are familiar with the Hayes mode[...]

7-10 Firmware User Guide Bac kup Configuration screen Navigate to the Backup Configuration screen. This screen is used to configur e the conditions under which backup will occur , if it will recover, and how the modem is configured. For the internal V .92 modem, the Backup Configuration scr een appears as follows, when all options are enabled [...]

Line Backup 7-11 has gone down. Should this address become unr eachable the router will treat this as a loss of connectivity and begin the backup timer . This loss is a Layer 2 loss. Note: For best results, enter an IP addr ess and not a host name. If a host name is used it may not be resolvable, and may keep the inter face down. Set the Ping Host [...]

7-12 Firmware User Guide Using Scheduled Connections with Bac kup The backup link is a PPP dial-up connection and only connects to the Internet ser vice pr ovider when traf fic is initiated from the LAN. If you want to use the backup link to pr ovide redundancy for ser vices, such as a W eb ser vice that you provide to the outside world, you must [...]

Line Backup 7-13 • T oggle Scheduled Connection Enable to On . • From the How Often pop-up menu, select Weekly and press Return. • From the Schedule Type pop-up menu, accept the default Forced Up and press Retur n. • Select Set W eekly Schedule , and press Retur n. The Set Weekly Schedule screen appears. • T oggle all the days of the week[...]

7-14 Firmware User Guide • Select Use Connection Profile , and press Retur n. A screen displays all of your Connection Pr ofiles. Select the one you want to apply this scheduled connection to and press Retur n. Y our selection becomes ef fective. Now , if your primar y W AN link fails, the backup link will become active and r emain active until[...]

Line Backup 7-15 The Backup Configuration screen appears. This screen is used to configur e the conditions under which backup will occur , if it will recover, and how the alternate gateway is configur ed. • Select Backup is and press Retur n. A pop-up menu allows you to select Disabled, Manual, or Automatic. Y ou enable backup by selecting eit[...]

7-16 Firmware User Guide IP Setup screen T o configure the backup gateway , fr om the Main Menu select System Configuration then IP Setup . The IP Setup screen appears. The IP Setup screen per mits entr y of a backup IP gateway address. This field is always visible, even if the Default IP Gateway field is not filled out, as in the case of a DH[...]

Line Backup 7-17 Bac kup Management/Statistics If backup is enabled, the Statistics & Logs menu of fers a Backup Management/Statistics option. T o view Backup Management/Statistics, from the Main Menu select Statistics & Logs then Backup Management/Statistics and press Retur n. The Backup Management/Statistics screen appears. • Current Ga[...]

7-18 Firmware User Guide During recover y , the following r easons may appear: • Time Since Detection is a display-only field that is only visible if backup or recover y is in pr ogress. It displays the elapsed time since detection of either W AN line failure or r e-establishment of the connection. • Switchover Time displays how high the Time [...]

Monitoring T ools 8-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 8 8 8 8 M M M M o o o o n n n n ii i i t t t t o o o o r r r r ii i i n n n n g g g g T T T T o o o o o o o o ll l l s s s s This chapter discusses the Router’s device and network monitoring tools. These tools can provide statistical infor mation, repor t on cur rent ne[...]

8-2 Firmware User Guide General status Current Date: The cur rent date; this can be set with the Date and Time utility (see “Date and time” on page 2-29 ). Default IP Gateway: The gateway’s default gateway , which may be either manually configured or lear ned via DHCP . This is the value you assigned in the Default IP Gateway field. If you [...]

Monitoring T ools 8-3 Current status The cur rent status section is a table showing the cur rent status of the DSL connection. For example: Profile Name: Lists the name of the connection pr ofile being used, if any . Rate: Shows the line rate for this connection. %Use: Indicates the average percent utilization of the maximum capacity of the chann[...]

8-4 Firmware User Guide Statistics & Logs When you are tr oubleshooting your Router, the Statistics & Logs screens provide insight into the r ecent event activities of the gateway . From the Main Menu go to Statistics & Logs and select one of the options described in the sections below . Event Histories The Netopia Fir mware V ersion 8.[...]

Monitoring T ools 8-5 W AN Event History The W AN Event Histor y screen lists a total of 128 events on the WAN. The most recent events appear at the top. Each entr y in the list contains the following infor mation: Date: Date of the event. Time: Time of the event. Event: A brief description of the event. Ch.: The channel involved in the event. The [...]

8-6 Firmware User Guide In the Statistics & Logs screen, select Device Event Histor y . The Device Event Histor y screen appears. If the event histor y exceeds the size of the screen, you can scr oll through it by using SCROLL UP and SCROLL DOWN. T o scroll up, select SCROLL UP at the top of the list and press Retur n. T o scroll down, select S[...]

Monitoring T ools 8-7 IP Routing T able The IP routing table displays all of the IP r outes curr ently known to the Router. The routing table scr een represents a snapshot of the r outing table information at the time the scr een is first invoked. T o take a new snapshot, select Update at the bottom of the screen and press Retur n. General Statist[...]

8-8 Firmware User Guide Physical Interface The top left side of the screen lists total packets r eceived and total packets transmitted for the following data por ts: • Ethernet • DSL Network Interface The bottom left side of the screen lists total packets r eceived and total packets transmitted: • IP (IP packets on the Ethernet) The right sid[...]

Monitoring T ools 8-9 System Inf ormation The System Infor mation screen gives a summar y view of the general system level values in the Router. From the Statistics & Logs menu select System Information . The System Infor mation screen appears. The infor mation display varies by model, firmwar e version, feature set, and so on. Y ou can tell a[...]

8-10 Firmware User Guide Simple Netw ork Management Protocol (SNMP) The Netopia Fir mware V ersion 8.4 includes a Simple Network Management Protocol (SNMP) agent, allowing monitoring and configuration by a standard SNMP manager . Netopia Routers now suppor t SNMP-V1 and SNMP-V2c. SNMP Heartbeat T rap Netopia Fir mware V ersion 8.4 implements a new[...]

Monitoring T ools 8-11 The SNMP Setup screen From the Main Menu, select SNMP in the System Configuration screen and pr ess Return. The SNMP Setup screen appears. Follow these steps to configure the first thr ee items in the screen: 1. Select System Name and enter a descriptive name for the Router’s SNMP agent. 2. Select System Location and ent[...]

8-12 Firmware User Guide Community strings The Read-Only Community String and the Read/W rite Community String are like passwords that must be used by an SNMP manager quer ying or configuring the Netopia Fir mware V ersion 8.4. An SNMP manager using the Read-Only Community String can examine statistics and configuration infor mation from the gate[...]

Monitoring T ools 8-13 T o go to the IP T rap Receivers screen, select IP Trap Receivers . The IP T rap Receivers scr een appears. Setting the IP trap receivers 1. Select Add IP Trap Receiver . 2. Select Receiver IP Address or Domain Name . Enter the IP address or domain name of the SNMP manager you want to receive the trap. 3. Select Community Str[...]

8-14 Firmware User Guide[...]

Security 9-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 9 9 9 9 S S S S e e e e c c c c u u u u r r r r ii i i t t t t y y y y The Netopia Fir mware V ersion 8.4 provides a number of security featur es to help protect its configuration screens and your local network fr om unauthorized access. Although these features are optional, it i[...]

9-2 Firmware User Guide T elnet Tiered Access – T w o P assw or d Levels Netopia Fir mware V ersion 8.4 of fers tiered access control for gr eater security and protection against accidental or malicious misconfiguration. Ser vice providers and network administrators can now limit the access of other users to the various configuration screens to[...]

Security 9-3 PCs using UPnP can retrieve the Gateway’s WAN IP address, and automatically create NA T por t maps. This means that applications that suppor t UPnP , and ar e used with a UPnP-enabled Netopia Gateway , will not need application layer gateway suppor t on the Netopia Gateway to work through NA T . Y ou can disable UPnP , if you are not[...]

9-4 Firmware User Guide Limited user configuration The Add Access Name/Password and Show/Change Access Name/Passwor ds screens allow you to select which configuration features a limited (non-Super user) user can access. From the Security Options scr een, select Add Access Name/Password . The Add Access Name/Passwor d screen appears. • Assign a [...]

Security 9-5 Y ou can toggle the default user privileges for each user . The defaults ar e set to minimize the possibility of an individual user inadver tently damaging the W AN connection. Exercise caution in assigning privileges other than these defaults to limited users. Access Privilege Default W AN Data Configuration No Connection Profile Co[...]

9-6 Firmware User Guide Advanced Security Options The Advanced Security Options screen allows you to configur e the global access privileges of users authenticated via a RADIUS ser ver or a T ACACS+ ser ver . From the Security Options scr een, select Advanced Security Options . The Advanced Security Options scr een appears. RADIUS server authentic[...]

Security 9-7 Since authentication via RADIUS ser ver is, by definition, authentication of remote users, the WAN-related defaults are pr eset to Y es. T oggle any that should be changed. Access Privileges (Custom) WAN Data Configuration: Yes Connection Profile Configuration: Yes Circuit (PVC/DLCI) Configuration: Yes LAN Data Configuration: Yes LAN [...]

9-8 Firmware User Guide T ACACS+ server authentication Netopia Fir mware V ersion 8.4 suppor ts T ACACS+ ser ver authentication. Its application to a Netopia Router is to control access to the Router’s management inter face, and to audit commands submitted by a user . T ACACS (T er minal Access Controller Access Contr ol System) protocol provides[...]

Security 9-9 Selecting this option displays the Change Access Password scr een. When changing a password, you will be challenged to enter it again to be sur e you have entered it cor rectly . User menu differences Menus reflect the security access level of the user . Consequently , configuration menus will display dif fering options based upon th[...]

9-10 Firmware User Guide • All users have access to System Configuration, Quick Menus, and Quick View , but limited users have only limited access to configuration elements in their descendant menus. • Configuration screen elements to which configuration access is forbidden ar e usually hidden. • The Quick Menus screen r eflects the secu[...]

Security 9-11 W AN Configuration screens If a limited user is allowed W AN, Connection Pr ofile, or PVC configuration access, the W AN Configuration option in the Main Menu is visible. If a limited user selects W AN Configuration in the Main Menu, the W AN Configuration screen displays its configuration options accor ding to the following di[...]

9-12 Firmware User Guide Connection Profiles The Super user can disallow limited user access to a par ticular Connection Profile. When adding a Connection Profile in the Add Connection Pr ofile screen the Super user can toggle the Superuser Accessible Only option to Ye s or No . This option is visible whether or not there ar e authorized userna[...]

Security 9-13 Note: Network Address Translation (NA T) is displayed in this screen in order to make access control simpler . Security becomes Change Access Passwor d for non-Super users, and provides access to the associated menu described previously . IP Setup menu In the IP Setup menu, users that do not have LAN Subnet Configuration access will [...]

9-14 Firmware User Guide Utilities & Diagnostics menu Based on access level, the Utilities & Diagnostics menu displays its configuration options according to the following diagram: Statistics & Logs menu The Statistics & Logs menu shown below is a composite of all the possible options on all Netopia gateways suppor ted by the fir [...]

Security 9-15 Quick Menus Quick Menus var y considerably between models, features, and access levels. The following is an example comparison of the Quick Menu as seen by the Super user and by a Limited user . Note: Console Configuration is always visible. A TM Circuits Configuration menu Y ou select A TM Circuits Configuration fr om the W AN Con[...]

9-16 Firmware User Guide The A TM Cir cuits Configuration menu screen appears as follows: Note: Multiple A TM cir cuit configuration is suppor ted on multiple A TM-capable gateways. Although some of the parameters of the Circuit Configuration scr eens per tain to V oice and Connection Profiles, it is assumed that if the user has been granted PV[...]

Security 9-17 About Filters and Filter Sets Security should be a high priority for anyone administering a network connected to the Internet. Using packet filters to control network communications can gr eatly improve your network’s security . The Netopia Fir mware V ersion 8.4’s packet filters are designed to pr ovide security for the Interne[...]

9-18 Firmware User Guide Filter priority Continuing the customs inspectors analogy , imagine the inspectors lined up to examine a package. If the package matches the first inspector’s criteria, the package is either rejected or passed on to its destination, depending on the first inspector’s par ticular orders. In this case, the package is ne[...]

Security 9-19 • Blocks (discards) the packet • Ignores the packet A filter for wards or blocks a packet only if it finds a match after applying its criteria. When no match occurs, the filter ignores the packet. A filtering rule The criteria are based on infor mation contained in the packets. A filter is simply a r ule that prescribes cer t[...]

9-20 Firmware User Guide Port number comparisons A filter can also use a comparison option to evaluate a packet’s source or destination por t number . The comparison options are: No Compare: No comparison of the por t number specified in the filter with the packet’s por t number . Not Equal T o: For the filter to match, the packet’s por t[...]

Security 9-21 Putting the parts together When you display a filter set, its filters are displayed as r ows in a table: The table’s columns cor respond to each filter’s attributes: #: The filter’s priority in the set. Filter number 1, with the highest priority , is first in the table. Source IP Addr: The packet sour ce IP address to match[...]

9-22 Firmware User Guide Filtering example #1 Returning to our filtering r ule example fr om above (see page 9-19 ), look at how a rule is translated into a filter. Star t with the r ule, then fill in the filter’s attributes: 1. The r ule you want to implement as a filter is: Block all T elnet attempts that originate from the r emote host 19[...]

Security 9-23 This filter blocks any packets coming from a r emote network with the IP network address 200.233.14.0. The 0 at the end of the address signifies any host on the class C IP network 200.233.14.0. If, for example, the filter is applied to a packet with the source IP addr ess 200.233.14.5, it will block it. In this case, the mask, whic[...]

9-24 Firmware User Guide • That which is not expressly per mitted is prohibited. It is strongly r ecommended that you take the latter , and safer , approach to all of your filter set designs. W orking with IP Filters and Filter Sets This section covers IP filters and filter sets. T o work with filters and filter sets, begin by accessing the [...]

Security 9-25 Adding a filter set Y ou can cr eate up to eight dif fer ent custom filter sets. Each filter set can contain up to 16 output filters and up to 16 input filters. T o add a new filter set, select Add Filter Set in the Filter Sets screen and press Retur n. The Add Filter Set screen appears. Naming a new filter set All new filter [...]

9-26 Firmware User Guide Adding filters to a filter set There ar e two kinds of filters you can add to a filter set: input and output. Input filters check packets received from the Inter net, destined for your network. Output filters check packets transmitted from your network to the Internet. Packets in the Netopia Firmware V ersion 8.4 pass[...]

Security 9-27 Note: There ar e two groups of items in this screen, one for input filters and one for output filters. In this section, you’ll learn how to add an input filter to a filter set. Adding an output filter works exactly the same way , providing you keep the dif ferent sour ce and destination perspectives in mind. 1. T o add a filte[...]

9-28 Firmware User Guide 3. If you want the filter to for ward packets that match its criteria to the destination IP addr ess, select For ward and toggle it to Ye s . If For war d is toggled to No , packets matching the filter’s criteria will be discarded. 4. Select Source IP Address and enter the sour ce IP address this filter will match on. [...]

Security 9-29 Deleting filters T o delete a filter , select Delete Input Filter or Delete Output Filter in the Display/Change Filter Set screen to display a table of filters. Select the filter from the table and pr ess Return to delete it. Press Escape to exit the table without deleting the filter . Moving filters T o reor ganize the filters[...]

9-30 Firmware User Guide Basic Firewall blocks undesirable traf fic originating from the WAN (in most cases, the Internet), but for wards all traf fic originating from the LAN. It follows the conser vative “that which is not expressly per mitted is prohibited” approach: unless an incoming packet expr essly matches one of the constituent input[...]

Security 9-31 Output filter 1: This filter for wards all outgoing traf fic to make sure that no outgoing connections from the LAN are blocked. Basic Firewall is suitable for a LAN containing only client hosts that want to access ser vers on the WAN, but not for a LAN containing ser vers providing ser vices to clients on the WAN. Basic Firewall?[...]

9-32 Firmware User Guide FTP sessions. T o allow W AN-originated FTP sessions to a LAN-based FTP ser ver with the IP address a.b.c.d (cor responding to a numbered IP addr ess such as 163.176.8.243), inser t the following input filter ahead of the cur rent input filter 1: • Enabled: Y es • For ward: Y es • Source IP Addr ess: 0.0.0.0 • Sou[...]

Security 9-33 The new filterset screen appears as follows: T o use the policy-based routing featur e, you create a filter that for wards the traf fic. • T oggle For ward to Ye s . This will display the For ce Routing options. • T oggle Force Routing to Ye s . • Enter the Gateway IP Address in standar d dotted-quad notation to which the tra[...]

9-34 Firmware User Guide Note: Default For warding Filter If you create one or mor e filters that have a matching action of for war d , then action on a packet matching none of the filters is to block any traf fic. Therefor e, if the behavior you want is to force the routing of a cer tain type of packet and pass all others thr ough the nor mal r[...]

Security 9-35 Firewall T utorial General firewall terms Filter rule : A filter set is comprised of individual filter r ules. Filter set : A grouping of individual filter r ules. Firewall : A component or set of components that r estrict access between a protected network and the Internet, or between two networks. Host : A workstation on the net[...]

9-36 Firmware User Guide Example TCP/UDP Ports Firewall design rules There ar e two basic rules to fir ewall design: • “What is not explicitly allowed is denied.” and • “What is not explicitly denied is allowed.” The first r ule is far more secure, and is the best appr oach to firewall design. It is far easier (and more secur e) to a[...]

Security 9-37 and a packet goes through these r ules destined for FTP , the packet would for ward through the first filter r ule (WWW), match the second r ule (FTP), and the packet is allowed through. Even though the next r ule is to deny all FTP traf fic, the FTP packet will never make it to this rule. Binary representation It is easiest when d[...]

9-38 Firmware User Guide Established connections The TCP header contains one bit called the ACK bit (or TCP Ack bit). This ACK bit appears only with TCP , not UDP . The ACK bit is par t of the TCP mechanism that guarantees the deliver y of data. The ACK bit is set whenever one side of a connection has received data fr om the other side. Only the ?[...]

Security 9-39 Example network Example filters Example 1 Incoming packet has the source addr ess of 200.1.1.28 Less Than or Equal Any por t less than or equal to the por t defined Equal Matches only the por t defined Greater Than or Equal Matches the por t or any por t greater Greater Than Matches anything greater than the por t defined Filter R[...]

9-40 Firmware User Guide This incoming IP packet has a source IP addr ess that matches the network address in the Source IP Addr ess field (00000000) in the Netopia Fir mware V ersion 8.4. This will not for ward this packet. Example 2 Incoming packet has the source addr ess of 200.1.1.184. This incoming IP packet (10000000) has a source IP addr es[...]

Security 9-41 Since the Source IP Network Addr ess in the Router is 01100000, and the source IP address after the logical AND is 1011000, this r ule does not match and this packet will be for warded. Example 4 Incoming packet has the source addr ess of 200.1.1.104. Since the Source IP Network Addr ess in the Router is 01100000, and the source IP ad[...]

9-42 Firmware User Guide Since the Source IP Network Addr ess in the Router is 01100000, and the source IP address after the logical AND is 01100000, this r ule does match and this packet will not be for warded. This r ule masks of f a single IP address. Configuration Management Netopia Fir mware V ersion 8.4 of fers a Configuration Management fe[...]

Security 9-43 Select Save Current Configuration as , and press Retur n. The Save Cur rent Configuration screen appears. Enter a descriptive name for your cur rent configuration, select SA VE , and press Retur n. Y our configuration will be saved to the flash memor y , and you will be retur ned to the Configuration Management screen. If you ch[...]

9-44 Firmware User Guide A warning scr een will ask you to confirm your choice. TFTP Y ou can also send or r eceive your stored configuration files via TFTP . Y ou select the stored configuration files from pull-down menus in the TFTP File T ransfer scr een in the Utilities & Diagnostics menu, as shown. Configuration Management Save Curren[...]

Utilities and Diagnostics 10-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 0 0 0 0 U U U U t t t t ii i i ll l l ii i i t t t t ii i i e e e e s s s s a a a a n n n n d d d d D D D D ii i i a a a a g g g g n n n n o o o o s s s s t t t t ii i i c c c c s s s s A number of utilities and tests are available for system diagnostic a[...]

10-2 Firmware User Guide Ping The Netopia Fir mware V ersion 8.4 includes a standar d Ping test utility . A Ping test generates IP packets destined for a par ticular (Ping-capable) IP host. Each time the tar get host receives a Ping packet, it retur ns a packet to the original sender . Ping allows you to see whether a par ticular IP destination is [...]

Utilities and Diagnostics 10-3 Status: The cur rent status of the Ping test. This item can display the status messages shown in the able below: Packets Out: The number of packets sent by the Ping test. Packets In: The number of retur n packets received from the tar get host. T o be considered on time, r eturn packets are expected back befor e the n[...]

10-4 Firmware User Guide Packets Lost: The number of packets unaccounted for , shown in total and as a per centage of total packets sent. This statistic may be updated during the Ping test, and may not be accurate until after the test is over . However , if an escalating one-to-one cor respondence is seen between Packets Out and Packets Lost , and [...]

Utilities and Diagnostics 10-5 4. Select Use Reverse DNS to learn the names of the gateways between the Netopia Router and the destination gateway . The default is Y es. 5. Select ST ART TRACE ROUTE and press Retur n. A scrolling screen will appear that lists the destination, number of hops, IP addresses of each hop, and DNS names, if selected. 6. [...]

10-6 Firmware User Guide F actor y Defaults Y ou can r eset the Router to its factor y default settings. In the Utilities & Diagnostics screen, select Rever t to Factor y Defaults and press Return. Select CONTINUE in the dialog box and pr ess Return. The Router will reboot and its settings will r eturn to the factor y defaults, deleting your co[...]

Utilities and Diagnostics 10-7 Updating firmware Fir mware updates may be available periodically from Netopia or fr om a site maintained by your organization’s network administrator . The Router ships with an embedded operating system refer red to as fir mware. The fir mware gover ns how the device communicates with your network and the W AN o[...]

10-8 Firmware User Guide • Select Config File Name and enter the name of the file you will download. The name of the file is available from the site wher e the ser ver is located. Y ou may need to enter a file path along with the file name (for example, bigroot/config/myfile). • Select GET CONFIG FROM SERVER and press Retur n. Y ou will [...]

T roubleshooting A-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x A A A A T T T T r r r r o o o o u u u u b b b b ll l l e e e e s s s s h h h h o o o o o o o o t t t t ii i i n n n n g g g g This appendix is intended to help you troubleshoot pr oblems you may encounter while setting up and using Netopia Fir mware V ersion 8.4. It[...]

A-2 Firmware User Guide Note: If you are attempting to modify the IP addr ess or subnet mask from a previous, successful configuration attempt, you will need to clear the IP address or r eset your Router to the factor y default before reinitiating the configuration pr ocess. For fur ther information on resetting your Router to factor y default, s[...]

T roubleshooting A-3 How to Reset the Router to F actor y Defaults Lose your password? This section shows how to r eset the Netopia Router so that you can access the configuration screens once again. Note: Keep in mind that all of your settings will need to be reconfigur ed. If you don't have a password, the only way to access the Netopia Ro[...]

A-4 Firmware User Guide Environment pr ofile • Locate the Router’s model number , product serial number , and fir mware version. The serial number is on the bottom of the gateway , along with the model number . The fir mware version appears in the Netopia Netopia Router’s Main Menu screen. Model number: Serial number: Fir mware version: ?[...]

Understanding IP Addressing B-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x B B B B U U U U n n n n d d d d e e e e r r r r s s s s t t t t a a a a n n n n d d d d ii i i n n n n g g g g II I I P P P P A A A A d d d d d d d d r r r r e e e e s s s s s s s s ii i i n n n n g g g g This appendix is a brief general introduction to I[...]

B-2 Firmware User Guide IP addresses ar e maintained and assigned by the InterNIC, a quasi-governmental or ganization now increasingly under the auspices of private industr y . Note: It’s ver y common for an or ganization to obtain an IP address from a thir d par ty , usually an Internet ser vice provider (ISP). ISPs usually issue an IP addr ess [...]

Understanding IP Addressing B-3 Subnet masks T o create subnets, the network manager must define a subnet mask, a 32-bit number that indicates which bits in an IP address ar e used for network and subnetwork addresses and which are used for host addresses. One subnet mask should apply to all IP networks that are physically connected together and s[...]

B-4 Firmware User Guide Network configuration Below is a diagram of a simple network configuration. The ISP is providing a Class C addr ess to the customer site, and both networks A and B want to gain Internet access thr ough this address. Router B connects to Router A and is provided Inter net access through Routers A and B. Router A: IP Address[...]

Understanding IP Addressing B-5 Background The IP addresses and r outing configurations for the devices shown in the diagram are outlined below . In addition, each individual field and its meaning are described. The IP Address and Subnet Mask fields define the IP addr ess and subnet mask of the device's Ethernet connection to the network w[...]

B-6 Firmware User Guide These two methods are not mutually exclusive; you can manually issue some of the addr esses while the rest are distributed by the Router. Using the gateway in this way allows it to function as an addr ess ser ver . One reason to use the Router as an addr ess ser ver is that it takes less time than manually distributing the a[...]

Understanding IP Addressing B-7 Configuration This section describes the specific IP address lease, r enew , and release mechanisms for both the Mac and PC, with either DHCP or MacIP address ser ving. DHCP address serving Windows 95 workstation: • The Win95 workstation requests and r enews its lease ever y half hour . • The Win95 workstation [...]

B-8 Firmware User Guide • For a dynamic address, the Router r eleases the address back to the address pool after it has lost contact with the Mac workstation for over 2 minutes. • For a static address, the Router r eleases the address back to the address pool after it has lost contact with the Mac workstation for over 20 minutes. Netopia Firmwa[...]

Understanding IP Addressing B-9 • define the address that you want to ser ve in the Connection Pr ofile's IP Setup screen. This method requir es a static value to be used. Thus any user dialing in can obtain the same IP address for ever y connection to the profile. If you want to ser ve addresses statically , define the addr ess in the C[...]

B-10 Firmware User Guide The figure above shows an example of a block of IP addr esses being distributed corr ectly . The example follows these r ules: • An IP address must not be used as a static addr ess if it is also in a range of addresses being distributed by DHCP or MacIP . • A single IP address range is used by all the addr ess-ser ved [...]

Understanding IP Addressing B-11 Nested IP Subnets Under cer tain circumstances, you may want to cr eate remote subnets from the limited number of IP addr esses issued by your ISP or other authority . Y ou can do this using connection profiles. These subnets can be nested within the range of IP addresses available to your network. For example, sup[...]

B-12 Firmware User Guide Routers B and C (which could also be Routers) ser ve the two remote networks that ar e subnets of a.b.c.0. The subnetting is accomplished by configuring the Router with connection profiles for Routers B and C (see the following table). The Router’s connection profiles for Routers B and C cr eate entries in its IP routi[...]

Understanding IP Addressing B-13 Let’s see how a packet from the Inter net gets routed to the host with IP address a.b.c.249, which is ser ved by Router C. The packet first ar rives at Router A, which delivers it to its local network (a.b.c.0). The packet is then received by the Router, which examines its destination IP addr ess. The Router comp[...]

B-14 Firmware User Guide The following diagram illustrates the IP address space taken up by the two r emote IP subnets. Y ou can see from the diagram why the ter m nested is appropriate for describing these subnets. Br oadcasts As mentioned earlier , binar y IP host or subnet addresses composed entirely of ones or zer os are reser ved for broadcast[...]

Binary Conversion T able C-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x C C C C B B B B ii i i n n n n a a a a r r r r y y y y C C C C o o o o n n n n v v v v e e e e r r r r s s s s ii i i o o o o n n n n T T T T a a a a b b b b ll l l e e e e This table is provided to help you choose subnet numbers and host numbers for IP and [...]

C-2 Firmware User Guide 30 11110 62 111110 94 1011110 126 1111110 31 11111 63 111111 95 1011111 127 1111111 Decimal Binar y Decimal Binary Decimal Binar y Decimal Binary 128 10000000 160 10100000 192 11000000 224 11100000 129 10000001 161 10100001 193 11000001 225 11100001 130 10000010 162 10100010 194 11000010 226 11100010 131 10000011 163 1010001[...]

Binary Conversion T able C-3 159 10011111 191 10111111 223 11011111 255 11111111 Decimal Binar y Decimal Binary Decimal Binar y Decimal Binary[...]

C-4 Firmware User Guide[...]

T echnical Specifications and Safety Information D-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x D D D D T T T T e e e e c c c c h h h h n n n n ii i i c c c c a a a a ll l l S S S S p p p p e e e e c c c c ii i i f f f f ii i i c c c c a a a a t t t t ii i i o o o o n n n n s s s s a a a a n n n n d d d d S S S S a a a a f f f [...]

D-2 Firmware User Guide Agency appr ov als North America Safety Approvals: • United States – UL 60950 Third Edition • Canada – CSA: CAN/CSA-C22.2 No. 60950-00 EMC: • United States – FCC Par t 15 Class B • Canada – ICES-003 T elecom: • United States – FCC Par t 68 • Canada – CS-03 International Safety Approvals: • Low V olt[...]

T echnical Specifications and Safety Information D-3 Manufacturer’ s Declaration of Conf ormance Note: Warnings: This is a Class B product. In a domestic envir onment this product may cause radio inter ference, in which case the user may be requir ed to take adequate measures. Adequate measures include increasing the physical distance between th[...]

D-4 Firmware User Guide Before installing this equipment, users should ensur e that it is permissible to be connected to the facilities of the local telecommunications company . The equipment must also be installed using an acceptable method of connection. In some cases, the company’s inside wiring associated with a single line individual ser vic[...]

T echnical Specifications and Safety Information D-5 • USB-powered models: For Use with Listed I.T .E. Only . T elecommunication installation cautions • Never install telephone wiring during a lightning stor m. • Never install telephone jacks in wet locations unless the jack is specifically designed for wet locations. • Never touch uninsu[...]

D-6 Firmware User Guide b) List all applicable cer tification jack Universal Ser vice Order Codes (“USOC”) for the equipment: RJ11. c) A plug and jack used to connect this equipment to the premises wiring and telephone network must comply with the applicable FCC Par t 68 r ules and requirements adopted by the ACT A. A compliant telephone cord [...]

T echnical Specifications and Safety Information D-7 Electrical Safety Ad visory T elephone companies repor t that electrical sur ges, typically lightning transients, are ver y destr uctive to customer ter minal equipment connected to AC power sources. This has been identified as a major nationwide problem. Ther efore it is advised that this equi[...]

D-8 Firmware User Guide[...]

Index-1 II I I n n n n d d d d e e e e x x x x A add static route 6-8 ADSL Line Configuration 2-4 advanced configuration features 2-22 ATMP 4-17 tunnel options 4-15 B backup default gateway 7-14 backup, line 7-1 basic firewall 9-30 BootP 6-17 clients 6-23 broadcasts B-14 C change static route 6-9 community strings 8-12 configuration troubleshooting[...]

Index-2 F filter parts 9-19 parts of 9-19 filter priority 9-18 filter set adding 9-25 display 9-21 filter sets adding 9-25 defined 9-17 deleting 9-29 disadvantages 9-23 sample (Basic Firewall) 9-29 using 9-24 filtering example #1 9-22 filters actions a filter can take 9-18 adding to a filter set 9-26 defined 9-17 deleting 9-29 disadvantages of 9-23[...]

Index-3 management and statistics 7-17 scheduled connections 7-12 WAN configuration 7-8 M MIBs supported 8-10 model numbers 1-3 MPPE 4-17 MS-CHAPv2 4-18 Multicast Forwarding 6-33 multiple subnets 6-4 N NAT adding server lists 3-15 defined 6-1 Easy Setup Profile 3-6 IP profile parameters 3-21 IP setup 3-7 map lists 3-8 modifying map lists 3-12 outsi[...]

Index-4 S scheduled connections 2-15 adding 2-17 deleting 2-20 modifying 2-20 once-only 2-19 viewing 2-16 weekly 2-18 security filters 9-17 – 9-32 measures to increase 9-1 telnet 9-16 Security Policy Database (SPD) 5-2 Simple Network Management Protocol, see SNMP SNMP community strings 8-12 MIBs supported 8-10 setup screen 8-11 traps 8-12 SNMP-V2[...]

Index-5 upgrade 1-3 uploading configuration files 10-8 with TFTP 10-8 utilities and diagnostics 10-1 V Variable Bit Rate (VBR) 2-6 viewing scheduled connections 2-16 Virtual Private Networks (VPN) 4-1 VPN 4-1 allowing through a firewall 4-24 ATMP tunnel options 4-15 default answer profile 4-18 encryption support 4-17 PPTP tunnel options 4-4 W WAN e[...]

Index-6[...]