Netopia 4542 manual

Net opia ™ 4541 and 4542 ADSL R outers User’s Refer ence Guide[...]

Cop yright ©2001 Netopia, Inc., v .080102 All rights reser ved. Printed in the U.S.A. This manual and any associated ar twork, software, and product designs are copyrighted with all rights reser ved. Under the copyright laws such materials may not be copied, in whole or par t, without the prior written consent of Netopia, Inc. Under the law , copy[...]

Contents 1 G Chapter 1 — Introduction .......................................................... 1-1 Over view ....................................................................... 1-1 Features and capabilities ............................................... 1-1 How to use this guide .................................................... 1-2 Chap[...]

2 User’ s Reference Guide IP Easy Setup ...................................................... 6-5 Easy Setup Security Configuration ......................... 6-7 Chapter 7 — W AN and System Configuration ............................. 7-1 W AN configuration .......................................................... 7-1 Creating a new Connect[...]

Contents 3 G IP Address Pools ................................................ 8-13 DHCP NetBIOS Options ....................................... 8-15 More Addr ess Ser ving Options ...................................... 8-17 Configuring the IP Address Ser ver options ............ 8-18 DHCP Relay Agent ..............................................[...]

4 User’ s Reference Guide About A TMP Tunnels................................................... 10-12 A TMP configuration ........................................... 10-12 Encr yption Suppor t .................................................... 10-15 MS-CHAP V2 and 128-bit strong encr yption ........ 10-15 AT MP/PPTP Default Profile .........[...]

Contents 5 G Basic IP packet components ............................. 11-21 Basic protocol types ......................................... 11-21 Firewall design r ules ......................................... 11-22 Filter basics ..................................................... 11-24 Example filters ...........................................[...]

6 User’ s Reference Guide Restar ting the system ................................................ 13-12 Appendix A — Troubleshooting .................................................. A-1 Configuration problems .................................................. A-1 Console connection problems ............................... A-2 Network problem[...]

Introduction 1-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 II I I n n n n t t t t r r r r o o o o d d d d u u u u c c c c t t t t ii i i o o o o n n n n Overview The Netopia 4541/4542 ADSL Router is a full-featured, stand-alone DSL r outer for connecting diverse local area networks (LANs) to the Inter net and other remote netw[...]

1-2 User’ s Reference Guide How to use this guide In addition to the simple documentation contained in the accompanying Getting Star ted Guide , this guide is designed to be your single source for infor mation about your Netopia 4541/4542 ADSL Router. It is intended to be viewed on-line, using the power ful featur es of the Adobe Acrobat Reader .[...]

Making the Physical Connections 2-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 2 2 2 2 M M M M a a a a k k k k ii i i n n n n g g g g t t t t h h h h e e e e P P P P h h h h y y y y s s s s ii i i c c c c a a a a ll l l C C C C o o o o n n n n n n n n e e e e c c c c t t t t ii i i o o o o n n n n s s s s This section tells you how to [...]

2-2 User’ s Reference Guide Y ou will need: ■ A Windows 95 or 98–based PC or a Macintosh computer with Ethernet connectivity for configuring the Netopia 4541/4542. This may be built-in Ethernet or an add-on car d, with TCP/IP installed and configur ed. See “Sharing the Connection” on page 3-1 . ■ An ADSL wall outlet wired for a connec[...]

Making the Physical Connections 2-3 3. Connect the Ethernet cable to the Ether net por t on the r outer and the other end to your computer . Y ou should now have: the power adapter plugged in; the Ether net cable connected between the router and your computer; and the DSL cable connected between the router and the DSL wall outlet. Netopia 4541/4542[...]

2-4 User’ s Reference Guide[...]

Sharing the Connection 3-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 3 3 3 3 S S S S h h h h a a a a r r r r ii i i n n n n g g g g t t t t h h h h e e e e C C C C o o o o n n n n n n n n e e e e c c c c t t t t ii i i o o o o n n n n Once you have set up your physical local area network, you will need to configur e the TCP/IP stack [...]

3-2 User’ s Reference Guide Dynamic configuration (r ecommended) To configur e your PC for dynamic addressing do the following: Note: Y ou can also use these instr uctions to configur e other computers on your network to accept IP addresses ser ved by the Netopia 4541/4542. 1. Go to the Star t Menu/Settings/Control Panels and double click the [...]

Sharing the Connection 3-3 Static configuration (optional) If you are manually configuring for a fixed or static IP addr ess, per for m the following: 1. Go to Star t Menu/Settings/Control Panels and double click the Network icon. From the Network components list, select the Configuration tab. 2. Select TCP/IP-->Y our Network Card . Then sel[...]

3-4 User’ s Reference Guide 4. Click OK in this window and the next window . When prompted, r eboot the computer . Note: Y ou can also use these instr uctions to configur e other computers on your network with manual or static IP addresses. Be sur e each computer on your network has its own IP address. Click on the DNS Configuration tab. Click [...]

Sharing the Connection 3-5 Configuring TCP/IP on Macintosh Computers The following is a quick guide to configuring TCP/IP for MacOS computers. Configuring TCP/IP in a Macintosh computer requir es the following: ■ Y ou must have either Open T ranspor t or Classic Networking (MacTCP) installed. Note: If you want to use the Dynamic Host Configur[...]

3-6 User’ s Reference Guide Static configuration (optional) 3. In the TCP/IP window or in the MacTCP/More window , select or type information into the fields as shown in the following table. 4. Close the TCP/IP or MacTCP control panel and save the settings. 5. If you are using MacTCP , you must restar t the computer . If you are using Open T ra[...]

Sharing the Connection 3-7 Note: Y ou can also use these instr uctions to configur e other computers on your network with manual or static IP addresses. Be sur e each computer on your network has its own IP address. More infor mation about configuring your Macintosh computer for TCP/IP connectivity thr ough a Netopia 4541/4542 can be found in T e[...]

3-8 User’ s Reference Guide[...]

Connecting to Y our Local Ar ea Network 4-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 4 4 4 4 C C C C o o o o n n n n n n n n e e e e c c c c t t t t ii i i n n n n g g g g t t t t o o o o Y Y Y Y o o o o u u u u r r r r L L L L o o o o c c c c a a a a ll l l A A A A r r r r e e e e a a a a N N N N e e e e t t t t w w w w o o o o r r [...]

4-2 User’ s Reference Guide Once the Netopia 4541/4542 is properly configur ed and connected to your LAN, PC and Macintosh computers that have their requir ed components in place will be able to connect to the Internet or other r emote IP networks. Connecting to an Ethernet network The Netopia 4541/4542 suppor ts Ether net connections through it[...]

Console-Based Management 5-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 5 5 5 5 C C C C o o o o n n n n s s s s o o o o ll l l e e e e - - - - B B B B a a a a s s s s e e e e d d d d M M M M a a a a n n n n a a a a g g g g e e e e m m m m e e e e n n n n t t t t Console-based management is a menu-driven inter face for the capabilities [...]

5-2 User’ s Reference Guide may be using the router to connect to mor e than one ser vice provider or r emote site. ■ The System Configuration menus display and per mit changing: ■ IP setup. See “IP Setup” on page 8-1 . ■ Filter sets (firewalls). See “Security” on page 11-1 . ■ IP address ser ving. See “IP Addr ess Ser ving”[...]

Console-Based Management 5-3 Configuring T elnet software If you are configuring your r outer using a T elnet session, your computer must be r unning a T elnet software program. ■ If you connect a PC with Microsoft Windows, you can use a Windows T elnet application or simply r un T elnet from the Star t menu. ■ If you connect a Macintosh comp[...]

5-4 User’ s Reference Guide Launch your ter minal emulation software and configur e the communications software for the values shown in the table below . These are the default communication parameters that the Netopia 4541/4542 uses. Navigating thr ough the console screens Use your keyboard to navigate the Netopia 4541/4542’s configuration sc[...]

Easy Setup 6-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 6 6 6 6 E E E E a a a a s s s s y y y y S S S S e e e e t t t t u u u u p p p p This chapter describes how to use the Easy Setup console screens on your Netopia 4541/4542. After completing the Easy Setup console screens, your r outer will be ready to connect to the Inter net or [...]

6-2 User’ s Reference Guide If you do not see the Main Menu, verify that: ■ If you are using a serial connection, that your serial por t speed is the same as the Netopia 4541/4542’s default 9600 baud, for first use. ■ The computer used to view the console screen has its serial por t connected to the Netopia 4541/4542’s Console por t or a[...]

Easy Setup 6-3 The Main Menu appears. 2. Select the first item on the Main Menu list, Easy Setup . Press Retur n to bring up the ADSL Line Configuration menu screen. DSL Line Configuration 1. Select Circuit Type and, from the pop-up menu, choose the type of cir cuit to which you will be connecting: Multimode, T1.413, G.dmt, G.lite, or ADI. 2. Se[...]

6-4 User’ s Reference Guide Routed 1483. If you select Bridged 1483, a new option PPP over Ethernet (PPPoE) appears. Y ou can then toggle PPPoE On or Of f. Choosing Routed 1483 hides the PPPoE option. ■ If you selected PPP , the next pop-up menu PPP Mode of fers the choice of VC Multiplexed or LLC SNAP . 3. The next two fields, Data Circuit VP[...]

Easy Setup 6-5 If you selected Numbered, the following fields appear . ■ Select the editable field labeled Local W AN IP Addr ess . The default address is 0.0.0.0, which allows for dynamic addr essing, when your ISP assigns an address each time you connect. However , you can enter another specific address if you want to use static addressing. [...]

6-6 User’ s Reference Guide 1. Select Ethernet IP Address and enter the first IP addr ess from the IP addr ess range your ISP has given you. This will be the Netopia Router’s IP address. The Ethernet IP Addr ess defaults to an address (192.168.1.1) within a range r eser ved by the Inter net address administration authority for use within priva[...]

Easy Setup 6-7 7. T oggle IP Address Ser ving to On or Of f, depending on whether you want the device’s IP address ser ver to supply dynamic IP addresses to your client workstations. Nor mally , you would accept the default On so that workstations on your LAN can have IP addresses assigned dynamically fr om the router . 8. The IP address ser ver [...]

6-8 User’ s Reference Guide The Router will restar t and your configuration settings will be activated. Y ou can then Exit or Quit your T elnet application. Easy Setup is now complete.[...]

W AN and System Configuration 7-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 7 7 7 7 W W W W A A A A N N N N a a a a n n n n d d d d S S S S y y y y s s s s t t t t e e e e m m m m C C C C o o o o n n n n f f f f ii i i g g g g u u u u r r r r a a a a t t t t ii i i o o o o n n n n This chapter describes how to use the console-based m[...]

7-2 User’ s Reference Guide 1. Select Circuit Type and from the pop-up menu choose the type of cir cuit to which you will be connecting. ■ Model 4541 of fers Multimode, T1.413, G.dmt, G.lite, or ADI. ■ Model 4542 of fers Multimode, ADI ETDI, ITU Standar d, UR2, ADI Legacy , TI Legacy and Alcatel ETSI. 2. Select Signaling Mode and choose Echo [...]

W AN and System Configuration 7-3 ■ Enter a name for the circuit in the Cir cuit Name field. ■ T oggle Circuit Enabled to Y es. ■ Enter the Vir tual Path Identifier and the Vir tual Channel Identifier in the Circuit VPI and Circuit VCI fields, respectively . ■ Then, select a Connection Profile for the Cir cuit. T o use the Default Pro[...]

7-4 User’ s Reference Guide Cr eating a new Connection Profile For a Netopia 4541/4542, connection profiles ar e useful for configuring the connection and authentication settings for negotiating a PPP connection on the ADSL link. If you are using the PPP data link encapsulation method, you can store your authentication infor mation in the conn[...]

W AN and System Configuration 7-5 3. Select Data Link Encapsulation and press Retur n. The pop-up menu of fers the possible data link encapsulation methods for connection profiles used for a variety of purposes: PPP , RFC1483, A TMP , PPTP , or IPsec. If you select any data link encapsulation method other than RFC1483, a Data Link Options menu it[...]

7-6 User’ s Reference Guide 7. T oggle or enter any IP Parameters you requir e and retur n to the Add Connection Profile scr een by pressing Escape. For more infor mation, see “IP Setup” on page 8-2 . 8. Select COMMIT and press Retur n. Y our new Connection Pr ofile will be added. If you want to view the Connection Profiles in your device,[...]

W AN and System Configuration 7-7 The default pr ofile If you are using RFC1483 datalink encapsulation, the Default Pr ofile screen contr ols whether or not the ADSL link will come up without an explicitly configured connection pr ofile. (PPP datalink encapsulation does not suppor t a default profile, and the cor r esponding menu item is unav[...]

7-8 User’ s Reference Guide IP parameters (default profile) scr een If you are using RFC1483 datalink encapsulation, the IP Parameters (Default Pr ofile) screen allows you to configure various IP parameters for ADSL connections established without an explicitly configur ed connection profile: For an ADSL link, Network Address T ranslation (N[...]

W AN and System Configuration 7-9 V iewing scheduled connections To display a table of scheduled connections, select Display/Change Scheduled Connection in the Scheduled Connections screen. Each scheduled connection occupies one r ow of the table. The first column in the table shows a one-letter repr esentation of the Days of the week, from Monda[...]

7-10 User’ s Reference Guide The other columns show: ■ The time of day that the connection will Begin At ■ The duration of the connection ( HH:MM ) ■ Whether it’s a recur ring Weekly connection or used Once Only ■ Which connection profile ( Conn. Pr of. ) is used to connect ■ Whether the scheduled connection is cur rently Enabled The[...]

W AN and System Configuration 7-11 demand call on the line. ■ Demand-Allowed , meaning that this schedule will per mit a demand call on the line. ■ Demand-Blocked , meaning that this schedule will prevent a demand call on the line. ■ Periodic , meaning that the connection is retried several times during the scheduled time. ■ If How Often i[...]

7-12 User’ s Reference Guide Set Once-Only Schedule If you set How Often to Once Only , select Set Once-Only Schedule and go to the Set Once-Only Schedule screen. ■ Select Place Call On (Date) and enter a date in the for mat MM/DD/YY or MM/DD/YYYY (month, day , year). Note: Y ou must enter the date in the for mat specified. The slashes ar e ma[...]

W AN and System Configuration 7-13 Modifying a scheduled connection To modify a scheduled connection, select Display/Change Scheduled Connection in the Scheduled Connections screen to display a table of scheduled connections. Select a scheduled connection from the table and pr ess Return. The Change Scheduled Connection scr een appears. The parame[...]

7-14 User’ s Reference Guide The console screen will open to the Main Menu, similar to the scr een shown below: Navigating thr ough the system configuration screens To help you find your way to par ticular scr eens, some sections in this guide begin with a graphical path guide similar to the following example: This par ticular path guide shows [...]

W AN and System Configuration 7-15 System configuration featur es The Netopia 4541/4542 ADSL Router’s default settings may be all you need to configure your Netopia 4541/4542. Some users, however , require advanced settings or pr efer manual control over the default selections. For these users, the Netopia 4541/4542 provides system configurat[...]

7-16 User’ s Reference Guide IP setup These screens allow you to configur e your network’s use of the IP networking protocol. ■ Details are given in “IP Setup” on page 8-2 . Filter sets (firewalls) These screens allow you to configur e security on your network by means of filter sets and a basic firewall. ■ Details are given in “[...]

W AN and System Configuration 7-17 3. Select the Router’s time zone from the Ti me Zone pop-up menu and press Retur n. 4. In the NTP Update Inter val field, enter how often to synchronize with the time ser ver , using the for mat HHHH:MM where H is hours and M is minutes. 5. Select a System Date Format ; the options are MM/DD/YY , DD/MM/YY , an[...]

7-18 User’ s Reference Guide Security These screens allow you to add users and define passwor ds on your network. ■ Details are given in “Security” on page 11-1 . Upgrade feature set Y ou can upgrade your Netopia 4541/4542 by adding new featur e sets through the Upgrade Featur e Set utility . See the release notes that came with your r out[...]

W AN and System Configuration 7-19 ■ Y ou can specify the UNIX syslog Facility to use by selecting the Facility pop-up. ■ Erase the log by selecting DUMP W AN LOG Installing the Syslog client The Goodies folder on the Netopia CD contains a Syslog client daemon program that can be configur ed to repor t the WAN events you specified in the Log[...]

7-20 User’ s Reference Guide[...]

IP Setup 8-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 8 8 8 8 II I I P P P P S S S S e e e e t t t t u u u u p p p p The Netopia 4541/4542 uses Internet Pr otocol (IP) to communicate both locally and with remote networks. This chapter shows you how to configure the r outer to route IP traf fic. Y ou also lear n how to configur e t[...]

8-2 User’ s Reference Guide IP Setup The IP Setup options screen is wher e you configure the Ether net side of the Netopia 4541/4542. The infor mation you enter here contr ols how the router r outes IP traf fic. Consult your network administrator or ISP to obtain the IP setup infor mation (such as the Ether net IP address, Ethernet subnet mask,[...]

IP Setup 8-3 The Netopia 4541/4542 suppor ts multiple IP subnets on the Ether net inter face. Y ou may want to configure multiple IP subnets to ser vice mor e hosts than are possible with your primar y subnet. It is not always possible to obtain a lar ger subnet from your ISP . For example, if you already have a full Class C subnet, your only opti[...]

8-4 User’ s Reference Guide IP subnets The IP Subnets screen allows you to configur e up to eight Ethernet IP subnets on unlimited-user models, one “primar y” subnet and up to seven secondar y subnets, by entering IP addr ess/subnet mask pairs: Note: Y ou need not use this screen if you have only a single Ether net IP subnet. In that case, y[...]

IP Setup 8-5 For example: ■ To delete a configur ed subnet, set both the IP address and subnet mask values to 0.0.0.0, either explicitly or by clearing each field and pressing Retur n to commit the change. When a configured subnet is deleted, the values in subsequent rows adjust up to fill the vacant fields. The subnets configured on this s[...]

8-6 User’ s Reference Guide If you have configured multiple Ether net IP subnets, the IP Setup screen changes slightly: The IP address and Subnet mask items ar e hidden, and the Define Additional Subnets... item becomes Subnet Configuration... . If you select Subnet Configuration , you will retur n to the IP Subnets screen that allows you to [...]

IP Setup 8-7 The Static Routes screen will appear . Viewing static r outes To display a view-only table of static r outes, select Display/Change Static Route . The table shown below will appear . The table has the following columns: Dest. Network: The network IP address of the destination network. Static Routes Display/Change Static Route... Add St[...]

8-8 User’ s Reference Guide Subnet Mask: The subnet mask associated with the destination network. Next Gateway: The IP address of the r outer that will be used to reach the destination network. Priority: An indication of whether the Netopia 4541/4542 will use the static route when it conflicts with infor mation received fr om RIP packets. Enable[...]

IP Setup 8-9 infor mation; Low means that the RIP infor mation takes precedence over the static r oute. ■ If the static route conflicts with a connection pr ofile, the connection profile will always take pr ecedence. ■ To make sur e that the static route is known only to the Netopia 4541/4542, select Adver tise Route Via RIP and toggle it to[...]

8-10 User’ s Reference Guide IP Addr ess Serving In addition to being a router , the Netopia 4541/4542 is also an IP address ser ver . There are thr ee protocols it can use to distribute IP addresses. ■ The first, called Dynamic Host Configuration Protocol (DHCP), is widely suppor ted on PC networks, as well as Apple Macintosh computers using[...]

IP Setup 8-11 Follow these steps to configure IP Addr ess Ser ving: ■ If you enabled IP Address Ser ving, then DHCP , BootP clients and Dynamic W AN clients are automatically enabled. ■ The IP Address Ser ving Mode pop-up menu allows you to choose the way in which the Netopia 4541/4542 will ser ve IP addresses. The device can act as either a D[...]

8-12 User’ s Reference Guide If you have configured multiple Ether net IP subnets, the appearance of the IP Address Ser ving screen is alter ed slightly: Three menu items ar e hidden, and Configure Addr ess Pools... appears instead. If you select Configure Address Pools... you will be taken to the IP Addr ess Pools screen that allows you to co[...]

IP Setup 8-13 IP Addr ess Pools The IP Address Pools scr een allows you to configure a separate IP addr ess ser ving pool for each of up to eight configured Ether net IP subnets: This screen consists of between two and eight r ows of four columns each. There ar e exactly as many rows as there ar e Ethernet IP subnets configur ed on the IP Subnet[...]

8-14 User’ s Reference Guide Numerous factors influence the choice of ser ved addr ess. It is dif ficult to specify the address that will be ser ved to a par ticular client in all cir cumstances. However , when the address ser ver has been configured, and the clients involved have no prior address ser ving interactions, the Netopia 4541/4542 w[...]

IP Setup 8-15 DHCP NetBIOS Options If your network uses NetBIOS, you can enable the Netopia 4541/4542 to use DHCP to distribute NetBIOS infor mation. NetBIOS stands for Network Basic Input/Output System. It is a layer of software originally developed by IBM and Sytek to link a network operating system with specific hardwar e. NetBIOS has been adop[...]

8-16 User’ s Reference Guide ■ From the NetBios Type pop-up menu, select the type of NetBIOS used on your network. ■ To ser ve DHCP clients with the NetBIOS scope, select Ser ve NetBios Scope and toggle it to Ye s . Select NetBios Scope and enter the scope. ■ To ser ve DHCP clients with the IP address of a NetBIOS name ser ver, select Ser v[...]

IP Setup 8-17 Select Release BootP Leases and press Retur n. ■ Back in IP Address Ser ving, the Ser ve Dynamic W AN Clients toggle Mor e Address Serving Options The Netopia 4541/4542 includes a number of enhancements in the built-in DHCP IP address ser ver . These enhancements include: ■ The ability to exclude one or more IP addr esses from the[...]

8-18 User’ s Reference Guide Configuring the IP Addr ess Server options To access the enhanced DHCP ser ver functions, from the Main Menu navigate to Statistics & Logs and then Ser ved IP Addresses . The following example shows the Ser ved IP Addresses scr een after three clients have leased IP addr esses. The first client did not provide a[...]

IP Setup 8-19 Y ou can select the entries in the Ser ved IP Addr esses screen. Use the up and down ar row keys to move the selection to one of the entries in the list of ser ved IP addresses. Once you select an entr y , pr essing Retur n displays an action pop-up menu that lists operations that can be per for med on that entr y . Possible operation[...]

8-20 User’ s Reference Guide ■ Details… is displayed if the entr y is associated with both a host name and a client identifier . Selecting Details… displays a pop-up menu that provides additional infor mation associated with the IP address. The pop-up menu includes the IP addr ess as well as the host name and client identifier supplied by[...]

IP Setup 8-21 ■ Include is displayed if the entr y is either excluded or declined. An IP address is marked declined when a client to whom the DHCP ser ver of fers the address declines the address. A client declines an addr ess if it deter mines that a leased address is alr eady in use by another device. Selecting Include restor es the selected IP[...]

8-22 User’ s Reference Guide The router’s Ether net IP address(es) will be automatically excluded fr om the address ser ving pool(s) on star tup. Entries in the ser ved IP address list cor responding to the r outer’s Ethernet IP addr ess(es) that have been automatically excluded on star tup are not selectable. Served IP Addresses -IP Address-[...]

IP Setup 8-23 D D D D H H H H C C C C P P P P R R R R e e e e ll l l a a a a y y y y A A A A g g g g e e e e n n n n t t t t The Netopia 4541/4542 of fers DHCP Relay Agent functionality , as defined in RFC1542. A DHCP relay agent is a computer system or a router that is configur ed to for ward DHCP r equests from clients on the LAN to a r emote D[...]

8-24 User’ s Reference Guide Select IP Address Ser ving and pr ess Retur n. The IP Address Ser ving scr een appears. Select IP Address Ser ving Mode . The pop-up menu of fers the choices of Disabled , DHCP Ser ver (the default), and DHCP Relay Agent . If you select DHCP Relay Agent and press Retur n, the screen changes as shown below . Now you ca[...]

IP Setup 8-25 Note: The remote DHCP ser ver(s) to which the Netopia Router is r elaying DHCP requests must be capable of ser vicing relayed r equests. Not all DHCP ser vers suppor t this featur e. For example, the DHCP ser ver in the Netopia Router does not . The DHCP ser ver(s) to which the Netopia Router is relaying DHCP r equests must be config[...]

8-26 User’ s Reference Guide 2. T oggle the Profile Enabled value to Ye s or No . The default is Y es. 3. Select IP Profile Parameters and press Retur n. The IP Pr ofile Parameters screen appears. 4. T oggle or enter any IP parameters you requir e and retur n to the Add Connection Profile scr een by pressing Escape. For more infor mation on N[...]

IP Setup 8-27 5. Select ADD PROFILE NOW and press Retur n. Y our new connection pr ofile will be added. If you want to view the connection profiles in your r outer , return to the WAN Configuration screen, and select Display/Change Connection Profile . The list of connection pr ofiles is displayed in a scrolling pop-up screen. WAN Configuratio[...]

8-28 User’ s Reference Guide[...]

Multiple Network Address T ranslation 9-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 9 9 9 9 M M M M u u u u ll l l t t t t ii i i p p p p ll l l e e e e N N N N e e e e t t t t w w w w o o o o r r r r k k k k A A A A d d d d d d d d r r r r e e e e s s s s s s s s T T T T r r r r a a a a n n n n s s s s ll l l a a a a t t t t ii i i o[...]

9-2 User’ s Reference Guide The following is a general description of these features: Port Address T ranslation The simplest for m of classic Network Address Translation is PAT (Por t Address T ranslation). P A T allows a group of computers on a LAN, such as might be found in a home or small of fice, to shar e a single Inter net connection using[...]

Multiple Network Address T ranslation 9-3 When addresses ar e retur ned to the group of available addr esses, they are r etur ned to the head of the group, being the most recently used. If that same host r equests a connection an hour later , and the same public address is still available, then it will be mapped to the same private host. If a new h[...]

9-4 User’ s Reference Guide Exterior addresses ar e allocated to internal hosts on a demand, or as-needed, basis and then made available when traf fic fr om that host ceases. Once an inter nal host has been allocated an address, it will use that address for all traf fic. Five minutes after all traf fic ceases – no pings, all TCP connections [...]

Multiple Network Address T ranslation 9-5 In order to suppor t this type of mapping, you define two addr ess ranges. First, you define a public range which contains the first and last public address to be used and the way in which these addr esses should be used (P A T , static, or dynamic). Y ou then configure an addr ess map which defines th[...]

9-6 User’ s Reference Guide Easy Setup Profile configuration The screen below is an example. Depending on the type of r outer you are using, fields displayed in this scr een may var y . The Local W AN IP Addr ess is used to configure a NA T public address range consisting of the Local W AN IP Address and all its por ts. The public addr ess ma[...]

Multiple Network Address T ranslation 9-7 Y ou can configur e a simple 1-to-many P A T (often r efer r ed to simply as NA T) mapping using Easy Setup. Mor e complex setups requir e configuration using the Network Address Translation item on the IP Setup screen. An example MultiNA T configuration at the end of this chapter describes some applicat[...]

9-8 User’ s Reference Guide The Network Address T ranslation screen appears. Public Range defines an external addr ess range and indicates what type of mapping to apply when using this range. The types of mapping available are dynamic , static and pat . Map Lists define collections of mapping r ules. A r ule maps interior range addr esses to ex[...]

Multiple Network Address T ranslation 9-9 The Add NA T Public Range scr een appears. ■ Select Range Name and give a descriptive name to this range. ■ Select Type and from the pop-up menu, assign its type. Options are static , dynamic , or pat (the default). ■ If you choose pat as the range type, select Public Address and enter the exterior IP[...]

9-10 User’ s Reference Guide ■ Select Map List Name and enter a descriptive name for this map list. A new menu item, Add Map , appears. ■ Select Add Map and press Retur n. The Add NA T Map screen appears. ■ Select First and Last Private Address and enter the first and last interior IP addresses you want to assign to this mapping. ■ Selec[...]

Multiple Network Address T ranslation 9-11 ■ From the list of public ranges you defined, select the one that you want to map to the interior range for this mapping and press Retur n. If none of your preconfigur ed ranges are suitable for this mapping, you can select <<NEW RANGE>> and create a new range. If you choose <<NEW RAN[...]

9-12 User’ s Reference Guide Modifying map lists Y ou can make changes to an existing map list after you have cr eated it. Since there may be mor e than one map list you must select which one you are modifying. From the Network Addr ess T ranslation screen select Show/Change Map List and press Retur n. ■ Select the map list you want to modify f[...]

Multiple Network Address T ranslation 9-13 ■ Add Map allows you to add a new map to the map list. ■ Show/Change Maps allows you to modify the individual maps within the list. ■ Delete Map allows you to delete a map from the list. Selecting Show/Change Maps or Delete Map displays the same pop-up menu. Scroll to the map you want to modify using[...]

9-14 User’ s Reference Guide Adding Server Lists Ser ver lists, also known as Expor ts, ar e handled similarly to map lists. If you want to make a par ticular ser ver’s por t accessible (and it isn’t accessible through other means, such as a static mapping), you must cr eate a ser ver list. Select Add Ser ver List from the Network Addr ess T [...]

Multiple Network Address T ranslation 9-15 ■ Select Add Ser ver and press Retur n. The Add NA T Ser ver screen appears. ■ Select Ser vice and press Retur n. A pop-up menu appears listing a selection of commonly expor ted ser vices. ■ Choose the ser vice you want to expor t and pr ess Return. Y ou can choose a pr econfigured ser vice fr om th[...]

9-16 User’ s Reference Guide ■ Enter the First and Last Por t Number between por ts 1 and 65535. Select OK and press Retur n. Y ou will be retur ned to the Add NA T Ser ver screen. ■ Enter the Ser ver Private IP Address of the ser ver whose ser vice you are expor ting. Since MultiNA T per mits the mapping of multiple private IP addr esses to [...]

Multiple Network Address T ranslation 9-17 Modifying server lists Once a ser ver list exists, you can select it for modification or deletion. ■ Select Show/Change Ser ver List from the Network Addr ess T ranslation screen. ■ Select the Ser ver List Name you want to modify from the pop-up menu and pr ess Retur n. The Show/Change NA T Ser ver Li[...]

9-18 User’ s Reference Guide ■ Selecting Show/Change Ser ver or Delete Ser ver displays the same pop-up menu. Select any ser ver from the list and pr ess Retur n. The Change NA T Ser ver screen appears. Y ou can make changes to the ser ver’s ser vice and por t or inter nal or external addr ess. Select CHANGE NA T SERVER and press Return. Y ou[...]

Multiple Network Address T ranslation 9-19 Deleting a server To delete a ser ver from the list, select Delete Ser ver fr om the Show/Change NA T Ser ver List menu and press Return. A pop-up menu lists your configured ser vers. Select the one you want to delete and pr ess Retur n. A dialog box asks you to confir m your choice. Choose CONTINUE and [...]

9-20 User’ s Reference Guide Binding Map Lists and Server Lists Once you have created your map lists and ser ver lists, for most Netopia Router models you must bind them to a profile, either a Connection Pr ofile or the Default Profile. Y ou do this in one of the following screens: ■ the IP profile parameters scr een (see below) of the Conn[...]

Multiple Network Address T ranslation 9-21 ■ Select NA T Map List and press Return. A pop-up menu displays a list of your defined map lists. ■ Select the map list you want to bind to this Connection Profile and pr ess Return. The map list you selected will now be bound to this Connection Profile. ■ Select NA T Server List and pr ess Retur [...]

9-22 User’ s Reference Guide IP Parameters (W AN Default Pr ofile) The Netopia 4541/4542 using RFC 1483 suppor ts a W AN default profile that per mits several parameters to be configured without an explicitly configur ed Connection Profile. The procedur e is similar to the procedur e to bind map lists and ser ver lists to a Connection Profi[...]

Multiple Network Address T ranslation 9-23 ■ Select NA T Map List and press Return. A pop-up menu displays a list of your defined map lists. ■ Select the map list you want to bind to the default profile and pr ess Return. The map list you selected will now be bound to the default profile. ■ Select NA T Server List and pr ess Retur n. A pop[...]

9-24 User’ s Reference Guide NA T Associations Configuration of map and ser ver lists alone is not suf ficient to enable NA T for a WAN connection because map and ser ver lists must be linked to a profile that contr ols the WAN inter face. This can be a Connection Pr ofile, a W AN Ethernet inter face, a default profile, or a default answer p[...]

Multiple Network Address T ranslation 9-25 keys. Select the item by pressing Retur n to display a pop-up menu of all of your configured lists. ■ Select the list name you want to assign and press Retur n again. Y our selection will then be associated with the cor responding pr ofile or inter face. NAT Associations +NAT Map List Name-+ Profile/In[...]

9-26 User’ s Reference Guide MultiNA T Configuration Example To help you understand a typical MultiNA T configuration, this section describes an example of the type of configuration you may want to implement on your site. The values shown are for example purposes only . Make your own appropriate substitutions. A typical DSL ser vice from an IS[...]

Multiple Network Address T ranslation 9-27 Enter your ISP-supplied values as shown below . Select NEXT SCREEN and press Retur n. Y our IP values ar e shown here. Then navigate to the Network Address T ranslation (NA T) screen. Connection Profile 1: Easy Setup Profile Connection Profile Name: Easy Setup Profile Address Translation Enabled: Yes IP Ad[...]

9-28 User’ s Reference Guide Select Show/Change Public Range , then Easy-P A T Range , and pr ess Retur n. Enter the value your ISP assigned for your public address (206.1.1.6, in this example). T oggle Type to pat. Y our public address is then mapped to the remaining private IP addr esses using P A T . (If you were not using the Easy-P A T Range[...]

Multiple Network Address T ranslation 9-29 Select ADD NA T PUBLIC RANGE and press Return. Y ou are retur ned to the Network Addr ess T ranslation screen. Next, select Show/Change Map List and choose Easy-P A T List . Select Add Map . The Add NA T Map scr een appears. (Now the name Easy-P A T List is a misnomer since it has a static map included in [...]

9-30 User’ s Reference Guide To make these changes, first limit the range of r emapped addresses on the Static Map and then edit the default ser ver list called Easy-Ser vers. ■ First, navigate to the Show/Change Map List screen, select Easy-P A T List and then Show/Change Maps . Choose the Static Map you created and change the First Private A[...]

Virtual Private Networks (VPNs) 10-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 0 0 0 0 V V V V ii i i r r r r t t t t u u u u a a a a ll l l P P P P r r r r ii i i v v v v a a a a t t t t e e e e N N N N e e e e t t t t w w w w o o o o r r r r k k k k s s s s ( ( ( ( V V V V P P P P N N N N s s s s ) ) ) ) The Netopia 4541/454[...]

10-2 User’ s Reference Guide T unneling is a process of creating a private path between a r emote user or private network and another private network over some inter mediate network, such as the IP-based Inter net. A VPN allows remote of fices or employees access to your internal business LAN thr ough means of encr yption allowing the use of the[...]

Virtual Private Networks (VPNs) 10-3 the receiving side, an IPsec-compliant device decr ypts each packet. The Netopia 4541/4542 suppor ts the more secur e T unnel mode. DES stands for Data Encr yption Standard, a popular symmetric-key encr yption method. DES uses a 56-bit key . The Netopia 4541/4542 of fers IPsec DES encr yption over the VPN tunnel[...]

10-4 User’ s Reference Guide PPTP configuration To set up the r outer as a PPTP Network Ser ver (PNS) capable of answering PPTP tunnel r equests you must also configure the VPN Default Answer Pr ofile. See "A TMP/PPTP Default Pr ofile" on page 10-16 for more information. PPTP is a Datalink Encapsulation option in Connection Profile[...]

Virtual Private Networks (VPNs) 10-5 When you define a Connection Profile as using PPTP by selecting PPTP as the datalink encapsulation method, and then select Data Link Options , the PPTP T unnel Options screen appears. ■ Enter the PPTP Par tner IP Address . This specifies the addr ess of the other end of the tunnel. If you do not specify the[...]

10-6 User’ s Reference Guide Note: The Netopia 4541/4542 suppor ts 128-bit (“strong”) encr yption. Unlike MS-CHAP version 1, which suppor ts one-way authentication, MS-CHAP version 2 suppor ts mutual authentication between connected routers and is incompatible with MS-CHAP version 1 (MS-CHAP-V1). When you choose MS-CHAP as the authentication [...]

Virtual Private Networks (VPNs) 10-7 The IP Profile Parameters scr een appears. ■ Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel. About IPsec T unnels IPsec stands for IP Security , a set of protocols that suppor ts secure exchange of IP packets at the IP layer . IPsec is deployed widely to implement Vir [...]

10-8 User’ s Reference Guide The Add Connection Profile scr een appears. ■ From the Data Link Encapsulation pop-up menu select IPsec . ■ Then select Data Link Options . The IPsec Encr yption & Authentication Options screen appears. ■ Y ou must specify an Encr yption Transform . The choices are DES or NULL . The default is DES . Add Con[...]

Virtual Private Networks (VPNs) 10-9 ■ Y ou must enter an Encr yption Key if the Encr yption T ransfor m is DES. The key for DES must be a hexadecimal string of 16 characters, using Hex characters only: '0'-'9', 'A'-'F' and 'a' - 'f'. No key entr y appears if the encr yption transfor m i[...]

10-10 User’ s Reference Guide IP Pr ofile Parameters The following IP Profile Options scr een is displayed for an IPsec Connection Profile. ■ Y ou must specify an SPI (Security Parameters Index) , which is the ESP receive side SPI and the default SPI for ESP transmit, AH receive, and AH transmit. It must be unique r elative to any other con?[...]

Virtual Private Networks (VPNs) 10-11 Map Lists, Ser ver Lists, and P A T addresses ar e described in detail in Chapter 9, “Multiple Network Address T ranslation.” ■ Y ou can specify a Filter Set . See "About filters and filter sets" on page 11-4 . ■ Y ou can r emove a Filter Set . ■ Y ou can choose to configur e Advanced IP [...]

10-12 User’ s Reference Guide If you do not specify the Remote T unnel Endpoint Address, the router will use the default gateway to r each the par tner . If the par tner should be r eached via an alter nate por t (for example, the LAN instead of the W AN), the Next Hop Gateway field allows this path to be resolved. Inter operation with other fea[...]

Virtual Private Networks (VPNs) 10-13 When you define a Connection Profile as using A TMP by selecting A TMP as the datalink encapsulation method, and then select Data Link Options , the A TMP T unnel Options screen appears. Note: An A TMP tunnel cannot be assigned a dynamic IP addr ess by the remote ser ver , as in a PPP connection. When you de?[...]

10-14 User’ s Reference Guide the gateway par tner is reached. If you do not specify the A TMP Par tner IP Address, the r outer will use the default gateway to reach the par tner and the Tunnel Via Gateway field is hidden. If the par tner should be reached via an alter nate por t (i.e., the LAN instead of the WAN), the Tunnel Via Gateway field [...]

Virtual Private Networks (VPNs) 10-15 ■ Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel. Encryption Support Encr yption is a method for altering user data into a for m that is unusable by anyone other than the intended recipient. The r ecipient must have the means to decr ypt the data to render it usable to[...]

10-16 User’ s Reference Guide and transparently . A TMP/PPTP Default Pr ofile The W AN Configuration menu of fers a A TMP/PPTP Default Profile option. Use this selection when your r outer is acting as the ser ver for VPN connections, that is, when you are on the answering end of the tunnel establishment. The A TMP/PPTP Default Pr ofile deter [...]

Virtual Private Networks (VPNs) 10-17 If you chose MS-CHAP authentication, the Data Compression option is not requir ed, and this menu item becomes hidden. VPN QuickV iew Y ou can view the status of your VPN connections in the VPN QuickView scr een. From the Main Menu select QuickView and then VPN QuickView . The VPN QuickView screen appears. Pro?[...]

10-18 User’ s Reference Guide Dial-Up Networking for VPN Microsoft Windows Dial-Up Networking softwar e per mits a remote standalone workstation to establish a VPN tunnel to a PPTP ser ver such as a Netopia Router located at a central site. Dial-Up Networking also allows a mobile user who may not be connected to a P AC to dial into an inter media[...]

Virtual Private Networks (VPNs) 10-19 The Communications window appears. 5. In the Communications window , select Dial-Up Networking and click the OK button. This retur ns you to the Windows Setup screen. Click the OK button. 6. Respond to the prompts to install Dial-Up Networking fr om the system disks or CDROM. 7. When prompted, r eboot your PC. [...]

10-20 User’ s Reference Guide Configuring a Dial-Up Networking profile Once you have created your Dial-Up Networking pr ofile, you configure it for TCP/IP networking to allow you to connect to the Internet thr ough your Inter net connection device. Do the following: 1. Double-click the My Computer (or whatever you have named it) icon on your [...]

Virtual Private Networks (VPNs) 10-21 4. Click the TCP/IP Settings button. ■ If your ISP uses dynamic IP addressing (DHCP), select the Ser ver assigned IP addr ess radio button. ■ If your ISP uses static IP addressing, select the Specify an IP addr ess radio button and enter your assigned IP address in the fields pr ovided. Also enter the IP a[...]

10-22 User’ s Reference Guide This displays a list of possible selections for the communications option. Active components will have a check in the checkboxes to their left. 6. Check Dial Up Networking at the top of the list and Vir tual Private Networking at the bottom of the list. 7. Click OK at the bottom right on each screen until you r eturn[...]

Virtual Private Networks (VPNs) 10-23 Connecting using Dial-Up Networking A Dial-Up Networking connection will be automatically launched whenever you r un a TCP/IP application, such as a web browser or email client. When you first r un the application a Connect T o dialog box appears in which you enter your User name and Password. If you check the[...]

10-24 User’ s Reference Guide PPTP example To enable a fir ewall to allow PPTP traf fic, you must pr ovision the firewall to allow inbound and outbound TCP packets specifically destined for por t 1723. The source por t may be dynamic, so often it is not useful to apply a compare function upon this por tion of the contr ol/negotiation packets.[...]

Virtual Private Networks (VPNs) 10-25 In the Display/Change Filter Set screen select Display/Change Output Filter . Display/Change Output Filter screen Select Output Filter 1 and press Retur n. In the Change Output Filter 1 screen, set the Pr otocol Type and Destination Por t infor mation as shown below . Change Input Filter 2 Enabled: Yes Forward:[...]

10-26 User’ s Reference Guide Select Output Filter 2 and press Retur n. In the Change Output Filter 2 screen, set the Pr otocol Type to allow GRE as shown below . A TMP example To enable a fir ewall to allow A TMP traf fic, you must provision the fir ewall to allow inbound and outbound UDP packets specifically destined for por t 5150. The sou[...]

Virtual Private Networks (VPNs) 10-27 Select Input Filter 1 and press Retur n. In the Change Input Filter 1 screen, set the Destination Por t infor mation as shown below . Select Input Filter 2 and press Retur n. In the Change Input Filter 2 screen, set the Pr otocol Type to allow GRE as shown below . Change Input Filter 1 Enabled: Yes Forward: Yes[...]

10-28 User’ s Reference Guide In the Display/Change Filter Set screen select Display/Change Output Filter . Display/Change Output Filter screen Select Output Filter 1 and press Retur n. In the Change Output Filter 1 screen, set the Pr otocol Type and Destination Por t infor mation as shown below . Select Output Filter 2 and press Retur n. In the [...]

Virtual Private Networks (VPNs) 10-29 Change Output Filter 2 Enabled: Yes Forward: Yes Source IP Address: 0.0.0.0 Source IP Address Mask: 0.0.0.0 Dest. IP Address: 0.0.0.0 Dest. IP Address Mask: 0.0.0.0 Protocol Type: GRE[...]

10-30 User’ s Reference Guide[...]

Security 11-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 1 1 1 1 S S S S e e e e c c c c u u u u r r r r ii i i t t t t y y y y The Netopia 4541/4542 provides a number of security featur es to help protect its configuration scr eens and your local network from unauthorized access. Although these featur es are optional, it is s[...]

11-2 User’ s Reference Guide Once user accounts are cr eated, users who attempt to access protected scr eens will be challenged. Users who enter an incor rect name or passwor d are r etur ned to a screen r equesting a name/password combination to access the Main Menu. To set up user accounts, in the System Configuration scr een select Security a[...]

Security 11-3 To add a new user account, select Add User in the Security Options scr een and press Retur n. The Add Name With Write Access screen appears. Follow these steps to configure the new account: 1. Select Enter Name and enter a descriptive name (for example, the user’s first name). 2. Select Enter Password and enter a passwor d. 3. T o[...]

11-4 User’ s Reference Guide To r estrict T elnet access, select Security in the Advanced Configuration menu. The Security Options screen will appear . There are two levels of T elnet r estriction available: ■ To r estrict T elnet access to the SNMP screens, select Enable T elnet Access to SNMP Scr eens and toggle it to No . (See “SNMP traps[...]

Security 11-5 Each inspector has a specific task. One inspector’s task may be to examine the destination address of all outgoing packages. That inspector looks for a cer tain destination—which could be as specific as a street address or as br oad as an entire countr y—and checks each package’s destination addr ess to see if it matches tha[...]

11-6 User’ s Reference Guide If the package does not match the first inspector’s criteria, it goes to the second inspector , and so on. Y ou can see that the order of the inspectors in the line is ver y impor tant. For example, let’s say the first inspector’s orders ar e to send along all packages that come from Rome, and the second inspe[...]

Security 11-7 Parts of a filter A filter consists of criteria based on packet attributes. A typical filter can match a packet on any one of the following attributes: ■ The source IP addr ess (where the packet was sent fr om) ■ The destination IP address (wher e the packet is going) ■ The type of higher-layer Internet pr otocol the packet i[...]

11-8 User’ s Reference Guide Port number comparisons A filter can also use a comparison option to evaluate a packet’s source or destination por t number. The comparison options are: No Compare: No comparison of the por t number specified in the filter with the packet’s por t number. Not Equal T o: For the filter to match, the packet’s p[...]

Security 11-9 Putting the parts together When you display a filter set, its filters are displayed as r ows in a table: The table’s columns cor respond to each filter’s attributes: #: The filter’s priority in the set. Filter number 1, with the highest priority , is first in the table. Source IP Addr: The packet sour ce IP address to match[...]

11-10 User’ s Reference Guide Filtering example #1 Returning to our filtering r ule example from above (see page 11-6 ), look at how a r ule is translated into a filter . Star t with the r ule, then fill in the filter’s attributes: 1. The r ule you want to implement as a filter is: Block all T elnet attempts that originate from the r emote[...]

Security 11-11 This filter blocks any packets coming from a r emote network with the IP network address 200.233.14.0. The 0 at the end of the address signifies any host on the class C IP network 200.233.14.0. If, for example, the filter is applied to a packet with the source IP addr ess 200.233.14.5, it will block it. In this case, the mask, whi[...]

11-12 User’ s Reference Guide An approach to using filters The ultimate goal of network security is to prevent unauthorized access to the network without compr omising authorized access. Using filter sets is par t of reaching that goal. Each filter set you design will be based on one of the following approaches: ■ That which is not expressly[...]

Security 11-13 To add a new filter set, select Add Filter Set in the Filter Sets scr een and press Retur n. The Add Filter Set screen appears. Naming a new filter set All new filter sets have a default name. The first filter set you add will be called Filter Set 1, the next filter will be Filter Set 2, and so on. To give a new filter set a d[...]

11-14 User’ s Reference Guide Adding filters to a filter set There ar e two kinds of filters you can add to a filter set: input and output. Input filters check packets received from the Inter net, destined for your network. Output filters check packets transmitted from your network to the Internet. Packets in the Netopia 4541/4542 pass thro[...]

Security 11-15 Note: There ar e two groups of items in this scr een, one for input filters and one for output filters. In this section, you’ll learn how to add an input filter to a filter set. Adding an output filter works exactly the same way , providing you keep the dif ferent sour ce and destination perspectives in mind. 1. T o add a fil[...]

11-16 User’ s Reference Guide 5. Select Source IP Addr ess Mask and enter a mask for the source IP addr ess. This allows you to fur ther modify the way the filter will match on the source addr ess. Enter 0.0.0.0 to for ce the filter to match on all source IP addr esses, or enter 255.255.255.255 to match the sour ce IP address exclusively . 6. S[...]

Security 11-17 Deleting filters To delete a filter , select Delete Input Filter or Delete Output Filter in the Display/Change Filter Set screen to display a table of filters. Select the filter from the table and pr ess Return to delete it. Pr ess Escape to exit the table without deleting the filter . Moving filters To r eor ganize the filter[...]

11-18 User’ s Reference Guide Basic Firewall blocks undesirable traf fic originating from the WAN (in most cases, the Internet), but for war ds all traf fic originating fr om the LAN. It follows the conser vative “that which is not expr essly per mitted is prohibited” approach: unless an incoming packet expr essly matches one of the constit[...]

Security 11-19 Output filter 1: This filter for wards all outgoing traf fic to make sure that no outgoing connections fr om the LAN are blocked. Basic Firewall is suitable for a LAN containing only client hosts that want to access ser vers on the WAN, but not for a LAN containing ser vers providing ser vices to clients on the W AN. Basic Firewal[...]

11-20 User’ s Reference Guide FTP sessions. To allow WAN-originated FTP sessions to a LAN-based FTP ser ver with the IP addr ess a.b.c.d (cor responding to a number ed IP address such as 163.176.8.243), inser t the following input filter ahead of the cur rent input filter 1: ■ Enabled: Y es ■ For ward: Y es ■ Source IP Addr ess: 0.0.0.0 ?[...]

Security 11-21 Basic IP packet components All IP packets contain the same basic header infor mation, as follows: This header infor mation is what the packet filter uses to make filtering decisions. It is impor tant to note that a packet filter does not look into the IP data stream (the User Data fr om above) to make filtering decisions. Basic p[...]

11-22 User’ s Reference Guide Fir ewall design rules There ar e two basic r ules to firewall design: ■ “What is not explicitly allowed is denied.” and ■ “What is not explicitly denied is allowed.” The first r ule is far more secur e, and is the best approach to fir ewall design. It is far easier (and more secur e) to allow in or ou[...]

Security 11-23 Logical AND function When a packet is compared (in most cases) a logical AND function is per for med. First the IP addresses and subnet masks are conver ted to binar y and then combined with AND. The r ules for the logical use of AND are as follows: 0 AND 0 = 0 0 AND 1 = 0 1 AND 0 = 0 1 AND 1 = 1 For example: Filter r ule: Deny IP: 1[...]

11-24 User’ s Reference Guide Example filter set screen This is an example of the Netopia filter set screen: Filter basics In the source or destination IP addr ess fields, the IP address that is enter ed must be the network address of the subnet. A host address can be enter ed, but the applied subnet mask must be 32 bits (255.255.255.255). The[...]

Security 11-25 Example network Example filters Example 1 Incoming packet has the source addr ess of 200.1.1.28 This incoming IP packet has a source IP addr ess that matches the network address in the Sour ce IP Address field (00000000) in the Netopia 4541/4542. This will not for ward this packet. Filter Rule: 200.1.1.0 (Source IP Network Addr ess[...]

11-26 User’ s Reference Guide Example 2 Incoming packet has the source addr ess of 200.1.1.184. This incoming IP packet (10000000) has a source IP addr ess that does not match the network address in the Source IP Addr ess field (00000000) in the Netopia 4541/4542. This r ule will for ward this packet because the packet does not match. Example 3 [...]

Security 11-27 Example 4 Incoming packet has the source addr ess of 200.1.1.104. Since the Source IP Network Addr ess in the Netopia 4541/4542 is 01100000, and the sour ce IP address after the logical AND is 01100000, this r ule does match and this packet will not be for warded. Example 5 Incoming packet has the source addr ess of 200.1.1.96. Since[...]

11-28 User’ s Reference Guide[...]

Monitoring T ools 12-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 2 2 2 2 M M M M o o o o n n n n ii i i t t t t o o o o r r r r ii i i n n n n g g g g T T T T o o o o o o o o ll l l s s s s This chapter discusses the Netopia 4541/4542’s device and network monitoring tools. These tools can provide statistical infor mation, re[...]

12-2 User’ s Reference Guide General status Current Date: The cur r ent date; this can be set with the Date and Time utility (see “Date and time” on page 7-16 ). Default IP Gateway: The router’s default gateway , which may be either manually configur ed or lear ned via DHCP . This is the value you assigned in the Default IP Gateway field [...]

Monitoring T ools 12-3 Curr ent status The cur rent status section is a table showing the cur r ent status of the DSL connection. For example: Profile Name: Lists the name of the connection pr ofile being used, if any . Rate: Shows the line rate for this connection. %Use: Indicates the average percent utilization of the maximum capacity of the ch[...]

12-4 User’ s Reference Guide Statistics & Logs When you are tr oubleshooting your Netopia 4541/4542, the Statistics & Logs screens pr ovide insight into the recent event activities of the r outer . From the Main Menu go to Statistics & Logs and select one of the options described in the sections below . Event histories The Netopia 454[...]

Monitoring T ools 12-5 W AN Event History The W AN Event Histor y screen lists a total of 128 events on the WAN. The most recent events appear at the top. Each entr y in the list contains the following infor mation: Date: Date of the event. Time: Time of the event. Event: A brief description of the event. Ch.: The channel involved in the event. The[...]

12-6 User’ s Reference Guide In the Statistics & Logs screen, select Device Event Histor y . The Device Event Histor y scr een appears. If the event histor y exceeds the size of the screen, you can scr oll through it by using SCROLL UP and SCROLL DOWN. To scr oll up, select SCROLL UP at the top of the list and press Retur n. T o scr oll down,[...]

Monitoring T ools 12-7 IP Routing T able The IP routing table displays all of the IP r outes cur rently known to the Netopia 4541/4542. The routing table scr een repr esents a snapshot of the routing table infor mation at the time the scr een is first invoked. T o take a new snapshot, select Update at the bottom of the screen and press Retur n. Ge[...]

12-8 User’ s Reference Guide Physical Interface The top left side of the screen lists total packets r eceived and total packets transmitted for the following data por ts: ■ Ethernet ■ DSL Network Interface The bottom left side of the screen lists total packets r eceived and total packets transmitted: ■ IP (IP packets on the Ethernet) The ri[...]

Monitoring T ools 12-9 System Information The System Infor mation screen gives a summar y view of the general system level values in the Netopia 4541/4542. From the Statistics & Logs menu select System Information . The System Infor mation scr een appears. The infor mation display varies by model, fir mware version, featur e set, and so on. Y [...]

12-10 User’ s Reference Guide The SNMP Setup screen From the Main Menu, select SNMP in the System Configuration screen and pr ess Retur n. The SNMP Setup screen appears. Follow these steps to configure the first thr ee items in the screen: 1. Select System Name and enter a descriptive name for the Netopia 4541/4542’s SNMP agent. 2. Select Sy[...]

Monitoring T ools 12-11 By default, the read-only and r ead/write community strings are set to public and private, r espectively . Y ou should change both of the default community strings to values known only to you and tr usted system adminis- trators. To change a community string, select it and enter a new value. Star ting with the version 4.3 ?[...]

12-12 User’ s Reference Guide Setting the IP trap receivers 1. Select Add IP Trap Receiver . 2. Select Receiver IP Address or Domain Name . Enter the IP address or domain name of the SNMP manager you want to receive the trap. 3. Select Community String if you enabled one in the SNMP Setup screen, and enter the appropriate password. 4. Select Add [...]

Utilities and Diagnostics 13-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 3 3 3 3 U U U U t t t t ii i i ll l l ii i i t t t t ii i i e e e e s s s s a a a a n n n n d d d d D D D D ii i i a a a a g g g g n n n n o o o o s s s s t t t t ii i i c c c c s s s s A number of utilities and tests are available for system diagnostic a[...]

13-2 User’ s Reference Guide Ping The Netopia 4541/4542 Router includes a standard Ping test utility . A Ping test generates IP packets destined for a par ticular (Ping-capable) IP host. Each time the tar get host r eceives a Ping packet, it retur ns a packet to the original sender . Ping allows you to see whether a par ticular IP destination is [...]

Utilities and Diagnostics 13-3 Status: The cur rent status of the Ping test. This item can display the status messages shown in the able below: Packets Out: The number of packets sent by the Ping test. Packets In: The number of retur n packets received fr om the tar get host. T o be consider ed on time, retur n packets are expected back befor e the[...]

13-4 User’ s Reference Guide Packets Lost: The number of packets unaccounted for , shown in total and as a percentage of total packets sent. This statistic may be updated during the Ping test, and may not be accurate until after the test is over . However , if an escalating one-to-one corr espondence is seen between Packets Out and Packets Lost ,[...]

Utilities and Diagnostics 13-5 To trace a r oute, follow these steps: 1. Select Host Name or IP Address and enter the name or addr ess of the destination you want to trace. 2. Select Maximum Hops to set the maximum number of routers to count between the Netopia Router and the destination router , up to the maximum of 64. The default is 30 hops. 3. [...]

13-6 User’ s Reference Guide The T elnet client screen appears. ■ Enter the host name or the IP address in dotted decimal for mat of the machine you want to T elnet into and press Retur n. ■ Either accept the default control character “Q” used to suspend the T elnet session, or type a dif ferent one. ■ ST ART A TELNET SESSION becomes hi[...]

Utilities and Diagnostics 13-7 T ransferring configuration and firmwar e files with TFTP T rivial File T ransfer Pr otocol (TFTP) is a method of transfer ring data over an IP network. TFTP is a client-ser ver application, with the router as the client. T o use the Netopia 4541/4542 as a TFTP client, a TFTP ser ver must be available. Netopia, Inc[...]

13-8 User’ s Reference Guide ■ Select GET ROUTER FIRMW ARE FROM SERVER and press Retur n. Y ou will see the following dialog box: ■ Select CANCEL to exit without downloading the file, or select CONTINUE to download the file. The system will reset at the end of the file transfer to put the new fir mwar e into ef fect. While the system r es[...]

Utilities and Diagnostics 13-9 ■ Select GET CONFIG FROM SERVER and press Retur n. Y ou will see the following dialog box: ■ Select CANCEL to exit without downloading the file, or select CONTINUE to download the file. The system will reset at the end of the file transfer to put the new configuration into ef fect. ■ If you choose to downloa[...]

13-10 User’ s Reference Guide Updating firmwar e Fir mware updates may be available periodically fr om Netopia or from a site maintained by your or ganization’s network administration. Follow these steps to update the Netopia 4541/4542’s fir mware: 1. Make sure you have the fir mwar e file on disk and know the path to its location. 2. Sel[...]

Utilities and Diagnostics 13-11 Caution! Do not manually power down or reset the Netopia 4541/4542 while it is automatically r esetting or it could be damaged. Downloading configuration files The Netopia 4541/4542 can be configured by downloading a configuration file. The downloaded file reconfigur es all of the Router’s parameters. Confi[...]

13-12 User’ s Reference Guide 3. Select CANCEL to exit without uploading the file, or select CONTINUE to upload the file. If you choose CONTINUE, you will have ten seconds to use your ter minal emulation software to initiate an XMODEM transfer of the configuration file. If you fail to initiate the transfer in that time, the dialog box will di[...]

Tr oubleshooting A-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x A A A A T T T T r r r r o o o o u u u u b b b b ll l l e e e e s s s s h h h h o o o o o o o o t t t t ii i i n n n n g g g g This appendix is intended to help you troubleshoot pr oblems you may encounter while setting up and using the Netopia 4541/4542. It also inc[...]

A-2 User’ s Reference Guide Console connection pr oblems Can’t see the configuration scr eens (nothing appears) ■ Make sure the cable connection fr om the Netopia 4541/4542’s console por t to the computer being used as a console is securely connected. ■ Make sure the ter minal emulation softwar e is accessing the cor rect por t on the co[...]

Tr oubleshooting A-3 How to r eset the router to factory defaults Lose your password? This section shows how to r eset the router so that you can access the console scr eens once again. Keep in mind that all of your connection profiles and settings will need to be r econfigured. If you don't have a password, the only way to get back into the[...]

A-4 User’ s Reference Guide Technical support Netopia, Inc. is committed to providing its customers with r eliable products and documentation, backed by excellent technical suppor t. Before contacting Netopia Look in this guide for a solution to your problem. Y ou may find a solution in this troubleshooting appendix or in other sections. Check t[...]

Tr oubleshooting A-5 Online product information Product infor mation can be found in the following: Netopia World Wide W eb ser ver via http://www .netopia.com Internet via anonymous FTP to ftp.netopia.com/pub FAX-Back This ser vice provides technical notes that answer the most commonly asked questions and of fers solutions for many common problems[...]

A-6 User’ s Reference Guide[...]

T echnical Specifications and Safety Information B-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x B B B B T T T T e e e e c c c c h h h h n n n n ii i i c c c c a a a a ll l l S S S S p p p p e e e e c c c c ii i i f f f f ii i i c c c c a a a a t t t t ii i i o o o o n n n n s s s s a a a a n n n n d d d d S S S S a a a a f f f [...]

B-2 User’ s Reference Guide December 1, 2000 ■ Canada – CSA: CAN/CSA-C22.2 No. 950-95 EMI: ■ FCC Par t 15 Class B International Safety Approvals: ■ Low V oltage (Eur opean directive) 73/23/EEC ■ EN60950 1992 (Europe) ■ AS/NRZ 3260 (Australia) ■ TS001(Australia) EMI Compatibility: ■ European Dir ective 89/336/EEC ■ EN 300 368.2-1[...]

T echnical Specifications and Safety Information B-3 The telephone company may make changes in its technical operations and procedur es; if such changes af fect the compatibility or use of this device, the telephone company is requir ed to give adequate notice of the changes. Y ou will be advised of your right to file a complaint with the FCC. If[...]

B-4 User’ s Reference Guide Caution Users should not attempt to make such connections themselves, but should contact the appropriate electric inspection authority , or electrician, as appr opriate. The Load Number (LN) assigned to each ter minal device denotes the percentage of the total load to be connected to a telephone loop which is used by t[...]

T echnical Specifications and Safety Information B-5 Replace only with the same or equivalent type recommended by the manufactur er . Dispose of used batteries according to the manufactur er's instr uctions.[...]

B-6 User’ s Reference Guide[...]

Limited Warranty and Limitation of Remedies-Revised January 2002 L L L L ii i i m m m m ii i i t t t t e e e e d d d d W W W W a a a a r r r r r r r r a a a a n n n n t t t t y y y y a a a a n n n n d d d d L L L L ii i i m m m m ii i i t t t t a a a a t t t t ii i i o o o o n n n n o o o o f f f f R R R R e e e e m m m m e e e e d d d d ii i i e e[...]