Perle Systems P840 manual

Perle P840 Bridge/Router with VPN Reference Manual All So ftw are Versio n s Pa rt numb er 5500063-12 © cop yright 2002 b y P erle System s Ltd.[...]

2 1 Introdu ction Th e P840 Route r Th e P 840 ro ut er p ro vide s I P r out in g co m b ine d wit h a pr o t oc o l tran sp are nt br idge . Th is bridge /r o ute r co m bin at io n is of te n the bes t sol u ti on to li nk i ng re motel y l oca ted LANs w here mos t of the traf fi c i s IP wi th s mal l er a mounts of tra f fi c fr om othe r pro[...]

Introduction 3 IP Routin g a nd th e P840 Rout er Th e P 840 ro ute r m ay be used t o ro ute b et we en sub n et s with in t h e sam e n et work o r b et ween diff er en t n et wo rks. Network broa dca sts sent w ithin a s ubnet-ro uted env ironment will not be forw a rded to the other s ubnet s in th e net wor k. The proce du re f or es tabl i sh[...]

Introduction 4 The Comp lete I P Connec tio n Th e f ollo wing are t h e st ep s th at a fram e of dat a will take wh en being t ra ns mit ted fr o m an origin at ing st atio n o n an IP ne two rk to a desti nation stati on on a d ifferent IP network. In this e xample, the two networks are separated by a third n etwork. • Or iginat ing statio n w[...]

Introduction 5 IP H eader Det ails Ev ery IP he ad er has common fi el ds of i nf ormati on. The l ayo ut of the inform a tion is alwa ys t he sam e. Refer to the follo w ing di ag ra m for a re prese ntati on of th e IP he ader . Figure 1 —2 IP Heade r Protocol The protocol se cti on i s u se d to i ndi ca te the protoc ol be i ng u s ed by the [...]

Introduction 6 Source Routing Source routing is us ed to predet ermine the path th at the IP frame mus t travel through the network . There are tw o types of s ource routi ng: stri ct source routi ng and loose s ource routi ng. St ric t so urc e r out ing will con tain a list of IP addr ess es o f ro ute r s th at m ust b e used whe n th e IP fram [...]

Introduction 7 Ping The “ ping ” mes sa g e i s a ctu al l y a q u ery s tatu s mes sa ge that ma y be sent to d ev i ces on the LAN to q ue ry thei r op erat io n st atus. T h e p in g me ssage is b asic ally a m es sage as king “A r e y ou alive ?” T he L AN de vice will re p ly wit h a me ssage if it is act ive. Ti me and Ma sk ser ver T[...]

Introduction 8 Bri dging an d the P840 Rou te r Th e b ridge p ort io n o f the P840 r o ute r is an Et h er ne t Media A cc es s Co ntr o l (M AC) leve l br idge pr ovidin g an e ffic ien t me an s of interconnecting IEEE 802.3 L oc al Ar e a Ne tw or ks su pporting a c hoic e of s ta nda rd Ethe rnet (1 0B as e5 ), Thi n Etherne t (10 Ba se 2) a [...]

Introduction 9 Forw arding Once the i niti al l earni ng process is complete, th e bridge/router enters a f orwardi ng mode and examines fra mes that may need to be fo rwarded. The l earning process doe s not stop at this time, h o wev er: The b ri dge/ rout er w ill con tinue le arni ng ne w s tati ons a s they bec ome a cti ve on a LAN seg ment. [...]

Introduction 10 Address Pu rgi ng To achiev e this rou tine housek eeping , the fil ter table contai ns the LAN addresses , al ong wi th their LAN port iden t ifier , an d a t ime r flag . Each time a pa rti cu la r a dd ress i s l ook ed u p or a dd ed to the ta bl e, a ti mer fl a g is s et for the “fresh” en try. When a time interval , defin[...]

Introduction 11 P840 Route r Fea tu re D efi ni tion s Tel n et A T eln et LA N stat io n or anot h er P840 r out er h as th e abilit y t o c o n ne ct t o t he Op erat or I nt er face o f an y P840 r o ute r su pporti ng the Tel net f ea ture . W ith the T eln et f eat ure , a ll of yo ur P840 ro uter s may be manage d fr o m a singl e point. Once[...]

Introduction 12 0 1 2 3 4 5 6 7 Graphic Database Post Script ASCII C Source Spreadsheet Binary Pre-compressed Fi le Ty pe Compres sion Ratio Fi gu re 1 — 3 Typ ica l C omp ressio n Rati os b y F ile Type Dat a co m p re ssion will give a 56/64 Kbp s link an effec tive t hr oughp ut ran ge fro m 112/128 Kb ps whe n tr ansfer rin g binar y files, t[...]

Introduction 13 WAN T op olo gies Th e P840 ro ut er m ay b e c o n ne ct ed to ot h er P840 r out er s in two co nfigurat io n s: M ultip o int or PPP M ultilin k. The WAN routing method used is set in the Re mote Site profile def ined in t he Remo te Site Set-Up Menu. Mult ilink In a Mult ilink co n figurat ion, two P840 ro ut er s are connected [...]

Introduction 14 To set u p a Ba ndw id th on Dema nd i ns tal l a tion, you mus t choos e the throu g hput l ev el tha t w ill be r e quire d fo r act ivatin g the st and -b y link. Th e th ro ughput level is m eas ure d in p er ce n t age o f use o f t h e p r imar y link. Th is per cen tage level is def ine d by th e Up Thr esh old p arame ter in[...]

15 2 ISDN Co nnect io n Ma nage me nt P840 ISD N Co nnectio n Manag ement In t h e wo r ld o f IS DN th e ab ility t o de cr ease connection t ime is a finan cial bonu s in th e LA N in terconnecting marketpl ace. If ISDN connec ti ons ca n be contr oll ed so tha t a mini mu m am ount of cos t i s in cu rre d w hi le f ull LAN in terconne c ti ng f[...]

ISDN Connection Management 16 Aut o-Call (Tim e- of-Day Conn ect ions) An Aut o -C all con n ect ion is an I SD N co n ne ct io n t hat is est ab lishe d eac h time t h e P840 att em p ts to start th e li nk. This start ing o f the lin k s oc c urs each t ime a P 840 powers up or when the l i nk g oes throu g h a res ta rt or at th e tim es sp ecif[...]

ISDN Connection Management 17 Address Conn ect An Add res s Connec t connec tion i s a n ISDN c onnecti on tha t i s es tabl i s hed to a s peci fi c des ti na tion P 8 40 dependent u pon the desti na tion net work address cont a ined w ithin traf f ic r eceive d fr om t he l ocal L A N. When a devi ce on the local LAN wi shes to establi sh a ses s[...]

ISDN Connection Management 18 Com binat ion A combi na ti on of the Addre ss Con nect an d A uto-C all opt io ns m ay be c o nf i gur ed whe n a se mi-per manent conne c ti on is req ui red to one remote site an d a dyn amic conne c tio n is r e quired to mul ti ple sites. A dyna mic connect ion i ndica t e s th at th e r e m ot e sit e f or t he s[...]

ISDN Connection Management 19 Protocol A waren es s For Co nn ection M anagement to be effective, each of the P840s must be aware of th e pro tocols used within the data being transferred over the ISDN call s between them . IP Clie nt - Ser ver sessio ns are esta blis hed betwe e n devices lo cat ed on t he LA Ns t hat are ro uted by the P840 ro ut[...]

ISDN Connection Management 20 P840 Session Pa rtici pation ( Spoofing) Whi le an IS DN cal l i s up an d connected , a ll tra ff ic w ithin the s es s ions will be c o ns idere d interes ting a nd will be tr an sfer re d t o th e par tn er P840 acr oss t h e I SD N call. Wh en t h e P840 det erm ine s th at th e I SD N call i s to b e suspe n ded ,[...]

ISDN Connection Management 21 Term inat ion Proces s Whe n th e P840 has de te rm in ed t hat t here are no ses sion s acti ve on a n ISDN call, the P 840 will att e mpt to clo se the ca l l. I f the partner P 840 st ill ha s s e ssions assign ed to t hat call , t he call will be m ain tain ed unt il each sid e h as determ ined t hat there are no a[...]

22 3 Interfaces Reference Pino ut I nfo rm ati on Conso le Connec to r Th e con so le c on nect or o n th e P840 is a DC E in t er fac e o n a RJ 45 pino ut . T he supp lied DB 9 t o RJ 45 con ver te r sh ould b e us ed t o co n ne c t t o t he D B9 c o nn ect or of a D TE te r min al. Th is co nne ct ion will t hen p ro vide a ccess to the bui l t[...]

23 4 Event Logs Th e P 840 ro ut er gen er ates eve n t lo gs fo r vario us fun ct io ns p erfo rm ed by t he b ridge /r o ute r. All o f t h e e ven t logs are sto r ed in the internal ev ent log fi l e, whi ch is acces si ble throug h the Network Ev ents menu. Certain event logs are classi fi ed as alarms becau se they are deemed to b e of higher[...]

Event Logs 24 Compl eted BCP neg oti ati on w i th <re mote s i te a li a s > Genera ted w hen the Bri d gi ng Control Protoc ol negoti a ti on has been c omple ted w i th the remote s i te dev i ce ass ociated with t he stated rem ote site profile. Once BCP neg otiations a re comp lete, IP routi ng may tak e place betw een th e two routers. [...]

Event Logs 25 ISDN link has ha d no t raffi c for longer than specifi ed by the idle ti mer and has been disconnected. Incorrect pa ss w ord f rom < IP ad dres s > Genera ted w hen a n inc orrect pa ss w ord i s g i v en for a Tel net conne cti on. The conne cti ng bri dg e/ route r’s na me o r I P add r ess is s pecifi ed. A ft er th ree i[...]

Event Logs 26 LCP X a u thenti ca ting pe er wi th PAP Generated when th is devi ce is u sing PAP to authenticate the peer (rem ote) device. LCP X esta bl i shi ng Gen er ated wh en th e Lin k Con tr ol Pr ot oco l of a PPP link o r re mo te site is est ablishing betwe en th is device and t he r em ot e site PPP device. LCP X no rep ly to Y Echo-Re[...]

Event Logs 27 Res tori ng boot DNLDSEG config u ra tion Genera ted u pon ente ring Netw ork Load Mode to i ni ti al i z e s peci fi c c onfi g ura ti on i nforma ti on re qu i red for retriev i ng new code i mag e. Generated upon enter ing operat i onal afte r a successful c od e bur n into fl ash . Res tori ng boot EEP RO M confi gu ra ti on Gener[...]

Event Logs 28 St atio n ad dr ess t able h as bee n fille d Ge n er at ed whe n th e stat io n addr es s t able is fille d. Th is e ven t is n ot rege ne r ate d unt il the tab le size dro p s be lo w 3/4 full an d th en fills again . STP disabled Genera ted w hen STP i s di s a ble d. STP enabled Generated when STP is ena bled. TFTP: s top p ut ti[...]

Event Logs 29 Ala rm log s: * Bad i nternal block check su m detected Ge n er at ed wh en power up diag nos tics fi nds a fault in th e in te rn al b lock of t he EEPRO M. * Clos i ng remote s i te X (ca l l l im it) Generated when the specified nu mber o f cal ls has been exceeded. * Clos ing r em o te sit e X (c allb ack failur e) Generated when [...]

Event Logs 30 * Clos ing r em o te sit e X ( usage lim it) Genera ted d ue to reachin g u s ag e limit fo r t his 24 ho ur p er io d. * Co n fig. er ase faile d Ge n er at ed wh en, dur ing a sof twar e updat e, th e devic e c onfigu ration is n o t e ras ed f ro m the non-vo lat il e memory w i thin the ti me l i mi t. Pos si bl e ha rdw a re fa u[...]

Event Logs 31 * DH CP s erv er – ou t of a ddre ss es in IP pool Genera ted w hen the la s t add res s f rom the DHCP IP Ad dres s pool has been as s ig ned to a de vi ce . * Dow nl oad a borted – Incomp lete f ile Ge n er at ed wh en a T FT P do wn load is ab or ted b efor e t h e file t ran sfer is co m ple t e * Download abor ted – Invalid[...]

Event Logs 32 * FTP server added t o firewall The IP addres s of the FTP serv er added to the table of s ervi ces a va il a ble through the firew al l. * FTP serv er removed from fire wa ll Th e I P addre ss of th e FTP server re m oved fr o m t he ta ble of servi ces available throu gh the f ire w a ll. * IS DN BRI interfa ce dea cti va ted Genera[...]

Event Logs 33 * Li nk X Di sconne ct: Y Genera ted w hen the d i sconne ct of a n ISDN c al l i s c omple ted. This ev ent i s g ene rate d on both si de s of the IS DN ca ll. T he cause will b e o ne o f t he cause s as spec ified in the CCIT T Reco mme nd atio n Q.931. Cause s of “ normal ca ll cl eari ng ” , “ U ser bu sy ”, and “Nu mb[...]

Event Logs 34 Code D es cr ipti on 055 056 057 058 063 065 In com in g calls b ar red w ith in CUG Call wa itin g n ot s ub scr ibed Bearer cap ab ility no t a uth orized Bearer ca p ab ility n ot p res ent ly a vaila ble Serv i ce or option not available, unsp ecified Bearer cap abilit y no t im plemen ted 06 6 C hanne l type not impl e mente d 06[...]

Event Logs 35 * Lin k X do wn Gen erated when a WAN link goes down. * Li nk X dow n to < remote si te a l i as > Genera ted whe n a P PP ISDN c al l to a remote si te is dropped . * Li nk X dow n to < remote si te a l i as > Generated when a W AN li nk connect ion to th e specif ied remote site goes down. * Li nk X Incomi ng Data Ca l l[...]

Event Logs 36 * Local DNS ser ver added to firewal l The IP addres s of the Local DNS server a dded to th e table of servi ces av ai la ble throug h the firewa ll . * Local DNS serv er removed from f irewa l l Th e I P addr ess of th e L oc al DNS ser ver r e mov ed fr om t he ta ble of se rvices availabl e throu gh the f ir ew a ll . * NAT UDP flo[...]

Event Logs 37 * Old down load m et h od ! L o ad in ”*. all” file Ge n er ate d wh e n an at te m pt is made to lo ad a *.f cs o r *.lda f or m at p rogr am file in to har dwar e whic h will on l y a ccept *.all fo r mat co de . * O l d forma t confi g ura ti on, u si ng de fa u lt Generated when the s aved conf i gur at ion does not m atch t[...]

Event Logs 38 * R u nni ng i n Sys tem Load mode Ge ne r ate d wh en e nt er i ng Sy ste m Lo ad Mod e in p re para t ion for a downloa d of code to be burn e d into f las h. * SECU RITY ALER T: SNMP commu ni ty < X> ha s wr ite access enabled to “AL L ” hosts The SNMP comm unity di spla yed has had w rite access enabled to all hosts on t[...]

Event Logs 39 * U nabl e to bind UD P Boot P ser ver port Generated as a resul t of an internal dev ice error. Try resetti ng the devi ce. If this i s u nsu ccess ful , contact a s ervi ce representativ e. * U na ble to bind UDP DHCP ser ver port Generated a s a resu lt of an i nternal de vi ce error. Try reset tin g the dev ice. If th is is uns u [...]

Event Logs 40 PPP Secu rity logs: CHAP a uthe ntica ti on fa i lu re s o termi nate l i nk . Genera ted when the CHAP au thenti ca tion sent by this router i n res ponse to a re qu es t f rom a remote si te i s rejected. CHA P failed for < re m ot e sit e alias> Ge n er ate d when t he re m ot e site r oute r fa iled a C HA P aut he n tic at [...]

41 5 Programmable Filterin g Pro gra mm ab le filt er in g gives t he ne tw ork manag er t he a b ility to control und er wh at con ditions E the r ne t fra mes a re f orwa rded acros s bridg e or bridg e/ rou ter ports. There are many rea sons why this mi g ht need to be ac compl is hed , s ome of w hi ch a re sec uri ty, protocol d is cri mi na t[...]

Fil ter in g 42 Se curity—“ Filt e r if Des tinat ion” Filt er if De st in atio n is a funct i on th at allo ws yo u to filter an Et h er n et fr ame b ased o n t h e d est in atio n of its addr es s. If th e destinati on a ddress equal s the address that th e Fil ter if Destination function has been appli ed to, th e frame is fil tered. Exam[...]

Fil ter in g 43 Se curit y—“ Filter if S ource ” Fil ter if So urce is a function th at al low s you to fi lter an Ethernet frame if the source a ddress of the fra me equa ls the ad dres s tha t the F ilter if So urce fun ctio n has bee n a ppl ied t o. Exam pl e: Ass u me tha t a P ers onal Compu ter is l oca ted on s eg ment 1 on the l oca [...]

Fil ter in g 44 8 Th e b ridge/ ro uter will p rom pt you fo r th e L AN th at t he st at ion is locat ed on ; en te r th e nam e o f th e p ar tn er br idge/r out er L AN ( LA N345678, fo r e xam p le) . No t e t h at t h e St at us of th e ad dr ess is m arke d as [ p re sen t] , th e lo cat ion is updat ed t o LA N345678 and the Permanent entry [...]

Fil ter in g 45 5 From the MAC ADDR ESS F ILTERS MENU, enter a 1. Th is will p lace y ou a t the fir st EDIT MA C AD DRES S F IL TER MENU screen. At the prompt enter the MAC addre ss for which yo u w ant to sp ecify th e filter . 6 Enter the 1 2 -di gi t Etherne t ad dres s of the hos t sy stem i n the f ol low i ng forma t: 000001020304 (enter a R[...]

Fil ter in g 46 4 From the MAC AD DRESS FILTERS MENU , make s ure that the Fil ter Operation is currently s et to “nega tiv e”. Th is will c ause t he M AC Ad dr ess Filt er s sp ec ifie d t o be use d fo r fo rwar ding fr am es wit h th e spe cif ied M AC addresse s. 5 At this menu, enter a 1. Th is will p lace y ou a t the fir st EDIT MA C AD[...]

Fil ter in g 47 Patt ern F ilter Oper ato rs Th e f ollo wing op erat o rs are use d in cr eat ing Pat te r n f ilte r s an d will b e d iscuss ed furt her in th e follo wing page s. Fo r ad di ti onal i nforma ti on ref er to the octe t loc ati ons di a gra ms at the ba ck of this ma nua l . Ea ch octet l oca ti on may contai n a HEX val ue. - off[...]

Fil ter in g 48 In Local Area Netw ork s there ma y be many d i ff erent Netw ork a nd Tra nsport l a yer protocol s tha t coexi s t on the sa me phys i cal medi a . TCP/IP , DECNET, and XNS are j u s t a f ew of the c ommon protocol s i n u se toda y. E ach of thes e protocol s is encapsul ated within an Ethern et frame, and th erefore is transpar[...]

Fil ter in g 49 In th is cas e, whenever a frame i s recei v ed, the frame w ill be f ilte re d if th e p rot oco l ty pe is NO T e qual to 0800 (I P) . Onl y one f i lte r patte rn may be u s ed tha t conta i ns the NOT opera tor.[...]

Fil ter in g 50 Transp ort Cont rol Prot ocol / In te rne t Prot ocol (TCP/IP) The previ ou s exa mple s how ed how to fi lte r a l l Ethernet f rame s that conta ine d a n IP protocol pa ck et. H ow ev er, IP is us ed as the Netw ork -l aye r protocol for more tha n 4 0 di ff erent Tra nsport-l a yer protoc ols , TCP bei ng onl y one of them. Ther[...]

Fil ter in g 51 DEC DE C uses pro t oc o l ty pe s 6000 to 600F , and alth ough som e are un de fine d, a sim p le filter m ask can b e c re at ed t o filte r all DE C t raf fic. Filt er all DE C Th e m ask to filt er all DE C t raffic wo uld be : 12- 600X The X is a variab le rep rese nt ing th e last fo ur bit s ( a n ibb le) o f t h e t yp e. Th[...]

Fil ter in g 52 General Restric tio ns Bridg e Fi lter Ma sk s may be crea ted to generall y restri ct acces s for v ari ous pu rposes. Some of these purposes may be to fi lter spec if i c combin at ions of inform atio n. T h is s ect io n will gen era lly d epic t m a sks tha t may be create d to co ntro l tr af fic a cross t he brid ge d LAN netw[...]

Fil ter in g 53 Mask Co mbin ati on s Mask com binations may be requ ired to ensu re th at a f rame is suf fi ciently q ua li fi ed before the decisi on to fi lter is mad e. Th e qualifica tion a f r ame must go thro u gh befor e a fil ter d e ci si o n is mad e depe nds on the re as on for t he filte r. Nonethel es s, a few ex ampl es bel ow hav e[...]

Fil ter in g 54 IP Ro uter P att ern Fi lt ering Pa ttern fi lte ring ma y be u s ed on a ny porti on of the IP f ra me. IP pattern f i l teri ng be hav es the s ame as bri dg e pa ttern fi l teri n g, except the start of the IP frame is off set 0 , becaus e the IP router functi on of the bridge /router handles only the IP f rame its elf. IP pa tte[...]

55 6 Frame Formats This a ppendi x prov i de s octe t loc ati ons for the v a ri ou s porti ons of three of the common Etherne t fra mes . Whe n c rea ting pat ter n filte r s t he se diagr ams will assist in th e cor rect defin itio n of th e pat t er n s. Th e off set num be r s are indic at ed by th e numbers a bove the frame representations. No[...]

Frame Format s 56 ETHERNET TYPE CODES Type Code Descr ipti on 0800 DOD I P 0801 X.75 I nt ernet 0804 Ch aos net 0805 X.25 Lev el 3 0806 A RP 0807 XN S C om pati b ility 6001 DEC M OP Dum p/Load 6002 DEC M OP Rem ote Con s ole 6003 DEC D E C NET Phase IV R ou te 6004 DEC LA T 6005 DEC D ia gnostic P rotocol 6006 DEC Cu sto mer P rotocol 6007 DEC L A[...]

Frame Format s 57 Octet Locations on an IP Route d TCP/IP F rame[...]

Frame Format s 58 Octet Location s on a Bridged X NS Frame[...]