Netopia 6.3 manual

Software User Guide Cayman Operating System Version 6.3 January 2002 Cayman 3000 series by Netopia[...]

Copyright © 2002 Netopia, Inc. All rights reserved, Printed in the USA. The information in this document is subject to change without notice. The statements, configurations, technical data, and recom- mendations in this document are believed to be accurate and reliable, but are presented without express or implied warranty . Users must take full [...]

3 Disclaimers ...........................................................................................................2 Table of Contents ................................................................................................3 Introduction ..................................................................................................[...]

4 Combination NAT Bypass Configuration .......................................................... 22 Security Monitor ..................................................................................................... 22 Event Details ........................................................................................................... 23 IP[...]

5 Configure a SafeHarbour VPN ............................................................................. 73 VPN IPSec Tunnel at the Gateway .............................................................. 73 Parameter Description and Setup ................................................................. 74 IPSec Tunnel Parameter Setup Worksheet .[...]

6 Default IP Gateway Settings ................................................................................... 128 WAN-to-WAN Routing Settings ............................................................................ 129 IP-over-PPP Settings ............................................................................................... 129 St[...]

7 Section 1 About Cayman Documentation About Ca yman Documentation Netopia, Inc. provides a suite of technical information for its Cayman-series family of intelligent enterprise and consumer Gateways. It consists of: • Software User Guide • Hardware and Installation User Guide • Dedicated Quickstart booklets • Specific White Papers The doc[...]

8 Section 1 Documentation Conventions Documentation Con ventions General This manual uses the following conventions to present information: Internal W eb Interface Command Line Interface Syntax conventions for the Cayman gateway command line interface are as follows: Con vention (T ypeface) Description bold italic monospaced Menu commands and butto[...]

9 Section 1 Documentation Conventions Icons Icons used in the guide are: T ext The words “Cayman Gateway” and “Gateway” refer to a standard unit from the Netopia Cayman 3000-Series product families. BOTH Pointing to a CLI command, refers to both DSL and Ethernet W AN inter faces for Cayman Gateways DSL Pointing to a CLI command, refers only[...]

10 Section 1 Organization The expressions “Release 6.3.0” and “R 6.3.0” refer to the most recent generally available Cayman Operating System: COS 6.3.0R0. Or ganization This guide consists of six sections, three appendixes including a glossary , and an index. It is organized as follows: • Section 1, “Introduction” — Describes the Ca[...]

11 Section 2 Basic Product Structure Basic Pr oduct Structure Units from the Netopia Cayman-series Gateway family are supplied in many configurations. This presents end-users with many alternatives for W ide Area Network (W AN) inter faces and Local Area Network (LAN) inter- faces. This is the current product roster that supports COS 6.3: About Ca[...]

12 Section 2 What’s New in Version 6.3 What’ s Ne w in V ersion 6.3 The new features for COS 6.3 are: New Embedded W eb Server Not only is the look and feel different, but the database and the web server engine are new and more flexible. The design of the new web server is geared to make navigation easier , pro- viding the most commonly used i[...]

13 Section 2 Capabilities Roadmap for COS 6.3 Capabilities Roadmap f or COS 6.3 Cayman Gateways support a wide array of features and functionality . This roadmap points you to overview discussions and How T o procedures. Capabilities Roadmap: Ca yman Gatewa ys with COS 6.3 Feature New for COS 6.3 Outline Page Details General Software Feature Keys Y[...]

14 Section 3 General This section describes the principal features of Cayman Operating System version 6.3. The information is grouped by usage area. General Feature Keys Certain functionality in this release is controlled through software feature keys. These keys are proprietary files with the following properties: • They are specific to the se[...]

15 Section 3 General Management Embedded W eb Server There is no specialized client software required to configure, manage, or maintain your Cayman Gateway . W eb pages embedded in the operating system provide access to the following Gateway operations: • Setup • System and security logs • Diagnostics functions Once you have removed your Cay[...]

16 Section 3 General Local Area Network DHCP ( Dynamic Host Configuration Protocol ) Server DHCP Server functionality enables the Gateway to assign your LAN com- puter(s) a “private” IP address and other parameters that allow network communication. The default DHCP Server configuration of the Gateway supports up to 253 LAN IP addresses. This [...]

17 Section 3 General W ide Area Network DHCP ( Dynamic Host Configuration Protocol ) Client DHCP Client functionality enables the Gateway to request an IP address from your Service Provider . DHCP ser vers on your Service Provider’ s net- work reply to DHCP Client requests and assign the network parameters. PPPoE ( Point-to-Point Protocol over E[...]

18 Section 3 General • Y our network may change address with each connection making it more difficult to attack. When you configure Instant On access, you can also configure an idle time-out value. Y our Gateway monitors traffic over the Internet link and when there has been no traffic for the configured number of seconds, it disconnects th[...]

19 Section 3 General Security Password Protection Access to your Cayman device is controlled through two access control accounts, Admin or User . • The Admin , or administrative user , per forms all configuration, manage- ment or maintenance operations on the Gateway . • The User account provides monitor capability only . A user may NOT change[...]

20 Section 3 General A similar configuration applies to a DSL W AN inter face (3220 family). Cayman Advanced Features for NA T Using the NA T facility provides effective LAN security . However , there are user applications that require methods to selectively by-pass this security function for certain types of Internet traffic. Cayman Gateways pro[...]

21 Section 3 General Pinholes This feature allows you to: • T ransparently route selected types of network traffic using the port for- warding facility . – FTP requests or HTTP (W eb) connections are directed to a specific host on your LAN. • Setup multiple pinhole paths. – Up to 32 paths are supported • Identify the type(s) of traffic[...]

22 Section 3 General Combination NA T Bypass Confi guration Specific pinholes and Default Server settings, each directed to different LAN devices, can be used together. Security Monitor The Security Monitor detects security related events including common types of malicious attacks and writes them to a dedicated security log file. Y ou view this [...]

23 Section 3 General Event Details Details on the eight specific event types and the information logged are: IP Source Ad dress Spoofing The Gateway checks all incoming packets to see if the IP address attached is valid for the interface the packet is received through. If the address of the packet is not valid for the interface the packet is disc[...]

24 Section 3 General mentation information can also be exploited to create an illegally sized packet. Unwary hosts will often crash when the illegal fragment corrupts data outside of the “normal” packet bounds. The Cayman unit will detect and discard illegal packet fragments, and the Security Monitoring software logs the event. Logged informati[...]

25 Section 3 General Login Failures The Cayman software provides the means for assigning passwords to the Admin or User accounts to control access to the Gateway . Any attempts to login are given three chances to enter a valid password. The Security Mon- itoring software records instances where the user fails to enter a valid pass- word. Logged inf[...]

26 Section 3 General BreakW ater Basic Firewall BreakW ater delivers an easily selectable set of pre-configured firewall pro- tection levels. These settings are readily available for simple implementa- tion through Cayman’ s embedded web ser ver interface. BreakW ater provides you and your network with: • Protection for all LAN users. • Eli[...]

27 Section 3 General VPN IPSec Pass Through This Cayman service supports your independent VPN client software in a transparent manner . Cayman has implemented an Application Layer Gate- way (ALG) to support multiple PCs running IP Security protocols. This feature has three elements: 1. On power up or reset, the address mapping function (NA T) of th[...]

28 Section 3 General SafeHarbour VPN IPSec T unnel SafeHarbour VPN IPSec T unnel provides a single, encr ypted tunnel to be terminated on the Gateway , making a secure tunnel available for all LAN- connected Users. This implementation offers the following: • Eliminates the need for VPN client software on individual PC’ s. • Reduces the comple[...]

29 Section 4 Access the User Interface Access the User Interface Using the embedded W eb-based user inter face for the Netopia Cayman- series Gateway you can configure, troubleshoot, and monitor the status of your Gateway . For COS V ersion 6.3 the W eb-based UI has been modified: • T o accomodate multiple new features of COS 6.3. • T o make [...]

30 Section 4 Home page Home page The Home page is the “dashboard” for your Cayman Gateway . The toolbar at the top provides links to controlling, configuring, and monitoring pages. Critical configuration and operational status is displayed in the center sec- tion. If you log on as Admin you see this page. This example screen is from the Dual [...]

31 Section 4 Home page Home page - Information The Home page’ s center section contains a summar y of the Gateway’ s configuration settings and operational status. Summary Information Field Status and/or Description General Information Hardware Model number and summary specification Serial Number Unique serial number , located on label attach[...]

32 Section 4 Toolbar T oolbar The toolbar is the dark blue bar at the top of the page containing the major navigation buttons. These buttons are available from almost every page, allowing you to move freely about the site. The example toolbar shown below is displayed when you log on as Admin . If you log on as User , some buttons will not be shown.[...]

33 Section 4 Restart Restar t Button Restart Response Comment The Restart button on the toolbar allows you to restart the Gateway at any time. Y ou will be prompted to confirm the restart before any action is taken. The Restart Confirmation message explains the consequences of and reasons for restarting the Gateway[...]

34 Section 4 Restart Link Alert Symbol Response Comment The Alert symbol appears in the upper right corner under one of two cir- cumstances: 1. a database change; one in which a change is made to the Gateway’ s configuration. The Alert serves as a reminder that you must Save the changes and Restart the Gateway before the change will take effect.[...]

35 Section 4 Help Help Button Help Response Comment Context-sensitive Help is provided in Release 6.3. The page shown above is displayed when you are on the Home page or other transitional pages. T o see a context help page example, go to Security -> P assw ords , then click Help .[...]

36 Section 4 Configure Configure Quickstart How to Use the Quickstart Page Quickstart is normally used immediately after the new hardware is installed. When you are first configuring your Gateway , Quickstart appears after you log on. (Once you have configured your Gateway , logging on displays the Home page. Thereafter , if you need to use Qui[...]

37 Section 4 Configure Setup Y our Gateway using a DHCP Connection The Other Quickstart Options page allows you to change the System Name or your Gateway’ s Ethernet MAC address. System Name is your Gateway’ s factor y identifier combined with its serial number . By default, this identifier is automatically captured for this field. Link Con?[...]

38 Section 4 Configure If you need to change either of these fields, use the following procedure. Change Procedure Step 1 Enter y our selected System Name. Y ou can use the default System name or select your own. The System Name can be 1-32 characters long. Step 2 Select the Enable MA C Override chec kbo x. A new field is displayed. Enter your 12[...]

39 Section 4 Configure Y ou will be returned to the Home page. A warning is displayed on this page while the Gateway restarts.[...]

40 Section 4 Configure Setup Y our Gateway using a PPP Connection Step 1 Enter y our ISP Username and ISP P asswor d. Step 2 Click Submit . This turns on the Alert (“!”) button in the top right corner of the page. Step 3 Click the Alert button to go to the pa ge to save y our changes. Step 4 Click on the Save and Restart link. Y ou will be retu[...]

41 Section 4 Configure Setup Y our Gateway using a Static IP Address If your service provider supplies you with a static IP address, your Gate- way’ s Quickstart page will offer the fields required to enter the appropri- ate information for this type of configuration. Configuration Procedure The Quickstart page designed for a static IP address[...]

42 Section 4 Configure Step 4 When y ou see the Save Changes page, clic k the Save and Restart link to restart your Ca yman Gatewa y with its new configuration settings. Y ou will be returned to the Home page. A warning is displayed on this page while the Gateway restarts. Step 5 After y our Cayman Gate way restarts, use y our bro wser to verify t[...]

43 Section 4 Configure LAN Link Confi gure -> LAN Response Comment * Interface Enable : Enables all LAN-connected computers to shared resources and to connect to the W AN. The Interface should always be enabled unless you are instructed to disable it by your Service Provider during troubleshooting. * IP Address : The LAN IP Address of the Gatew[...]

44 Section 4 Configure WA N Link Confi gure -> W AN Response Comment W AN IP Interfaces Y our IP interfaces are listed. Click on an inter face to configure it. IP Gateway Enable Gateway: Y ou can configure the Gateway to send packets to a default gateway if it does not know how to reach the destina- tion host. Interface T ype: If you have PPP[...]

45 Section 4 Configure Advanced The following are links under Configure -> Advanced: Link Advanced Link IP Static Routes Selected Advanced options are discussed in the pages that follow . Many are self-explanatory or are dictated by your ser vice provider . Comment Response Description A static route identifies a manually configured pathway t[...]

46 Section 4 Configure Link IP Static ARP Link Pinholes Response Description Y our Gateway maintains a dynamic Address Resolution Protocol (ARP) table to map IP addresses to Ethernet (MAC) addresses. It populates this ARP table dynamically , by retrieving IP address/MAC address pairs only when it needs them. Optionally , you can define static ARP [...]

47 Section 4 Configure Configure Specific Pinholes Planning for Y our Pinholes Determine if any of the service applications that you want to provide on your LAN stations utilize TCP or UDP protocols. If an application does, then you must configure an Internal Server to implement port for warding. This is accessed from the Advanced -> Internal[...]

48 Section 4 Configure A diagram of this LAN example is: TIPS for making Pinhole Entries 1. If the port forwarding feature is required for W eb ser vices, ensure that the embedded W eb ser ver’ s port number is re-assigned PRIOR to any Pin- hole data entry . 2. Enter data for one Pinhole at a time. 3. Use a unique name for each Pinhole. If you ch[...]

49 Section 4 Configure Pinhole Configuration Procedure Use the following steps: Step 1 From the Configure toolbar button -> Adv anced link, select the Internal Servers link. Since Port Forwarding is required for this example, the Cayman embedded W eb server is configured first. T o pass W eb traffic through to your LAN station(s), select a [...]

50 Section 4 Configure Step 6 Click Add . T ype your specific data into the Pinhole Entries table of this page . Click Submit . Step 7 Click on the Pinholes link in the Breadcrumb T rail to go to the Pinholes entr y page. Clic k Add . Add the ne xt Pinhole . T ype the specific data for the second Pinhole. Step 8 Click on the Pinholes link in the [...]

51 Section 4 Configure Step 9 Click on the Pinholes link in the Breadcrumb T rail to go to the Pinholes entr y page. Re view your entries to be sure the y are correct. Step 10 Click the Alert button. Step 11 Select the Save and Restart link to complete the entire Pinhole creation task and ensure that the parameters are pr operly saved. Note the fol[...]

52 Section 4 Configure Configure the IPMaps Feature F A Qs f or the IPMaps Feature Before configuring an example of an IPMaps-enabled network, review these frequently asked questions. What are IPMaps and how are the y used? The IPMaps feature allows multiple static W AN IP addresses to be assigned to the Cayman Gateway . Static W AN IP addresses [...]

53 Section 4 Configure What types of servers are supported by IPMaps? IPMaps allows a Cayman Gateway to support servers behind the Gateway , for example, web, mail, FTP , or DNS servers. VPN servers are not supported at this time. Can I use IPMaps with m y PPP oE or PPP oA connection? Y es. IPMaps can be assigned to the W AN interface provided they[...]

54 Section 4 Configure IPMaps Block Dia gram The following diagram shows the IPMaps principle in conjunction with existing Cayman NA T operations: NA T/P A T T able 143.137.50.37 143.137.50.36 143.137.50.35 192.168.1.1 192.168.1.n 192.168.1.3 192.168.1.2 ... ... Cayman Gate way Static IP Addresses for IPMaps Applications 143.137.50.37 143.137.50.36[...]

55 Section 4 Configure Link Protocol Lifetimes Link Default Server Response Description Each NA T Protocol map entr y will time-out if there is no traffic of that protocol for the specified number of minutes. For example, UDP entries time-out if there is no UDP traffic after 6 (default) minutes. Response Description This feature allows you to: *[...]

56 Section 4 Configure Confi gure a Default Server This feature allows you to direct unsolicited or non-specific traffic to a des- ignated LAN station. W ith NA T “On” in the Gateway , these packets nor- mally would be discarded. For instance, this could be application traffic where you don’t know (in advance) the port or protocol that wi[...]

57 Section 4 Configure T ypical Network Diagram A typical network utilizing the NA T Default Ser ver looks like this: NA T Combination Application Cayman’ s NA T security feature allows you to configure a sophisticated LAN layout that uses both the Pinhole and Default Server capabilities. W ith this topology , you configure the embedded adminis[...]

58 Section 4 Configure Link DNS Response Description Y our Service Provider may maintain a Domain Name ser ver . If you have the information for the DNS servers, enter it on the DNS page. If your Gateway is configured to use DHCP to obtain its W AN IP address, the DNS information is automatically obtained from that same DHCP Server .[...]

59 Section 4 Configure Link DHCP Server Response Description Y our Gateway can provide network configuration information to com- puters on your LAN, using the Dynamic Host Configuration Protocol (DHCP). If you already have a DHCP server on your LAN, you should turn this service off. If you want the Gateway to provide this service, click the Serve[...]

60 Section 4 Configure Link SNMP SNMP presents you with a security issue. The community facility of SNMP behaves somewhat like a password. The community “ public ” is a well-known community name. It could be used to examine the configuration of your Gateway by your service provider or an unin- vited reviewer . While Cayman's SNMP implemen[...]

61 Section 4 Configure Link Ethernet Bridge Response Description Bridges let you join two local area networks, so that they appear to be part of the same physical network. As a bridge for protocols other than TCP/IP , your Gateway keeps track of as many as 255 MAC (Media Access Control) addresses, each of which uniquely identifies an individ- ual [...]

62 Section 4 Configure Link System Response Description The System Name defaults to your Gateway's factory identifier com- bined with its serial number . Some cable-oriented Ser vice Providers use the System Name as an important identification and support parame- ter . If your Gateway is part of this type of network, do NOT alter the System [...]

63 Section 4 Configure Link Internal Servers Response Description Y our Gateway ships with an embedded W eb ser ver and support for a T elnet session, to allow ease of use for configuration and maintenance. The default ports of 80 for HTTP and 23 for T elnet may be reassigned. This is necessary if a pinhole is created to support applications using[...]

64 Section 4 Configure Link Ethernet MAC Address Override Link T raf fi c Shaping Response Description Y ou can override your Gateway’ s Ethernet MAC address with any neces- sary setting. Some ISPs require your account to be identified by the MAC address, among other things. For information on setting this parameter , see “How to Use the Quic[...]

65 Section 4 Configure Link Clear Options Response Description T o restore the factory configuration of the Gateway , choose Clear Options . Y ou may want to upload your configuration to a file before performing this function. Comment Clear Options does not clear feature keys or affect the software image or BootPROM. Y ou must restart the Gatewa[...]

66 Section 4 Configure Security Button Security Link Passwords Description The Security features are available by clicking on the Security toolbar button. Some items of this category do not appear when you log on as User . Response Description Access to your Gateway is controlled through two user accounts, Admin and User . When you first power up [...]

67 Section 4 Configure Create and Change Passwords Y ou can establish different levels of access security to protect your Cay- man Gateway settings from unauthorized display or modification. • Admin level privileges let you display and modify all settings in the Cayman Gateway (Read/W rite mode). The Admin level password is cre- ated when you ?[...]

68 Section 4 Configure • It can have up to eight alphanumeric characters. • It is case-sensitive. Step 4 Enter y our new pass word a gain in the Confirm P assw ord field. Y ou confirm the new password to verify that you entered it correctly the first time. Step 5 When y ou are finished, clic k the Submit button to store y our modified con[...]

69 Section 4 Configure Use a Cayman Firewall BreakW ater Basic Firewall BreakW ater delivers an easily selectable set of pre-configured firewall pro- tection levels. For simple implementation these settings (comprised of three levels) are readily available through Cayman’ s embedded web server inter face. BreakW ater Basic Firewall’ s three s[...]

70 Section 4 Configure Step 4 Click on the radio b utton to select the protection level y ou want. Click Submit . Changing the BreakW ater setting does not require a restart to take effect. This makes it easy to change the setting "on the fly ,” as your needs change. TIPS for making your BreakW ater Basic Firewall Selection Application Sele[...]

71 Section 4 Configure Basic Firewall Background As a device on the Internet, a Cayman Gateway requires an IP address in order to send or receive traffic. The IP traffic sent or received have an associated application port which is dependent on the nature of the connection request. In the IP protocol standard the following session types are commo[...]

72 Section 4 Configure This table shows how outbound traffic is treated. Outbound means the traf- fic is coming from the LAN-side computers into the LAN side of the Gate- way. Gatewa y: LAN Side BreakW ater Setting >> ClearSailing SilentRunning LANdLoc ked P or t Session T ype --------------P ort State----------------------- 20 ftp data Enabl[...]

73 Section 4 Configure Configure a SafeHarbour VPN VPN IPSec T unnel at the Gatewa y SafeHarbour VPN IPSec T unnel provides a single, encr ypted tunnel to be terminated on the Gateway , making a secure tunnel available for all LAN- connected Users. This implementation offers the following: • Eliminates the need for VPN client software on individ[...]

74 Section 4 Configure A typical SafeHarbour configuration is shown below: Use these Best Practices in establishing your SafeHarbour tunnel. P arameter Description and Setup The following table describes SafeHarbour’ s parameters that are used for an IPSec VPN tunnel configuration: 1. Ensure that the configuration information is complete and a[...]

75 Section 4 Configure Peer Internal IP NetmaskThe Peer Internal IP Netmask is the subnet mask of the Peer Internal IP Network. PFS DH Group Perfect Forward Secrecy (PFS) is used during SA renegotiation. When PFS is selected, a Diffie-Hellman key exchange is required. SafeHarbour supports PFS DH Groups 1, 2 and 5. Pre-Shared Key The Pre-Shared Key[...]

76 Section 4 Configure IPSec T unnel Parameter Setup W orksheet Parameter Cayman Peer Gateway Name Peer External IP Address Peer Internal IP Network Peer Internal IP Netmask Enable Encrypt Protocol None ESP Auth Protocol None ESP AH Key Management IKE Pre-Shared Key T ype HEX ASCII Pre-Shared Key Negotiation Method Main Aggressive DH Group 1 2 5 SA[...]

77 Section 4 Configure SafeHarbour T unnel Setup Use the following tasks to configure an IPSec VPN tunnel on your Cayman Gateway . T ask 1: Ensure that you have SafeHarbour VPN enabled. SafeHarbour is a keyed feature. See page 93 for information concerning installing Cayman Software Feature Keys. T ask2: Complete Parameter Setup W orksheet IPSec t[...]

78 Section 4 Configure Leave the Enable NA T over T unnel choice as Off unless your network administrator instructs otherwise. T ask 4: Make the IPSec T unnel Entries Enter the initial group of tunnel parameters. Refer to your Setup W ork- sheet and the Glossary of VPN T erms as required. Per form the following steps: Step 1 Enter tunnel Name . Ste[...]

79 Section 4 Configure Step 6 Ensure that the toggle chec kbox Enable , which is On by default, remains On. Step 7 Click Add . The T unnel Details page appears. T ask 5: Make the T unnel Details entries Use the following steps: Step 1 Enter or select the required settings. Step 2 Click Update . The Alert button appear s. Step 3 Click the Alert butt[...]

80 Section 4 Configure Using the Security Monitoring Log Y ou can view the Security Log at any time. Use the following steps: Step 1 Click the Security toolbar button. Step 2 Click the Security Log link. Step 3 Click the Show link from the Security Log tool bar . An example of the Security Log is shown on the next page. Step 4 When a new security e[...]

81 Section 4 Configure[...]

82 Section 4 Configure The capacity of the security log is 100 security alert messages. When the log reaches capacity , subsequent messages are not captured, but they are noted in the log entry count. T able of Time Offsets (in hours) from GMT T ake the recorded UTC/GMT value and subtract the offset value to get the time that an event occurred in y[...]

83 Section 4 Configure Install Button Install Response Description From the Install toolbar button you can: • Install new Operating System Software • Install new Feature Keys[...]

84 Section 4 Configure Install Software Updating Y our Gatewa y to COS V ersion 6.3 Cayman Operating System Release 6.3 represents significantly expanded functionality for your Cayman Gateway . T o deliver these important fea- tures, the COS 6.3 image is larger than earlier versions and the updating process is different from earlier procedures. It[...]

85 Section 4 Configure Required T asks W arnings : T ask # Description Page # 1 Locate and confirm the required files. 86 2 Install and verify the Updater application code. 87 3 Install and verify the COS 6.3 image. 89 Depending on your particular subscriber agreement, you may need to install other feature key files. COS 6.3 is NOT SUPPORTED on th[...]

86 Section 4 Configure Upgrading to COS 6.3 requires THREE files: 1. Documentation - Software Upg rade Instructions PDF file 2. Updater file 3. Cayman Operating System image Background When you downloaded your operating system upgrade from the Cayman website you downloaded a ZIP file containing these files: • Software Upg rade Instructions P[...]

87 Section 4 Configure Contact Information Contact Cayman T echnical Support for questions concerning the upgrade process. Contact Cayman Sales for specific advanced features. Use this contact information: Install Updater Application Code Use these steps to install the Updater software in your Gateway from the Home page: Step 1 Open a web connecti[...]

88 Section 4 Configure Ethernet button on the Cayman Gateway Home page. When the Ethernet window appears, click Save . If you have previously saved your Cayman Gateway configuration, you can skip this step. Step 3 Click the Install Software button on the Ca yman Gateway Home pa g e . The Install New Cayman Software window opens. Step 4 Enter the U[...]

89 Section 4 Configure Y our Cayman Gateway restarts with its new image. During this step you have the following visual guide from your unit: V erify Updater Application Code T o verify that the Updater image has loaded successfully , use the following steps: Step 7 Open a web connection to y our Cayman Gate way from the computer on y our LAN; retu[...]

90 Section 4 Configure Step 3 Enter the filename into the text bo x by using one of these techniques: The COS file name starts with the letter “c” (for “COS”). a. Click the Browse button, select the file you want, and click Open. -or- b. Enter the name and path of the software image you want to install in the text field and click Open .[...]

91 Section 4 Configure V erify the COS 6.3 Image T o verify that the COS 6.3 image has loaded successfully , use the following steps: Step 1 Open a web connection to y our Cayman Gate way from the computer on y our LAN and return to the Home page. For COS 6.3 you now have a new layout . The screen shown below is from a Cayman 3220-H. Step 2 V erify[...]

92 Section 4 Configure If your admin password is not set, you will be prompted to set it before you reach the Home page. This completes the UPGRADE process for COS 6.3.[...]

93 Section 4 Configure Install Keys Use Cayman Software Feature Keys Background Cayman Gateway users obtain advanced product functionality by install- ing a software feature key . This concept utilizes a specially constructed and distributed file (referred to as a feature key) to enable additional capability within the unit. Software feature key p[...]

94 Section 4 Configure • BreakW ater Basic Firewall • BarrierReef Advanced Firewall • SafeHarbour IPSec T unnel at the Gateway Obtaining Software Feature Keys Contact your Service Provider to acquire a Software Feature Key . Procedure - Install a New Feature Key File W ith the appropriate feature key file resident on your LAN PC, use the ste[...]

95 Section 4 Configure Step 5 Click the Restart toolbar button. The Confirmation screen appears. Step 6 Click the Restart the Gateway link to confirm. T o check your installed features: Step 1 Click the Install toolbar button. Step 2 Click the List of Features link.[...]

96 Section 4 Configure The System Status page appears with the information from the features link displayed below . Y ou can check that the feature you just installed is enabled.[...]

97 Troubleshoot T r oubleshoot This section provides some specific procedures and tips for working with important features of Cayman OS 6.3. P erform T roubleshooting on Gatewa ys There are three major T roubleshooting capabilities you can access via your Cayman Gateway’ s web inter face. The pro- cedures for using them are discussed here. In th[...]

98 Troubleshoot Each test generates one of the following result codes: CODE Description P ASS The test was successful. F AIL The test was unsuccessful. SKIPPED The test was skipped because a test on which it depended failed, or it was not supported by the service provider equipment to which it is connected. PENDING The test timed out without produc[...]

99 Troubleshoot Network T ools Use these steps: Step 1 Click the T roubleshoot toolbar button. Step 2 Click the Network T ools link. Three test tools are available from this page. • NSLookup - converts a domain name to its IP address and vice versa. • Ping - tests the “reachability” of a particular network destination by sending an ICMP ech[...]

100 Troubleshoot Example: Show the path to the grosso.com site. Result: It took 20 hops to get to the grosso.com web site. Step 5 T o use the NSLookup capability , type an ad dress (domain name or IP address) in the te xt bo x and c lick the NSLookup button Example: Show the IP Address for grosso.com Result: The DNS Server doing the lookup is displ[...]

101 System Status System Status System Status provides a group of links that display status and statistics to help you manage your Gateway . Managing the WAN Users is an example of the management tools available. Manage a Restricted Number of W AN Users User Status On the Home page your W AN User status is prominently displayed in the center area. [...]

102 System Status The Show link provides this information: • Number of allowed concurrent W AN users • Number of W AN connections currently in use • Address and computer name - of current LAN users • Timeout - displays status of Idle T imeout Counter . The current user has this amount of time (from an initial 20 minute interval) remaining p[...]

103 System Status Step 3 Click the Disconnect button. If you want to disconnect all users at once, clic k the Disconnect All button. Step 4 A confirmation message appears. Exceeding the W AN User Limit If your system supports a restricted number of W AN users, web browser users who attempt to access the W AN in excess of the restricted number will[...]

104 Appendix A Overview Overview The Cayman Gateway operating software includes a command line interface (CLI) that lets you access your Cayman Gateway over a telnet or console connection. Y ou can use the command line interface to enter and update the unit’ s configura- tion settings, monitor its performance, and restart it. The CLI has two maj[...]

105 Appendix A Overview CONFIG Commands Command V erbs Status and/or Description set Set configuration data define Define environment data delete Delete configuration list data view View configuration data script Print configuration data help Help command option save Save configuration data Keywords system Gateway’s system options pppoe PPP over [...]

106 Appendix A Starting and Ending a CLI Session Starting and Ending a CLI Session There are two ways to open a CLI session: 1. Open a telnet connection from a workstation on your network 2. Connect a terminal to the Maintenance Port located on the rear panel of the Cayman Gateway. Connecting from telnet Y ou initiate a telnet connection by issuing[...]

107 Appendix A Using the CLI Help Facility When you have logged in successfully , the command line interface lists the user- name and the security level associated with the password you entered in the diag- nostic log. Ending a CLI Session Y ou end a command line interface session by typing quit from the SHELL node of the command line interface hie[...]

108 Appendix A SHELL Commands The only command you cannot truncate is restart . T o prevent accidental inter- ruption of communications, you must enter the restart command in its entirety . Y ou can use the Up and Down arrow keys to scroll backward and forward through recent commands you have entered. Alternatively , you can use the !! command to r[...]

109 Appendix A SHELL Commands Puts the command line interface into Configure mode, which lets you configure your Cayman Gateway with Config commands. Config commands are described starting on page 105 . Runs a diagnostic utility to conduct a series of internal checks and loopback tests to verify network connectivity over each interface on your [...]

11 0 Appendix A SHELL Commands Downloads a new version of the Cayman Gateway operating software from a TFTP (T rivial File T ransfer Protocol) server , validates the software image, and pro- grams the image into the Cayman Gateway memory . After you install new oper- ating software, you must restart the Cayman Gateway. The TFTP server must be acces[...]

111 Appendix A SHELL Commands Displays the IP routes stored in your Cayman Gateway. Performs a domain name system lookup for a specified host. • The hostname argument is the name of the host for which you want DNS information; for example, nslookup klaatu . • The ip_address argument is the IP address, in dotted decimal notation, of the device [...]

11 2 Appendix A SHELL Commands Releases the DHCP lease the Gateway is currently using to acquire the IP settings for its W AN (Ethernet B) port. Releases the DHCP lease the Cayman 3220-H is currently using to acquire the IP settings for the specified DSL port. The vcc-id identifier is a letter in the rang B- I. Enter the reset dhcp client release[...]

11 3 Appendix A SHELL Commands Resets the point-to-point connection over the specified virtual circuit. This com- mand only applies to virtual circuits that use PPP framing. Clears the security monitoring log to make room to capture new entries. This function disconnects the specified W AN User to allow for other users to access the W AN. This fu[...]

11 4 Appendix A SHELL Commands Displays the DHCP leases stored in NVRAM by your Cayman Gateway. Displays DSL port statistics, such as upstream and downstream connection rates and noise levels. Displays the Ethernet statistics for your Cayman Gateway. Show all keyed features and whether or not they are enabled. If the key is not per- manent, it show[...]

11 5 Appendix A SHELL Commands Displays memory usage information for your Cayman Gateway. If you include the optional all argument, your Cayman Gateway will display a more detailed set of memory statistics. Displays information about open PPP links. Y ou can display a subset of the PPP statistics by including an optional stats, lcp, ipcp , or lastc[...]

11 6 Appendix A SHELL Commands Opens a PPP link on the specified virtual circuit. Displays the current status of a Cayman Gateway, the device's hardware and soft- ware revision levels, a summary of errors encountered, and the length of time the Cayman Gateway has been running since it was last restarted. Identical to the show status command. [...]

11 7 Appendix A About CONFIG Commands About CONFIG Commands Y ou reach the configuration mode of the command line interface by typing con- figure (or any truncation of configure , such as c or config ) at the CLI SHELL prompt. CONFIG Mode Prompt When you are in CONFIG mode, the CLI prompt consists of the name of the Cay- man Gateway followed by yo[...]

11 8 Appendix A About CONFIG Commands • Moving from one subnode to another — Y ou can move from one subnode to another by entering a partial path that identifies how far back to climb. • Moving from any subnode to any other subnode — Y ou can move from any subnode to any other subnode by entering a partial path that starts with a top-level[...]

11 9 Appendix A About CONFIG Commands If a command is ambiguous or miskeyed, the CLI prompts you to enter additional information. For example, you must specify which virtual circuit you are configur- ing when you are setting up a Cayman Gateway. Displaying Current Gateway Settings Y ou can use the view command to display the current CONFIG setting[...]

120 Appendix A About CONFIG Commands Dogzilla (top)>> set system Stepping set mode (press Control-X <Return/Enter> to exit) ... system name (“Dogzilla”): Mycroft Diagnostic Level (High): medium Stepping mode ended. V alidating Y our Configuration Y ou can use the validate CONFIG command to make sure that your configura- tion setti[...]

121 Appendix A CONFIG Commands CONFIG Commands This section describes the keywords and arguments for the various CONFIG com- mands. A TM Settings Y ou can use the CLI to set up each A TM virtual circuit. Enables the W AN interface of 3220-H to be configured using the Asynchronous T ransfer Mode (A TM) protocol. Selects the virtual circuit for whic[...]

122 Appendix A CONFIG Commands Select the number of PPPoE sessions to be configured for VCC n. Up to eight can be configured on the first VCC; one on the other VCCs. The total must be less than or equal to eight. Select the transmission priority for vcc n. The Gateway transmits traffic for high priority VCCs before it transmits traffic for low[...]

123 Appendix A CONFIG Commands DHCP Settings As a Dynamic Host Control Protocol (DHCP) server , your Cayman Gateway can assign IP addresses and provide configuration information to other devices on your network dynamically . A device that acquires its IP address and other TCP/IP configuration settings from the Cayman Gateway can use the informati[...]

124 Appendix A CONFIG Commands DMT Settings Selects the type of Discrete Multitone (DMT) asynchronous digital subscriber line (ADSL) protocol to use for the W AN interface. Domain Name System Settings Domain Name System (DNS) is an information service for TCP/IP networks that uses a hierarchical naming system to identify network domains and the hos[...]

125 Appendix A CONFIG Commands IP Settings Y ou can use the command line interface to specify whether TCP/IP is enabled, identify a default Gateway , and to enter TCP/IP settings for the Cayman Gateway LAN and W AN ports. If PPPoE is turned off, you must specify settings for Ethernet A and B separately . If PPPoE is turned on, you can omit the A|B [...]

126 Appendix A CONFIG Commands . Specifies restrictions on the types of traffic the 3220-H accepts over the DSL vir- tual circuit. The admin-disable argument means that router traffic is accepted but that administrative commands are ignored. The admin-only argument means that router traffic is ignored by that administrative commands are accepte[...]

127 Appendix A CONFIG Commands Specifies the broadcast address for the local Ethernet interface. IP hosts use the broadcast address to send messages to every host on your network simulta- neously . The broadcast address for most networks is the network number followed by 255. For example, the broadcast address for the 192.168.1.0 network would be [...]

128 Appendix A CONFIG Commands . Specifies whether you want the Cayman Gateway to respond when it receives an address resolution protocol for devices behind it. By default, proxy ARP is turned off. Specifies whether the Cayman Gateway should use Routing Information Protocol (RIP) broadcasts to advertise its routing tables to other routers on your[...]

129 Appendix A CONFIG Commands Specifies whether the Gateway is reached using a fixed IP address or through a PPP virtual circuit. Specifies the IP address of the default IP Gateway . W AN-to-W AN Routing Settings Use the following command to configure settings for routing between W AN con- nections. Enables or disables routing between W AN con[...]

130 Appendix A CONFIG Commands The default value for the ip_address argument is 0.0.0.0, which indicates that the virtual PPP interface will use the IP address assigned to it by the remote peer . Note that the remote peer must be configured to supply an IP address to your Cayman Gateway if you enter 0.0.0.0 for the ip_address argument. Specifies [...]

131 Appendix A CONFIG Commands For example, inclusion of subnet masks in RIP packets and implementation of multicasting instead of broadcasting. This last feature reduces the load on hosts which do not support routing protocols. This command is only available when address mapping for the specified virtual circuit is turned “off”. Specifies wh[...]

132 Appendix A CONFIG Commands Static Route Settings A static route identifies a manually configured pathway to a remote network. Unlike dynamic routes, which are acquired and confirmed periodically from other routers, static routes do not time out. Consequently , static routes are useful when working with PPP , since an intermittent PPP link ma[...]

133 Appendix A CONFIG Commands • The remote network is more than one router away but the static route should not be replaced by a dynamic route, even if the dynamic route is more effi- cient. Deletes a static route. Deleting a static route removes all information associated with that route. W AN Settings Enables or disables communications throug[...]

134 Appendix A CONFIG Commands Specifies whether an administrator can open a telnet connection to the Cayman Gateway over the W AN Ethernet interface [or specified VCC interface] to monitor and configure the Cayman Gateway. The admin-only argument means that router traffic is ignored but that administrative commands are accepted. The none argum[...]

135 Appendix A CONFIG Commands Network Address T ranslation (NA T) Default Settings NA T default settings let you specify whether you want your Cayman Gateway to forward NA T traffic to a default ser ver when it doesn’t know what else to do with it. The NA T default host function is useful in situations where you cannot create a specific NA T p[...]

136 Appendix A CONFIG Commands Specifies the type of protocol being redirected. If you select other , specifies the number of the protocol you want to translate. Specifies the first port number in the range being translated. Specifies the last port number in the range being translated. . Specifies the IP address of the internal host to which [...]

137 Appendix A CONFIG Commands Configuring Basic PPP Settings Enables or disables PPP on the Cayman Gateway . Specifies the Maximum Receive Unit (MRU) for the PPP interface. The integer argument can be any number between 128 and 2048. Enables or disables LCP magic number negotiation. Specifies whether you want the Cayman Gateway to compress the [...]

138 Appendix A CONFIG Commands Specifies the number of seconds the Cayman Gateway should wait before retrans- mitting a configuration or termination request. The integer argument can be any number between 1 and 30. Specifies whether a PPP connection is maintained by the Cayman Gateway when it is unused for extended periods. If you specify always[...]

139 Appendix A CONFIG Commands Specifies the name the Cayman Gateway sends in a CHAP response packet. The chap_name argument is 1-64 alphanumeric characters. The information you enter must match the CHAP username configured in the remote PPP peer's authentication database. Specifies the CHAP secret for CHAP authentication. The secret argume[...]

140 Appendix A CONFIG Commands Configuring P eer A uthentication Y ou can specify that your Cayman Gateway will use P AP , CHAP , or both to authen- ticate a remote peer as a PPP link is being completed. Perform the following steps to specify how your Cayman Gateway should authenticate remote peers. Specifies whether the Cayman Gateway will use C[...]

141 Appendix A CONFIG Commands Command Line Interface Preference Settings Y ou can set command line interface preferences to customize your environment. Specifies whether you want command help and prompting information dis- played. By default, the command line interface verbose preference is turned off. If you turn it on, the command line interfac[...]

142 Appendix A CONFIG Commands Specifies the port number for telnet (CLI) communication with the Cayman Gate- way. Because port numbers in the range 0-1024 are used by other protocols, you should use numbers in the range 2000-32767 when assigning new port numbers to the Cayman Gateway telnet configuration interface. Security Settings Security set[...]

143 Appendix A CONFIG Commands This enables this particular tunnel. Currently , one tunnel is supported. Specifies the IP address of the destination gateway . Specifies the IP address of the destination computer or internal network. Specifies the subnet mask of the destination computer or internal network. The subnet mask specifies which bits o[...]

144 Appendix A CONFIG Commands See page 73 for details about SafeHarbour IPsec tunnel capability . See page 73 for details about SafeHarbour IPsec tunnel capability . See page 73 for details about SafeHarbour IPsec tunnel capability . See page 73 for details about SafeHarbour IPsec tunnel capability . Internet Key Exchange (IKE) Settings The follow[...]

145 Appendix A CONFIG Commands SNMP Settings The Simple Network Management Protocol (SNMP) lets a network administrator monitor problems on a network by retrieving settings on remote network devices. The network administrator typically runs an SNMP management station program on a local host to obtain information from an SNMP agent such as the Cayma[...]

146 Appendix A CONFIG Commands you have assigned a name to your Cayman Gateway, you can enter that name in the Address text field of your browser to open a connection to your Cayman Gate- way. . Specifies the types of log messages you want the Cayman Gateway to record. All messages with a level number equal to or greater than the level you specif[...]

147 Appendix A CONFIG Commands T raffic Shaping Settings T raffic shaping lets you control how much traffic can flow through an Ethernet interface by limiting the size of the WAN “pipe.” This function is most suitable for Internet Service Providers or multi-inter face routers. When you use the traffic-shaping option to set the maximum spee[...]

148 Appendix B Glossary Appendix B 10Base2 IEEE 802.3 specification for Ethernet that uses thin coaxial cable to run at 10 Mbps. Limited to 185 meters per segment. 10Base5 IEEE 802.3 baseband physical layer specification for Ethernet that uses thick coaxial cable to run at 10 Mbps. Limited to 500 meters per segment. 10Base-T IEEE 802.3 specificatio[...]

149 Appendix B bps Bits per second. A measure of data transmission speed. BRI Basic Rate Interface. ISDN standard for provision of low-speed ISDN services (two B channels (64 kbps each) and one D channel (16 kbps)) over a single wire pair. bridge Device that passes packets between two network segments according to the packets' destination addr[...]

150 Appendix B 3DES Triple DES, with a 168 bit encryption key, is the most accepted variant of DES. DH Group Diffie-Hellman is a public key algorithm used between two systems to determine and deliver secret keys used for encryption. Groups 1, 2 and 5 are supported. Also, see Diffie-Hellman listing. DHCP Dynamic Host Configuration Protocol. A networ[...]

151 Appendix B ESP E ncapsulation Security Payload (ESP) header provides confidentiality, data origin authentication, connectionless integrity, anti-replay pro- tection, and limited traffic flow confidentiality. It encrypts the contents of the datagram as specified by the Security Association. The ESP transformations encrypt and decrypt portions of[...]

152 Appendix B -----I----- IKE I nternet K ey E xchange protocol provides automated key management and is a preferred alternative to manual key management as it pro- vides better security. Manual key management is practical in a small, static environment of two or three sites. Exchanging the key is done through manual means. Because IKE provides au[...]

153 Appendix B -----M----- magic number Random number generated by a router and included in packets it sends to other routers. If the router receives a packet with the same magic number it is using, the router sends and receives packets with new random numbers to determine if it is talking to itself. MD5 A 128-bit, m essage- d igest, authentication[...]

154 Appendix B Peer Internal IP Network The Peer Internal IP Network is the private, or Local Area Network (LAN) address of the remote gateway or VPN Server you are communi- cating with. Peer Internal IP Netmask The Peer Internal IP Netmask is the subnet mask of the Peer Internal IP Network. PFS-DH P erfect F orward S ecrecy D iffie H ellman Group.[...]

155 Appendix B Security Association From the IPSEC point of view, an SA is a data structure that describes which transformation is to be applied to a datagram and how. The SA specifies: • The authentication algorithm for AH and ESP • The encryption algorithm for ESP • The encryption and authentication keys • Lifetime of encryption keys • [...]

156 Appendix B -----T ----- T1 link Digital transmission link capable of speeds up to 1544 kilobits per second. TA Terminal adaptor. Device that connects a network or terminal to an ISDN network. telnet IP protocol that lets a user on one host establish and use a virtual ter- minal connection to a remote host. twisted pair Cable consisting of two c[...]

157 Appendix B[...]

158 Symbols !! command 108 A Access the GUI 29 Address mapping 134 Address resolution table 114 Admin Login Failures 25 Administrative restrictions 130 Administrator password 29, 67, 106 Arguments, CLI 118 ARP Command 108 Proxy 128, 134 Authentication 138 Authentication trap 145 B Bridging 122 Broadcast address 125, 127, 133 C Cayman 3220-H-W Home [...]

159 H Hardware address 122 hijacking 155 Home page 30 User mode 30 Home window 29 Hop count 132 How To Configure a SafeHarbour VPN 73 Configure Multiple Static IP Addresses 73 HTTP traffic 141 I ICMP Echo 111 Illegal Packet Size (Ping of Death) 23 Install 83 IP address 125, 126, 133 Default 29 IP interfaces 114 IP routes 114 IP Source Address Spoof[...]

160 RIP 128 Routing Information Protocol (RIP) 128 S Secondary nameserver 124 Secret 139 Security log 82 Security Monitoring 22 Serial cable 106 Set bncp command 121, 122 Set bridge commands 122 Set dns commands 124 Set ip static-routes commands 132 Set preference more command 141 Set preference verbose command 141 Set servers command 141 Set serve[...]

Contact Inf ormation Cayman 3000 series by Netopia Netopia, Inc. 2470 Mariner Square Loop Alameda, CA 94501 Corporate Headquarters: 510-814-5100 Corporate Fax: 510-814-5020 Customer Service/T ech Support: 510-814-5000 ext 1. Support URL: http://www .netopia.com/support January , 2002[...]