Netopia Firmware 4000-Series manuel d'utilisation

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314

Aller à la page of

Un bon manuel d’utilisation

Les règles imposent au revendeur l'obligation de fournir à l'acheteur, avec des marchandises, le manuel d’utilisation Netopia Firmware 4000-Series. Le manque du manuel d’utilisation ou les informations incorrectes fournies au consommateur sont à la base d'une plainte pour non-conformité du dispositif avec le contrat. Conformément à la loi, l’inclusion du manuel d’utilisation sous une forme autre que le papier est autorisée, ce qui est souvent utilisé récemment, en incluant la forme graphique ou électronique du manuel Netopia Firmware 4000-Series ou les vidéos d'instruction pour les utilisateurs. La condition est son caractère lisible et compréhensible.

Qu'est ce que le manuel d’utilisation?

Le mot vient du latin "Instructio", à savoir organiser. Ainsi, le manuel d’utilisation Netopia Firmware 4000-Series décrit les étapes de la procédure. Le but du manuel d’utilisation est d’instruire, de faciliter le démarrage, l'utilisation de l'équipement ou l'exécution des actions spécifiques. Le manuel d’utilisation est une collection d'informations sur l'objet/service, une indice.

Malheureusement, peu d'utilisateurs prennent le temps de lire le manuel d’utilisation, et un bon manuel permet non seulement d’apprendre à connaître un certain nombre de fonctionnalités supplémentaires du dispositif acheté, mais aussi éviter la majorité des défaillances.

Donc, ce qui devrait contenir le manuel parfait?

Tout d'abord, le manuel d’utilisation Netopia Firmware 4000-Series devrait contenir:
- informations sur les caractéristiques techniques du dispositif Netopia Firmware 4000-Series
- nom du fabricant et année de fabrication Netopia Firmware 4000-Series
- instructions d'utilisation, de réglage et d’entretien de l'équipement Netopia Firmware 4000-Series
- signes de sécurité et attestations confirmant la conformité avec les normes pertinentes

Pourquoi nous ne lisons pas les manuels d’utilisation?

Habituellement, cela est dû au manque de temps et de certitude quant à la fonctionnalité spécifique de l'équipement acheté. Malheureusement, la connexion et le démarrage Netopia Firmware 4000-Series ne suffisent pas. Le manuel d’utilisation contient un certain nombre de lignes directrices concernant les fonctionnalités spécifiques, la sécurité, les méthodes d'entretien (même les moyens qui doivent être utilisés), les défauts possibles Netopia Firmware 4000-Series et les moyens de résoudre des problèmes communs lors de l'utilisation. Enfin, le manuel contient les coordonnées du service Netopia en l'absence de l'efficacité des solutions proposées. Actuellement, les manuels d’utilisation sous la forme d'animations intéressantes et de vidéos pédagogiques qui sont meilleurs que la brochure, sont très populaires. Ce type de manuel permet à l'utilisateur de voir toute la vidéo d'instruction sans sauter les spécifications et les descriptions techniques compliquées Netopia Firmware 4000-Series, comme c’est le cas pour la version papier.

Pourquoi lire le manuel d’utilisation?

Tout d'abord, il contient la réponse sur la structure, les possibilités du dispositif Netopia Firmware 4000-Series, l'utilisation de divers accessoires et une gamme d'informations pour profiter pleinement de toutes les fonctionnalités et commodités.

Après un achat réussi de l’équipement/dispositif, prenez un moment pour vous familiariser avec toutes les parties du manuel d'utilisation Netopia Firmware 4000-Series. À l'heure actuelle, ils sont soigneusement préparés et traduits pour qu'ils soient non seulement compréhensibles pour les utilisateurs, mais pour qu’ils remplissent leur fonction de base de l'information et d’aide.

Table des matières du manuel d’utilisation

  • Page 1

    N N N N e e e e t t t t o o o o p p p p ii i i a a a a ® ® ® ® F F F F ii i i r r r r m m m m w w w w a a a a r r r r e e e e U U U U s s s s e e e e r r r r G G G G u u u u ii i i d d d d e e e e N N N N e e e e t t t t o o o o p p p p ii i i a a a a ® ® ® ® 4 4 4 4 0 0 0 0 0 0 0 0 0 0 0 0 - - - - S S S S e e e e r r r r ii i i e e e e s s[...]

  • Page 2

    C o p yright Copyright© 2004, Netopia, Inc. Netopia and the Netopia logo are r egistered trademarks belonging to Netopia, Inc., register ed U.S. Patent and T rademark Of fice. Broadband Without Boundaries and 3-D Reach are trademarks belonging to Netopia, Inc. All other trademarks are the pr oper ty of their respective owners. All rights r eser v[...]

  • Page 3

    Contents iii G Chapter 1 — Introduction .......................................................... 1-1 What’s New in Netopia Fir mware V ersion 5.4 ................... 1-1 Console-based Management ........................................... 1-2 Netopia Console Menus ................................................. 1-2 Netopia Models ..........[...]

  • Page 4

    iv Firmware User Guide Modifying a scheduled connection ....................... 2-34 Deleting a scheduled connection......................... 2-34 System Configuration Screens ...................................... 2-35 System configuration features............................. 2-35 IP Setup .......................................................[...]

  • Page 5

    Contents v G IP profile parameters .......................................... 3-21 IP Parameters (W AN Default Pr ofile) .................... 3-23 NA T Associations ......................................................... 3-25 IP Passthrough ............................................................ 3-27 MultiNA T Configuration Example ......[...]

  • Page 6

    vi Firmware User Guide Adding an IKE Phase 1 Profile ............................... 5-4 Changing an IKE Phase 1 Profile ........................... 5-8 Key Management ........................................................... 5-9 IPsec W AN Configuration Scr eens ................................. 5-18 IPsec Manual Key Entr y ..................[...]

  • Page 7

    Contents vii G Event Logs .................................................................. 7-12 SNMP Suppor t ............................................................ 7-13 Backup Default Gateway ............................................... 7-13 Backup Configuration screen .............................. 7-13 IP Setup screen ...............[...]

  • Page 8

    viii Firmware User Guide Advanced Security Options ................................. 10-5 User access password ....................................... 10-7 User menu dif fer ences ....................................... 10-8 User Accounts ........................................................... 10-15 T elnet Access ..............................[...]

  • Page 9

    Contents ix G Updating fir mware .............................................. 11-7 Downloading configuration files ........................... 11-8 Uploading configuration files ............................... 11-9 T ransfer ring Configuration and Fir mware Files with XMODEM .............................................................. 11-[...]

  • Page 10

    x Firmware User Guide Packet header types .......................................... B-14 Appendix C — Binar y Conversion T able ...................................... C-1 Index[...]

  • Page 11

    Introduction 1-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 II I I n n n n t t t t r r r r o o o o d d d d u u u u c c c c t t t t ii i i o o o o n n n n This Fir mware User Guide covers the advanced features of the Netopia 4000-Series Router and IAD families. Y our Netopia equipment of fers advanced configuration featur es in[...]

  • Page 12

    1-2 Firmware User Guide Console-based Management Console-based management is a fast menu-driven inter face for the capabilities built into the Netopia Fir mwar e V ersion 5.4. Console-based management pr ovides access to a wide variety of features that the router suppor ts. Y ou can customize these features for your individual setup. This chapter d[...]

  • Page 13

    Introduction 1-3 reconfiguring the manner in which you may be using the r outer to connect to more than one ser vice provider or r emote site. See “W AN Configuration,” beginning on page 2-1 . See also Chapter 4, “Vir tual Private Networks (VPNs).” ■ The System Configuration menus display and per mit changing: See “System Configurat[...]

  • Page 14

    1-4 Firmware User Guide Connecting thr ough a T elnet Session Features of the Netopia Fir mwar e V ersion 5.4 can be configured thr ough the console screens. Before you can access the console scr eens through T elnet, you must have: ■ A network connection locally to the router or IP access to the r outer . Note: Alter natively , you may have a d[...]

  • Page 15

    Introduction 1-5 Connecting a Console Cable to y our Equipment Many Netopia models include a serial console por t labeled “Console” on the back panel. Y ou can per for m all of the system configuration activities for your Netopia equipment through a local serial console connection, if available, using ter minal emulation software, such as Hype[...]

  • Page 16

    1-6 Firmware User Guide Launch your ter minal emulation software and configur e the communications software for the values shown in the table below . These are the default communication parameters that the Netopia Fir mwar e V ersion 5.4 uses. Parameter Suggested V alue T er minal type PC : ANSI-BBS Mac : ANSI, VT-100, or VT-200 Data bits 8 Parity[...]

  • Page 17

    Introduction 1-7 Na vigating thr ough the Console Screens Use your keyboard to navigate the Netopia Fir mwar e V ersion 5.4’s configuration screens, enter and edit infor mation, and make choices. The following table lists the keys to use to navigate through the console screens. T o help you find your way to par ticular screens, some sections in[...]

  • Page 18

    1-8 Firmware User Guide[...]

  • Page 19

    W AN and System Configuration 2-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 2 2 2 2 W W W W A A A A N N N N a a a a n n n n d d d d S S S S y y y y s s s s t t t t e e e e m m m m C C C C o o o o n n n n f f f f ii i i g g g g u u u u r r r r a a a a t t t t ii i i o o o o n n n n This chapter describes how to use the console-based m[...]

  • Page 20

    2-2 Firmware User Guide ADSL Line Configuration screen The ADSL Line Configuration screen is shown below: 1. Select Circuit Type and from the pop-up menu choose the type of cir cuit to which you will be connecting: Multimode, T1.413, G.dmt/G.lite, or ADI. 2. Select Trellis Coding Enabled . T oggle it to On (the default) or Of f. 3. Select Signali[...]

  • Page 21

    W AN and System Configuration 2-3 SDSL/IDSL Configuration screen The SDSL/IDSL Line Configuration screen is shown below: ■ Select a Line T ype fr om the pull-down menu. Y ou can choose SDSL-A TM , SDSL-HDLC , IDSL , or IDSL-CM . For IDSL connections, choose IDSL if your ser vice pr ovider uses most common central of fice equipment; choose IDS[...]

  • Page 22

    2-4 Firmware User Guide Some of these selections will reset the defaults for the r emaining options in this screen. Y ou will be challenged to confir m your choice. The SDSL-HDLC and IDSL Line Types do not of fer these choices. ■ The Data Rate Mode pull-down menu allows you to select either Hunt or Locked mode. ■ If you choose Hunt , the route[...]

  • Page 23

    W AN and System Configuration 2-5 IDSL Line Configuration screen The IDSL Line Configuration screen is shown below: ■ For IDSL lines, the Data Rate (kbps) pull-down menu of fers 64 (B1) , 64 (B2) , 128 (B1+B2) , or 144 (2B+D) . ■ The Data Link Encapsulation pull-down menu of fers PPP , HDLC , or Frame Relay . ■ If you are using Frame Relay[...]

  • Page 24

    2-6 Firmware User Guide G.SHDSL Line Configuration screen The G.SHDSL Line Configuration screen is shown below: Each access concentrator (DSLAM) has a dif fer ent set of defaults and other parameters. Y our ser vice pr ovider should supply you with the appropriate infor mation about the type and capabilities of the access concentrator equipment t[...]

  • Page 25

    W AN and System Configuration 2-7 T1 Line Configuration screen The T1 Line Configuration screen is shown below: ■ Select Operation Mode and press Retur n. From the pop-up menu, highlight the mode your telephone ser vice pr ovider uses: HDLC (Cisco), CM-HDLC (Copper Mountain), or AT M . The default setting is HDLC. Press Retur n. ■ Select Lin[...]

  • Page 26

    2-8 Firmware User Guide default setting is 1 (one). Press Retur n. Note: Y ou can change the First DS0 Channel number , which has a valid range from one to the maximum number minus the number of active channels. If the number of active DS0 channels is 24 (maximum), First DS0 Channel is hidden. If you specify a number of DS0 channels less than the m[...]

  • Page 27

    W AN and System Configuration 2-9 Note: If you used Easy Setup to configure your r outer , you have alr eady created a connection pr ofile called Easy Setup Profile. If you r eturn to the Easy Setup menus and change the Data Link Encapsulation method you set up in this step, the Easy Setup Data Link Encapsulation method will over ride this one [...]

  • Page 28

    2-10 Firmware User Guide 1. Select LMI T ype (Link Management Type) and pr ess Retur n. From the pop-up menu, highlight either ANSI (Annex D) , CCITT (Annex A) , LMI , or None . The default is None . Press Retur n. See “Frame Relay DLCI configuration” on page 2-11 for instr uctions. Specifying the Link Management Type is the first step in con[...]

  • Page 29

    W AN and System Configuration 2-11 ting defaults to 64000, but you may modify the capacity rate if this setting will not be applicable to you. ■ The Default Bc (Bc also refer r ed to as Committed Burst Size) repr esents the maximum amount of data that your Frame Relay ser vice pr ovider agrees to transfer from a given PVC (Per manent Vir tual Ci[...]

  • Page 30

    2-12 Firmware User Guide T o go to the Frame Relay DLCI configuration screen, select Frame Relay DLCI Configuration in the W AN Configuration screen. Displa ying a Frame Relay DLCI configuration table T o display a view-only table of the Frame Relay DLCIs, select Display/Change DLCIs in the Frame Relay DLCI Configuration screen, and pr ess Ret[...]

  • Page 31

    W AN and System Configuration 2-13 Changing a Frame Rela y DLCI configuration T o modify a Frame Relay DLCI configuration, select Display/Change DLCIs in the Frame Relay DLCI Configuration screen. Select a DLCI Name from the table and pr ess Return to go to the Change DLCI screen. The parameters in this screen ar e the same as the parameters in[...]

  • Page 32

    2-14 Firmware User Guide Adding a Frame Rela y DLCI configuration T o add a new Frame Relay DLCI, select Add DLCI in the Frame Relay DLCI Configuration screen and press Retur n. The Add DLCI screen appears. 1. Select DLCI Name and enter a name for this individual Frame Relay DLCI profile. It can be any name you want. For example: the name of you[...]

  • Page 33

    W AN and System Configuration 2-15 provider agr ees to transfer from a given PVC (Per manent Vir tual Cir cuit) or DLCI (Data Link Connection Identifier). The setting defaults to 64000, but you may modify the committed burst size by toggling the selection in the Use Default field to No . Y ou can then enter a dif fer ent committed burst size in [...]

  • Page 34

    2-16 Firmware User Guide Multiple A TM P ermanent Vir tual Cir cuits The Netopia Fir mware V ersion 5.4 suppor ts up to eight per manent vir tual cir cuits. Multiple A TM PVC overview On cell-based DSL W AN inter faces, the A TM connection between the device and the central of fice equipment (DSLAM) is divided logically into one or more vir tual c[...]

  • Page 35

    W AN and System Configuration 2-17 3. T o add a circuit, select Add Cir cuit and press Retur n. The Add Circuit scr een appears. ■ Enter a name for the circuit in the Cir cuit Name field. ■ T oggle Circuit Enabled to Y es. ■ Enter the Vir tual Path Identifier and the Vir tual Channel Identifier in the Circuit VPI and Cir cuit VCI fields,[...]

  • Page 36

    2-18 Firmware User Guide Quality of Service (QoS) settings ■ Select the QoS (Quality of Ser vice) setting from the pop-up menu: UBR . or CBR . UBR : No configuration is needed for UBR VCs. Leave the default value 0 (maximum line rate). CBR : One parameter is requir ed for CBR VCs. Enter the Peak Cell Rate that applies to the VC. This value shoul[...]

  • Page 37

    W AN and System Configuration 2-19 Note: With multiple VCs you must explicitly statically bind the second (and all subsequent) VCs to a profile. The first VC will automatically statically bind according to pr e-defined dynamic binding r ules when you add the second VC. It will rever t back to dynamic binding if the number of VCs is r educed to [...]

  • Page 38

    2-20 Firmware User Guide Editing cir cuits Y ou configure Vir tual Cir cuits in the A TM Circuits Configuration scr een. From the Main Menu, navigate to the A TM Cir cuits Configuration screen. Select Show/Change Circuit and pr ess Return. Main Menu WA N Conf iguration A TM Cir cuits Conf iguration ATM Circuits Configuration Show/Change Circuit.[...]

  • Page 39

    W AN and System Configuration 2-21 Choosing Show/Change Circuit (or Delete Circuit) displays a pop-up menu that allows you to select the cir cuit to be modified or deleted. Changing a cir cuit If you want to make any changes to the circuit you select, you make them in the Change Cir cuit screen. ■ Circuit Name allows you to associate a one- to [...]

  • Page 40

    2-22 Firmware User Guide ■ Circuit Enabled allows you to enable or disable the cir cuit, using the T ab key . The default is enabled. ■ Traf fic T ype allows you to select which type of traf fic will be routed on this cir cuit, V oice or Data. If you choose V oice, the Connection Profile is field becomes unavailable and does not display . ?[...]

  • Page 41

    W AN and System Configuration 2-23 Select VC Traf fic Statistics . The A TM VC Statistics scr een appears. ■ T o display more infor mation about each cir cuit associated with the selected W AN module, use the up or down ar row key to highlight the cir cuit you want to view . Pr ess Return. A pop-up window appears, displaying detailed infor mati[...]

  • Page 42

    2-24 Firmware User Guide Creating a Ne w Connection Pr ofile Connection profiles ar e useful for configuring the connection and authentication settings for negotiating a PPP connection on a DSL link. If you are using the PPP data link encapsulation method, you can stor e your authentication infor mation in the connection profile so that your us[...]

  • Page 43

    W AN and System Configuration 2-25 Multiple Data Link Encapsulation Settings 4. Select Encapsulation Options and press Retur n. ❥ If you selected A TMP , PPTP , L2TP , or IPSec, see Chapter 4, “Vir tual Private Networks (VPNs).” ❥ If you selected PPP or RFC1483, the screen of fers dif fer ent options: If you are using PPP , when you select[...]

  • Page 44

    2-26 Firmware User Guide Retur n to the Add Connection Profile screen by pr essing Escape. 5. Select IP Profile Parameters and pr ess Return. The IP Pr ofile Parameters screen appears. Datalink (PPP/MP) Options Data Compression... Standard LZS Send Authentication... PAP Send User Name: Send Password: Receive User Name: Receive Password: ❥ If y[...]

  • Page 45

    W AN and System Configuration 2-27 6. T oggle or enter any IP Parameters you requir e and retur n to the Add Connection Profile scr een by pressing Escape. For more infor mation, see “IP Setup” on page 6-2 . 7. Select COMMIT and press Retur n. Y our new Connection Profile will be added. If you want to view the Connection Profiles in your de[...]

  • Page 46

    2-28 Firmware User Guide The Default Pr ofile If you are using RFC1483 data link encapsulation, the Default Pr ofile screen contr ols whether or not the DSL link will come up without an explicitly configured connection pr ofile. (PPP datalink encapsulation does not suppor t a default profile, and the cor responding menu item is unavailable.) S[...]

  • Page 47

    W AN and System Configuration 2-29 IP parameters (default pr ofile) screen If you are using RFC1483 datalink encapsulation, the IP Parameters (Default Pr ofile) screen allows you to configure various IP parameters for DSL connections established without an explicitly configur ed connection profile: For an DSL link, Network Address T ranslatio[...]

  • Page 48

    2-30 Firmware User Guide Viewing sc heduled connections T o display a table of scheduled connections, select Display/Change Scheduled Connection in the Scheduled Connections screen. Each scheduled connection occupies one r ow of the table. The first column in the table shows a one-letter repr esentation of the Days of the week, from Monday (M or m[...]

  • Page 49

    W AN and System Configuration 2-31 The other columns show: ■ The time of day that the connection will Begin At ■ The duration of the connection ( HH:MM ) ■ Whether it’s a recur ring Weekly connection or used Once Only ■ Which connection profile ( Conn. Pr of. ) is used to connect ■ Whether the scheduled connection is cur rently Enable[...]

  • Page 50

    2-32 Firmware User Guide demand call on the line. ■ Demand-Allowed , meaning that this schedule will per mit a demand call on the line. ■ Demand-Blocked , meaning that this schedule will prevent a demand call on the line. ■ Periodic , meaning that the connection is retried several times during the scheduled time. ■ If How Often is set to W [...]

  • Page 51

    W AN and System Configuration 2-33 Set Once-Only Sc hedule If you set How Often to Once Only , select Set Once-Only Schedule and go to the Set Once-Only Schedule screen. ■ Select Place Call On (Date) and enter a date in the for mat MM/DD/YY or MM/DD/YYYY (month, day , year). Note: Y ou must enter the date in the for mat specified. The slashes a[...]

  • Page 52

    2-34 Firmware User Guide Modifying a scheduled connection T o modify a scheduled connection, select Display/Change Scheduled Connection in the Scheduled Connections screen to display a table of scheduled connections. Select a scheduled connection from the table and pr ess Return. The Change Scheduled Connection scr een appears. The parameters in th[...]

  • Page 53

    W AN and System Configuration 2-35 System Configuration Screens System configuration features The Netopia Fir mware V ersion 5.4 default settings may be all you need to configur e your Router. Some users, however , requir e advanced settings or prefer manual control over the default selections. For these users, Netopia Fir mware V ersion 5.4 pr[...]

  • Page 54

    2-36 Firmware User Guide The System Configuration menu screen appears: IP Setup These screens allow you to configur e your network’s use of the IP networking protocol. ■ Details are given in “IP Setup” on page 6-2 . Filter Sets These screens allow you to configur e security on your network by means of filter sets and a basic firewall. [...]

  • Page 55

    W AN and System Configuration 2-37 Stateful Inspection firewall Stateful inspection firewall is a security featur e that prevents unsolicited inbound access when NA T is disabled. Y ou can configure UDP and TCP “no-activity” periods that will also apply to NA T time-outs if stateful inspection is enabled on the inter face. Stateful Inspecti[...]

  • Page 56

    2-38 Firmware User Guide Stateful Inspection Options Enable and configure stateful inspection on a WAN inter face. When you create or modify a Connection Pr ofile, the IP Profile Parameters scr een allows you to enable Stateful Inspection on that profile by toggling Stateful Inspection Enabled to Ye s . By default, this is tur ned of f (No). If[...]

  • Page 57

    W AN and System Configuration 2-39 ■ Max. TCP Sequence Number Dif fer ence : Enter a value in this field. This value represents the maximum sequence number dif fer ence allowed between subsequent TCP packets. If this number is exceeded, the packet is dropped. The acceptable range is 0 – 65535. A value of 0 (zer o) disables this check. ■ Ena[...]

  • Page 58

    2-40 Firmware User Guide Exposed Addresses Y ou can specify the IP addresses you want to expose by selecting Add Exposed Address List and pr essing Retur n. The Add Exposed Address List screen appears. Add, Edit, or delete exposed addresses options ar e active only if NA T is disabled on an WAN inter face. The hosts specified in exposed addresses [...]

  • Page 59

    W AN and System Configuration 2-41 ■ Star t Address: Star t IP Address of the exposed host range. ■ End Address: End IP Addr ess of the exposed host range ■ Protocol : Select the Pr otocol of the traf fic to be allowed to the host range fr om the pull-down menu. Options are Any , TCP , UDP , or TCP/UDP . ■ Star t Por t: Star t por t of th[...]

  • Page 60

    2-42 Firmware User Guide Date and time Y ou can set the system’s date and time parameters in the Set Date and Time screen. Select Date and Time in the System Configuration screen and pr ess Return. The Set Date and Time scr een appears. Follow these steps to set the system’s date and time: 1. T oggle NTP (Network Time Prot.) Enabled to On to s[...]

  • Page 61

    W AN and System Configuration 2-43 Console Configuration Y ou can change the default ter minal communications parameters to suit your requir ements. T o go to the Console Configuration screen, select Console Configuration in the System Configuration screen. Follow these steps to change a parameter’s value: 1. Select 57600, 38400, 19200, or 9[...]

  • Page 62

    2-44 Firmware User Guide RFC-1483 T ransparent Bridging This feature allows you to tur n of f the r outing features and use your device as a bridge. If you select this option, the device will restar t itself, and r eset all the settings to factor y defaults. Any configurations you have made will be erased. Use this feature with caution. If you dec[...]

  • Page 63

    W AN and System Configuration 2-45 Y ou can reinstate r outer mode by retur ning to the System Configuration menu. Select Change Device to a Router . Press Return , confir m your choice, and the device will r estar t in router mode. Bridged Frame-Relay . Note: Netopia Fir mware V ersion 5.4 now suppor ts additional Frame Relay configuration opt[...]

  • Page 64

    2-46 Firmware User Guide Logging Y ou can configure a UNIX-compatible syslog client to r epor t a number of subsets of the events entered in the router’s WAN Event Histor y . See “W AN Event Histor y” on page 9-5 . Select Logging from the System Configuration menu. The Logging Configuration screen appears. By default, all events are logged[...]

  • Page 65

    W AN and System Configuration 2-47 Y ou will need to install a Syslog client daemon program on your PC and configur e it to repor t the WAN events you specified in the Logging Configuration screen. The following screen shows a sample syslog dump of WAN events: May 5 10:14:06 tsnext.netopia.com Link 1 down: PPP PAP failure May 5 10:14:06 tsnext.[...]

  • Page 66

    2-48 Firmware User Guide[...]

  • Page 67

    Multiple Network Address T ranslation 3-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 3 3 3 3 M M M M u u u u ll l l t t t t ii i i p p p p ll l l e e e e N N N N e e e e t t t t w w w w o o o o r r r r k k k k A A A A d d d d d d d d r r r r e e e e s s s s s s s s T T T T r r r r a a a a n n n n s s s s ll l l a a a a t t t t ii i i o[...]

  • Page 68

    3-2 Firmware User Guide Features MultiNA T featur es can be divided into several categories that can be used simultaneously in dif fer ent combinations on a per-Connection Profile basis. The following is a general description of these features: P ort Address T ranslation The simplest for m of classic Network Address T ranslation is PAT (Por t Addr[...]

  • Page 69

    Multiple Network Address T ranslation 3-3 Dynamic mapping Dynamic mapping , often refer r ed to as many-to-few , of fers an extension to the advantages pr ovided by static mapping. Instead of requiring a one-to-one association of public addr esses and private addresses, as is requir ed in static mapping, dynamic mapping uses a group of public IP ad[...]

  • Page 70

    3-4 Firmware User Guide Exterior addresses ar e allocated to internal hosts on a demand, or as-needed, basis and then made available when traf fic fr om that host ceases. Once an inter nal host has been allocated an address, it will use that address for all traf fic. Five minutes after all traf fic ceases – no pings, all TCP connections closed[...]

  • Page 71

    Multiple Network Address T ranslation 3-5 Complex maps Map lists and ser ver lists ar e completely independent of each other . A Connection Pr ofile can use one or the other or both. MultiNA T allows complex mapping and r equires mor e complex configuration than in earlier fir mware versions. Multiple mapped interior subnets are suppor ted, and [...]

  • Page 72

    3-6 Firmware User Guide Cur rently ther e is a restriction that the r emote user must be routed to via the W AN inter face, other wise the connections will fail. There is no r estriction as to the number of connections. There is no user configuration r equired for this featur e. MultiNA T Configuration Y ou configure the MultiNA T features thr o[...]

  • Page 73

    Multiple Network Address T ranslation 3-7 Server Lists and Dynamic NA T configuration Y ou use the advanced NA T featur e sets by first defining a series of mapping r ules and then grouping them into a list . There ar e two kinds of lists -- map lists , made up of dynamic, P A T and static mapping r ules, and ser ver lists , a list of inter nal [...]

  • Page 74

    3-8 Firmware User Guide Select Network Address Translation (NA T) and press Retur n. The Network Address T ranslation scr een appears. Public Range defines an external addr ess range and indicates what type of mapping to apply when using this range. The types of mapping available are dynamic , static and pat . Map Lists define collections of mapp[...]

  • Page 75

    Multiple Network Address T ranslation 3-9 NA T rules The following r ules apply to assigning NA T ranges and ser ver lists: ■ Static public address ranges must not overlap other static, P A T , public addresses, or the public addr ess assigned to the router’s WAN inter face. ■ A P A T public addr ess must not overlap any static address ranges[...]

  • Page 76

    3-10 Firmware User Guide Select First Public Address and enter the first exterior IP addr ess in the range you want to assign. Select Last Public Address and enter an IP addr ess at the end of the range. ■ Select ADD NA T PUBLIC RANGE and pr ess Return. The range will be added to your list and you will be retur ned to the Network Address T ransl[...]

  • Page 77

    Multiple Network Address T ranslation 3-11 ■ Select Add Map and press Retur n. The Add NA T Map scr een appears. ■ Select First and Last Private Address and enter the first and last interior IP addr esses you want to assign to this mapping. ■ Select Use NA T Public Range and pr ess Return. A scr een appears displaying the public ranges you h[...]

  • Page 78

    3-12 Firmware User Guide mapping and press Retur n. If none of your preconfigur ed ranges are suitable for this mapping, you can select <<NEW RANGE>> and create a new range. If you choose <<NEW RANGE>> , the Add NA T Public Range screen displays and you can create a new public range to be used by this map. See Add NA T Publ[...]

  • Page 79

    Multiple Network Address T ranslation 3-13 Modifying map lists Y ou can make changes to an existing map list after you have created it. Since ther e may be more than one map list you must select which one you are modifying. From the Network Addr ess T ranslation screen select Show/Change Map List and press Retur n. ■ Select the map list you want [...]

  • Page 80

    3-14 Firmware User Guide ■ Add Map allows you to add a new map to the map list. ■ Show/Change Maps allows you to modify the individual maps within the list. ■ Delete Map allows you to delete a map from the list. Selecting Show/Change Maps or Delete Map displays the same pop-up menu. Scroll to the map you want to modify using the ar r ow keys [...]

  • Page 81

    Multiple Network Address T ranslation 3-15 Adding Server Lists Ser ver lists, also known as Expor ts, ar e handled similarly to map lists. If you want to make a par ticular ser ver’s por t accessible (and it isn’t accessible through other means, such as a static mapping), you must cr eate a ser ver list. Select Add Ser ver List from the Network[...]

  • Page 82

    3-16 Firmware User Guide ■ Select Add Ser ver and press Retur n. The Add NA T Ser ver screen appears. ■ Select Ser vice and press Retur n. A pop-up menu appears listing a selection of commonly expor ted ser vices. ■ Choose the ser vice you want to expor t and pr ess Return. Y ou can choose a preconfigur ed ser vice from the list, or define [...]

  • Page 83

    Multiple Network Address T ranslation 3-17 ■ Enter the First and Last Por t Number between por ts 1 and 65535. Select OK and press Retur n. Y ou will be retur ned to the Add NA T Ser ver screen. ■ Enter the Ser ver Private IP Address of the ser ver whose ser vice you are expor ting. Since MultiNA T per mits the mapping of multiple private IP ad[...]

  • Page 84

    3-18 Firmware User Guide Modifying server lists Once a ser ver list exists, you can select it for modification or deletion. ■ Select Show/Change Ser ver List from the Network Addr ess T ranslation screen. ■ Select the Ser ver List Name you want to modify fr om the pop-up menu and press Retur n. The Show/Change NA T Ser ver List screen appears.[...]

  • Page 85

    Multiple Network Address T ranslation 3-19 ■ Selecting Show/Change Ser ver or Delete Ser ver displays the same pop-up menu. Select any ser ver fr om the list and press Retur n. The Change NA T Ser ver screen appears. Y ou can make changes to the ser ver’s ser vice and por t or internal or exter nal addr ess. Select CHANGE NA T SERVER and pr ess[...]

  • Page 86

    3-20 Firmware User Guide Deleting a server T o delete a ser ver from the list, select Delete Ser ver fr om the Show/Change NA T Ser ver List menu and pr ess Retur n. A pop-up menu lists your configured ser vers. Select the one you want to delete and press Retur n. A dialog box asks you to confir m your choice. Choose CONTINUE and press Retur n. T[...]

  • Page 87

    Multiple Network Address T ranslation 3-21 Binding Map Lists and Server Lists Once you have created your map lists and ser ver lists, for most Netopia Router models you must bind them to a profile, either a Connection Pr ofile or the Default Profile. Y ou do this in one of the following scr eens: ■ the IP profile parameters scr een (see below[...]

  • Page 88

    3-22 Firmware User Guide ■ Select NA T Map List and pr ess Return. A pop-up menu displays a list of your defined map lists. ■ Select the map list you want to bind to this Connection Profile and pr ess Return. The map list you selected will now be bound to this Connection Profile. ■ Select NA T Ser ver List and pr ess Return. A pop-up menu [...]

  • Page 89

    Multiple Network Address T ranslation 3-23 IP P arameters (W AN Default Pr ofile) The Netopia Fir mware V ersion 5.4 using RFC 1483 suppor ts a W AN default pr ofile that per mits several parameters to be configured without an explicitly configur ed Connection Profile. The procedur e is similar to the procedur e to bind map lists and ser ver l[...]

  • Page 90

    3-24 Firmware User Guide ■ Select NA T Map List and pr ess Return. A pop-up menu displays a list of your defined map lists. ■ Select the map list you want to bind to the default profile and pr ess Return. The map list you selected will now be bound to the default profile. ■ Select NA T Ser ver List and pr ess Return. A pop-up menu displays[...]

  • Page 91

    Multiple Network Address T ranslation 3-25 NA T Associations Configuration of map and ser ver lists alone is not suf ficient to enable NA T for a WAN connection because map and ser ver lists must be linked to a pr ofile that controls the W AN inter face. This can be a Connection Profile, a W AN Ether net inter face, a default pr ofile, or a de[...]

  • Page 92

    3-26 Firmware User Guide keys. Select the item by pressing Retur n to display a pop-up menu of all of your configured lists. ■ Select the list name you want to assign and press Retur n again. Y our selection will then be associated with the cor responding pr ofile or inter face. NAT Associations +NAT Map List Name-+ Profile/Interface Name------[...]

  • Page 93

    Multiple Network Address T ranslation 3-27 IP P assthrough Netopia Fir mware V ersion 5.4 of fers an IP passthr ough feature. The IP passthr ough feature allows for a single PC on the LAN to have the router’s public addr ess assigned to it. It also provides P A T (NAPT) via the same public IP address for all other hosts on the private LAN subnet.[...]

  • Page 94

    3-28 Firmware User Guide The IP Profile Parameters scr een, found under the W AN Configuration menu, Add/Change Connection Profile screen, appears as shown. If you select NA T Options , in either case, the NA T Options screen appears. If you toggle IP Passthrough Enabled to Ye s , additional field(s) appear . IP Profile Parameters Address Trans[...]

  • Page 95

    Multiple Network Address T ranslation 3-29 T oggling IP Passthrough DHCP Enabled to Ye s displays the IP Passthr ough DHCP MAC address field. This is an editable field in which you can enter the MAC (hardwar e) address of the designated PC be used as the DHCP Client Identifier for dynamic address r eser vation. The MAC address must be six colon-[...]

  • Page 96

    3-30 Firmware User Guide A restriction Since both the router and the passthr ough host will use same IP address, new sessions that conflict with existing sessions will be rejected by the r outer . For example, suppose you ar e a teleworker using an IPSec tunnel from the r outer and from the passthr ough host. Both tunnels go to the same remote end[...]

  • Page 97

    Multiple Network Address T ranslation 3-31 MultiNA T Configuration Example T o help you understand a typical MultiNA T configuration, this section describes an example of the type of configuration you may want to implement on your site. The values shown are for example purposes only . Make your own appropriate substitutions. A typical DSL ser vi[...]

  • Page 98

    3-32 Firmware User Guide Enter your ISP-supplied values as shown below . Select NEXT SCREEN and press Retur n. Y our IP values are shown her e. Then navigate to the Network Address T ranslation (NA T) screen. Connection Profile 1: Easy Setup Profile Connection Profile Name: Easy Setup Profile Address Translation Enabled: Yes IP Addressing... Number[...]

  • Page 99

    Multiple Network Address T ranslation 3-33 Select Show/Change Public Range , then Easy-P A T Range , and pr ess Return. Enter the value your ISP assigned for your public address (206.1.1.6, in this example). T oggle Type to pat. Y our public address is then mapped to the remaining private IP addr esses using P A T . (If you wer e not using the Easy[...]

  • Page 100

    3-34 Firmware User Guide Select ADD NA T PUBLIC RANGE and pr ess Return. Y ou ar e retur ned to the Network Address T ranslation screen. Next, select Show/Change Map List and choose Easy-P A T List . Select Add Map . The Add NA T Map screen appears. (Now the name Easy-P A T List is a misnomer since it has a static map included in its list.) Enter i[...]

  • Page 101

    Multiple Network Address T ranslation 3-35 T o make these changes, first limit the range of remapped addr esses on the Static Map and then edit the default ser ver list called Easy-Ser vers. ■ First, navigate to the Show/Change Map List screen, select Easy-P A T List and then Show/Change Maps . Choose the Static Map you created and change the Fi[...]

  • Page 102

    3-36 Firmware User Guide[...]

  • Page 103

    Virtual Private Networks (VPNs) 4-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 4 4 4 4 V V V V ii i i r r r r t t t t u u u u a a a a ll l l P P P P r r r r ii i i v v v v a a a a t t t t e e e e N N N N e e e e t t t t w w w w o o o o r r r r k k k k s s s s ( ( ( ( V V V V P P P P N N N N s s s s ) ) ) ) The Netopia Fir mware V ersio[...]

  • Page 104

    4-2 Firmware User Guide The Netopia Fir mware V ersion 5.4 can be used in VPNs either to initiate the connection or to answer it. When used in this way , the r outers are said to be tunnelling through the public network (Inter net). The advantages are that, like your long distance phone call, you don't need a direct line between one computer o[...]

  • Page 105

    Virtual Private Networks (VPNs) 4-3 protocol over IP . A TMP is more ef ficient than PPTP for network-to-network tunnels. ■ IPsec stands for IP Security , a set of pr otocols that suppor ts secure exchange of IP packets at the IP layer . IPsec is deployed widely to implement Vir tual Private Networks (VPNs). IPsec suppor ts two encr yption modes[...]

  • Page 106

    4-4 Firmware User Guide About PPTP T unnels T o set up a PPTP tunnel, you create a Connection Pr ofile including the IP address and other relevant infor mation for the remote PPTP par tner . Y ou use the same pr ocedure to initiate a PPTP tunnel that ter minates at a r emote PPTP ser ver or to ter minate a tunnel initiated by a r emote PPTP client[...]

  • Page 107

    Virtual Private Networks (VPNs) 4-5 When you define a Connection Profile as using PPTP by selecting PPTP as the datalink encapsulation method, and then select Data Link Options , the PPTP T unnel Options screen appears. ■ Enter the PPTP Par tner IP Address . This specifies the addr ess of the other end of the tunnel. If you do not specify the [...]

  • Page 108

    4-6 Firmware User Guide Note: The Netopia Fir mware V ersion 5.4 suppor ts 128-bit (“strong”) encr yption. Unlike MS-CHAP version 1, which suppor ts one-way authentication, MS-CHAP version 2 suppor ts mutual authentication between connected routers and is incompatible with MS-CHAP version 1 (MS-CHAP-V1). When you choose MS-CHAP as the authentic[...]

  • Page 109

    Virtual Private Networks (VPNs) 4-7 The IP Profile Parameters scr een appears. ■ Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel. About IPsec T unnels IPsec stands for IP Security , a set of pr otocols that suppor ts secure exchange of IP packets at the IP layer . IPsec is deployed widely to implement Vir [...]

  • Page 110

    4-8 Firmware User Guide About A TMP T unnels T o set up an A TMP tunnel, you cr eate a Connection Profile including the IP addr ess and other relevant infor mation for the remote A TMP par tner . A TMP uses the ter minology of a foreign agent that initiates tunnels and a home agent that ter minates them. Y ou use the same procedur e to initiate or[...]

  • Page 111

    Virtual Private Networks (VPNs) 4-9 When you define a Connection Profile as using A TMP by selecting A TMP as the datalink encapsulation method, and then select Data Link Options , the A TMP T unnel Options scr een appears. Note: An A TMP tunnel cannot be assigned a dynamic IP addr ess by the remote ser ver , as in a PPP connection. When you de?[...]

  • Page 112

    4-10 Firmware User Guide them, acting as a home agent ( No ). ■ T unnels are nor mally initiated On Demand ; however , you can disable this feature. When disabled, the tunnel must be manually established through the call management scr eens. ■ Y ou can specify the Idle Timeout , an inactivity timer , whose expiration will ter minate the tunnel.[...]

  • Page 113

    Virtual Private Networks (VPNs) 4-11 MS-CHAP V2 and 128-bit str ong encryption Notes: ■ The Netopia Fir mware V ersion 5.4 suppor ts 128-bit (“strong”) encr yption when using PPTP tunnels. A TMP does not have an option of using 128-bit MPPE. If you ar e using A TMP between two Netopia r outers you can optionally set 56-bit DES encr yption. ?[...]

  • Page 114

    4-12 Firmware User Guide ■ T oggle Answer A TMP/PPTP Connections to Ye s if you want the r outer to accept VPN connections or No (the default) if you do not. ■ For PPTP tunnel connections only , you must define what type of authentication these connections will use. Select Receive Authentication and press Retur n. A pop-up menu of fers the fol[...]

  • Page 115

    Virtual Private Networks (VPNs) 4-13 VPN Quic kVie w Y ou can view the status of your VPN connections in the VPN QuickView screen. From the Main Menu select QuickView and then VPN QuickView . The VPN QuickView screen appears. Profile Name: Lists the name of the Connection Pr ofile being used, if any . Type: Shows the data link encapsulation metho[...]

  • Page 116

    4-14 Firmware User Guide Dial-Up Netw orking f or VPN Microsoft Windows Dial-Up Networking softwar e per mits a remote standalone workstation to establish a VPN tunnel to a PPTP ser ver such as a Netopia Router located at a central site. Dial-Up Networking also allows a mobile user who may not be connected to a P AC to dial into an inter mediate IS[...]

  • Page 117

    Virtual Private Networks (VPNs) 4-15 The Communications window appears. 5. In the Communications window , select Dial-Up Networking and click the OK button. This retur ns you to the Windows Setup screen. Click the OK button. 6. Respond to the prompts to install Dial-Up Networking fr om the system disks or CDROM. 7. When prompted, r eboot your PC. C[...]

  • Page 118

    4-16 Firmware User Guide Configuring a Dial-Up Netw orking profile Once you have created your Dial-Up Networking pr ofile, you configure it for TCP/IP networking to allow you to connect to the Inter net through your Inter net connection device. Do the following: 1. Double-click the My Computer (or whatever you have named it) icon on your deskto[...]

  • Page 119

    Virtual Private Networks (VPNs) 4-17 4. Click the TCP/IP Settings button. ■ If your ISP uses dynamic IP addressing (DHCP), select the Ser ver assigned IP address radio button. ■ If your ISP uses static IP addressing, select the Specify an IP addr ess radio button and enter your assigned IP address in the fields pr ovided. Also enter the IP add[...]

  • Page 120

    4-18 Firmware User Guide This displays a list of possible selections for the communications option. Active components will have a check in the checkboxes to their left. 6. Check Dial Up Networking at the top of the list and Vir tual Private Networking at the bottom of the list. 7. Click OK at the bottom right on each screen until you r eturn to the[...]

  • Page 121

    Virtual Private Networks (VPNs) 4-19 Connecting using Dial-Up Netw orking A Dial-Up Networking connection will be automatically launched whenever you r un a TCP/IP application, such as a web browser or email client. When you first r un the application a Connect T o dialog box appears in which you enter your User name and Password. If you check the[...]

  • Page 122

    4-20 Firmware User Guide PPTP example T o enable a firewall to allow PPTP traf fic, you must provision the fir ewall to allow inbound and outbound TCP packets specifically destined for por t 1723. The sour ce por t may be dynamic, so often it is not useful to apply a compare function upon this por tion of the contr ol/negotiation packets. Y ou [...]

  • Page 123

    Virtual Private Networks (VPNs) 4-21 In the Display/Change Filter Set screen select Display/Change Output Filter . Display/Change Output Filter screen Select Output Filter 1 and press Retur n. In the Change Output Filter 1 screen, set the Pr otocol Type and Destination Por t infor mation as shown below . Change Input Filter 2 Enabled: Yes Forward: [...]

  • Page 124

    4-22 Firmware User Guide Select Output Filter 2 and press Retur n. In the Change Output Filter 2 screen, set the Pr otocol Type to allow GRE as shown below . A TMP example T o enable a firewall to allow A TMP traf fic, you must pr ovision the firewall to allow inbound and outbound UDP packets specifically destined for por t 5150. The sour ce po[...]

  • Page 125

    Virtual Private Networks (VPNs) 4-23 Select Input Filter 1 and press Retur n. In the Change Input Filter 1 screen, set the Destination Por t infor mation as shown below . Select Input Filter 2 and press Retur n. In the Change Input Filter 2 screen, set the Pr otocol Type to allow GRE as shown below . Change Input Filter 1 Enabled: Yes Forward: Yes [...]

  • Page 126

    4-24 Firmware User Guide In the Display/Change Filter Set screen select Display/Change Output Filter . Display/Change Output Filter screen Select Output Filter 1 and press Retur n. In the Change Output Filter 1 screen, set the Pr otocol Type and Destination Por t infor mation as shown below . Select Output Filter 2 and press Retur n. In the Change [...]

  • Page 127

    Virtual Private Networks (VPNs) 4-25 Windo ws Netw orking Broadcasts Netopia fir mware pr ovides the ability to for ward Windows Networking NetBIOS br oadcasts. This is useful for , for example, a Vir tual Private Network, in which you want to be able to browse the r emote network to which you are tunnelling, as par t of your Windows Network Neigh[...]

  • Page 128

    4-26 Firmware User Guide Configuration for Router A Configuration for Router B IP Profile Parameters Address Translation Enabled: No Remote IP Address: 192.168.2.1 Remote IP Mask: 255.255.255.0 Filter Set... Remove Filter Set NetBIOS Proxy Enabled Yes RIP Profile Options... Enter an IP address in decimal and dot form (xxx.xxx.xxx.xxx). Configure [...]

  • Page 129

    Virtual Private Networks (VPNs) 4-27 Note: Microsoft Network br owsing is available with or without a Windows Internet Name Ser vice (WINS) ser ver . Shared volumes on the r emote network are accessible with or without a WINS ser ver . Local LAN shar ed volumes that have Por t Address T ranslation (P A T) applied to them ar e not available to hosts[...]

  • Page 130

    4-28 Firmware User Guide[...]

  • Page 131

    Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 5 5 5 5 II I I n n n n t t t t e e e e r r r r n n n n e e e e t t t t K K K K e e e e y y y y E E E E x x x x c c c c h h h h a a a a n n n n g g g g e e e e ( ( ( ( II I I K K K K E E E E ) ) ) ) II I I P P P P s s s s e e e e c c[...]

  • Page 132

    5-2 Firmware User Guide the two devices on the Inter net to communicate securely . ■ Phase 2 establishes the tunnel and provides for secur e transpor t of data. IPsec can be configured without IKE, but IKE of fers additional features, flexibility , and ease of configuration. Key exchange between your local router and a r emote point can be con[...]

  • Page 133

    Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-3 The Add Connection Profile scr een appears. ■ From the Encapsulation Type pop-up menu select IPsec . ■ Then select Encapsulation Options . The IPsec T unnel Options screen appears. Main Menu WA N Conf iguration Add Connection Prof ile Add Connection Profile Profile Name: Profile 1 P[...]

  • Page 134

    5-4 Firmware User Guide For Key Management you can use either IKE or Manual . If you choose Manual, skip to “IPsec Manual Key Entr y” on page 5-19 . If you choose IKE (the default) continue below . ■ Select IKE Phase 1 Profile and pr ess Return. ■ A pop-up window displays a list of IKE Phase 1 Profiles that you have configur ed. If you h[...]

  • Page 135

    Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-5 ■ The Profile Name field accepts any name of up to 16 characters. Sixteen IKE Phase 1 pr ofiles are suppor ted, since each of the potential sixteen Connection Profiles may be associated with a separate IKE Phase 1 profile. ■ The Mode pop-up menu allows you to choose between Main[...]

  • Page 136

    5-6 Firmware User Guide that will be used to generate key material for IKE Phase 1. ■ The Encryption Algorithm pop-up menu specifies the IKE Phase 1 encr yption algorithm, and may be either DES (the default) or 3DES. ■ The Hash Algorithm pop-up menu specifies the IKE Phase 1 hash algorithm, and may be either SHA1 (the default) or MD5. ■ The[...]

  • Page 137

    Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-7 the Phase 1 SAs under which they were cr eated. Phase 2 SAs “dangle” when the Phase 1 SA under which they were cr eated expires befor e they do. There is no requir ement that the Phase 1 SA exist for the duration of the Phase 2 SA ’s lifetime, but it is convenient because a Delete [...]

  • Page 138

    5-8 Firmware User Guide Changing an IKE Phase 1 Pr ofile Selecting Display/Change IKE Phase 1 Profile or Delete IKE Phase 1 Profile displays an IKE Phase 1 pr ofile pop-up menu listing the names of all cur rently defined IKE Phase 1 pr ofiles: Selecting Display/Change IKE Phase 1 Profile and choosing an IKE phase 1 pr ofile name from the po[...]

  • Page 139

    Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-9 K ey Mana g ement Y ou specify your IKE key management on a per-Connection Profile basis. Y ou can do this in one of thr ee ways: ■ Y ou can create your IKE Phase 1 Pr ofile first, and then associate it with an existing Connection Profile ■ Y ou can create a Connection Pr ofile [...]

  • Page 140

    5-10 Firmware User Guide Note: The Change Connection Profile scr een will of fer dif ferent options, depending on the model of r outer you are using. For a r outer with the Dial Backup feature, you can associate an IPsec pr ofile with the Primar y , the Backup, or choose to apply it to Any Por t of the W AN inter face by choosing the inter face f[...]

  • Page 141

    Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-11 The Key Management pop-up menu at the top of the IPsec T unnel Options screen allows you to choose between IKE key management (the default for a new IPsec profile) and Manual key management. If you select Manual , the IKE Phase 1 Profile option does not display , and you must enter yo[...]

  • Page 142

    5-12 Firmware User Guide This screen allows you to specify the lifetime associated with each IPsec Security Association (SA) and contr ol when the SA will expire and become invalid. ■ SA Lifetime (seconds) specifies the duration in seconds for which the SA will remain valid. The range of per missible values is the set of non-negative integer val[...]

  • Page 143

    Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-13 Netopia Fir mware V ersion 5.4 pr ovides a new Dead Peer Detection mechanism. An IPsec IP net inter face sends ICMP ping requests to a specific IP addr ess on a Remote Member network. The ping is periodic, and the reply is expected within a cer tain amount of time. If the ICMP r eply d[...]

  • Page 144

    5-14 Firmware User Guide If you enable IKE key management the IP Profile Parameters scr een appears. ■ The Remote Tunnel Endpoint field accepts either an IP address in the familiar dotted–quad notation a.b.c.d or a hostname to be resolved using the Domain Name System (DNS). Multiple Netw ork IPsec Netopia Fir mware V ersion 5.4 of fers an enh[...]

  • Page 145

    Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-15 ■ suppor t for sub-netting, host and network range addressing modes ■ works with manual keying and Inter net Key Exchange (IKE) ■ each IPsec network works under the same local/remote tunnel endpoints ■ Select Add Network and press Retur n. The Add Network Configuration screen a[...]

  • Page 146

    5-16 Firmware User Guide If you retur n to the IP Profile Parameters scr een, two new fields are displayed: ■ Display/Change Network allows you to make changes to existing network configurations you have made. If you select Display/Change Network, a list of your configured networks displays. ■ Scroll down and up with the ar r ow keys to sel[...]

  • Page 147

    Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-17 ■ Specifying IKE key management alters the Advanced IP Profile Options screen as follows: ■ Y ou can specify a Local Tunnel Endpoint Address . If not 0.0.0.0, this value must be one of the assigned inter face addr esses, either W AN or LAN. This is used as the sour ce address of al[...]

  • Page 148

    5-18 Firmware User Guide IPsec W AN Configuration Screens Y ou can also configure IKE Phase 1 Pr ofiles in the W AN Configuration menus. The W AN Configuration scr een now includes IKE Phase 1 Configuration as shown: Select IKE Phase 1 Configuration and press Retur n. The IKE Phase 1 Configuration screen appears. W AN Conf iguration Main Me[...]

  • Page 149

    Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-19 The IKE Phase 1 Configuration screen allows configuration of global (non-connection-pr ofile-specific) IPsec parameters. This screen allows you to Display , Change, Add, or Delete an IKE Phase 1 profile. IPsec Manual K e y Entr y The V ersion 5.3 fir mware has a r edesigned layout[...]

  • Page 150

    5-20 Firmware User Guide Select IPsec Manual Keys and press Retur n. Depending on your selections of Encapsulation, Encr yption T ransfor m, and Authentication T ransfor m in the IPsec T unnel Options screen, the IPsec Manual Keys scr een will display dif fering entr y fields to enter authorization keys and encr yption keys. With Manual Keys, you [...]

  • Page 151

    Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-21 If the remote tunnel end point is a hostname (or “0.0.0.0”) 0.0.0.0 is displayed until a Security Association is established. Previously the r emote members network was displayed. W AN Event Histor y Err or Repor ting The following events are logged and displayed in the WAN Event Hi[...]

  • Page 152

    5-22 Firmware User Guide IKE: no matching ph2 proposal Either the local router r ejected the proposals of the r emote or the remote r ejected the local router’s. IKE: ph2 resend timeout The attempt to resend the phase 2 authentication timed out. IKE: phase 2 complete The phase 2 negotiation completed successfully . Event message: Meaning:[...]

  • Page 153

    IP Setup 6-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 6 6 6 6 II I I P P P P S S S S e e e e t t t t u u u u p p p p The Netopia Fir mware V ersion 5.4 uses Inter net Pr otocol (IP) to communicate both locally and with remote networks. This chapter shows you how to configure the r outer to route IP traf fic. Y ou also lear n how to[...]

  • Page 154

    6-2 Firmware User Guide IP Setup The IP Setup options screen is wher e you configure the Ether net side of the Router. The infor mation you enter here contr ols how the router r outes IP traf fic. Consult your network administrator or ISP to obtain the IP setup infor mation (such as the Ether net IP address, Ether net subnet mask, default IP gate[...]

  • Page 155

    IP Setup 6-3 The Netopia Fir mware V ersion 5.4 suppor ts multiple IP subnets on the Ether net inter face. Y ou may want to configure multiple IP subnets to ser vice more hosts than ar e possible with your primar y subnet. It is not always possible to obtain a lar ger subnet from your ISP . For example, if you alr eady have a full Class C subnet, [...]

  • Page 156

    6-4 Firmware User Guide that the addresses distributed by the Router and those that ar e manually configured ar e not the same. Each method of distribution must have its own exclusive range of addresses to draw fr om. IP subnets The IP Subnets screen allows you to configur e up to eight Ethernet IP subnets on unlimited-user models, one “primar [...]

  • Page 157

    IP Setup 6-5 For example: ■ T o delete a configured subnet, set both the IP addr ess and subnet mask values to 0.0.0.0, either explicitly or by clearing each field and pressing Retur n to commit the change. When a configured subnet is deleted, the values in subsequent rows adjust up to fill the vacant fields. The subnets configured on this [...]

  • Page 158

    6-6 Firmware User Guide If you have configured multiple Ether net IP subnets, the IP Setup screen changes slightly: The IP address and Subnet mask items ar e hidden, and the Define Additional Subnets... item becomes Subnet Configuration... . If you select Subnet Configuration , you will retur n to the IP Subnets screen that allows you to defin[...]

  • Page 159

    IP Setup 6-7 The Static Routes screen will appear . Viewing static r outes T o display a view-only table of static routes, select Display/Change Static Route . The table shown below will appear . The table has the following columns: Dest. Network: The network IP address of the destination network. Static Routes Display/Change Static Route... Add St[...]

  • Page 160

    6-8 Firmware User Guide Subnet Mask: The subnet mask associated with the destination network. Next Gateway: The IP address of the r outer that will be used to reach the destination network. Priority: An indication of whether the Router will use the static route when it conflicts with infor mation r eceived from RIP packets. Enabled: An indication [...]

  • Page 161

    IP Setup 6-9 infor mation; Low means that the RIP infor mation takes precedence over the static r oute. ■ If the static route conflicts with a connection pr ofile, the connection profile will always take pr ecedence. ■ T o make sure that the static r oute is known only to the Router, select Adver tise Route Via RIP and toggle it to No . T o [...]

  • Page 162

    6-10 Firmware User Guide RIP-2 MD5 A uthentication Fir mware version 5.3.7 suppor ts RIP-2 MD5 Authentication (RFC2082 Routing Inter net Pr otocol V ersion 2, Message Digest 5). The purpose of MD5 authentication is to provide an additional level of confidence that a RIP packet received was generated by a r eliable source. In other wor ds, MD5 auth[...]

  • Page 163

    IP Setup 6-11 The IP Setup screen appears. ■ Select RIP Options . The Ethernet LAN RIP Options scr een appears. IP Setup Ethernet IP Address: 192.168.1.1 Ethernet Subnet Mask: 255.255.255.0 Define Additional Subnets... Default IP Gateway: 0.0.0.0 Backup IP Gateway: 0.0.0.0 Primary Domain Name Server: 0.0.0.0 Secondary Domain Name Server: 0.0.0.0 [...]

  • Page 164

    6-12 Firmware User Guide ■ Select Receive RIP , and from the pull-down menu choose v2 MD5 Authentication . ■ Y ou can also select T ransmit RIP , and choose v2 MD5 (br oadcast) or v2 MD5 (multicast) from the pull-down menu. ■ RIP v2 Authentication Keys is visible only if v2 MD5 Authentication is enabled for either Receive or Ethernet LAN RIP [...]

  • Page 165

    IP Setup 6-13 T ransmit RIP . Note: • All of the changes on this menu requir e a reboot. This is unique to the Ether net LAN. RIP changes on all other inter faces ar e immediately ef fective. • If you set the RIP Receive option to Both v1 and v2 , the inter face will ignore authenticated RIP packets since authenticated v1 packets do not exist. [...]

  • Page 166

    6-14 Firmware User Guide Adding a ke y Select Add Key . The Add Key Screen appears. ■ The key identifier Key ID can be any numeric value from 0 – 255, and must be unique per inter face. Y ou can not have two keys with the same key ID on an inter face. ■ The Authentication Key may consist of from 1 – 16 ASCII characters. These appear as ast[...]

  • Page 167

    IP Setup 6-15 Changing or deleting a key Y ou change or delete a key by selecting it from a pop-up menu. In the RIP v2 Authentication Keys menu, select Display/Change Key . Note: The date and time for mats are deter mined by the system date and time for mats. If the cur r ent date and time fall within the range of dates and times, the V alid field[...]

  • Page 168

    6-16 Firmware User Guide Connection Pr ofiles and Default Profile RIP-2 MD5 authentication may be configured in Connection Pr ofiles, as well. If you are not using NA T , your public Inter net connection can benefit from sending authenticated RIP packets as well as receiving them. T o configur e RIP-2 MD5 authentication for a Connection Pro?[...]

  • Page 169

    IP Setup 6-17 press COMMIT in the Add or Change Key scr een, then press Escape three times to r etur n to the Add or Change Connection Profile scr een. ■ Select COMMIT in the Connection Profile screen and pr ess Return. Y our changes become ef fective for the specified Connection Profile. P o wer interruptions Netopia 4000 Series routers use [...]

  • Page 170

    6-18 Firmware User Guide Go to the System Configuration screen. Select IP Addr ess Ser ving and press Retur n. The IP Address Ser ving screen will appear . Follow these steps to configure IP Addr ess Ser ving: ■ If you enabled IP Address Ser ving, then DHCP , BootP clients and Dynamic W AN clients ar e automatically enabled. ■ The IP Address [...]

  • Page 171

    IP Setup 6-19 Consequently , the DHCP lease time is configurable. The DHCP Lease Time (Hours) setting allows you to modify the router’s default lease time of one hour . Y ou can enter any number up to and including 168 hours (one week) for the DHCP lease. Note: About DHCP Auto-configuration: Beginning with Fir mware V ersion 5.3.4, r outers who[...]

  • Page 172

    6-20 Firmware User Guide IP Address P ools The IP Address Pools scr een allows you to configure a separate IP addr ess ser ving pool for each of up to eight configured Ether net IP subnets: This screen consists of between two and eight r ows of four columns each. There ar e exactly as many rows as there ar e Ethernet IP subnets configur ed on th[...]

  • Page 173

    IP Setup 6-21 Numerous factors influence the choice of ser ved address. It is dif ficult to specify the address that will be ser ved to a par ticular client in all cir cumstances. However , when the address ser ver has been configur ed, and the clients involved have no prior address ser ving interactions, the Router will generally ser ve the fi[...]

  • Page 174

    6-22 Firmware User Guide DHCP NetBIOS Options If your network uses NetBIOS, you can enable the Router to use DHCP to distribute NetBIOS infor mation. NetBIOS stands for Network Basic Input/Output System. It is a layer of software originally developed by IBM and Sytek to link a network operating system with specific hardwar e. NetBIOS has been adop[...]

  • Page 175

    IP Setup 6-23 ■ From the NetBIOS Type pop-up menu, select the type of NetBIOS used on your network. ■ T o ser ve DHCP clients with the NetBIOS scope, select Ser ve NetBIOS Scope and toggle it to Ye s . Select NetBIOS Scope and enter the scope. ■ T o ser ve DHCP clients with the IP address of a NetBIOS name ser ver , select Serve NetBIOS Name [...]

  • Page 176

    6-24 Firmware User Guide Select Release BootP Leases and press Retur n. ■ Back in IP Address Ser ving, the Ser ve Dynamic W AN Clients toggle More Address Serving Options The Netopia Fir mware V ersion 5.4 includes a number of enhancements in the built-in DHCP IP addr ess ser ver . These enhancements include: ■ The ability to exclude one or mor[...]

  • Page 177

    IP Setup 6-25 Configuring the IP Address Server options T o access the enhanced DHCP ser ver functions, from the Main Menu navigate to Statistics & Logs and then Ser ved IP Addresses . The following example shows the Ser ved IP Addr esses screen after three clients have leased IP addr esses. The first client did not provide a Host Name in its[...]

  • Page 178

    6-26 Firmware User Guide Y ou can select the entries in the Ser ved IP Addr esses screen. Use the up and down ar row keys to move the selection to one of the entries in the list of ser ved IP addr esses. Once you select an entr y , pr essing Return displays an action pop-up menu that lists operations that can be per for med on that entr y . Possibl[...]

  • Page 179

    IP Setup 6-27 ■ Details… is displayed if the entr y is associated with both a host name and a client identifier . Selecting Details… displays a pop-up menu that provides additional infor mation associated with the IP address. The pop-up menu includes the IP addr ess as well as the host name and client identifier supplied by the client to wh[...]

  • Page 180

    6-28 Firmware User Guide ■ Include is displayed if the entr y is either excluded or declined. An IP address is marked declined when a client to whom the DHCP ser ver of fers the addr ess declines the address. A client declines an addr ess if it deter mines that a leased address is alr eady in use by another device. Selecting Include restor es the[...]

  • Page 181

    IP Setup 6-29 The router’s Ether net IP address(es) will be automatically excluded fr om the address ser ving pool(s) on star tup. Entries in the ser ved IP addr ess list cor responding to the router’s Ether net IP addr ess(es) that have been automatically excluded on star tup are not selectable. Served IP Addresses -IP Address------Type----Exp[...]

  • Page 182

    6-30 Firmware User Guide DHCP Rela y Ag ent The Netopia Fir mware V ersion 5.4 of fers DHCP Relay Agent functionality , as defined in RFC1542. A DHCP r elay agent is a computer system or a router that is configur ed to for war d DHCP requests from clients on the LAN to a remote DHCP ser ver , and to pass the r eplies back to the requesting client[...]

  • Page 183

    IP Setup 6-31 Select IP Address Ser ving and pr ess Return. The IP Addr ess Ser ving scr een appears. Select IP Address Ser ving Mode . The pop-up menu of fers the choices of Disabled , DHCP Ser ver (the default), and DHCP Relay Agent . If you select DHCP Relay Agent and press Retur n, the screen changes as shown below . Now you can enter the IP ad[...]

  • Page 184

    6-32 Firmware User Guide Note: The remote DHCP ser ver(s) to which the Netopia Router is relaying DHCP r equests must be capable of ser vicing r elayed requests. Not all DHCP ser vers suppor t this featur e. For example, the DHCP ser ver in the Netopia Router does not . The DHCP ser ver(s) to which the Netopia Router is r elaying DHCP requests must[...]

  • Page 185

    IP Setup 6-33 1. Select Profile Name and enter a name for this connection pr ofile. It can be any name you wish. For example: the name of your ISP . 2. T oggle the Profile Enabled value to Ye s or No . The default is Y es. 3. Select IP Profile Parameters and pr ess Return. The IP Pr ofile Parameters screen appears. 4. T oggle or enter any IP p[...]

  • Page 186

    6-34 Firmware User Guide 5. Select ADD PROFILE NOW and press Retur n. Y our new connection profile will be added. If you want to view the connection profiles in your r outer , retur n to the W AN Configuration screen, and select Display/Change Connection Pr ofile . The list of connection profiles is displayed in a scrolling pop-up screen. Mult[...]

  • Page 187

    IP Setup 6-35 By default, Multicast For war ding is tuned of f (None). Y ou enable the r outer to transmit multicast data by selecting Tx. from the pull-down menu. If you enable Multicast For war ding, you will see a new option IGMP V ersion . This lets you choose V1 or V2. If you know you will be communicating with other hosts that are limited to [...]

  • Page 188

    6-36 Firmware User Guide Typically , you will have a Connection Pr ofile that you created in Easy Setup. Y ou may have more. Select the Connection Profile that you want to use fr om the Display/Change Connection Profile menu, and then select IP Profile Parameters . By default, Multicast For war ding is turned of f (None) on Connection Profiles[...]

  • Page 189

    Line Backup 7-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 7 7 7 7 L L L L ii i i n n n n e e e e B B B B a a a a c c c c k k k k u u u u p p p p The fir mware of fers line backup functionality in the event of a line failure on a DSL, Ether net, or leased-line primar y W AN link. The fir mwar e suppor ts backup ■ to an exter nal mo[...]

  • Page 190

    7-2 Firmware User Guide External Dial Bac kup Suppor t Netopia equipment that suppor ts the exter nal dial backup feature automatically display the serial por t configuration menus described in the following sections. Models that do not suppor t exter nal dial backup do not display external dial backup-r elated menus, but of fer menus for backup t[...]

  • Page 191

    Line Backup 7-3 The Choose Inter face to Configur e screen appears. Choose the inter face to configur e for backup, Serial Por t Setup . The Serial Por t Configuration screen appears. WA N W AN Conf iguration Main Menu Setup WAN Configuration WAN (Wide Area Network) Setup... Display/Change Connection Profile... Add Connection Profile... Delete C[...]

  • Page 192

    7-4 Firmware User Guide ■ The default mode is Console Only . This is the nor mal state for using a ter minal emulation application to manage the router . See “Connecting a Console Cable to your Equipment” on page 1-5 . If you select Modem/Auto from the pull-down menu, the r outer becomes capable of auto detecting the presence of a modem or a [...]

  • Page 193

    Line Backup 7-5 Note: • The modem cable should have a standard DB-9 female connector to connect to the console por t. This is the standard type of modem cable connector . • Macintosh users who use a USB-to-serial adapter to connect to the console serial por t can use a modem in Modem/Auto mode. However , your ter minal emulator software will no[...]

  • Page 194

    7-6 Firmware User Guide backup mode and connect via your modem. Note: Backup and Recover y have r esolutions of five seconds. This is how often the router evaluates the state of the connections and makes decisions. ■ Select Ping Host Name or IP Address and enter an IP address or r esolvable DNS name that the router will ping. This is an optional[...]

  • Page 195

    Line Backup 7-7 Connection Pr ofiles The line backup feature allows you to configur e a complete Connection Profile for the backup por t, just as you do for your primar y W AN connection. In this way pr ofiles are associated with a par ticular inter face. The profile should reflect the por t it is associated with. It should have switched char[...]

  • Page 196

    7-8 Firmware User Guide ■ From the Dial pop-up menu, you can choose whether to Dial Out Only , Dial In Only , or Dial In/Out (default). ■ Y ou can add the Number to Dial and an Alternate Site to Dial , if available. ■ Y ou can toggle Dial on Demand to Y es or No. This allows the router to deter mine whether or not to dial the backup number wh[...]

  • Page 197

    Line Backup 7-9 The Scheduled Connections screen appears. ■ Select Add Scheduled Connection and press Retur n. The Add Scheduled Connection screen appears. ■ T oggle Scheduled Connection Enable to On . ■ From the How Often pop-up menu, select W eekly and pr ess Retur n. ■ From the Schedule Type pop-up menu, accept the default Forced Up and [...]

  • Page 198

    7-10 Firmware User Guide ■ T oggle all the days of the week to Ye s , and set the Scheduled Window Duration Per Day to 24:00 . This guarantees a 24X7 connection. Press Escape to r eturn to the Add Scheduled Connection scr een. ■ Select Use Connection Profile , and press Retur n. A scr een displays all of your Connection Profiles. Select the o[...]

  • Page 199

    Line Backup 7-11 Select Backup Management/Statistics and press Retur n. Note: This option is only visible if backup is not Disabled. The Backup Management/Statistics screen appears. ■ Current Por t is a display-only field that shows which por t is cur rently in operation. ■ Backup State is a display-only field that shows the cur rent state of[...]

  • Page 200

    7-12 Firmware User Guide connection. ■ Switchover Time is a display-only field that is only visible if backup or recover y is in progr ess. It displays the time until either automatic Backup or Recover y . ■ The FORCE BACKUP/FORCE RECOVER Y option is a selectable option that, depending on the cur r ent state of backup, will force the switching[...]

  • Page 201

    Line Backup 7-13 SNMP Suppor t The router suppor ts objects for deter mining the state of backup, as well as pr oviding traps for the backup and recover y events. No objects suppor t configuration of backup or recover y . Bac kup Default Gate way Introduced in version 5.1.2, the fir mwar e of fers backup functionality to an alter nate gateway typ[...]

  • Page 202

    7-14 Firmware User Guide The Backup Configuration screen appears. This screen is used to configur e the conditions under which backup will occur , if it will r ecover , and how the alter nate gateway is configured. ■ Select Backup is and press Retur n. A pop-up menu allows you to select Disabled, Manual, or Automatic. Y ou enable backup by sel[...]

  • Page 203

    Line Backup 7-15 Use this setting with caution. Setting it to Y es may induce alter nating switching between Backup and Recover y Mode. This field will deter mine the r ecover y behavior of a Manual backup and Ping failure backup. These two failures ar e treated as Layer 2 failur es. ■ If you enable Auto-Recover y on loss of Layer 2, the Layer 2[...]

  • Page 204

    7-16 Firmware User Guide Bac kup Management/Statistics If backup is enabled, the Statistics & Logs menu of fers a Backup Management/Statistics option. T o view Backup Management/Statistics, from the Main Menu select Statistics & Logs then Backup Management/Statistics and press Retur n. The Backup Management/Statistics screen appears. ■ Cu[...]

  • Page 205

    Line Backup 7-17 either one and pressing Retur n will for ce the link to switch to the other mode. Quic kView The QuickView screen now has an infor mation element to indicate which gateway is in use. Quick View 1/29/2002 01:05:35 PM Default IP Gateway: 0.0.0.0 CPU Load: 5% Unused Memory: 5582 KB Primary DNS Server: 0.0.0.0 Gateway installed -- Back[...]

  • Page 206

    7-18 Firmware User Guide[...]

  • Page 207

    V oice Configuration 8-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 8 8 8 8 V V V V o o o o ii i i c c c c e e e e C C C C o o o o n n n n f f f f ii i i g g g g u u u u r r r r a a a a t t t t ii i i o o o o n n n n This chapter describes the telephony ser vices and configuration of the Netopia 4700-Series Integrated Access Devices [...]

  • Page 208

    8-2 Firmware User Guide central of fice, but not long distance or local calls. T oll Restriction Operation - PBX/Local Switching Mode: When you pick up the phone, you receive local PBX dial tone. When a 9 (or outside line code) is pressed, the IAD detects the digit and r eturns busy (locally generated). Incoming calls are allowed. Extension calls [...]

  • Page 209

    V oice Configuration 8-3 ■ Select V oice Gateway and fr om the pop-up menu, choose the type of voice gateway device to which you will be connected. The choices are: CopperCom, JetStr eam, T ollBridge, TDSoft, Zhone, or Alcatel. ■ Select Ring Cadence and press Retur n. A pop-up menu allows you to choose between 20Hz (the default), 25Hz, or 50Hz[...]

  • Page 210

    8-4 Firmware User Guide Echo cancellation is set to Y es by default. For ordinar y telephone handsets, echo cancellation should be set to Y es (tur ned on) to eliminate echoes on the voice line. T oggling a por t to No allows you to connect a fax machine or modem to the phone por t (since fax machines and modems automatically cancel echoes). If you[...]

  • Page 211

    Monitoring T ools 9-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 9 9 9 9 M M M M o o o o n n n n ii i i t t t t o o o o r r r r ii i i n n n n g g g g T T T T o o o o o o o o ll l l s s s s This chapter discusses the Router’s device and network monitoring tools. These tools can provide statistical infor mation, repor t on cur r ent n[...]

  • Page 212

    9-2 Firmware User Guide General status Current Date: The cur r ent date; this can be set with the Date and Time utility (see “Date and time” on page 2-42 ). Default IP Gateway: The router’s default gateway , which may be either manually configur ed or lear ned via DHCP . This is the value you assigned in the Default IP Gateway field. If you[...]

  • Page 213

    Monitoring T ools 9-3 Current status The cur rent status section is a table showing the cur r ent status of the DSL connection. For example: Profile Name: Lists the name of the connection pr ofile being used, if any . Rate: Shows the line rate for this connection. %Use: Indicates the average percent utilization of the maximum capacity of the chan[...]

  • Page 214

    9-4 Firmware User Guide Statistics & Logs When you are tr oubleshooting your Router, the Statistics & Logs screens pr ovide insight into the recent event activities of the router . From the Main Menu go to Statistics & Logs and select one of the options described in the sections below . Event Histories The Netopia Fir mware V ersion 5.4[...]

  • Page 215

    Monitoring T ools 9-5 W AN Event History The W AN Event Histor y scr een lists a total of 128 events on the W AN. The most r ecent events appear at the top. Each entr y in the list contains the following infor mation: Date: Date of the event. Time: Time of the event. Event: A brief description of the event. Ch.: The channel involved in the event. T[...]

  • Page 216

    9-6 Firmware User Guide In the Statistics & Logs screen, select Device Event Histor y . The Device Event Histor y scr een appears. If the event histor y exceeds the size of the scr een, you can scroll through it by using SCROLL UP and SCROLL DOWN. T o scroll up, select SCROLL UP at the top of the list and pr ess Return. T o scr oll down, select[...]

  • Page 217

    Monitoring T ools 9-7 IP Routing T ab le The IP routing table displays all of the IP r outes cur rently known to the Router. The routing table scr een repr esents a snapshot of the routing table infor mation at the time the screen is first invoked. T o take a new snapshot, select Update at the bottom of the screen and press Retur n. General Statis[...]

  • Page 218

    9-8 Firmware User Guide Ph ysical Interface The top left side of the screen lists total packets r eceived and total packets transmitted for the following data por ts: ■ Ether net ■ DSL Netw ork Interface The bottom left side of the screen lists total packets r eceived and total packets transmitted: ■ IP (IP packets on the Ether net) The right[...]

  • Page 219

    Monitoring T ools 9-9 System Inf ormation The System Infor mation screen gives a summar y view of the general system level values in the Router. From the Statistics & Logs menu select System Information . The System Infor mation scr een appears. The infor mation display varies by model, fir mware version, featur e set, and so on. Y ou can tell[...]

  • Page 220

    9-10 Firmware User Guide Simple Netw ork Management Pr otocol (SNMP) - V2c The Netopia Fir mware V ersion 5.4 includes a Simple Network Management Pr otocol (SNMP) agent, allowing monitoring and configuration by a standard SNMP manager . Netopia Routers and IADs now suppor t both SNMP-V1 and SNMP-V2c. Enterprise-specific SNMP Changes Enterprise-s[...]

  • Page 221

    Monitoring T ools 9-11 The SNMP Setup screen From the Main Menu, select SNMP in the System Configuration scr een and press Retur n. The SNMP Setup screen appears. Follow these steps to configure the first thr ee items in the screen: 1. Select System Name and enter a descriptive name for the Router’s SNMP agent. 2. Select System Location and en[...]

  • Page 222

    9-12 Firmware User Guide Comm unity strings The Read-Only Community String and the Read/W rite Community String are like passwor ds that must be used by an SNMP manager quer ying or configuring the Netopia Fir mwar e V ersion 5.4. An SNMP manager using the Read-Only Community String can examine statistics and configuration infor mation from the r[...]

  • Page 223

    Monitoring T ools 9-13 T o go to the IP T rap Receivers screen, select IP Trap Receivers . The IP T rap Receivers scr een appears. Setting the IP trap receivers 1. Select Add IP Trap Receiver . 2. Select Receiver IP Address or Domain Name . Enter the IP address or domain name of the SNMP manager you want to receive the trap. 3. Select Community Str[...]

  • Page 224

    9-14 Firmware User Guide[...]

  • Page 225

    Security 10-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 0 0 0 0 S S S S e e e e c c c c u u u u r r r r ii i i t t t t y y y y The Netopia Fir mware V ersion 5.4 pr ovides a number of security features to help pr otect its configuration screens and your local network fr om unauthorized access. Although these features ar e opt[...]

  • Page 226

    10-2 Firmware User Guide Console Tiered Access – T w o P ass wor d Levels Netopia Fir mware V ersion 5.4 of fers tier ed access control for greater security and pr otection against accidental or malicious misconfiguration. Ser vice pr oviders and network administrators can now limit the access of other users to the various configuration screens[...]

  • Page 227

    Security 10-3 For Windows XP users, the automatic discover y featur e places an icon representing the Netopia Gateway automatically in the “My Network Places” folder . Be sure that the Windows XP ser vice Universal Plug and Play Device Host is enabled and r unning, other wise you might not see the icon. Double clicking the icon will launch a te[...]

  • Page 228

    10-4 Firmware User Guide Limited user configuration The Add Access Name/Password and Show/Change Access Name/Passwor ds screens allow you to select which configuration features a limited (non-Super user) user can access. Fr om the Security Options screen, select Add Access Name/Password . The Add Access Name/Passwor d screen appears. ■ Assign a[...]

  • Page 229

    Security 10-5 Y ou can toggle the default user privileges for each user . The defaults are set to minimize the possibility of an individual user inadver tently damaging the W AN connection. Exer cise caution in assigning privileges other than these defaults to limited users. Adv anced Security Options The Advanced Security Options screen allows you[...]

  • Page 230

    10-6 Firmware User Guide ■ Select RADIUS Access Privileges , and from the pull-down menu, choose which access privilege you want this user to have: All , LAN , WA N , or for IADs only , VOX . If you assign any of these privileges, limited users will have full access to privileges associated with these inter faces. Y ou can customize these privile[...]

  • Page 231

    Security 10-7 User access passw or d Users must be able to change their names and passwords, r egardless of other security access r estrictions. If a user does not have security access, then they will only be able to modify the password for their account. When a limited-access user logs into the router . and accesses the System Configuration menus[...]

  • Page 232

    10-8 Firmware User Guide User menu diff erences Menus reflect the security access level of the user . Consequently , configuration menus will display dif fering options based upon the parameters a par ticular user is allowed to change. Some dif ferences include: ■ Limited users (non-Super users) do not have access to Easy Setup. ■ All users h[...]

  • Page 233

    Security 10-9 Based on access level, the Main Menu displays its configuration options according to the following diagram: W AN Configuration screens If a limited user is allowed W AN, Connection Pr ofile, or PVC configuration access, the W AN Configuration option in the Main Menu is visible. If a limited user selects W AN Configuration in the[...]

  • Page 234

    10-10 Firmware User Guide Connection Pr ofiles The Super user can disallow limited user access to a par ticular Connection Pr ofile. When adding a Connection Profile in the Add Connection Pr ofile screen the Super user can toggle the Superuser Accessible Only option to Ye s or No . This option is visible whether or not there ar e authorized use[...]

  • Page 235

    Security 10-11 System Configuration menu The System Configuration menu is always available to all users. Based on access level, the System Configuration menu displays its configuration options according to the following diagram: Note: Network Address Translation (NA T) is displayed in this scr een in order to make access control simpler . Secur[...]

  • Page 236

    10-12 Firmware User Guide Utilities & Diagnostics men u Based on access level, the Utilities & Diagnostics menu displays its configuration options according to the following diagram: X-Modem File T ransfer men u Based on access level, the X-Modem File T ransfer menu displays its configuration options according to the following diagram: St[...]

  • Page 237

    Security 10-13 Based on access level, the Statistics & Logs menu displays its options according to the following diagram: Statistics & Logs WAN Event History... Device Event History... Voice Log... Voice Accounting Log... Voice Error Log... IP Routing Table... Served IP Addresses... Served IP Addresses... Accounting Statistics... Backup Man[...]

  • Page 238

    10-14 Firmware User Guide Quic k Menus Quick Menus var y considerably between models, featur es, and access levels. The following is an example comparison of the Quick Menu as seen by the Super user and by a Limited user . Note: Console Configuration is always visible. A TM Cir cuits Configuration menu Y ou select A TM Cir cuits Configuration fr[...]

  • Page 239

    Security 10-15 The A TM Cir cuits Configuration menu screen appears as follows: Note: Multiple A TM cir cuit configuration is suppor ted on multiple A TM-capable routers. Although some of the parameters of the Circuit Configuration scr eens per tain to V oice and Connection Pr ofiles, it is assumed that if the user has been granted PVC configu[...]

  • Page 240

    10-16 Firmware User Guide Pr otecting the Security Options screen The first screen you should pr otect is the Security Options screen, because it contr ols access to the configuration screens. Access to the Security Options scr een can be protected with a passwor d. Select Password for This Scr een in the Security Options screen and enter a passw[...]

  • Page 241

    Security 10-17 T o add a new user account, select Add User in the Security Options screen and press Retur n. The Add Name With Write Access screen appears. Follow these steps to configure the new account: 1. Select Enter Name and enter a descriptive name (for example, the user’s first name). 2. Select Enter Password and enter a passwor d. 3. T [...]

  • Page 242

    10-18 Firmware User Guide T o restrict T elnet access, select Security in the Advanced Configuration menu. The Security Options screen will appear . There ar e two levels of T elnet r estriction available: ■ T o restrict T elnet access to the SNMP scr eens, select Enable T elnet Access to SNMP Scr eens and toggle it to No . (See “SNMP traps”[...]

  • Page 243

    Security 10-19 Each inspector has a specific task. One inspector’s task may be to examine the destination address of all outgoing packages. That inspector looks for a cer tain destination—which could be as specific as a street address or as br oad as an entire countr y—and checks each package’s destination addr ess to see if it matches th[...]

  • Page 244

    10-20 Firmware User Guide If the package does not match the first inspector’s criteria, it goes to the second inspector , and so on. Y ou can see that the order of the inspectors in the line is ver y impor tant. For example, let’s say the first inspector’s orders ar e to send along all packages that come from Rome, and the second inspector?[...]

  • Page 245

    Security 10-21 P ar ts of a filter A filter consists of criteria based on packet attributes. A typical filter can match a packet on any one of the following attributes: ■ The source IP addr ess (where the packet was sent fr om) ■ The destination IP address (wher e the packet is going) ■ The type of higher-layer Inter net protocol the packe[...]

  • Page 246

    10-22 Firmware User Guide P ort number comparisons A filter can also use a comparison option to evaluate a packet’s source or destination por t number . The comparison options are: No Compare: No comparison of the por t number specified in the filter with the packet’s por t number . Not Equal T o: For the filter to match, the packet’s por[...]

  • Page 247

    Security 10-23 Putting the par ts together When you display a filter set, its filters are displayed as r ows in a table: The table’s columns cor respond to each filter’s attributes: #: The filter’s priority in the set. Filter number 1, with the highest priority , is first in the table. Source IP Addr: The packet sour ce IP address to mat[...]

  • Page 248

    10-24 Firmware User Guide Filtering example #1 Retur ning to our filtering r ule example from above (see page 10-20 ), look at how a r ule is translated into a filter . Star t with the r ule, then fill in the filter’s attributes: 1. The r ule you want to implement as a filter is: Block all T elnet attempts that originate from the r emote hos[...]

  • Page 249

    Security 10-25 This filter blocks any packets coming from a r emote network with the IP network address 200.233.14.0. The 0 at the end of the address signifies any host on the class C IP network 200.233.14.0. If, for example, the filter is applied to a packet with the source IP addr ess 200.233.14.5, it will block it. In this case, the mask, whi[...]

  • Page 250

    10-26 Firmware User Guide An appr oach to using filters The ultimate goal of network security is to prevent unauthorized access to the network without compr omising authorized access. Using filter sets is par t of reaching that goal. Each filter set you design will be based on one of the following approaches: ■ That which is not expressly pr o[...]

  • Page 251

    Security 10-27 3. View , change, or delete individual filters and filter sets. The sections below explain how to execute these steps. Adding a filter set Y ou can create up to eight dif ferent custom filter sets. Each filter set can contain up to 16 output filters and up to 16 input filters. T o add a new filter set, select Add Filter Set i[...]

  • Page 252

    10-28 Firmware User Guide Adding filter s to a filter set There ar e two kinds of filters you can add to a filter set: input and output. Input filters check packets received from the Inter net, destined for your network. Output filters check packets transmitted from your network to the Inter net. Packets in the Netopia Firmware V ersion 5.4 p[...]

  • Page 253

    Security 10-29 Note: There ar e two groups of items in this scr een, one for input filters and one for output filters. In this section, you’ll lear n how to add an input filter to a filter set. Adding an output filter works exactly the same way , providing you keep the dif ferent sour ce and destination perspectives in mind. 1. T o add a fi[...]

  • Page 254

    10-30 Firmware User Guide 3. If you want the filter to for war d packets that match its criteria to the destination IP address, select For ward and toggle it to Ye s . If For war d is toggled to No , packets matching the filter’s criteria will be discarded. 4. Select Source IP Address and enter the sour ce IP address this filter will match on.[...]

  • Page 255

    Security 10-31 Deleting filters T o delete a filter , select Delete Input Filter or Delete Output Filter in the Display/Change Filter Set screen to display a table of filters. Select the filter from the table and pr ess Return to delete it. Pr ess Escape to exit the table without deleting the filter . Mo ving filters T o reor ganize the filt[...]

  • Page 256

    10-32 Firmware User Guide Basic Firewall blocks undesirable traf fic originating from the WAN (in most cases, the Internet), but for war ds all traf fic originating fr om the LAN. It follows the conser vative “that which is not expressly per mitted is pr ohibited” approach: unless an incoming packet expr essly matches one of the constituent i[...]

  • Page 257

    Security 10-33 Output filter 1: This filter for war ds all outgoing traf fic to make sure that no outgoing connections fr om the LAN are blocked. Basic Firewall is suitable for a LAN containing only client hosts that want to access ser vers on the W AN, but not for a LAN containing ser vers pr oviding ser vices to clients on the W AN. Basic Fir [...]

  • Page 258

    10-34 Firmware User Guide FTP sessions. T o allow W AN-originated FTP sessions to a LAN-based FTP ser ver with the IP addr ess a.b.c.d (cor responding to a number ed IP address such as 163.176.8.243), inser t the following input filter ahead of the cur rent input filter 1: ■ Enabled: Y es ■ For war d: Y es ■ Source IP Addr ess: 0.0.0.0 ■ [...]

  • Page 259

    Security 10-35 The new filterset screen appears as follows: T o use the policy-based routing featur e, you create a filter that for war ds the traf fic. ■ T oggle For ward to Ye s . This will display the For ce Routing options. ■ T oggle Force Routing to Ye s . ■ Enter the Gateway IP Address in standar d dotted-quad notation to which the t[...]

  • Page 260

    10-36 Firmware User Guide Note: Default For war ding Filter If you create one or mor e filters that have a matching action of for war d , then action on a packet matching none of the filters is to block any traf fic. Therefor e, if the behavior you want is to force the r outing of a cer tain type of packet and pass all others through the nor mal[...]

  • Page 261

    Security 10-37 Fire wall T utorial General firewall terms Filter rule : A filter set is comprised of individual filter r ules. Filter set : A grouping of individual filter r ules. Firewall : A component or set of components that r estrict access between a protected network and the Inter net, or between two networks. Host : A workstation on the [...]

  • Page 262

    10-38 Firmware User Guide Example TCP/UDP P or ts Firewall design rules There ar e two basic r ules to firewall design: ■ “What is not explicitly allowed is denied.” and ■ “What is not explicitly denied is allowed.” The first r ule is far more secur e, and is the best approach to fir ewall design. It is far easier (and more secur e) [...]

  • Page 263

    Security 10-39 and a packet goes through these r ules destined for FTP , the packet would for ward thr ough the first filter r ule (WWW), match the second r ule (FTP), and the packet is allowed through. Even though the next r ule is to deny all FTP traf fic, the FTP packet will never make it to this r ule. Binary representation It is easiest whe[...]

  • Page 264

    10-40 Firmware User Guide Established connections The TCP header contains one bit called the ACK bit (or TCP Ack bit). This ACK bit appears only with TCP , not UDP . The ACK bit is par t of the TCP mechanism that guarantees the deliver y of data. The ACK bit is set whenever one side of a connection has received data fr om the other side. Only the ?[...]

  • Page 265

    Security 10-41 Example netw ork Example filters Example 1 Incoming packet has the source addr ess of 200.1.1.28 Less Than or Equal Any por t less than or equal to the por t defined Equal Matches only the por t defined Greater Than or Equal Matches the por t or any por t gr eater Greater Than Matches anything gr eater than the por t defined Filt[...]

  • Page 266

    10-42 Firmware User Guide This incoming IP packet has a source IP addr ess that matches the network address in the Sour ce IP Address field (00000000) in the Netopia Fir mware V ersion 5.4. This will not for war d this packet. Example 2 Incoming packet has the source addr ess of 200.1.1.184. This incoming IP packet (10000000) has a source IP addr [...]

  • Page 267

    Security 10-43 Since the Source IP Network Addr ess in the Router is 01100000, and the source IP addr ess after the logical AND is 1011000, this r ule does not match and this packet will be for war ded. Example 4 Incoming packet has the source addr ess of 200.1.1.104. Since the Source IP Network Addr ess in the Router is 01100000, and the source IP[...]

  • Page 268

    10-44 Firmware User Guide Since the Source IP Network Addr ess in the Router is 01100000, and the source IP addr ess after the logical AND is 01100000, this r ule does match and this packet will not be for war ded. This r ule masks of f a single IP address. Configuration Management Netopia Fir mware V ersion 5.4 of fers a Configuration Management[...]

  • Page 269

    Security 10-45 Select Save Current Configuration as , and press Retur n. The Save Cur rent Configuration scr een appears. Enter a descriptive name for your cur rent configuration, select SA VE , and press Retur n. Y our configuration will be saved to the flash memor y , and you will be r eturned to the Configuration Management scr een. If you[...]

  • Page 270

    10-46 Firmware User Guide A war ning screen will ask you to confir m your choice. Configuration Management Save Current Configuration as... +-Configuration Name---Type---+ Replace Existing Configuration... +-----------------------------+ Boot from a Configuration... | Backup Config Binary | Delete a Configuration... | HappyInternet Binary | | | +-[...]

  • Page 271

    Security 10-47 TFTP and X-Modem Y ou can also send or receive your stor ed configuration files via TFTP or X-Modem. Y ou select the stored configuration files from pull-down menus in the TFTP or X-Modem File T ransfer scr eens in the Utilities & Diagnostics menu, as shown. Trivial File Transfer Protocol (TFTP) TFTP Server Name: Firmware Fil[...]

  • Page 272

    10-48 Firmware User Guide Call Filtering Netopia Fir mware V ersion 5.4 suppor ts a call filtering mechanism that lets you control which packets cause connections to be established and which packets cause connections to be maintained (that is, to not time out due to inactivity). This feature is par t of the Filter Set management component of the ?[...]

  • Page 273

    Security 10-49 This pop-up menu allows you to configure what action will be taken for packets that the filter r ule specifies should be for war ded. ■ If you set Call Placement/Idle Reset to No Change (the default), no change will be made to the call filtering attribute associated with the packet. If no other filter r ule with its Call Place[...]

  • Page 274

    10-50 Firmware User Guide[...]

  • Page 275

    Utilities and Diagnostics 11-1 C C C C h h h h a a a a p p p p t t t t e e e e r r r r 1 1 1 1 1 1 1 1 U U U U t t t t ii i i ll l l ii i i t t t t ii i i e e e e s s s s a a a a n n n n d d d d D D D D ii i i a a a a g g g g n n n n o o o o s s s s t t t t ii i i c c c c s s s s A number of utilities and tests are available for system diagnostic a[...]

  • Page 276

    11-2 Firmware User Guide Ping The Netopia Fir mware V ersion 5.4 Router includes a standar d Ping test utility . A Ping test generates IP packets destined for a par ticular (Ping-capable) IP host. Each time the tar get host r eceives a Ping packet, it retur ns a packet to the original sender . Ping allows you to see whether a par ticular IP destina[...]

  • Page 277

    Utilities and Diagnostics 11-3 Status: The cur rent status of the Ping test. This item can display the status messages shown in the able below: Packets Out: The number of packets sent by the Ping test. Packets In: The number of retur n packets received fr om the tar get host. T o be considered on time, r eturn packets are expected back befor e the [...]

  • Page 278

    11-4 Firmware User Guide Packets Lost: The number of packets unaccounted for , shown in total and as a percentage of total packets sent. This statistic may be updated during the Ping test, and may not be accurate until after the test is over . However , if an escalating one-to-one cor respondence is seen between Packets Out and Packets Lost , and P[...]

  • Page 279

    Utilities and Diagnostics 11-5 3. Select Timeout (seconds) to set when the trace will timeout for each hop, up to 10 seconds. The default is 3 seconds. 4. Select Use Reverse DNS to learn the names of the r outers between the Netopia Router and the destination router . The default is Y es. 5. Select ST AR T TRACE ROUTE and press Retur n. A scrolling[...]

  • Page 280

    11-6 Firmware User Guide menu and press Retur n. ■ T o end a suspended session, select T er minate Suspended Session . Select a session from the pop-up menu and press Retur n. F actor y Defaults Y ou can reset the Router to its factor y default settings. In the Utilities & Diagnostics screen, select Rever t to Factor y Defaults and press Retu[...]

  • Page 281

    Utilities and Diagnostics 11-7 The sections below describe how to update the Router’s fir mware and how to download and upload configuration files. Updating firmware Fir mware updates may be available periodically fr om Netopia or from a site maintained by your or ganization’s network administrator . The Router ships with an embedded operat[...]

  • Page 282

    11-8 Firmware User Guide ■ Select GET ROUTER FIRMW ARE FROM SERVER and press Retur n. Y ou will see the following dialog box: ■ Select CANCEL to exit without downloading the file, or select CONTINUE to download the file. The system will reset at the end of the file transfer to put the new fir mwar e into ef fect. While the system r esets, t[...]

  • Page 283

    Utilities and Diagnostics 11-9 ■ If you choose to download the configuration file, the TFTP T ransfer State item will change fr om Idle to Reading Config . The TFTP Current Transfer Bytes item will reflect the number of bytes transfer red. Uploading configuration files Using TFTP , you can send a file containing a snapshot of the router’[...]

  • Page 284

    11-10 Firmware User Guide Updating firmware Fir mware updates may be available periodically fr om Netopia or from a site maintained by your or ganization’s network administration. Follow these steps to update the Router’s fir mware: 1. Make sure you have the fir mwar e file on disk and know the path to its location. 2. Select Send Firmwar e[...]

  • Page 285

    Utilities and Diagnostics 11-11 Caution! Do not manually power down or reset the Router while it is automatically r esetting or it could be damaged. Downloading configuration files The Router can be configured by downloading a configuration file. The downloaded file r econfigures all of the Router’s parameters. Configuration files are av[...]

  • Page 286

    11-12 Firmware User Guide 3. Select CANCEL to exit without uploading the file, or select CONTINUE to upload the file. If you choose CONTINUE, you will have ten seconds to use your ter minal emulation software to initiate an XMODEM transfer of the configuration file. If you fail to initiate the transfer in that time, the dialog box will disappea[...]

  • Page 287

    Utilities and Diagnostics 11-13 Select T1 Line Statistics / Diagnostics and press Retur n. The T1 Line Statistics / Diagnostics screen appears. The screen displays the cur r ent condition of tests that you r un. The counters display the occur rences of the indicated events in fifteen-minute increments, shifting the totals to the column to the righ[...]

  • Page 288

    11-14 Firmware User Guide 24 hours: Cumulative statistics, for the preceding 24-hour period. Line Status: Conditions may be Nor mal Operation, Red Alar m, Y ellow Alar m, or (Rmt/Lcl) LoopBack Loopback Status: Cur rent loopback condition T ests: Of fers a pop-up menu with the following options: ■ Normal - Clear Loopback clears any local loopbacks[...]

  • Page 289

    T roubleshooting A-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x A A A A T T T T r r r r o o o o u u u u b b b b ll l l e e e e s s s s h h h h o o o o o o o o t t t t ii i i n n n n g g g g This appendix is intended to help you troubleshoot pr oblems you may encounter while setting up and using the Netopia Fir mware V ersion 5.4[...]

  • Page 290

    A-2 Firmware User Guide Note: If you are attempting to modify the IP addr ess or subnet mask from a pr evious, successful configuration attempt, you will need to clear the IP address or r eset your Router to the factor y default before reinitiating the configuration pr ocess. For fur ther infor mation on resetting your Router to factor y default,[...]

  • Page 291

    T roubleshooting A-3 Ho w to Reset the Router to F actor y Defaults Lose your password? This section shows how to r eset the router so that you can access the console scr eens once again. Keep in mind that all of your connection profiles and settings will need to be r econfigured. If you don't have a password, the only way to get back into t[...]

  • Page 292

    A-4 Firmware User Guide Technical Support Netopia, Inc. is committed to providing its customers with r eliable products and documentation, backed by excellent technical suppor t. Bef ore contacting Netopia Look in this guide for a solution to your problem. Y ou may find a solution in this tr oubleshooting appendix or in other sections. Check the i[...]

  • Page 293

    Understanding IP Addressing B-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x B B B B U U U U n n n n d d d d e e e e r r r r s s s s t t t t a a a a n n n n d d d d ii i i n n n n g g g g II I I P P P P A A A A d d d d d d d d r r r r e e e e s s s s s s s s ii i i n n n n g g g g This appendix is a brief general introduction to I[...]

  • Page 294

    B-2 Firmware User Guide IP addresses indicate both the identity of the network and the identity of the individual host on the network. The number of bits used for the network number and the number of bits used for the host number can var y , as long as cer tain r ules ar e followed. The local network manager assigns IP host numbers to individual ma[...]

  • Page 295

    Understanding IP Addressing B-3 Subnet numbers appear within IP addresses, along with network numbers and host numbers. Since an IP address is always 32 bits long, using subnet numbers means either the network number or the host numbers must use fewer bits in order to leave r oom for the subnet numbers. Since the InterNIC assigns the network number[...]

  • Page 296

    B-4 Firmware User Guide Netw ork configuration Below is a diagram of a simple network configuration. The ISP is providing a Class C addr ess to the customer site, and both networks A and B want to gain Inter net access through this address. Router B connects to Router A and is provided Inter net access through Routers A and B. Router A: IP Addres[...]

  • Page 297

    Understanding IP Addressing B-5 Bac kground The IP addresses and r outing configurations for the devices shown in the diagram are outlined below . In addition, each individual field and its meaning are described. The IP Address and Subnet Mask fields define the IP addr ess and subnet mask of the device's Ethernet connection to the network [...]

  • Page 298

    B-6 Firmware User Guide There ar e two schemes for distributing the remaining IP addr esses: ■ Manually give each computer an address ■ Let the Router automatically distribute the addresses These two methods are not mutually exclusive; you can manually issue some of the addr esses while the rest are distributed by the Router. Using the r outer [...]

  • Page 299

    Understanding IP Addressing B-7 Configuration This section describes the specific IP address lease, r enew , and release mechanisms for both the Mac and PC, with either DHCP or MacIP address ser ving. DHCP address serving Windows 95 workstation: ■ The Win95 workstation requests and r enews its lease ever y half hour . ■ The Win95 workstation [...]

  • Page 300

    B-8 Firmware User Guide ■ The Router releases the DHCP addr ess back to the available DHCP address pool exactly one hour after the last-heard lease r equest. Some other DHCP implementations may hold on to the lease for an additional time after the lease expired to act as a buf fer for variances in clocks between the client and ser ver . MacIP ser[...]

  • Page 301

    Understanding IP Addressing B-9 In any situation where a device is dialing into a Netopia r outer , the router may need to be configured to ser ve IP via the W AN inter face. This is only a requir ement if the calling device has not been configured locally to know what its address(es) ar e. So when a client, dialing into a Netopia router's W[...]

  • Page 302

    B-10 Firmware User Guide The figure above shows an example of a block of IP addr esses being distributed cor rectly . The example follows these r ules: ■ An IP address must not be used as a static addr ess if it is also in a range of addresses being distributed by DHCP or MacIP . ■ A single IP address range is used by all the addr ess-ser ved [...]

  • Page 303

    Understanding IP Addressing B-11 Nested IP Subnets Under cer tain cir cumstances, you may want to create remote subnets fr om the limited number of IP addresses issued by your ISP or other authority . Y ou can do this using connection pr ofiles. These subnets can be nested within the range of IP addresses available to your network. For example, su[...]

  • Page 304

    B-12 Firmware User Guide Routers B and C (which could also be Routers) ser ve the two r emote networks that are subnets of a.b.c.0. The subnetting is accomplished by configuring the Router with connection profiles for Routers B and C (see the following table). The Router’s connection profiles for Routers B and C cr eate entries in its IP routi[...]

  • Page 305

    Understanding IP Addressing B-13 Let’s see how a packet from the Inter net gets routed to the host with IP addr ess a.b.c.249, which is ser ved by Router C. The packet first ar rives at Router A, which delivers it to its local network (a.b.c.0). The packet is then received by the Router, which examines its destination IP addr ess. The Router com[...]

  • Page 306

    B-14 Firmware User Guide The following diagram illustrates the IP address space taken up by the two r emote IP subnets. Y ou can see from the diagram why the ter m nested is appropriate for describing these subnets. Br oadcasts As mentioned earlier , binar y IP host or subnet addresses composed entir ely of ones or zeros ar e reser ved for broadcas[...]

  • Page 307

    Binary Conversion T able C-1 A A A A p p p p p p p p e e e e n n n n d d d d ii i i x x x x C C C C B B B B ii i i n n n n a a a a r r r r y y y y C C C C o o o o n n n n v v v v e e e e r r r r s s s s ii i i o o o o n n n n T T T T a a a a b b b b ll l l e e e e This table is provided to help you choose subnet numbers and host numbers for IP and [...]

  • Page 308

    C-2 Firmware User Guide Decimal Binar y Decimal Binar y Decimal Binary Decimal Binar y 128 10000000 160 10100000 192 11000000 224 11100000 129 10000001 161 10100001 193 11000001 225 11100001 130 10000010 162 10100010 194 11000010 226 11100010 131 10000011 163 10100011 195 11000011 227 11100011 132 10000100 164 10100100 196 11000100 228 11100100 133[...]

  • Page 309

    Index-1 II I I n n n n d d d d e e e e x x x x A add static route 6-8 ADSL Line Configuration 2-2 advanced configuration features 2-35 ATMP 4-10 tunnel options 4-8 B backup default gateway 7-13 backup, line 7-1 basic firewall 10-32 BootP 6-17 clients 6-23 broadcasts B-14 C change static route 6-9 community strings 9-12 configuration troubleshooting[...]

  • Page 310

    Index-2 11 with TFTP 11-8 with XMODEM 11-11 Dynamic Host Configuration Protocol (DHCP) 6-17 Dynamic Host Configuration Protocol, see DHCP Dynamic WAN 6-17 E Easy Setup navigating 1-7 encryption 4-3 , 4-7 , 4-10 , 5-1 event history device 9-5 WAN 9-5 Exposed Addresses 2-40 F filter parts 10-21 parts of 10-21 filter priority 10-19 filter set adding 1[...]

  • Page 311

    Index-3 static B-8 IP passthrough 3-27 IP setup 6-2 IP trap receivers deleting 9-13 modifying 9-13 setting 9-13 viewing 9-13 IPsec 4-3 , 4-7 , 5-1 L latency 10-35 LED status 9-3 LEDs 9-3 line backup 7-1 backup IP gateway 7-15 connection profiles 7-7 management and statistics 7-10 , 7- 16 scheduled connections 7-8 WAN configuration 7-2 , 7-3 M MIBs [...]

  • Page 312

    Index-4 port number comparisons 10-22 port numbers 10-21 PPTP 4-10 tunnel options 4-4 PVC 2-16 Q quality of service 10-35 Quick View 9-1 R restarting the system 11-12 restricting telnet access 10-17 RFC-1483 Transparent Bridging 2-44 RIP-2 MD5 Authentication 6-10 router to serve IP addresses to hosts 6- 1 routing tables IP 6-6 , 9-7 S scheduled con[...]

  • Page 313

    Index-5 defined 11-6 downloading configuration files 11-8 updating firmware 11-7 uploading configuration files 11-9 TFTP, transferring files 11-6 tiered access 10-2 TOS bit 10-35 Trivial File Transfer Protocol (TFTP) 11-6 Trivial File Transfer Protocol, see TFTP troubleshooting A-1 configuration PC A-1 event histories 9-4 trusted host 10-33 trusted[...]

  • Page 314

    Index-6[...]