Netopia Network Router 4000 Series User Manual

Netopia Firmware User Guide

Netopia 4000-Series Equipment

Netopia Firmware Version 5.4

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

iii

Contents

Chapter 1 — Introduction..........................................................1-1

What’s New in Netopia Firmware Version 5.4 ................... 1-1

Console-based Management........................................... 1-2

Netopia Console Menus ................................................. 1-2

Netopia Models ............................................................. 1-3

Screen differences .............................................. 1-3

Connecting through a Telnet Session............................... 1-4

Conﬁguring Telnet software................................... 1-4

Connecting a Console Cable to your Equipment................ 1-5

Navigating through the Console Screens.......................... 1-7

Chapter 2 — WAN and System Conﬁguration .............................2 -1

WAN Conﬁguration ......................................................... 2-1

ADSL Line Conﬁguration screen ............................ 2-2

SDSL/IDSL Conﬁguration screen........................... 2-3

G.SHDSL Line Conﬁguration screen....................... 2-6

T1 Line Conﬁguration screen ................................ 2-7

Frame Relay Conﬁguratio n .............................................. 2-9

Frame Relay DLCI conﬁguration........................... 2-11

Multiple ATM Permanent Virtual Circuit s ........................ 2-16

Multiple ATM PVC ove r v ie w ................................. 2-16

Multiple ATM PVC conﬁguratio n ........................... 2-16

Editing circuits................................................... 2-20

Changing a circui t .............................................. 2-21

Monitoring multiple virtual circuits....................... 2-22

Creating a New Connection Proﬁle................................. 2-24

The Default Proﬁle ....................................................... 2-28

IP parameters (default proﬁle) screen.................. 2-29

Scheduled Connections................................................ 2-29

Viewing scheduled connections........................... 2-30

Adding a scheduled connection........................... 2-31

Set Weekly Schedule.......................................... 2-32

Set Once-Only Schedule ..................................... 2-33

Download from Www.Somanuals.com. All Manuals Search And Download.

Firmware User Guide

Modifying a scheduled connection....................... 2-34

Deleting a scheduled connection......................... 2-34

System Conﬁguration Screens ...................................... 2-35

System conﬁguration features............................. 2-35

IP Setu p ............................................................ 2-36

Filter Sets ......................................................... 2-36

IP Address Serving............................................. 2-36

Network Address Translation (NAT )...................... 2-36

Stateful Inspection ﬁrewall ................................. 2-37

Date and time ................................................... 2-42

Console Conﬁguration ........................................ 2-43

SNMP (Simple Network Management Protocol)..... 2-43

Security............................................................. 2-43

Upgrade Feature Set .......................................... 2-43

RFC-1483 Transparent Bridging........................... 2-44

Logging............................................................. 2-46

Chapter 3 — Multiple Network Address Translation ...................3-1

Overview....................................................................... 3-1

Features ............................................................. 3-2

Supported trafﬁc ................................................. 3-5

Support for Microsoft Network (MSN) Messenge r ... 3-5

Support for AOL Instant Messenger (AIM)

File Transfer ........................................................ 3-5

MultiNAT Conﬁguration ................................................... 3-6

Easy Setup Proﬁle conﬁguratio n ............................ 3-6

Se r v er Lists and Dynamic NAT conﬁguration........... 3-7

IP setup .............................................................. 3-7

Modifying map lists............................................ 3-13

Adding Server Lists...................................................... 3-15

Modifying server lists......................................... 3-18

Deleting a server ............................................... 3-20

Binding Map Lists and Server Lists............................... 3-21

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

IP proﬁle parameters.......................................... 3-21

IP Parameters (WAN Default Proﬁle) .................... 3-23

NAT Associations......................................................... 3-25

IP Passthrough ............................................................ 3-27

MultiNAT Conﬁguration Example.................................... 3-31

Chapter 4 — Virtual Private Networks (VPNs)............................4-1

Ove r v ie w ....................................................................... 4-1

About PPTP Tunnels ....................................................... 4-4

PPTP conﬁguration ............................................... 4-4

About IPsec Tunnels....................................................... 4-7

About ATMP Tunnels....................................................... 4-8

ATMP conﬁguration .............................................. 4-8

Enc r y ption Suppor t ...................................................... 4-10

MS-CHAP V2 and 128-bit strong encryption ......... 4-11

ATMP/PPTP Default Proﬁle............................................ 4-11

VPN QuickView ............................................................ 4-13

Dial-Up Networking for VP N ........................................... 4-14

Installing Dial-Up Networking............................... 4-14

Creating a new Dial-Up Networking proﬁl e ............ 4-15

Conﬁguring a Dial-Up Networking proﬁl e ............... 4-16

Installing the VPN Clien t ............................................... 4-17

Windows 95 VPN installation .............................. 4-17

Windows 98 VPN installation .............................. 4-18

Connecting using Dial-Up Networking................... 4-19

Allowing VPNs through a Firewall................................... 4-19

PPTP example.................................................... 4-20

ATMP exampl e ................................................... 4-22

Windows Networking Broadcasts................................... 4-25

Chapter 5 — Internet Key Exchange (IKE) IPsec

Key Management for VPNs ...................................5-1

Overview....................................................................... 5-1

Internet Key Exchange (IKE) Conﬁguration........................ 5-2

Download from Www.Somanuals.com. All Manuals Search And Download.

Firmware User Guide

Adding an IKE Phase 1 Proﬁl e ............................... 5-4

Changing an IKE Phase 1 Proﬁle ........................... 5-8

Key Management........................................................... 5-9

IPsec WAN Conﬁguration Screens ................................. 5-18

IPsec Manual Key Entry................................................ 5-19

VPN Quickview................................................... 5-20

WAN Event History Error Reporting...................... 5-21

Chapter 6 — IP Setu p ...............................................................6-1

IP Setup........................................................................ 6-2

IP subnets........................................................... 6-4

Static routes ....................................................... 6-6

RIP-2 MD5 Authentication............................................. 6-10

Ove r v ie w ........................................................... 6-10

Authentication conﬁguration................................ 6-10

Connection Proﬁles and Default Proﬁl e ................ 6-16

IP Address Serving ...................................................... 6-17

IP Address Pools................................................ 6-20

DHCP NetBIOS Options ...................................... 6-22

More Address Serving Options...................................... 6-24

Conﬁguring the IP Address Server options ........... 6-25

DHCP Relay Agent........................................................ 6-30

Connection Proﬁles...................................................... 6-32

Multicast Forwarding.................................................... 6-34

Chapter 7 — Line Backup .........................................................7-1

External Dial Backup Support ......................................... 7-2

Conﬁguring External Dial Backu p ..................................... 7-2

WAN Conﬁguration ......................................................... 7-2

Backup Conﬁguration screen ................................ 7-5

Connection Proﬁles........................................................ 7-7

Using Scheduled Connections with Backup...................... 7-8

Management/Statistics................................................ 7-10

QuickView ................................................................... 7-12

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

vii

Event Logs .................................................................. 7-12

SNMP Support ............................................................ 7-13

Backup Default Gateway............................................... 7-13

Backup Conﬁguration screen .............................. 7-13

IP Setup screen................................................. 7-15

Backup Management/Statistics.......................... 7-16

QuickView ......................................................... 7-17

Chapter 8 — Voice Conﬁguration...............................................8-1

Introduction................................................................... 8-1

Explanation of terms............................................ 8-1

Conﬁguring the Voice Features........................................ 8-2

Chapter 9 — Monitoring Tool s ...................................................9 -1

Quick View Status Ove r v iew............................................ 9-1

General status..................................................... 9-2

Current statu s ..................................................... 9-3

Status lights........................................................ 9-3

Statistics & Logs ........................................................... 9-4

Event Historie s .............................................................. 9-4

IP Routing Table............................................................. 9-7

General Statistic s .......................................................... 9-7

System Information........................................................ 9-9

Simple Network Management Protocol (SNMP) - V2c ...... 9-10

Enterprise-speciﬁc SNMP Changes...................... 9-10

The SNMP Setup screen..................................... 9-11

SNMP traps....................................................... 9-12

Chapter 10 — Security ...........................................................10-1

Suggested Security Measures....................................... 10-1

Console Tiered Access – Two Password Levels .............. 10-2

UPnP Support.................................................... 10-2

Superuser conﬁguration ..................................... 10-3

Limited user conﬁguration .................................. 10-4

Download from Www.Somanuals.com. All Manuals Search And Download.

viii

Firmware User Guide

Advanced Security Options ................................. 10-5

User access password ....................................... 10-7

User menu differences....................................... 10-8

User Account s ........................................................... 10-15

Telnet Acces s ............................................................ 10-17

About Filters and Filter Sets........................................ 10-18

What’s a ﬁlter and what’s a ﬁlter set? ............... 10-18

How ﬁlter sets work ......................................... 10-18

How individual ﬁlters work ................................ 10-20

Design guidelines ............................................ 10-25

Working with IP Filters and Filter Set s .......................... 10-26

Adding a ﬁlter set............................................. 10-27

Deleting a ﬁlter set .......................................... 10-31

A sample ﬁlter set............................................ 10-31

Policy-based Routing using Filterset s ........................... 10-34

TOS ﬁeld matchin g ........................................... 10-35

Firewall Tutorial ......................................................... 10-37

General ﬁrewall terms ...................................... 10-37

Basic IP packet components............................. 10-37

Basic protocol types......................................... 10-37

Firewall design rules ........................................ 10-38

Filter basics..................................................... 10-40

Example ﬁlters................................................. 10-41

Conﬁguration Management......................................... 10-44

TFTP and X-Modem........................................... 10-47

Call Filtering .............................................................. 10-48

Chapter 11 — Utilities and Diagnostic s ...................................11-1

Ping............................................................................ 11-2

Trace Route................................................................. 11-4

Telnet Client................................................................ 11-5

Factory Defaults .......................................................... 11-6

Transferring Conﬁguration and Firmware Files with TFTP.. 11-6

Download from Www.Somanuals.com. All Manuals Search And Download.

Contents

Updating ﬁrmware.............................................. 11-7

Downloading conﬁguration ﬁle s ........................... 11-8

Uploading conﬁguration ﬁle s ............................... 11-9

Transferring Conﬁguration and Firmware Files

with XMODEM.............................................................. 11-9

Updating ﬁrmware............................................ 11-10

Downloading conﬁguration ﬁles......................... 11-11

Uploading conﬁguration ﬁles............................. 11-11

Restarting the System ............................................... 11-12

T1 Line Statistics and Diagnostics .............................. 11-12

Appendix A — Troubleshooting..................................................A-1

Conﬁguration Problems .................................................. A-1

Console connection problem s ............................... A-2

Network problems................................................ A-2

How to Reset the Router to Factory Defaults.................... A-3

Power Outages .............................................................. A-3

Technical Support.......................................................... A-4

How to reach us .................................................. A-4

Appendix B — Understanding IP Addressing ..............................B-1

What is IP?.................................................................... B-1

About IP Addressin g ....................................................... B-1

Subnets and subnet mask s .................................. B-2

Example: Using subnets on a Class C IP internet ... B-3

Example: Working with a Class C subnet................ B-5

Distributing IP Addresses ............................................... B-5

Technical note on subnet masking ........................ B-6

Conﬁguratio n ....................................................... B-7

Manually distributing IP addresses........................ B-8

Using address serving.......................................... B-8

Tips and rules for distributing IP addresses ........... B-9

Nested IP Subnets....................................................... B-11

Broadcasts.................................................................. B-14

Download from Www.Somanuals.com. All Manuals Search And Download.

Firmware User Guide

Packet header types .......................................... B-14

Appendix C — Binary Conversion Table......................................C-1

Index

Download from Www.Somanuals.com. All Manuals Search And Download.

Introduction 1-1

Chapter 1

Introduction

This Firmware User Guide covers the advanced features of the Netopia 4000-Series Router and IAD families.

Your Netopia equipment offers advanced conﬁguration features in addition to Easy Setup. The advanced feature

screens are accessed through the Main Menu of the console conﬁguration screen. This Firmware User Guide

documents the advanced features, including advanced testing, security, monitoring, and conﬁguration features.

This Firmware User Guide should be used as a companion to the Easy Setup conﬁguration instructions in the

Netopia Router Getting Started guide or the applicable User’s Reference Guide. You should read the Getting

Started guide before reading this Firmware User Guide.

Note: ^{This Guide also includes descriptions of new features and changes to the functionality of the ﬁrmware}

for the current release, Netopia Firmware Version 5.4. Such descriptions supersede the descriptions of the

corresponding features given in the original User’s Reference Guide, if any, accompanying your product.

What’s New in Netopia Firmware Version 5.4

New in Netopia Firmware Version 5.4 are the following features:

■

Multiple Data Link Encapsulation support on ATM-based WAN interfaces

See “Multiple Data Link Encapsulation Settings” on page 2-25.

Stateful Inspection Firewall

See “Stateful Inspection ﬁrewall” on page 2-37.

IP Passthrough support

See “IP Passthrough” on page 3-27.

Universal Plug-and-Play support (UPnP™)

See “UPnP Support” on page 10-2.

Download from Www.Somanuals.com. All Manuals Search And Download.

1-2 Firmware User Guide

Console-based Management

Console-based management is a fast menu-driven inte rface for the capabilities built into the Netopia Firmware

Version 5.4. Console-based management provides access to a wide variety of features that the router supports.

You can customize these features for your individual setup. This chapter describes how to access the

console-based management screens.

This section covers the following topics:

■

“Netopia Console Menus” on page 1-2

“Netopia Models” on page 1-3

“Connecting through a Telnet Session” on page 1-4

“Connecting a Console Cable to your Equipment” on page 1-5

“Navigating through the Console Screens” on page 1-7

Netopia Console Menus

Console-based management screens contain the main entry points to the Netopia Firmware Version 5.4

conﬁguration and monitoring features. The entry points are displayed in the Main Menu shown below:

Netopia Data Router

Netopia IAD

Netopia Router

Netopia IAD

Easy Setup...

WAN Configuration...

System Configuration...

Utilities & Diagnostics...

Statistics & Logs...

Quick Menus...

WAN Configuration...

System Configuration...

Voice Configuration...

Utilities & Diagnostics...

Statistics & Logs...

Quick Menus...

Quick View...

Return/Enter goes to Easy Setup -- minimal configuration.

You always start from this main screen.

Return/Enter goes to Easy Setup -- minimal configuration.

You always start from this main screen.

■

The Easy Setup menus display and permit changing the values contained in the default connection proﬁle.

You can use Easy Setup to initially conﬁgure the router directly through a console session.

Easy Setup menus contain up to ﬁve descendant screens for viewing or altering these values. The number

of screens depends on whether you have optional features installed.

The Getting Started manual describes the Easy Setup menus to get you up and running quickly.

■

The WAN Conﬁguration menu displays and permits changing your connection proﬁle(s), Virtual Private

Networks (VPNs) and default proﬁle, creating or deleting additional connection proﬁles, and conﬁguring or

Download from Www.Somanuals.com. All Manuals Search And Download.

Introduction 1-3

reconﬁguring the manner in which you may be using the router to connect to more than one service

provider or remote site. See “WAN Conﬁguration,” beginning on page 2-1. See also Chapter 4, “Virtual

Private Networks (VPNs).”

■

The System Conﬁguration menus display and permit changing:

• IP Setup

• Filter Sets

• IP Address Serving

• Date and Time

• Security

• Network Address Translation (NAT)

• Console Conﬁguration

• Stateful Inspection

• SNMP (Simple Network

Management Protocol)

• Upgrade Feature Set

• Change Device to a Bridge

• Logging

See “System Conﬁguration Screens,” beginning on page 2-35.

■

For IADs, the Voice Conﬁguration menus provide the tools for conﬁguring the voice telephone features

available in Netopia Firmware Version 5.4. See Chapter 8, “Voice Conﬁguration.”

The Utilities & Diagnostics menus provide a selection of seven tools for monitoring and diagnosing the

router's behavior, as well as for updating the ﬁrmware and rebooting the system. See Chapter 11, “Utilities

and Diagnostics.”

■

The Statistics & Logs menus display nine sets of tables and device logs that show information about your

router, your network, and their history. See “Statistics & Logs,” beginning on page 9-4.

The Quick Menus screen is a shortcut entry point to the most commonly used conﬁguration menus that

are accessed through the other menu entry points.

The Quick View menu displays at a glance current real-time operating information about your router. See

“Quick View Status Overview” on page 9-1.

Netopia Models

This Firmware User Guide covers all of the Netopia 4000-Series Router and IAD models. However some

information in this guide will only apply to a speciﬁc model.

Screen differences

Because different Netopia 4000-Series models offer many different features and interfaces, the options shown

on some screens in this Firmware User Guide may not appear on your own particular model’s console screen.

These differences are noted throughout the manual.

Download from Www.Somanuals.com. All Manuals Search And Download.

1-4 Firmware User Guide

Connecting through a Telnet Session

Features of the Netopia Firmware Version 5.4 can be conﬁgured through the console screens.

Before you can access the console screens through Telnet, you must have:

■

A network connection locally to the router or IP access to the router.

Note: ^{Alternatively, you may have a direct serial console cable connection using a provided console cable and}

the Console port on the back of the router. Some models do not have a console port. For more information on

attaching the console cable, see “Connecting a Console Cable to your Equipment” on page 1-5.

■

Telnet software installed on the computer you will use to conﬁgure the router

Conﬁguring Telnet software

If you are conﬁguring your device using a Telnet session, your computer must be running a Telnet software

program.

■

If you connect a PC with Microsoft Windows, you can use a Windows Telnet application or simply run Telnet

from the Start menu.

If you connect a Macintosh computer, you can use the NCSA Telnet program supplied on the Netopia CD.

You install NCSA Telnet by simply dragging the application from the CD to your hard disk. Mac OS X users

can run Telnet in the Terminal application, found in the Mac OS X Utilities folder.

Download from Www.Somanuals.com. All Manuals Search And Download.

Introduction 1-5

Connecting a Console Cable to your Equipment

Many Netopia models include a serial console port labeled “Console” on the back panel. You can perform all of

the system conﬁguration activities for your Netopia equipment through a local serial console connection, if

available, using terminal emulation software, such as HyperTerminal provided with Windows 95, 98, 2000, or

NT on the PC, or ZTerm, included on the Netopia CD, for Macintosh computers.

You attach the Netopia device to either a PC or Macintosh computer via the serial port on the computer. (On a

Macintosh computer, the serial port is called the Modem port or Printer port. Since Macintosh computers have

different serial bus connectors, you may need a USB-to-DB-9 or USB-to-serial adapter. These are available from

a variety of third-party manufacturers.) This connection lets you use the computer to conﬁgure and monitor the

Router via the console screens.

Example back panel

Ethernet

DSL

Console

Power

Console connection port

DB-9 (male)

To connect to your computer for serial console communication, use a console cable appropriate to your

platform:

■

A DB-9 connector end attaches to a PC.

A DB-9 end of the Console cable attaches to the Console port.

If you connect a PC with Microsoft Windows 95, 98, 2000, or NT, you can use the HyperTerminal

application bundled with the operating system.

■

If you connect a Macintosh computer, you can use the ZTerm terminal emulation program on the supplied

Netopia CD.

Download from Www.Somanuals.com. All Manuals Search And Download.

1-6 Firmware User Guide

Launch your terminal emulation software and conﬁgure the communications software for the values shown in

the table below. These are the default communication parameters that the Netopia Firmware Version 5.4 uses.

Parameter

Terminal type

Suggested Value

PC: ANSI-BBS

Mac: ANSI, VT-100, or VT-200

Data bits

Parity

None

Stop bits

Speed

9600 - 57600 bits per second

None

Flow Control

Note: The router ﬁrmware contains an autobaud detection feature. If you are at any screen on the

serial console, you can change your baud rate and press Return (HyperTerminal for the PC

requires a disconnect). The new baud rate is displayed at the bottom of the screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

Introduction 1-7

Navigating through the Console Screens

Use your keyboard to navigate the Netopia Firmware Version 5.4’s conﬁguration screens, enter and edit

information, and make choices. The following table lists the keys to use to navigate through the console

screens.

To...

Use These Keys...

Move through selectable items in a screen or pop-up menu

Up, Down, Left, and Right Arrow

Return or Enter

Set a change to a selected item or open a pop-up menu of

options for a selected item like entering an upgrade key

Change a toggle value (Yes/No, On/Off)

Restore an entry or toggle value to its previous value

Move one item up

Tab

Esc

Up arrow or Control + K

Down arrow or Control + O

Control + E

Move one item down

Display a dump of the device event log

Display a dump of the WAN event log

Refresh the screen

Control + F

Control + L

To help you ﬁnd your way to particular screens, some sections in this guide begin with a graphical path guide

similar to the following example:

System

Configuration

Main

IP Setup

This particular path guide shows how to get to the Network Protocols Setup screens. The path guide represents

these steps:

1. Beginning in the Main Menu, select System Conﬁguration and press Return. The System Conﬁguration

screen appears.

2. Select IP Setup and press Return. The IP Setup screen appears.

To go back in this sequence of screens, use the Escape key.

Download from Www.Somanuals.com. All Manuals Search And Download.

1-8 Firmware User Guide

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-1

Chapter 2

WAN and System Configuration

This chapter describes how to use the console-based management screens to access and conﬁgure advanced

features of your equipment. You can customize these features for your individual setup. These menus provide a

powerful method for experienced users to set up their router’s connection proﬁles and system conﬁguration.

This section covers the following topics:

■

“WAN Conﬁguration” on page 2-1

■

“ADSL Line Conﬁguration screen” on page 2-2

“SDSL/IDSL Conﬁguration screen” on page 2-3

“G.SHDSL Line Conﬁguration screen” on page 2-6

“T1 Line Conﬁguration screen” on page 2-7

■

“Frame Relay Conﬁguration” on page 2-9

“Multiple ATM Permanent Virtual Circuits” on page 2-16

“Creating a New Connection Proﬁle” on page 2-24

“The Default Proﬁle” on page 2-28

“Scheduled Connections” on page 2-29

“System Conﬁguration Screens” on page 2-35

WAN Conﬁguration

To conﬁgure your Wide Area Network (WAN) connection, navigate to the WAN Conﬁguration screen from the Main

Menu and select WAN (Wide Area Network) Setup.

WAN

Configuration

Main

WAN

Setup

The Line Conﬁguration screen appears. The Line Conﬁguration screen will be appropriate to the type of WAN

interface supported by your particular router model.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-2 Firmware User Guide

ADSL Line Conﬁguration screen

The ADSL Line Conﬁguration screen is shown below:

ADSL Line Configuration

Circuit Type...

Multimode

Trellis Coding Enabled:

Signaling Mode...

FDM

Fast Retrain Enabled:

Data Link Encapsulation...

RFC1483

1. Select Circuit Type and from the pop-up menu choose the type of circuit to which you will be connecting:

Multimode, T1.413, G.dmt/G.lite, or ADI.

2. Select Trellis Coding Enabled. Toggle it to On (the default) or Off.

3. Select Signaling Mode and choose Echo Cancellation or FDM (the default).

4. If you selected Multimode Circuit Type, the Fast Retrain Enabled ﬁeld appears. Toggle it to On (the default)

or Off.

5. Select Data Link Encapsulation and press Return. The pop-up menu will offer you the choice of PPP or

RFC1483.

6. Press Escape to return to the WAN Conﬁguration screen.

For multiple permanent virtual circuit (PVC) conﬁgurations, see “Multiple ATM Permanent Virtual Circuits” on

page 2-16.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-3

SDSL/IDSL Conﬁguration screen

The SDSL/IDSL Line Conﬁguration screen is shown below:

SDSL Line Conf+------------+

+------------+

Line Type...

| SDSL-ATM |

| SDSL-HDLC |

Operation Mode...

| IDSL

| IDSL-CM

Data Rate Mode...

Data Rate...

+------------+

384

Data Link Encapsulation...

PPP Mode...

PPP

VC Multiplexed

Return/Enter to select <among/between> ...

Enter Information supplied to you by your telephone company.

■

Select a Line Type from the pull-down menu. You can choose SDSL-ATM, SDSL-HDLC, IDSL, or IDSL-CM.

For IDSL connections, choose IDSL if your service provider uses most common central ofﬁce equipment;

choose IDSL-CM if your service provider uses Copper Mountain equipment. If you choose either IDSL type,

the router must reboot and you will see a warning screen to conﬁrm your choice.

IDSL conﬁguration offers different options. See “IDSL Line Conﬁguration screen” on page 2-5.

■

The Operation Mode pull-down menu allows you to select the type of SDSL-ATM DSLAM to which you will be

connecting: Generic, Lucent, Nokia EOC Fast, Nokia Fixed, Paradyne, Nortel UE IMAS or Newbridge.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-4 Firmware User Guide

SDSL Line Configuration

+----------------+

Line Type...

+----------------+

Operation Mode...

| Generic

| Lucent

| Nokia EOC Fast |

Data Rate Mode...

Data Rate...

| Nokia Fixed

| Paradyne

| Nortel UE IMAS |

| Newbridge

+----------------+

Data Link Encapsulation...

RFC1483 Mode...

RFC1483

Routed 1483

Some of these selections will reset the defaults for the remaining options in this screen. You will be

challenged to conﬁrm your choice. The SDSL-HDLC and IDSL Line Types do not offer these choices.

■

The Data Rate Mode pull-down menu allows you to select either Hunt or Locked mode.

■

If you choose Hunt, the router will cycle through the speeds available and attempt to connect at the

highest available speed. This hunt will take a few minutes. When a negotiated speed is determined,

the router will remember that speed and use it as the starting point for the next time a connection is

attempted.

■

If you choose Locked, the Data Rate you select in the next menu will always be used.

■

The Data Rate pull-down menu allows you to select the data rate for your connection. This is usually

assigned by your Service provider.

Your Data Link Encapsulation may be either PPP or RFC1483, as assigned by your Service Provider.

■

If you are using PPP, the PPP Mode menu offers either VC Multiplexed or LLC SNAP.

■

If you are using RFC1483, the RFC1483 Mode menu offers either Bridged 1483 or Routed 1483.

Bridged 1483 displays a PPP over Ethernet (PPPoE) toggle item that can be toggled either On or Off.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-5

IDSL Line Conﬁguration screen

The IDSL Line Conﬁguration screen is shown below:

IDSL Line Configuration

Line Type...

IDSL

Data Rate (kbps)...

144 (2B+D)

Data Link Encapsulation...

PPP

Return/Enter to select <among/between> ...

Enter information supplied to you by your ISDN phone company.

■

For IDSL lines, the Data Rate (kbps) pull-down menu offers 64 (B1), 64 (B2), 128 (B1+B2), or 144

(2B+D).

The Data Link Encapsulation pull-down menu offers PPP, HDLC, or Frame Relay.

■

If you are using Frame Relay, a PPP over Frame Relay Enabled option appears and allows you to tog-

gle it either On or Off.

If you enable PPP over Frame Relay, the DLCI and LMI ﬁelds appear.

The DLCI ﬁeld is editable; the default is 16.

The LMI pull-down menu offers the choices None, ANSI (Annex D), CCITT (Annex A), or LMI.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-6 Firmware User Guide

G.SHDSL Line Conﬁguration screen

The G.SHDSL Line Conﬁguration screen is shown below:

DSL Line Configuration

Regional Setting...

Annex A

Cell Format...

Scrambled

Idle

Unused Cell Format...

Data Link Encapsulation...

RFC1483 Mode...

RFC1483

Bridged 1483

Off

PPP over Ethernet (PPPoE):

Each access concentrator (DSLAM) has a different set of defaults and other parameters.

Your service provider should supply you with the appropriate information about the type and capabilities of the

access concentrator equipment they use.

■

Select Regional Setting and from the pop-up menu select either Annex A or Annex B. North American users

select Annex A; non-North American users select Annex B.

■

Select Cell Format and from the pop-up menu select either Scrambled (the default) or Unscrambled. This

setting must match the format used by your service provider. Scrambled is the most common, so you

probably do not need to change it unless your provider speciﬁcally tells you to do so.

■

Select Unused Cell Format and from the pop-up menu select either Idle (the default) or Empty. This setting

must match the format used by your service provider. Idle is the most common, so you probably do not

need to change it unless your provider speciﬁcally tells you to do so.

Select Data Link Encapsulation and from the pop-up menu choose your DLE.

■

If you selected RFC1483, the next pop-up menu RFC1483 Mode offers the choice of Bridged 1483 or

Routed 1483. If you select Bridged 1483, a new option PPP over Ethernet (PPPoE) appears. You can

then toggle PPPoE On or Off. Choosing Routed 1483 hides the PPPoE option.

■

If you selected PPP, the next pop-up menu PPP Mode offers the choice of VC Multiplexed or LLC SNAP.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-7

T1 Line Conﬁguration screen

The T1 Line Conﬁguration screen is shown below:

T1 Line Configuration

Operation Mode...

HDLC

B8ZS

ESF

Line Encoding...

Framing Mode...

Transmit ANSI PRMs:

AutoDetect DS0 Channels:

Number of DS0 Channels:

First DS0 Channel:

Buildout (-dB)...

0-0.6

Nx64k

Channel Data Rate...

Data Link Encapsulation...

Frame Relay

Off

PPP over Frame Relay Enabled:

Return/Enter goes to new screen.

Enter Information supplied to you by your telephone company.

■

Select Operation Mode and press Return. From the pop-up menu, highlight the mode your telephone

service provider uses: HDLC (Cisco), CM-HDLC (Copper Mountain), or ATM. The default setting is HDLC.

Press Return.

■

Select Line Encoding and press Return. From the pop-up menu, highlight the encoding your telephone

service provider uses: B8ZS or AMI. The default setting is B8ZS. Press Return.

Select Framing Mode and press Return. From the pop-up menu, highlight either ESF or D4, depending on

the framing mode that your telephone service provider advises you to use. The default setting is ESF. Press

Return.

■

If you selected ESF framing mode, toggle Transmit ANSI PRMs either No (the default) or Yes. If you

selected D4 framing mode, this option is not available.

Select AutoDetect DS0 Channels. Netopia routers whose model number ends in “-T” may be able to use

the auto detection feature. Toggle this item to Yes if your service provider uses equipment that supports

DS0 channel auto detection. Otherwise accept the default No.

■

Select Number of DS0 Channels and enter the number of DS0 channels that you and your telephone

service provider have determined are necessary for your T1 line. The default setting for DS0 Channels is 1

(one). Press Return.

Note: Each DS0 channel represents a 56k or 64k increment in bandwidth. Selecting a number less than

the maximum of 24 speciﬁes a fractional T1 interface.

For fractional T1, you can also specify in the check box whether the DS0 channels are contiguous or

alternating.

■

Select First DS0 Channel and enter the number of the ﬁrst active DS0 channel you will be using. The

Download from Www.Somanuals.com. All Manuals Search And Download.

2-8 Firmware User Guide

default setting is 1 (one). Press Return.

Note: You can change the First DS0 Channel number, which has a valid range from one to the maximum

number minus the number of active channels. If the number of active DS0 channels is 24 (maximum), First

DS0 Channel is hidden.

If you specify a number of DS0 channels less than the maximum, a Contiguous Channels item appears. For

fractional-T1, you can specify whether the DS0 channels are contiguous or alternating by toggling

Contiguous Channels to Yes or No.

■

Select Buildout (-dB) and press Return. From the pop-up menu, highlight the line buildout, which is the

transmit attenuation of the line that you will be using. The choices in the menu include Auto, 0-0.6, 7.5,

15.0, 22.5, and None. The default setting is 0-0.6. Press Return.

If Automatic is chosen, the attenuation of the transmission will be set to match the receiving signal level.

■

Select Channel Data Rate and highlight the data rate speciﬁed by your service provider. The channel data

rate choices are Nx56k or Nx64k. The default is Nx64k. Press Return.

Select Data Link Encapsulation and highlight the method of encapsulation that you want to use from the

pop-up menu. The choices offered are PPP, HDLC (Cisco), RFC 1483, and Frame Relay. The default setting

is Frame Relay. Press Return.

The screen will offer different options depending on your selection.

Frame Relay Options

PPP Options

T1 Line Configuration

Operation Mode...

Line Encoding...

Framing Mode...

Normal

B8ZS

ESF

Operation Mode...

Line Encoding...

Framing Mode...

Normal

B8ZS

ESF

Number of DS0 Channels:

First DS0 Channel:

Number of DS0 Channels:

First DS0 Channel:

Channel Data Rate...

Nx64k

Channel Data Rate...

Nx64k

Data Link Encapsulation...

Frame Relay

Data Link Encapsulation...

PPP Mode...

PPP

PPP over Frame Relay Enabled:

VC Multiplexed

DLCI:

LMI:

None

TO MAIN MENU

NEXT SCREEN

TO MAIN MENU

NEXT SCREEN

Return/Enter takes you back to previous screen.

Enter Information supplied to you by your telephone company. Enter Information supplied to you by your telephone company.

RFC 1483 Options

ATM Operation Mode Options

T1 Line Configuration

Operation Mode...

Line Encoding...

Framing Mode...

Normal

B8ZS

ESF

Operation Mode...

Line Encoding...

Framing Mode...

ATM

B8ZS

ESF

Number of DS0 Channels:

First DS0 Channel:

Number of DS0 Channels:

First DS0 Channel:

Channel Data Rate...

Nx64k

Data Link Encapsulation...

RFC1483 Mode...

RFC1483

Bridged 1483

Off

Data Link Encapsulation...

RFC1483 Mode...

RFC1483

Bridged 1483

PPP over Ethernet (PPPoE):

Data Circuit VPI (0-255):

Data Circuit VCI (32-65535):

Off

TO MAIN MENU

NEXT SCREEN

TO MAIN MENU

NEXT SCREEN

Return/Enter goes to new screen.

Enter Information supplied to you by your telephone company. Enter Information supplied to you by your telephone company.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-9

Note: If you used Easy Setup to conﬁgure your router, you have already created a connection proﬁle called

Easy Setup Proﬁle. If you return to the Easy Setup menus and change the Data Link Encapsulation method

you set up in this step, the Easy Setup Data Link Encapsulation method will override this one and change

the default data link encapsulation method in use.

You are now ﬁnished conﬁguring the Line Conﬁguration screen. Press the Escape key to return to the WAN

Conﬁguration screen.

Note: If you selected Frame Relay as your data link encapsulation method, see “Frame Relay Conﬁguration”

on page 2-9 for more information.

Frame Relay Conﬁguration

If you chose Frame Relay as your data link encapsulation type you can now conﬁgure the Frame Relay options

from the WAN Conﬁguration menu.

WAN Configuration

WAN (Wide Area Network) Setup...

Display/Change Connection Profile...

Add Connection Profile...

Delete Connection Profile...

Default Profile...

Frame Relay Configuration...

Frame Relay DLCI Configuration...

Return/Enter for WAN line configuration.

From here you will configure yours and the remote sites' WAN information.

From the WAN Conﬁguration screen, select WAN Setup, then select the Frame Relay Conﬁguration option and

press Return. The Frame Relay Conﬁguration screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-10 Firmware User Guide

Frame Relay Configuration

LMI Type...

ANSI (Annex D)

T391 (Polling Interval in secs): 10

N391 (Polls/Full Status Cycles): 6

N392 (Error Threshold):

N393 (Monitored Event Window):

Tx Injection Management...

Default CIR:

Standard

64000

Default Bc:

Default Be:

Congestion Management Enabled:

Maximum Tx Frame Size:

1520

Return/Enter goes to new screen.

Enter Information supplied to you by your telephone company.

1. Select LMI Type (Link Management Type) and press Return. From the pop-up menu, highlight either ANSI

(Annex D), CCITT (Annex A), LMI, or None. The default is None. Press Return.

See “Frame Relay DLCI conﬁguration” on page 2-11 for instructions.

Specifying the Link Management Type is the ﬁrst step in conﬁguring Frame Relay.

■

If you select an LMI Type (Link Management Type) other than None, the T391 option speciﬁes the

number of seconds between the Status Enquiry messages. The default setting is 10.

The N391 option speciﬁes the frequency of full status polls, in increments of the basic (T391) polling

cycle. The default setting is 6.

The N392 option speciﬁes the maximum number of (link reliability, protocol, and sequence number)

error events that can occur within the N393 sliding window. If an N392 threshold is exceeded, the

switch declares the Netopia Router inactive. The default setting is 3.

■

The N393 option allows the user to specify the width of the sliding N392 monitored event window. The

default setting is 4.

2. Select Tx Injection Management and press Return. From the pop-up menu, highlight Standard if you want

the frames on your line that exceed the conﬁgured service parameters to be dropped at the router,

Buffered if you want the frames on your line that exceed the link capacity to be delayed until the link is less

busy, or None if you want all of the frames on your line to be transmitted. Press Return.

Note: If you select None as the Tx Injection Management type, the three Tx Injection Management options

listed below will remain hidden. Go to step 4.

If you select Standard or Buffered as the Tx Injection Management type, then the Default CIR, Bc, and Be

values will appear (in the corresponding ﬁelds below the Tx Injection Management ﬁeld) in order for you to

deﬁne the parameters of the management algorithm.

■

The Default CIR (CIR also referred to as Committed Information Rate) represents the average capacity

available to a given PVC (Permanent Virtual Circuit) or DLCI (Data Link Connection Identiﬁer). This set-

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-11

ting defaults to 64000, but you may modify the capacity rate if this setting will not be applicable to

you.

■

The Default Bc (Bc also referred to as Committed Burst Size) represents the maximum amount of data

that your Frame Relay service provider agrees to transfer from a given PVC (Permanent Virtual Circuit)

or DLCI (Data Link Connection Identiﬁer). This setting defaults to 64000, but you may change the

capacity rate if necessary.

The Default Be (Be also referred to as Excess Burst Size) represents the maximum amount of data

that your Frame Relay service provider will attempt to deliver to a given PVC (Permanent Virtual Circuit)

or DLCI (Data Link Connection Identiﬁer). This setting defaults to 0, but you may change the capacity

rate if necessary.

Note: Some Frame Relay service providers allow for over-subscription of the DLCIs, which occurs when the

total number of CIRs for all PVCs exceeds the line rate setup.

3. Select Congestion Management Enabled and toggle to Yes or No depending on whether you use this

selection. Press Return.

If Congestion Management is enabled, this option causes the Netopia Router to use in-bound FECNs

(Forward Explicit Congestion Notiﬁcation). This feature is designed to notify you that congestion avoidance

procedures should be initiated where applicable for trafﬁc in the same direction as the received frame. It

indicates that the frame in question has encountered congested resources.

Note: The Congestion Management Enabled ﬁeld will only appear if Standard or Buffered is selected as

the option from the Tx Injection Management ﬁeld.

4. Select Maximum Tx Frame Size and press Return. The default is automatically set to a value suitable for

encapsulating a full Ethernet packet’s transmission load; however you can change the Maximum Frame

Size to suit your network’s transmission load. Press Return.

You are now ﬁnished conﬁguring the Frame Relay Conﬁguration screen. Press the Escape key to return to the

WAN Conﬁguration screen. If you need to conﬁgure your DLCIs, go to the next section.

Frame Relay DLCI conﬁguration

If you selected None as your LMI Type then you will need to manually conﬁgure your DLCIs.

A Frame Relay DLCI is a set of parameters that tells the Netopia Router how to initially connect to a remote

destination.

The Netopia Router supports up to 16 different Frame Relay DLCI proﬁles.

Each Frame Relay DLCI conﬁguration you set up allows the Netopia Router to connect your network to another

network that uses IP over Frame Relay.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-12 Firmware User Guide

To go to the Frame Relay DLCI conﬁguration screen, select Frame Relay DLCI Conﬁguration in the WAN

Conﬁguration screen.

Frame Relay DLCI Configuration

Display/Change DLCIs...

Add DLCI...

Delete DLCI...

Add, delete, and modify DLCIs from here.

Displaying a Frame Relay DLCI conﬁguration table

To display a view-only table of the Frame Relay DLCIs, select Display/Change DLCIs in the Frame Relay DLCI

Conﬁguration screen, and press Return.

The Frame Relay DLCI Conﬁguration table is a handy way to quickly view the DLCI names and DLCI numbers that

you attribute to your Frame Relay proﬁles.

Frame Relay DLCI Configuration

+-DLCI Name----------DLCI Number-+

+--------------------------------+

| DLCI 16

16 |

+--------------------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-13

Changing a Frame Relay DLCI conﬁguration

To modify a Frame Relay DLCI conﬁguration, select Display/Change DLCIs in the Frame Relay DLCI

Conﬁguration screen.

Select a DLCI Name from the table and press Return to go to the Change DLCI screen. The parameters in this

screen are the same as the parameters in the Add DLCI screen. To ﬁnd out how to set them, see “Adding a

Frame Relay DLCI conﬁguration” on page 2-14.

Change DLCI

DLCI Name:

DLCI 33

Yes

DLCI Enabled:

DLCI Number (16-991):

Remote IP Address:

2.0.0.2

Download from Www.Somanuals.com. All Manuals Search And Download.

2-14 Firmware User Guide

Adding a Frame Relay DLCI conﬁguration

To add a new Frame Relay DLCI, select Add DLCI in the Frame Relay DLCI Conﬁguration screen and press

Return. The Add DLCI screen appears.

Add DLCI

DLCI Name:

DLCI 16

Yes

DLCI Enabled:

DLCI Number (16-991):

Remote IP Address:

0.0.0.0

Data Flow Parameters---------------Use Default---------Value----

CIR:

Bc:

Yes

Be:

ADD DLCI NOW

CANCEL

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes.

Here you configure the parameters for a single DLCI (Data Link Circuit ID).

1. Select DLCI Name and enter a name for this individual Frame Relay DLCI proﬁle. It can be any name you

want. For example: the name of your ISP or remote branch you’re connecting to such as the corporate

headquarters of your company.

Note: The Netopia Router allows Frame Relay DLCIs to be named, so that you can easily reference and

differentiate them. This is accomplished by giving a DLCI Name to a DLCI Number.

2. Select DLCI Enabled and toggle it to Yes to activate the proﬁle. If you disable this proﬁle, the Netopia

Router will automatically disable and block access to a speciﬁc remote DLCI.

3. Select DLCI Number (16-991) and enter a number for this individual DLCI. Check with your Frame Relay

provider to ﬁnd out what numbers are allocated for each of your DLCI proﬁles. The DLCI number range

should fall within the range of 16-991.

4. Select Remote IP Address and enter the remote IP address your ISP or network administrator gave you

that represents the remote sites IP address for their router. Press Return.

If you selected Standard or Buffered as the Tx Injection Management type in the Frame Relay Conﬁguration

screen go to the next bulleted item below. If you selected None in the Frame Relay Conﬁguration screen go to

step 6.

Below the Remote IP Address ﬁeld, the following Data Flow Parameters appear:

■

The CIR (Committed Information Rate) represents the average capacity available to a given PVC (Per-

manent Virtual Circuit) or DLCI (Data Link Connection Identiﬁer). The setting defaults to 64000, but

you may modify the capacity rate by toggling the selection in the Use Default ﬁeld to No. You can then

enter a different capacity rate in the Value ﬁeld.

■

The Bc (Committed Burst Size) represents the maximum amount of data that your Frame Relay service

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-15

provider agrees to transfer from a given PVC (Permanent Virtual Circuit) or DLCI (Data Link Connection

Identiﬁer). The setting defaults to 64000, but you may modify the committed burst size by toggling the

selection in the Use Default ﬁeld to No. You can then enter a different committed burst size in the

Value ﬁeld.

■

The Be (Excess Burst Size) represents the maximum amount of data that your Frame Relay service

provider will attempt to deliver to a given PVC (Permanent Virtual Circuit) or DLCI (Data Link Connection

Identiﬁer). The setting defaults to 0, but you may modify the excess burst size by toggling the selection

in the Use Default ﬁeld to No. You can then enter a different excess burst size in the Value ﬁeld.

Note: Some Frame Relay service providers allow for over-subscription of the DLCIs, which occurs when the

total number of CIRs for all PVCs exceeds the line rate setup.

5. Select ADD DLCI NOW to save the current static Frame Relay DLCI proﬁle that you have just entered, and

press Return to go back to the Frame Relay DLCI Conﬁguration screen. Alternately, you can cancel the

Frame Relay DLCI proﬁle you have just created by selecting CANCEL to exit the Add DLCI screen.

Deleting a Frame Relay DLCI conﬁguration

To delete a Frame Relay DLCI conﬁguration, select Delete DLCI in the Frame Relay DLCI Conﬁguration screen

and press Return to display the Frame Relay DLCI conﬁguration table.

Frame Relay DLCI Configuration

+-DLCI Name----------DLCI Number-+

+--------------------------------+

| joe

16 |

+------------------------------------------------------------------------+

| Are you sure you want to delete this DLCI?

CANCEL

CONTINUE

+------------------------------------------------------------------------+

+--------------------------------+

1. Highlight the Frame Relay DLCI conﬁguration you wish to delete. Press Return.

2. A Frame Relay DLCI Conﬁguration table appears with a prompt asking you if you want to delete the

connection proﬁle you have just highlighted. Select CONTINUE if you wish to delete this DLCI or CANCEL if

you do not.

You are now ﬁnished conﬁguring the Frame Relay DLCI Conﬁguration screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-16 Firmware User Guide

Multiple ATM Permanent Virtual Circuits

The Netopia Firmware Version 5.4 supports up to eight permanent virtual circuits.

Multiple ATM PVC overview

On cell-based DSL WAN interfaces, the ATM connection between the device and the central ofﬁce equipment

(DSLAM) is divided logically into one or more virtual circuits (VCs). A virtual circuit may be either a permanent

virtual circuit (PVC) or a switched virtual circuit (SVC). Netopia devices support PVCs.

VCs are identiﬁed by a Virtual Path Identiﬁer (VPI) and Virtual Channel Identiﬁer (VCI). A VPI is an 8-bit value

between 0 and 255, inclusive, while a VCI is a 16-bit value between 0 and 65535, inclusive.

■

Circuits now support attributes in addition to their VPI and VCI values. When conﬁguring a circuit, you can

specify an optional circuit name of up to 14 characters. The circuit name is used only to identify the circuit

for management purposes as a convenience to aid in selecting circuits from lists. The default circuit name

is “Circuit <n>”, where <n> is some number between one and eight corresponding to the circuit’s position

in the list of up to eight circuits.

■

You can also individually enable or disable a circuit without deleting it. This is useful for temporarily

removing a circuit without losing the conﬁgured attributes.

In order to function, each circuit must be bound to a Connection Proﬁle or to the Default Proﬁle. Among

other attributes, the proﬁle binding speciﬁes the IP addressing information for use on the circuit. Each

circuit must be bound to a distinct Connection Proﬁle. You cannot bind multiple circuits to the same

Connection Proﬁle.

Multiple ATM PVC conﬁguration

ATM VPI/VCI Autodetection. You can bind multiple circuits to the same Connection Proﬁle. Netopia Firmware

Version 5.4 allows you to have a standard conﬁguration that uses, for example, four VCs (0/35, 0/38, 8/35,

8/38) pointing to the same proﬁle.

The unit will now automatically select the active VC on networks with a VPI/VCI of any of these four values

without any custom conﬁguration of the unit. You must, however, manually create these VCs and associate

them with the proﬁle you desire.

You conﬁgure Virtual Circuits in the Add/Change Circuit screen.

WAN

Configuration

Main

ATM Circuits

Configuration

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-17

ATM Circuits Configuration

Show/Change Circuit...

Add Circuit...

Delete Circuit...

3. To add a circuit, select Add Circuit and press Return. The Add Circuit screen appears.

Add Circuit

Circuit Name:

Circuit 2

Yes

Circuit Enabled:

Circuit VPI (0-255):

Circuit VCI (32-65535):

QoS...

+-------------+

| UBR

Peak Cell Rate (0 = line rate): | CBR

+-------------+

Default Profile

CANCEL

Use Connection Profile...

Use Default Profile for Circuit

ADD Circuit NOW

■

Enter a name for the circuit in the Circuit Name ﬁeld.

Toggle Circuit Enabled to Yes.

Enter the Virtual Path Identiﬁer and the Virtual Channel Identiﬁer in the Circuit VPI and Circuit VCI

ﬁelds, respectively.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-18 Firmware User Guide

Quality of Service (QoS) settings

■

Select the QoS (Quality of Service) setting from the pop-up menu: UBR. or CBR.

UBR: No conﬁguration is needed for UBR VCs. Leave the default value 0 (maximum line rate).

CBR: One parameter is required for CBR VCs. Enter the Peak Cell Rate that applies to the VC. This

value should be between 1 and the line rate. You set this value according to speciﬁcations deﬁned by

your service provider.

Add Circuit

Circuit Name:

Circuit 2

Yes

Circuit Enabled:

Circuit VPI (0-255):

Circuit VCI (32-65535):

QoS...

CBR

Peak Cell Rate (0 = line rate):

Use Connection Profile...

Use Default Profile for Circuit

ADD Circuit NOW

Default Profile

CANCEL

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes.

■

The Peak Cell Rate ﬁeld is editable. Netopia Firmware Version 5.4 supports two ATM classes of ser-

vice for data connections: Unspeciﬁed Bit Rate (UBR) and Constant Bit Rate (CBR). You can conﬁgure

these classes of service on a per VC basis. The default ATM class of service is UBR.

Then, select a Connection Proﬁle for the Circuit. To use the Default Proﬁle, select Use Default Proﬁle

for Circuit and press Return. For other options, select a proﬁle from the Use Connection Proﬁle

pop-up menu.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-19

Note: With multiple VCs you must explicitly statically bind the second (and all subsequent) VCs to a proﬁle.

The ﬁrst VC will automatically statically bind according to pre-deﬁned dynamic binding rules when you add the

second VC. It will revert back to dynamic binding if the number of VCs is reduced to one; for example, by

deleting previously deﬁned VCs.

When the link comes up the router binds the VC dynamically to the ﬁrst suitable Connection Proﬁle or to the

Default Proﬁle if there is no Connection Proﬁle conﬁgured.

• If you factory default the router, the VC binds to the Default Proﬁle.

• If you delete a Connection Proﬁle that is statically bound to a VC, the VC binding is set back to the Default

Proﬁle. If there is only one VC deﬁned, the VC dynamically binds to the ﬁrst suitable proﬁle or to the Default

Proﬁle. If there are multiple VCs deﬁned, it binds to the Default Proﬁle.

• If you add a second VC, it is initialized to the Default Proﬁle, and the menu screens display the VC

Connection Proﬁle-related items, allowing you to bind to a speciﬁc Connection Proﬁle instead of the Default

Proﬁle. In addition, the router statically binds the ﬁrst VC according to the rules used to select a proﬁle for

dynamic binding. At this point, each proﬁle uses static binding when the link is brought up.

• If there are no VCs when you add a VC -- for example, if you deleted all your previous VCs and started adding

them again -- dynamic binding will occur when the link comes up. If you delete a VC, leaving only one VC, that VC

resumes dynamically binding again.

■

Select ADD Circuit NOW and press Return.

4. To display or change a circuit, select Display/Change Circuit, select a circuit from the pop-up menu, and

press Return. The ﬁelds are the same as those in the Add Circuit screen.

5. To delete a circuit, select Delete Circuit, select a circuit from the pop-up menu, and press Return. In the

conﬁrmation window, select CONTINUE and press Return.

6. Press Escape to return to the WAN Setup menu.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-20 Firmware User Guide

Editing circuits

You conﬁgure Virtual Circuits in the ATM Circuits Conﬁguration screen. From the Main Menu, navigate to the

ATM Circuits Conﬁguration screen.

WAN

Configuration

Main

ATM Circuits

Configuration

ATM Circuits Configuration

Show/Change Circuit...

Add Circuit...

Delete Circuit...

Select Show/Change Circuit and press Return.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-21

Choosing Show/Change Circuit (or Delete Circuit) displays a pop-up menu that allows you to select the circuit

to be modiﬁed or deleted.

ATM Circuits Configuration

+--Circuit Name----VPI/VCI--+

+---------------------------+

Show/Change Circuit...

Add Circuit...

| Circuit 1

8/35

0/0

| Voice Circuit

Delete Circuit...

+---------------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

Changing a circuit

If you want to make any changes to the circuit you select, you make them in the Change Circuit screen.

Change Circuit

Circuit Name:

Circuit 1

Circuit Enabled:

+---------+

| Voice |

Traffic Type...

| Data

Circuit VPI (0-255):

Circuit VCI (0-65535):

Connection Profile is

+---------+

Easy Setup Profile

■

Circuit Name allows you to associate a one- to fourteen-character name with the circuit. The default circuit

name is “Circuit <n>”, where <n> is some number between one and eight corresponding to the circuit’s

position in the list of up to eight circuits.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-22 Firmware User Guide

■

Circuit Enabled allows you to enable or disable the circuit, using the Tab key. The default is enabled.

Trafﬁc Type allows you to select which type of trafﬁc will be routed on this circuit, Voice or Data. If you

choose Voice, the Connection Proﬁle is ﬁeld becomes unavailable and does not display.

■

Circuit VPI allows you to specify the Virtual Path Identiﬁer (VPI) value for the circuit. The default VPI value

for both ADSL and cell-based DSL is zero (0).

Circuit VCI allows you to specify the Virtual Channel Identiﬁer (VCI) value for the circuit. The default VCI

value depends on the type of DSLAM to which you are connecting.

Accessing the Connection Proﬁle Is ﬁeld in the Change Circuit menu depends not on the number of

Connection Proﬁles you have created, but the number of data VCs you have added. (See “Multiple ATM PVC

conﬁguration” on page 2-16.) If you have more than one data VC you can choose how Connection Proﬁles

are associated with VCs, otherwise you get default behavior and the Connection Proﬁle Is ﬁeld cannot be

selected.

Monitoring multiple virtual circuits

The General Statistics screen adds a selection for ATM VC Statistics.

To access the ATM VC Statistics screen navigate from the Main Menu to Statistics & Logs then General

Statistics.

Statistics

& Logs

Main

General

Statistics

The General Statistics screen appears.

General Statistics

Physical I/F-----Rx Bytes---Tx Bytes---Rx Pkts---Tx Pkts----Rx Err----Tx Err

Ethernet Hub

Aux Async

ATM SDSL 1

22152

5092

403

404

Network----------Rx Bytes---Tx Bytes---Rx Pkts---Tx Pkts----Rx Err----Tx Err

IP 0

VC Traffic Statistics...

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-23

Select VC Trafﬁc Statistics.

The ATM VC Statistics screen appears.

ATM VC Statistics

VPI/VCI------Local IP Addr---------Frames Rx--Frames Tx---Bytes Rx---Bytes Tx

----------------------------------SCROLL UP-----------------------------------

0/39

8/36

111.222.333.4

---------------------------------SCROLL DOWN----------------------------------

■

To display more information about each circuit associated with the selected WAN module, use the up or

down arrow key to highlight the circuit you want to view. Press Return.

A pop-up window appears, displaying detailed information for the selected circuit.

ATM VC Statistics

View St+---------------------------------------------------------------------+

VPI/VCI+---------------------------------------------------------------------+

-------|

0/39 | Circuit Name:

Circuit 4

Profile 4

8/36 | Connection Profile Name:

| Bytes Rx:

| Bytes Tx

| Frames Rx:

Frames Tx:

| Frames Rx Discarded: 0

Frames Tx Discarded: 0

| Errors Rx:

| Errors Tx:

-------+---------------------------------------------------------------------+

Download from Www.Somanuals.com. All Manuals Search And Download.

2-24 Firmware User Guide

Creating a New Connection Proﬁle

Connection proﬁles are useful for conﬁguring the connection and authentication settings for negotiating a PPP

connection on a DSL link. If you are using the PPP data link encapsulation method, you can store your

authentication information in the connection proﬁle so that your user name and password (or host name and

secret) are transmitted when you attempt to connect.

Connection proﬁles deﬁne the networking protocols necessary for the router to make a remote connection. A

connection proﬁle is like an address book entry describing how the router is to get to a remote site, or how to

recognize and authenticate a connection. To create a new connection proﬁle, you navigate to the WAN

Conﬁguration screen from the Main Menu, and select Add Connection Proﬁle.

WAN

Configuration

Main

Add Connection

Profile

The Add Connection Proﬁle screen appears.

Add Connection Profile

Profile Name:

Profile 1

Yes

Profile Enabled:

Encapsulation Type...

RFC1483 Mode...

RFC1483

Bridged 1483

IP Profile Parameters...

COMMIT

CANCEL

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes.

Configure a new Conn. Profile. Finished? COMMIT or CANCEL to exit.

On a Netopia Router you can add up to 15 more connection proﬁles, for a total of 16, but you can only use one

at a time, unless you are using VPNs.

1. Select Proﬁle Name and enter a name for this connection proﬁle. It can be any name you wish. For

example: the name of your ISP.

2. Toggle Proﬁle Enabled to Yes or No. The default is Yes. You can toggle it to No, if you want to disable it

later.

3. Select Encapsulation Type and press Return. The pop-up menu offers the possible data link encapsulation

methods for connection proﬁles used for a variety of purposes: PPP, RFC1483, ATMP, PPTP, IPsec, or L2TP.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-25

Multiple Data Link Encapsulation Settings

4. Select Encapsulation Options and press Return.

❥

If you selected ATMP, PPTP, L2TP, or IPSec, see Chapter 4, “Virtual Private Networks (VPNs).”

If you selected PPP or RFC1483, the screen offers different options:

❥

Add Connection Profile

Profile Name:

Profile 1

Yes

Profile Name:

Profile 1

Yes

Profile Enabled:

Encapsulation Type...

RFC1483 Mode...

+--------------+

Encapsulation Type...

PPP

+--------------+

| Bridged 1483 |

| Routed 1483 |

+--------------+

Underlying Encapsulation...

PPP Mode...

None

VC Multiplexed

Encapsulation Options...

IP Profile Parameters...

Interface Group...

COMMIT

Primary

CANCEL

COMMIT

CANCEL

Configure a new Conn. Profile. Finished? COMMIT or CANCEL to exit.

❥

If you selected RFC1483, the screen allows you

to choose Bridged 1483 or Routed 1483.

❥

If you selected PPP, the screen allows you to

choose PPPoE or None as the Underlying

Encapsulation.

❥

If you choose None, the PPP Mode offers the

choice of VC Multiplexed or LLC SNAP.

If you are using PPP, when you select Encapsulation Options, the Datalink (PPP/MP) Options screen

appears. (RFC1483 does not require these options and does not offer the menu selection.)

Download from Www.Somanuals.com. All Manuals Search And Download.

2-26 Firmware User Guide

Datalink (PPP/MP) Options

Data Compression... Standard LZS

Data Compression...

Standard LZS

PAP

Send Authentication...

PAP

Send User Name:

Send Password:

Send User Name:

Send Password:

Receive User Name:

Receive Password:

Receive User Name:

Receive Password:

Dial on Demand:

Yes

❥

Data Compression defaults to Standard LZS. You

can select Ascend LZS, if you are connecting to

compatible equipment, or None from the

pull-down menu.

❥

If you are creating a Backup proﬁle (supported

models only), and have selected Backup as the

Interface Group in the previous screen, you can

toggle Dial on Demand to Yes (the default) or No.

See “Line Backup” on page 7-1 for more

information.

❥

The Send Authentication pull-down menu lets

you select PAP, CHAP, or None.

Selecting PAP or CHAP allows you to enter your

authentication credentials for both sending and

receiving connections.

PAP requires a User Name and Password;

CHAP requires a Host Name and Secret.

The screen changes to accommodate your

selection.

Return to the Add Connection Proﬁle screen by pressing Escape.

5. Select IP Proﬁle Parameters and press Return. The IP Proﬁle Parameters screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-27

IP Profile Parameters

Address Translation Enabled:

Yes

IP Addressing...

Numbered

NAT Map List...

Easy-PAT List

Easy-Servers

NAT Server List...

Local WAN IP Address:

Local WAN IP Mask:

0.0.0.0

Filter Set...

Remove Filter Set

RIP Profile Options...

6. Toggle or enter any IP Parameters you require and return to the Add Connection Proﬁle screen by pressing

Escape. For more information, see “IP Setup” on page 6-2.

7. Select COMMIT and press Return. Your new Connection Proﬁle will be added.

If you want to view the Connection Proﬁles in your device, return to the WAN Conﬁguration screen, and

select Display/Change Connection Proﬁle. The list of Connection Proﬁles is displayed in a scrolling pop-up

screen.

WAN Configuration

+-Profile Name---------------------IP Address------+

+--------------------------------------------------+

| Easy Setup Profile

255.225.255.255 |

| Profile 1

0.0.0.0

+--------------------------------------------------+

Download from Www.Somanuals.com. All Manuals Search And Download.

2-28 Firmware User Guide

The Default Proﬁle

If you are using RFC1483 data link encapsulation, the Default Proﬁle screen controls whether or not the DSL

link will come up without an explicitly conﬁgured connection proﬁle. (PPP datalink encapsulation does not

support a default proﬁle, and the corresponding menu item is unavailable.) See “Connection Proﬁles” on

page 6-32 for more information.

You access the Default Proﬁle screen from the Main Menu by selecting WAN Conﬁguration and then selecting

Default Proﬁle.

WAN

Configuration

Main

WAN

Default Profile

The Default Proﬁle screen appears.

WAN Default Profile

Must Match a Defined Profile:

IP Parameters...

■

You can set Must Match a Deﬁned Proﬁle item to Yes or No (the default). This item controls whether or

not the DSL link will come up without an explicitly conﬁgured connection proﬁle. If your ISP is serving you a

dynamic IP Address, you need not explicitly conﬁgure a connection proﬁle, and the default behavior of the

router will be to connect automatically once it is powered on.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-29

IP parameters (default proﬁle) screen

If you are using RFC1483 datalink encapsulation, the IP Parameters (Default Proﬁle) screen allows you to

conﬁgure various IP parameters for DSL connections established without an explicitly conﬁgured connection

proﬁle:

IP Parameters (Default Profile)

Address Translation Enabled:

Filter Set (Firewall)...

Remove Filter Set

Receive RIP:

Transmit RIP:

Both

Off

Return/Enter accepts * Tab toggles * ESC cancels.

For an DSL link, Network Address Translation (NAT) is disabled by default in the Default Proﬁle. You can enable

it by toggling to Yes. For details on setting up IP Parameters see “IP Setup” on page 6-2.

Scheduled Connections

Scheduled connections are useful for PPPoE, PPTP, and ATMP connection proﬁles.

To go to the Scheduled Connections screen, from the WAN Conﬁguration screen select Advanced Connection

Options and then select Scheduled Connections.

WAN

Configuration

Advanced

Connection Options

Main

Scheduled

Connections

Download from Www.Somanuals.com. All Manuals Search And Download.

2-30 Firmware User Guide

Scheduled Connections

Display/Change Scheduled Connection...

Add Scheduled Connection...

Delete Scheduled Connection...

Navigate from here to add/modify/change/delete Scheduled Connections.

Viewing scheduled connections

To display a table of scheduled connections, select Display/Change Scheduled Connection in the Scheduled

Connections screen. Each scheduled connection occupies one row of the table.

Scheduled Connections

+-Days----Begin At---HH:MM---When----Conn. Prof. Name----Enabled-----+

+--------------------------------------------------------------------+

| mtWtfss 08:30PM

06:00 weekly Profile 01

+--------------------------------------------------------------------+

The ﬁrst column in the table shows a one-letter representation of the Days of the week, from Monday (M or m)

to Sunday (S or s). If a letter representing a day is capitalized, the connection will be activated on that day; a

lower-case letter means that the connection will not be activated on that day. If the scheduled connection is

conﬁgured for a once-only connection, the word “once” will appear instead of the days of the week.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-31

The other columns show:

■

The time of day that the connection will Begin At

The duration of the connection (HH:MM)

Whether it’s a recurring Weekly connection or used Once Only

Which connection proﬁle (Conn. Prof.) is used to connect

Whether the scheduled connection is currently Enabled

The router checks the date and time set in scheduled connections against the system date and time.

Adding a scheduled connection

To add a new scheduled connection, select Add Scheduled Connection in the Scheduled Connections screen

and press Return. The Add Scheduled Connection screen appears.

Add Scheduled Connection

Scheduled Connection Enable:

How Often...

Weekly

Forced

Schedule Type...

Set Weekly Schedule...

Use Connection Profile...

ADD SCHEDULED CONNECTION

CANCEL

Scheduled Connections dial remote Networks on a Weekly or Once-Only basis.

Follow these steps to conﬁgure the new scheduled connection:

■

To activate the connection, select Scheduled Connection Enable and toggle it to On. You can make the

scheduled connection inactive by toggling Scheduled Connection Enable to Off.

Decide how often the connection should take place by selecting How Often and choosing Weekly or Once

Only from the pop-up menu.

The Schedule Type allows you to set the exact weekly schedule or once-only schedule.

Options are:

■

Forced Up, meaning that this connection will be maintained whether or not there is a demand call on

the line.

Forced Down, meaning that this connection will be torn down or blocked whether or not there is a

Download from Www.Somanuals.com. All Manuals Search And Download.

2-32 Firmware User Guide

demand call on the line.

■

Demand-Allowed, meaning that this schedule will permit a demand call on the line.

Demand-Blocked, meaning that this schedule will prevent a demand call on the line.

Periodic, meaning that the connection is retried several times during the scheduled time.

■

If How Often is set to Weekly, the item directly below How Often reads Set Weekly Schedule. If How Often

is set to Once Only, the item directly below How Often reads Set Once-Only Schedule.

Set Weekly Schedule

If you set How Often to Weekly, select Set Weekly Schedule and go to the Set Weekly Schedule screen.

■

Select the days for the scheduled connection to occur and toggle them to Yes.

Set Weekly Schedule

Monday:

Tuesday:

Wednesday:

Thursday:

Friday:

Saturday:

Sunday:

Scheduled Window Start Time:

AM or PM:

11:50

Scheduled Window Duration Per Day:

00:00

■

Select Scheduled Window Start Time and enter the time to initiate the scheduled connection.

You must enter the time in the format H:M, where H is a one- or two-digit number representing the hour and

M is a one- or two-digit number representing the minutes. The colon is mandatory. For example, the entry

1:3 (or 1:03) would be accepted as 3 minutes after one o’clock. The entry 7:0 (or 7:00) would be accepted

as seven o’clock, exactly. The entries 44, :5, and 2: would be rejected.

■

Select AM or PM and choose AM or PM from the pop-up menu.

Select Scheduled Window Duration Per Day and enter the maximum duration allowed for this scheduled

connection, per call.

You are ﬁnished conﬁguring the weekly options. Return to the Add Scheduled Connection screen to

continue.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-33

Set Once-Only Schedule

If you set How Often to Once Only, select Set Once-Only Schedule and go to the Set Once-Only Schedule

screen.

Set Once-Only Schedule

Place Call on (MM/DD/YY):

05/07/1998

Scheduled Window Start Time:

AM or PM:

11:50

Scheduled Window Duration:

00:00

■

Select Place Call On (Date) and enter a date in the format MM/DD/YY or MM/DD/YYYY (month, day,

year).

Note: You must enter the date in the format speciﬁed. The slashes are mandatory. For example, the entry

5/7/98 would be accepted as May 7, 1998. The entry 5/7 would be rejected.

Select Scheduled Window Start Time and enter the time to initiate the scheduled connection.

Note: You must enter the time in the format H:M, where H is a one- or two-digit number representing the

hour and M is a one- or two-digit number representing the minutes. The colon is mandatory. For example,

the entry 1:3 (or 1:03) would be accepted as 3 minutes after one o’clock. The entry 7:0 (or 7:00) would be

accepted as seven o’clock, exactly. The entries 44, :5, and 2: would be rejected.

■

Select AM or PM and choose AM or PM.

Select Scheduled Window Duration and enter the maximum duration allowed for this scheduled

connection. Use the same format restrictions noted above.

You are ﬁnished conﬁguring the once-only options. Return to the Add Scheduled Connection screen to continue.

■

In the Add Scheduled Connection screen, select Use Connection Proﬁle and choose from the list of

connection proﬁles you have already created. A scheduled connection must be associated with a

connection proﬁle to be useful. The connection proﬁle becomes active during the times speciﬁed in the

associated scheduled connection, if any exists.

■

Select ADD SCHEDULED CONNECTION to save the current scheduled connection. Select CANCEL to exit

the Add Scheduled Connection screen without saving the new scheduled connection.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-34 Firmware User Guide

Modifying a scheduled connection

To modify a scheduled connection, select Display/Change Scheduled Connection in the Scheduled

Connections screen to display a table of scheduled connections.

Select a scheduled connection from the table and press Return. The Change Scheduled Connection screen

appears. The parameters in this screen are the same as the ones in the Add Scheduled Connection screen

(except that ADD SCHEDULED CONNECTION and CANCEL do not appear). To ﬁnd out how to set them, see

“Adding a scheduled connection” on page 2-31.

Deleting a scheduled connection

To delete a scheduled connection, select Delete Scheduled Connection in the Scheduled Connections screen

to display a table of scheduled connections.

Select a scheduled connection from the table and press the Return key to delete it. To exit the table without

deleting the selected scheduled connection, press the Escape key.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-35

System Conﬁguration Screens

System conﬁguration features

The Netopia Firmware Version 5.4 default settings may be all you need to conﬁgur e your Router. Some users,

however, require advanced settings or prefer manual contr ol over the default selections. For these users,

Netopia Firmware Version 5.4 provides system conﬁguration options.

“IP Setup” on page 2-36

“Filter Sets” on page 2-36

“IP Address Se r v ing” on page 2-36

“Date and time” on page 2-42

“Network Address Translation (NAT)” on page 2-36

“Stateful Inspection ﬁrewall” on page 2-37

“Console Conﬁguration” on page 2-43

“SNMP (Simple Network Management Protocol)”

on page 2-43

“Upgrade Feature Set” on page 2-43

“Logging” on page 2-46

“Security” on page 2-43

“RFC-1483 Transparent Bridging” on page 2-44

To help you determine whether you need to use the system conﬁguration options, review the following

requirements. If you have one or more of these needs, use the system conﬁguration options described in later

chapters.

■

System conﬁguration of dynamic IP address distribution through DHCP or BootP

Greater network security through the use of ﬁlters

Use of Network Time Protocol

To access the system conﬁguration screens, select System Conﬁguration in the Main Menu, then press

Return.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-36 Firmware User Guide

The System Conﬁguration menu screen appears:

System Configuration

IP Setup...

Filter Sets...

IP Address Serving...

Network Address Translation (NAT)...

Date and Time...

Console Configuration...

SNMP (Simple Network Management Protocol)...

Security...

Upgrade Feature Set...

Change Device to a Bridge...

Logging...

Use this screen if you want options beyond Easy Setup.

IP Setup

These screens allow you to conﬁgure your network’s use of the IP networking protocol.

■

Details are given in “IP Setup” on page 6-2 .

Filter Sets

These screens allow you to conﬁgure security on your network by means of ﬁlter sets and a basic ﬁrewall.

■

Details are given in “Security” on page 10-1 .

IP Address Serving

These screens allow you to conﬁgure IP address serving on your network by means of DHCP, WANIP, and BootP.

■

Details are given in “IP Address Se r v ing” on page 6-17 .

Network Address Translation (NAT)

These screens allow you to conﬁgure the Multiple Network Address Translation (MultiNAT) features.

■

Details are given in “Multiple Network Address Translation” on page 3-1.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-37

Stateful Inspection ﬁrewall

Stateful inspection ﬁrewall is a security feature that prevents unsolicited inbound access when NAT is disabled.

You can conﬁgure UDP and TCP “no-activity” periods that will also apply to NAT time-outs if stateful inspection is

enabled on the interface. Stateful Inspection parameters are active on a WAN interface only if enabled on your

Gateway. Stateful inspection can be enabled on a proﬁle whether NAT is enabled or not.

Stateful Inspection

UDP no-activity timeout (sec):

TCP no-activity timeout (sec):

Add Exposed Address List...

180

14400

Exposed Address Associations...

Return/Enter goes to new screen.

Return/Enter to configure Xposed IP addresses.

■

UDP no-activity time-out: The time in seconds after which a UDP session will be terminated, if there is no

trafﬁc on the session.

TCP no-activity time-out: The time in seconds after which an TCP session will be terminated, if there is no

trafﬁc on the session.

Exposed Addresses: The hosts speciﬁed in Exposed addresses will be allowed to receive inbound trafﬁc

even if there is no corresponding outbound trafﬁc. This is active only if NAT is disabled on an WAN

interface.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-38 Firmware User Guide

Stateful Inspection Options

Enable and conﬁgure stateful inspection on a WAN interface.

IP Profile Parameters

Address Translation Enabled:

IP Addressing...

Yes

Numbered

NAT Map List...

Easy-PAT List

Easy-Servers

NAT Server List...

NAT Options...

Stateful Inspection Enabled:

Local WAN IP Address:

Local WAN IP Mask:

0.0.0.0

Filter Set...

Remove Filter Set

RIP Profile Options...

Return/Enter to select <among/between> ...

Configure IP requirements for a remote network connection here.

When you create or modify a Connection Proﬁle, the IP Proﬁle Parameters screen allows you to enable Stateful

Inspection on that proﬁle by toggling Stateful Inspection Enabled to Yes. By default, this is turned off (No). If

you enable Stateful Inspection, the Stateful Inspection Options ﬁeld appears.

IP Profile Parameters

Address Translation Enabled:

IP Addressing...

Numbered

Stateful Inspection Enabled:

Stateful Inspection Options...

Local WAN IP Address:

Yes

0.0.0.0

Local WAN IP Mask:

Filter Set...

Remove Filter Set

RIP Profile Options...

Configure IP requirements for a remote network connection here.

Select Stateful Inspection Options and press Return. The Stateful Inspection Parameters screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-39

Stateful Inspection Parameters

Max. TCP Sequence Number Difference:

Enable default mapping to router:

Deny Fragmented Packets:

Exposed Address List...

Enter max. allowed TCP sequence number difference (1 - 65535), 0 to disable.

■

Max. TCP Sequence Number Difference: Enter a value in this ﬁeld. This value represents the maximum

sequence number difference allowed between subsequent TCP packets. If this number is exceeded, the

packet is dropped. The acceptable range is 0 – 65535. A value of 0 (zero) disables this check.

Enable default mapping to router: This is disabled by default. Toggling this option to Yes will allow the

router to respond to trafﬁc received on this interface, for example, ICMP Echo requests.

Note: If Stateful Inspection is enabled on a base connection proﬁle (for example, for PPP, RFC1483

bridged/routed, or PPPoE), Enable default mapping to router must be yes to allow inbound VPN terminations.

(for example. for PPTP/ATMP client access to the router)

■

Deny Fragmented Packets: Toggling this option to Yes causes the router to discard fragmented packets on

this interface.

■

You can apply these parameters to your Exposed Address lists by selecting your Exposed Address List

from the pop-up menu,

Download from Www.Somanuals.com. All Manuals Search And Download.

2-40 Firmware User Guide

Stateful Inspection Parameters

+Exposed Address List N+

+----------------------+

Max. TCP Sequ| my_xposed_list

| 0

| <<None>>

Enable defaul|

| No

Deny Fragment|

| No

Exposed Addre|

+----------------------+

Up/Down Arrows to select, then Return/Enter; ESC to cancel.

Exposed Addresses

You can specify the IP addresses you want to expose by selecting Add Exposed Address List and pressing

Return. The Add Exposed Address List screen appears.

Add Exposed Address List

Exposed Address List Name:

my_xposed_addr_list

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes.

Add, Edit, or delete exposed addresses options are active only if NAT is disabled on an WAN interface. The

hosts speciﬁed in exposed addresses will be allowed to receive inbound trafﬁc even if there is no

corresponding outbound trafﬁc.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-41

Change Exposed Address Range ("my_xposed_list")

First Exposed Address:

Last Exposed Address:

Protocol...

192.168.1.10

+-------------+

| TCP and UDP |

| TCP

| UDP

| ANY

Port Start:

Port End:

+-------------+

CHANGE EXPOSED ADDRESS RANGE

CANCEL

■

Start Address: Start IP Address of the exposed host range.

End Address: End IP Address of the exposed host range

Protocol: Select the Protocol of the trafﬁc to be allowed to the host range from the pull-down menu.

Options are Any, TCP, UDP, or TCP/UDP.

■

Start Port: Start port of the range to be allowed to the host range. The acceptable range is from 1 - 65535

End Port: Protocol of the trafﬁc to be allowed to the host range. The acceptable range is from 1 - 65535

You can edit or delete exposed address lists by selecting Show/Change Exposed Address List or Delete

Exposed Address List. A list of previously conﬁgured exposed addresses appears.

Add Exposed Address List

+------Exposed Address Range---------Protocol-------------------+

+---------------------------------------------------------------+

| 192.168.1.10

192.168.1.12

TCP and UDP

+---------------------------------------------------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

This allows you to select an exposed address list for editing or deletion.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-42 Firmware User Guide

Date and time

You can set the system’s date and time parameters in the Set Date and Time screen.

Select Date and Time in the System Conﬁguration screen and press Return. The Set Date and Time screen

appears.

Set Date and Time

NTP (Network Time Prot.) Enabled: On

Time Server Host Name/IP Address 204.152.184.72

Time Zone...

GMT -8:00 Pacific Standard Time

0:00

NTP Update Interval (HHHH:MM)

System Date Format:

System Time Format:

MM/DD/YY

AM/PM

Follow these steps to set the system’s date and time:

1. Toggle NTP (Network Time Prot.) Enabled to On to synchronize the Router’s time and date with a network

server. Toggle this ﬁeld to Off to manually set the time and date; the options in this screen will change to

allow you to manually enter the time and date parameters.

Note: If time and date are manually set, that information will be lost upon reboot or loss of power.

2. Enter the IP address of the time server in the ﬁeld Time Server Host Name/IP Address.

3. Select the Router’s time zone from the Time Zone pop-up menu and press Return.

4. In the NTP Update Interval ﬁeld, enter how often to synchronize with the time server, using the format

HHHH:MM where H is hours and M is minutes.

5. Select a System Date Format; the options are MM/DD/YY, DD/MM/YY, and YY/MM/DD, where M is

month, D is day, and Y is year.

6. Select a System Time Format, either AM/PM or 24hrs.

7. Press Escape to return to the System Conﬁguration menu.

Note: NTP can be blocked by some ﬁrewall conﬁgurations. To ensure that this feature works, create a ﬁlterset

rule to allow UDP port 123 to be open.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-43

Console Conﬁguration

You can change the default terminal communications parameters to suit your requirements.

To go to the Console Conﬁguration screen, select Console Conﬁguration in the System Conﬁguration screen.

Console Configuration

Baud Rate...

57600

SET CONFIG NOW

CANCEL

Follow these steps to change a parameter’s value:

1. Select 57600, 38400, 19200, or 9600.

2. Select SET CONFIG NOW to save the new parameter settings. Select CANCEL to leave the parameter

unchanged and exit the Console Conﬁguration screen.

SNMP (Simple Network Management Protocol)

These screens allow you to monitor and conﬁgure your network by means of a standard Simple Network

Management Protocol (SNMP) agent.

■

Details are given in “Simple Network Management Protocol (SNMP) - V2c” on page 9-10.

Security

These screens allow you to add users and deﬁne passwords on your network.

■

Details are given in “Security” on page 10-1.

Upgrade Feature Set

You can upgrade your Router by adding new feature sets through the Upgrade Feature Set utility.

See the release notes that came with your router or feature set upgrade, or visit the Netopia Web site at

www.netopia.com for information on new feature sets, how to obtain them, and how to install them on your

Router.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-44 Firmware User Guide

RFC-1483 Transparent Bridging

This feature allows you to turn off the routing features and use your device as a bridge. If you select this option,

the device will restart itself, and reset all the settings to factory defaults. Any conﬁgurations you have made will

be erased. Use this feature with caution. If you decide to reinstate the routing capabilities, you must reconﬁgure

the device from scratch.

From the Main Menu, select System Conﬁguration.

System Configuration

IP Setup...

Filter Sets...

IP Address Serving...

Network Address Translation (NAT)...

Date and Time...

Console Configuration...

SNMP (Simple Network Management Protocol)...

Security...

Upgrade Feature Set...

Change Device to a Bridge...

Logging...

Use this screen if you want options beyond Easy Setup.

Select Change Device to a Bridge and press Return. You will be challenged to conﬁrm this choice.

+----------------------------------------------------+

| This change requires a reboot and will result

| in Factory Defaulting the device.

CANCEL

CONTINUE

+----------------------------------------------------+

If you chose CONTINUE, the device will reboot and restart in bridge mode. Routing features will be disabled and

the console menus corresponding conﬁguration items, such as Easy Setup, will be removed.

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-45

Netopia Router

WAN Configuration...

System Configuration...

Utilities & Diagnostics...

Statistics & Logs...

Quick View...

You can reinstate router mode by returning to the System Conﬁguration menu.

System Configuration

Management IP Setup...

Filter Sets...

Date and Time...

Console Configuration...

SNMP (Simple Network Management Protocol)...

Security...

Upgrade Feature Set...

Change Device to a Router...

Logging...

Use this screen if you want options beyond Easy Setup.

Select Change Device to a Router.

Press Return, conﬁrm your choice, and the device will restart in router mode.

^{Bridged Frame-Relay.}Note: Netopia Firmware Version 5.4 now supports additional Frame Relay conﬁguration

options when the Netopia device is operating in bridged mode.

Bridged Frame Relay (RFC 2427) is an extension of the existing onboard Frame Relay capability. Frame

Relay-capable Netopia routers (ex: T-1, IDSL) may be run in bridged mode, with the WAN handling Frame Relay

packets that are bridged to the Ethernet interface. For these models, LMI, multiple DLCIs, etc. can be

conﬁgured.

If you choose to run the router in bridged mode, and select Frame Relay as the data link encapsulation method

in the WAN (Wide Area Network) Setup menu, the WAN Conﬁguration menu now offers options to conﬁgure

Frame Relay and Frame Relay DLCIs.

Download from Www.Somanuals.com. All Manuals Search And Download.

2-46 Firmware User Guide

Logging

You can conﬁgure a UNIX-compatible syslog client to report a number of subsets of the events entered in the

router’s WAN Event History. See “WAN Event History” on page 9-5.

Select Logging from the System Conﬁguration menu.

The Logging Conﬁguration screen appears.

Logging Configuration

WAN Event Log Options

Log Boot and Errors:

Log Line Specific:

Log Connections:

Log PPP, DHCP, CNA:

Log IP:

Yes

Syslog Parameters

Syslog Enabled:

Hostname or IP Address:

Facility...

Local 0

By default, all events are logged in the event history.

■

By toggling each event descriptor to either Yes or No, you can determine which ones are logged and which

are ignored.

You can enable or disable the syslog client dynamically. When enabled, it will report any appropriate and

previously unreported events.

You can specify the syslog server’s address either in dotted decimal format or as a DNS name up to 63

characters.

■

You can specify the UNIX syslog Facility to use by selecting the Facility pop-up.

Erase the log by selecting DUMP WAN LOG

Download from Www.Somanuals.com. All Manuals Search And Download.

WAN and System Conﬁguration 2-47

You will need to install a Syslog client daemon program on your PC and conﬁgure it to report the WAN events

you speciﬁed in the Logging Conﬁguration screen.

The following screen shows a sample syslog dump of WAN events:

May 5 10:14:06 tsnext.netopia.com Link 1 down: PPP PAP failure

May 5 10:14:06 tsnext.netopia.com >>Issued Speech Setup Request from our DN: 5108645534

May 5 10:14:06 tsnext.netopia.com Requested Disc. from DN: 917143652500

May 5 10:14:06 tsnext.netopia.com Received Clear Confirm for our DN: 5108645534

May 5 10:14:06 tsnext.netopia.com Link 1 down: Manual disconnect

May 5 10:14:06 tsnext.netopia.com >>Issued Speech Setup Request from our DN: 5108645534

May 5 10:14:06 tsnext.netopia.com Requested Disc. from DN: 917143652500

May 5 10:14:06 tsnext.netopia.com Received Clear Confirm for our DN: 5108645534

May 5 10:14:06 tsnext.netopia.com Link 1 down: No answer

May 5 10:14:06 tsnext.netopia.com --Device restarted-----------------------------------------

May 5 10:14:06 tsnext.netopia.com >>Received Speech Setup Ind. from DN: (not supplied)

May 5 10:14:06 tsnext.netopia.com Requested Connect to our DN: 5108645534

May 5 10:14:06 tsnext.netopia.com ASYNC: Modem carrier detected (more) Modem

reports: 26400 V34

May 5 10:14:06 tsnext.netopia.com >>WAN: 56K Modem 1 activated at 115 Kbps

May 5 10:14:06 tsnext.netopia.com Connect Confirmed to our DN: 5108645534

May 5 10:14:06 tsnext.netopia.com PPP: Channel 1 up, Answer Profile name: Default Profile

May 5 10:14:06 tsnext.netopia.com PPP: NCP up, session 1, Channel 1 Final (fallback)

negotiated auth: Local PAP , Remote NONE

May 5 10:14:06 tsnext.netopia.com PPP: PAP we accepted remote, Channel 1 Remote name: guest

May 5 10:14:06 tsnext.netopia.com PPP: MP negotiated, session 1 Remote EDO: 06 03 0

000C5700624 0

May 5 10:14:06 tsnext.netopia.com PPP: CCP negotiated, session 1, type: Ascend

LZS Local mode: 1, Remote mode: 1

May 5 10:14:06 tsnext.netopia.com PPP: BACP negotiated, session 1 Local MN: FFFFFF

FF, Remote MN: 00000001

May 5 10:14:06 tsnext.netopia.com PPP: IPCP negotiated, session 1, rem:

192.168.10.100 local: 192.168.1.1

May 5 10:14:06 tsnext.netopia.com >>WAN: 56K Modem 1 deactivated

May 5 10:14:06 tsnext.netopia.com Received Clear Ind. from DN: 5108645534, Cause: 0

May 5 10:14:06 tsnext.netopia.com Issued Clear Response to DN: 5108645534

May 5 10:14:06 tsnext.netopia.com Link 1 down: Remote clearing

May 5 10:14:06 tsnext.netopia.com PPP: IPCP down, session 1

May 5 10:14:06 tsnext.netopia.com >>Received Speech Setup Ind. from DN: (not supplied)

Download from Www.Somanuals.com. All Manuals Search And Download.

2-48 Firmware User Guide

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-1

Chapter 3

Multiple Network Address Translation

Netopia Firmware Version 5.4 offers advanced Multiple Network Address Translation functionality.

You should read this chapter completely before attempting to conﬁgure any of the advanced NAT features.

This chapter covers the following topics:

■

Overview on page 3-1

MultiNAT Conﬁguration on page 3-6

Easy Setup Proﬁle conﬁguration on page 3-6

Server Lists and Dynamic NAT conﬁguration on page 3-7

Adding Se r v er Lists on page 3-15

Binding Map Lists and Server Lists on page 3-21

NAT Associations on page 3-25

IP Passthrough on page 3-27

MultiNAT Conﬁguration Example on page 3-31

Overview

NAT (Network Address Translation) is a means of mapping one or more IP addresses and/or IP service ports

into different values. This mapping serves two functions:

■

It allows the addresses of many computers on a LAN to be represented to the public Internet by only one or

a few addresses, saving you money.

■

It can be used as a security feature by obscuring the true addresses of important machines from potential

hackers on the Internet.

To help you understand some of the concepts discussed here, it may be helpful to introduce some NAT

terminology.

The term mapping refers to rules that associate one or more private addresses on the Netopia Router’s LAN to

one or more public addresses on the Netopia Routers WAN interface (typically the Internet).

The terms private and internal refer to addresses on the Netopia Router’s LAN. These addresses are

considered private because they are protected or obscured by NAT and cannot be directly accessed from the

WAN (or Internet) side of the Netopia Router unless speciﬁcally conﬁgured otherwise.

The terms public and external refer to the WAN (or Internet) side of the Netopia Router.

Download from Www.Somanuals.com. All Manuals Search And Download.

3-2 Firmware User Guide

Features

MultiNAT features can be divided into several categories that can be used simultaneously in different

combinations on a per-Connection Proﬁle basis.

The following is a general description of these features:

Port Address Translation

The simplest form of classic Network Address Translation is PAT (Port Address Translation). PAT allows a group

of computers on a LAN, such as might be found in a home or small ofﬁce, to share a single Internet connection

using one IP address. The computers on the LAN can surf the Web, read e-mail, download ﬁles, etc., but their

individual IP addresses are never exposed to the public network. Instead, a single IP address acts as the

source IP address of trafﬁc originating from the LAN. The Netopia Router allows you to deﬁne multiple PAT

mappings, which can be individually mapped to different public IP addresses. This offers more control over the

access permitted to users on the LAN.

A limitation of PAT is that communication must be initiated from the internal network. A user on the external

side cannot access a machine behind a PAT connection. A PAT enhancement is the ability to deﬁne multiple PAT

mappings. Each of these can optionally map to a section or range of IP addresses of the internal network. PAT

mapping allows only internal users to initiate trafﬁc ﬂow between the internal and external networks.

Server lists

Server lists, previously known as exported services, make it possible to provide access from the public network

to hosts on the LAN. Server lists allow you to deﬁne particular services, such as Web, ftp, or e-mail, which are

available via a public IP address. You deﬁne the type of service you would like to make available and the

internal IP address to which you would like to provide access. You may also deﬁne a speciﬁc public IP address

to use for this service if you want to use an IP other than the WAN IP address of the Netopia Router.

Static mapping

If you want to host your own Website or provide other Internet services to the public, you need more than

classic NAT. The reason is noted under Port Address Translation above – external users cannot initiate trafﬁc to

computers on your LAN because external users can never see the real addresses of the computers on your

LAN. If you want users outside your LAN to have access, for example, to a Web or FTP server that you host, you

need to make a public representation of the real IP addresses of those servers.

Static mappings are a way to make one or more private IP addresses fully accessible from the public network

via corresponding public IP addresses. Some applications may negotiate multiple TCP connections in the

process of communication, which often does not work with traditional PAT. Static mapping offers the ability to

use these applications through NAT. Each private IP address is mapped, on a one-to-one basis, to a public IP

address that can be accessed from the Internet or public network. As with PAT mappings, you may have multiple

static mappings to map a range of private IP addresses to a range of public IP addresses if desired.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-3

Dynamic mapping

Dynamic mapping, often referred to as many-to-few, offers an extension to the advantages provided by static

mapping. Instead of requiring a one-to-one association of public addresses and private addresses, as is

required in static mapping, dynamic mapping uses a group of public IP addresses to dynamically allocate static

mappings to private hosts that are communicating with the public network. If a host on the private network

initiates a connection to the Internet, for example, the Netopia Router automatically sets up a one-to-one

mapping of that host’s private IP address to one of the public IP addresses allocated to be used for Dynamic

NAT. As long as this host is communicating with the Internet, it will be able to use that address. When trafﬁc

from that host ceases, and no trafﬁc is passed from that host for ﬁve minutes, the public address is made

available again for other private hosts to use as necessary.

When addresses are returned to the group of available addresses, they are returned to the head of the group,

being the most recently used. If that same host requests a connection an hour later, and the same public

address is still available, then it will be mapped to the same private host. If a new host, which has not

previously requested a connection, initiates a connection it is allocated the last, or oldest, public address

available.

Dynamic NAT is a way of sharing a range of public, or exterior, NAT addresses among one or more groups of

private, or interior, hosts. This is intended to provide superior support for applications that traditionally have

difﬁculty communicating through NAT. Dynamic NAT is intended to provide functionality beyond many-to-one and

one-to-one translation. Netopia’s NAT implementation makes it possible to have a static mapping of one public

address to one private address, thus allowing applications such as NetMeeting to work by assuring that any

trafﬁc sent back to the source IP address is forwarded through to the internal machine.

Static one-to-one mapping works well if you have enough IP addresses for all the workstations on your LAN. If

you do not, Dynamic NAT allows machines to make full use of the publicly routable IP addresses provided by the

ISP as necessary, on demand. When these public IP addresses are no longer being used by a particular

workstation, they are returned to a pool of available addresses for other workstations to use.

A common example is a DSL customer’s application. Most DSL ISPs only provide customers with a few IP

addresses for use on their network. For networks with more than four or ﬁve machines it is usually mandatory to

use NAT. A customer may have 15 workstations on the LAN, all of which need Internet access. The customer is

only provided ﬁve IP addresses by their ISP. The customer has eight hosts, which only need to use email and

have Web access, but another seven hosts, which use NetMeeting to communicate with clients once or twice a

day. NetMeeting will not work unless a static one-to-one mapping exists for the machine running NetMeeting to

use for communication. The customer does not have enough IP addresses to create a one-to-one mapping for

each of the seven users. This is where dynamic NAT applies.

The customer can conﬁgure four of these addresses to be used for Dynamic NAT. The ﬁfth address is then used

for the eight other machines that do not need one-to-one mappings. As each machine conﬁgured to use

addresses from the dynamic pool tries to connect to the Internet it is allocated a public IP address to use

temporarily. Once the communication has been terminated, that IP address is freed for one of the other six

hosts to use.

Download from Www.Somanuals.com. All Manuals Search And Download.

3-4 Firmware User Guide

Available for Dynamic NAT

Used for Normal NAT

WAN Network

Network Address Translation

LAN Network

Exterior addresses are allocated to internal hosts on a demand, or as-needed, basis and then made available

when trafﬁc from that host ceases. Once an internal host has been allocated an address, it will use that

address for all trafﬁc. Five minutes after all trafﬁc ceases – no pings, all TCP connections closed, no DNS

requests, etc. – the address is put at the head of an available list. If an interior host needs an exterior address

an hour later, and the previously used address is still available, it will acquire the same address. If an interior

host that has not previously been allocated an exterior address needs one, it will be allocated the last, hence

the oldest, exterior address on the available list.

All NAT conﬁgurations are rule-based. This means that trafﬁc passed through NAT from either the public or the

private network is compared to the rules and mappings conﬁgured in the Netopia Router in a particular order.

The ﬁrst rule that applies to the trafﬁc being initiated is used.

For example, if a connection is initiated from the public network and is destined for a public IP address

conﬁgured on the Netopia Router, the following comparisons are made in this order.

1. The Netopia Router ﬁrst checks its internal NAT cache to see if the data is part of a previously initiated

connection, if not…

2. The Netopia Router checks the conﬁgured server lists to see if this trafﬁc is intended to be forwarded to an

internal host based on the type of service.

3. The Netopia Router then checks to see if there is a static, dynamic, or PAT mapping for the public IP

address that the connection is being initiated to.

4. The Netopia Router answers the request itself if the data is destined for the Netopia’s WAN interface IP

address. Otherwise the data is discarded.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-5

Complex maps

Map lists and server lists are completely independent of each other. A Connection Proﬁle can use one or the

other or both.

MultiNAT allows complex mapping and requires more complex conﬁguration than in earlier ﬁrmware versions.

Multiple mapped interior subnets are supported, and the rules for mapping each of the subnets may be

different. The ﬁgure below illustrates a possible multiNAT conﬁguration.

Public Addresses

Private Addresses IP Host

NAT Type

206.1.1.1

206.1.1.2

206.1.1.3

206.1.1.4

206.1.1.5

206.1.1.6

192.168.1.253

192.168.1.254

Web/FTP Server

E-mail Server

1:1 Static

192.168.1.1 – 252 LAN Users

LAN Users

1:1 Dynamic

1:Many PAT

}

192.168.1.1 – 252

192.168.1.1 – 252 LAN Users

206.1.2.1 – 6

(possible later)

1:1 Dynamic

In order to support this type of mapping, you deﬁne two address ranges. First, you deﬁne a public range which

contains the ﬁrst and last public address to be used and the way in which these addresses should be used

(PAT, static, or dynamic). You then conﬁgure an address map which deﬁnes the private IP address or addresses

to be used and which public range they should be mapped to. You add the address map to the list of address

maps which are conﬁgured, creating a map list. The mappings in the map list are order-dependent and are

compared in order from the top of the list to the bottom. If a particular resource is not available, subordinate

mappings can be deﬁned that will redirect trafﬁc.

Supported trafﬁc

MultiNat supports the following IP protocols:

■

PAT: TCP/UDP trafﬁc which does not carry source or destination IP addresses or ports in the data stream

(i.e., HTTP, Telnet, ‘r’ commands, tftp, NFS, NTP, SMTP, NNTP, etc.).

Static NAT: All IP protocol trafﬁc which does not carry or otherwise rely on the source or destination IP

addresses in the data stream.

Dynamic NAT: All IP protocol trafﬁc which does not carry or otherwise rely on the source or destination IP

addresses in the data stream.

Support for Microsoft Network (MSN) Messenger

Netopia Firmware Version 5.4 provides support for MSN Messenger/Windows Messenger applications via UPnP

(see UPnP Support on page 10-2). Normal plain chat always works.

Support for AOL Instant Messenger (AIM) File Transfer

Netopia Firmware Version 5.4 provides Application Level Gateway (ALG) support for AOL Instant Messenger

(AIM) ﬁle transfer. This allows AIM users to exchange ﬁles, even when both users are behind NAT. Previously,

the ﬁle transfer function would work only if one or neither of the two users were behind NAT.

Download from Www.Somanuals.com. All Manuals Search And Download.

3-6 Firmware User Guide

Currently there is a restriction that the remote user must be routed to via the WAN interface, otherwise the

connections will fail. There is no restriction as to the number of connections.

There is no user conﬁguration required for this feature.

MultiNAT Conﬁguration

You conﬁgure the MultiNAT features through the console menu:

■

For a simple 1-to-many NAT conﬁguration (classic NAT or PAT), use the Easy Setup Proﬁle conﬁguration,

described below.

■

For the more advanced features, such as server lists and dynamic NAT, follow the instructions in:

■

IP setup, described on page 3-7

■

IP proﬁle parameters, described on page 3-21

Easy Setup Proﬁle conﬁguration

The screen below is an example. Depending on the type of router you are using, ﬁelds displayed in this screen

may vary.

Connection Profile 1: Easy Setup Profile

Connection Profile Name:

Easy Setup Profile

Address Translation Enabled:

IP Addressing...

Yes

Numbered

Local WAN IP Address:

Local WAN IP Mask:

Remote IP Address:

Remote IP Mask:

0.0.0.0

255.255.255.0

127.0.0.2

255.255.255.255

PPP Authentication...

PAP

Send User Name:

Send Password:

tonyf

********************

PREVIOUS SCREEN

NEXT SCREEN

Return/Enter brings you to next screen.

The Local WAN IP Address is used to conﬁgure a NAT public address range consisting of the Local WAN IP

Address and all its ports. The public address map list is named Easy-PAT List and the port map list is named

Easy-Servers.

The two map lists, Easy-PAT List and Easy-Servers, are created by default and NAT conﬁguration becomes

effective.This will map all your private addresses (0.0.0.0 through 255.255.255.255) to your public address.

These map lists are bound to the Easy Setup Proﬁle. See Binding Map Lists and Server Lists on page 3-21.

This is all you need to do if you want to continue to use a single PAT, or 1-to-many, NAT conﬁguration.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-7

Server Lists and Dynamic NAT conﬁguration

You use the advanced NAT feature sets by ﬁrst deﬁning a series of mapping rules and then grouping them into

a list. There are two kinds of lists -- map lists, made up of dynamic, PAT and static mapping rules, and server

lists, a list of internal services to be presented to the external world. Creating these lists is a four-step process:

1. Deﬁne the public range of addresses that external computers should use to get to the NAT internal

machines. These are the addresses that someone on the Internet would see.

2. Create a List name that will act as a rule or server holder.

3. Create a map or rule that speciﬁes the internal range of NATed addresses and the external range they are

to be associated with.

4. Associate the Map or Server List to your WAN interface via a Connection Proﬁle or the Default Proﬁle.

The three NAT features all operate completely independently of each other, although they can be used

simultaneously on the same Connection Proﬁle.

You can conﬁgure a simple 1-to-many PAT (often referred to simply as NAT) mapping using Easy Setup. More

complex setups require conﬁguration using the Network Address Translation item on the IP Setup screen.

An example MultiNAT conﬁguration at the end of this chapter describes some applications for these features.

See the MultiNAT Conﬁguration Example on page 3-31.

In order to conﬁgure the router to make servers on your LAN visible to the Internet, you use advanced features

in the System Conﬁguration screens, described in IP setup.

IP setup

To access the NAT conﬁguration screens, from the Main Menu navigate to IP Setup:

System

Configuration

Main

Setup

Download from Www.Somanuals.com. All Manuals Search And Download.

3-8 Firmware User Guide

IP Setup

Ethernet IP Address:

192.168.1.1

Ethernet Subnet Mask:

255.255.255.0

Define Additional Subnets...

Default IP Gateway:

127.0.0.2

Primary Domain Name Server:

Secondary Domain Name Server:

Domain Name:

0.0.0.0

isp.com

Receive RIP...

Transmit RIP...

Both

Off

Static Routes...

IP Address Serving...

Network Address Translation (NAT)...

Set up the basic IP attributes of your Netopia in this screen.

Select Network Address Translation (NAT) and press Return.

The Network Address Translation screen appears.

Network Address Translation

Add Public Range...

Show/Change Public Range...

Delete Public Range...

Add Map List...

Show/Change Map List...

Delete Map List...

Add Server List...

Show/Change Server List...

Delete Server List...

NAT Associations...

Return/Enter to configure IP Address redirection.

Public Range deﬁnes an external address range and indicates what type of mapping to apply when using this

range. The types of mapping available are dynamic, static and pat.

Map Lists deﬁne collections of mapping rules. A rule maps interior range addresses to exterior range

addresses by the mapping techniques deﬁned in the map list.

Server Lists bind internal IP addresses and ports to external IP addresses and ports so that connections

initiated from the outside can access an interior server.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-9

NAT rules

The following rules apply to assigning NAT ranges and server lists:

■

Static public address ranges must not overlap other static, PAT, public addresses, or the public address

assigned to the router’s WAN interface.

■

A PAT public address must not overlap any static address ranges. It may be the same as another PAT

address or server list address, but the port range must not overlap.

You conﬁgure the ranges of exterior addresses by ﬁrst adding public ranges.

Select Add Public Range and press Return.

The Add NAT Public Range screen appears.

Add NAT Public Range

Range Name:

Type...

my_first_range

pat

Public Address:

206.1.1.6

First Public Port:

Last Public Port:

49152

65535

ADD NAT PUBLIC RANGE

CANCEL

■

Select Range Name and give a descriptive name to this range.

Select Type and from the pop-up menu, assign its type. Options are static, dynamic, or pat (the default).

■

If you choose pat as the range type, select Public Address and enter the exterior IP address in the

range you want to assign. Select First and Last Public Port and enter the ﬁrst and last exterior ports

in the range. These are the ports that will be used for trafﬁc initiated from the private LAN to the out-

side world.

Note: For PAT map lists and server lists, if you use the Public Address 0.0.0.0, the list will acquire its public IP

address from the WAN IP address speciﬁed by your WAN IP conﬁguration in the Connection Proﬁle. If that is a

static IP address, then the PAT map list and server lists will acquire that address. If it is a negotiated IP

address, such as may be assigned via DHCP or PPP, the PAT map list and server lists will acquire that address

each time it is negotiated.

■

If you choose dynamic as the range type, a new menu item, First Public Address, becomes visible.

Select First Public Address and enter the ﬁrst exterior IP address in the range you want to assign.

Select Last Public Address and enter an IP address at the end of the range.

■

If you choose static as the range type, a new menu item, First Public Address, becomes visible.

Download from Www.Somanuals.com. All Manuals Search And Download.

3-10 Firmware User Guide

Select First Public Address and enter the ﬁrst exterior IP address in the range you want to assign.

Select Last Public Address and enter an IP address at the end of the range.

■

Select ADD NAT PUBLIC RANGE and press Return. The range will be added to your list and you will be

returned to the Network Address Translation screen.

Once the public ranges have been assigned, the next step is to bind interior addresses to them. Because these

bindings occur in ordered lists, called map lists, you must ﬁrst deﬁne the list, then add mappings to it.

From the Network Address Translation screen select Add Map List and press Return.

The Add NAT Map List screen appears.

Add NAT Map List

Map List Name:

Add Map...

my_map

■

Select Map List Name and enter a descriptive name for this map list. A new menu item, Add Map,

appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-11

Select Add Map and press Return. The Add NAT Map screen appears.

■

Add NAT Map ("my_map")

First Private Address:

192.168.1.1

Last Private Address:

192.168.1.254

Use NAT Public Range...

ADD NAT MAP

CANCEL

■

Select First and Last Private Address and enter the ﬁrst and last interior IP addresses you want to assign

to this mapping.

Select Use NAT Public Range and press Return. A screen appears displaying the public ranges you have

deﬁned.

Add NAT Map ("my_map")

+-Public Address Range------------Type----Name-------------+

+----------------------------------------------------------+

| 0.0.0.0

pat

Easy-PAT

Select

| 206.1.1.6

my_first_range |

| 206.1.1.1

206.1.1.2

static my_second_range |

| <<NEW RANGE...>>

+----------------------------------------------------------+

Up/Down Arrow Keys to select, ESC to cancel, Return/Enter to Delete.

■

From the list of public ranges you deﬁned, select the one that you want to map to the interior range for this

Download from Www.Somanuals.com. All Manuals Search And Download.

3-12 Firmware User Guide

mapping and press Return.

If none of your preconﬁgured ranges are suitable for this mapping, you can select <<NEW RANGE>> and

create a new range. If you choose <<NEW RANGE>>, the Add NAT Public Range screen displays and you

can create a new public range to be used by this map. See Add NAT Public Range on page 3-9.

■

The Add NAT Map screen now displays the range you have assigned.

Add NAT Map ("my_map")

First Private Address:

Last Private Address:

192.168.1.1

192.168.1.254

Use NAT Public Range...

Public Range Type is:

my_first_range

pat

Public Range Start Address is: 206.1.1.6

ADD NAT MAP

CANCEL

■

Select ADD NAT MAP and press Return. Your mapping is added to your map list.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-13

Modifying map lists

You can make changes to an existing map list after you have created it. Since there may be more than one map

list you must select which one you are modifying.

From the Network Address Translation screen select Show/Change Map List and press Return.

■

Select the map list you want to modify from the pop-up menu.

Network Address Translation

+-NAT Map List Name--+

+--------------------+

Add Out| Easy-PAT List

Show/Ch| my_map

Delete |

Add Map|

Show/Ch|

Delete |

Add Ser|

Show/Ch|

Delete |

NAT Ass|

+--------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

The Show/Change NAT Map List screen appears.

Show/Change NAT Map List

my_map

Map List Name:

Add Map...

Show/Change Maps...

Delete Map...

Download from Www.Somanuals.com. All Manuals Search And Download.

3-14 Firmware User Guide

■

Add Map allows you to add a new map to the map list.

Show/Change Maps allows you to modify the individual maps within the list.

Delete Map allows you to delete a map from the list.

Selecting Show/Change Maps or Delete Map displays the same pop-up menu.

Show/Change NAT Map List

+---Private Address Range---------Type----Public Address Range------------+

+-------------------------------------------------------------------------+

| 192.168.1.1

192.168.1.254 pat

206.1.1.6

| 192.168.1.253 192.168.1.254 static 206.1.1.1

206.1.1.2

206.1.1.5

| 192.168.1.1

192.168.1.252 dynamic 206.1.1.3

+-------------------------------------------------------------------------+

Scroll to the map you want to modify using the arrow keys and press Return.

The Change NAT Map screen appears.

Change NAT Map ("my_map")

First Private Address:

Last Private Address:

192.168.1.253

192.168.1.254

Use NAT Public Range...

Public Range Type is:

my_second_range

static

Public Range Start Address is: 206.1.1.1

Public Range End Address is:

206.1.1.2

CHANGE NAT MAP

CANCEL

Make any modiﬁcations you need and then select CHANGE NAT MAP and press Return. Your changes will

become effective and you will be returned to the Show/Change NAT Map List screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-15

Adding Server Lists

Server lists, also known as Exports, are handled similarly to map lists. If you want to make a particular server’s

port accessible (and it isn’t accessible through other means, such as a static mapping), you must create a

server list.

Select Add Server List from the Network Address Translation screen.

The Add NAT Server List screen appears.

Add NAT Server List

Server List Name:

Add Server...

my_servers

■

Select Server List Name and type in a descriptive name. A new menu item, Add Server, appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

3-16 Firmware User Guide

■

Select Add Server and press Return. The Add NAT Server screen appears.

Add NAT Server ("my_servers")

Service...

Server Private IP Address:

Public IP Address:

192.168.1.45

206.1.1.1

ADD NAT SERVER

CANCEL

■

Select Service and press Return. A pop-up menu appears listing a selection of commonly exported

services.

Add NAT Server ("my_servers")

+-Type------Port(s)-------+

+-------------------------+

Service...

| ftp

| telnet

| smtp

Server Private IP Address:

Public IP Address:

| tftp

| gopher

| finger

| www-http 80

| pop2

| pop3

| snmp

109

110

161 - 162

| timbuktu 407

| pptp

1723

| irc

6665 - 6669 |

| Other...

+-------------------------+

CANCEL

ADD NAT SERVER

■

Choose the service you want to export and press Return.

You can choose a preconﬁgured service from the list, or deﬁne your own by selecting Other. If you select

Other, a screen is displayed that allows you to enter the port number range for your customized service.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-17

Other Exported Port

First Port Number (1..65535):

Last Port Number (1..65535):

31337

CANCEL

■

Enter the First and Last Port Number between ports 1 and 65535. Select OK and press Return. You

will be returned to the Add NAT Server screen.

■

Enter the Server Private IP Address of the server whose service you are exporting.

Since MultiNAT permits the mapping of multiple private IP addresses to multiple public IP addresses, your

ISP or corporate site’s router must be conﬁgured such that it knows that your multiple public addresses are

accessible via your router.

If you want to use static mappings to map internal servers to public addresses, your ISP or corporate site's

router must also be conﬁgured for static routes to these public addresses on the Netopia Router.

■

Enter the Public IP Address to which you are exporting the service.

Note: For PAT map lists and server lists, if you use the Public Address 0.0.0.0, the list will acquire its public IP

address from the WAN IP address speciﬁed by your WAN IP conﬁguration in the Connection Proﬁle. If that is a

static IP address, then the PAT map list and server lists will acquire that address. If it is a negotiated IP

address, such as may be assigned via DHCP or PPP, the PAT map list and server lists will acquire that address

each time it is negotiated.

■

Select ADD NAT SERVER and press Return. The server will be added to your server list and you will be

returned to the Add NAT Server List screen.

Note: In order to use CUSeeMe through the Netopia Router, you must export the ports 7648 and 7649. In

MultiNat, you may use a port range export. Without the export, CUSeeMe will fail to work. This is true unless a

static mapping is in place for the host using CUSeeMe. In that case no server list entry is necessary.

Download from Www.Somanuals.com. All Manuals Search And Download.

3-18 Firmware User Guide

Modifying server lists

Once a server list exists, you can select it for modiﬁcation or deletion.

■

Select Show/Change Server List from the Network Address Translation screen.

Select the Server List Name you want to modify from the pop-up menu and press Return.

Network Address Translation

+-NAT Server List Name-+

+----------------------+

A| my_servers

|..

+----------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

The Show/Change NAT Server List screen appears.

Show/Change NAT Server List

my_servers

Server List Name:

Add Server...

Show/Change Server...

Delete Server...

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-19

Selecting Show/Change Server or Delete Server displays the same pop-up menu.

■

Show/Change NAT Server List

+-Private Address--Public Address----Port------------+

+----------------------------------------------------+

Se| 192.168.1.254

206.1.1.6

206.1.1.5

206.1.1.4

206.1.1.3

206.1.1.1

smtp

| 192.168.1.254

Ad| 192.168.1.254

| 192.168.1.254

Sh|

De|

+----------------------------------------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

Select any server from the list and press Return. The Change NAT Server screen appears.

Change NAT Server ("My Exports")

Service...

smtp

Server Private IP Address:

Public IP Address:

192.168.1.254

206.1.1.1

CHANGE NAT SERVER

CANCEL

You can make changes to the server’s service and port or internal or external address.

Select CHANGE NAT SERVER and press Return. Your changes take effect and you are returned to the

Show/Change NAT Server List screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

3-20 Firmware User Guide

Deleting a server

To delete a server from the list, select Delete Server from the Show/Change NAT Server List menu and press

Return.

A pop-up menu lists your conﬁgured servers. Select the one you want to delete and press Return. A dialog box

asks you to conﬁrm your choice.

Show/Change NAT Server List

+-Internal Address-External Address--Port------------+

+----------------------------------------------------+

Se| 192.168.1.254

206.1.1.6

smtp

| 19+----------------------------------------------+ |

Ad| | Are you sure you want to delete this Server? | |

| |

Sh| |

| |

CANCEL

CONTINUE

De| |

| +----------------------------------------------+ |

+----------------------------------------------------+

Choose CONTINUE and press Return. The server is deleted from the list.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-21

Binding Map Lists and Server Lists

Once you have created your map lists and se r v er lists, for most Netopia Router models you must bind them to

a proﬁle, either a Connection Proﬁle or the Default Proﬁle. You do this in one of the following screens:

■

the IP proﬁle parameters screen (see below) of the Connection Proﬁle conﬁguration menu

the IP Parameters (WAN Default Proﬁle) screen (see page 3-23) of the Default Proﬁle conﬁguration menu

the Binding Map Lists and Server Lists screen (see page 3-21)

IP proﬁle parameters

To bind a map list to a Connection Proﬁle, from the Main Menu go to the WAN Conﬁguration screen then the

Display/Change Connection Proﬁle screen. From the pop-up menu list of your Connection Proﬁles, choose the

one you want to bind your map list to. Select IP Proﬁle Parameters and press Return.

WAN

Configuration

Main

Display/Change

Connection Profile

IP Profile

Parameters

The IP Proﬁle Parameters screen appears.

IP Profile Parameters

Address Translation Enabled:

Yes

IP Addressing...

Unnumbered

NAT Map List...

Easy-PAT List

Easy-Servers

NAT Server List...

Local WAN IP Address:

Local WAN IP Mask:

Remote IP Address:

Remote IP Mask:

206.1.1.6

0.0.0.0

127.0.0.2

255.255.255.255

Filter Set...

Basic Firewall

Remove Filter Set

RIP Profile Options...

Configure IP requirements for a remote network connection here.

Download from Www.Somanuals.com. All Manuals Search And Download.

3-22 Firmware User Guide

■

Select NAT Map List and press Return. A pop-up menu displays a list of your deﬁned map lists.

IP Profile Parameters

+--NAT Map List Name---+

+----------------------+

Address Trans| Easy-PAT

IP Addressing| my_map

|mbered

| <<None>>

NAT Map List.|

|sy PAT

NAT Server Li|

Local WAN IP |

Remote IP Add|

Remote IP Mas|

|7.0.0.2

|5.255.255.255

Filter Set...|

Remove Filter|

|tBIOS Filter

Receive RIP: |

|th

+----------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

■

Select the map list you want to bind to this Connection Proﬁle and press Return. The map list you selected

will now be bound to this Connection Proﬁle.

Select NAT Server List and press Return. A pop-up menu displays a list of your deﬁned server lists.

IP Profile Parameters

+-NAT Server List Name-+

+----------------------+

Address Trans| Easy-Servers

IP Addressing| my_servers

| <<None>>

|mbered

NAT Map List.|

NAT Server Li|

|sy PAT

Local WAN IP |

Remote IP Add|

Remote IP Mas|

|0.0.0

|7.0.0.2

|5.255.255.255

Filter Set...|

Remove Filter|

|tBIOS Filter

Receive RIP: |

|th

+----------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

■

Select the server list you want to bind to this Connection Proﬁle and press Return. The server list you

selected will now be bound to this Connection Proﬁle.

Note: There is no interdependency between NAT and IP Addressing. Also, the Local WAN IP Address and Mask

ﬁelds’ visibility are dependent only on the IP Addressing type.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-23

IP Parameters (WAN Default Proﬁle)

The Netopia Firmware Version 5.4 using RFC 1483 supports a WAN default proﬁle that permits several

parameters to be conﬁgured without an explicitly conﬁgured Connection Proﬁle.

The procedure is similar to the procedure to bind map lists and server lists to a Connection Proﬁle.

From the Main Menu go to the WAN Conﬁguration screen, then the Default Proﬁle screen. Select IP Parameters

and press Return.

WAN

Configuration

Main

WAN Default

Profile

IP Parameters

The IP Parameters (Default Proﬁle) screen appears.

IP Parameters (Default Profile)

Address Translation Enabled:

Yes

NAT Map List...

Easy-PAT List

Easy-Servers

NAT Server List...

Filter Set (Firewall)...

Remove Filter Set

Receive RIP:

Both

Return/Enter to select <among/between> ...

■

Toggle Address Translation Enabled to Yes.

Download from Www.Somanuals.com. All Manuals Search And Download.

3-24 Firmware User Guide

■

Select NAT Map List and press Return. A pop-up menu displays a list of your deﬁned map lists.

IP Parameters (Default Profile)

+--NAT Map List Name---+

+----------------------+

| Easy-PAT List

| my_map

Address Trans| <<None>>

NAT Map List.|

NAT Server Li|

Filter Set (F|

Remove Filter|

Receive RIP: |

|th

+----------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

■

Select the map list you want to bind to the default proﬁle and press Return. The map list you selected will

now be bound to the default proﬁle.

Select NAT Server List and press Return. A pop-up menu displays a list of your deﬁned server lists.

IP Parameters (Default Profile)

+-NAT Server List Name-+

+----------------------+

| Easy-Servers

| my_servers

Address Trans| <<None>>

NAT Map List.|

|_first_map

NAT Server Li|

Filter Set (F|

Remove Filter|

Receive RIP: |

|th

+----------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

■

Select the server list you want to bind to the default proﬁle and press Return. The server list you selected

will now be bound to the default proﬁle.

Note: There is no interdependency between NAT and IP Addressing. Also, the Local WAN IP Address and

Mask ﬁelds’ visibility are dependent only on the IP Addressing type.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-25

NAT Associations

Conﬁguration of map and server lists alone is not sufﬁcient to enable NAT for a WAN connection because map

and server lists must be linked to a proﬁle that controls the WAN interface. This can be a Connection Proﬁle, a

WAN Ethernet interface, a default proﬁle, or a default answer proﬁle. Once you have conﬁgured your map and

server lists, you may want to reassign them to different interface-controlling proﬁles, for example, Connection

Proﬁles. To permit easy access to this IP Setup functionality, you can use the NAT Associations screen.

You access the NAT Associations screen from the Network Address Translation screen.

System

Configuration

Main

Setup

Network Address

Translation

Select NAT Associations and press Return. The NAT Associations screen appears.

NAT Associations

Profile/Interface Name-------------Nat?-Map List Name-----Server List Name

Default Answer Profile

Easy Setup Profile

Profile 01

On my_first_map

On Easy-PAT

my_servers

my_server_list

<<None>>

On my_second_map

On my_first_map

On <<None>>

Profile 02

Profile 03

■

You can toggle NAT? On or Off for each Proﬁle/Interface name. You do this by navigating to the NAT? ﬁeld

associated with each proﬁle using the arrow keys. Toggle NAT on or off by using the Tab key.

You can reassign any of your map lists or server lists to any of the Proﬁle/Interfaces. You do this by

navigating to the Map List Name or Server List Name ﬁeld associated with each proﬁle using the arrow

Download from Www.Somanuals.com. All Manuals Search And Download.

3-26 Firmware User Guide

keys. Select the item by pressing Return to display a pop-up menu of all of your conﬁgured lists.

NAT Associations

+NAT Map List Name-+

Profile/Interface Name-------------Nat+------------------+Server List Name

Easy Setup Profile

Profile 01

On | Easy-PAT List

|my_servers

On | my_first_map

|my_servers

Profile 02

On | my_second_map

|my_server_list

Profile 03

On | my_map

|<<None>>

Profile 04

On | <<None>>

|<<None>>

Default Answer Profile

On +------------------+my_servers

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

■

Select the list name you want to assign and press Return again. Your selection will then be associated with

the corresponding proﬁle or interface.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-27

IP Passthrough

Netopia Firmware Version 5.4 offers an IP passthrough feature. The IP passthrough feature allows for a single

PC on the LAN to have the router’s public address assigned to it. It also provides PAT (NAPT) via the same

public IP address for all other hosts on the private LAN subnet. Using IP passthrough:

■

The public WAN IP is used to provide IP address translation for private LAN computers.

The public WAN IP is assigned and reused on a LAN computer.

DHCP address serving can automatically serve the WAN IP address to a LAN computer.

When DHCP is used for addressing the designated passthrough PC, the acquired or conﬁgured WAN

address is passed to DHCP, which will dynamically conﬁgure a single-servable-address subnet, and reserve

the address for the conﬁgured MAC address. This dynamic subnet conﬁguration is based on the local and

remote WAN address and subnet mask. If the WAN interface does not have a suitable subnet mask that is

usable, for example when using PPP or PPPoE, the DHCP subnet conﬁguration will default to a class C

subnet mask.

Globally, only one dynamically-conﬁgured DHCP subnet is available. If you conﬁgure multiple Connection

Proﬁles to use IP Passthrough's DHCP option, when any of these proﬁles is established, the dynamic DHCP

conﬁguration will be overwritten.

In the case of an Ethernet WAN router the IP passthrough conﬁguration is located in the WAN Ethernet

Conﬁguration menu. For all other routers, it is located in the Connection Proﬁles' IP Proﬁle Parameters.

The WAN Ethernet Conﬁguration screen, found under the WAN Conﬁguration menu, WAN Setup screen,

appears as shown.

WAN Ethernet Configuration

Address Translation Enabled:

Local WAN IP Address:

Yes

0.0.0.0

NAT Map List...

Easy-PAT List

Easy-Servers

NAT Server List...

NAT Options...

Stateful Inspection Enabled:

Filter Set...

Remove Filter Set

Enable PPP over Ethernet:

WAN Ethernet Speed Setting...

Wan Ethernet MAC Address:

Off

Auto-Negotiation

00:fc:de:fa:dd:02

DHCP Client Mode:

RIP Options...

Standards-Based

Set up the basic IP attributes of your Ethernet Module in this screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

3-28 Firmware User Guide

The IP Proﬁle Parameters screen, found under the WAN Conﬁguration menu, Add/Change Connection Proﬁle

screen, appears as shown.

IP Profile Parameters

Address Translation Enabled:

IP Addressing...

Yes

Numbered

NAT Map List...

Easy-PAT List

Easy-Servers

NAT Server List...

NAT Options...

Stateful Inspection Enabled:

Local WAN IP Address:

Local WAN IP Mask:

0.0.0.0

Filter Set...

Remove Filter Set

RIP Profile Options...

Toggle to Yes if this is a single IP address ISP account.

Configure IP requirements for a remote network connection here.

If you select NAT Options, in either case, the NAT Options screen appears.

NAT Options

IP Passthrough Enabled:

Toggle ON to allow local WAN IP address to be used on LAN in addition to NAT.

If you toggle IP Passthrough Enabled to Yes, additional ﬁeld(s) appear.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-29

NAT Options

IP Passthrough Enabled:

Yes

IP Passthrough DHCP Enabled:

IP Passthrough DHCP MAC address: 00-00-00-00-00-00

Enter MAC addr. of IP passthrough host, or zeroes for first come first serve.

Toggling IP Passthrough DHCP Enabled to Yes displays the IP Passthrough DHCP MAC address ﬁeld. This is

an editable ﬁeld in which you can enter the MAC (hardware) address of the designated PC be used as the DHCP

Client Identiﬁer for dynamic address reservation. The MAC address must be six colon-delimited or

dash-delimited sets of hex digits ('0' – 'FF').

First Come First Serve Mode

Netopia Firmware Version 5.4 IP Passthrough allows a ﬁrst come ﬁrst serve mode.

NAT Options defaults to an all-zeroes MAC address.

If you leave the default all-zeroes MAC address, the Router will select the next DHCP client that initiates a DHCP

lease request or renewal to be the IP passthrough host. When the WAN comes up, or if it is already up, the

Router will serve this client the IP passthrough/WAN address. When this client's lease ends, the IP

passthrough address becomes available for the next client to initiate a DHCP transaction. The next client will

get the IP passthrough address. Note that there is no way to control which PC has the IP passthrough address

without releasing all other DHCP leases on the LAN.

Note: If you specify a non-zeroes MAC address, the DHCP Client Identiﬁer must be in the format speciﬁed

above. Macintosh computers allow the DHCP Client Identiﬁer to be entered as a name or text, however Netopia

routers accept only strict (binary/hex) MAC address format. Macintosh computers display their strict MAC

addresses in the TCP/IP Control Panel (Classic MacOS) or the Network Preference Pane of System Preferences

(Mac OS X).

Once conﬁgured, the passthrough host's DHCP leases will be shortened to two minutes. This allows for timely

updates of the host's IP address, which will be a private IP address before the WAN connection is established.

After the WAN connection is established and has an address, the passthrough host can renew its DHCP

address binding to acquire the WAN IP address.

Download from Www.Somanuals.com. All Manuals Search And Download.

3-30 Firmware User Guide

A restriction

Since both the router and the passthrough host will use same IP address, new sessions that conﬂict with

existing sessions will be rejected by the router. For example, suppose you are a teleworker using an IPSec

tunnel from the router and from the passthrough host. Both tunnels go to the same remote endpoint, such as

the VPN access concentrator at your employer’s ofﬁce. In this case, the ﬁrst one to start the IPSec trafﬁc will

be allowed; the second one – since, from the WAN it's indistinguishable – will fail.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-31

MultiNAT Conﬁguration Example

To help you understand a typical MultiNAT conﬁguration, this section describes an example of the type of

conﬁguration you may want to implement on your site. The values shown are for example purposes only. Make

your own appropriate substitutions.

A typical DSL service from an ISP might include ﬁve user addresses. Without PAT, you might be able to attach

only ﬁve IP hosts. Using simple 1-to-many PAT you can connect more than ﬁve devices, but use only one of your

addresses. Using multiNAT you can make full use of the address range. The example assumes the following

range of addresses offered by a typical ISP:

Local WAN IP address:

Local WAN subnet mask:

Remote IP address:

Default gateway:

206.1.1.6

255.255.255.248

206.1.1.254

Public IP addresses assigned by the ISP are 206.1.1.1 through 206.1.1.6 (255.255.255.248 subnet mask).

Your internal devices have IP addresses of 192.168.1.1 through 192.168.1.254 (255.255.255.0 subnet

mask).

Netopia Router's address is:

Web server's address is:

Mail server's address is:

FTP server's address is:

192.168.1.1

192.168.1.253

192.168.1.254

192.168.1.253

In this example you will statically map the ﬁrst ﬁve public IP addresses (206.1.1.1 - 206.1.1.5) to the ﬁrst ﬁve

corresponding private IP addresses (192.168.1.1 - 192.168.1.5). You will use these 1-to-1 mapped addresses

to give your servers “real” addresses. You will then map 206.1.1.6 to the remaining private IP addresses

(192.168.1.6 - 192.168.1.254) using PAT.

The conﬁguration process is as follows:

From the Main Menu go to the Easy Setup and then the Connection Proﬁle screen.

Easy

Setup

Main

Connection

Profile

Download from Www.Somanuals.com. All Manuals Search And Download.

3-32 Firmware User Guide

Enter your ISP-supplied values as shown below.

Connection Profile 1: Easy Setup Profile

Connection Profile Name:

Easy Setup Profile

Address Translation Enabled:

IP Addressing...

Yes

Numbered

Local WAN IP Address:

Local WAN IP Mask:

206.1.1.6

255.255.255.248

PREVIOUS SCREEN

NEXT SCREEN

Enter a subnet mask in decimal and dot form (xxx.xxx.xxx.xxx).

Enter basic information about your WAN connection with this screen.

Select NEXT SCREEN and press Return.

Your IP values are shown here.

IP Easy Setup

Ethernet IP Address:

192.168.1.1

Ethernet Subnet Mask:

Domain Name:

255.255.255.0

ISP.net

Primary Domain Name Server:

Secondary Domain Name Server:

173.166.101.1

173.166.102.1

Default IP Gateway:

IP Address Serving:

206.1.1.254

Number of Client IP Addresses:

1st Client Address:

192.168.1.2

PREVIOUS SCREEN

NEXT SCREEN

Set up the basic IP attributes of your Netopia in this screen.

Then navigate to the Network Address Translation (NAT) screen.

System

Configuration

Main

Setup

Network Address

Translation (NAT)

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-33

Select Show/Change Public Range, then Easy-PAT Range, and press Return. Enter the value your ISP assigned

for your public address (206.1.1.6, in this example). Toggle Type to pat. Your public address is then mapped to

the remaining private IP addresses using PAT. (If you were not using the Easy-PAT Range and Easy-PAT List that

are created by default by using Easy Setup, you would have to deﬁne a public range and map list. For the

purpose of this example you can just alter this range and list.)

Change NAT Public Range

Range Name:

Type...

Easy-PAT Range

pat

Public Address:

206.1.1.6

First Public Port:

Last Public Port:

49152

65535

CHANGE NAT PUBLIC RANGE

CANCEL

Select CHANGE NAT PUBLIC RANGE and press Return. This returns you to the Network Address Translation

screen.

Select Add Public Range and press Return. Type a name for this static range, as shown below. Enter the ﬁrst

and last public addresses your ISP assigned in their respective ﬁelds as shown. The ﬁrst ﬁve public IP

addresses (206.1.1.1 - 206.1.1.5, in this example) are statically mapped to the ﬁrst ﬁve corresponding private

IP addresses (192.168.1.1 - 192.168.1.5).

Add NAT Public Range

Range Name:

Static Range

static

Type...

First Public Address:

Last Public Address:

206.1.1.1

206.1.1.5

ADD NAT PUBLIC RANGE

CANCEL

Return/Enter to commit changes.

Download from Www.Somanuals.com. All Manuals Search And Download.

3-34 Firmware User Guide

Select ADD NAT PUBLIC RANGE and press Return. You are returned to the Network Address Translation

screen.

Next, select Show/Change Map List and choose Easy-PAT List. Select Add Map. The Add NAT Map screen

appears. (Now the name Easy-PAT List is a misnomer since it has a static map included in its list.) Enter in

192.168.1.1 for the First Private Address and 192.168.1.5 for the Last Private Address.

Add NAT Map ("Easy-PAT List")

First Private Address:

Last Private Address:

192.168.1.1

192.168.1.5

Use NAT Public Range...

ADD NAT MAP

CANCEL

Select Use NAT Public Range and from the pop-up menu choose Static Range. Select ADD NAT MAP and

press Return.

This will statically map the ﬁrst ﬁve public IP addresses to the ﬁrst ﬁve corresponding private IP addresses and

will map 206.1.1.6 to the remaining private IP addresses using PAT.

Notes on the example

The Easy-Map List and the Easy-PAT List are attached to any new Connection Proﬁle by default. If you want to

use this NAT conﬁguration on a previously deﬁned Connection Proﬁle then you need to bind the Map List to the

proﬁle. You do this through either the NAT Associations screen or the proﬁle’s conﬁguration screens.

The PAT part of this example setup will allow any user on the Netopia Router's LAN with an IP address in the

range of 192.168.1.6 through 192.168.1.254 to initiate trafﬁc ﬂow to the outside world (for example, the

Internet). No one on the Internet would be able to initiate a conversation with them.

The Static mapping part of this example will allow any of the machines in the range of addresses from

192.168.1.1 through 192.168.1.5 to communicate with the outside world as if they were at the addresses

206.1.1.1 through 206.1.1.5, respectively. It also allows any machine on the Internet to access any service

(port) on any of these ﬁve machines.

You may decide this poses a security risk. You may decide that anyone can have complete access to your FTP

server, but not to your router, and only limited access to the desired services (ports) on the Web and Mail

servers.

Download from Www.Somanuals.com. All Manuals Search And Download.

Multiple Network Address Translation 3-35

To make these changes, ﬁrst limit the range of remapped addresses on the Static Map and then edit the

default server list called Easy-Servers.

■

First, navigate to the Show/Change Map List screen, select Easy-PAT List and then Show/Change Maps.

Choose the Static Map you created and change the First Private Address from 192.168.1.1 to

192.168.1.4. Now the router, Web, and Mail servers’ IP addresses are no longer included in the range of

static mappings and are therefore no longer accessible to the outside world. Users on the Internet will not

be able to Telnet, Web, SNMP, or ping to them. It is best also to navigate to the public range screen and

change the Static Range to go from 206.1.1.5.

■

Next, navigate to Show/Change Server List and select Easy-Servers and then Add Server. You should

export both the Web (www-http) and Mail (smtp) ports to one of the now free public addresses. Select

Service... and from the resulting pop-up menu select www-http. In the resulting screen enter your Web

server's address, 192.168.1.2, and the public address, for example, 206.1.1.2, and then select ADD NAT

SERVER. Now return to Add Server, choose the smtp port and enter 192.168.1.3, your Mail server's IP

address for the Server Private IP Address. You can decide if you want to present both your Web and Mail

services as being on the same public address, 206.1.1.2, or if you prefer to have your Mail server appear

to be at a different IP address, 206.1.1.3. For the sake of this example, alias both services to 206.1.1.2.

Now, as before, the PAT conﬁguration will allow any user on the Netopia Router's LAN with an IP address in the

range of 192.168.1.6 through 192.168.1.254 to initiate trafﬁc ﬂow to the Internet. Someone at the FTP server

can access the Internet and the Internet can access all services of the FTP machine as if it were at 206.1.1.5.

The router cannot directly communicate with the outside world. The only communication between the Web

server and the Internet is through port 80, the Web port, as if the server were located on a machine at IP

address 206.1.1.2. Similarly, the only communication with the Mail server is through port 25, the SMTP port,

as if it were located at IP address 206.1.1.2

Download from Www.Somanuals.com. All Manuals Search And Download.

3-36 Firmware User Guide

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-1

Chapter 4

Virtual Private Networks (VPNs)

The Netopia Firmware Version 5.4 offers IPsec, PPTP, and ATMP tunneling support for Virtual Private Networks

(VPN).

The following topics are covered in this chapter:

■

"Overview" on page 4-1

"About PPTP Tunnels" on page 4-4

"About IPsec Tunnels" on page 4-7

"About ATMP Tunnels" on page 4-8

"Encryption Support" on page 4-10

"ATMP/PPTP Default Proﬁle" on page 4-11

"VPN QuickView" on page 4-13

"Dial-Up Networking for VPN" on page 4-14

"Installing the VPN Client" on page 4-17

"Allowing VPNs through a Firewall" on page 4-19

"Windows Networking Broadcasts" on page 4-25

Overview

When you make a long distance telephone call from your home to a relative far away, you are creating a private

network. You can hold a conversation, and exchange information about the happenings on opposite sides of the

state, or the continent, that you are mutually interested in. When your next door neighbor picks up the phone to

call her daughter at college, at the same time you are talking to your relatives, your calls don't overlap, but each

is separate and private. Neither house has a direct wire to the places they call. Both share the same lines on

the telephone poles (or underground) on the street.

These calls are virtual private networks. Virtual, because they appear to be direct connections between the

calling and answering parties, even though they travel over the public wires and switches of the phone

company; private, because neither pair of calling and answering parties interacts with the other; and networks,

because they exchange information.

Computers can do the same thing; it's called Virtual Private Networks (VPNs). Equipped with a Router, a single

computer or private network (LAN) can establish a private connection with another computer or private network

over the public network (Internet).

Download from Www.Somanuals.com. All Manuals Search And Download.

4-2 Firmware User Guide

The Netopia Firmware Version 5.4 can be used in VPNs either to initiate the connection or to answer it. When

used in this way, the routers are said to be tunnelling through the public network (Internet). The advantages are

that, like your long distance phone call, you don't need a direct line between one computer or LAN and the

other, but use the local connections, making it much cheaper; and the information you exchange through your

tunnel is private and secure.

Tunneling is a process of creating a private path between a remote user or private network and another private

network over some intermediate network, such as the IP-based Internet. A VPN allows remote ofﬁces or

employees access to your internal business LAN through means of encryption allowing the use of the public

Internet to look “virtually” like a private secure network. When two networks communicate with each other

through a network based on the Internet Protocol, they are said to be tunneling through the IP network.

Transit Internetwork

Virtual Private Network

Logical

Equivalent

Unlike the phone company, private and public computer networks can use more than one protocol to carry your

information over the wires. Three such protocols are in common use for tunnelling, Point-to-Point Tunnelling

Protocol (PPTP), Ascend Tunnel Management Protocol (ATMP), and IP Security (IPsec). The Netopia Router can

use any one.

■

Point-to-Point Tunneling Protocol (PPTP) is an extension of Point-to-Point Protocol (PPP) and uses a client

and server model. Netopia’s PPTP implementation is compatible with Microsoft’s and can function as

either the client (PAC) or the server (PNS). As a client, a Netopia R-series router can provide all users on a

LAN with secure access over the Internet to the resources of another LAN by setting up a tunnel with a

Windows NT server running Remote Access Services (RAS) or with another Netopia Router. As a server, a

Netopia R-series router can provide remote users a secure connection to the resources of the LAN over a

dial-up, cable, DSL, or any other type of Internet access. Because PPTP can create a VPN tunnel using the

Dial-Up Networking (DUN) (see "Dial-Up Networking for VPN" on page 4-14) utility built into Windows 95,

98, or NT, no additional client software is required.

■

Ascend Tunnel Management Protocol (ATMP) is the protocol that is implemented in many Ascend routers.

ATMP is a simple protocol for connecting nodes and/or networks together over the Internet via a tunnel.

ATMP encapsulates IP or other user data without PPP headers within General Routing Encapsulation (GRE)

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-3

protocol over IP. ATMP is more efﬁcient than PPTP for network-to-network tunnels.

■

IPsec stands for IP Security, a set of protocols that supports secure exchange of IP packets at the IP layer.

IPsec is deployed widely to implement Virtual Private Networks (VPNs). IPsec supports two encryption

modes: Transport and Tunnel. Transport mode encrypts only the data portion (payload) of each packet, but

leaves the header untouched. The more secure Tunnel mode encrypts both the header and the payload. On

the receiving side, an IPsec-compliant device decrypts each packet. The Netopia Firmware Version 5.4

supports the more secure Tunnel mode.

DES stands for Data Encryption Standard, a popular symmetric-key encryption method. DES uses a 56-bit

key. The Netopia Firmware Version 5.4 offers IPsec DES encryption over the VPN tunnel.

When used to initiate the tunnelled connection, the Router is called a PPTP Access Concentrator (PAC, in PPTP

language), or a foreign agent (in ATMP language). When used to answer the tunnelled connection, the Netopia

Router is called a PPTP Network Server (PNS, in PPTP language) or a home agent (in ATMP language).

In either case, the Netopia Router wraps, or encapsulates, information that one end of the tunnel exchanges

with the other, in a wrapper called General Routing Encapsulation (GRE), at one end of the tunnel, and unwraps,

or decapsulates, it at the other end.

Conﬁguring the Netopia Router for use with the different protocols is done through the console-based menu

screens. Each type is described in its own section:

■

"About PPTP Tunnels" on page 4-4

"About IPsec Tunnels" on page 4-7

"About ATMP Tunnels" on page 4-8

Your conﬁguration depends on which protocol you (and the router at the other end of your tunnel) will use, and

whether or not you will be using the VPN client software in a standalone remote connection.

Note: You must choose which protocol you will be using, since you cannot both export PPTP and use ATMP, or

vice versa, at the same time.

Having both an ATMP tunnel and a PPTP export is not possible because functions require GRE and the router’s

PPTP export/server does not distinguish the GRE packets it forwards. Since it processes all of them, ATMP

tunneling is impaired. For example, you cannot run an ATMP tunnel between two routers and also have PPTP

exported on one side.

Summary

A Virtual Private Network (VPN) connects the components of one network over another network. VPNs

accomplish this by allowing you to tunnel through the Internet or another public network in a manner that

provides the same security and features formerly available only in private networks.

VPNs allow networks to communicate across an IP network. Your local networks (connected to the Netopia

Router) can exchange data with remote networks that are also connected to a VPN-capable router.

This feature provides individuals at home, on the road, or in branch ofﬁces with a cost-effective and secure way

to access resources on remote LANs connected to the Internet with Netopia Routers. The feature is built

around three key technologies: PPTP, IPsec, and ATMP.

Download from Www.Somanuals.com. All Manuals Search And Download.

4-4 Firmware User Guide

About PPTP Tunnels

To set up a PPTP tunnel, you create a Connection Proﬁle including the IP address and other relevant information

for the remote PPTP partner. You use the same procedure to initiate a PPTP tunnel that terminates at a remote

PPTP server or to terminate a tunnel initiated by a remote PPTP client.

PPTP conﬁguration

To set up the router as a PPTP Network Server (PNS) capable of answering PPTP tunnel requests you must also

conﬁgure the VPN Default Answer Proﬁle. See "ATMP/PPTP Default Proﬁle" on page 4-11 for more information.

PPTP is a Datalink Encapsulation option in Connection Proﬁles. It is not an option in device or link conﬁguration

screens, as PPTP is not a native encapsulation. Consequently, the Easy Setup Proﬁle does not offer PPTP

datalink encapsulation. See the "Creating a New Connection Proﬁle" on page 2-24 for information on creating

Connection Proﬁles.

Channel 4 (and higher) events, such as connections and disconnections, reported in the WAN Event Histories

are VPN tunnel events.

To deﬁne a PPTP tunnel, navigate to the Add Connection Proﬁle menu from the Main Menu.

WAN

Configuration

Main

Add Connection

Profile

Add Connection Profile

Profile 1

Profile Name:

Profile Enabled:

+---------------+

| PPP

Data Link Encapsulation...

| Frame Relay |

| RFC1483

| ATMP

IP Profile Parameters...

| PPTP

| IPsec

+---------------+

COMMIT

CANCEL

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-5

When you deﬁne a Connection Proﬁle as using PPTP by selecting PPTP as the datalink encapsulation method,

and then select Data Link Options, the PPTP Tunnel Options screen appears.

PPTP Tunnel Options

PPTP Partner IP Address:

Tunnel Via Gateway:

173.167.8.134

0.0.0.0

Authentication...

CHAP

None

Data Compression...

Send Host name:

Send Password:

tony

*****

kimba

******

Receive Host name:

Receive Password:

Initiate Connections:

On Demand:

Yes

Optional Windows NT Domain Name:

Idle Timeout (seconds):

300

■

Enter the PPTP Partner IP Address. This speciﬁes the address of the other end of the tunnel.

If you do not specify the PPTP Partner IP Address the gateway cannot initiate tunnels, i.e., act as a PPTP

Access Concentrator (PAC) for this proﬁle. It can only accept tunnel requests as a PPTP Network Server

(PNS).

If you specify the PPTP Partner IP Address, and the address is in the same subnet as the Remote IP

Address you speciﬁed in the IP Proﬁle Parameters, the Tunnel Via Gateway option becomes visible. You

can enter the address by which the gateway partner is reached.

If you do not specify the PPTP Partner IP Address, the router will use the default gateway to reach the

partner and the Tunnel Via Gateway ﬁeld is hidden. If the partner should be reached via an alternate port

(i.e. the LAN instead of the WAN), the Tunnel Via Gateway ﬁeld allows this path to be resolved.

■

From the pop-up menu select an Authentication protocol for the PPP connection. Options are PAP, CHAP, or

MS-CHAP. The default is PAP. The authentication protocol must be the same on both ends of the tunnel.

You can specify a Data Compression algorithm, either None or Standard LZS, for the PPTP connection.

Note: When the Authentication protocol is MS-CHAP, compression is set to None, and the Data

Compression option is hidden.

■

When the authentication protocol is MS-CHAP, you can specify a Data Encryption algorithm for the PPTP

connection. Available options are MPPE and None (the default). For other authentication protocols, this

option is hidden. When MPPE is negotiated, the WAN Event History reports that it is negotiated as a CCP

(compression) type. This is because the MPPE protocol uses a compression engine, even though it is not

itself a compression protocol.

Download from Www.Somanuals.com. All Manuals Search And Download.

4-6 Firmware User Guide

Note: The Netopia Firmware Version 5.4 supports 128-bit (“strong”) encryption. Unlike MS-CHAP version 1,

which supports one-way authentication, MS-CHAP version 2 supports mutual authentication between connected

routers and is incompatible with MS-CHAP version 1 (MS-CHAP-V1). When you choose MS-CHAP as the

authentication method for the PPTP tunnel, the Netopia router will start negotiating MS-CHAP-V2. If the router

you are connecting to does not support MS-CHAP-V2, it will fall back to MS-CHAP-V1, or, if the router you are

connecting to does not support MPPE at all, the PPP session will be dropped.

■

You can specify a Send Host Name which is used with Send Secret for authenticating with a remote PNS

when the proﬁle is used for initiating a tunnel connection.

You must specify a Send Password (the CHAP and MS-CHAP term for password), used for authenticating

the tunnel when initiating a tunnel connection.

You can specify a Receive Host Name which is used with the Receive Secret for authenticating a remote

PPTP client.

■

You must specify a Receive Password , used for authenticating the remote PPTP client.

You can specify that this router will Initiate Connections (acting as a PAC) or only answer them (acting as a

PNS).

■

Tunnels are normally initiated On Demand; however, you can disable this feature. When disabled, the

tunnel must be manually established or may be scheduled using the scheduled connections feature. See

"Scheduled Connections" on page 2-29.

Some networks that use Microsoft Windows NT PPTP Network Servers require additional authentication

information, called Windows NT Domain Name, when answering PPTP tunnel connection requests. Not all

Windows NT installations require this information, since not all such installations use this authentication

feature. The Windows NT Domain Name is not the same as the Internet domain name, but is the name of

a group of servers that share common security policy and user account databases. Your PPTP tunnel

partner’s administrator will supply this Windows NT Domain Name if it is required. If you conﬁgure your

Router to initiate PPTP tunnel connections by toggling Initiate Connections to Yes, the Optional Windows

NT Domain Name ﬁeld appears. Enter the domain name your network administrator has supplied.

■

You can specify the Idle Timeout, an inactivity timer, whose expiration will terminate the tunnel. A value of

zero disables the timer. Because tunnels are subject to abrupt termination when the underlying datalink is

torn down, use of the Idle Timeout is strongly encouraged.

■

Return to the Connection Proﬁle screen by pressing Escape.

Select IP Proﬁle Parameters and press Return.

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-7

The IP Proﬁle Parameters screen appears.

IP Profile Parameters

Address Translation Enabled:

Yes

NAT Map List...

Easy-PAT

NAT Server List...

Easy-Servers

Local WAN IP Address:

0.0.0.0

Remote IP Address:

Remote IP Mask:

173.167.8.10

255.255.0.0

Filter Set...

Remove Filter Set

RIP Profile Options...

■

Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel.

About IPsec Tunnels

IPsec stands for IP Security, a set of protocols that supports secure exchange of IP packets at the IP layer.

IPsec is deployed widely to implement Virtual Private Networks (VPNs). See "Overview" on page 4-1 for more

information.

IPsec supports two encryption modes: Transport and Tunnel. Transport mode encrypts only the data portion

(payload) of each packet, but leaves the header untouched. The more secure Tunnel mode encrypts both the

header and the payload. On the receiving side, an IPsec-compliant device decrypts each packet. Netopia

Routers support the more secure Tunnel mode.

Netopia Firmware Version 5.4 offers IPsec 3DES encryption over the VPN tunnel. DES stands for Data

Encryption Standard, a popular symmetric-key encryption method. DES uses a 56-bit key. Netopia Routers offer

IPsec 3DES (triple DES) encryption as a standard option. Some models support built-in hardware acceleration

of 3DES encryption at line speeds.

Internet Key Exchange (IKE) is an authentication and encryption key management protocol used in conjunction

with the IPsec standard. IPsec key management offers a wide variety of options which are explained in

Chapter 5, “Internet Key Exchange (IKE) IPsec Key Management for VPNs.”

Download from Www.Somanuals.com. All Manuals Search And Download.

4-8 Firmware User Guide

About ATMP Tunnels

To set up an ATMP tunnel, you create a Connection Proﬁle including the IP address and other relevant

information for the remote ATMP partner. ATMP uses the terminology of a foreign agent that initiates tunnels

and a home agent that terminates them. You use the same procedure to initiate or terminate an ATMP tunnel.

Used in this way, the terms initiate and terminate mean the beginning and end of the tunnel; they do not mean

activate and deactivate.

ATMP is a tunneling protocol, with two basic aspects. Tunnels are created and torn down using a session

protocol that is UDP-based. User (or client) data is transferred across the tunnel by encapsulating the client

data within Generic Routing Encapsulation (GRE). The GRE data is then routed using standard methods.

ATMP conﬁguration

ATMP is a Datalink Encapsulation option in Connection Proﬁles. It is not an option in device or link conﬁguration

screens, since ATMP is not a native encapsulation. The Easy Setup Proﬁle does not offer ATMP datalink

encapsulation. See "Creating a New Connection Proﬁle" on page 2-24 for information on creating Connection

Proﬁles.

The WAN Event History screens will report VPN tunnel events, such as connections and disconnections, as

Channel 4 (and higher) events.

To deﬁne an ATMP tunnel, navigate to the Add Connection Proﬁle menu from the Main Menu.

WAN

Configuration

Main

Add Connection

Profile

Add Connection Profile

Profile 2

Profile Name:

Profile Enabled:

+---------------+

| PPP

Data Link Encapsulation...

Data Link Options...

| Frame Relay |

| RFC1483

| ATMP

IP Profile Parameters...

| PPTP

| IPsec

+---------------+

COMMIT

CANCEL

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-9

When you deﬁne a Connection Proﬁle as using ATMP by selecting ATMP as the datalink encapsulation method,

and then select Data Link Options, the ATMP Tunnel Options screen appears.

ATMP Tunnel Options

ATMP Partner IP Address:

Tunnel Via Gateway:

173.167.8.134

0.0.0.0

Network Name:

Password:

sam.net

****

Data Encryption...

Key String:

DES

Initiate Connections:

On Demand:

Yes

Idle Timeout (seconds):

300

Note: An ATMP tunnel cannot be assigned a dynamic IP address by the remote server, as in a PPP

connection. When you deﬁne an ATMP tunnel proﬁle, the Local WAN IP Address, assigned in the IP Proﬁle

Parameters screen, must be the true IP address, not 0.0.0.0, if NAT is enabled.

■

ATMP Partner IP Address speciﬁes the address of the other end of the tunnel. When unspeciﬁed, the

gateway can not initiate tunnels (i.e., act as a foreign agent) for this proﬁle; it can only accept tunnel

requests as a home agent.

■

When you specify the ATMP Partner IP Address, and the address is in the same subnet as the Remote IP

Address you speciﬁed in the IP Proﬁle Parameters, you can specify the route (Tunnel Via Gateway) by which

the gateway partner is reached. If you do not specify the ATMP Partner IP Address, the router will use the

default gateway to reach the partner and the Tunnel Via Gateway ﬁeld is hidden. If the partner should be

reached via an alternate port (i.e., the LAN instead of the WAN), the Tunnel Via Gateway ﬁeld allows this

path to be resolved.

■

You can specify a Network Name. When the tunnel partner is another Netopia router, this name may be

used to match against a Connection Proﬁle. When the partner is an Ascend router in Gateway mode, then

Network Name is used by the Ascend router to match a gateway proﬁle. When the partner is an Ascend

router in Router mode, leave this ﬁeld blank.

■

You must specify a Password, used for authenticating the tunnel.

Note: The Password entry will be the same for both ends of the tunnel.

For Netopia-to-Netopia connections only, you can specify a Data Encryption algorithm for the ATMP

connection from the pop-up menu, either DES or None. None is the default.

Note: Ascend does not support DES encryption for ATMP tunnels.

■

You must specify a Key String of up to (and including) 20 characters when DES is selected. When

encryption is None, this ﬁeld is invisible.

You can specify that this router will Initiate Connections, acting as a foreign agent (Yes), or only answer

Download from Www.Somanuals.com. All Manuals Search And Download.

4-10 Firmware User Guide

them, acting as a home agent (No).

■

Tunnels are normally initiated On Demand; however, you can disable this feature. When disabled, the

tunnel must be manually established through the call management screens.

You can specify the Idle Timeout, an inactivity timer, whose expiration will terminate the tunnel. A value of

zero disables the timer. Because tunnels are subject to abrupt termination when the underlying datalink is

torn down, use of the Idle Timeout is strongly encouraged.

■

Return to the Connection Proﬁle screen by pressing Escape.

Select IP Proﬁle Parameters and press Return. The IP Proﬁle Parameters screen appears.

IP Profile Parameters

Address Translation Enabled:

Yes

NAT Map List...

Easy-PAT

NAT Server List...

Easy-Servers

Local WAN IP Address:

0.0.0.0

Remote IP Address:

Remote IP Mask:

173.167.8.10

255.255.0.0

Filter Set...

Remove Filter Set

RIP Profile Options...

■

Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel.

Encryption Support

Encryption is a method for altering user data into a form that is unusable by anyone other than the intended

recipient. The recipient must have the means to decrypt the data to render it usable to them. The encryption

process protects the data by making it difﬁcult for any third party to get at the original data.

Netopia PPTP is fully compatible with Microsoft Point-to-Point Encryption (MPPE) data encryption for user data

transfer over the PPTP tunnel. Microsoft Windows NT Server provides MPPE encryption capability only when

Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) is enabled. Netopia complies with this

feature to allow MPPE only when MS-CHAP is negotiated. MS-CHAP and MPPE are user-selectable options in the

PPTP Tunnel Options screen. If either the client or the server side speciﬁes encryption, then encryption

becomes mandatory for both.

Netopia’s ATMP implementation supports Data Encryption Standard (DES) data encryption for user data

transfer over the ATMP tunnel between two Netopia routers. The encryption option, none or DES, is a selectable

option in the ATMP Tunnel Options screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-11

MS-CHAP V2 and 128-bit strong encryption

Notes:

■

The Netopia Firmware Version 5.4 supports 128-bit (“strong”) encryption when using PPTP tunnels.

ATMP does not have an option of using 128-bit MPPE. If you are using ATMP between two Netopia routers

you can optionally set 56-bit DES encryption.

■

When you choose MS-CHAP as the authentication method for a PPTP tunnel, the Netopia router will start

negotiating MS-CHAPv2. If the router or VPN adapter client you are connecting to does not support

MS-CHAPv2, the Netopia router will fall back to MS-CHAPv1, or, if the router or VPN adapter client you are

connecting to does not support MPPE at all, the PPP session will be dropped. This is done automatically

and transparently.

ATMP/PPTP Default Proﬁle

The WAN Conﬁguration menu offers a ATMP/PPTP Default Proﬁle option. Use this selection when your router is

acting as the server for VPN connections, that is, when you are on the answering end of the tunnel

establishment. The ATMP/PPTP Default Proﬁle determines the way the attempted tunnel connection is

answered.

WAN Configuration

WAN (Wide Area Network) Setup...

Display/Change Connection Profile...

Add Connection Profile...

Delete Connection Profile...

WAN Default Profile...

ATMP/PPTP Default Profile...

Scheduled Connections...

Configuration Changes Reset WAN Connection:

Yes

To set the parameters under which the router will answer attempted VPN connections, select ATMP/PPTP

Default Proﬁle and press Return. The ATMP/PPTP Default Proﬁle screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

4-12 Firmware User Guide

ATMP/PPTP Default Profile

Answer ATMP/PPTP Connections:

PPTP Configuration Options

Receive Authentication...

Data Compression...

PAP

None

■

Toggle Answer ATMP/PPTP Connections to Yes if you want the router to accept VPN connections or No

(the default) if you do not.

For PPTP tunnel connections only, you must deﬁne what type of authentication these connections will use.

Select Receive Authentication and press Return. A pop-up menu offers the following options: PAP (the

default), CHAP, or MS-CHAP.

■

If you chose PAP or CHAP authentication, from the Data Compression pop-up menu select either None (the

default) or Standard LZS.

If you chose MS-CHAP authentication, the Data Compression option is not required, and this menu item

becomes hidden.

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-13

VPN QuickView

You can view the status of your VPN connections in the VPN QuickView screen.

From the Main Menu select QuickView and then VPN QuickView.

Main

VPN

QuickView

The VPN QuickView screen appears.

VPN Quick View

Profile Name----------Type----Rx Pckts---Tx Pckts--RxDiscard--Remote Address--

HA <-> FA1 (Jony Fon ATMP

HA <-> FA3 (Sleve M. ATMP

173.166.82.8

173.166.117.91

Proﬁle Name: Lists the name of the Connection Proﬁle being used, if any.

Type: Shows the data link encapsulation method (PPTP or ATMP).

Rx Pckts: Shows the number of packets received via the VPN tunnel.

Tx Pckts: Shows the number of packets transmitted via the VPN tunnel.

Rx Discard: Shows the number of packets discarded.

Remote Address: Shows the tunnel partner’s IP address.

Download from Www.Somanuals.com. All Manuals Search And Download.

4-14 Firmware User Guide

Dial-Up Networking for VPN

Microsoft Windows Dial-Up Networking software permits a remote standalone workstation to establish a VPN

tunnel to a PPTP server such as a Netopia Router located at a central site. Dial-Up Networking also allows a

mobile user who may not be connected to a PAC to dial into an intermediate ISP and establish a VPN tunnel to,

for example, a corporate headquarters, remotely. Netopia Routers also can serve as a PAC at the workstation's

site, making it unnecessary for the standalone workstation to initiate the tunnel. In such a case, the Dial-Up

Networking software is not required, since the Netopia Router initiates the tunnel.

This section is provided for users who may require the VPN client software for Dial-Up Networking in order to

connect to an ISP who provides a PPTP account.

Microsoft Windows Dial-Up Networking (DUN) is the means by which you can initiate a VPN tunnel between your

individual remote client workstation and a private network such as your corporate LAN via the Internet. DUN is a

software adapter that allows you to establish a tunnel.

DUN is a free add-on available for Windows 95, and comes standard with Windows 98 and Windows NT. The

VPN tunnel behaves as a private network connection, unrelated to other trafﬁc on the network. Once you have

installed Dial-Up Networking, you will be able to connect to your remote site as if you had a direct private

connection, regardless of the intervening network(s) through which your data passes. You may need to install

the Dial-Up Networking feature of Windows 95, 98, or 2000 to take advantage of the virtual private networking

feature of your Netopia router.

Note: For the latest information and tech notes on Dial-Up Networking and VPNs be sure to visit the Netopia

website at http://www.netopia.com and, for the latest software and release notes, the Microsoft website at

http://www.microsoft.com.

Installing Dial-Up Networking

Check to see if Dial-Up Networking is already installed on your PC. Open your My Computer (or whatever you

have named it) icon on your desktop. If there is a folder named Dial-Up Networking, you don’t have to install it.

If there is no such folder, you must install it from your system disks or CDROM. Do the following:

1. From the Start menu, select Settings and then Control Panel.

2. In the Control Panel window, double-click the Add/Remove Programs icon.

The Add/Remove Programs Properties window appears.

3. Click the Windows Setup tab.

4. Double-click Communications.

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-15

The Communications window appears.

5. In the Communications window, select Dial-Up Networking and click the OK button.

This returns you to the Windows Setup screen. Click the OK button.

6. Respond to the prompts to install Dial-Up Networking from the system disks or CDROM.

7. When prompted, reboot your PC.

Creating a new Dial-Up Networking proﬁle

A Dial-Up Networking proﬁle is like an address book entry that contains the information and parameters you

need for a secure private connection. You can create this proﬁle by using either the Internet Connection Wizard

or the Make New Connection feature of Dial-Up Networking. The following instructions tell you how to create the

proﬁle with the Make New Connection feature. Do the following:

1. Double-click the My Computer (or whatever you have named it) icon on your desktop.

Open the Dial-Up Networking folder, and then double-click Make New Connection. The Make New

Connection wizard window appears.

2. Type a name for this connection (such as the name of your company, or the computer you are dialing into).

From the pull-down menu, select the device you intend to use for the virtual private network connection.

This can be any device you have installed or connected to your PC. Click the Next button. A screen appears

with ﬁelds for you to enter telephone numbers for the computer you want to connect to.

3. Type the directory number or the Virtual Circuit Identiﬁer number.

This number is provided by your ISP or corporate administrator. Depending on the type of device you are

using, the number may or may not resemble an ordinary telephone directory number.

4. Click the Next button.

The ﬁnal window will give you a chance to accept or change the name you have entered for this proﬁle. If

you are satisﬁed with it, click the Finish button. Your proﬁle is complete.

Download from Www.Somanuals.com. All Manuals Search And Download.

4-16 Firmware User Guide

Conﬁguring a Dial-Up Networking proﬁle

Once you have created your Dial-Up Networking proﬁle, you conﬁgure it for TCP/IP networking to allow you to

connect to the Internet through your Internet connection device. Do the following:

1. Double-click the My Computer (or whatever you have named it) icon on your desktop.

Open the Dial-Up Networking folder. You will see the icon for the proﬁle you created in the previous section.

2. Right-click the icon and from the pop-up menu select Properties.

3. In the Properties window click the Server Type button.

From the Type of Dial-up Server pull-down menu select the appropriate type of server for your system

version:

■

Windows 95 users select PPP: Windows 95, Windows NT 3.5, Internet

Windows 98 users select PPP: Windows 98, Windows NT Server, Internet

In the Allowed network protocols area check TCP/IP and uncheck all of the other checkboxes.

Note: Netopia’s PPTP implementation does not currently support tunnelling of IPX and NetBEUI protocols.

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-17

4. Click the TCP/IP Settings button.

■

If your ISP uses dynamic IP addressing (DHCP), select the Server assigned IP address radio button.

If your ISP uses static IP addressing, select the Specify an IP address radio button and enter your

assigned IP address in the ﬁelds provided. Also enter the IP address in the Primary and Secondary

DNS ﬁelds.

5. Click the OK button in this window and the next two windows.

Installing the VPN Client

Before Installing the VPN Client you must have TCP/IP installed and have an established Internet connection.

Windows 95 VPN installation

1. From your Internet browser navigate to the following URL:

http://www.microsoft.com/NTServer/nts/downloads/recommended/dunl3win95/releasenotes.aso

Download the Microsoft Windows 95 VPN patch dun 1.3 to the Windows 95 computer you intend to use as

a VPN client with PPTP. Follow the installation instructions.

2. From the Windows 95 Start menu select Settings, then Control Panel and click once.

The Control Panel screen appears.

3. Double-click Add/Remove Programs.

The Add/Remove Programs screen appears.

4. Click the Windows Setup tab.

The Windows Setup screen will be displayed within the top center box.

5. Highlight Communications and double-click.

Download from Www.Somanuals.com. All Manuals Search And Download.

4-18 Firmware User Guide

This displays a list of possible selections for the communications option. Active components will have a

check in the checkboxes to their left.

6. Check Dial Up Networking at the top of the list and Virtual Private Networking at the bottom of the list.

7. Click OK at the bottom right on each screen until you return to the Control Panel. Close the Control Panel

by clicking the upper right corner X.

8. Double-click the My Computer icon (normally at the left upper corner of the screen).

This will display the devices within My Computer. Scroll down the list to Dial-Up Networking and

double-click it.

9. Double click Make New Connection.

This displays the Make New Connection installation screen. In this screen you will see a box labelled

Select a device. From the pull-down menu to the right, select Microsoft VPN Adapter.

Click the Next button at the bottom of the screen

This displays the VPN Host screen. In the box to the top center of the screen enter your VPN server’s IP

address (for example, 192.168.xxx.xxx. This is not a proper Internet address)

Windows 98 VPN installation

1. From the Windows 98 Start menu select Settings, then Control Panel and click once.

The Control Panel screen appears.

2. Double-click Add/Remove Programs.

The Add/Remove Programs screen appears.

3. Click the Windows Setup tab.

The Windows Setup screen will be displayed within the top center box.

4. Double-click Communications.

This displays a list of possible selections for the communications option. Active components will have a

check in the checkboxes to their left.

5. Check Dial Up Networking at the top of the list and Virtual Private Networking at the bottom of the list.

6. Click OK at the bottom right on each screen until you return to the Control Panel. Close the Control Panel

by clicking the upper right corner X.

7. Double-click the My Computer icon (normally at the left upper corner of the screen).

This will display the devices within My Computer. Scroll down the list to Dial-Up Networking and

double-click it.

8. Double click Make New Connection.

This displays the Make New Connection installation screen. In this screen you will see a box labelled

Select a device. From the pull-down menu to the right, select Microsoft VPN Adapter.

Click the Next button at the bottom of the screen

This displays the VPN Host screen. In the box to the top center of the screen enter your VPN server’s IP

address (for example, 192.168.xxx.xxx. This is not a proper Internet address)

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-19

Connecting using Dial-Up Networking

A Dial-Up Networking connection will be automatically launched whenever you run a TCP/IP application, such as

a web browser or email client. When you ﬁrst run the application a Connect To dialog box appears in which you

enter your User name and Password. If you check the Save password checkbox, the system will remember your

User name and Password, and you won’t be prompted for them again.

Allowing VPNs through a Firewall

An administrator interested in securing a network will usually combine the use of VPNs with the use of a ﬁrewall

or some similar mechanism. This is because a VPN is not a complete security solution, but rather a component

of overall security. Using a VPN will add security to transactions carried over a public network, but a VPN alone

will not prevent a public network from inﬁltrating a private network. Therefore, you should combine use of a

ﬁrewall with VPNs, where the ﬁrewall will secure the private network from inﬁltration from a public network, and

the VPN will secure the transactions that must cross the public network.

A strict ﬁrewall may not be provisioned to allow VPN trafﬁc to pass back and forth as needed. In order to ensure

that a ﬁrewall will allow a VPN, certain attributes must be added to the ﬁrewall's provisioning. The provisions

necessary vary slightly between ATMP and PPTP, but both protocols operate on the same basic premise: there

are control and negotiation operations, and there is the tunnelled trafﬁc that carries the payload of data

between the VPN endpoints. The difference is that ATMP uses UDP to handle control and negotiation, while

PPTP uses TCP. Then both ATMP and PPTP use GRE to carry the payload.

For PPTP negotiation to work, TCP packets inbound and outbound destined for port 1723 must be allowed.

Likewise, for ATMP negotiation to work, UDP packets inbound and outbound destined for port 5150 must be

allowed. Source ports are dynamic, so, if possible, make this ﬂexible, too. Additionally, PPTP and ATMP both

require a ﬁrewall to allow GRE bi-directionally.

The following sections illustrate a sample ﬁltering setup to allow either PPTP or ATMP trafﬁc to cross a ﬁrewall:

■

"PPTP example" on page 4-20

"ATMP example" on page 4-22

■

Make your own appropriate substitutions. For more information on ﬁlters and ﬁrewalls, see Chapter 10,

“Security.”.

Download from Www.Somanuals.com. All Manuals Search And Download.

4-20 Firmware User Guide

PPTP example

To enable a ﬁrewall to allow PPTP trafﬁc, you must provision the ﬁrewall to allow inbound and outbound TCP

packets speciﬁcally destined for port 1723. The source port may be dynamic, so often it is not useful to apply

a compare function upon this portion of the control/negotiation packets. You must also set the ﬁrewall to allow

inbound and outbound GRE packets, enabling transport of the tunnel payload.

From the Main Menu navigate to Display/Change IP Filter Set, and from the pop-up menu select Basic Firewall.

Main

System

Configuration

Filter

Sets

Display/Change

Filter Set

Basic

Firewall

Select Display/Change Input Filter.

Display/Change Input Filter screen

+--#----Source IP Addr----Dest IP Addr------Proto-Src.Port-D.Port--On?-Fwd--+

+---------------------------------------------------------------------------+

| 1

| 2

0.0.0.0

TCP NC

=2000 Yes No

=6000 Yes No

+---------------------------------------------------------------------------+

Select Input Filter 1 and press Return. In the Change Input Filter 1 screen, set the Destination Port information

as shown below.

Change Input Filter 1

Enabled:

Forward:

Yes

Source IP Address:

0.0.0.0

Source IP Address Mask:

Dest. IP Address:

0.0.0.0

Dest. IP Address Mask:

Protocol Type:

TCP

Source Port Compare...

Source Port ID:

No Compare

Dest. Port Compare...

Dest. Port ID:

Equal

1723

Established TCP Conns. Only:

Select Input Filter 2 and press Return. In the Change Input Filter 2 screen, set the Protocol Type to allow GRE as

shown below.

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-21

Change Input Filter 2

Enabled:

Forward:

Yes

Source IP Address:

0.0.0.0

Source IP Address Mask:

Dest. IP Address:

0.0.0.0

Dest. IP Address Mask:

Protocol Type:

GRE

In the Display/Change Filter Set screen select Display/Change Output Filter.

Display/Change Output Filter screen

+-#----Source IP Addr----Dest IP Addr------Proto-Src.Port-D.Port--On?-Fwd-+

+-------------------------------------------------------------------------+

| 1

| 2

0.0.0.0

TCP NC

GRE --

=1723 Yes Yes |

Yes Yes |

+-------------------------------------------------------------------------+

Select Output Filter 1 and press Return. In the Change Output Filter 1 screen, set the Protocol Type and

Destination Port information as shown below.

Change Output Filter 1

Enabled:

Forward:

Yes

Source IP Address:

0.0.0.0

Source IP Address Mask:

Dest. IP Address:

0.0.0.0

Dest. IP Address Mask:

Protocol Type:

TCP

Source Port Compare...

Source Port ID:

No Compare

Dest. Port Compare...

Dest. Port ID:

Equal

1723

Established TCP Conns. Only:

Download from Www.Somanuals.com. All Manuals Search And Download.

4-22 Firmware User Guide

Select Output Filter 2 and press Return. In the Change Output Filter 2 screen, set the Protocol Type to allow

GRE as shown below.

Change Output Filter 2

Enabled:

Forward:

Yes

Source IP Address:

0.0.0.0

Source IP Address Mask:

Dest. IP Address:

0.0.0.0

Dest. IP Address Mask:

Protocol Type:

GRE

ATMP example

To enable a ﬁrewall to allow ATMP trafﬁc, you must provision the ﬁrewall to allow inbound and outbound UDP

packets speciﬁcally destined for port 5150. The source port may be dynamic, so often it is not useful to apply

a compare function on this portion of the control/negotiation packets. You must also set the ﬁrewall to allow

inbound and outbound GRE packets (Protocol 47, Internet Assigned Numbers Document, RFC 1700), enabling

transport of the tunnel payload.

From the Main Menu navigate to Display/Change IP Filter Set, and from the pop-up menu select Basic Firewall.

Main

System

Configuration

Filter

Sets

Display/Change

Filter Set

Basic

Firewall

Select Display/Change Input Filter.

Display/Change Input Filter screen

+--#----Source IP Addr----Dest IP Addr------Proto-Src.Port-D.Port--On?-Fwd--+

+---------------------------------------------------------------------------+

| 1

| 2

0.0.0.0

TCP NC

=2000 Yes No

=6000 Yes No

+---------------------------------------------------------------------------+

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-23

Select Input Filter 1 and press Return. In the Change Input Filter 1 screen, set the Destination Port information

as shown below.

Change Input Filter 1

Enabled:

Forward:

Yes

Source IP Address:

0.0.0.0

Source IP Address Mask:

Dest. IP Address:

0.0.0.0

Dest. IP Address Mask:

Protocol Type:

TCP

Source Port Compare...

Source Port ID:

No Compare

Dest. Port Compare...

Dest. Port ID:

Equal

1723

Established TCP Conns. Only:

Select Input Filter 2 and press Return. In the Change Input Filter 2 screen, set the Protocol Type to allow GRE as

shown below.

Change Input Filter 2

Enabled:

Forward:

Yes

Source IP Address:

0.0.0.0

Source IP Address Mask:

Dest. IP Address:

0.0.0.0

Dest. IP Address Mask:

Protocol Type:

GRE

Download from Www.Somanuals.com. All Manuals Search And Download.

4-24 Firmware User Guide

In the Display/Change Filter Set screen select Display/Change Output Filter.

Display/Change Output Filter screen

+-#----Source IP Addr----Dest IP Addr------Proto-Src.Port-D.Port--On?-Fwd-+

+-------------------------------------------------------------------------+

| 1

| 2

0.0.0.0

TCP NC

GRE --

=1723 Yes Yes |

Yes Yes |

+-------------------------------------------------------------------------+

Select Output Filter 1 and press Return. In the Change Output Filter 1 screen, set the Protocol Type and

Destination Port information as shown below.

Change Output Filter 1

Enabled:

Forward:

Yes

Source IP Address:

0.0.0.0

Source IP Address Mask:

Dest. IP Address:

0.0.0.0

Dest. IP Address Mask:

Protocol Type:

UDP

Source Port Compare...

Source Port ID:

No Compare

Dest. Port Compare...

Dest. Port ID:

No Compare

5150

Select Output Filter 2 and press Return. In the Change Output Filter 2 screen, set the Protocol Type to allow

GRE as shown below.

Change Output Filter 2

Enabled:

Forward:

Yes

Source IP Address:

0.0.0.0

Source IP Address Mask:

Dest. IP Address:

0.0.0.0

Dest. IP Address Mask:

Protocol Type:

GRE

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-25

Windows Networking Broadcasts

Netopia ﬁrmware provides the ability to forward Windows Networking NetBIOS broadcasts. This is useful for, for

example, a Virtual Private Network, in which you want to be able to browse the remote network to which you are

tunnelling, as part of your Windows Network Neighborhood.

Routed connections, such as VPNs, can not use NetBEUI to carry the Network Neighborhood information. They

need to use NetBIOS, because NetBEUI cannot be routed. This feature will allow browsing the Network

Neighborhood without any additional workstation conﬁguration.

You enable this feature in the IP Proﬁle Parameters screen of your Connection Proﬁle. The IP Proﬁle Parameters

screen varies slightly, depending on whether your model router connects directly to the Internet, or if it connects

via an Ethernet connection through a cable or DSL modem. The enabling feature is the same for both:

Using the Tab key, toggle NetBIOS Proxy Enabled from the default No to Yes, and press Return. Your remote

Network Neighborhood becomes accessible from your Windows desktop.

Note: The remote IP address and subnet mask should strictly match the IP address and subnet mask

conﬁgured on the LAN interface of the remote router. See the following example.

Example:

LAN IP 192.168.1.0/24

PC # A --------- Router A

LAN IP 192.168.2.0/24

Router B --------- PC # B

Tunnel

.100

When PC #A sends a Windows networking broadcast it sends it with a destination IP 192.168.1.255.

When Router A receives this broadcast it translates the destination of this broadcast to match the remote IP of

the NetBIOS Proxy-enabled VPN proﬁles and it forwards the broadcast through the VPN tunnel.

When Router B receives this broadcast, it sends it on its LAN.

Download from Www.Somanuals.com. All Manuals Search And Download.

4-26 Firmware User Guide

Conﬁguration for Router A

IP Profile Parameters

Address Translation Enabled:

Remote IP Address:

192.168.2.1

Remote IP Mask:

255.255.255.0

Filter Set...

Remove Filter Set

NetBIOS Proxy Enabled

Yes

RIP Profile Options...

Enter an IP address in decimal and dot form (xxx.xxx.xxx.xxx).

Configure IP requirements for a remote network connection here.

Conﬁguration for Router B

IP Profile Parameters

Address Translation Enabled:

Remote IP Address:

Remote IP Mask:

192.168.1.1

255.255.255.0

Filter Set...

Remove Filter Set

NetBIOS Proxy Enabled

Yes

RIP Profile Options...

Enter an IP address in decimal and dot form (xxx.xxx.xxx.xxx).

Configure IP requirements for a remote network connection here.

Download from Www.Somanuals.com. All Manuals Search And Download.

Virtual Private Networks (VPNs) 4-27

Note: Microsoft Network browsing is available with or without a Windows Internet Name Service (WINS)

server. Shared volumes on the remote network are accessible with or without a WINS server. Local LAN shared

volumes that have Port Address Translation (PAT) applied to them are not available to hosts on the remote LAN.

For tunnelled trafﬁc, NAT on the WAN has no effect on the Microsoft Networking trafﬁc.

Make sure the NetBIOS ﬁlter is not enabled in your Internet Connection Proﬁle.

Netopia includes the NetBIOS Proxy feature as an enhancement and convenience for our customers. It has

been lab-tested and many customers use it successfully. However, Netopia cannot guarantee that this feature

will automatically give you the networking functionality you expect. There are many possible issues with the

various Windows operating systems that may prevent NetBIOS from functioning as described above. Netopia

Technical Support does not troubleshoot problems customers may encounter with their Windows operating

system

Download from Www.Somanuals.com. All Manuals Search And Download.

4-28 Firmware User Guide

Download from Www.Somanuals.com. All Manuals Search And Download.

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-1

Chapter 5

Internet Key Exchange (IKE) IPsec Key Management

for VPNs

IPsec stands for IP Security, a set of protocols that supports secure exchange of IP packets at the IP layer.

IPsec is deployed widely to implement Virtual Private Networks (VPNs). See “Virtual Private Networks (VPNs)”

on page 4-1 for more information.

The Version 5.3 ﬁrmware supports Internet Key Exchange (IKE) for secure encrypted communication over a VPN

tunnel.

This chapter covers the following topics:

■

“Overview” on page 5-1

“Internet Key Exchange (IKE) Conﬁguration” on page 5-2

“Key Management” on page 5-9

“IPsec WAN Conﬁguration Screens” on page 5-18

“IPsec Manual Key Entry” on page 5-19

Overview

IPsec supports two encapsulation modes: Transport and Tunnel. Transport mode encrypts only the data portion

(payload) of each packet, but leaves the header untouched. Tunnel mode encrypts both the header and the

payload. On the receiving side, an IPsec-compliant device decrypts each packet. Netopia Routers support

Tunnel mode.

DES stands for Data Encryption Standard, a popular symmetric-key encryption method. DES uses a 56-bit key.

Netopia Routers offer IPsec 3DES (triple DES) encryption as a standard option.

Note: Some models support built-in hardware acceleration of 3DES encryption at line speeds. The optional

VPN-accelerated models (all 4652 models and 4522 routers whose model number ends in “-XL”) accelerate

IPsec encryption and authentication.

Internet Key Exchange (IKE) is an authentication and encryption key management protocol used in conjunction

with the IPsec standard.

IKE is a two-phase protocol for key exchange.

■

Phase 1 authenticates the security gateways and establishes the Security Parameters (SPs) they will use

to negotiate on behalf of the clients. Security Associations (SAs) are sets of information values that allow

Download from Www.Somanuals.com. All Manuals Search And Download.

5-2 Firmware User Guide

the two devices on the Internet to communicate securely.

■

Phase 2 establishes the tunnel and provides for secure transport of data.

IPsec can be conﬁgured without IKE, but IKE offers additional features, ﬂexibility, and ease of conﬁguration. Key

exchange between your local router and a remote point can be conﬁgured either manually or by using the key

exchange protocol.

The advantage of using IKE is that it automatically negotiates IPsec Security Associations and enables IPsec

secure communications without having to manually enter the lengthy encryption keys at both ends of the

connection. You enter a human-readable pass phrase or shared secret English sentence, like “my dog has

ﬂeas” on each end once. This pass phrase is used to authenticate each end to the other. Thereafter, the two

ends periodically use a public key encryption method called Difﬁe-Hellman to exchange key material and then

securely generate new authentication and encryption keys. The keys are automatically and continually changing,

making the data exchanged using the keys inherently secure.

It also allows you to specify a lifetime for the IPsec Security Association and allows encryption keys to change

periodically during IPsec sessions. You can set this period for key generation to as often as your security

requirements dictate.

A Security Policy Database (SPD) now deﬁnes the security requirements. This is a signiﬁcant change from

earlier ﬁrmware implementations of IPsec. Trafﬁc with a source IP address that falls within the local member

speciﬁcation of an IPsec tunnel and that is addressed to a destination IP address that falls within the remote

member speciﬁcation of that tunnel is not routed using the normal routing table. Instead it is forwarded using

the security policy database to the remote security gateway (remote tunnel endpoint) speciﬁed in the IPsec

tunnel conﬁguration. It is not possible to send trafﬁc outside the tunnel by bypassing the tunnel and the remote

security gateway.

Note: To fully protect against IP address “spooﬁng” of local member addresses requires ﬁrewall rules to be

installed on the WAN interface. These must prevent packets coming in through that interface with local member

source addresses, since local member source addresses should only originate from the LAN. Otherwise it is

theoretically possible for a malicious hacker to send packets through the tunnel by impersonating local member

IP addresses. See the chapter “Security” on page 10-1 for more information.

Trafﬁc originating from local member LAN addresses that is not addressed to remote member addresses, as

well as trafﬁc originating from local LAN IP addresses that do not match any local member speciﬁcations, is

routed using the normal routing table. This means that if you want to restrict trafﬁc from local members from

going out to the Internet and force it all to go through one or more tunnels you need to specify remote members

of 0.0.0.0 - 255.255.255.255 or 0.0.0.0/0. Trafﬁc originating from the router, for example, telnet, ping, DNS

queries, will not use the default VPN deﬁnition even if the source addresses match. Trafﬁc to and from the

router is included in speciﬁc VPNs.

Internet Key Exchange (IKE) Conﬁguration

IPsec tunnels are deﬁned in the same manner as PPTP tunnels. (See “Virtual Private Networks (VPNs)” on

page 4-1 for more information.) You conﬁgure the Connection Proﬁle as follows.

From the Main Menu navigate to WAN Conﬁguration and then Add Connection Proﬁle.

Download from Www.Somanuals.com. All Manuals Search And Download.

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-3

WAN

Configuration

Main

Add Connection

Profile

The Add Connection Proﬁle screen appears.

Add Connection Profile

Profile 1

Profile Name:

Profile Enabled:

+-------------+

Encapsulation Type...

| PPP

Encapsulation Options...

| HDLC

| Frame Relay |

| RFC1483

| ATMP

IP Profile Parameters...

Interface Group...

COMMIT

| PPTP

| IPsec

+-------------+

Primary

CANCEL

■

From the Encapsulation Type pop-up menu select IPsec.

Then select Encapsulation Options. The IPsec Tunnel Options screen appears.

IPsec Tunnel Options

Key Management...

IKE

ESP

IKE Phase 1 Profile...

Encapsulation...

ESP Encryption Transform...

DES

ESP Authentication Transform...

HMAC-MD5-96

Compression Type...

None

Advanced IPsec Options...

COMMIT

CANCEL

Download from Www.Somanuals.com. All Manuals Search And Download.

5-4 Firmware User Guide

For Key Management you can use either IKE or Manual. If you choose Manual, skip to “IPsec Manual Key

Entry” on page 5-19. If you choose IKE (the default) continue below.

■

Select IKE Phase 1 Proﬁle and press Return.

+-IKE Phase1 Profile--+

+---------------------+

| <<ADD PH1 PROFILE>> |

| <<NONE>>

Key Management... |

IKE Phase 1 Profile|

Encapsulation... |

ESP Encryption Tran|

ESP Authentication |

|5-96

Compression Type...|

Advanced IPsec Opti|

COMMIT

+---------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

■

A pop-up window displays a list of IKE Phase 1 Proﬁles that you have conﬁgured. If you have not previously

conﬁgured an IKE Phase 1 Proﬁle, the selection ADD PH1 PROFILE allows you to do that now.

Adding an IKE Phase 1 Proﬁle

IKE Phase 1 Proﬁles contain the information that the two ends of a tunnel use to authenticate each other and

the parameters that govern the public key cryptography exchanges that are required to generate new keys

periodically. Make sure to add an IKE Phase 1 Proﬁle. If an IKE Phase 1 Proﬁle is not assigned to an IKE

Connection Proﬁle, all VPN trafﬁc for that proﬁle will be discarded.

Select ADD PH1 PROFILE. The Add IKE Phase 1 Proﬁle screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-5

Add IKE Phase 1 Profile

IKE Profile 1

Profile Name:

Mode...

Aggressive Mode

Local Identity Type...

Local Identity Value:

Remote Identity Type...

Remote Identity Value:

Authentication Method...

Shared Secret:

IPv4 Address

0.0.0.0

IPv4 Address

0.0.0.0

Shared Secret

********************

des

Encryption Algorithm...

Hash Algorithm...

md5

Diffie-Hellman Group...

Group 2 (1024 bits)

Advanced IKE Phase 1 Options...

ADD IKE PHASE 1 PROFILE

CANCEL

■

The Proﬁle Name ﬁeld accepts any name of up to 16 characters. Sixteen IKE Phase 1 proﬁles are

supported, since each of the potential sixteen Connection Proﬁles may be associated with a separate IKE

Phase 1 proﬁle.

■

The Mode pop-up menu allows you to choose between Main Mode (the default) and Aggressive Mode.

In Main Mode the router hides the Local and Remote Identity Type and Value ﬁelds, defaults to the host

address, and always uses the IPV4 Address and the local and remote tunnel endpoint address.

■

In Aggressive Mode the Local and Remote Identity Type pop-up menus allow you to choose the type of

Identity value to use: IPv4 Address, IPv4 Subnet, IPv4 Range, Host Name, E-Mail Address, Key ID (ASCII),

and Key ID (HEX). The Local and Remote Identity Type and Value menus allow you to specify one of the

following, based on what Local Identity Type you selected in the previous pop-up menu:

IPv4 Address: A single IPv4 address in the familiar dotted-quad notation (a.b.c.d).

IPv4 Subnet: A single IPv4 network address in dotted-quad notation (a.b.c.d) followed by a mask speciﬁed

either by a slash and a bit-count between 0 and 32 OR by a second dotted-quad.

IPv4 Range: Two IPv4 addresses in dotted quad notation (a.b.c.d) separated by a space.

Host Name: A fully-qualiﬁed domain name (FQDN).

E-Mail Address: An RFC 822 e-mail address in the form user@hostname.

Key ID (ASCII): An opaque string consisting of printable ASCII characters represented as a sequence of

printable ASCII characters.

Key ID (HEX): An opaque string consisting of arbitrary 8-bit ASCII values represented as a sequence of

hexadecimal digits, each of which corresponds to one nibble of the string value.

■

The Authentication Method pop-up menu speciﬁes the IKE Phase 1 authentication method. The only

currently supported authentication method is Shared Secret. Other methods may be supported in future

ﬁrmware releases.

The Shared Secret ﬁeld allows you to enter a shared secret phrase (between 1 and 48 characters long)

Download from Www.Somanuals.com. All Manuals Search And Download.

5-6 Firmware User Guide

that will be used to generate key material for IKE Phase 1.

■

The Encryption Algorithm pop-up menu speciﬁes the IKE Phase 1 encryption algorithm, and may be either

DES (the default) or 3DES.

The Hash Algorithm pop-up menu speciﬁes the IKE Phase 1 hash algorithm, and may be either SHA1 (the

default) or MD5.

The Difﬁe-Hellman Group pop-up menu speciﬁes the IKE Phase 1 Difﬁe-Hellman key exchange size, and

may be either Group 1 (768 bits), Group 2 (1024 bits) (the default), or Group 5 (1536 bits).

If you select Advanced IKE Phase 1 Options the Advanced IKE Phase 1 Options screen appears.

Advanced IKE Phase 1 Options

Negotiation...

Normal

SA Use Policy...

Newest SAs Immediately

Allow Dangling Phase 2 SAs:

Phase 1 SA Lifetime (seconds):

Phase 1 SA Lifetime (Kbytes):

Yes

28800

Send Initial Contact Message:

Include Vendor ID Payload:

Independent Phase 2 Re-keys:

Strict Port Policy:

Yes

Return/Enter accepts * Tab toggles * ESC cancels.

Normally it is not necessary to change the settings of the items on the Advanced IKE Phase 1 Options screen.

Most of these settings exist for ensuring compatibility with remote IKE implementations that may have certain

limitations.

■

The Negotiation pop-up menu allows you to specify the way the device will respond to a connection

attempt. Normal (the default) is a two-way mode; Initiate Only or Respond Only permit limiting the

connection to one-way only.

■

The SA Use Policy pop-up menu speciﬁes the policy that the router will use to determine which Phase 1

SAs to use when multiple valid Phase 1 SAs are available for transmitting trafﬁc on an IPsec tunnel.

Because the router normally re–keys prior to the expiration of the current Phase 1 SAs, multiple valid

Phase 1 SAs may exist during the period of time after the router has re-keyed and established new Phase

1 SAs and the time at which the old Phase 1 SAs expire.

■

If you select Newest SAs Immediately, the router will begin using the newly created Phase 1 SAs

immediately after they are negotiated.

■

If you select Old SAs Until Expired, the router will continue using the old Phase 1 SAs until they expire

and will begin using the newly created Phase 1 SAs only after the old ones are no longer valid.

■

Allow Dangling Phase 2 SAs toggles whether or not Phase 2 SAs are permitted to survive the expiration of

Download from Www.Somanuals.com. All Manuals Search And Download.

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-7

the Phase 1 SAs under which they were created. Phase 2 SAs “dangle” when the Phase 1 SA under which

they were created expires before they do. There is no requirement that the Phase 1 SA exist for the

duration of the Phase 2 SA’s lifetime, but it is convenient because a Delete message may be sent.

■

The two SA Lifetime items specify the lifetime associated with each Phase 1 SA and control when the SA

will expire and become invalid.

■

Phase 1 SA Lifetime (seconds) speciﬁes the duration in seconds for which the SA will remain valid.

The range of permissible values is the set of non-negative integer values between 0 and 2^32-1. The

default value is 28,800 seconds. The value zero speciﬁes the default.

Phase 1 SA Lifetime (Kbytes) speciﬁes the maximum number of kilobytes of data that may be

secured (encrypted/decrypted or authenticated) using the SA before it expires and becomes invalid.

The range of permissible values is the set of non-negative integer values between 0 and 2^32-1. The

default value is 0 Kilobytes. The value zero speciﬁes the absence of a secured data lifetime.

Note: It is invalid to set both lifetime values to zero. This condition is not enforced by the console (in order to

avoid order dependencies when conﬁguring the items), but will set defaults at runtime.

■

Send Initial Contact Message toggles whether or not the IKE negotiation process begins by sending an

initial contact message. The default is Yes.

Include Vendor-ID Payload toggles whether or not the router includes the vendor-ID payload in its IKE

Phase 1 messages.

Independent Phase 2 Re-keys toggles whether or not a Phase 2 re-keys requires a Phase 1 re-key. If this

item is set to Yes (the default), Phase 2 re-keys will be performed independently when necessary without

requiring a Phase 1 re-key. If this item is set to No, each Phase 2 re-key will be preceded by a Phase 1

re-key. This item should normally be set to Yes unless the device is communicating with a non-compliant

remote IPsec peer that requires that a Phase 1 re-key precede each Phase 2 re-key.

■

Strict Port Policy toggles whether or not IKE requires packets to originate from the IANA IKE port (500).

Set to Yes, the router will listen only to port 500 and source its packets from port 500. Set to No, the

router will return trafﬁc to whatever port originated it.

Download from Www.Somanuals.com. All Manuals Search And Download.

5-8 Firmware User Guide

Changing an IKE Phase 1 Proﬁle

Selecting Display/Change IKE Phase 1 Proﬁle or Delete IKE Phase 1 Proﬁle displays an IKE Phase 1 proﬁle

pop-up menu listing the names of all currently deﬁned IKE Phase 1 proﬁles:

IPsec Configuration

+--IKE Phase1 Profile--+

+----------------------+

D| IKE Profile 2

|1 Profile...

A| Arthropods

D| Anthropoids

|e...

| Anopheles

| Albigensians

+----------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

Selecting Display/Change IKE Phase 1 Proﬁle and choosing an IKE phase 1 proﬁle name from the pop-up list

displays the Change IKE Phase 1 Proﬁle screen. This screen is identical to the Add IKE Phase 1 Proﬁle screen

shown above.

Selecting Delete IKE Phase 1 Proﬁle and choosing an IKE phase 1 proﬁle name from the pop-up list displays a

conﬁrmation alert asking you to conﬁrm that you really want to delete the speciﬁed IKE phase 1 proﬁle:

IPsec Configuration

+--IKE Phase1 Profile--+

Display+----------------------+

Add IKE| Netopia

+------------------------------------------------------------+

| Are you sure you want to delete this IKE Phase 1 Profile? |

CANCEL

CONTINUE

+------------------------------------------------------------+

+----------------------+

Download from Www.Somanuals.com. All Manuals Search And Download.

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-9

Key Management

You specify your IKE key management on a per-Connection Proﬁle basis. You can do this in one of three ways:

■

You can create your IKE Phase 1 Proﬁle ﬁrst, and then associate it with an existing Connection Proﬁle

You can create a Connection Proﬁle and then modify it to associate it with an existing IKE Phase 1 Proﬁle

You can create a new Connection Proﬁle and add a new IKE Phase 1 Proﬁle as you go

You can do this WAN Conﬁguration menus.

Refer to “Creating a New Connection Proﬁle” on page 2-24 for instructions on creating a Connection Proﬁle if

you don’t already know how to do that.

You can access the Key Management menus from the Change Connection Proﬁle menu under the WAN

Conﬁguration screen for a Connection Proﬁle you have already created,

Main

Display/Change

Connection Profile

WAN Configuration

or you can create a new Connection Proﬁle with your IKE settings included, as you go.

The IKE Key management settings are part of the Data Link Options that you specify in the Add Connection

Proﬁle or Change Connection Proﬁle menus. In this description, it is assumed that you are changing an existing

Connection Proﬁle.

A Change Connection Proﬁle screen is shown below.

Change Connection Profile

Profile Name:

Easy Setup Profile

+-------------+

Profile Enabled:

+-------------+

Encapsulation Type...

| PPP

Encapsulation Options...

| ATMP

| PPTP

| IPsec

IP Profile Parameters...

+-------------+

Telco Options...

COMMIT

CANCEL

Download from Www.Somanuals.com. All Manuals Search And Download.

5-10 Firmware User Guide

Note: The Change Connection Proﬁle screen will offer different options, depending on the model of router you

are using. For a router with the Dial Backup feature, you can associate an IPsec proﬁle with the Primary, the

Backup, or choose to apply it to Any Port of the WAN interface by choosing the interface from the Interface

Group pop-up menu as shown below.

Add Connection Profile

Profile Name:

Profile 1

Yes

Profile Enabled:

Encapsulation Type...

IPsec

Encapsulation Options...

IP Profile Parameters...

Interface Group...

COMMIT

+--------------+

| Primary

| Backup

| Any Port

+--------------+

CANCEL

From the Encapsulation Type pop-up menu, select IPsec. Then select Encapsulation Options and press Return.

The IPsec Tunnel Options screen appears.

IPsec Tunnel Options

Key Management...

IKE

ESP

IKE Phase 1 Profile...

Encapsulation...

ESP Encryption Transform...

DES

ESP Authentication Transform...

HMAC-MD5-96

Advanced IPsec Options...

COMMIT

CANCEL

Download from Www.Somanuals.com. All Manuals Search And Download.

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-11

The Key Management pop-up menu at the top of the IPsec Tunnel Options screen allows you to choose

between IKE key management (the default for a new IPsec proﬁle) and Manual key management.

If you select Manual, the IKE Phase 1 Proﬁle option does not display, and you must enter your IPsec Manual

Keys under the IPsec Manual Keys screen. See “IPsec Manual Key Entry” on page 19.

■

The IKE Phase 1 Proﬁle pop-up menu allows you to associate an IKE Phase 1 Proﬁle with the IPsec tunnel.

An IKE Phase 1 Proﬁle speciﬁes the set of parameters that will be used for the IKE Phase 1 exchange. IKE

Phase 1 Proﬁles may be shared by multiple IPsec tunnels. The pop-up menu item displays the name of the

currently associated IKE Phase 1 Proﬁle, if any, or is blank if no IKE Phase 1 proﬁle is associated with the

tunnel.

The pop-up menu lists the names of all currently deﬁned IKE Phase 1 Proﬁles. The pop-up menu also

includes an <<ADD PH1 PROFILE>> item to allow you to deﬁne a new IKE Phase 1 Proﬁle directly without

ﬁrst going to the IPsec Conﬁguration screen, and a <<NONE>> item to allow you to dissociate an existing

IKE Phase 1 Proﬁle from the IPsec tunnel.

The remainder of the screen allows you to conﬁgure the IKE Phase 2 parameters that control the contents of

the single IKE Phase 2 proposal sent by the router. These same items specify the values that must be offered

by one of the remote peer’s proposals.

■

The Encapsulation pop-up menu allows you to select what IPsec encapsulations will be used: ESP only (the

default), AH only, or AH+ESP (both AH and ESP).

An AH Authentication Transform pop-up menu (which is visible only if you have selected AH or AH+ESP

encapsulation) allows you to specify the type of AH authentication: HMAC-MD5-96 or HMAC-SHA1–96.

The ESP Encryption Transform pop-up menu (which is visible only if you have selected ESP or AH+ESP

encapsulation) allows you to specify the type of ESP encryption: DES, 3DES, or NULL (no encryption).

The ESP Authentication Transform pop-up menu (which is visible only if you have selected ESP or AH+ESP

encapsulation) allows you to specify the type of ESP authentication: None, HMAC-MD5-96, or

HMAC-SHA1–96.

If you select Advanced IPsec Options, the Advanced IPsec Options screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

5-12 Firmware User Guide

Advanced IPsec Options

SA Lifetime seconds:

SA Lifetime Kbytes:

28800

Perfect Forward Secrecy:

Dead Peer Detection:

Yes

This screen allows you to specify the lifetime associated with each IPsec Security Association (SA) and control

when the SA will expire and become invalid.

■

SA Lifetime (seconds) speciﬁes the duration in seconds for which the SA will remain valid. The range of

permissible values is the set of non-negative integer values between 0 and 2^32-1. The default value is

28,800 seconds (1 hour). The value zero speciﬁes the absence of an elapsed time lifetime.

■

SA Lifetime (Kilobytes) speciﬁes the maximum number of kilobytes of data that may be secured

(encrypted/decrypted or authenticated) using the SA before it expires and becomes invalid. The range of

permissible values is the set of non-negative integer values between 0 and 2^32-1. The default value is 0

Kilobytes. The value zero speciﬁes the absence of a secured data lifetime.

Note: It is invalid to set both lifetime values to zero! This condition is not enforced by the console (in order to

avoid order dependencies when conﬁguring the items), but rather is enforced at runtime and will cause the

IPsec proﬁle to assume the defaults.

■

Perfect Forward Secrecy toggles whether or not Perfect Forward Secrecy will be used. Enabling Perfect

Forward Secrecy (the default) causes IKE to perform a new Difﬁe-Hellman exchange with each Phase 2

re-key. Because the additional Difﬁe-Hellman exchanges required for Perfect Forward Secrecy introduce

additional overhead, it may be good to disable Perfect Forward Secrecy when security does not require it.

■

Dead Peer Detection toggles whether or not the router will detect a remote peer being ofﬂine.

Enhanced Dead Peer Detection

Netopia Firmware Version 5.4 adds a new Dead Peer Detection mechanism.

In previous ﬁrmware versions, when Dead Peer Detection was enabled, a counter would begin in the router

when any trafﬁc was sent through the tunnel. Determination of a dead peer could take up to eight minutes.

Download from Www.Somanuals.com. All Manuals Search And Download.

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-13

Netopia Firmware Version 5.4 provides a new Dead Peer Detection mechanism. An IPsec IP net interface

sends ICMP ping requests to a speciﬁc IP address on a Remote Member network. The ping is periodic, and

the reply is expected within a certain amount of time. If the ICMP reply does not arrive within that time, the

peer is considered dead, the current phase 2 SAs are torn down, and the IKE SA starts a new phase 1

negotiation, followed by the normal phase 2 negotiation, thereafter.

When you toggle Dead Peer Detection to Yes (on), new options appear.

Advanced IPsec Options

SA Lifetime seconds:

SA Lifetime Kbytes:

28800

Perfect Forward Secrecy:

Yes

Dead Peer Detection:

Ping host:

Yes

1.1.1.1

Ping retry interval:

Ping reply timeout:

■

Ping host allows you to specify the host IP address of the host to ping, and from which replies will be

expected.

This ﬁeld is only available if you have previously conﬁgured, and committed, remote network IP data in the

Add Network Conﬁguration screen under Advanced IP Proﬁle Options. See “Add Network Conﬁguration” on

page 5-15.

■

Ping retry interval and Ping reply timeout options appear.

The defaults are 5 seconds and 90 seconds, respectively. You may adjust these to suit your network’s

tolerances.

Note:

• ICMP Dead Peer Detection is not available when using manual re-keying.

• ICMP Dead Peer Detection does not initiate a series of phase 2 exchanges upon detecting a dead peer; it

instead initiates a new phase 1 negotiation, followed by a new phase 2 negotiation once contact with the peer

has been re-established.

• If you are using Multiple Network IPsec, the IP address of the ICMP Dead Peer Detection mechanism must be

constrained to the set of network ranges deﬁned for the IPsec proﬁle.

Press Escape to return to the Add or Change Connection Proﬁle screen, and select IP Proﬁle Parameters.

Download from Www.Somanuals.com. All Manuals Search And Download.

5-14 Firmware User Guide

If you enable IKE key management the IP Proﬁle Parameters screen appears.

IP Profile Parameters

Remote Tunnel Endpoint:

Add Network...

0.0.0.0

Address Translation Enabled:

Filter Set...

<<None>>

Remove Filter Set

Advanced IP Profile Options...

COMMIT

CANCEL

■

The Remote Tunnel Endpoint ﬁeld accepts either an IP address in the familiar dotted–quad notation a.b.c.d

or a hostname to be resolved using the Domain Name System (DNS).

Multiple Network IPsec

Netopia Firmware Version 5.4 offers an enhancement to IPsec VPN tunnels allowing multiple network support.

This feature enhances your Netopia Router’s Virtual Private Networking functionality.

This feature allows you to deﬁne many local and remote network ranges for a given IPsec VPN proﬁle. Each of

these ranges has its own IPsec tunnel. However, each tunnel has a common tunneling endpoint and encryption

policy. This is useful, for example, for branch ofﬁce management of multiple IP subnets over an encrypted VPN

tunnel. The following diagram illustrates this feature:

Advantages of Multiple Network IPsec are:

■

scalability

■

ﬂexibility, by adding any combination of remote/local network ranges

Download from Www.Somanuals.com. All Manuals Search And Download.

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-15

support for sub-netting, host and network range addressing modes

■

works with manual keying and Internet Key Exchange (IKE)

each IPsec network works under the same local/remote tunnel endpoints

■

Select Add Network and press Return. The Add Network Conﬁguration screen appears.

Add Network Configuration

+--------------+

Remote Member Format...

Remote Member Address:

Remote Member Mask:

Local Member Format...

Local Member Address:

Local Member Mask:

| Subnet

| Range

| Host Address |

+--------------+

0.0.0.0

COMMIT

CANCEL

■

The Remote Member Format and Local Member Format pop-up menus allow you to choose a format for

your network end points: Subnet, Range, or a single Host Address.

■

If you choose Subnet, you must enter the Remote Member Address and the subnet mask that is the

Remote Member Mask.

Enter the Local Member Address and the Local Member Mask in their respective ﬁelds.

If you choose Range, the next two ﬁelds become Remote Member 1st Address and Remote Member

Last Address. You supply these values.

Complete the Local Member 1st Address and Local Member Last Address ﬁelds.

If you choose Host Address, you need only supply the Remote Member Address and the Local Mem-

ber Address; the other ﬁelds are hidden.

■

Select COMMIT and press Return to add the conﬁguration. This returns you to the IP Proﬁle Parameters

screen. Select COMMIT and press Return in the IP Proﬁle Parameters screen. This returns you to the

Change Connection Proﬁle screen. Select COMMIT and press Return in the Change Connection Proﬁle

screen.

Note:

• Any two IPsec tunnels differ only by the local/remote networks they are intended to reach; they have the

same encryption policy, which is derived from the base proﬁle.

• The feature is limited to 8 networks per tunnel.

Download from Www.Somanuals.com. All Manuals Search And Download.

5-16 Firmware User Guide

If you return to the IP Proﬁle Parameters screen, two new ﬁelds are displayed:

IP Profile Parameters

Remote Tunnel Endpoint:

0.0.0.0

Add Network...

Display/Change Network...

Delete Network...

Address Translation Enabled:

Filter Set...

<<None>>

Remove Filter Set

Advanced IP Profile Options...

COMMIT

CANCEL

Enter the IP Address or hostname of the remote tunnel endpoint.

■

Display/Change Network allows you to make changes to existing network conﬁgurations you have made. If

you select Display/Change Network, a list of your conﬁgured networks displays.

Display/Change Network Configuration

--------------Local-Members-------------------------Remote-Members--------------

Net #---Type----Start-Address---Size----------Type----Start-Address---Size------

----------------------------------SCROLL UP-----------------------------------

SUBNET 192.168.2.1

SUBNET 10.0.1.1

/24

SUBNET 192.168.1.0

SUBNET 10.0.0.1

/24

HOST 163.176.91.101 -

RANGE 163.176.30.222 21

HOST 163.176.91.100 -

RANGE 163.176.91.100 100

---------------------------------SCROLL DOWN----------------------------------

■

Scroll down and up with the arrow keys to select the one you want to change, and press Return. You will be

returned to the Network Conﬁguration screen where you can make any required changes.

If you select Delete Network in the IP Proﬁle Parameters screen, the same scrolling list will display. When

you select one of the networks and press Return, a warning screen will ask you to conﬁrm your choice:

Download from Www.Somanuals.com. All Manuals Search And Download.

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-17

+--------------------------------------------------------------+24

| Are you sure you want to delete this network configuration? |8

CANCEL

CONTINUE

|00

+--------------------------------------------------------------+

■

Specifying IKE key management alters the Advanced IP Proﬁle Options screen as follows:

Advanced IP Profile Options

Local Tunnel Endpoint Address:

Next Hop Gateway:

0.0.0.0

Idle Timeout (seconds):

300

■

You can specify a Local Tunnel Endpoint Address. If not 0.0.0.0, this value must be one of the assigned

interface addresses, either WAN or LAN. This is used as the source address of all IPsec trafﬁc.

You can specify a Next Hop Gateway. If you specify the Remote Tunnel Endpoint Address, and the address

is in the same subnet as the Remote Members Network you speciﬁed in the IP Proﬁle Parameters, the

Next Hop Gateway option allows you to enter the address by which the gateway partner is reached.

If you do not specify the Remote Tunnel Endpoint Address, the router will use the default gateway to reach

the partner. If the partner should be reached via an alternate port (for example, the LAN instead of the

WAN), the Next Hop Gateway ﬁeld allows this path to be resolved.

■

You can specify an Idle Timeout (seconds) value. The idle timeout tells the router that if no trafﬁc passes

through the tunnel for the speciﬁed number of seconds, no automatic SA re-key should be performed.

When new trafﬁc does pass through the tunnel, the idle timeout interval resets again when the current SAs

expire.

If you set the value to zero, the router will re-key the SA whenever the SA Lifetime interval speciﬁes,

regardless of whether trafﬁc is passing through it or not. This will effectively “nail up” the tunnel.

Download from Www.Somanuals.com. All Manuals Search And Download.

5-18 Firmware User Guide

IPsec WAN Conﬁguration Screens

You can also conﬁgure IKE Phase 1 Proﬁles in the WAN Conﬁguration menus.

Main

IKE Phase 1

Configuration

WAN Configuration

The WAN Conﬁguration screen now includes IKE Phase 1 Conﬁguration as shown:

WAN Configuration

WAN (Wide Area Network) Setup...

Display/Change Connection Profile...

Add Connection Profile...

Delete Connection Profile...

WAN Default Profile...

ATMP/PPTP Default Profile...

IKE Phase 1 Configuration...

Scheduled Connections...

Accounting Configuration...

Establish WAN Connection...

Disconnect WAN Connection...

From here you will configure yours and the remote sites' WAN information.

Select IKE Phase 1 Conﬁguration and press Return.

The IKE Phase 1 Conﬁguration screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-19

IKE Phase 1 Configuration

Display/Change IKE Phase 1 Profile...

Add IKE Phase 1 Profile...

Delete IKE Phase 1 Profile...

The IKE Phase 1 Conﬁguration screen allows conﬁguration of global (non-connection-proﬁle-speciﬁc) IPsec

parameters. This screen allows you to Display, Change, Add, or Delete an IKE Phase 1 proﬁle.

IPsec Manual Key Entry

The Version 5.3 ﬁrmware has a redesigned layout and additional options for manual key entry. If you selected

Manual Key Management in the IPsec Tunnel Options screen, you will need to enter your encryption keys in the

IPsec Manual Keys screen.

IPsec Tunnel Options

Key Management...

Encapsulation...

Manual

ESP

ESP Encryption Transform...

DES

ESP Authentication Transform...

HMAC-MD5-96

IPsec Manual Keys...

COMMIT

CANCEL

Download from Www.Somanuals.com. All Manuals Search And Download.

5-20 Firmware User Guide

Select IPsec Manual Keys and press Return.

IPsec Manual Keys

SHA1 ESP Auth. Key:

SHA1 AH Auth. Key:

Depending on your selections of Encapsulation, Encryption Transform, and Authentication Transform in the

IPsec Tunnel Options screen, the IPsec Manual Keys screen will display differing entry ﬁelds to enter

authorization keys and encryption keys.

With Manual Keys, you must manually conﬁgure identical authentication and encryption keys at both ends of

the tunnel. The authentication keys are either 32 (for MD5) or 40 (for SHA1) ascii hex characters, while the

encryption keys are 16 (for DES) or 48 (for triple-DES) ascii-hex characters.

VPN Quickview

Statistics are displayed on the VPN Quick View screen.

Quick

View

Main

VPN

Quick View

The VPN Quick View screen has been modiﬁed slightly in ﬁrmware version 5.3.

Download from Www.Somanuals.com. All Manuals Search And Download.

Internet Key Exchange (IKE) IPsec Key Management for VPNs 5-21

VPN Quick View

Profile Name----------Type--Rx Pckts--Tx Pckts--Discard--Remote Address--

HA <-> FA1 (Jony Fon ATMP

HA <-> FA3 (Sleve M. ATMP

173.166.82.8

63.193.117.91

0.0.0.0

My IPsec Tunnel

Bangalore

IPsec

PPTP

1.1.1.1

If the remote tunnel end point is a hostname (or “0.0.0.0”) 0.0.0.0 is displayed until a Security Association is

established. Previously the remote members network was displayed.

WAN Event History Error Reporting

The following events are logged and displayed in the WAN Event History screen:

Event message:

Meaning:

IKE: no ph1 preferences assigned An attempt was made to use an IPsec proﬁle with no IKE

proﬁle attached to it.

IKE: DNS lookup failure

The DNS lookup of the remote tunnel end point has failed.

IKE: no matching ph1 proﬁle

An IKE phase 1 request was received and did not match

any of the proﬁles stored in the local router.

IKE: no matching proposal

An IKE phase 1 request was received and the proposal did

not match an allowed parameter, or else the remote

rejected the local router’s proposal.

IKE: phase 1 auth failure

The phase 1 remote authentication failed.

IKE: phase 1 resend timeout

The attempt to resend the phase 1 remote authentication

timed out.

IKE: phase 1 complete

The phase 1 negotiation completed successfully.

IKE: phase 2 hash failure

The phase-2 hash failed because the data received is out

of date or has been tampered with.

Download from Www.Somanuals.com. All Manuals Search And Download.

5-22 Firmware User Guide

Event message:

Meaning:

IKE: no matching ph2 proposal

IKE: ph2 resend timeout

IKE: phase 2 complete

Either the local router rejected the proposals of the remote

or the remote rejected the local router’s.

The attempt to resend the phase 2 authentication timed

out.

The phase 2 negotiation completed successfully.

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-1

Chapter 6

IP Setup

The Netopia Firmware Version 5.4 uses Internet Protocol (IP) to communicate both locally and with remote

networks. This chapter shows you how to conﬁgure the router to route IP trafﬁc. You also learn how to conﬁgure

the router to se r v e IP addresses to hosts on your local network.

Netopia’s IP routing features Network Address Translation and IP address serving.

This section covers the following topics:

■

“IP Setup” on page 6-2

“RIP-2 MD5 Authentication” on page 6-10

“IP Address Se r v ing” on page 6-17

“More Address Serving Options” on page 6-24

“DHCP Relay Agent” on page 6-30

“Connection Proﬁles” on page 6-32

“Multicast Forwarding” on page 6-34

Network Address Translation allows communication between the LAN connected to the Router and the Internet

using a single (or a few) IP address(es) instead of a routed account with separate IP addresses for each

computer on the network.

Network Address Translation also provides increased security by hiding the local IP addresses of the LAN

connected to the Netopia routers from the outside world.

The setup is simpler, so ISPs typically offer Internet accounts supporting Network Address Translation at a

signiﬁcant cost savings.

For a detailed discussion of Network Address Translation, see Chapter 3, “Multiple Network Address

Translation.”

Download from Www.Somanuals.com. All Manuals Search And Download.

6-2 Firmware User Guide

IP Setup

Main

System

Configuration

IP Setup

The IP Setup options screen is where you conﬁgure the Ethernet side of the Router. The information you enter

here controls how the router routes IP trafﬁc.

Consult your network administrator or ISP to obtain the IP setup information (such as the Ethernet IP address,

Ethernet subnet mask, default IP gateway, and Primary Domain Name Server IP address) you will need before

changing any of the settings in this screen. Changes to these settings that you make in this screen will take

effect only after the Netopia device is reset.

To go to the IP Setup options screen, from the Main Menu, select System Conﬁguration, then IP Setup.

The IP Setup screen appears.

IP Setup

Ethernet IP Address:

192.128.117.162

255.255.255.0

Ethernet Subnet Mask:

Define Additional Subnets...

Default IP Gateway:

192.128.117.163

0.0.0.0

Backup IP Gateway:

Primary Domain Name Server:

Secondary Domain Name Server:

Domain Name:

0.0.0.0

yourdomain.com

RIP Options...

Multicast Forwarding...

None

Static Routes...

IP Address Serving...

Follow these steps to conﬁgure IP setup for your Router:

■

Select Ethernet IP Address and enter the IP address for the Router’s Ethernet port.

■

Select Ethernet Subnet Mask and enter the subnet mask for the Ethernet IP address that you entered in

the last step.

■

If you desire multiple subnets select Deﬁne Additional Subnets. If you select this item you will be taken to

the IP Subnets screen. This screen allows you to deﬁne IP addresses and masks for additional subnets.

See “IP subnets” on page 6-4 for details.

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-3

The Netopia Firmware Version 5.4 supports multiple IP subnets on the Ethernet interface. You may want to

conﬁgure multiple IP subnets to service more hosts than are possible with your primary subnet. It is not

always possible to obtain a larger subnet from your ISP. For example, if you already have a full Class C

subnet, your only option is multiple Class C subnets, since it is virtually impossible to justify a Class A or

Class B assignment.

If you are using NAT, you can use the reserved Class A or Class B subnet.

■

Select Default IP Gateway and enter the IP address for a default gateway. This can be the address of any

major router accessible to the Router.

A default gateway should be able to successfully route packets when the Router doesn’t know how to route

to the intended recipient’s IP address. Typically, a default gateway is the ISP’s router.

■

If a backup gateway is available, select Backup IP Gateway and enter the IP address of a gateway that you

want to use for backup in the event of a connection failure. See “Backup Default Gateway” on page 7-13

for conﬁguration details.

Select Primary Domain Name Server and enter the IP address for a domain name server. The domain

name server matches the alphabetic addresses favored by people (for example, robin.hood.com) to the IP

addresses actually used by IP routers (for example, 163.7.8.202).

If a secondary DNS server is available, select Secondary Domain Name Server and enter its IP address.

The secondary DNS server is used by the Router when the primary DNS server is inaccessible. Entering a

secondary DNS is useful but not necessary.

■

Select Domain Name and enter your network’s domain name (for example, netopia.com). Netopia strongly

recommends that you enter a domain name.

Routing Information Protocol (RIP) is needed if there are IP routers on other segments of your Ethernet

network that the Router needs to recognize. If this is the case select RIP Options and press Return. This

will take you to the Ethernet LAN RIP options screen, where you can conﬁgure several parameters,

including RIP v2 MD5 Authentication. See “RIP-2 MD5 Authentication” on page 6-10.

■

With Receive RIP set to v1, the Ethernet port will accept routing information provided by RIP packets

from other routers that use the same subnet mask. Set to v2, the router will accept routing informa-

tion provided by RIP packets from other routers that use different subnet masks. Set to Both, the

router will accept information from either RIP v1 or v2 routers.

■

With Transmit RIP v1 selected, the router will generate RIP packets only to other RIP v1 routers. With

Transmit RIP v2 (broadcast) selected, the router will generate RIP packets to all other hosts on the net-

work. With Transmit RIP v2 (multicast) selected, the router will generate RIP packets only to other rout-

ers capable of recognizing RIP v2 packets.

■

If you want to enable Multicast Forwarding, select Multicast Forwarding and from the pop-up menu,

choose the type that you want to enable. See “Multicast Forwarding” on page 6-34 for detailed

conﬁguration.

If you enable Multicast Forwarding, the next ﬁeld IGMP Version appears. You can choose v1 or v2 from the

pop-up menu.

■

Select Static Routes to manually conﬁgure IP routes. See the section “Static routes,” below.

If you select IP Address Serving you will be taken to the IP Address Serving screen (see “IP Address

Serving” on page 6-17). Since no two hosts can use the same IP address at the same time, make sure

Download from Www.Somanuals.com. All Manuals Search And Download.

6-4 Firmware User Guide

that the addresses distributed by the Router and those that are manually conﬁgured are not the same.

Each method of distribution must have its own exclusive range of addresses to draw from.

IP subnets

The IP Subnets screen allows you to conﬁgure up to eight Ethernet IP subnets on unlimited-user models, one

“primary” subnet and up to seven secondary subnets, by entering IP address/subnet mask pairs:

IP Subnets

IP Address

Subnet Mask

----------------

#1: 192.128.117.162

---------------

255.255.255.0

#2: 0.0.0.0

0.0.0.0

#3:

#4:

#5:

#6:

#7:

#8:

Note: You need not use this screen if you have only a single Ethernet IP subnet. In that case, you can continue

to enter or edit the IP address and subnet mask for the single subnet on the IP Setup screen.

This screen displays up to eight rows of two editable columns, preceded by a row number between one and

eight. If you have eight subnets conﬁgured, there will be eight rows on this screen. Otherwise, there will be one

more row than the number of conﬁgured subnets. The last row will have the value 0.0.0.0 in both the IP

address and subnet mask ﬁelds to indicate that you can edit the values in this row to conﬁgure an additional

subnet. All eight row labels are always visible, regardless of the number of subnets conﬁgured.

■

To add an IP subnet, enter the Router’s IP address on the subnet in the IP Address ﬁeld in a particular row

and the subnet mask for the subnet in the Subnet Mask ﬁeld in that row.

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-5

For example:

IP Subnets

IP Address

Subnet Mask

----------------

---------------

255.255.255.0

#1: 192.128.117.162

#2: 192.128.152.162

255.255.0.0

0.0.0.0

#3: 0.0.0.0

#4:

#5:

#6:

#7:

#8:

■

To delete a conﬁgured subnet, set both the IP address and subnet mask values to 0.0.0.0, either explicitly

or by clearing each ﬁeld and pressing Return to commit the change. When a conﬁgured subnet is deleted,

the values in subsequent rows adjust up to ﬁll the vacant ﬁelds.

The subnets conﬁgured on this screen are tied to the address serving pools conﬁgured on the IP Address Pools

screen, and that changes on this screen may affect the IP Address Pools screen. In particular, deleting a

subnet conﬁgured on this screen will delete the corresponding address serving pool, if any, on the IP Address

Pools screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

6-6 Firmware User Guide

If you have conﬁgured multiple Ethernet IP subnets, the IP Setup screen changes slightly:

IP Setup

Subnet Configuration...

Default IP Gateway:

192.128.117.163

Primary Domain Name Server:

Secondary Domain Name Server:

Domain Name:

0.0.0.0

Receive RIP...

Transmit RIP...

Both

v2 (multicast)

Static Routes...

IP Address Serving...

Network Address Translation (NAT)...

Set up the basic IP attributes of your Netopia in this screen.

The IP address and Subnet mask items are hidden, and the Deﬁne Additional Subnets... item becomes Subnet

Conﬁguration.... If you select Subnet Conﬁguration, you will return to the IP Subnets screen that allows you to

deﬁne IP addresses and masks for additional Ethernet IP subnets.

Static routes

Static routes are IP routes that are maintained manually. Each static route acts as a pointer that tells the

Router how to reach a particular network. However, static routes are used only if they appear in the IP routing

table, which contains all of the routes used by the Router (see “IP Routing Table” on page 9-7).

Static routes are helpful in situations where a route to a network must be used and other means of ﬁnding the

route are unavailable. For example, static routes are useful when you cannot rely on RIP.

To go to the Static Routes screen, select Static Routes in the IP Setup screen and press Return.

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-7

The Static Routes screen will appear.

Static Routes

Display/Change Static Route...

Add Static Route...

Delete Static Route...

Configure/View/Delete Static Routes from this and the following Screens.

Viewing static routes

To display a view-only table of static routes, select Display/Change Static Route. The table shown below will

appear.

+-Dest. Network---Subnet Mask-----Next Gateway----Priority-Enabled-+

+------------------------------------------------------------------+

| 0.0.0.0

0.0.0.0

163.176.8.1

Low

Yes

+------------------------------------------------------------------+

Select a Static Route to modify.

The table has the following columns:

Dest. Network: The network IP address of the destination network.

Download from Www.Somanuals.com. All Manuals Search And Download.

6-8 Firmware User Guide

Subnet Mask: The subnet mask associated with the destination network.

Next Gateway: The IP address of the router that will be used to reach the destination network.

Priority: An indication of whether the Router will use the static route when it conﬂicts with information received

from RIP packets.

Enabled: An indication of whether the static route should be installed in the IP routing table.

To return to the Static Routes screen, press Escape.

Adding a static route

To add a new static route, select Add Static Route in the Static Routes screen. The Add Static Route screen

will appear.

Add Static Route

Static Route Enabled:

Yes

Destination Network IP Address:

0.0.0.0

Destination Network Subnet Mask: 0.0.0.0

Next Gateway IP Address:

Route Priority...

0.0.0.0

High

Advertise Route Via RIP:

ADD STATIC ROUTE NOW

CANCEL

Configure a new Static Route in this Screen.

■

To install the static route in the IP routing table, select Static Route Enabled and toggle it to Yes. To

remove the static route from the IP routing table, select Static Route Enabled and toggle it to No.

Be sure to read the rules on the installation of static routes in the IP routing table. See “Rules of static

route installation” on page 6-9.

■

Select Destination Network IP Address and enter the network IP address of the destination network.

Select Destination Network Subnet Mask and enter the subnet mask used by the destination network.

Select Next Gateway IP Address and enter the IP address for the router that the Router will use to reach

the destination network. This router does not necessarily have to be part of the destination network, but it

must at least know where to forward packets destined for that network.

■

Select Route Priority and choose High or Low. High means that the static route takes precedence over RIP

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-9

information; Low means that the RIP information takes precedence over the static route.

■

If the static route conﬂicts with a connection proﬁle, the connection proﬁle will always take precedence.

To make sure that the static route is known only to the Router, select Advertise Route Via RIP and toggle

it to No. To allow other RIP-capable routers to know about the static route, select Advertise Route Via RIP

and toggle it to Yes. When Advertise Route Via RIP is toggled to Yes, a new item called RIP Metric appears

below Advertise Route Via RIP.

With RIP Metric you set the number of routers, from 1 to 15, between the sending router and the

destination router. The maximum number of routers on a packet’s route is 15. Setting RIP Metric to 1

means that a route can involve 15 routers, while setting it to 15 means a route can only involve one router.

■

Select ADD STATIC ROUTE NOW to save the new static route, or select CANCEL to discard it and return to

the Static Routes screen.

Up to 32 static routes can be created, but one is always reserved for the default gateway, which is

conﬁgured using either Easy Setup or the IP Setup screen in system conﬁguration.

Modifying a static route

To modify a static route, in the Static Routes screen select Display/Change Static Route to display a table of

static routes.

Select a static route from the table and go to the Change Static Route screen. The parameters in this screen

are the same as the ones in the Add Static Route screen (see “Adding a static route” on page 6-8).

Deleting a static route

To delete a static route, in the Static Routes screen select Delete Static Route to display a table of static

routes. Select a static route from the table and press Return to delete it. To exit the table without deleting the

selected static route, press Escape.

Rules of static route installation

The Netopia Firmware Version 5.4 applies certain rules before installing enabled static routes in the IP routing

table. An enabled static route will not be installed in the IP routing table if any of the following conditions are

true:

■

The static route’s Next Gateway IP Address matches an IP address in the range of IP addresses being

distributed by DHCP.

■

The static route’s Next Gateway IP Address is determined to be unreachable by the Router.

The static route’s route information conﬂicts with a connection proﬁle’s route information.

The connection proﬁle associated with the static route has a disabled dial-on-demand setting, and there is

no current connection using that connection proﬁle.

A static route that is already installed in the IP routing table will be removed if any of the conditions listed above

become true for that static route. However, an enabled static route is automatically reinstalled once the

conditions listed above are no longer true for that static route.

Download from Www.Somanuals.com. All Manuals Search And Download.

6-10 Firmware User Guide

RIP-2 MD5 Authentication

Firmware version 5.3.7 supports RIP-2 MD5 Authentication (RFC2082 Routing Internet Protocol Version 2,

Message Digest 5). The purpose of MD5 authentication is to provide an additional level of conﬁdence that a RIP

packet received was generated by a reliable source. In other words, MD5 authentication provides an enhanced

level of security that information that your PC receives does not originate from a malicious source posing as

part of your network.

Overview

All participants in an authenticated RIP environment on a network must share an identiﬁer key. There is no key

exchange protocol like IKE, so all keys must be manually entered by an administrator.

RIP-2 MD5 Authentication requires that an interface conﬁgured to receive authenticated packets ignore unau-

thenticated packets or packets authenticated with an invalid key. An interface that is not conﬁgured for

receiving authenticated packets ignores authenticated ones.

On a Netopia router, every interface will be allowed to have up to two keys. RIP-2 MD5 authentication can be

conﬁgured on the Ethernet LAN (all models), Ethernet WAN models, Connection Proﬁles, and the Default Proﬁle.

Keys can have lifetimes, deﬁned as a start date and time and an end date and time, or inﬁnite.

Key management

Typically, you conﬁgure only one key on a given interface and all of the interfaces that interact with that

interface. RIP updates are sent every 30 seconds. Each RIP packet is authenticated using one key and sent.

When the Netopia router receives an authenticated RIP packet from a device, it keeps track of that device

(peer).

The longer it is in use, a single key becomes less secure. Therefore, RFC2082 speciﬁes that an interface must

support at least two keys per interface to allow a transition from an old key to a new key. It is recommended

that you specify an overlapping time of ﬁve minutes for transitioning from one key to the next. Whenever two

keys are valid at the same time, the Netopia router tries to determine if other peers (devices that it has

received an authenticated packet from in the past three minutes) on its network are using the new key. If any of

the peers have not used the new key yet, the Netopia router will send RIP updates twice, once with each key.

If the last valid key expires, the Device Event History logs a “* RIP: last authentication key expired” message,

and continues to use that key as if it were still valid.

Authentication conﬁguration

To conﬁgure RIP-2 MD5 authentication, from the Main Menu, select System Conﬁguration, then IP Setup.

Main

System Configuration

IP Setup

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-11

The IP Setup screen appears.

IP Setup

Ethernet IP Address:

192.168.1.1

Ethernet Subnet Mask:

255.255.255.0

Define Additional Subnets...

Default IP Gateway:

0.0.0.0

Backup IP Gateway:

Primary Domain Name Server:

Secondary Domain Name Server:

Domain Name:

RIP Options...

Multicast Forwarding...

None

Static Routes...

IP Address Serving...

■

Select RIP Options. The Ethernet LAN RIP Options screen appears.

Ethernet LAN RIP Options

+-----------------------+

Receive RIP...

Transmit RIP...

| Off

| v1

| v2

| Both v1 and v2

| v2 MD5 Authentication |

+-----------------------+

Download from Www.Somanuals.com. All Manuals Search And Download.

6-12 Firmware User Guide

■

Select Receive RIP, and from the pull-down menu choose v2 MD5 Authentication.

Ethernet LAN RIP Options

Receive RIP...

v2 MD5 Authentication

Off

Transmit RIP...

RIP v2 Authentication Keys...

■

You can also select Transmit RIP, and choose v2 MD5 (broadcast) or v2 MD5 (multicast) from the

pull-down menu.

Ethernet LAN RIP Options

Receive RIP...

+--------------------+n

+--------------------+

Transmit RIP...

| Off

| v1

RIP v2 Authentication Keys...

| v2 (broadcast)

| v2 (multicast)

| v2 MD5 (broadcast) |

| v2 MD5 (multicast) |

+--------------------+

■

RIP v2 Authentication Keys is visible only if v2 MD5 Authentication is enabled for either Receive or

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-13

Transmit RIP.

Note:

• All of the changes on this menu require a reboot. This is unique to the Ethernet LAN. RIP changes on all other

interfaces are immediately effective.

• If you set the RIP Receive option to Both v1 and v2, the interface will ignore authenticated RIP packets since

authenticated v1 packets do not exist. Only v2 packets can be authenticated.

■

Select RIP v2 Authentication Keys.

The RIP v2 Authentication Keys screen appears.

RIP v2 Authentication Keys

Display/Change Key...

Add Key...

Delete Key...

Download from Www.Somanuals.com. All Manuals Search And Download.

6-14 Firmware User Guide

Adding a key

Select Add Key. The Add Key Screen appears.

Add Key

Key ID:

Authentication Key:

Start Date (MM/DD/YY):

Start Time (hh:mm):

AM or PM:

10/10/2002

12:00

End Time Mode:

End Date (MM/DD/YY):

End Time (hh/mm):

AM or PM:

Date

10/10/2002

12:00

COMMIT

CANCEL

■

The key identiﬁer Key ID can be any numeric value from 0 – 255, and must be unique per interface. You

can not have two keys with the same key ID on an interface.

The Authentication Key may consist of from 1 – 16 ASCII characters. These appear as asterisks when

typed.

The Start Date and End Date formats are determined by the System Date Format, set on the Set Date and

Time menu under the System Conﬁguration menus.

The Start Time and End Time formats are determined by the System Time Format. The AM or PM pull-down

menus do not appear if the time format is 24 hour time.

The End Time Mode pull-down menu allows you to select either Date or Inﬁnite. This determines whether or

not the key will expire at a speciﬁed time and date, or remain effective indeﬁnitely.

End Date, End Time, and AM or PM do not appear if the End Time Mode is set to “Inﬁnite”. Inﬁnite means

that the key begins when it begins, but it never expires. The acceptable year range is from 1904 – 2039.

■

When you are satisﬁed with your entries, select COMMIT and press Return.

This menu will not accept a non-unique Key ID on the same interface; failure to enter an authentication

key; or a negative start date, end date, or start time and end time range.

Changes to RIP Keys on all interfaces are immediately effective. This differs from the remainder of the RIP

conﬁguration on the Ethernet LAN, which requires a reboot. It is important that the keys be able to change

dynamically, however, because the purpose of entering more than one key on an interface is to insure a smooth

transition between keys with no network outages.

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-15

Changing or deleting a key

You change or delete a key by selecting it from a pop-up menu. In the RIP v2 Authentication Keys menu, select

Display/Change Key.

RIP v2 Authentication Keys

+-Key ID--Start Date--Start Time--End Date--End Time--Valid-+

+-----------------------------------------------------------+

| 1

| 255

10/10/2002 12:00 AM

3/11/2000 3:17 PM

Infinite

yes |

8/6/2002 1:24 AM no

+-----------------------------------------------------------+

Delete Key...

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

Note: The date and time formats are determined by the system date and time formats. If the current date

and time fall within the range of dates and times, the Valid ﬁeld indicates “yes”, otherwise it indicates

“no”.

You modify the Change Key menu in the same way as in the Add Key menu (see “Adding a key,” on page 14).

If you select Delete Key, a pop-up menu will ask you to conﬁrm your choice.

+----------------------------------------------------------+

| Are you sure you want to delete this RIP MD5 Key?

CANCEL

CONTINUE

+----------------------------------------------------------+

Download from Www.Somanuals.com. All Manuals Search And Download.

6-16 Firmware User Guide

Connection Proﬁles and Default Proﬁle

RIP-2 MD5 authentication may be conﬁgured in Connection Proﬁles, as well. If you are not using NAT, your public

Internet connection can beneﬁt from sending authenticated RIP packets as well as receiving them. To conﬁgure

RIP-2 MD5 authentication for a Connection Proﬁle, you can either change an existing Connection Proﬁle, or

create a new one.

The Default Proﬁle Leased and Switched menus are the same as the Connection Proﬁle RIP option and

associated menus. For brevity, the following example shows only the Connection Proﬁle RIP option and

associated menus.

In either case, navigate to the RIP Proﬁle Parameters screen under the IP Proﬁle Parameters menu of the

Display/Change (or Add) Connection Proﬁle screen.

Display/Change

Main

WAN

Configuration

IP Profile

Parameters

RIP Profile

Options

(or Add)

Connection Profile

The connection proﬁle RIP Proﬁle Parameters screen appears.

RIP Profile Parameters

Receive RIP:

v2 MD5 Authentication

Transmit RIP:

v2 MD5 (multicast)

Poison Reverse

TX RIP Policy...

RIP v2 Authentication Keys...

■

Receive RIP is always visible. Here you select Off, v1, v2, Both v1 and v2, or v2 MD5 Authentication from

the pull-down menu. For MD5 authentication, you must select v2 MD5 Authentication.

If NAT is disabled, Transmit RIP is visible. Here you select Off, v1, v2 (broadcast), v2 (multicast), v2 MD5

(broadcast), or v2 MD5 (multicast) from the pull-down menu. For MD5 authentication, you must select v2

MD5 (either broadcast or multicast).

■

If you chose any Transmit RIP option other than Off, TX RIP Policy is visible. Here you select Poison

Reverse, Split Horizon, or No Split Horizon from the pull-down menu. Unless otherwise instructed, leave the

default Poison Reverse.

If either Receive RIP or Transmit RIP is set to v2 MD5 Authentication, RIP v2 Authentication Keys is

visible. Selecting RIP v2 Authentication Keys takes you to the RIP v2 Authentication Keys screen, where you

can conﬁgure your keys in the same manner as in “Adding a key,” on page 14. After conﬁguring your key,

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-17

press COMMIT in the Add or Change Key screen, then press Escape three times to return to the Add or

Change Connection Proﬁle screen.

■

Select COMMIT in the Connection Proﬁle screen and press Return. Your changes become effective for the

speciﬁed Connection Proﬁle.

Power interruptions

Netopia 4000 Series routers use NTP updates to set the correct time. Consequently, the starting time after a

power cycle, whether from power failure or deliberately switching power off and on, is in the year 1904. This

could invalidate some keys that would otherwise be valid. To prevent this, if the system time is before the year

2000, all keys are considered valid regardless of their speciﬁed date and time ranges.

IP Address Serving

• Serve DHCP Clients

System

Configuration

Main

IP Address

Serving

• Serve BootP Clients

• Serve Dynamic WAN Clients

In addition to being a router, the Router is also an IP address server. There are three protocols it can use to

distribute IP addresses.

■

The ﬁrst, called Dynamic Host Conﬁguration Protocol (DHCP), is widely supported on PC networks, as well

as Apple Macintosh computers using Open Transport and computers using the UNIX operating system.

Addresses assigned via DHCP are “leased” or allocated for a short period of time; if a lease is not

renewed, the address becomes available for use by another computer. DHCP also allows most of the IP

parameters for a computer to be conﬁgured by the DHCP server, simplifying setup of each machine.

■

The second, called BootP (also known as Bootstrap Protocol), is the predecessor to DHCP and allows older

IP hosts to obtain most of the information that a DHCP client would obtain. However, in contrast, BootP

address assignments are “permanent” since there is no lease renewal mechanism in BootP.

The third protocol, called Dynamic WAN, is part of the PPP/MP suite of wide area protocols used for WAN

connections. It allows remote terminal adapters and NAT-enabled routers to be assigned a temporary IP

address for the duration of their connection.

Since no two hosts can use the same IP address at the same time, make sure that the addresses distributed

by the Router and those that are manually conﬁgured are not the same. Each method of distribution must have

its own exclusive range of addresses to draw from.

Download from Www.Somanuals.com. All Manuals Search And Download.

6-18 Firmware User Guide

Go to the System Conﬁguration screen. Select IP Address Serving and press Return. The IP Address Serving

screen will appear.

IP Address Serving

+--------------------+

IP Address Serving Mode...

| Disabled

| DHCP Server

Number of Client IP Addresses: | DHCP Relay Agent |

1st Client Address:

+--------------------+

192.168.1.1

Client Default Gateway...

Serve DHCP Clients:

Yes

DHCP Lease Time (Hours):

DHCP NetBIOS Options...

Serve BOOTP Clients:

Yes

Serve Dynamic WAN Clients

Follow these steps to conﬁgure IP Address Serving:

■

If you enabled IP Address Serving, then DHCP, BootP clients and Dynamic WAN clients are automatically

enabled.

■

The IP Address Serving Mode pop-up menu allows you to choose the way in which the Router will serve IP

addresses. The device can act as either a DHCP Server or a DHCP Relay Agent. (See “DHCP Relay Agent”

on page 6-30 for more information.) In most cases, you will use the device to serve its own pool of IP

addresses, hence DHCP Server is the default. Address serving can also be disabled.

■

Select Number of Client IP Addresses and enter the total number of contiguous IP addresses that the

Router will distribute to the client machines on your local area network. Twelve-user models are limited to

twelve IP addresses.

In the screen example shown above, ﬁve Client IP addresses have been allocated.

Select 1st Client Address and enter the ﬁrst client IP address that you will allocate to your ﬁrst client

machine. For instance, on your local area network you may want to ﬁrst ﬁgure out which machines are going

to be allocated speciﬁc static IP addresses so that you can determine the pool of IP addresses that you will

be serving addresses from via DHCP, BootP, and/or Dynamic WAN.

Example: Your ISP has given your Router the IP address 192.168.6.137, with a subnet mask of

255.255.255.248. The subnet mask allocated will give you six IP addresses to use when connecting to the

ISP over the Internet. Your address range will be from .137 – .143. In this example you would enter

192.168.6.138 as the 1st Client Address, since the router itself must have an IP address.

■

To enable DHCP, select Serve DHCP Clients and toggle it to Yes. DHCP serving is automatic when IP

Address Serving is enabled.

The default DHCP Lease time is one hour. This may be unnecessarily brief in your network environment.

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-19

Consequently, the DHCP lease time is conﬁgurable. The DHCP Lease Time (Hours) setting allows you to

modify the router’s default lease time of one hour. You can enter any number up to and including 168 hours

(one week) for the DHCP lease.

Note: About DHCP Auto-conﬁguration:

Beginning with Firmware Version 5.3.4, routers whose model number ends in “-T” will allow the IP Address

Server to auto-conﬁgure when the router is conﬁgured with a new IP Address and Subnet Mask. This applies

according to the following guidelines:

• If you conﬁgure the router with a 24 bit Subnet Mask (Class C), the router will continue serving from 100-199,

with the new IP Address.

• If you conﬁgure the router with a subnet smaller than a Class C subnet, the router will serve all available

addresses.

• If you explicitly conﬁgure the DHCP pool, auto-conﬁguration of the DHCP pool is suppressed.

• If you conﬁgure the router manually and you would like the router to auto-conﬁgure DHCP, you must explicitly

set the IP Address and Subnet Mask to 0.0.0.0 and reboot.

If you have conﬁgured multiple Ethernet IP subnets, the appearance of the IP Address Serving screen is altered

slightly:

IP Address Serving

IP Address Serving Mode...

DHCP Server

Configure Address Pools...

Serve DHCP Clients:

Yes

DHCP Lease Time (Hours):

DHCP NetBIOS Options...

Serve BOOTP Clients:

Yes

Serve Dynamic WAN Clients

Three menu items are hidden, and Conﬁgure Address Pools... appears instead. If you select Conﬁgure

Address Pools... you will be taken to the IP Address Pools screen that allows you to conﬁgure an address

serving pool for each of the conﬁgured Ethernet IP subnets. See “IP Address Pools” on page 6-20.

Download from Www.Somanuals.com. All Manuals Search And Download.

6-20 Firmware User Guide

IP Address Pools

The IP Address Pools screen allows you to conﬁgure a separate IP address serving pool for each of up to eight

conﬁgured Ethernet IP subnets:

IP Address Pools

Subnet (# host addrs)

---------------------

192.128.117.0 (253)

1st Client Addr Clients Client Gateway

--------------- ------- --------------

192.128.117.196 16

192.129.117.110 8

192.128.117.162

192.129.117.4

192.129.117.0 (253)

This screen consists of between two and eight rows of four columns each. There are exactly as many rows as

there are Ethernet IP subnets conﬁgured on the IP Subnets screen.

■

The Subnet (# host addrs) column is non-selectable and non-editable. It indicates the network address of

the Ethernet IP subnet for which an address pool is being conﬁgured and the number of host addresses

available on the subnet. The network address is equal to the router’s IP address on the subnet

bitwise-ANDed with the subnet mask. The host address count is equal to the subnet size minus three,

since one address is reserved for the network address, one for the subnet broadcast address, and one for

the router’s interface address on the subnet.

You can edit the remaining columns in each row.

■

The 1st Client Addr and Clients columns allow you to specify the base and extent of the address serving

pool for a particular subnet. Entering 0.0.0.0 for the ﬁrst client address or 0 for the number of clients

indicates that no addresses will be served from the corresponding Ethernet IP subnet.

The Client Gateway column allows you to specify the default gateway address that will be provided to

clients served an address from the corresponding pool. The value defaults to the Router’s IP address on

the corresponding subnet (or the Router’s default gateway, if that gateway is located on the subnet in

question). You can override the value by entering any address that is part of the subnet.

DHCP, BootP, and dynamic WAN clients may receive an address from any one of the address serving pools

conﬁgured on this screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-21

Numerous factors inﬂuence the choice of served address. It is difﬁcult to specify the address that will be

served to a particular client in all circumstances. However, when the address server has been conﬁgured, and

the clients involved have no prior address serving interactions, the Router will generally serve the ﬁrst unused

address from the ﬁrst address pool with an available address. The Router starts from the pool on the ﬁrst row

and continues to the pool on the last row of this screen.

Once the address server and/or the clients have participated in address serving transactions, different rules

apply:

■

When requesting an address, a client will often suggest an address to be assigned, such as the one it was

last served. The Router will attempt to honor this request if the address is available. The client stores this

address in non-volatile storage, for example, on disk, and the speciﬁc storage method/location differs

depending on the client operating system.

When requesting an address, a client may provide a client identiﬁer, or, if it does not, the Netopia Firmware

Version 5.4 may construct a pseudo-client identiﬁer for the client. When the client subsequently requests

an address, the Router will attempt to serve the address previously associated with the pseudo-client

identiﬁer. This is normally the last address served to the client.

Otherwise, the Netopia will select the least-recently used available address, starting from the ﬁrst address

in the ﬁrst pool and ending with the last address in the last pool.

Note: The address serving pools on this screen are tied to the IP subnets conﬁgured on the IP Subnets

screen. Changes to the IP Subnets screen may affect this screen. In particular, deleting a subnet on the IP

Subnets screen will delete the corresponding address serving pool, if any, on this screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

6-22 Firmware User Guide

DHCP NetBIOS Options

If your network uses NetBIOS, you can enable the Router to use DHCP to distribute NetBIOS information.

NetBIOS stands for Network Basic Input/Output System. It is a layer of software originally developed by IBM

and Sytek to link a network operating system with speciﬁc hardware. NetBIOS has been adopted as an industry

standard. It offers LAN applications a variety of “hooks” to carry out inter-application communications and data

transfer. Essentially, NetBIOS is a way for application programs to talk to the network. To run an application that

works with NetBIOS, a non-IBM network operating system or network interface card must offer a NetBIOS

emulator. Many vendors either provide a version of NetBIOS to interface with their hardware or emulate its

transport layer communications services in their network products. A NetBIOS emulator is a program provided

by NetWare clients that allow workstations to run applications that support IBM’s NetBIOS calls.

■

Select DHCP NetBIOS Options and press Return. The DHCP NetBIOS Options screen appears.

DHCP NetBIOS Options

Serve NetBIOS Type:

NetBIOS Type...

Yes

Type B

Serve NetBIOS Scope:

NetBIOS Scope:

Serve NetBIOS Name Server:

NetBIOS Name Server IP Addr:

0.0.0.0

Configure DHCP-served NetBIOS options here.

■

To serve DHCP clients with the type of NetBIOS used on your network, select Serve NetBIOS Type and

toggle it to Yes.

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-23

■

From the NetBIOS Type pop-up menu, select the type of NetBIOS used on your network.

DHCP NetBIOS Options

+--------+

Serve NetBIOS Type:

NetBIOS Type...

+--------+

| Type B |

| Type P |

| Type M |

| Type H |

+--------+

Serve NetBIOS Scope:

NetBIOS Scope:

Serve NetBIOS Name Server:

NetBIOS Name Server IP Addr:

0.0.0.0

Local network Broadcast nodes

■

To serve DHCP clients with the NetBIOS scope, select Serve NetBIOS Scope and toggle it to Yes.

Select NetBIOS Scope and enter the scope.

To serve DHCP clients with the IP address of a NetBIOS name server, select Serve NetBIOS Name Server

and toggle it to Yes.

Select NetBIOS Name Server IP Addr and enter the IP address for the NetBIOS name server.

You are now ﬁnished setting up DHCP NetBIOS Options. To return to the IP Address Serving screen, press

Escape.

■

To enable BootP’s address serving capability, select Serve BOOTP Clients and toggle to Yes.

Note: Addresses assigned through BootP are permanently allocated from the IP Address Serving pool until

you release them. To release these addresses, navigate back to the Main Menu, then Statistics & Logs,

Served IP Addresses, and Lease Management.

Statistics

& Logs

Main

Served IP

Addresses

Lease Management

Download from Www.Somanuals.com. All Manuals Search And Download.

6-24 Firmware User Guide

IP Address Lease Management

Reset All Leases

Release BootP Leases

Reclaim Declined Addresses

Hit RETURN/ENTER, you will return to the previous screen.

Select Release BootP Leases and press Return.

■

Back in IP Address Serving, the Serve Dynamic WAN Clients toggle

More Address Serving Options

The Netopia Firmware Version 5.4 includes a number of enhancements in the built-in DHCP IP address server.

These enhancements include:

■

The ability to exclude one or more IP addresses from the address serving pool so the addresses will not be

served to clients.

■

The ability to reserve a particular IP address for a client with a particular Ethernet MAC address.

The ability to view the host name associated with a client to which the router has leased an IP address.

The ability for the router’s Ethernet IP address(es) to overlap the DHCP address serving pool(s).

The ability to serve as a DHCP Relay Agent.

The Netopia Firmware Version 5.4 supports reserving an IP address only for a type 1 client identiﬁer (i.e., an

Ethernet hardware address). It does not support reserving an IP address for an arbitrary client identiﬁer. (For

more information on client identiﬁers, see RFC 2131, section 9.14.)

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-25

Conﬁguring the IP Address Server options

To access the enhanced DHCP server functions, from the Main Menu navigate to Statistics & Logs and then

Served IP Addresses.

Main

Served IP

Addresses

Statistics & Logs

The following example shows the Served IP Addresses screen after three clients have leased IP addresses. The

ﬁrst client did not provide a Host Name in its DHCP messages; the second and third clients did.

Served IP Addresses

-IP Address------Type----Expires—-Host Name/Client Identifier-----------------

----------------------------------SCROLL UP-----------------------------------

192.168.1.100

192.168.1.101

192.168.1.102

192.168.1.103

192.168.1.104

192.168.1.105

192.168.1.106

192.168.1.107

192.168.1.108

192.168.1.109

192.168.1.110

192.168.1.111

192.168.1.112

192.168.1.113

DHCP

00:59

00:45

EN: 00-00-C5-70-00-04

Bill’s Pentium

Steve’s Power Mac

---------------------------------SCROLL DOWN----------------------------------

Lease Management...

The rightmost column displays the host name supplied by the client if one was provided; otherwise it displays

the client identiﬁer. (If a host name is displayed, the client identiﬁer is still accessible in a Details pop-up menu.

See below.)

Note: The server does not query the client for its host name. Macintosh computers running versions of

MacOS prior to MacOS version 8.5 (OT 2.0.1, TCP/IP 2.0.1) do not supply a host name option in their DHCP

messages, so no host name will appear in the Served IP Addresses list.

Download from Www.Somanuals.com. All Manuals Search And Download.

6-26 Firmware User Guide

You can select the entries in the Served IP Addresses screen. Use the up and down arrow keys to move the

selection to one of the entries in the list of served IP addresses.

Served IP Addresses

-IP Address------Type----Expires—-Host Name/Client Identifier-----------------

----------------------------------SCROLL UP-----------------------------------

192.168.1.100

192.168.1.101

192.168.1.102

192.168.1.103

192.168.1.104

192.168.1.105

192.168.1.106

192.168.1.107

192.168.1.108

192.168.1.109

192.168.1.110

192.168.1.111

192.168.1.112

192.168.1.113

+------------+

| Details... | Barr's XPi 120

| Exclude

| Release

| Reserve... |

+------------+

---------------------------------SCROLL DOWN----------------------------------

Lease Management...

Once you select an entry, pressing Return displays an action pop-up menu that lists operations that can be

performed on that entry. Possible operations are Details…, Exclude, Include, Release, and Reserve… The

action popup is context-sensitive and lists only those operations that apply to the selected IP address in its

current lease state.

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-27

Details… is displayed if the entry is associated with both a host name and a client identiﬁer.

■

Selecting Details… displays a pop-up menu that provides additional information associated with the IP

address. The pop-up menu includes the IP address as well as the host name and client identiﬁer supplied

by the client to which the address is leased.

Served IP Addresses

-IP Address------Type----Expires—-Host Name/Client Identifier-----------------

----------------------------------SCROLL UP-----------------------------------

192.168.1.100

192.168.1.101

+----------------------------------------------------------------------------+

| IP Address is 192.168.1.108

| Host Name is Barr's XPi 120

| Client ID is EN: 00-00-c5-45-89-ef

+----------------------------------------------------------------------------+

192.168.1.111

192.168.1.112

192.168.1.113

| Reserve... |

+------------+

---------------------------------SCROLL DOWN----------------------------------

Lease Management...

■

Exclude is displayed if the entry is not already excluded.

Selecting Exclude excludes the IP address from the address serving pool so the address will not be served

to a client. If the IP address is currently leased to or reserved for a client, you will be presented with a

warning dialog asking you to conﬁrm the operation.

Download from Www.Somanuals.com. All Manuals Search And Download.

6-28 Firmware User Guide

Served IP Addresses

-IP Address------Type----Expires—-Host Name/Client Identifier-----------------

----------------------------------SCROLL UP-----------------------------------

192.168.1.100

192.168.1.101

192.1+-------------------------------------------------------------+

192.1|

192.1| You are about to make changes that will affect an address |

192.1| that is currently in use. Are you sure you want to do this? |

192.1|

CANCEL

192.1+-------------------------------------------------------------+

192.168.1.111

192.168.1.112

192.168.1.113

| Reserve... |

+------------+

---------------------------------SCROLL DOWN----------------------------------

Lease Management...

■

Include is displayed if the entry is either excluded or declined.

An IP address is marked declined when a client to whom the DHCP server offers the address declines the

address. A client declines an address if it determines that a leased address is already in use by another

device.

Selecting Include restores the selected IP address to the address serving pool so that the IP address is

once again eligible to be served to a client.

■

Release is displayed if the entry is currently offered, leased, or reserved.

Selecting Release puts the selected entry in the available state. You will be presented with a warning

dialog asking you to conﬁrm the operation since the IP address is in use. There is no mechanism to notify

the client to whom the address is leased that the lease has been terminated. Thus, the client will continue

to use the address until the next time it attempts to renew its lease. In the interim, the server may lease

the same IP address to a different client, thereby creating an address conﬂict. For this reason, releasing

an address that is actively being used by a client is generally not recommended.

■

Reserve… is displayed if the entry is available, declined, excluded, leased, offered, or reserved.

Reserving an IP address for a client with a particular Ethernet MAC address guarantees that a client with

the speciﬁed MAC address will be offered or leased the speciﬁed IP address. Moreover, it prevents the

speciﬁed IP address from being offered or leased to any other client.

Selecting Reserve... displays a pop-up dialog box that displays the IP address and editable item in which

you can enter an Ethernet MAC address. The pop-up dialog box includes OK and CANCEL buttons for

conﬁrming or cancelling the operation. If the IP address is currently offered or leased to, or reserved for, a

client, you will be presented with a warning dialog asking you to conﬁrm the operation. Reserving an IP

address guarantees that the IP address will only be leased.

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-29

Served IP Addresses

-IP Address------Type----Expires—-Host Name/Client Identifier-----------------

----------------------------------SCROLL UP-----------------------------------

192.168.1.100

192.168.1.101

192.168.1.102 +--------------------------------------+

192.168.1.103 +--------------------------------------+

192.168.1.104 |

192.168.1.105 | IP Address is 192.168.1.108

192.168.1.106 | MAC Address: 00-00-c5-45-89-ef

192.168.1.107 |

192.168.1.108 |

192.168.1.109 |

192.168.1.110 |

CANCEL

192.168.1.111 +--------------------------------------+

192.168.1.112

192.168.1.113

+------------+

---------------------------------SCROLL DOWN----------------------------------

Lease Management...

The router’s Ethernet IP address(es) will be automatically excluded from the address serving pool(s) on startup.

Entries in the served IP address list corresponding to the router’s Ethernet IP address(es) that have been

automatically excluded on startup are not selectable.

Served IP Addresses

-IP Address------Type----Expires--Host Name/Client Identifier-----------------

----------------------------------SCROLL UP-----------------------------------

192.168.1.1

192.168.1.2

192.168.1.3

192.168.1.4

192.168.1.5

192.168.1.6

192.168.1.7

192.168.1.8

192.168.1.9

192.168.1.10

192.168.1.11

192.168.1.12

192.168.1.13

192.168.1.14

Excluded for the router's IP address

Excluded

DHCP

00:24

Barr's XPi 120

---------------------------------SCROLL DOWN----------------------------------

Lease Management...

Hit RETURN/ENTER for available operations.

Download from Www.Somanuals.com. All Manuals Search And Download.

6-30 Firmware User Guide

DHCP Relay Agent

The Netopia Firmware Version 5.4 offers DHCP Relay Agent functionality, as deﬁned in RFC1542. A DHCP relay

agent is a computer system or a router that is conﬁgured to forward DHCP requests from clients on the LAN to

a remote DHCP server, and to pass the replies back to the requesting client systems.

When a DHCP client starts up, it has no IP address, nor does it know the IP address of a DHCP server.

Therefore, it uses an IP broadcast to communicate with one or more DHCP servers. These broadcasts are

normally limited to the network segment on which the client is located, and do not pass through routers such as

the Netopia Router. If the Netopia Router is conﬁgured to act as a DHCP server, it will assign the client an

address from an address pool conﬁgured locally in the Netopia Router and respond to the client's request

itself.

However, if the Netopia Router is conﬁgured to act as a DHCP relay agent, it does not satisfy the DHCP request

itself, but instead forwards the request to one or more remote DHCP servers. These servers process the

request, assign an address from an address pool conﬁgured on the remote server, and forward the response

back to the Netopia Router for delivery back to the client. The agent then sends the response to the client on

behalf of the DHCP server. This process is transparent to the client, which doesn't know that it is

communicating through an intermediary rather than directly to a local server. Using DHCP relay, it is possible to

centralize the conﬁguration information for the host computers at many remote sites at a single location, easing

the burden of administering conﬁguration management for remote sites.

To conﬁgure the Netopia Router to act as a DHCP relay agent, from the Main Menu navigate to the System

Conﬁguration menu.

System

Configuration

Main

IP Address

Serving

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-31

Select IP Address Serving and press Return. The IP Address Serving screen appears.

IP Address Serving

+------------------+

IP Address Serving Mode...

| Disabled

| DHCP Server

Number of Client IP Addresses: | DHCP Relay Agent |

1st Client Address:

+------------------+

192.168.1.1

Client Default Gateway...

Serve DHCP Clients:

Yes

DHCP NetBIOS Options...

Serve BOOTP Clients:

Select IP Address Serving Mode. The pop-up menu offers the choices of Disabled, DHCP Server (the default),

and DHCP Relay Agent.

If you select DHCP Relay Agent and press Return, the screen changes as shown below.

IP Address Serving

IP Address Serving Mode...

DHCP Relay Agent

Relay Server #1:

Relay Server #2:

Relay Server #3:

10.1.1.1

20.1.1.1

30.1.1.1

Configure Address Serving (DHCP, BOOTP, etc.) here.

Now you can enter the IP address(es) of your remote DHCP server(s), such as might be located in your

company’s corporate headquarters. Each time you enter an IP address and press Return, an additional ﬁeld

appears. You can enter up to four DHCP server addresses.

In the example above, DHCP requests from clients on the LAN will be relayed to the DHCP servers at IP

addresses 10.1.1.1, 20.1.1.1, and 30.1.1.1.

Download from Www.Somanuals.com. All Manuals Search And Download.

6-32 Firmware User Guide

Note: The remote DHCP server(s) to which the Netopia Router is relaying DHCP requests must be capable of

servicing relayed requests. Not all DHCP servers support this feature. For example, the DHCP server in the

Netopia Router does not.

The DHCP server(s) to which the Netopia Router is relaying DHCP requests must be conﬁgured with one or more

address pools that are within the Netopia Router’s primary Ethernet LAN subnet. (There is no mechanism for

DHCP clients to receive an address on a secondary subnet via a relayed DHCP request.)

Connection Proﬁles

Since you will probably only have a single connection to your ISP over the remote link, you may not need to

create multiple connection proﬁles. Additional proﬁles may be useful for creating VPNs.

Connection Proﬁles deﬁne the line and networking protocols necessary for the router to make a remote

connection. A connection proﬁle is like an address book entry describing how the router is to get to a remote

site, or how to recognize and authenticate a remote user connecting to the router. To create a new Connection

Proﬁle, you navigate to the WAN Conﬁguration screen from the Main Menu, and select Add Connection Proﬁle.

WAN

Configuration

Main

Add Connection

Profile

The Add Connection Proﬁle screen appears.

Add Connection Profile

Profile Name:

Profile 1

Yes

Profile Enabled:

Data Link Encapsulation...

Data Link Options...

PPP

IP Profile Parameters...

COMMIT

CANCEL

Configure a new Conn. Profile. Finished? COMMIT or CANCEL to exit.

On a Router you can add up to 15 more connection proﬁles, for a total of 16, although only one can be used at

a time, unless you are using VPNs.

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-33

1. Select Proﬁle Name and enter a name for this connection proﬁle. It can be any name you wish. For

example: the name of your ISP.

2. Toggle the Proﬁle Enabled value to Yes or No. The default is Yes.

3. Select IP Proﬁle Parameters and press Return. The IP Proﬁle Parameters screen appears.

IP Profile Parameters

Address Translation Enabled:

IP Addressing...

Yes

Numbered

NAT Map List...

Easy-PAT List

Easy-Servers

NAT Server List...

Local WAN IP Address:

Local WAN IP Mask:

Remote IP Address:

Remote IP Mask:

0.0.0.0

Filter Set...

Remove Filter Set

RIP Profile Options...

Configure IP requirements for a remote network connection here.

4. Toggle or enter any IP parameters you require and return to the Add Connection Proﬁle screen by pressing

Escape. For more information on NAT, see “Multiple Network Address Translation,” beginning on page 3-1.

The Local WAN IP Address is displayed for numbered or NAT proﬁles. The Local WAN IP Mask is displayed

for numbered proﬁles. The Remote IP Address and Remote IP Mask are displayed for unnumbered proﬁles.

Download from Www.Somanuals.com. All Manuals Search And Download.

6-34 Firmware User Guide

5. Select ADD PROFILE NOW and press Return. Your new connection proﬁle will be added.

If you want to view the connection proﬁles in your router, return to the WAN Conﬁguration screen, and

select Display/Change Connection Proﬁle. The list of connection proﬁles is displayed in a scrolling pop-up

screen.

WAN Configuration

+-Profile Name---------------------IP Address------+

+--------------------------------------------------+

| Easy Setup Profile

127.0.0.2

0.0.0.0

| Profile 1

|on:

Yes

+--------------------------------------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

Multicast Forwarding

Multicast is a method for transmitting large amounts of information to many, but not all, hosts over an Internet.

One common use is to distribute real time audio and video to the set of hosts which have joined a distributed

conference.

Multicast is similar to radio or TV broadcasts in the sense that only those who have tuned in to a particular

frequency receive the information. You see and hear the channel you are interested in, but not the others.

Since a router should not be used as a passive forwarding device, Netopia routers use a protocol for forwarding

multicasting. This protocol is Internet Group Management Protocol (IGMP). Two versions of IGMP are available,

V1 and V2. Netopia routers can use either one, however, Multicast Forwarding will only work if your service

provider supports it. Check with your service provider.

You conﬁgure Multicast Forwarding in two console menu screens:

■

First, you enable Multicast Forwarding in the IP Setup screen in the System Conﬁguration menu,

■

Then you associate it with a Connection Proﬁle in the IP Proﬁle Parameters screen in the

Add/Display/Change Connection Proﬁle menus.

Navigate to the IP Setup screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

IP Setup 6-35

Main

Setup

System Configuration

By default, Multicast Forwarding is tuned off (None). You enable the router to transmit multicast data by

selecting Tx. from the pull-down menu.

IP Setup

Ethernet IP Address:

192.168.1.1

Ethernet Subnet Mask:

Define Additional Subnets...

255.255.255.0

Default IP Gateway:

0.0.0.0

Backup IP Gateway:

Primary Domain Name Server:

Secondary Domain Name Server:

Domain Name:

Receive RIP...

Both

Transmit RIP...

+----------------+

Multicast Forwarding...

IGMP Version...

| None

| Tx.

+----------------+

Static Routes...

IP Address Serving...

If you enable Multicast Forwarding, you will see a new option IGMP Version. This lets you choose V1 or V2. If

you know you will be communicating with other hosts that are limited to V1, select V1; otherwise, allow the

default V2.

Navigate to the IP Proﬁle Parameters screen.

Main

Add/Display/Change

Connection Profile

WAN Configuration

Download from Www.Somanuals.com. All Manuals Search And Download.

6-36 Firmware User Guide

IP Profile Parameters

Address Translation Enabled:

IP Addressing...

Yes

Numbered

NAT Map List...

Easy-PAT List

Easy-Servers

NAT Server List...

Local WAN IP Address:

Local WAN IP Mask:

Remote IP Address:

Remote IP Mask:

0.0.0.0

Filter Set...

+----------------+

Remove Filter Set

| None

| Rx.

+----------------+

Multicast Forwarding...

RIP Profile Options...

Typically, you will have a Connection Proﬁle that you created in Easy Setup. You may have more. Select the

Connection Proﬁle that you want to use from the Display/Change Connection Proﬁle menu, and then select IP

Proﬁle Parameters.

By default, Multicast Forwarding is turned off (None) on Connection Proﬁles until you enable a speciﬁc

Connection Proﬁle to receive multicast data. You enable it by selecting Rx. from the pull-down menu.

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Backup 7-1

Chapter 7

Line Backup

The ﬁrmware offers line backup functionality in the event of a line failure on a DSL, Ethernet, or leased-line

primary WAN link. The ﬁrmware supports backup

■

to an external modem connected to the Console port or

to a backup default gateway.

■

Conﬁguration of either method is similar, but differences are noted in their respective sections.

This chapter covers the following topics:

■

“External Dial Backup Support” on page 7-2

“Conﬁguring External Dial Backup” on page 7-2

“WAN Conﬁguration” on page 7-2

“Connection Proﬁles” on page 7-7

“Using Scheduled Connections with Backup” on page 7-8

“Management/Statistics” on page 7-10

“QuickView” on page 7-12

“Event Logs” on page 7-12

“SNMP Support” on page 7-13

“Backup Default Gateway” on page 7-13

The purpose of backup is to provide a recovery mechanism in the event that the primary connection fails. A

failure can be either line loss, for example by central site switch failure or physical cable breakage, or in the

case of Frame Relay (with LMI) or PPP, loss of end-to-end connectivity. Detection of one of these failures causes

the router to switch from using the primary WAN port to using the Console port to which a modem has been

attached. Alternatively, you can choose backup to an alternate gateway on the Ethernet LAN.

In the event of a loss of primary connectivity you have the option of switching back to the primary port

automatically once it has recovered its connection.

Download from Www.Somanuals.com. All Manuals Search And Download.

7-2 Firmware User Guide

External Dial Backup Support

Netopia equipment that supports the external dial backup feature automatically display the serial port

conﬁguration menus described in the following sections.

Models that do not support external dial backup do not display external dial backup-related menus, but offer

menus for backup to a default gateway. Generally, models that support external dial backup can be determined

from the following matrix:

External Dial Backup – Supported Models Matrix

WAN Interface:

IADs:

SDSL

SHDSL

ADSL

Yes

Data Routers:

* ADSL models do not currently support dial backup, but will support it in a revision in

the near future.

Conﬁguring External Dial Backup

Four menus support external dial backup conﬁguration:

■

the Serial Port Conﬁguration menu under the WAN Conﬁguration menus

Here you select the Modem/Auto mode to allow the Console port to be used for a modem.

the Backup Conﬁguration menu under WAN Conﬁguration, Advanced Connection Options

Here you select Backup is... Automatic, and Recovery is Automatic.

the Add Connection Proﬁle menus under the WAN Conﬁguration menus

Here you choose Encapsulation Type = PPP, ﬁll out the correct IP information, select Backup as the

interface group, and ﬁll out the Telco Options.

■

the Backup IP Gateway menu item in the IP Setup screen under the System Conﬁguration menu

Here you enter the Backup Gateway IP address.

Detailed descriptions follow.

WAN Conﬁguration

To conﬁgure Line Backup, from the Main Menu select WAN Conﬁguration and then WAN Setup.

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Backup 7-3

Main

WAN

Setup

WAN Configuration

WAN (Wide Area Network) Setup...

Display/Change Connection Profile...

Add Connection Profile...

Delete Connection Profile...

WAN Default Profile...

ATMP/PPTP Default Profile...

IKE Phase 1 Configuration...

Scheduled Connections...

Backup Configuration...

Frame Relay Configuration...

Frame Relay DLCI Configuration...

Establish WAN Connection...

Disconnect WAN Connection...

Return/Enter to create a new Connection Profile.

From here you will configure yours and the remote sites' WAN information.

The Choose Interface to Conﬁgure screen appears.

Choose Interface to Configure

G.SHDSL-ATM Setup...

Serial Port Setup...

Choose the interface to conﬁgure for backup, Serial Port Setup.

The Serial Port Conﬁguration screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

7-4 Firmware User Guide

Serial Port Configuration

+--------------+

| Console Only |

| Modem/Auto |

+--------------+

Serial Port Mode...

■

The default mode is Console Only. This is the normal state for using a terminal emulation application to

manage the router. See “Connecting a Console Cable to your Equipment” on page 1-5.

If you select Modem/Auto from the pull-down menu, the router becomes capable of auto detecting the

presence of a modem or a console connection attached to the serial console port.

■

A console connection is detected at the connection speed deﬁned on the Console Conﬁguration menu

(see “Console Conﬁguration” on page 2-43).

■

A modem will be detected at the data rate you specify in the following menu. It will not auto detect the

Console baud rate in Modem/Auto mode.

Serial Port Configuration

Serial Port Mode...

Modem/Auto

57600

Data Rate (kbps)...

Serial Modem Init String:

Serial Modem Directory Number:

AT&F&C1&D2E0S0=1

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Backup 7-5

Note:

• The modem cable should have a standard DB-9 female connector to connect to the console port. This is the

standard type of modem cable connector.

• Macintosh users who use a USB-to-serial adapter to connect to the console serial port can use a modem in

Modem/Auto mode. However, your terminal emulator software will not function in this mode via the USB

adapter, due to the pin assignments in the adapter. For console management access, Macintosh users should

use Console Only mode.

■

If you select Modem/Auto, you can select its Data Rate from a pop-up menu, edit the Serial Modem

Init String, if necessary, and enter your local Serial Modem Directory Number.

Changes to Serial Port Mode take place after a reboot. This is not automatic. You may continue to con-

ﬁgure these settings, and after you are ﬁnished, you must reboot the router manually. See “Restarting

the System” on page 11-12.

■

Press Escape twice to return to the WAN Conﬁguration screen, and select Advanced Connection

Options, then Backup Conﬁguration (shown on page 7-5).

Backup Conﬁguration screen

This screen is used to conﬁgure the conditions under which backup will occur, if it will recover, and how the

Console port is conﬁgured.

For a modem connected to the Console port, the Backup Conﬁguration screen appears as follows:

Backup Configuration

Backup Parameters

Backup is...

Automatic

Requires Failure of (minutes):

Ping Host Name or IP Address:

Recovery to ADSL...

Automatic

Requires Recovery of (minutes):

Auto-Recovery on loss of Layer 2: Yes

Layer 2 Failure Timer (seconds): 0

Clear Backup Call only if idle:

Yes

Requires idle time of (seconds): 300

Data Link Encapsulation is

Async PPP

Enter Information supplied to you by your telephone company.

■

Select Backup is and from the pop-up menu, select Automatic (default), Manual, or Disabled. You enable

line backup by selecting either Manual or Automatic.

Select Requires Data Link Failure of... and enter the number of minutes that the system should wait

before it assumes that a connection failure has occurred. After that period, the system would switch to

Download from Www.Somanuals.com. All Manuals Search And Download.

7-6 Firmware User Guide

backup mode and connect via your modem.

Note: Backup and Recovery have resolutions of ﬁve seconds. This is how often the router evaluates the state

of the connections and makes decisions.

■

Select Ping Host Name or IP Address and enter an IP address or resolvable DNS name that the router will

ping. This is an optional item that is particularly useful for testing if the remote end of a VPN connection

has gone down. Should this address become unreachable the router will treat this as a loss of connectivity

and begin the backup timer. This loss is a Layer 2 loss.

■

Select Recovery to “WAN_name” (where WAN_name is the type of WAN connection you have, e.g., ADSL)

and press Return. Choose either Manual or Automatic to determine how the system will return to the

primary WAN link when it becomes available again. If you choose Automatic, the next two menu items

become visible.

Note: Automatic recovery only works upon loss of primary WAN connectivity.

■

If you chose Automatic Recovery, select Requires Recovery of... and press Return. A pop-up menu

allows you to choose among 30 Sec(onds), 1 Min(ute), 2 Min(utes), 5 Min(utes), 10 Min(utes), or 15

Min(utes). This allows you to be sure that the primary WAN connection is well re-established before the

router switches back to it from the backup mode.

■

You can toggle Auto-Recovery on loss of Layer 2 to Yes or No (the default). This setting determines

whether the router should try to Auto-Recover when the backup is invoked because of a Layer 2 loss,

for example, a no valid Connection Proﬁle. (Layer 1 is still available, and this is what recovery checks.)

Use this setting with caution. Setting it to Yes may induce alternating switching between Backup and

Recovery Mode. This ﬁeld will determine the recovery behavior of a Manual backup and Ping failure

backup. These two failures are treated as Layer 2 failure.

■

Select Clear Backup Call only if idle. The default Yes will prevent the backup call from being torn down if

there is activity on the backup connection when the primary connection comes back up. You can toggle this

to No if you wish.

■

Requires idle time of (seconds) speciﬁes how long the device should wait before permitting the call to be

torn down after a period of inactivity.

Data Link Encapsulation is set to Async PPP. This ﬁeld is not editable.

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Backup 7-7

Connection Proﬁles

The line backup feature allows you to conﬁgure a complete Connection Proﬁle for the backup port, just as you

do for your primary WAN connection. In this way proﬁles are associated with a particular interface. The proﬁle

should reﬂect the port it is associated with. It should have switched characteristics for the backup port.

Add Connection Profile

Profile Name:

Profile 1

Yes

Profile Enabled:

Data Link Encapsulation...

Data Link Options...

PPTP

IP Enabled:

Yes

IP Profile Parameters...

+----------------+

Interface Group...

Telco Options...

| Primary

| Backup

| Any Port

+----------------+

CANCEL

COMMIT

Return/Enter to discard changes you have made. Profile will not be added.

Configure a new Conn. Profile. Finished? ADD or CANCEL to exit.

For instructions on creating a Connection Proﬁle see “Creating a New Connection Proﬁle” on page 2-24.

To associate this Connection Proﬁle with your backup port interface, choose Backup from the Interface Port

pop-up menu and press Return.

If you choose Backup, Telco Options becomes visible. The Telco Options screen allows you to set the

parameters for the modem connection.

Download from Www.Somanuals.com. All Manuals Search And Download.

7-8 Firmware User Guide

Telco Options

Dial...

Dial In/Out

Number to Dial:

Alternate Site to Dial:

Dial on Demand:

Yes

300

Idle Timeout (seconds):

Callback:

■

From the Dial pop-up menu, you can choose whether to Dial Out Only, Dial In Only, or Dial In/Out (default).

You can add the Number to Dial and an Alternate Site to Dial, if available.

You can toggle Dial on Demand to Yes or No. This allows the router to determine whether or not to dial the

backup number when there is trafﬁc that needs to be transmitted or received.

■

You can set the Idle Timeout (seconds) to tear down the connection after some speciﬁed period of

inactivity.

You can also toggle Callback to No or Yes. In most cases, since this is a backup connection, you can leave

this set to the default No.

Using Scheduled Connections with Backup

The backup link is a PPP dial-up connection and only connects to the Internet service provider when trafﬁc is

initiated from the LAN. If you want to use the backup link to provide redundancy for services, such as a Web

service that you provide to the outside world, you must force the connection to stay up. You do this by creating

a scheduled connection entry that will be a permanent “forced up” connection for the backup port. The backup

port will be activated upon primary WAN link failure and remain active until primary WAN link recovery.

To conﬁgure a Scheduled Connection, from the Main Menu select WAN Conﬁguration and then Scheduled

Connections.

Main

Scheduled

Connections

WAN Configuration

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Backup 7-9

The Scheduled Connections screen appears.

Scheduled Connections

Display/Change Scheduled Connection...

Add Scheduled Connection...

Delete Scheduled Connection...

Return/Enter to add a Scheduled Connection.

Navigate from here to add/modify/change/delete Scheduled Connections.

■

Select Add Scheduled Connection and press Return. The Add Scheduled Connection screen appears.

Add Scheduled Connection

Scheduled Connection Enable:

How Often...

Weekly

Forced Up

Schedule Type...

Set Weekly Schedule...

Use Connection Profile...

ADD SCHEDULED CONNECTION

CANCEL

Return/Enter accepts * Tab toggles * ESC cancels.

Scheduled Connections dial remote Networks on a Weekly or Once-Only basis.

■

Toggle Scheduled Connection Enable to On.

From the How Often pop-up menu, select Weekly and press Return.

From the Schedule Type pop-up menu, accept the default Forced Up and press Return.

Select Set Weekly Schedule, and press Return. The Set Weekly Schedule screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

7-10 Firmware User Guide

Set Weekly Schedule

Monday:

Yes

Tuesday:

Wednesday:

Thursday:

Friday:

Saturday:

Sunday:

Scheduled Window Start Time:

AM or PM:

11:27

Scheduled Window Duration Per Day: 24:00

Return/Enter accepts * Tab toggles * ESC cancels.

■

Toggle all the days of the week to Yes, and set the Scheduled Window Duration Per Day to 24:00. This

guarantees a 24X7 connection. Press Escape to return to the Add Scheduled Connection screen.

Select Use Connection Proﬁle, and press Return. A screen displays all of your Connection Proﬁles. Select

the one you want to apply this scheduled connection to and press Return. Your selection becomes

effective.

Now, if your primary WAN link fails, the backup link will become active and remain active until the primary link

recovers.

For more information about Scheduled Connections, see “Scheduled Connections” on page 2-29.

Management/Statistics

The Statistics & Logs menu offers a Backup Management/Statistics option.

To view the Backup Management/Statistics, from the Main Menu select Statistics & Logs.

Main

Backup Management/

Statistics

Statistics & Logs

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Backup 7-11

Statistics & Logs...

WAN Event History...

Device Event History...

IP Routing Table...

Served IP Addresses...

Backup Management/Statistics...

General Statistics...

System Information...

Select Backup Management/Statistics and press Return.

Note: This option is only visible if backup is not Disabled.

The Backup Management/Statistics screen appears.

Backup Management/Statistics

Current Port:

Backup State:

Reason:

Primary

Primary Port Failure in Progress

Loss of Layer 1

Time Since Detection:

Switchover Time:

0:25

1:00

FORCE BACKUP

■

Current Port is a display-only ﬁeld that shows which port is currently in operation.

Backup State is a display-only ﬁeld that shows the current state of Backup or Recovery.

Reason is a display-only ﬁeld that shows the cause for the current state of Backup or Recovery.

Time Since Detection is a display-only ﬁeld that is only visible if backup or recovery is in progress. It

displays the elapsed time since detection of either primary WAN line failure or re-establishment of the

Download from Www.Somanuals.com. All Manuals Search And Download.

7-12 Firmware User Guide

connection.

■

Switchover Time is a display-only ﬁeld that is only visible if backup or recovery is in progress. It displays

the time until either automatic Backup or Recovery.

The FORCE BACKUP/FORCE RECOVERY option is a selectable option that, depending on the current state

of backup, will force the switching of ports. If you are currently in backup mode, the option will be FORCE

RECOVERY. If you are currently in normal WAN link mode, the option will be FORCE BACKUP. Selecting

either one and pressing Return will force the link to switch to the other mode.

QuickView

QuickView now has an information element to indicate which port is in use.

Quick View

Default IP Gateway: 0.0.0.0

Domain Name Server: 0.0.0.0

Domain Name: happyinternet.com

CPU Load: 4%

Unused Memory: 387 KB

Current WAN Port: Console Port

Event Logs

When a backup or recovery occurs an event is logged in the WAN Event History.

WAN Event History

Current Date -- 8/17/02 10:57:12 AM

-Date-----Time-----Event------------------------------------------------------

----------------------------------SCROLL UP-----------------------------------

08/17/02 10:39:37 * Line Failure: Switching to backup port

08/17/02 10:38:51 * Line Recovery: Switching to primary port

08/17/02 10:37:42 * Line Failure: Switching to backup port

08/17/02 10:35:53 --Device restarted-----------------------------------------

08/17/02 10:04:48 --Device restarted-----------------------------------------

08/17/02 10:04:13 --Device restarted-----------------------------------------

08/17/02 08:59:01 --Device restarted-----------------------------------------

08/17/02 09:12:09 --Device restarted-----------------------------------------

08/17/02 10:31:08 --Device restarted-----------------------------------------

08/17/02 09:47:57 >>WAN: ADSL 1 deactivated

08/17/02 09:47:56 >>WAN: ADSL 1 activated at 10000 Kbps

08/17/02 09:42:07 --Device restarted-----------------------------------------

08/17/02 09:29:45 --Device restarted-----------------------------------------

08/17/02 11:29:44 --Device restarted-----------------------------------------

---------------------------------SCROLL DOWN----------------------------------

Clear History...

Return/Enter on event item for details or SCROLL [UP/DOWN] item for scrolling.

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Backup 7-13

SNMP Support

The router supports objects for determining the state of backup, as well as providing traps for the backup and

recovery events. No objects support conﬁguration of backup or recovery.

Backup Default Gateway

Introduced in version 5.1.2, the ﬁrmware offers backup functionality to an alternate gateway typically connected

to a LAN port.

A typical application would be to have a LAN connection from your 4000-Series router to another router that

has, for example, an ISDN or analog modem connection to the Internet, and designating the second router as

the backup gateway. Should the primary WAN connection fail, trafﬁc would be automatically redirected through

your alternate gateway device to maintain Internet connectivity.

Two menus control the backup gateway feature:

■

the Backup Conﬁguration screen in the WAN Conﬁguration menu

Here, you enable the backup feature and set some parameters.

the IP Setup screen in the System Conﬁguration menu

■

Here, you set the IP address of the alternate gateway device.

Backup Conﬁguration screen

To enable the backup feature, from the Main Menu select WAN Conﬁguration, Advanced Connection Options,

and then Backup Conﬁguration.

WAN

Configuration

Advanced

Connection Options

Main

Backup

Configuration

Download from Www.Somanuals.com. All Manuals Search And Download.

7-14 Firmware User Guide

The Backup Conﬁguration screen appears.

Backup Configuration

+-----------+

Backup Parameters

Backup is...

+-----------+

| Disabled |

Requires Failure of (minutes): | Manual

| Automatic |

+-----------+

Automatic

Ping Host Name or IP Address:

Recovery to ADSL...

Requires Recovery of (minutes):

Auto-Recovery on loss of Layer 2: No

Automatically switches to Backup Port on loss of Layer 1 or 2.

This screen is used to conﬁgure the conditions under which backup will occur, if it will recover, and how the

alternate gateway is conﬁgured.

■

Select Backup is and press Return. A pop-up menu allows you to select Disabled, Manual, or Automatic.

You enable backup by selecting either Manual or Automatic. If you enable backup, the subsequent menu

items become visible.

Select Requires Data Link Failure of (minutes). Enter the number of minutes you want the system to wait

before the backup port becomes enabled in the event of primary line failure. This allows you to be sure the

WAN connection is not merely brieﬂy interrupted before the router switches to backup mode.

Select Ping Host Name or IP Address and enter an IP address or resolvable DNS name that the router will

ping. This is an optional item that is particularly useful for testing if the remote end of a VPN connection

has gone down. Should this address become unreachable the router will treat this as a loss of connectivity

and begin the backup timer. This loss is a Layer 2 loss.

■

Select Recovery to “WAN_name” (where WAN_name is the type of WAN connection you have, such as

ADSL) and press Return. Choose either Manual or Automatic to determine how the system will return to the

WAN link when it becomes available again. If you choose Automatic, the next two menu items become

visible.

Note: Automatic recovery only works upon loss of WAN connectivity.

■

If you chose Automatic Recovery, select Requires Recovery of. Enter the number of minutes you want

the system to wait before attempting to switch back to the WAN connection. This allows you to be sure

that the WAN connection is well re-established before the router switches back to it from the backup

mode.

■

You can toggle Auto-Recovery on loss of Layer 2 to Yes or No (the default). This setting determines

whether the router should try to Auto-Recover when the backup is invoked because of a Layer 2 loss,

for example, a no valid Connection Proﬁle. (Layer 1 is still available, and this is what recovery checks.)

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Backup 7-15

Use this setting with caution. Setting it to Yes may induce alternating switching between Backup and

Recovery Mode. This ﬁeld will determine the recovery behavior of a Manual backup and Ping failure

backup. These two failures are treated as Layer 2 failures.

■

If you enable Auto-Recovery on loss of Layer 2, the Layer 2 Failure Timer (seconds) ﬁeld becomes vis-

ible, and you can specify how long the Auto-Recovery should wait before attempting to recover connec-

tivity through your primary connection. This can prevent alternating switching between Backup and

Recovery Mode.

■

Press Escape twice to return to the Main Menu.

IP Setup screen

To conﬁgure the backup gateway, from the Main Menu select System Conﬁguration then IP Setup.

System

Configuration

Main

Setup

The IP Setup screen appears.

The IP Setup screen permits entry of a backup IP gateway address. This ﬁeld is always visible, even if the

Default IP Gateway ﬁeld is not ﬁlled out, as in the case of a DHCP-acquired IP address and default gateway on

the WAN interface.

IP Setup

Ethernet IP Address:

192.168.1.1

Ethernet Subnet Mask:

Define Additional Subnets...

255.255.255.0

Default IP Gateway:

0.0.0.0

Backup IP Gateway:

Primary Domain Name Server:

Secondary Domain Name Server:

Domain Name:

Receive RIP...

Transmit RIP...

Both

Off

Static Routes...

IP Address Serving...

Network Address Translation (NAT)...

Enter an IP address in decimal and dot form (xxx.xxx.xxx.xxx).

Set up the basic IP attributes of your Netopia in this screen.

For more information on IP Setup see the “IP Setup” on page 6-2.

Note: Backup and Recovery have resolutions of ﬁve seconds. This is how often the router evaluates the state

of the connections and makes decisions.

Download from Www.Somanuals.com. All Manuals Search And Download.

7-16 Firmware User Guide

Backup Management/Statistics

If backup is enabled, the Statistics & Logs menu offers a Backup Management/Statistics option.

To view Backup Management/Statistics, from the Main Menu select Statistics & Logs then

Backup Management/Statistics and press Return.

Main

Backup Management/

Statistics

Statistics & Logs

The Backup Management/Statistics screen appears.

Backup Management/Statistics

Current Gateway:

Backup State:

Reason:

Primary

Primary Port Failure in Progress

Loss of Layer 1

Time Since Detection:

Switchover Time:

0:14

1:00

FORCE BACKUP

■

Current Gateway is a display-only ﬁeld that shows which port is currently in operation.

Backup State is a display-only ﬁeld that shows the current state of Backup or Recovery.

Reason is a display-only ﬁeld that shows the cause for the current state of Backup or Recovery.

Time Since Detection is a display-only ﬁeld that is only visible if backup or recovery is in progress. It

displays the elapsed time since detection of either primary WAN line failure or re-establishment of the

connection.

■

Switchover Time is a display-only ﬁeld that is only visible if backup or recovery is in progress. It displays

the time until either automatic Backup or Recovery.

The FORCE BACKUP/FORCE RECOVERY option is a selectable option that, depending on the current state

of backup, will force the switching of ports. If you are currently in backup mode, the option will be FORCE

RECOVERY. If you are currently in normal WAN link mode, the option will be FORCE BACKUP. Selecting

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Backup 7-17

either one and pressing Return will force the link to switch to the other mode.

QuickView

The QuickView screen now has an information element to indicate which gateway is in use.

Quick View

1/29/2002 01:05:35 PM

Default IP Gateway: 0.0.0.0

Primary DNS Server: 0.0.0.0

Secondary DNS Server: 0.0.0.0

CPU Load: 5%

Unused Memory: 5582 KB

Gateway installed -- Backup

Domain Name: happyinternet.com

Download from Www.Somanuals.com. All Manuals Search And Download.

7-18 Firmware User Guide

Download from Www.Somanuals.com. All Manuals Search And Download.

Voice Conﬁguration 8-1

Chapter 8

Voice Configuration

This chapter describes the telephony services and conﬁguration of the Netopia 4700-Series Integrated Access

Devices (IADs) running Netopia Firmware Version 5.4.

This chapter covers the following topics:

■

“Introduction” on page 8-1

■

“Conﬁguring the Voice Features” on page 8-2

Introduction

Netopia IADs provide small and medium sized businesses with a complete Centrex PBX system. It supports

voice call switching between the DSL link and eight local extensions. Call management features can include

distinctive ringing, intelligent call forwarding, Direct Inward Dial (DID), Caller ID, and hunt groups. Important key

system features such as call hold, call transfer, and call waiting are all supported.

Note: Since the Netopia IADs are Centrex-based, speciﬁc voice features available to you in Netopia Firmware

Version 5.4 will depend on the services for which you contract with your service provider.

Netopia Firmware Version 5.4 supports up to eight telephone extensions and up to eight derived voice lines.

The 4700-Series IAD family includes the Netopia data routing engine for any number of attached computers or

other network devices connected to a single 10/100 Ethernet port.

Key features include:

■

Fax/Modem: Conﬁgurable Voice port for incoming fax or modem calls. This is another term for echo

cancellation support.

Voice Gateway Interoperability: CopperCom, JetStream, Tollbridge TDSoft, Zhone, and Alcatel. General

Bandwidth support to follow in an upcoming ﬁrmware release.

Centrex is a simpler variation on the PBX. It is a PBX with all switching occurring at a local telephone ofﬁce

instead of at the company's premises. Typically, the telephone company owns and manages all the

communications equipment necessary to implement the PBX and then sells various services to the company.

Explanation of terms

Some telephony terms mean different things in Centrex mode and PBX/local switching mode: Toll Restriction,

Speed Dial, and Distinctive Ringing. Netopia IADs operate in Centrex mode.

■

Toll Restriction Operation - Centrex Mode: When you pick up the phone, you receive a dial tone from the

central ofﬁce. When 9 is pressed, the Netopia IAD detects 9 and returns a busy tone served by the Centrex

system accessible via the IAD. Incoming calls are allowed. This allows local extension calling through the

Download from Www.Somanuals.com. All Manuals Search And Download.

8-2 Firmware User Guide

central ofﬁce, but not long distance or local calls.

Toll Restriction Operation - PBX/Local Switching Mode: When you pick up the phone, you receive local PBX

dial tone. When a 9 (or outside line code) is pressed, the IAD detects the digit and returns busy (locally

generated). Incoming calls are allowed. Extension calls (locally switched) are allowed.

■

Speed Dial - Centrex Mode: In Centrex Mode, when you pick up the phone, dial-tone from the central ofﬁce

is present. It is therefore, not possible to program the phone or use speed dial in this mode from the

phone.

Speed Dial - PBX/Local Switching mode: In this mode, you have the ability to pick up the phone, receive

local dial tone and proceed to program the phone w/ local speed dial options. In addition, taking the phone

off hook and pressing speed dial numbers will cause the stored speed dial digits to be sent out. This is

independent of the previous mode.

Conﬁguring the Voice Features

This section describes how to conﬁgure the voice telephone features in Netopia Firmware Version 5.4.

From the Main Menu select Voice Conﬁguration.

Netopia IAD

Easy Setup...

WAN Configuration...

System Configuration...

Voice Configuration...

Utilities & Diagnostics...

Statistics & Logs...

Quick Menus...

Quick View...

Return/Enter goes to Easy Setup -- minimal configuration.

You always start from this main screen.

The Voice Conﬁguration screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

Voice Conﬁguration 8-3

Voice Configuration

CopperCom

Voice Gateway...

Ring Cadence...

20 Hz

Port Configuration...

Voice Coding...

mu-law

LES Profile Number...

Profile 9

■

Select Voice Gateway and from the pop-up menu, choose the type of voice gateway device to which you will

be connected. The choices are: CopperCom, JetStream, TollBridge, TDSoft, Zhone, or Alcatel.

Select Ring Cadence and press Return. A pop-up menu allows you to choose between 20Hz (the default),

25Hz, or 50Hz for compliance with several non-North American telephone systems.

Selecting Port Conﬁguration displays the Port Conﬁguration screen.

Port Configuration

Port 1 Echo Cancellation Enabled: Yes

Compression is

G726 - ADPCM 32K

Port 2 Echo Cancellation Enabled: Yes

Compression is

G726 - ADPCM 32K

Port 3 Echo Cancellation Enabled: Yes

Compression is

G726 - ADPCM 32K

Port 4 Echo Cancellation Enabled: Yes

Compression is

G726 - ADPCM 32K

Port 5 Echo Cancellation Enabled: Yes

Compression is

G726 - ADPCM 32K

Port 6 Echo Cancellation Enabled: Yes

Compression is

G726 - ADPCM 32K

Port 7 Echo Cancellation Enabled: Yes

Compression is

G726 - ADPCM 32K

Port 8 Echo Cancellation Enabled: Yes

Compression is

G726 - ADPCM 32K

Return/Enter accepts * Tab toggles * ESC cancels.

Download from Www.Somanuals.com. All Manuals Search And Download.

8-4 Firmware User Guide

Echo cancellation is set to Yes by default. For ordinary telephone handsets, echo cancellation should be

set to Yes (turned on) to eliminate echoes on the voice line. Toggling a port to No allows you to connect a

fax machine or modem to the phone port (since fax machines and modems automatically cancel echoes).

If you want to disable echo cancellation, toggle this item to No. You can enable or disable echo cancellation

for each telephone port.

■

The Compression type is normally set at the voice gateway. It is visible for informational purposes, to

ascertain that the provisioning on the voice gateway is in sync with the IAD.

LES stands for Loop Emulation Service, an increasingly popular standard among ATM voice gateway

manufacturers.

If the voice gateway is LES-compliant (see LES Proﬁle Number below), a pop-up menu allows you to choose

between G711 - PCM 64K and G726 - ADPCM 32K. Your service provider must supply you with the correct

provisioning information. The reason is that in those gateway types the voice gateway expects this type of

provisioning to be done prior to making any voice calls.

If the voice gateway is not LES-compliant, the pop-up menus are not available, and these ﬁelds are for

information only.

Once you have made your settings for each voice port, press Escape to return to the Voice Conﬁguration

menu.

■

Select Voice Coding and press Return. From the pop-up menu choose the voice coding method you will be

using. The default is mu-law, which is the standard 8-bit, 8 kHz, mono format intended primarily for the

requirements of voice in North America. You can also choose a-law, a more common audio format outside

North America.

If your service provider is using an LES-compliant voice gateway, the LES Proﬁle Number option becomes

visible. From the pop-up menu choose either Proﬁle 9 or Proﬁle 10.

The Netopia Firmware Version 5.4 supports LES proﬁle 9 and LES proﬁle 10. LES proﬁle 9 includes only

PCM calls. LES proﬁle 10 includes PCM and ADPCM capabilities.

Download from Www.Somanuals.com. All Manuals Search And Download.

Monitoring Tools 9-1

Chapter 9

Monitoring Tools

This chapter discusses the Router’s device and network monitoring tools. These tools can provide statistical

information, report on current network status, record events, and help in diagnosing and locating problems.

This section covers the following topics:

■

“Quick View Status Ove r v iew” on page 9-1

“Statistics & Logs” on page 9-4

“Event Histories” on page 9-4

“IP Routing Table” on page 9-7

“General Statistics” on page 9-7

“System Information” on page 9-9

“Simple Network Management Protocol (SNMP) - V2c” on page 9-10

Quick View Status Overview

You can get a useful, overall status report from the Netopia Firmware Version 5.4 in the Quick View screen. To

go to the Quick View screen, select Quick View in the Main Menu.

Main

Quick View

The Quick View screen has three status sections:

■

General status

Current DSL Status

LED Status

Download from Www.Somanuals.com. All Manuals Search And Download.

9-2 Firmware User Guide

General status

Quick View

CPU Load: 4%

10/11/2001 07:31:26 AM

Unused Memory: 6044 KB

Default IP Gateway: 0.0.0.0

Primary DNS Server: 0.0.0.0

Secondary DNS Server: 0.0.0.0

Domain Name: Netopia.com

----------------MAC Address--------IP Address---------------------------------

Ethernet Hub: 00-00-c5-ff-70-00 192.168.1.1

ATM SDSL WAN: 00-00-c5-ff-70-02 0.0.0.0

Current DSL Status

Profile Name----------Rate--%Use-Remote Address-----Est.-More Info------------

ISP

1536 10 IP 92.163.4.1

Lcl NAT 192.163.100.6

VPN QuickView

LED Status

-PWR----ERROR----ETHERNET----DSL- - - - - - - - - - - - +--------LEDS---------

| '-'= Off 'G'= Green

| 'R'= Red 'Y'= Yellow

Current Date: The current date; this can be set with the Date and Time utility (see “Date and time” on

page 2-42).

Default IP Gateway: The router’s default gateway, which may be either manually conﬁgured or learned via

DHCP. This is the value you assigned in the Default IP Gateway ﬁeld. If you are using the router’s defaults

(DHCP and NAT) this value will be 0.0.0.0. If you have assigned an IP address as your default gateway, it is

shown here.

CPU Load: Percentage of the system’s resources being used by all current transmissions.

Unused Memory: The total remaining system memory available for use.

Primary DNS Server: If you are using the router’s defaults (DHCP and NAT) this value will be 0.0.0.0. If you

have assigned an IP address as your primary default gateway, it is shown here.

Secondary DNS Server: If you are using the router’s defaults (DHCP and NAT) this value will be 0.0.0.0. If you

have assigned an IP address as a secondary gateway, it is shown here.

Domain Name: The domain name you have assigned, typically the name of your ISP.

MAC Address: The Router’s hardware address, for those interfaces that support DHCP.

IP Address: The Router’s IP address, entered in the IP Setup screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

Monitoring Tools 9-3

Current status

The current status section is a table showing the current status of the DSL connection. For example:

Current DSL Status

Profile Name----------Rate--%Use-Remote Address-----Est.-More Info------------

ISP

1536 10 IP 92.163.4.1

Lcl NAT 192.163.100.6

Proﬁle Name: Lists the name of the connection proﬁle being used, if any.

Rate: Shows the line rate for this connection.

%Use: Indicates the average percent utilization of the maximum capacity of the channels in use for the

connection.

Remote Address: Shows the IP address of the connected remote router.

Est: Indicates whether the connection was locally (“Lcl”) or remotely (“Rmt”) established.

More Info: Indicates the NAT address in use for this connection.

Status lights

This section shows the current real-time status of the Router’s status lights (LEDs). It is useful for remotely

monitoring the router’s status. The Quick View screen’s arrangement of LEDs corresponds to the physical

arrangement of LEDs on the router. These LEDs and the corresponding display in the console menu screen will

vary by model.

LED Status

-PWR----ERROR----ETHERNET----DSL- - - - - - - - - - - - +--------LEDS---------

| '-'= Off 'G'= Green

| 'R'= Red 'Y'= Yellow

Each LED representation can report one of four states:

–: The LED is off.

R: The LED is red.

G: The LED is green.

Y: The LED is yellow.

The section “Netopia Router status lights” in the Getting Started Guide describes the meanings of the colors

for each LED.

Download from Www.Somanuals.com. All Manuals Search And Download.

9-4 Firmware User Guide

Statistics & Logs

Main

Statistics & Logs

When you are troubleshooting your Router, the Statistics & Logs screens provide insight into the recent event

activities of the router.

From the Main Menu go to Statistics & Logs and select one of the options described in the sections below.

Event Histories

Main

• WAN Event History

• Device Event History

Statistics & Logs

The Netopia Firmware Version 5.4 records certain relevant occurrences in event histories. Event histories are

useful for diagnosing problems because they list what happened before, during, and after a problem occurs.

You can view two different event histories: one for the router’s system and one for the WAN. Some Netopia

Routers have a built-in battery backup which prevents loss of event history from a shutdown or reset.

The router’s event histories are structured to display the most recent events ﬁrst, and to make it easy to

distinguish error messages from informational messages. Error messages are preﬁxed with an asterisk. Both

the WAN Event History and Device Event History retain records of the 128 most recent events.

In the Statistics & Logs screen, select WAN Event History or Device Event History.

Download from Www.Somanuals.com. All Manuals Search And Download.

Monitoring Tools 9-5

WAN Event History

The WAN Event History screen lists a total of 128 events on the WAN. The most recent events appear at the

top.

WAN Event History

Current Date -- 10/11/2001 03:02:23 PM

-Date-----Time-----Event------------------------------------------------------

----------------------------------SCROLL UP-----------------------------------

07/03/98 13:59:06 DSL: IP up, channel 1, gateway: 173.166.107.1

07/03/98 13:59:05 DSL: Channel 1 up

07/03/98 13:59:05 >>WAN: data link activated at 1040 Kbps

07/03/98 13:58:32 --Device restarted-----------------------------------------

07/03/98 12:46:39 --Device restarted-----------------------------------------

07/03/98 11:45:57 --Device restarted-----------------------------------------

07/02/98 17:58:15 DSL: IP up, channel 1, gateway: 173.166.107.1

07/02/98 17:58:10 DSL: Channel 1 up

07/02/98 17:58:10 >>WAN: data link activated at 1040 Kbps

07/02/98 17:57:05 DSL: IP down, channel 1

07/02/98 17:57:05 Link 1 down: No Synch

07/02/98 17:57:05 >>WAN: data link deactivated

07/02/98 17:48:02 DSL: IP up, channel 1, gateway: 173.166.107.1

07/02/98 17:48:01 DSL: Channel 1 up

---------------------------------SCROLL DOWN----------------------------------

Clear History...

Return/Enter on event item for details or SCROLL [UP/DOWN] item for scrolling.

Each entry in the list contains the following information:

Date: Date of the event.

Time: Time of the event.

Event: A brief description of the event.

Ch.: The channel involved in the event.

The ﬁrst event in each call sequence is marked with double arrows (>>).

Failures are marked with an asterisk (*).

If the event history exceeds the size of the screen, you can scroll through it by using the SCROLL UP and

SCROLL DOWN items.

To scroll up, select SCROLL UP at the top of the list and press Return. To scroll down, select SCROLL DOWN at

the bottom of the list and press Return.

To get more information about any event listed in the WAN Event History, select the event and then press

Return. A dialog box containing more information about the selected event will appear. Press Return or Escape

to dismiss the dialog box.

To clear the event history, select Clear History at the bottom of the history screen and press Return.

Device Event History

The Device Event History screen lists a total of 128 port and system events, giving the time and date for each

event, as well as a brief description. The most recent events appear at the top.

Download from Www.Somanuals.com. All Manuals Search And Download.

9-6 Firmware User Guide

In the Statistics & Logs screen, select Device Event History. The Device Event History screen appears.

Device Event History

Current Date -- 10/11/2001 03:02:23 PM

-Date-----Time-----Event------------------------------------------------------

----------------------------------SCROLL UP-----------------------------------

01/22/02 02:03:11 IP address server initialization complete

01/22/02 02:03:11 --BOOT: Warm start v5.3

---------------------------------

01/22/02 02:02:32 IP address server initialization complete

01/22/02 02:02:32 --BOOT: Warm start v5.3

---------------------------------

01/22/02 01:59:50 * IP: Route 0.0.0.0/0.0.0.0 not installed

01/22/02 01:59:50 IP address server initialization complete

01/22/02 01:59:50 --BOOT: Cold start v5.3

---------------------------------

01/22/02 01:55:07 * IP: Route 0.0.0.0/0.0.0.0 not installed

---------------------------------SCROLL DOWN----------------------------------

Clear History...

Return/Enter on event item for details or SCROLL [UP/DOWN] item for scrolling.

If the event history exceeds the size of the screen, you can scroll through it by using SCROLL UP and SCROLL

DOWN.

To scroll up, select SCROLL UP at the top of the list and press Return. To scroll down, select SCROLL DOWN at

the bottom of the list and press Return.

To obtain more information about any event listed in the Device Event History, select the event and then press

Return. A dialog box containing more information about the selected event appears. Press Return or Escape to

dismiss the dialog box.

To clear the Device Event History, select Clear History and press Return.

Download from Www.Somanuals.com. All Manuals Search And Download.

Monitoring Tools 9-7

IP Routing Table

Main

Statistics & Logs

• IP Routing Table

The IP routing table displays all of the IP routes currently known to the Router.

IP Routing Table

Network Address-Subnet Mask-----via Router------Port------------------Type----

----------------------------------SCROLL UP-----------------------------------

0.0.0.0

255.0.0.0

0.0.0.0

Other

Local

Bcast

Other

Bcast

127.0.0.1

192.168.1.0

192.168.1.1

192.168.1.15

224.0.0.0

255.255.255.255 127.0.0.1

255.255.255.240 192.168.1.1

255.255.255.255 192.168.1.1

255.255.255.255 192.168.1.15

Loopback

Ethernet

224.0.0.0

0.0.0.0

255.255.255.255 255.255.255.255 255.255.255.255 --

---------------------------------SCROLL DOWN----------------------------------

UPDATE

The routing table screen represents a snapshot of the routing table information at the time the screen is ﬁrst

invoked. To take a new snapshot, select Update at the bottom of the screen and press Return.

General Statistics

Main

• General Statistics

Statistics & Logs

The General Statistics screen displays information about data trafﬁc on the Router’s data ports. This

information is useful for monitoring and troubleshooting your LAN. Note that the counters roll over at their

maximum ﬁeld width, that is, they restart again at 0.

Download from Www.Somanuals.com. All Manuals Search And Download.

9-8 Firmware User Guide

General Statistics

Physical I/F-----Rx Bytes---Tx Bytes---Rx Pkts---Tx Pkts----Rx Err----Tx Err

Ethernet Hub

ATM ADSL 1

1234567

123456

12345

Network----------Rx Bytes---Tx Bytes---Rx Pkts---Tx Pkts----Rx Err----Tx Err

IP 1234567 123456 123456 123456 123456 12345

VC Traffic Statistics...

Physical Interface

The top left side of the screen lists total packets received and total packets transmitted for the following data

ports:

■

Ethernet

DSL

Network Interface

The bottom left side of the screen lists total packets received and total packets transmitted:

■

IP (IP packets on the Ethernet)

The right side of the table lists the total number of occurrences of each of six types of communication

statistics:

Rx Bytes. The number of bytes received

Tx Bytes. The number of bytes transmitted

Rx Packets: The number of packets received

Tx Pkts. The number of packets transmitted

Rx Err: The number of bad Ethernet packets received

Tx Err: The number of errors occurring when Ethernet packets are transmitted simultaneously by nodes on the

LAN

Download from Www.Somanuals.com. All Manuals Search And Download.

Monitoring Tools 9-9

System Information

The System Information screen gives a summary view of the general system level values in the Router.

From the Statistics & Logs menu select System Information. The System Information screen appears.

System Information

Serial Number

ff-70-00 (16740352)

Firmware Version

5.4

ModelNumber

4541200

Processor Speed (Mhz)

Flash Rom Capacity (MBytes)

DRAM Capacity (MBytes)

Hardware Acceleration

Not Installed

Ethernet

Single 10/100 Port

ADSL

WAN Interface

The information display varies by model, ﬁrmware version, feature set, and so on. You can tell at a glance your

particular system conﬁguration.

Download from Www.Somanuals.com. All Manuals Search And Download.

9-10 Firmware User Guide

Simple Network Management Protocol (SNMP) - V2c

The Netopia Firmware Version 5.4 includes a Simple Network Management Protocol (SNMP) agent, allowing

monitoring and conﬁguration by a standard SNMP manager. Netopia Routers and IADs now support both

SNMP-V1 and SNMP-V2c.

Enterprise-speciﬁc SNMP Changes

Enterprise-speciﬁc SNMP changes in Netopia Firmware Version 5.4 include restarting the device as a bridge or

router, and controlling the ‘WAN changes reset immediately’ item.

Restart Item: The OID responsible for restarting the router can now tell it to startup as a router or a bridge.

Note that if the device was a router and is now told to be a bridge (or vice-versa) the device will be factory

defaulted.

WAN Changes take effect immediately: This item is found in the console menu and is now added as an SNMP

OID. The router will reboot if the value is changed.

These changes have been added to the SNMP MIB ﬁle NETOPIA.MIB.

This MIB is available by anonymous ftp from the Netopia ftp server.

MIBs are available in a variety of formats. Load this MIB into your SNMP management software. Follow the

instructions included with your SNMP manager on how to load MIBs.

The Netopia Firmware Version 5.4 supports the following management information base (MIB) documents:

■

MIB II (RFC 1213)

Interface MIB (RFC 1229)

Ethernet MIB (RFC 1643)

Netopia MIB

SNMP-v2 Traps: SNMP v2 MIB (RFC1907) v2 traps only; npaV2trap.mib (Netopia-speciﬁc)

ATM: ATM TC (RFC2514); ATM MIB (RFC2515)

ADSL: ADSL MIB (RFC2662)

These MIBs are on the Netopia CD included with the Router. Load these MIBs into your SNMP management

software in the order they are listed here. Follow the instructions included with your SNMP manager on how to

load MIBs.

You can also obtain the latest updated SNMP MIBs from the Netopia anonymous FTP server.

FTP to: ftp.netopia.com/pub/router/snmpinfo.

Download from Www.Somanuals.com. All Manuals Search And Download.

Monitoring Tools 9-11

The SNMP Setup screen

From the Main Menu, select SNMP in the System Conﬁguration screen and press Return. The SNMP Setup

screen appears.

System

Configuration

Main

SNMP

SNMP Setup

System Name:

System Location:

System Contact:

System Trap Version:

+----------+

| SNMP-V1 |

| SNMP-V2c |

+----------+

Read-Only Community String:

Read/Write Community String:

Authentication Traps Enable:

IP Trap Receivers...

Off

Follow these steps to conﬁgure the ﬁrst three items in the screen:

1. Select System Name and enter a descriptive name for the Router’s SNMP agent.

2. Select System Location and enter the router’s physical location (room, ﬂoor, building, etc.).

3. Select System Contact and enter the name of the person responsible for maintaining the router.

4. Select the SNMP Trap Version and choose either SNMP-V1 or SNMP-V2c. SNMP-V2c is a more feature-rich

version, but is not supported by all vendors. Consult with your service provider.

System Name, System Location, and System Contact set the values returned by the Router SNMP agent for the

SysName, SysLocation, and SysContact objects, respectively, in the MIB II system group. Although optional, the

information you enter in these items can help a system administrator manage the network more efﬁciently.

Download from Www.Somanuals.com. All Manuals Search And Download.

9-12 Firmware User Guide

Community strings

The Read-Only Community String and the Read/Write Community String are like passwords that must be used

by an SNMP manager querying or conﬁguring the Netopia Firmware Version 5.4. An SNMP manager using the

Read-Only Community String can examine statistics and conﬁguration information from the router, but cannot

modify the router’s conﬁguration. An SNMP manager using the Read/Write Community String can both

examine and modify conﬁguration parameters.

By default, the read-only and read/write community strings are set to public and private, respectively. You

should change both of the default community strings to values known only to you and trusted system adminis-

trators.

To change a community string, select it and enter a new value.

Setting the Read-Only and Read-Write community strings to the empty string will block all SNMP requests to the

router. (The router may still send SNMP Traps if those are properly enabled.)

Previously, if either community string was the empty string, SNMP Requests specifying an empty community

string were accepted and processed.

This change is designed to allow the administrator to block SNMP access to the router and to provide more

granular control over the allowed SNMP operations to the router.

■

Setting only the Read-Write community string to the empty string will block SNMP Set Requests to the

router, but Get Requests and Get-Next Requests will still be honored using the Read-Only community string

(assuming that is not the empty string).

■

Setting only the Read-Only community string to the empty string will not block Get Requests or Get-Next

Requests since those operations (and Set Requests) are still allowed using the (non-empty) Read-Write

community string.

Even if you decide not to use SNMP, you should change the community strings. This prevents unauthorized

access to the Router through SNMP. For more information on security issues, see “Suggested Security

Measures” on page 10-1.

SNMP traps

An SNMP trap is an informational message sent from an SNMP agent (in this case, the Router) to a manager.

When a manager receives a trap, it may log the trap as well as generate an alert message of its own.

Standard traps generated by the Netopia Firmware Version 5.4 include the following:

■

An authentication failure trap is generated when the router detects an incorrect community string in a

received SNMP packet. Authentication Traps Enable must be On for this trap to be generated.

■

A cold start trap is generated after the router is reset.

An interface down trap (ifDown) is generated when one of the router’s interfaces, such as a port, stops

functioning or is disabled.

■

An interface up trap (ifUp) is generated when one of the router’s interfaces, such as a port, begins

functioning.

The Netopia Firmware Version 5.4 sends traps using UDP (for IP networks).

You can specify which SNMP managers are sent the IP traps generated by the Netopia Firmware Version 5.4. Up

to eight receivers can be set. You can also review and remove IP traps.

Download from Www.Somanuals.com. All Manuals Search And Download.

Monitoring Tools 9-13

To go to the IP Trap Receivers screen, select IP Trap Receivers. The IP Trap Receivers screen appears.

IP Trap Receivers

Display/Change IP Trap Receiver...

Add IP Trap Receiver...

Delete IP Trap Receiver...

Return/Enter to modify an existing Trap Receiver.

Navigate from here to view, add, modify and delete IP Trap Receivers.

Setting the IP trap receivers

1. Select Add IP Trap Receiver.

2. Select Receiver IP Address or Domain Name. Enter the IP address or domain name of the SNMP manager

you want to receive the trap.

3. Select Community String if you enabled one in the SNMP Setup screen, and enter the appropriate

password.

4. Select Add Trap Receiver Now and press Return. You can add up to seven more receivers.

Viewing IP trap receivers

To display a view-only table of IP trap receivers, select Display/Change IP Trap Receiver in the IP Trap

Receivers screen.

Modifying IP trap receivers

1. To edit an IP trap receiver, select Display/Change IP Trap Receiver in the IP Trap Receivers screen.

2. Select an IP trap receiver from the table and press Return.

3. In the Change IP Trap Receiver screen, edit the information as needed and press Return.

Deleting IP trap receivers

1. To delete an IP trap receiver, select Delete IP Trap Receiver in the IP Trap Receivers screen.

2. Select an IP trap receiver from the table and press Return.

3. In the dialog box, select Continue and press Return.

Download from Www.Somanuals.com. All Manuals Search And Download.

9-14 Firmware User Guide

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-1

Chapter 10

Security

The Netopia Firmware Version 5.4 provides a number of security features to help protect its conﬁguration

screens and your local network from unauthorized access. Although these features are optional, it is strongly

recommended that you use them.

This section covers the following topics:

■

“Console Tiered Access – Two Password Levels” on page 10-2

“User Accounts” on page 10-15

“Telnet Access” on page 10-17

“About Filters and Filter Sets” on page 10-18

“Working with IP Filters and Filter Sets” on page 10-26

“Policy-based Routing using Filtersets” on page 10-34

“Firewall Tutorial” on page 10-37

“Conﬁguration Management” on page 10-44

“Call Filtering” on page 10-48

Suggested Security Measures

In addition to setting up user accounts, Telnet access, and ﬁlters (all of which are covered later in this chapter),

there are other actions you can take to make the Router and your network more secure:

■

Change the SNMP community strings (or passwords). The default community strings are universal and

could easily be known to a potential intruder.

■

Set the answer proﬁle so it must match incoming calls to a connection proﬁle.

Leave the Enable Dial-in Console Access option set to No.

Conﬁgure the Netopia Firmware Version 5.4 through the serial console port, if available, to ensure that your

communications cannot be intercepted.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-2 Firmware User Guide

Console Tiered Access – Two Password Levels

Netopia Firmware Version 5.4 offers tiered access control for greater security and protection against accidental

or malicious misconﬁguration. Service providers and network administrators can now limit the access of other

users to the various conﬁguration screens to prevent misconﬁgurations.

The access privileges of various users that may be assigned are governed by a Superuser administrative

account. The Superuser can assign different privileges to Limited users who will be accessing the router

functions in some way.

Conﬁguration access names and passwords are speciﬁed in the Security Options screen. From the Main Menu,

select System Conﬁguration, then Security.

System

Configuration

Main

Security

Options

Security

The Security Options screen appears.

Security Options

UPnP Enabled (on reboot):

Yes

Enable Telnet Console Access:

Yes

Enable Telnet Access to SNMP Screens:

Superuser Configuration...

Advanced Security Options...

Configuration Management...

Return/Enter accepts * Tab toggles * ESC cancels.

UPnP Support

UPnP Enabled: Universal Plug and Play (UPnP™) is a set of protocols that allows a PC to automatically discover

other UPnP devices (anything from an internet gateway device to a light switch), retrieve an XML description of

the device and its services, control the device, and subscribe to real-time event notiﬁcation.

By default, UPnP is enabled on the Netopia Gateway.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-3

For Windows XP users, the automatic discovery feature places an icon representing the Netopia Gateway

automatically in the “My Network Places” folder. Be sure that the Windows XP service Universal Plug and Play

Device Host is enabled and running, otherwise you might not see the icon.

Double clicking the icon will launch a telnet window to your Gateway’s Telnet interface.

PCs using UPnP can retrieve the Gateway’s WAN IP address, and automatically create NAT port maps. This

means that applications that support UPnP, and are used with a UPnP-enabled Netopia Gateway, will not need

application layer gateway support on the Netopia Gateway to work through NAT.

You can disable UPnP, if you are not using any UPnP devices or applications.

Superuser conﬁguration

The access privileges of the Superuser account are not modiﬁable. It is possible, however, to control who can

Select Superuser Conﬁguration and press Return.

The Superuser Conﬁguration screen appears.

Superuser Configuration

Name (19 characters max):

admin

Password:

Telnet Access Enabled:

Web Access Enabled:

Yes

ADD SUPERUSER

CANCEL

■

Assign a Superuser Name. It can be up to 19 characters long. It is good practice not to use any

easily-guessed combination such as your birthday.

Assign a Password. Keep this password secure. If you lose or forget it, you will not be able to access the

router without factory defaulting it, thereby losing all of your conﬁguration information.

You can disable Telnet or Web Access. This may be useful for extra security in preventing remote attempts

to access the router.

Select ADD SUPERUSER and press Return. The Superuser account is now conﬁgured.

You will be challenged for this name and password every time you attempt to log into the router.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-4 Firmware User Guide

Limited user conﬁguration

The Add Access Name/Password and Show/Change Access Name/Passwords screens allow you to select

which conﬁguration features a limited (non-Superuser) user can access. From the Security Options screen,

select Add Access Name/Password. The Add Access Name/Password screen appears.

Add Access Name/Password

Name (19 characters max):

user

Password:

********************

Yes

Telnet Access Enabled:

Web Access Enabled:

+-----------+

Access Privileges...

| All

| LAN

| WAN

| VOX

| Custom... |

+-----------+

ADD USER

CANCEL

■

Assign a User Name and Password, and enable or disable Telnet and Web access as in the Superuser

Conﬁguration screen.

Select Access Privileges, and from the pull-down menu, choose which access privilege you want this user

to have: All, LAN, WAN, or for IADs only, VOX.

If you assign any of these privileges, limited users will have full access to privileges associated with these

interfaces. You can customize these privileges further, in order to limit access to only certain portions of

those interfaces’ conﬁguration, by selecting Custom. If you select Custom, the Access Privileges

(Custom) screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-5

Access Privileges (Custom)

WAN Data Configuration:

Connection Profile Configuration: No

Circuit (PVC/DLCI) Configuration: No

LAN Data Configuration:

LAN Subnet Configuration:

NAT/Filters Configuration:

Yes

Preferences (Global) Configuration:Yes

Voice Configuration:

Yes

CANCEL

You can toggle the default user privileges for each user. The defaults are set to minimize the possibility of an

individual user inadvertently damaging the WAN connection. Exercise caution in assigning privileges other than

these defaults to limited users.

Access Privilege

WAN Data Conﬁguration

Default

Connection Proﬁle Conﬁguration

Circuit (PVC/DLCI) Conﬁguration

LAN Data Conﬁguration

Yes

LAN Subnet Conﬁguration

NAT/Filters Conﬁguration

Preferences (Global) Conﬁguration

Voice Conﬁguration (IADs only)

Advanced Security Options

The Advanced Security Options screen allows you to conﬁgure the global access privileges of users

authenticated via a RADIUS server.

From the Security Options screen, select Advanced Security Options. The Advanced Security Options screen

appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-6 Firmware User Guide

Advanced Security Options

Security Databases...

Local only

RADIUS Server Addr/Name:

RADIUS Server Secret:

Alt RADIUS Server Addr/Name:

Alt RADIUS Server Secret:

RADIUS Identifer:

+-----------+

RADIUS Server Authentication Port+-----------+

RADIUS Access Privileges...

| All

| LAN

| WAN

| VOX

Telnet Server Port:

| Custom... |

+-----------+

LAN (Ethernet) IP Filter Set...

Remove Filter Set

■

Select RADIUS Access Privileges, and from the pull-down menu, choose which access privilege you want

this user to have: All, LAN, WAN, or for IADs only, VOX.

If you assign any of these privileges, limited users will have full access to privileges associated with these

interfaces. You can customize these privileges further, in order to limit access to only certain portions of

those interfaces’ conﬁguration, by selecting Custom. If you select Custom, the Access Privileges

(Custom) screen appears.

Access Privileges (Custom)

WAN Data Configuration:

Yes

Connection Profile Configuration: Yes

Circuit (PVC/DLCI) Configuration: Yes

LAN Data Configuration:

LAN Subnet Configuration:

NAT/Filters Configuration:

Yes

Preferences (Global) Configuration:Yes

CANCEL

Return/Enter accepts * Tab toggles * ESC cancels.

Since authentication via RADIUS server is, by deﬁnition, authentication of remote users, the WAN-related

defaults are preset to Yes. Toggle any that should be changed.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-7

User access password

Users must be able to change their names and passwords, regardless of other security access restrictions.

If a user does not have security access, then they will only be able to modify the password for their account.

When a limited-access user logs into the router. and accesses the System Conﬁguration menus, the only

Security option displayed is Change Access Password.

System Configuration

IP Setup...

Filter Sets...

IP Address Serving...

Network Address Translation (NAT)...

Date and Time...

Console Configuration...

Change Access Password...

Upgrade Feature Set...

Logging...

Use this screen if you want options beyond Easy Setup.

Selecting this option displays the Change Access Password screen.

Change Access Password

New Password:

CHANGE PASSWORD NOW

CANCEL

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes.

When changing a password, you will be challenged to enter it again to be sure you have entered it correctly.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-8 Firmware User Guide

User menu differences

Menus reﬂect the security access level of the user. Consequently, conﬁguration menus will display differing

options based upon the parameters a particular user is allowed to change. Some differences include:

■

Limited users (non-Superusers) do not have access to Easy Setup.

■

All users have access to System Conﬁguration, Quick Menus, and Quick View, but limited users have only

limited access to conﬁguration elements in their descendant menus.

■

Conﬁguration screen elements to which conﬁguration access is forbidden are usually hidden.

The Quick Menus screen reﬂects the security access level of the user. Menus to which conﬁguration

access is forbidden are hidden.

Main Menu

The following is an example comparison of the Main Menu as seen by the Superuser and by a Limited user.

Superuser

Limited user

Netopia Router

Easy Setup...

WAN Configuration...

System Configuration...

Utilities & Diagnostics...

Statistics & Logs...

Quick Menus...

System Configuration...

Utilities & Diagnostics...

Statistics & Logs...

Quick Menus...

Quick View...

Return/Enter goes to Easy Setup -- minimal configuration.

You always start from this main screen.

Return/Enter goes to Easy Setup -- minimal configuration.

You always start from this main screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-9

Based on access level, the Main Menu displays its conﬁguration options according to the following diagram:

User Access Level

Netopia Router

Easy Setup...

Superuser

WAN Configuration...

System Configuration...

Utilities & Diagnostics...

Statistics & Logs...

Quick Menus...

WAN, Conn. Profiles, PVC

All

Global, Voice

All

Quick View...

Return/Enter goes to Easy Setup -- minimal configuration.

You always start from this main screen.

WAN Conﬁguration screens

If a limited user is allowed WAN, Connection Proﬁle, or PVC conﬁguration access, the WAN Conﬁguration option

in the Main Menu is visible. If a limited user selects WAN Conﬁguration in the Main Menu, the WAN

Conﬁguration screen displays its conﬁguration options according to the following diagram:

User Access Level

WAN Configuration

WAN

PVC

WAN (Wide Area Network) Setup...

ATM Circuits Configuration...

Display/Change Connection Profile...

Add Connection Profile...

Connection Profiles

Delete Connection Profile...

WAN Default Profile...

Connection Profiles

ATMP/PPTP Default Profile...

Advanced Connection Options...

WAN, Conn. Profiles

WAN

Frame Relay Configuration...

Frame Relay DLCI Configuration...

All

Establish WAN Connection...

Disconnect WAN Connection...

If a limited user selects Advanced Connection Options in the WAN Conﬁguration menu, the Advanced

Connection Options screen displays its conﬁguration options according to the following diagram:

Download from Www.Somanuals.com. All Manuals Search And Download.

10-10 Firmware User Guide

Advanced Connection Options

User Access Level

Configuration Changes Reset WAN Connection:

IKE Phase 1 Configuration...

WAN

Connection Profiles

Scheduled Connections...

Accounting Configuration...

Backup Configuration...

Connection Profiles

WAN

Connection Proﬁles

The Superuser can disallow limited user access to a particular Connection Proﬁle. When adding a Connection

Proﬁle in the Add Connection Proﬁle screen the Superuser can toggle the Superuser Accessible Only option to

Yes or No.

Add Connection Profile

Profile Name:

Profile 1

Yes

Profile Enabled:

Encapsulation Type...

PPP

Encapsulation Options...

IP Profile Parameters...

Superuser Accessible Only:

COMMIT

CANCEL

Return/Enter to accept the profile.

Configure a new Conn. Profile. Finished? COMMIT or CANCEL to exit.

This option is visible whether or not there are authorized username/passwords other than the Superuser.

The Superuser can also change the user accessibility after creating a Connection Proﬁle or a limited user in the

Change Connection Proﬁle screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-11

System Conﬁguration menu

The System Conﬁguration menu is always available to all users. Based on access level, the System

Conﬁguration menu displays its conﬁguration options according to the following diagram:

System Configuration

User Access Level

IP Setup...

LAN

NAT

LAN

NAT

Filter Sets...

IP Address Serving...

Network Address Translation (NAT)...

Date and Time...

Global

Console Configuration...

All

Superuser

SNMP (Simple Network Management Protocol)...

Security...

Superuser, All

Upgrade Feature Set...

Change Device to a Bridge...

Logging...

All

Superuser

All

Use this screen if you want options beyond Easy Setup.

Note: Network Address Translation (NAT) is displayed in this screen in order to make access control

simpler. Security becomes Change Access Password for non-Superusers, and provides access to the

associated menu described previously.

IP Setup menu

In the IP Setup menu, users that do not have LAN Subnet Conﬁguration access will see a screen similar to the

following:

IP Setup

LAN IP Subnet is...

192.168.1.1/24

Download from Www.Somanuals.com. All Manuals Search And Download.

10-12 Firmware User Guide

Utilities & Diagnostics menu

Based on access level, the Utilities & Diagnostics menu displays its conﬁguration options according to the

following diagram:

Utilities & Diagnostics

User Access Level

Ping...

Global

Trace Route...

Telnet...

Log off Serial Console Session...

All

Trivial File Transfer Protocol (TFTP)...

X-Modem File Transfer...

Global

All

Restart System...

Revert to Factory Defaults...

All

Superuser

Send ICMP Echo Requests to a network host.

X-Modem File Transfer menu

Based on access level, the X-Modem File Transfer menu displays its conﬁguration options according to the

following diagram:

X-Modem File Transfer

User Access Level

Send Firmware to Netopia...

Global

Get Configuration Destination...

Send Config to Netopia...

Current Configuration

Global

Send Configuration...

All

Receive Config from Netopia...

Statistics & Logs menu

The Statistics & Logs menu shown below is a composite of all the possible options on all Netopia routers and

IADs supported by the ﬁrmware. Substantial differences exist among screens on a given router or IAD. Here, all

selection options are shown.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-13

Based on access level, the Statistics & Logs menu displays its options according to the following diagram:

Statistics & Logs

User Access Level

WAN Event History...

Global

Device Event History...

Voice Log...

Global

Voice

Voice Accounting Log...

Voice Error Log...

IP Routing Table...

Voice

Global

Served IP Addresses...

Global

Served IP Addresses...

Accounting Statistics...

Backup Management/Statistics...

General Statistics...

Global

System Information...

Download from Www.Somanuals.com. All Manuals Search And Download.

10-14 Firmware User Guide

Quick Menus

Quick Menus vary considerably between models, features, and access levels. The following is an example

comparison of the Quick Menu as seen by the Superuser and by a Limited user.

Superuser

Quick Menu

Connection Profiles

Line Configuration

Fr. Relay Config

Fr. Relay DLCI Config

Backup Config

IP Setup

Add Connection Profiles

Change Connection Profiles

Delete Connection Profiles

WAN Default Profile

IP Address Serving Setup

IP Filter Sets

Static Routes

Telephone Setup

Network Address Translation

ATMP/PPTP Default Profile

IKE Phase 1 Config

Scheduled Connections

Add Scheduled Connection

Change Scheduled Connection

Delete Scheduled Connection

MacIP Setup

X-Modem File Transfer

TFTP

AURP Setup

Console Configuration

SNMP Setup

Limited user

Quick Menu

IP Setup

IP Address Serving Setup

Filter Sets

Static Routes

Network Address Translation

X-Modem File Transfer

TFTP

Console Configuration

This menu allows you to visit most configuration screens.

Note: Console Conﬁguration is always visible.

ATM Circuits Conﬁguration menu

You select ATM Circuits Conﬁguration from the WAN Conﬁguration menu.

Main

ATM Circuits

Configuration

WAN Configuration

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-15

The ATM Circuits Conﬁguration menu screen appears as follows:

ATM Circuits Configuration

Display/Change WAN 1 Circuit...

Add WAN 1 Circuit...

Delete WAN 1 Circuit...

Display/Change WAN 2 Circuit...

Add WAN 2 Circuit...

Delete WAN 2 Circuit...

Note: Multiple ATM circuit conﬁguration is supported on multiple ATM-capable routers. Although some of the

parameters of the Circuit Conﬁguration screens pertain to Voice and Connection Proﬁles, it is assumed that if

the user has been granted PVC conﬁguration access, they are permitted conﬁguration access to all PVC

parameters.

User Accounts

When you ﬁrst set up and conﬁgure the Netopia Firmware Version 5.4, no passwords are required to access the

conﬁguration screens. Anyone could tamper with the router’s conﬁguration by simply connecting it to a console.

However, by adding user accounts, you can protect the most sensitive screens from unauthorized access. User

accounts are composed of name/password combinations that can be given to authorized users.

Caution!

You are strongly encouraged to add protection to the conﬁguration screens. Unprotected screens could allow an

unauthorized user to compromise the operation of your entire network.

Once user accounts are created, users who attempt to access protected screens will be challenged. Users who

enter an incorrect name or password are returned to a screen requesting a name/password combination to

access the Main Menu.

To set up user accounts, in the System Conﬁguration screen select Security and press Return. The Security

Options screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-16 Firmware User Guide

Security Options

Enable Telnet Console Access:

Yes

Enable Telnet Access to SNMP Screens:

Console Access timeout (seconds):

600

Show Users...

Add User...

Delete User...

Advanced Security Options...

Password for This Screen (11 chars max):

Return/Enter accepts * Tab toggles * ESC cancels.

Set up configuration access options here.

Protecting the Security Options screen

The ﬁrst screen you should protect is the Security Options screen, because it controls access to the

conﬁguration screens. Access to the Security Options screen can be protected with a password.

Select Password for This Screen in the Security Options screen and enter a password. Make sure this

password is secure and is different from any of the user account passwords.

Protecting the conﬁguration screens

You can protect the conﬁguration screens with user accounts. You can administer the accounts from the

Security Options screen. You can create up to four accounts.

To display a view-only list of user accounts, select Show Users in the Security Options screen.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-17

To add a new user account, select Add User in the Security Options screen and press Return. The Add Name

With Write Access screen appears.

Add Name With Write Access

Enter Name:

Enter Password (11 characters max):

ADD NAME/PASSWORD NOW

CANCEL

Follow these steps to conﬁgure the new account:

1. Select Enter Name and enter a descriptive name (for example, the user’s ﬁrst name).

2. Select Enter Password and enter a password.

3. To accept the new name/password combination, select ADD NAME/PASSWORD NOW and press Return.

To exit the Add Name With Write Access screen without saving the new account, select CANCEL. You are

returned to the Security Options screen.

To delete a user account, select Delete User to display a list of accounts. Select an account from the list and

press Return to delete it. To exit the list without deleting the selected account, press Escape.

Telnet Access

Telnet is a TCP/IP service that allows remote terminals to access hosts on an IP network. The Netopia

Firmware Version 5.4 supports Telnet access to its conﬁguration screens.

Caution!

You should consider password-protecting or restricting Telnet access to the Router if you suspect there is a

chance of tampering.

To password-protect the conﬁguration screens, select Easy Setup from the Main Menu, and go to the Easy

Setup Security Conﬁguration screen. By entering a name and password pair in this screen, all access via serial,

Telnet, SNMP, and Web server will be password-protected.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-18 Firmware User Guide

To restrict Telnet access, select Security in the Advanced Conﬁguration menu. The Security Options screen will

appear. There are two levels of Telnet restriction available:

■

To restrict Telnet access to the SNMP screens, select Enable Telnet Access to SNMP Screens and toggle

it to No. (See “SNMP traps” on page 9-12.)

■

To restrict Telnet access to all of the conﬁguration screens, select Enable Telnet Console Access and

toggle it to No.

About Filters and Filter Sets

Security should be a high priority for anyone administering a network connected to the Internet. Using packet

ﬁlters to control network communications can greatly improve your network’s security.

The Netopia Firmware Version 5.4’s packet ﬁlters are designed to provide security for the Internet connections

made to and from your network. You can customize the router’s ﬁlter sets for a variety of packet ﬁltering

applications. Typically, you use ﬁlters to selectively admit or refuse TCP/IP connections from certain remote

networks and speciﬁc hosts. You will also use ﬁlters to screen particular types of connections. This is

commonly called ﬁrewalling your network.

Before creating ﬁlter sets, you should read the next few sections to learn more about how these powerful

security tools work.

What’s a ﬁlter and what’s a ﬁlter set?

A ﬁlter is a rule that lets you specify what sort of data can ﬂow in and out of your network. A particular ﬁlter can

be either an input ﬁlter—one that is used on data (packets) coming in to your network from the Internet—or an

output ﬁlter—one that is used on data (packets) going out from your network to the Internet.

A ﬁlter set is a group of ﬁlters that work together to check incoming or outgoing data. A ﬁlter set can consist of

a combination of input and output ﬁlters.

How ﬁlter sets work

A ﬁlter set acts like a team of customs inspectors. Each ﬁlter is an inspector through which incoming and

outgoing packages must pass. The inspectors work as a team, but each inspects every package individually.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-19

Each inspector has a speciﬁc task. One inspector’s task may be to examine the destination address of all

outgoing packages. That inspector looks for a certain destination—which could be as speciﬁc as a street

address or as broad as an entire country—and checks each package’s destination address to see if it matches

that destination.

FROM:

TO:

A ﬁlter inspects data packets like a customs inspector scrutinizing packages.

Filter priority

Continuing the customs inspectors analogy, imagine the inspectors lined up to examine a package. If the

package matches the ﬁrst inspector’s criteria, the package is either rejected or passed on to its destination,

depending on the ﬁrst inspector’s particular orders. In this case, the package is never seen by the remaining

inspectors.

packet

first

filter

match?

send

to next

filter

yes

forward

discard?

discard

(delete)

forward

to network

Download from Www.Somanuals.com. All Manuals Search And Download.

10-20 Firmware User Guide

If the package does not match the ﬁrst inspector’s criteria, it goes to the second inspector, and so on. You can

see that the order of the inspectors in the line is very important.

For example, let’s say the ﬁrst inspector’s orders are to send along all packages that come from Rome, and the

second inspector’s orders are to reject all packages that come from France. If a package arrives from Rome,

the ﬁrst inspector sends it along without allowing the second inspector to see it. A package from Paris is

ignored by the ﬁrst inspector, rejected by the second inspector, and never seen by the others. A package from

London is ignored by the ﬁrst two inspectors, so it’s seen by the third inspector.

In the same way, ﬁlter sets apply their ﬁlters in a particular order. The ﬁrst ﬁlter applied can forward or discard

a packet before that packet ever reaches any of the other ﬁlters. If the ﬁrst ﬁlter can neither forward nor discard

the packet (because it cannot match any criteria), the second ﬁlter has a chance to forward or reject it, and so

on. Because of this hierarchical structure, each ﬁlter is said to have a priority. The ﬁrst ﬁlter has the highest

priority, and the last ﬁlter has the lowest priority.

How individual ﬁlters work

As described above, a ﬁlter applies criteria to an IP packet and then takes one of three actions:

■

Forwards the packet to the local or remote network

Blocks (discards) the packet

Ignores the packet

A ﬁlter forwards or blocks a packet only if it ﬁnds a match after applying its criteria. When no match occurs, the

ﬁlter ignores the packet.

A ﬁltering rule

The criteria are based on information contained in the packets. A ﬁlter is simply a rule that prescribes certain

actions based on certain conditions. For example, the following rule qualiﬁes as a ﬁlter:

Block all Telnet attempts that originate from the remote host 199.211.211.17.

This rule applies to Telnet packets that come from a host with the IP address 199.211.211.17. If a match

occurs, the packet is blocked.

Here is what this rule looks like when implemented as a ﬁlter on the Netopia Firmware Version 5.4:

+-#--Source IP Addr--Dest IP Addr-----Proto-Src.Port-D.Port--On?-Fwd-+

+--------------------------------------------------------------------+

| 1 199.211.211.17 0.0.0.0

TCP 23

Yes No |

+--------------------------------------------------------------------+

To understand this particular ﬁlter, look at the parts of a ﬁlter.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-21

Parts of a ﬁlter

A ﬁlter consists of criteria based on packet attributes. A typical ﬁlter can match a packet on any one of the

following attributes:

■

The source IP address (where the packet was sent from)

The destination IP address (where the packet is going)

The type of higher-layer Internet protocol the packet is carrying, such as TCP or UDP

Port numbers

A ﬁlter can also match a packet’s port number attributes, but only if the ﬁlter’s protocol type is set to TCP or

UDP, since only those protocols use port numbers. The ﬁlter can be conﬁgured to match the following:

■

The source port number (the port on the sending host that originated the packet)

The destination port number (the port on the receiving host that the packet is destined for)

By matching on a port number, a ﬁlter can be applied to selected TCP or UDP services, such as Telnet, FTP, and

World Wide Web. The following tables show a few common services and their associated port numbers:

Internet service

FTP

TCP port

Internet service

Finger

TCP port

20/21

Telnet

World Wide Web

News

SMTP (mail)

Gopher

144

513

rlogin

Internet service

UDP port

Internet service

UDP port

Who Is

AppleTalk Routing

202

Maintenance (at-rtmp)

World Wide Web

AppleTalk Name Binding

(at-nbp)

202

SNMP

TFTP

161

AURP (AppleTalk)

who

387

513

Download from Www.Somanuals.com. All Manuals Search And Download.

10-22 Firmware User Guide

Port number comparisons

A ﬁlter can also use a comparison option to evaluate a packet’s source or destination port number. The

comparison options are:

No Compare: No comparison of the port number speciﬁed in the ﬁlter with the packet’s port number.

Not Equal To: For the ﬁlter to match, the packet’s port number cannot equal the port number speciﬁed in the

ﬁlter.

Less Than: For the ﬁlter to match, the packet’s port number must be less than the port number speciﬁed in the

ﬁlter.

Less Than or Equal: For the ﬁlter to match, the packet’s port number must be less than or equal to the port

number speciﬁed in the ﬁlter.

Equal: For the ﬁlter to match, the packet’s port number must equal the port number speciﬁed in the ﬁlter.

Greater Than: For the ﬁlter to match, the packet’s port number must be greater than the port number speciﬁed

in the ﬁlter.

Greater Than or Equal: For the ﬁlter to match, the packet’s port number must be greater than or equal to the

port number speciﬁed in the ﬁlter.

Other ﬁlter attributes

There are three other attributes to each ﬁlter:

■

The ﬁlter’s order (i.e., priority) in the ﬁlter set

Whether the ﬁlter is currently active

Whether the ﬁlter is set to forward packets or to block (discard) packets

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-23

Putting the parts together

When you display a ﬁlter set, its ﬁlters are displayed as rows in a table:

+-#---Source IP Addr---Dest IP Addr-----Proto-Src.Port-D.Port--On?-Fwd-+

+----------------------------------------------------------------------+

| 1 192.211.211.17 0.0.0.0

TCP 0

Yes No |

| 2 0.0.0.0

0.0.0.0

TCP NC

ICMP --

TCP NC

UDP NC

=6000 Yes No |

| 3 0.0.0.0

Yes Yes |

| 4 0.0.0.0

>1023 Yes Yes |

| 5 0.0.0.0

>1023 Yes Yes |

+----------------------------------------------------------------------+

The table’s columns correspond to each ﬁlter’s attributes:

#: The ﬁlter’s priority in the set. Filter number 1, with the highest priority, is ﬁrst in the table.

Source IP Addr: The packet source IP address to match.

Dest IP Addr: The packet destination IP address to match.

Proto: The protocol to match. This can be entered as a number (see the table below) or as TCP or UDP if those

protocols are used.

Protocol

Number to use

Full name

N/A

ICMP

TCP

Ignores protocol type

Internet Control Message Protocol

Transmission Control Protocol

User Datagram Protocol

UDP

Src. Port: The source port to match. This is the port on the sending host that originated the packet.

D. Port: The destination port to match. This is the port on the receiving host for which the packet is intended.

On?: Displays Yes when the ﬁlter is in effect or No when it is not.

Fwd: Shows whether the ﬁlter forwards (Yes) a packet or discards (No) it when there’s a match.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-24 Firmware User Guide

Filtering example #1

Returning to our ﬁltering rule example from above (see page 10-20), look at how a rule is translated into a ﬁlter.

Start with the rule, then ﬁll in the ﬁlter’s attributes:

1. The rule you want to implement as a ﬁlter is:

Block all Telnet attempts that originate from the remote host 199.211.211.17.

2. The host 199.211.211.17 is the source of the Telnet packets you want to block, while the destination

address is any IP address. How these IP addresses are masked determines what the ﬁnal match will be,

although the mask is not displayed in the table that displays the ﬁlter sets (you set it when you create the

ﬁlter). In fact, since the mask for the destination IP address is 0.0.0.0, the address for Dest IP Addr could

have been anything. The mask for Source IP Addr must be 255.255.255.255 since an exact match is

desired.

■

Source IP Addr = 199.211.211.17

Source IP address mask = 255.255.255.255

Dest IP Addr = 0.0.0.0

Destination IP address mask = 0.0.0.0

3. Using the tables on page 10-21, ﬁnd the destination port and protocol numbers (the local Telnet port):

■

Proto = TCP (or 6)

D. Port = 23

■

4. The ﬁlter should be enabled and instructed to block the Telnet packets containing the source address

shown in step 2:

■

On? = Yes

Fwd = No

■

This four-step process is how we produced the following ﬁlter from the original rule:

+-#---Source IP Addr---Dest IP Addr-----Proto-Src.Port-D.Port--On?-Fwd-+

+----------------------------------------------------------------------+

| 1 192.211.211.17 0.0.0.0

TCP 0

Yes No |

+----------------------------------------------------------------------+

Filtering example #2

Suppose a ﬁlter is conﬁgured to block all incoming IP packets with the source IP address of 200.233.14.0,

regardless of the type of connection or its destination. The ﬁlter would look like this:

+-#---Source IP Addr---Dest IP Addr-----Proto-Src.Port-D.Port--On?-Fwd-+

+----------------------------------------------------------------------+

| 1 200.233.14.0

0.0.0.0

Yes No |

+----------------------------------------------------------------------+

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-25

This ﬁlter blocks any packets coming from a remote network with the IP network address 200.233.14.0. The 0

at the end of the address signiﬁes any host on the class C IP network 200.233.14.0. If, for example, the ﬁlter

is applied to a packet with the source IP address 200.233.14.5, it will block it.

In this case, the mask, which does not appear in the table, must be set to 255.255.255.0. This way, all

packets with a source address of 200.233.14.x will be matched correctly, no matter what the ﬁnal address byte

is.

Note: The protocol attribute for this ﬁlter is 0 by default. This tells the ﬁlter to ignore the IP protocol or type of

IP packet.

Design guidelines

Careful thought must go into designing a new ﬁlter set. You should consider the following guidelines:

■

Be sure the ﬁlter set’s overall purpose is clear from the beginning. A vague purpose can lead to a faulty

set, and that can actually make your network less secure.

■

Be sure each individual ﬁlter’s purpose is clear.

Determine how ﬁlter priority will affect the set’s actions. Test the set (on paper) by determining how the

ﬁlters would respond to a number of different hypothetical packets.

■

Consider the combined effect of the ﬁlters. If every ﬁlter in a set fails to match on a particular packet, the

packet is:

■

Forwarded if all the ﬁlters are conﬁgured to discard (not forward)

Discarded if all the ﬁlters are conﬁgured to forward

Discarded if the set contains a combination of forward and discard ﬁlters

Disadvantages of ﬁlters

Although using ﬁlter sets can greatly enhance network security, there are disadvantages:

■

Filters are complex. Combining them in ﬁlter sets introduces subtle interactions, increasing the likelihood

of implementation errors.

Enabling a large number of ﬁlters can have a negative impact on performance. Processing of packets will

take longer if they have to go through many checkpoints.

Too much reliance on packet ﬁlters can cause too little reliance on other security methods. Filter sets are

not a substitute for password protection, effective safeguarding of passwords, caller ID, the “must match”

option in the answer proﬁle, PAP or CHAP in connection proﬁles, callback, and general awareness of how

your network may be vulnerable.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-26 Firmware User Guide

An approach to using ﬁlters

The ultimate goal of network security is to prevent unauthorized access to the network without compromising

authorized access. Using ﬁlter sets is part of reaching that goal.

Each ﬁlter set you design will be based on one of the following approaches:

■

That which is not expressly prohibited is permitted.

That which is not expressly permitted is prohibited.

■

It is strongly recommended that you take the latter, and safer, approach to all of your ﬁlter set designs.

Working with IP Filters and Filter Sets

This section covers IP ﬁlters and ﬁlter sets.

System

Configuration

Main

Filter

Sets

To work with ﬁlters and ﬁlter sets, begin by accessing the ﬁlter set screens.

Note: Make sure you understand how ﬁlters work before attempting to use them. Read the section “About

Filters and Filter Sets,” beginning on page 10-18.

Filter Sets

Add Filter Set...

Display/Change Filter Set...

Delete Filter Set...

The procedure for creating and maintaining ﬁlter sets is as follows:

1. Add a new ﬁlter set.

2. Create the ﬁlters for the new ﬁlter set.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-27

3. View, change, or delete individual ﬁlters and ﬁlter sets.

The sections below explain how to execute these steps.

Adding a ﬁlter set

You can create up to eight different custom ﬁlter sets. Each ﬁlter set can contain up to 16 output ﬁlters and up

to 16 input ﬁlters.

To add a new ﬁlter set, select Add Filter Set in the Filter Sets screen and press Return. The Add Filter Set

screen appears.

Add Filter Set...

Filter Set Name:

Filter Set 3

ADD FILTER SET

CANCEL

Naming a new ﬁlter set

All new ﬁlter sets have a default name. The ﬁrst ﬁlter set you add will be called Filter Set 1, the next ﬁlter will be

Filter Set 2, and so on.

To give a new ﬁlter set a different name, select Filter Set Name and enter a new name for the ﬁlter set.

To save the ﬁlter set, select ADD FILTER SET. The saved ﬁlter set is empty (contains no ﬁlters), but you can

return to it later to add ﬁlters (see “Adding ﬁlters to a ﬁlter set” on page 10-28).

Download from Www.Somanuals.com. All Manuals Search And Download.

10-28 Firmware User Guide

Adding ﬁlters to a ﬁlter set

There are two kinds of ﬁlters you can add to a ﬁlter set: input and output. Input ﬁlters check packets received

from the Internet, destined for your network. Output ﬁlters check packets transmitted from your network to the

Internet.

packet

input filter

LAN

WAN

packet

output filter

The Netopia Router

Packets in the Netopia Firmware Version 5.4 pass through an input ﬁlter if they originate in the WAN and through an output ﬁlter

if they’re being sent out to the WAN.

The process for adding input and output ﬁlters is exactly the same. The main difference between the two

involves their reference to source and destination. From the perspective of an input ﬁlter, your local network is

the destination of the packets it checks, and the remote network is their source. From the perspective of an

output ﬁlter, your local network is the source of the packets, and the remote network is their destination.

Type of ﬁlter

Source means

Destination means

Input ﬁlter

The remote network

The local network

Output ﬁlter

The remote network

To add a ﬁlter, select Display/Change Filter Set in the Filter Set screen. From the pop-up menu, select the ﬁlter

set to which you will add a ﬁlter. The Display/Change Filter Set screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-29

Display/Change Filter Set...

Filter Set 3

Filter Set Name:

Add Input Filter to Filter Set...

Display/Change Input Filter...

Delete Input Filter...

Move Input Filter...

Add Output Filter to Filter Set...

Display/Change Output Filter...

Delete Output Filter...

Move Output Filter...

Note: There are two groups of items in this screen, one for input ﬁlters and one for output ﬁlters. In this

section, you’ll learn how to add an input ﬁlter to a ﬁlter set. Adding an output ﬁlter works exactly the same way,

providing you keep the different source and destination perspectives in mind.

1. To add a ﬁlter, select Add Input Filter to Filter Set and press Return. The Add Input Filter screen appears.

Add Input Filter

Enabled:

Forward:

Yes

Source IP Address:

0.0.0.0

Source IP Address Mask:

Dest. IP Address:

0.0.0.0

Dest. IP Address Mask:

Protocol Type:

ANY

Protocol Type:

TCP

Source Port Compare...

Source Port ID:

No Compare

Dest. Port Compare...

Dest. Port ID:

No Compare

Established TCP Conns. Only:

ADD THIS FILTER NOW

CANCEL

2. To make the ﬁlter active in the ﬁlter set, select Enabled and toggle it to Yes. If Enabled is toggled to No, the

ﬁlter can still exist in the ﬁlter set, but it will have no effect.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-30 Firmware User Guide

3. If you want the ﬁlter to forward packets that match its criteria to the destination IP address, select Forward

and toggle it to Yes. If Forward is toggled to No, packets matching the ﬁlter’s criteria will be discarded.

4. Select Source IP Address and enter the source IP address this ﬁlter will match on. You can enter a subnet

or a host address.

5. Select Source IP Address Mask and enter a mask for the source IP address. This allows you to further

modify the way the ﬁlter will match on the source address. Enter 0.0.0.0 to force the ﬁlter to match on all

source IP addresses, or enter 255.255.255.255 to match the source IP address exclusively.

6. Select Dest. IP Address and enter the destination IP address this ﬁlter will match on. You can enter a

subnet or a host address.

7. Select Dest. IP Address Mask and enter a mask for the destination IP address. This allows you to further

modify the way the ﬁlter will match on the destination address. Enter 0.0.0.0 to force the ﬁlter to match on

all destination IP addresses.

8. Select Protocol Type and enter ICMP, TCP, UDP, Any, or the number of another IP transport protocol (see

the table on page 10-23 ).

Note: If Protocol Type is set to TCP or UDP, the settings for port comparison that you conﬁgure in steps 8

and 9 will appear. These settings only take effect if the Protocol Type is TCP or UDP.

9. Select Source Port Compare and choose a comparison method for the ﬁlter to use on a packet’s source

port number. Then select Source Port ID and enter the actual source port number to match on (see the

table on page 10-21).

10. Select Dest. Port Compare and choose a comparison method for the ﬁlter to use on a packet’s destination

port number. Then select Dest. Port ID and enter the actual destination port number to match on (see the

table on page 10-21).

11. When you are ﬁnished conﬁguring the ﬁlter, select ADD THIS FILTER NOW to save the ﬁlter in the ﬁlter set.

Select CANCEL to discard the ﬁlter and return to the Add IP Filter Set screen.

Viewing ﬁlters

To display a table of input or output ﬁlters, select Display/Change Input Filter or Display/Change Output Filter

in the Display/Change Filter Set screen.

Modifying ﬁlters

To modify a ﬁlter, select Display/Change Input Filter or Display/Change Output Filter in the Display/Change

Filter Set screen. Select a ﬁlter from the table and press Return. The Change Filter screen appears. The

parameters in this screen are set in the same way as the ones in the Add Filter screen (see “Adding ﬁlters to a

ﬁlter set” on page 10-28).

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-31

Change Filter

Enabled:

Forward:

Source IP Address:

0.0.0.0

Source IP Address Mask:

Dest. IP Address:

0.0.0.0

Dest. IP Address Mask:

Protocol Type:

Source Port Compare...

Source Port ID:

No Compare

Dest. Port Compare...

Dest. Port ID:

No Compare

Enter the IP specific information for this filter.

Deleting ﬁlters

To delete a ﬁlter, select Delete Input Filter or Delete Output Filter in the Display/Change Filter Set screen to

display a table of ﬁlters.

Select the ﬁlter from the table and press Return to delete it. Press Escape to exit the table without deleting the

ﬁlter.

Moving ﬁlters

To reorganize the ﬁlters in a ﬁlter set, select Move Input Filter or Move Output Filter in the Display/Change

Filter Set screen to display a table of ﬁlters.

Select a ﬁlter from the table and press Return. Then use the up or down arrow key to change the ﬁlter’s order in

the ﬁlter set. Press Return to accept the new ﬁlter location.

Deleting a ﬁlter set

Note: If you delete a ﬁlter set, all of the ﬁlters it contains are deleted as well. To reuse any of these ﬁlters in

another set, before deleting the current ﬁlter set you’ll have to note their conﬁguration and then recreate them.

To delete a ﬁlter set, select Delete Filter Set in the Filter Sets screen to display a list of ﬁlter sets.

Select a ﬁlter set from the list and press Return. Select CONTINUE and press Return to delete it.

A sample ﬁlter set

This section contains the settings for a ﬁlter set called Basic Firewall, which is part of the Netopia Firmware

Version 5.4’s factory conﬁguration.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-32 Firmware User Guide

Basic Firewall blocks undesirable trafﬁc originating from the WAN (in most cases, the Internet), but forwards all

trafﬁc originating from the LAN. It follows the conservative “that which is not expressly permitted is prohibited”

approach: unless an incoming packet expressly matches one of the constituent input ﬁlters, it will not be

forwarded to the LAN.

The ﬁve input ﬁlters and one output ﬁlter that make up Basic Firewall are shown in the table below.

Inputﬁlter Inputﬁlter Inputﬁlter Inputﬁlter Inputﬁlter

Output

ﬁlter 1

Setting

Enabled

Yes

Forward

Yes

Source IP

address

0.0.0.0

TCP

0.0.0.0

TCP

0.0.0.0

TCP

0.0.0.0

UDP

0.0.0.0

Source IP

address mask

0.0.0.0

Dest. IP

address

Dest. IP

address mask

Protocol type

ICMP

N/A

Source port

comparison

Compare

N/A

Source port ID

N/A

Dest. port

comparison

Equal

Greater

Than

Greater

Than

Dest. port ID

2000

6000

N/A

1023

N/A

Basic Firewall’s ﬁlters play the following roles.

Input ﬁlters 1 and 2: These block WAN-originated OpenWindows and X-Windows sessions. Service origination

requests for these protocols use ports 2000 and 6000, respectively. Since these are greater than 1023,

OpenWindows and X-Windows trafﬁc would otherwise be allowed by input ﬁlter 4. Input ﬁlters 1 and 2 must

precede input ﬁlter 4; otherwise they would have no effect since ﬁlter 4 would have already forwarded

OpenWindows and X-Windows trafﬁc.

Input ﬁlter 3: This ﬁlter explicitly forwards all WAN-originated ICMP trafﬁc to permit devices on the WAN to ping

devices on the LAN. Ping is an Internet service that is useful for diagnostic purposes.

Input ﬁlters 4 and 5: These ﬁlters forward all TCP and UDP trafﬁc, respectively, when the destination port is

greater than 1023. This type of trafﬁc generally does not allow a remote host to connect to the LAN using one

of the potentially intrusive Internet services, such as Telnet, FTP, and WWW.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-33

Output ﬁlter 1: This ﬁlter forwards all outgoing trafﬁc to make sure that no outgoing connections from the LAN

are blocked.

Basic Firewall is suitable for a LAN containing only client hosts that want to access servers on the WAN, but not

for a LAN containing servers providing services to clients on the WAN. Basic Firewall’s general strategy is to

explicitly forward WAN-originated TCP and UDP trafﬁc to ports greater than 1023. Ports lower than 1024 are the

service origination ports for various Internet services such as FTP, Telnet, and the World Wide Web (WWW).

A more complicated ﬁlter set would be required to provide WAN access to a LAN-based server. See the next

section, “Possible modiﬁcations,” for ways to allow remote hosts to use services provided by servers on the

LAN.

Possible modiﬁcations

You can modify the sample ﬁlter set Basic Firewall to allow incoming trafﬁc using the examples below. These

modiﬁcations are not intended to be combined. Each modiﬁcation is to be the only one used with Basic Firewall.

The results of combining ﬁlter set modiﬁcations can be difﬁcult to predict. It is recommended that you take

special care if you are making more than one modiﬁcation to the sample ﬁlter set.

Trusted host. To allow unlimited access by a trusted remote host with the IP address a.b.c.d (corresponding to

a numbered IP address such as 163.176.8.243), insert the following input ﬁlter ahead of the current input

ﬁlter 1:

■

Enabled: Yes

Forward: Yes

Source IP Address: a.b.c.d

Source IP Address Mask: 255.255.255.255

Dest. IP Address: 0.0.0.0

Dest. IP Address Mask: 0.0.0.0

Protocol Type: 0

Trusted subnet. To allow unlimited access by a trusted remote subnet with subnet address a.b.c.d

(corresponding to a numbered IP address such as 163.176.8.0) and subnet mask e.f.g.h (corresponding to a

numbered IP mask such as 255.255.255.0), insert the following input ﬁlter ahead of the current input ﬁlter 1:

■

Enabled: Yes

Forward: Yes

Source IP Address: a.b.c.d

Source IP Address Mask: e.f.g.h

Dest. IP Address: 0.0.0.0

Dest. IP Address Mask: 0.0.0.0

Protocol Type: 0

Download from Www.Somanuals.com. All Manuals Search And Download.

10-34 Firmware User Guide

FTP sessions. To allow WAN-originated FTP sessions to a LAN-based FTP server with the IP address a.b.c.d

(corresponding to a numbered IP address such as 163.176.8.243), insert the following input ﬁlter ahead of the

current input ﬁlter 1:

■

Enabled: Yes

Forward: Yes

Source IP Address: 0.0.0.0

Source IP Address Mask: 0.0.0.0

Dest. IP Address: a.b.c.d

Dest. IP Address Mask: 255.255.255.255

Protocol Type: TCP

Source Port Comparison: No Compare

Source Port ID: 0

Dest. Port Comparison: Equal

Dest. Port ID: 21

Note: A similar ﬁlter could be used to permit Telnet or WWW access. Set the Dest. Port ID to 23 for Telnet or

to 80 for WWW.

Note: Deleting a ﬁlter set does not delete the ﬁlters in that set. However, the ﬁlters in the deleted set are no

longer in effect (unless they are part of another set). The deleted set will no longer appear in the answer proﬁle

or any connection proﬁles to which it was added.

Policy-based Routing using Filtersets

Previous ﬁrmware versions routed IP packets only by destination IP address. Netopia Firmware Version 5.4

offers the ability to route IP packets using criteria other than the destination IP address. This is called

policy-based routing. You are now able to route IP trafﬁc based on the following:

■

source IP address

source and/or destination protocol ﬁeld

source and/or destination port numbers

TOS ﬁeld

You specify the routing criteria and routing information by using IP ﬁltersets to determine the forwarding action

of a particular ﬁlter.

In previous ﬁrmware versions, a ﬁlter would either pass or block the speciﬁed trafﬁc. Netopia Firmware Version

5.4 adds a third option, force routing. You specify a gateway IP address, and each packet matching the ﬁlter is

routed according to that gateway address, rather than by means of the global routing table.

In addition, the TOS ﬁeld has been added to the classiﬁer list in a ﬁlter. This allows you to ﬁlter on TOS ﬁeld

settings in the IP packet, if you desire.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-35

The new ﬁlterset screen appears as follows:

Change Input Filter 1

Enabled:

Yes

Forward:

Yes

Call Placement/Idle Reset:

Force Routing:

Gateway IP Address:

No Change

Yes

163.176.8.134

Source IP Address:

Source IP Address Mask:

Dest. IP Address:

Dest. IP Address Mask:

TOS:

0.0.0.0

TOS Mask:

Protocol Type:

UDP

Source Port Compare...

Source Port ID:

Dest. Port Compare...

Dest. Port ID:

Equal

137

No Compare

Return/Enter to set comparison of packet Port ID and Filter Port ID.

Enter the packet specific information for this filter.

To use the policy-based routing feature, you create a ﬁlter that forwards the trafﬁc.

■

Toggle Forward to Yes. This will display the Force Routing options.

Toggle Force Routing to Yes.

Enter the Gateway IP Address in standard dotted-quad notation to which the trafﬁc should be forwarded.

You can enter Source and Destination IP Address(es) and Mask(s), Protocol Type, and Source and

Destination Port ID(s) for the ﬁlter, if desired.

TOS ﬁeld matching

Netopia Firmware Version 5.4 adds two additional new parameters to an IP ﬁlter: TOS and TOS Mask. Both

ﬁelds accept values in the range 0 – 255.

Certain types of IP packets, such as voice or multimedia packets, are sensitive to latency introduced by the

network. A delay-sensitive packet is one that has the low-latency bit set in the TOS ﬁeld of the IP header. This

means that if such packets are not received rapidly, the quality of service degrades. If you expect to route

signiﬁcant amounts of such trafﬁc you can conﬁgure your router to route this type of trafﬁc to a gateway other

than your normal gateway using this feature.

The TOS ﬁeld matching check is consistent with source and destination address matching.

Example: You want packets with the TOS low latency bit to go through VC 2 (via gateway 127.0.0.3) instead of

your normal gateway. You would set up the ﬁlter as follows:

Download from Www.Somanuals.com. All Manuals Search And Download.

10-36 Firmware User Guide

Add Input Filter

Enabled:

Forward:

Yes

Call Placement/Idle Reset:

No Change

Force Routing:

Yes

Gateway IP Address:

127.0.0.3

Source IP Address:

Source IP Address Mask:

Dest. IP Address:

Dest. IP Address Mask:

TOS:

0.0.0.0

TOS Mask:

Protocol Type:

ANY

ADD THIS FILTER NOW

CANCEL

Return/Enter to add this Filter to the Filter Set.

Enter the packet specific information for this filter.

Note:

Default Forwarding Filter

If you create one or more ﬁlters that have a matching action of forward, then action on a packet matching none

of the ﬁlters is to block any trafﬁc.

Therefore, if the behavior you want is to force the routing of a certain type of packet and pass all others through

the normal routing mechanism, you must conﬁgure one ﬁlter to match the ﬁrst type of packet and apply Force

Routing. A subsequent ﬁlter is required to match and forward all other packets.

Management IP trafﬁc

If the Force Routing ﬁlter is applied to source IP addresses, it may inadvertently block communication with the

router itself. You can avoid this by preceding the Force Routing ﬁlter with a ﬁlter that matches the destination IP

address of the router itself.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-37

Firewall Tutorial

General ﬁrewall terms

Filter rule: A ﬁlter set is comprised of individual ﬁlter rules.

Filter set: A grouping of individual ﬁlter rules.

Firewall: A component or set of components that restrict access between a protected network and the Internet,

or between two networks.

Host: A workstation on the network.

Packet: Unit of communication on the Internet.

Packet ﬁlter: Packet ﬁlters allow or deny packets based on source or destination IP addresses, TCP or UDP

ports, or the TCP ACK bit.

Port: A number that deﬁnes a particular type of service.

Basic IP packet components

All IP packets contain the same basic header information, as follows:

Source IP Address

Destination IP Address

Source Port

Destination Port

Protocol

163.176.132.18

163.176.4.27

2541

TCP

ACK Bit

Yes

DATA

User Data

This header information is what the packet ﬁlter uses to make ﬁltering decisions. It is important to note that a

packet ﬁlter does not look into the IP data stream (the User Data from above) to make ﬁltering decisions.

Basic protocol types

TCP: Transmission Control Protocol. TCP provides reliable packet delivery and has a retransmission

mechanism (so packets are not lost). RFC 793 is the speciﬁcation for TCP.

UDP: User Datagram Protocol. Unlike TCP, UDP does not guarantee reliable, sequenced packet delivery. If data

does not reach its destination, UDP does not retransmit the data. RFC 768 is the speciﬁcation for UDP.

There are many more ports deﬁned in the Assigned Addresses RFC. The table that follows shows some of these

port assignments.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-38 Firmware User Guide

Example TCP/UDP Ports

TCP Port

Service

FTP

UDP Port

161

Service

SNMP

20/21

Telnet

SMTP

WWW

News

TFTP

387

AURP

144

Firewall design rules

There are two basic rules to ﬁrewall design:

■

“What is not explicitly allowed is denied.”

and

■

“What is not explicitly denied is allowed.”

The ﬁrst rule is far more secure, and is the best approach to ﬁrewall design. It is far easier (and more secure)

to allow in or out only certain services and deny anything else. If the other rule is used, you would have to ﬁgure

out everything that you want to disallow, now and in the future.

Firewall Logic

Firewall design is a test of logic, and ﬁlter rule ordering is critical. If a packet is forwarded through a series of

ﬁlter rules and then the packet matches a rule, the appropriate action is taken. The packet will not forward

through the remainder of the ﬁlter rules.

For example, if you had the following ﬁlter set...

Allow WWW access;

Allow FTP access;

Allow SMTP access;

Deny all other packets.

and a packet goes through these rules destined for FTP, the packet would forward through the ﬁrst rule (WWW),

go through the second rule (FTP), and match this rule; the packet is allowed through.

If you had this ﬁlter set for example....

Allow WWW access;

Allow FTP access;

Deny FTP access;

Deny all other packets.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-39

and a packet goes through these rules destined for FTP, the packet would forward through the ﬁrst ﬁlter rule

(WWW), match the second rule (FTP), and the packet is allowed through. Even though the next rule is to deny all

FTP trafﬁc, the FTP packet will never make it to this rule.

Binary representation

It is easiest when doing ﬁltering to convert the IP address and mask in question to binary. This will allow you to

perform the logical AND to determine whether a packet matches a ﬁlter rule.

Logical AND function

When a packet is compared (in most cases) a logical AND function is performed. First the IP addresses and

subnet masks are converted to binary and then combined with AND. The rules for the logical use of AND are as

follows:

0 AND 0 = 0

0 AND 1 = 0

1 AND 0 = 0

1 AND 1 = 1

For example:

Filter rule:

Deny

IP: 163.176.1.15

Mask: 255.255.255.255 BINARY:

Incoming Packet:

IP 163.176.1.15

BINARY:

10100011.10110000.00000001.00001111

11111111.11111111.11111111.11111111

BINARY:

10100011.10110000.00000001.00001111

If you put the incoming packet and subnet mask together with AND, the result is:

10100011.10110000.00000001.00001111

which matches the IP address in the ﬁlter rule and the packet is denied.

Implied rules

With a given set of ﬁlter rules, there is an Implied rule that may or may not be shown to the user. The implied

rule tells the ﬁlter set what to do with a packet that does not match any of the ﬁlter rules. An example of implied

rules is as follows:

Implied

Meaning

Y+Y+Y=N

N+N+N=Y

Y+N+Y=N

If all ﬁlter rules are YES, the implied rule is NO.

If all ﬁlter rules are NO, the implied rule is YES.

If a mix of YES and NO ﬁlters, the implied rule is NO.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-40 Firmware User Guide

Established connections

The TCP header contains one bit called the ACK bit (or TCP Ack bit). This ACK bit appears only with TCP, not

UDP. The ACK bit is part of the TCP mechanism that guarantees the delivery of data. The ACK bit is set

whenever one side of a connection has received data from the other side. Only the ﬁrst TCP packet will not have

the ACK bit set; once the TCP connection is in place, the remainder of the TCP packets with have the ACK bit

set.

The ACK bit is helpful for ﬁrewall design and reduces the number of potential ﬁlter rules. A ﬁlter rule could be

created just allowing incoming TCP packets with the ACK bit set, since these packets had to be originated from

the local network.

Example ﬁlter set screen

This is an example of the Netopia ﬁlter set screen:

Change Input Filter 1

Enabled:

Forward:

Yes

Source IP Address:

0.0.0.0

Source IP Address Mask:

Dest. IP Address:

0.0.0.0

Dest. IP Address Mask:

Protocol Type:

TCP

Source Port Compare...

Source Port ID:

No Compare

Dest. Port Compare...

Dest. Port ID:

Equal

2000

Established TCP Conns. Only:

Filter basics

In the source or destination IP address ﬁelds, the IP address that is entered must be the network address of

the subnet. A host address can be entered, but the applied subnet mask must be 32 bits (255.255.255.255).

The Netopia Firmware Version 5.4 has the ability to compare source and destination TCP or UDP ports. These

options are as follows:

Item

What it means

No Compare

Not Equal To

Less Than

Does not compare TCP or UDP port

Matches any port other than what is deﬁned

Anything less than the port deﬁned

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-41

Less Than or Equal

Equal

Any port less than or equal to the port deﬁned

Matches only the port deﬁned

Greater Than or Equal Matches the port or any port greater

Greater Than Matches anything greater than the port deﬁned

Example network

Input Packet

Filter

Internet

Data

IP 200.1.1.??

Example ﬁlters

Example 1

Filter Rule:

200.1.1.0

(Source IP Network Address)

(Source IP Mask)

255.255.255.128

Forward = No

(What happens on match)

Incoming packet has the source address of 200.1.1.28

IP Address

Binary Representation

200.1.1.28

AND

255.255.255.128 10000000

00011100

(Source address in incoming IP packet)

(Perform the logical AND)

Download from Www.Somanuals.com. All Manuals Search And Download.

10-42 Firmware User Guide

00000000

(Logical AND result)

This incoming IP packet has a source IP address that matches the network address in the Source IP Address

ﬁeld (00000000) in the Netopia Firmware Version 5.4. This will not forward this packet.

Example 2

Filter Rule:

200.1.1.0

(Source IP Network Address)

(Source IP Mask)

255.255.255.128

Forward = No

(What happens on match)

Incoming packet has the source address of 200.1.1.184.

IP Address

Binary Representation

200.1.1.184

AND

10111000

(Source address in incoming IP packet)

255.255.255.128 10000000

10000000

(Perform the logical AND)

(Logical AND result)

This incoming IP packet (10000000) has a source IP address that does not match the network address in the

Source IP Address ﬁeld (00000000) in the Netopia Firmware Version 5.4. This rule will forward this packet

because the packet does not match.

Example 3

Filter Rule:

200.1.1.96

(Source IP Network Address)

(Source IP Mask)

255.255.255.240

Forward = No

(What happens on match)

Incoming packet has the source address of 200.1.1.184.

IP Address

Binary Representation

200.1.1.184

AND

10111000

(Source address in incoming IP packet)

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-43

255.255.255.240 11110000

10110000

(Perform the logical AND)

(Logical AND result)

Since the Source IP Network Address in the Router is 01100000, and the source IP address after the logical

AND is 1011000, this rule does not match and this packet will be forwarded.

Example 4

Filter Rule:

200.1.1.96

(Source IP Network Address)

(Source IP Mask)

255.255.255.240

Forward = No

(What happens on match)

Incoming packet has the source address of 200.1.1.104.

IP Address

Binary Representation

200.1.1.104

AND

01101000

(Source address in incoming IP packet)

255.255.255.240 11110000

01100000

(Perform the logical AND)

(Logical AND result)

Since the Source IP Network Address in the Router is 01100000, and the source IP address after the logical

AND is 01100000, this rule does match and this packet will not be forwarded.

Example 5

Filter Rule:

200.1.1.96

(Source IP Network Address)

(Source IP Mask)

255.255.255.255

Forward = No

(What happens on match)

Incoming packet has the source address of 200.1.1.96.

IP Address

Binary Representation

200.1.1.96

AND

01100000

(Source address in incoming IP packet)

Download from Www.Somanuals.com. All Manuals Search And Download.

10-44 Firmware User Guide

255.255.255.255 11111111

01100000

(Perform the logical AND)

(Logical AND result)

Since the Source IP Network Address in the Router is 01100000, and the source IP address after the logical

AND is 01100000, this rule does match and this packet will not be forwarded. This rule masks off a single IP

address.

Conﬁguration Management

Netopia Firmware Version 5.4 offers a Conﬁguration Management feature. Conﬁguration Management provides

a way to store several router conﬁgurations in a single device for use at different times. This feature is

supported on all models that support the version 5.4 ﬁrmware except the 4752 IAD.

You can store up to three conﬁgurations in the router’s memory in addition to the currently running

conﬁguration. The current conﬁguration is the one currently booted from and is updated whenever there is a

change to the router (logged events, parameter changes).

Other conﬁgurations are stored along with the current conﬁguration. Whenever you choose, you can reboot into

one of these conﬁgurations (the copy of which becomes the current conﬁguration).

You name the saved conﬁgurations, giving you a reference for identifying each one. The naming operation

occurs when you decide to save a conﬁguration or when downloading a conﬁguration via TFTP or X-Modem.

The conﬁgurations that are saved will persist across a Factory Default (soft or NMI). The router will reboot with

a Factory Defaulted conﬁguration, as usual, but the saved conﬁgurations are still available for use.

You save your conﬁgurations in the Conﬁguration Management screen in the Security menus.

Security Options

Enable Telnet Console Access:

Yes

Enable Telnet Access to SNMP Screens:

Console Access timeout (seconds):

Superuser Configuration...

600

Advanced Security Options...

Configuration Management...

Return/Enter accepts * Tab toggles * ESC cancels.

Select Conﬁguration Management, and press Return. The Conﬁguration Management screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-45

Configuration Management

Save Current Configuration as...

Replace Existing Conifiguration...

Boot from a Configuration...

Delete a Configuration...

Select Save Current Conﬁguration as, and press Return. The Save Current Conﬁguration screen appears.

Save Current Configuration

Configuration Name:

HappyInternet

SAVE

CANCEL

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes.

Enter a descriptive name for your current conﬁguration, select SAVE, and press Return. Your conﬁguration will

be saved to the ﬂash memory, and you will be returned to the Conﬁguration Management screen.

If you choose to run one of your stored conﬁgurations, you can select it from a pop-up menu. If you select Boot

from a Conﬁguration and select a different one, you can reboot the router with your selected conﬁguration.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-46 Firmware User Guide

Configuration Management

Save Current Configuration as... +-Configuration Name---Type---+

Replace Existing Configuration... +-----------------------------+

Boot from a Configuration...

Delete a Configuration...

| Backup Config

| HappyInternet

Binary |

+-----------------------------+

A warning screen will ask you to conﬁrm your choice.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-47

TFTP and X-Modem

You can also send or receive your stored conﬁguration ﬁles via TFTP or X-Modem. You select the stored

conﬁguration ﬁles from pull-down menus in the TFTP or X-Modem File Transfer screens in the Utilities &

Diagnostics menu, as shown.

TFTP

Trivial File Transfer Protocol (TFTP)

TFTP Server Name:

Firmware File Name:

GET ROUTER FIRMWARE FROM SERVER...

Config File Name:

+-----------------------+

| Current Configuration |

Get Configuration Destination...

GET CONFIG FROM SERVER...

| Backup Config

| HappyInternet

| <Empty> Type Name

Send Configuration...

SEND CONFIG TO SERVER...

+-----------------------+

TFTP Transfer State -- Idle

TFTP Current Transfer Bytes -- 0

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

X-Modem

X-Modem File Transfer

Send Firmware to Netopia...

+-----------------------+

| Current Configuration |

Get Configuration Destination...

Send Config to Netopia...

| Backup Config

| HappyInternet

| <Empty> Type Name

Send Configuration...

Receive Config from Netopia...

+-----------------------+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-48 Firmware User Guide

Call Filtering

Netopia Firmware Version 5.4 supports a call ﬁltering mechanism that lets you control which packets cause

connections to be established and which packets cause connections to be maintained (that is, to not time out

due to inactivity). This feature is part of the Filter Set management component of the ﬁrmware. Call ﬁltering

makes use of the existing sets of ﬁlter rules that can be associated with a connection.

The term connection includes both non-VPN connection proﬁles for which the remote network is reached

through a switched WAN interface, such as Analog or ISDN, and all VPN connection proﬁles, such as ATMP,

PPTP, and IPsec.

The call ﬁltering mechanism is useful if you have a time-limited type of connection. Such a connection may time

out during a period of inactivity and may you want it to be re-established or maintained automatically for certain

types of trafﬁc.

You manage Filters and Filter Sets in the Filter Sets management screen under the System Conﬁguration

menus.

Main

System Configuration

Filter Sets

The Add Output Filter menu appears as follows:

Add Output Filter

Enabled:

Forward:

Yes

Source IP Address:

0.0.0.0

Source IP Address Mask:

Dest. IP Address:

0.0.0.0

Dest. IP Address Mask:

Protocol Type:

ANY

ADD THIS FILTER NOW

CANCEL

Return/Enter accepts * Tab toggles * ESC cancels.

Enter the packet specific information for this filter.

When you add (or change) an output ﬁlter, and toggle Forward to Yes, a new Call Placement/Idle Reset pop-up

menu becomes visible.

Download from Www.Somanuals.com. All Manuals Search And Download.

Security 10-49

Add Output Filter

Enabled:

+-----------+

Forward:

+-----------+

| No Change |

| Disabled |

+-----------+

0.0.0.0

Call Placement/Idle Reset:

Source IP Address:

Source IP Address Mask:

0.0.0.0

Dest. IP Address:

0.0.0.0

Dest. IP Address Mask:

Protocol Type:

ANY

ADD THIS FILTER NOW

CANCEL

This pop-up menu allows you to conﬁgure what action will be taken for packets that the ﬁlter rule speciﬁes

should be forwarded.

■

If you set Call Placement/Idle Reset to No Change (the default), no change will be made to the call

ﬁltering attribute associated with the packet. If no other ﬁlter rule with its Call Placement/Idle Reset pop-up

set to Disabled previously has been or subsequently will be applied to the packet, the packet will be

forwarded as usual. No special action will be taken.

If the connection is up, the connection’s idle timer will be refreshed and the packet forwarded as usual. If

the connection is down, the packet is queued until a connection is established.

■

If you set the Call Placement/Idle Reset to Disabled, the call ﬁltering attribute associated with the packet

will be set such that the packet will be dropped if the connection is down, and forwarded without resetting

the idle timer if the connection is up.

Download from Www.Somanuals.com. All Manuals Search And Download.

10-50 Firmware User Guide

Download from Www.Somanuals.com. All Manuals Search And Download.

Utilities and Diagnostics 11-1

Chapter 11

Utilities and Diagnostics

A number of utilities and tests are available for system diagnostic and control purposes.

This section covers the following topics:

■

“Ping” on page 11-2

“Trace Route” on page 11-4

“Telnet Client” on page 11-5

“Factory Defaults” on page 11-6

“Transferring Conﬁguration and Firmware Files with TFTP” on page 11-6

“Transferring Conﬁguration and Firmware Files with XMODEM” on page 11-9

“Restarting the System” on page 11-12

“T1 Line Statistics and Diagnostics” on page 11-12

Note: These utilities and tests are accessible only through the console-based management screens. See the

Getting Started Guide chapter, “Console-Based Management,” for information on accessing the console-based

management screens.

You access the Utilities & Diagnostics screens from the Main Menu.

Utilities & Diagnostics

Ping...

Trace Route...

Telnet...

Trivial File Transfer Protocol (TFTP)...

X-Modem File Transfer...

Restart System...

Revert to Factory Defaults...

Download from Www.Somanuals.com. All Manuals Search And Download.

11-2 Firmware User Guide

Ping

The Netopia Firmware Version 5.4 Router includes a standard Ping test utility. A Ping test generates IP packets

destined for a particular (Ping-capable) IP host. Each time the target host receives a Ping packet, it returns a

packet to the original sender.

Ping allows you to see whether a particular IP destination is reachable from the Router. You can also ascertain

the quality and reliability of the connection to the desired destination by studying the Ping test’s statistics.

In the Utilities & Diagnostic screen, select Ping and press Return. The ICMP Ping screen appears.

ICMP Ping

Name of Host to Ping:

Packets to Send:

Data Size:

Delay (seconds):

START PING

Status:

Packets Out:

Packets In:

Packets Lost:

Round Trip Time

(Min/Max/Avg):

0 (0%)

0.000 / 0.000 / 0.000 secs

Enter the IP Address/Domain Name of a host to ping.

Send ICMP Echo Requests to a network host.

To conﬁgure and initiate a Ping test, follow these steps:

1. Select Name of Host to Ping and enter the destination domain name or IP address.

2. Select Packets to Send to change the default setting. This is the total number of packets to be sent during

the Ping test. The default setting is adequate in most cases, but you can change it to any value from 1 to

4,294,967,295.

3. Select Data Size to change the default setting. This is the size, in bytes, of each Ping packet sent. The

default setting is adequate in most cases, but you can change it to any value from 0 (only header data) to

1664.

4. Select Delay (seconds) to change the default setting. The delay, in seconds, determines the time between

Ping packets sent. The default setting is adequate in most cases, but you can change it to any value from

0 to 4,294,967. A delay of 0 seconds forces packets to be sent immediately, one after another.

5. Select START PING and press Return to begin the Ping test. While the test is running, the START PING

item becomes STOP PING. To manually stop the Ping test, select STOP PING and press Return or Escape.

While the Ping test is running and when it is over, a status ﬁeld and a number of statistical items are active on

the screen. These are described below.

Download from Www.Somanuals.com. All Manuals Search And Download.

Utilities and Diagnostics 11-3

Status: The current status of the Ping test. This item can display the status messages shown in the able below:

Message

Description

Resolving host name

Can’t resolve host name

Pinging

Finding the IP address for the domain name-style address

IP address can’t be found for the domain name–style address

Ping test is in progress

Complete

Ping test was completed

Cancelled by user

Ping test was cancelled manually

Destination unreachable from

w.x.y.z

Ping test was able to reach the router with IP address w.x.y.z,

which reported that the test could not reach the ﬁnal

destination

Couldn’t allocate packet buffer

Couldn’t open ICMP port

Couldn’t proceed with Ping test; try again or reset system

Packets Out: The number of packets sent by the Ping test.

Packets In: The number of return packets received from the target host. To be considered on time, return

packets are expected back before the next packet in the sequence of Ping packets is sent. A count of the

number of late packets appears in parentheses to the right of the Packets In count.

In the example that follows, a Router is sending Ping packets to another host, which responds with return Ping

packets. Note that the second return Ping packet is considered to be late because it is not received by the

Router before the third Ping packet is sent. The ﬁrst and third return Ping packets are on time.

time

send Ping packet 1

Netopia

receive Ping packet 1

host

send return Ping packet 1

receive return Ping packet 1

Netopia

send Ping packet 2

receive Ping packet 2

send return Ping packet 2

host

send Ping packet 3

Netopia

receive return Ping packet 2

receive Ping packet 3

host

send return Ping packet 3

receive return Ping packet 3

Netopia

Download from Www.Somanuals.com. All Manuals Search And Download.

11-4 Firmware User Guide

Packets Lost: The number of packets unaccounted for, shown in total and as a percentage of total packets

sent. This statistic may be updated during the Ping test, and may not be accurate until after the test is over.

However, if an escalating one-to-one correspondence is seen between Packets Out and Packets Lost, and

Packets In is noticeably lagging behind Packets Out, the destination is probably unreachable. In this case, use

STOP PING.

Round Trip Time (Min/Max/Avg): Statistics showing the minimum, maximum, and average number of

seconds elapsing between the time each Ping packet was sent and the time its corresponding return Ping

packet was received.

The time-to-live (TTL) value for each Ping packet sent by the Router is 255, the maximum allowed. The TTL value

deﬁnes the number of IP routers that the packet can traverse. Ping packets that reach their TTL value are

dropped, and a “destination unreachable” notiﬁcation is returned to the sender (see the table on the previous

page). This ensures that no inﬁnite routing loops occur. The TTL value can be set and retrieved using the SNMP

MIB-II ip group’s ipDefaultTTL object.

Trace Route

You can count the number of routers between your Netopia Router and a given destination with the Trace Route

utility.

In the Statistics & Diagnostics screen, select Trace Route and press Return. The Trace Route screen appears.

Trace Route

Host Name or IP Address:

Maximum Hops:

Timeout (seconds):

Use Reverse DNS:

Yes

START TRACE ROUTE

Enter the IP Address/Domain Name of a host.

Trace route to a network host.

To trace a route, follow these steps:

1. Select Host Name or IP Address and enter the name or address of the destination you want to trace.

2. Select Maximum Hops to set the maximum number of routers to count between the Netopia Router and

the destination router, up to the maximum of 64. The default is 30 hops.

Download from Www.Somanuals.com. All Manuals Search And Download.

Utilities and Diagnostics 11-5

3. Select Timeout (seconds) to set when the trace will timeout for each hop, up to 10 seconds. The default is

3 seconds.

4. Select Use Reverse DNS to learn the names of the routers between the Netopia Router and the destination

router. The default is Yes.

5. Select START TRACE ROUTE and press Return. A scrolling screen will appear that lists the destination,

number of hops, IP addresses of each hop, and DNS names, if selected.

6. Cancel the trace by pressing Escape. Return to the Trace Route screen by pressing Escape twice.

Telnet Client

The Telnet client mode replaces the normal menu mode. Telnet sessions can be cascaded, that is, you can

initiate a Telnet client session when using a Telnet console session. To activate the Telnet client, select Telnet

from the Utilities & Diagnostics menu.

The Telnet client screen appears.

Telnet

Host Name or IP Address:

Control Character to Suspend:

START A TELNET SESSION

Resume Suspended Session...

Terminate Suspended Session...

■

Enter the host name or the IP address in dotted decimal format of the machine you want to Telnet into and

press Return.

■

Either accept the default control character “Q” used to suspend the Telnet session, or type a different one.

START A TELNET SESSION becomes highlighted.

Press Return and the Telnet session will be initiated.

To suspend the session, press Control-Q or whatever other control character you speciﬁed.

To go back to your Telnet session, select Resume Suspended Session. Select a session from the pop-up

Download from Www.Somanuals.com. All Manuals Search And Download.

11-6 Firmware User Guide

menu and press Return.

■

To end a suspended session, select Terminate Suspended Session. Select a session from the pop-up

menu and press Return.

Factory Defaults

You can reset the Router to its factory default settings. In the Utilities & Diagnostics screen, select Revert to

Factory Defaults and press Return. Select CONTINUE in the dialog box and press Return. The Router will

reboot and its settings will return to the factory defaults, deleting your conﬁgurations.

In an emergency, you can also use the Reset switch to return the router to its factory default settings. Call

Netopia Technical Support for instructions on using the Reset switch.

Note: Reset to factory defaults with caution. You will need to reconﬁgure all of your settings in the router.

If you lose your password and are unable to access the console screens, you can manually reset the router in

an emergency. See Appendix A, “Troubleshooting.”

Transferring Conﬁguration and Firmware Files with TFTP

Trivial File Transfer Protocol (TFTP) is a method of transferring data over an IP network. TFTP is a client-server

application, with the router as the client. To use the Router as a TFTP client, a TFTP server must be available.

Netopia, Inc., has a public access TFTP server on the Internet where you can obtain the latest ﬁrmware

versions.

To use TFTP, select Trivial File Transfer Protocol (TFTP) in the Statistics & Diagnostics screen and press

Return. The Trivial File Transfer Protocol (TFTP) screen appears.

Download from Www.Somanuals.com. All Manuals Search And Download.

Utilities and Diagnostics 11-7

Trivial File Transfer Protocol (TFTP)

TFTP Server Name:

Firmware File Name:

GET ROUTER FIRMWARE FROM SERVER...

Config File Name:

GET CONFIG FROM SERVER...

SEND CONFIG TO SERVER...

TFTP Transfer State -- Idle

TFTP Current Transfer Bytes -- 0

The sections below describe how to update the Router’s ﬁrmware and how to download and upload

conﬁguration ﬁles.

Updating ﬁrmware

Firmware updates may be available periodically from Netopia or from a site maintained by your organization’s

network administrator.

The Router ships with an embedded operating system referred to as ﬁrmware. The ﬁrmware governs how the

device communicates with your network and the WAN or remote site. Firmware updates are periodically posted

on the Netopia website.

To update the router’s ﬁrmware, follow these steps:

■

Select TFTP Server Name and enter the server name or IP address of the TFTP server you will use. The

server name or IP address is available from the site where the server is located.

Select Firmware File Name and enter the name of the ﬁle you will download. The name of the ﬁle is

available from the site where the server is located. You may need to enter a ﬁle path along with the ﬁle

name (for example, bigroot/conﬁg/myﬁle).

Download from Www.Somanuals.com. All Manuals Search And Download.

11-8 Firmware User Guide

■

Select GET ROUTER FIRMWARE FROM SERVER and press Return. You will see the following dialog box:

+--------------------------------------------------------------------+

| Are you sure you want to send a firmware file to your Netopia?

| The device will restart when the transfer is complete.

CANCEL

CONTINUE

+--------------------------------------------------------------------+

■

Select CANCEL to exit without downloading the ﬁle, or select CONTINUE to download the ﬁle. The system

will reset at the end of the ﬁle transfer to put the new ﬁrmware into effect. While the system resets, the

LEDs will blink on and off.

Caution!

■

Be sure the ﬁrmware update you load onto your router is the correct version for your particular model.

Some models do not support all ﬁrmware versions. Loading an incorrect ﬁrmware version can permanently

damage the unit.

■

Do not manually power down or reset the Router while it is automatically resetting or it could be damaged.

If you choose to download the ﬁrmware, the TFTP Transfer State item will change from Idle to Reading

Firmware. The TFTP Current Transfer Bytes item will reﬂect the number of bytes transferred.

Downloading conﬁguration ﬁles

The Router can be conﬁgured by downloading a conﬁguration ﬁle using TFTP. Once downloaded, the ﬁle

reconﬁgures all of the router’s parameters as if someone had manually done so through the console port.

To download a conﬁguration ﬁle, follow these steps:

■

Select TFTP Server Name and enter the server name or IP address of the TFTP server you will use. The

server name or IP address is available from the site where the server is located.

Select Conﬁg File Name and enter the name of the ﬁle you will download. The name of the ﬁle is available

from the site where the server is located. You may need to enter a ﬁle path along with the ﬁle name (for

example, bigroot/conﬁg/myﬁle).

■

Select GET CONFIG FROM SERVER and press Return. You will see the following dialog box:

+----------------------------------------------------------------------+

| Are you sure you want to send a saved configuration to your Netopia? |

CANCEL

CONTINUE

+----------------------------------------------------------------------+

■

Select CANCEL to exit without downloading the ﬁle, or select CONTINUE to download the ﬁle. The system

will reset at the end of the ﬁle transfer to put the new conﬁguration into effect.

Download from Www.Somanuals.com. All Manuals Search And Download.

Utilities and Diagnostics 11-9

■

If you choose to download the conﬁguration ﬁle, the TFTP Transfer State item will change from Idle to

Reading Conﬁg . The TFTP Current Transfer Bytes item will reﬂect the number of bytes transferred.

Uploading conﬁguration ﬁles

Using TFTP, you can send a ﬁle containing a snapshot of the router’s current conﬁguration to a TFTP server. The

ﬁle can then be downloaded by a different Router unit to conﬁgure its parameters (see “Downloading

conﬁguration ﬁles” on page 11-8). This is useful for conﬁguring a number of routers with identical parameters or

just for creating conﬁguration backup ﬁles.

Uploading a ﬁle can also be useful for troubleshooting purposes. The uploaded conﬁguration ﬁle can be tested

on a different Router unit by Netopia or your network administrator.

To upload a conﬁguration ﬁle, follow these steps:

1. Select TFTP Server Name and enter the server name or IP address of the TFTP server you will use. The

server name or IP address is available from the site where the server is located.

2. Select Conﬁg File Name and enter a name for the ﬁle you will upload. The ﬁle will appear with the name you

choose on the TFTP server. You may need to enter a ﬁle path along with the ﬁle name (for example,

Mypc/Netopia/myﬁle).

3. Select SEND CONFIG TO SERVER and press Return. Netopia will begin to transfer the ﬁle.

4. The TFTP Transfer State item will change from Idle to Writing Conﬁg. The TFTP Current Transfer Bytes

item will reﬂect the number of bytes transferred.

Transferring Conﬁguration and Firmware Files with

XMODEM

You can transfer conﬁguration and ﬁrmware ﬁles with XMODEM through the Router’s console port, if available

on your model. Be sure your terminal emulation program supports XMODEM ﬁle transfers.

To go to the X-Modem File Transfer screen, select it in the Utilities & Diagnostics menu.

Note: The X-Modem File Transfer screen is only available if you are connected via the Console port.

Note: It is good practice when updating programmable devices to disable any other programs or network

activity on the device or the attached computer. This includes WAN trafﬁc such as a DSL connection or screen

savers or other automatic programs running on the attached computer. Such activity can slow down or interrupt

the ﬁle transfer requiring you to rerun the upgrade.

Download from Www.Somanuals.com. All Manuals Search And Download.

11-10 Firmware User Guide

X-Modem File Transfer

Send Firmware to Netopia...

Get Configuration Destination... Current Configuration

Send Config to Netopia...

Send Configuration...

Current Configuration

Receive Config from Netopia...

Updating ﬁrmware

Firmware updates may be available periodically from Netopia or from a site maintained by your organization’s

network administration.

Follow these steps to update the Router’s ﬁrmware:

1. Make sure you have the ﬁrmware ﬁle on disk and know the path to its location.

2. Select Send Firmware to Netopia and press Return. The following dialog box appears:

+--------------------------------------------------------------------+

| Are you sure you want to send a firmware file to your Netopia?

| If so, when you hit Return/Enter on the CONTINUE button, you will |

| have 10 seconds to begin the transfer from your terminal program. |

CANCEL

CONTINUE

+--------------------------------------------------------------------+

3. Select CANCEL to exit without downloading the ﬁle, or select CONTINUE to download the ﬁle.

If you choose CONTINUE, you will have ten seconds to use your terminal emulation software to initiate an

XMODEM transfer of the ﬁrmware ﬁle. If you fail to initiate the transfer in that time, the dialog box will

disappear and the terminal emulation software will inform you of the transfer’s failure. You can then try

again.

The system will reset at the end of a successful ﬁle transfer to put the new ﬁrmware into effect. While the

system resets, the LEDs will blink on and off.

Download from Www.Somanuals.com. All Manuals Search And Download.

Utilities and Diagnostics 11-11

Caution!

Do not manually power down or reset the Router while it is automatically resetting or it could be damaged.

Downloading conﬁguration ﬁles

The Router can be conﬁgured by downloading a conﬁguration ﬁle. The downloaded ﬁle reconﬁgures all of the

Router’s parameters.

Conﬁguration ﬁles are available from a site maintained by your organization’s network administrator or from

your local site (see “Uploading conﬁguration ﬁles,” below).

Follow these steps to download a conﬁguration ﬁle:

1. Make sure you have the conﬁguration ﬁle on disk and know the path to its location.

2. Select Send Conﬁg to Netopia and press Return. The following dialog box appears:

+----------------------------------------------------------------------+

| Are you sure you want to send a saved configuration to your Netopia? |

| If so, when you hit Return/Enter on the CONTINUE button, you will

| have 10 seconds to begin the transfer from your terminal program.

CANCEL

CONTINUE

+----------------------------------------------------------------------+

3. Select CANCEL to exit without downloading the ﬁle, or select CONTINUE to download the ﬁle.

If you choose CONTINUE, you will have ten seconds to use your terminal emulation software to initiate an

XMODEM transfer of the conﬁguration ﬁle. If you fail to initiate the transfer in that time, the dialog box will

disappear and the terminal emulation software will inform you of the transfer’s failure. You can then try

again.

The system will reset at the end of a successful ﬁle transfer to put the new conﬁguration into effect.

Uploading conﬁguration ﬁles

A ﬁle containing a snapshot of the Router’s current conﬁguration can be uploaded from the router to disk. The

ﬁle can then be downloaded by a different Router to conﬁgure its parameters (see “Downloading conﬁguration

ﬁles,” above). This is useful for conﬁguring a number of routers with identical parameters or for creating

conﬁguration backup ﬁles.

Uploading a ﬁle can also be useful for troubleshooting purposes. The uploaded conﬁguration ﬁle can be tested

on a different Router by Netopia or your network administrator.

The procedure below applies whether you are using the console or the WAN interface. To upload a conﬁguration

ﬁle:

1. Decide on a name for the ﬁle and a path for saving it.

2. Select Receive Conﬁg from Netopia and press Return. The following dialog box appears:

Download from Www.Somanuals.com. All Manuals Search And Download.

11-12 Firmware User Guide

+--------------------------------------------------------------------+

| Are you sure you want to save your current Netopia configuration? |

| If so, when you hit Return/Enter on the CONTINUE button, you will |

| have 10 seconds to begin the transfer from your terminal program. |

CANCEL

CONTINUE

+--------------------------------------------------------------------+

3. Select CANCEL to exit without uploading the ﬁle, or select CONTINUE to upload the ﬁle.

If you choose CONTINUE, you will have ten seconds to use your terminal emulation software to initiate an

XMODEM transfer of the conﬁguration ﬁle. If you fail to initiate the transfer in that time, the dialog box will

disappear and the terminal emulation software will inform you of the transfer’s failure. You can then try

again.

Restarting the System

You can restart the system by selecting the Restart System item in the Utilities & Diagnostics screen.

You must restart the system whenever you reconﬁgure the Router and want the new parameter values to take

effect. Under certain circumstances, restarting the system may also clear up system or network malfunctions.

Some conﬁguration processes automatically restart the system to apply the changes you have made.

T1 Line Statistics and Diagnostics

For T1 models the Utilities and Diagnostics menu includes an option for displaying T1 line statistics.

You access the Utilities and Diagnostics menu from the Main Menu.

Main

T1 Line Statistics/

Diagnostics

Utilities & Diagnostics

Download from Www.Somanuals.com. All Manuals Search And Download.

Utilities and Diagnostics 11-13

Utilities & Diagnostics

Ping...

Trace Route...

Telnet...

Trivial File Transfer Protocol (TFTP)...

X-Modem File Transfer...

Restart System...

Revert to Factory Defaults...

T1 Line Statistics / Diagnostics...

Select T1 Line Statistics / Diagnostics and press Return.

The T1 Line Statistics / Diagnostics screen appears.

T1 Line Statistics / Diagnostics

--Condition------------------00:16---00:27---00:12----1:57----1:42---24 hours-

Errored Seconds

007

006

016

000

00000

Unavailable Seconds

Severely Errored Seconds

Bursty Errored Seconds

Loss of Frame Count

Bipolar Violation Count

+-------------------------+

| Normal - Clear Loopback |esent

| Send Blue Alarm -all 1s |

| Remote Payload Loopback |

| Local Payload Loopback |

| Loopback Pattern Test |

+-------------------------+

Line Status:

Loopback Status:

Tests...

The screen displays the current condition of tests that you run. The counters display the occurrences of the

indicated events in ﬁfteen-minute increments, shifting the totals to the column to the right after each ﬁfteen

minute cycle until the total is accumulated in the 24 hours column.

Condition: Displays the parameters tested.

Time columns: Current time (00:00) starts at zero and resets to zero at 15:00 minutes, shifting the counted

total to the next column to its right.

Download from Www.Somanuals.com. All Manuals Search And Download.

11-14 Firmware User Guide

24 hours: Cumulative statistics, for the preceding 24-hour period.

Line Status: Conditions may be Normal Operation, Red Alarm, Yellow Alarm, or (Rmt/Lcl) LoopBack

Loopback Status: Current loopback condition

Tests: Offers a pop-up menu with the following options:

■

Normal - Clear Loopback clears any local loopbacks and sends an ANSI PLB clear to the remote CSU. This

returns the Netopia Router to its normal state if any testing has been done and the router has been put

into a looped state. Select this option after running tests to return the router to a normal state so that it is

capable of passing trafﬁc as it should.

■

Send Blue Alarm -all 1s forces an error condition of all 1s; remote will send a yellow alarm if enabled. You

can use this pattern in two different ways. Once a remote router has been looped you can use it to verify

that you are receiving the same data that you are sending. For example, if you send all ones across the line

and get back a mixture of ones and zeroes, there is a problem. You can also use this test in a different

way. If you send all ones to a remote device, it should report that it is receiving all ones. This would verify

(without having to put up a loop) that data is reaching the destination intact. It does not verify bi-directional

integrity however, which is veriﬁed if you have the remote end in loop. This pattern is also for checking the

remote end's capability of reporting back a yellow alarm (usually something that is optionally enabled on

the remote CSU).

■

Remote Payload Loopback sends an ANSI BPM payload loopback request to the remote CSU. This pattern

tells the remote device (usually the CSU at the other end of the circuit) that it should go into a looped

state. Use this pattern for putting up a loop to do testing from a remote portion of the circuit, either by the

Telco or by the CPE at the remote end of the circuit. This test makes the remote CSU go into a looped state

so that any data you send it is returned to you. This is useful for determining if the remote CSU is receiving

data from the CPE. If it does not loop then you can conclude that it is not receiving any data from you.

■

Local Payload Loopback enables a local payload loopback. This pattern is similar to the Remote Payload

Loopback pattern except that it puts the local CSU into a looped state rather than the remote CSU. This is

useful if the remote side is not able to send a remote loop code to the router to put it into a looped state.

You can simply put it into loopback manually and see if that loop is reﬂected at the remote side.

Loopback Pattern Test sends continuous 1200 byte packets and compares incoming packets (similar to

ISDN loopback tests), counting good and bad packets. Twenty consecutive good packets are required to

PASS. The loopback testing screen is only visible when this test is selected. It sends a pseudo-random

sequence that is intended to simulate data so that you can check for errors on the circuit. This test

requires that the remote CSU be in a payload loopback condition. (It will partially work if the remote CSU is

in a LINE loopback condition as well, but this is less reliable.)

When you select one of these tests and press Return, the test runs and the screen provides feedback.

Download from Www.Somanuals.com. All Manuals Search And Download.

Troubleshooting A-1

Appendix A

Troubleshooting

This appendix is intended to help you troubleshoot problems you may encounter while setting up and using the

Netopia Firmware Version 5.4. It also includes information on how to contact Netopia Technical Support.

Important information on these problems can be found in the event histories kept by the Router. These event

histories can be accessed in the Statistics & Logs screen.

This section covers the following topics:

■

“Conﬁguration Problems” on page A-1

“How to Reset the Router to Factory Defaults” on page A-3

“Power Outages” on page A-3

“Technical Support” on page A-4

Conﬁguration Problems

If you encounter problems during your initial conﬁguration process, review the following suggestions before

calling for technical support. There are four zones to consider when troubleshooting initial conﬁguration:

1. The computer’s connection to the router

2. The router’s connection to the telecommunication line(s)

3. The telecommunication line’s connection to your ISP

4. The ISP’s connection to the Internet

If the connection from the computer to the router was not successful, verify that the following conditions are in

effect:

■

The Router is turned on.

An Ethernet cable connects your PC’s Ethernet card or built-in Ethernet port to the Router.

Telnet is available on your PC or Macintosh. (On a PC, it must be speciﬁed in your system path. You can

usually ﬁnd the application as “c:\windows\telnet.exe”.)

■

Your PC or Macintosh is properly conﬁgured for TCP/IP.

Your PC or Macintosh has an IP address.

Your PC or Macintosh has a subnet mask that matches or is compatible with the Router’s subnet mask.

Download from Www.Somanuals.com. All Manuals Search And Download.

A-2 Firmware User Guide

Note: If you are attempting to modify the IP address or subnet mask from a previous, successful

conﬁguration attempt, you will need to clear the IP address or reset your Router to the factory default before

reinitiating the conﬁguration process. For further information on resetting your Router to factory default, see

“How to Reset the Router to Factory Defaults” on page A-3.

Console connection problems

Can’t see the conﬁguration screens (nothing appears)

■

Make sure the cable connection from the Router’s console port to the computer being used as a console is

securely connected.

■

Make sure the terminal emulation software is accessing the correct port on the computer that’s being

used as a console.

■

Try pressing Ctrl-L or Return or the up or down arrow key several times to refresh the terminal screen.

Make sure that ﬂow control on serial connections is turned off.

Junk characters appear on the screen

■

Check that the terminal emulation software is conﬁgured correctly.

■

Check the baud rate. The default values are 9600, N, 8, and 1.

Characters are missing from some of the conﬁguration screens

■

Try changing the Router’s default speed of 9600 bps and setting your terminal emulation software to

match the new speed.

Network problems

Problems communicating with remote IP hosts

■

Verify the accuracy of the default gateway’s IP address (entered in the IP Setup or Easy Setup screen).

■

Use the Netopia Firmware Version 5.4’s Ping utility, in the Utilities & Diagnostics screen, and try to Ping

local and remote hosts. See “Ping” on page 11-2 for instructions on how to use the Ping utility. If you can

successfully Ping hosts using their IP addresses but not their domain names (198.34.7.1 but not

garcia.netopia.com, for example), verify that the DNS server’s IP address is correct and that it is reachable

from the Router (use Ping).

■

If you are using ﬁlters, check that your ﬁlter sets are not blocking the type of connections you are trying to

make.

Local routing problems

■

Observe the Ethernet LEDs to see if data trafﬁc ﬂow appears to be normal.

■

Check the WAN statistics and LAN statistics screens to see more speciﬁc information on data trafﬁc ﬂow

and address serving. See “Statistics & Logs” on page 9-4 for more information.

Download from Www.Somanuals.com. All Manuals Search And Download.

Troubleshooting A-3

How to Reset the Router to Factory Defaults

Lose your password? This section shows how to reset the router so that you can access the console screens

once again. Keep in mind that all of your connection proﬁles and settings will need to be reconﬁgured.

If you don't have a password, the only way to get back into the Router is the following:

1. Turn the router upside down.

2. Referring to the diagram below, ﬁnd the paper clip-size Reset Switch slot.

Reset Switch Slot

3. Carefully insert the larger end of a standard size paper clip until you contact the internal Reset Switch. (No

need to unwind the paper clip.)

4. Press this switch.

5. This will reset the unit to factory defaults and you will now be able to reprogram the router.

Power Outages

If you suspect that power was restored after a power outage and the Router is connected to a remote site, you

may need to switch the Router off and then back on again. After temporary power outages, a connection that

still seems to be up may actually be disconnected. Rebooting the router should reestablish the connection.

Download from Www.Somanuals.com. All Manuals Search And Download.

A-4 Firmware User Guide

Technical Support

Netopia, Inc. is committed to providing its customers with reliable products and documentation, backed by

excellent technical support.

Before contacting Netopia

Look in this guide for a solution to your problem. You may ﬁnd a solution in this troubleshooting appendix or in

other sections. Check the index for a reference to the topic of concern. If you cannot ﬁnd a solution, complete

the environment proﬁle below before contacting Netopia Technical Support.

Environment proﬁle

■

Locate the Router’s model number, product serial number, and ﬁrmware version. The serial number is on

the bottom of the router, along with the model number. The ﬁrmware version appears in the Netopia

Firmware Version 5.4’s Main Menu screen.

Model number:

Serial number:

Firmware version:

■

What kind of local network(s) do you have, with how many devices?

Ethernet

TCP/IP

How to reach us

We can help you with your problem more effectively if you have completed the environment proﬁle in the

previous section. If you contact us by telephone, please be ready to supply Netopia Technical Support with the

information you used to conﬁgure the Router. Also, please be at the site of the problem and prepared to

reproduce it and to try some troubleshooting steps.

When you are prepared, contact Netopia Technical Support by e-mail, telephone, or post:

Internet: [email protected] (for technical support)

[email protected] (for general information)

Phone: 1 510-597-5400

Netopia, Inc.

Customer Services

6001 Shellmound Street

Emeryville, California 94608

USA

Online product information

Product information can be found in the following:

Netopia World Wide Web server via http://www.netopia.com

Internet via anonymous FTP to ftp.netopia.com/pub

Download from Www.Somanuals.com. All Manuals Search And Download.

Understanding IP Addressing B-1

Appendix B

Understanding IP Addressing

This appendix is a brief general introduction to IP addressing. A basic understanding of IP will help you in

conﬁguring the Netopia Firmware Version 5.4 and using some of its powerful features, such as static routes

and packet ﬁltering.

This section covers the following topics:

■

“What is IP?” on page B-1

“About IP Addressing” on page B-1

“Distributing IP Addresses” on page B-5

“Nested IP Subnets” on page B-11

“Broadcasts” on page B-14

What is IP?

All networks use protocols to establish common standards for communication. One widely used network

protocol is the Internet Protocol, also known as IP. Like many other protocols, IP uses packets, or formatted

chunks of data, to communicate. In packets, a header is part of the envelope information that surrounds the

actual data being transmitted. In e-mail, a header is usually the address and routing information found at the

top of messages.

Note: This guide uses the term “IP” in a very general and inclusive way to identify all of the following:

■

Networks that use the Internet Protocol, along with accompanying protocols such as TCP, UDP, and

ICMP

■

Packets that include an IP header within their structure

Devices that send IP packets

About IP Addressing

Every networking protocol uses some form of addressing in order to ensure that packets are delivered correctly.

In IP, individual network devices that are initial sources and ﬁnal destinations of packets are usually called

hosts instead of nodes, but the two terms are interchangeable. Each host on an IP network must have a unique

IP address. An IP address, also called an Internet address, is a 32-bit number usually expressed as four

decimal numbers separated by periods. Each decimal number in an IP address represents a 1-byte (8-bit) binary

number. Thus, values for each of the four numbers range from 00000000 to 11111111 in binary notation, or

from 0 to 255 in decimal notation. The expression 192.168.1.1 is a typical example of an IP address.

Download from Www.Somanuals.com. All Manuals Search And Download.

B-2 Firmware User Guide

IP addresses indicate both the identity of the network and the identity of the individual host on the network. The

number of bits used for the network number and the number of bits used for the host number can vary, as long

as certain rules are followed. The local network manager assigns IP host numbers to individual machines.

IP addresses are maintained and assigned by the InterNIC, a quasi-governmental organization now increasingly

under the auspices of private industry.

Note: It’s very common for an organization to obtain an IP address from a third party, usually an Internet

service provider (ISP). ISPs usually issue an IP address when they are contracted to provide Internet access

services.

The InterNIC (the NIC stands for Network Information Center) divides IP addresses into several classes.

Classes A, B, and C are assigned to organizations that request addresses. In Class A networks, the ﬁrst byte of

an IP address is reserved for the network portion of the address. Class B networks reserve the ﬁrst two bytes

of an IP address for the network address. Class C networks reserve the ﬁrst three bytes of an IP address for the

network address. In all cases, a network manager can decide to use subnetting to assign even more bits to the

network portion of the IP address, but never less than the class requires. The following section gives more

information on subnetting.

Class A networks have a small number of possible network numbers, but a large number of possible host

numbers. Conversely, Class C networks have a small number of possible host numbers, but a large number of

possible network numbers. Thus, the InterNIC assigns Class A addresses to large organizations that have very

large numbers of IP hosts, while smaller organizations, with fewer hosts, get Class B or Class C addresses. You

can tell the various classes apart by the value of the ﬁrst (or high-order) byte. Class A networks use values from

1 to 127, Class B networks use values from 128 to 191, and Class C networks use values from 192 to 223.

The following table summarizes some of the differences between Class A, B, and C networks.

Number of

networks

possible per

class

Number of

hosts

possible per

network

Format of address

(without subnetting)

Class First byte

Example

1–127

128–191

192–223

127

16,384

16,777,214

65,534

254

net.host.host.host

net.net.host.host

net.net.net.host

97.3.14.250

140.100.10.11

197.204.13.7

2,097,152

Subnets and subnet masks

Often an entire organization is assigned only one IP network number. If the organization has several IP networks

connected together with IP routers, the network manager can use subnetting to distinguish between these

networks, even though they all use the same network number. Each physical network becomes a subnet with a

unique subnet number.

Download from Www.Somanuals.com. All Manuals Search And Download.

Understanding IP Addressing B-3

Subnet numbers appear within IP addresses, along with network numbers and host numbers. Since an IP

address is always 32 bits long, using subnet numbers means either the network number or the host numbers

must use fewer bits in order to leave room for the subnet numbers. Since the InterNIC assigns the network

number proper, it should not change, so the subnet numbers must be created out of bits that would otherwise

be part of the host numbers.

Subnet masks

To create subnets, the network manager must deﬁne a subnet mask, a 32-bit number that indicates which bits

in an IP address are used for network and subnetwork addresses and which are used for host addresses. One

subnet mask should apply to all IP networks that are physically connected together and share a single assigned

network number. Subnet masks are often written in decimal notation like IP addresses, but they are most easily

understood in binary notation. When a subnet mask is written in binary notation, each numeral 1 indicates that

the corresponding bit in the IP address is part of the network or subnet address. Each 0 indicates that the

corresponding bit is part of the host address. The following table shows the proper subnet masks to use for

each class of network when no subnets are required.

Class

Subnet mask for a network with no subnets

Binary:

11111111.00000000.00000000.00000000

Decimal: 255.0.0.0

Binary:

11111111.11111111.00000000.00000000

Decimal: 255.255.0.0

Binary:

11111111.11111111.11111111.00000000

Decimal: 255.255.255.0

To know whether subnets are being used or not, you must know what subnet mask is being used—you cannot

determine this information simply from an IP address. Subnet mask information is conﬁgured as part of the

process of setting up IP routers and gateways such as the Router.

Note: If you receive a routed account from an ISP, there must be a mask associated with your network IP

address. By using the IP address with the mask you can discover exactly how many IP host addresses you

actually have.

To conﬁgure subnets properly, you must also be able to convert between binary notation and decimal notation.

Example: Using subnets on a Class C IP internet

When setting up IP routing with a Class A address, or even with multiple Class C addresses, subnetting is fairly

straightforward. Subnetting a single Class C address between two networks, however, is more complex. This

section describes the general procedures for subnetting a single Class C network between two Netopia routers

so that each can have Internet access.

Download from Www.Somanuals.com. All Manuals Search And Download.

B-4 Firmware User Guide

Network conﬁguration

Below is a diagram of a simple network conﬁguration. The ISP is providing a Class C address to the customer

site, and both networks A and B want to gain Internet access through this address. Router B connects to Router

A and is provided Internet access through Routers A and B.

Customer Site A

PC 1:

IP Address:

192.168.1.3

Subnet Mask:

255.255.255.128

Gateway: 192.168.1.1

Router B:

Router A:

IP Address: 192.168.1.1

IP Address: 192.168.1.2

Subnet Mask: 255.255.255.128

Subnet Mask:

LAN

Remote IP: 10.0.0.1

255.255.255.128

Remote Sub: 255.255.255.0

ISP Network

Remote IP: 192.168.1.129

Gateway: 10.0.0.1

Remote Sub:

255.255.255.128

Router A:

Static Route:

192.168.1.128 [network]

255.255.255.128 [mask]

192.168.1.2 [via router]

IP Address: 10.0.0.1

Gateway: 192.168.1.1

Subnet Mask:

255.255.255.0

Usable IP Addresses

available to Customer Site A:

192.168.1.1 -->

Usable IP Addresses available to

Customer Site A: 192.168.1.1 -->

192.168.1.126

Customer Site B

PC 2:

IP Address:

Router B:

IP Address: 192.168.1.129

192.168.1.130

Internet

Subnet Mask: 255.255.255.128

Remote IP: 192.168.1.2

Subnet Mask:

255.255.255.128

Remote Sub: 255.255.255.128

Gateway: 192.168.1.2

Gateway:

192.168.1.129

Usable IP Addresses available to

Customer Site B: 192.168.1.129

--> 192.168.1.254

LAN

Download from Www.Somanuals.com. All Manuals Search And Download.

Understanding IP Addressing B-5

Background

The IP addresses and routing conﬁgurations for the devices shown in the diagram are outlined below. In

addition, each individual ﬁeld and its meaning are described.

The IP Address and Subnet Mask ﬁelds deﬁne the IP address and subnet mask of the device's Ethernet

connection to the network while the Remote IP and Remote Sub ﬁelds describe the IP address and subnet

mask of the remote router. This information is entered in the connection proﬁle of the Router.

The Gateway ﬁeld describes the router or workstation's default gateway, or where they will send their packets if

the appropriate route is not known. The Static Route ﬁeld, which is only shown on Router B, tells Router B what

path to take to get to the network deﬁned by Router B. Finally, the Usable IP Address ﬁeld shows the range of IP

addresses available to the hosts of that network.

Note that the IP addresses given in this section are for example purposes only. Do not use these addresses

when conﬁguring your network.

With this conﬁguration, both Customer Site A and B can gain Internet access through Routers A and B, with no

reconﬁguration of the ISP's equipment. The most important item in this conﬁguration is the static route deﬁned

on Router B. This tells Router B what path to take to get to the network deﬁned by Router B. Without this

information, Customer Site B will be able to access Customer Site A, but not the Internet.

If it is not possible to deﬁne a static route on Router B, RIP could be enabled to serve the same purpose. To

use RIP instead of a static route, enable Transmit RIP on Router A and Transmit and Receive RIP on Router B.

This will allow the route from Customer Site B to propagate on Router B and Customer Site A.

Example:Working with a Class C subnet

Suppose that your organization has a site with only 10 hosts and no plans to add any new hosts. You don’t

need a full Class C address for this site. Many ISPs offer Internet access with only a portion of a full Internet

address.

For example, you might obtain the Class C address 199.14.17.48, with the mask 255.255.255.240. From the

previous example, you can see that this gives you 14 host addresses to distribute to the hosts at your site. In

effect, your existing network of 10 hosts is a subnet of the ISP’s network. Since the Class C address has

already been reduced to subnets, you cannot further subnet your network without the risk of creating network

routing problems (since you must use the mask issued by the ISP). This, however, is not a problematic

limitation for your small network.

The advantages of this situation are the greater ease and lower cost of obtaining a subnet rather than a full

Class C address from an ISP.

Distributing IP Addresses

To set up a connection to the Internet, you may have obtained a block of IP host addresses from an ISP. When

conﬁguring the Router, you gave one of those addresses to its Ethernet port, leaving a number of addresses to

distribute to computers on your network.

Download from Www.Somanuals.com. All Manuals Search And Download.

B-6 Firmware User Guide

There are two schemes for distributing the remaining IP addresses:

■

Manually give each computer an address

■

Let the Router automatically distribute the addresses

These two methods are not mutually exclusive; you can manually issue some of the addresses while the rest

are distributed by the Router. Using the router in this way allows it to function as an address server.

One reason to use the Router as an address server is that it takes less time than manually distributing the

addresses. This is particularly true if you have many addresses to distribute. You need to enter information only

once, rather than having to enter it on each host separately. This also reduces the potential for misconﬁguring

hosts.

Another reason to use the Router as an address server is that it will distribute addresses only to hosts that

need to use them.

All Routers come with an integrated Dynamic Host Control Protocol (DHCP) server. Some routers also come with

a Macintosh Internet Protocol (MacIP) server. These servers provide a means of distributing IP addresses to

either a Mac or PC workstation as needed.

When setting up the DHCP or MacIP servers in the Router, it is necessary to understand how workstations

lease, renew, and release their IP addresses. This information is helpful in determining dynamic address

allocation for a network.

The term “lease” describes the action of a workstation requesting and using an IP address. The address is

dynamic and can be returned to the address pool at a later time.

The term “renew” refers to what the workstations do to keep their leased IP address. At certain intervals, the

workstation talks to the DHCP or MacIP server and renews the lease on that IP address. This renewal allows

the workstation to keep and use the assigned IP address until the next renewal period.

The term “release” refers to a situation where the workstation is no longer using its assigned IP address or has

been shut down. IP addresses can be manually released as well. The IP address goes back into the DHCP or

MacIP address pool to be reassigned to another workstation as needed.

Technical note on subnet masking

Note: The IP address supplied by the Router will be a unique number. You may want to replace this number

with a number that your ISP supplies if you are conﬁguring the router for a static IP address. However, the

Router and all devices on the same local network must have the same subnet mask. If you require a different

class address, you can edit the IP Mask ﬁeld to enter the correct address. Refer to the table below.

Number of Devices (other than

Largest Possible Ethernet Subnet

Mask

Router) on Local Network

255.255.255.252

2-5

255.255.255.248 (6)

255.255.255.240 (14)

255.255.255.224 (30)

6-13

14-29

Download from Www.Somanuals.com. All Manuals Search And Download.

Understanding IP Addressing B-7

Number of Devices (other than

Largest Possible Ethernet Subnet

Mask

Router) on Local Network

30-61

62-125

125-259

255.255.255.192

255.255.255.128

255.255.255.0

Conﬁguration

This section describes the speciﬁc IP address lease, renew, and release mechanisms for both the Mac and PC,

with either DHCP or MacIP address serving.

DHCP address serving

Windows 95 workstation:

■

The Win95 workstation requests and renews its lease every half hour.

The Win95 workstation does NOT relinquish its DHCP address lease when the machine is shut down.

The lease can be manually expired using the WINIPCFG program, a command line program executable from

the DOS prompt or from the START:RUN menu on a Windows-based computer.

Windows 3.1 workstation (MSTCP Version 3.11a):

■

The Win3.1 workstation requests and renews its lease every half hour.

■

The Win3.1 workstation does NOT relinquish its DHCP address lease when the user exits Windows and

goes to DOS.

■

The lease can be manually expired by typing IPCONFIG/RELEASE from a DOS window within Windows or

from the DOS prompt.

Macintosh workstation (Open Transport Version 1.1 or later):

■

The Mac workstation requests and renews its lease every half hour.

■

The Mac workstation relinquishes its address upon shutdown in all but one case. If the TCP/IP control

panel is set to initialize at startup, and no IP services are used or the TCP/IP control panel is not opened,

the DHCP address will NOT be relinquished upon shutdown. However, if the TCP/IP control panel is opened

or if an IP application is used, the Mac WILL relinquish the lease upon shutdown.

■

If the TCP/IP control panel is set to acquire an address only when needed (therefore a TCP/IP application

must have been launched to obtain a lease) the Mac WILL relinquish its lease upon shutdown every time.

Netopia Firmware Version 5.4 DHCP server characteristics

■

The Netopia Firmware Version 5.4 ignores any lease-time associated with a DHCP request and

automatically issues the DHCP address lease for one hour.

■

The number of devices a Router can serve DHCP to is 512. This is imposed by global limits on the size of

the address serving database, which is shared by all address serving functions active in the router.

Download from Www.Somanuals.com. All Manuals Search And Download.

B-8 Firmware User Guide

■

The Router releases the DHCP address back to the available DHCP address pool exactly one hour after the

last-heard lease request. Some other DHCP implementations may hold on to the lease for an additional

time after the lease expired to act as a buffer for variances in clocks between the client and server.

MacIP serving

Macintosh workstation (MacTCP or Open Transport):

Once the Mac workstation requests and receives a valid address, the Router actively checks for the

workstation’s existence once every minute.

■

For a dynamic address, the Router releases the address back to the address pool after it has lost contact

with the Mac workstation for over 2 minutes.

■

For a static address, the Router releases the address back to the address pool after it has lost contact

with the Mac workstation for over 20 minutes.

Netopia Firmware Version 5.4 MacIP server characteristics

The Mac workstation uses ATP to both request and receive an address from the Router's MacIP server. Once

acquired, NBP conﬁrm packets will be sent out every minute from the Router to the Mac workstation.

Manually distributing IP addresses

If you choose to manually distribute IP addresses, you must enter each computer’s address into its TCP/IP

stack software. Once you manually issue an address to a computer, it possesses that address until you

manually remove it. That’s why manually distributed addresses are called static addresses.

Static addresses are useful in cases when you want to make sure that a host on your network cannot have its

address taken away by the address server. Appropriate candidates for a static address include a network

administrator’s computer, a computer dedicated to communicating with the Internet, and routers.

Using address serving

The Router provides three ways to serve IP addresses to computers on a network. The ﬁrst, Dynamic Host

Conﬁguration Protocol (DHCP), is supported by PCs with Microsoft Windows and a TCP/IP stack. Macintosh

computers using Open Transport and computers using the UNIX operating system may also be able to use

DHCP. The second way, MacIP, is for Macintosh computers. The third way, called Serve Dynamic WAN Clients

(IPCP), is used to fulﬁll WAN client requirements

The Router can use both DHCP and MacIP. Whether you use one or both depends on your particular networking

environment. If that environment includes both PCs and Macintosh computers that do not use Open Transport,

you need to use both DHCP and MacIP to distribute IP addresses to all of your computers.

Serve dynamic WAN clients

The third method, used to fulﬁll WAN client requirements, is called Serve Dynamic WAN Clients. The correct

term or protocol is a subset of the PPP suite call IPCP. Originally, this would apply only to switched WAN

interface routers, and not to leased line routers. However, a new feature can give you Asynchronous PPP dial-in

support on the Auxiliary port on any router including leased line Netopia routers.

Download from Www.Somanuals.com. All Manuals Search And Download.

Understanding IP Addressing B-9

In any situation where a device is dialing into a Netopia router, the router may need to be conﬁgured to serve IP

via the WAN interface. This is only a requirement if the calling device has not been conﬁgured locally to know

what its address(es) are. So when a client, dialing into a Netopia router's WAN interface, is expecting

addresses to be served by the answering router, you must set the answering Netopia router to serve IP via its

WAN interface.

You can do this in either of two ways:

■

use the Serve Dynamic WAN Clients option in the Address Serving Setup screen.

Enabling Serve Dynamic WAN Clients only allows you to specify a pool of addresses from which the dial-in

client may get an IP address. It does not allow static addressing.

If you want to serve addresses dynamically, use Serve Dynamic WAN Clients.

■

deﬁne the address that you want to serve in the Connection Proﬁle's IP Setup screen.

This method requires a static value to be used. Thus any user dialing in can obtain the same IP address for

every connection to the proﬁle.

If you want to serve addresses statically, deﬁne the address in the Connection Proﬁle.

Notes:

■

The addresses that are to be served cannot be used elsewhere. For example you wouldn't want to

deﬁne a static address in a Connection Proﬁle to be served via the WAN that is already deﬁned in the

DHCP pool of addresses.

In order to work correctly, you must deﬁne a host or node address in the IP Proﬁle Parameters of the

Connection Proﬁle.

This is accomplished by specifying the IP address that is to be statically served via the WAN, and then

by entering a mask value of 255.255.255.255.

Tips and rules for distributing IP addresses

■

Before you allocate IP addresses using DHCP and MacIP, consider whether you need to set aside any static

addresses.

■

Note any planned and currently used static addresses before you use DHCP and MacIP.

Avoid fragmenting your block of IP addresses. For example, try to use a continuous range for the static

addresses you choose.

Download from Www.Somanuals.com. All Manuals Search And Download.

B-10 Firmware User Guide

Distributed to the

Router

(Ethernet IP address)

Manually distributed

(static)

Pool of addresses distributed

by MacIP and DHCP

Block of IP host addresses

(derived from network IP

address + mask issued by ISP)

The ﬁgure above shows an example of a block of IP addresses being distributed correctly.

The example follows these rules:

■

An IP address must not be used as a static address if it is also in a range of addresses being distributed

by DHCP or MacIP.

A single IP address range is used by all the address-served clients. These include DHCP, BootP, MacIP, and

WAN clients, even though BootP and static MacIP clients might not be considered served.

The address range speciﬁed for address-served clients cannot wrap around from the end of the total

available range back to the beginning. See below for a further explanation and an example.

■

The network address issued by an ISP cannot be used as a host address.

A DHCP example

Suppose, for example, that your ISP gave your network the IP address 199.1.1.32 and a 4-bit subnet mask.

Address 199.1.1.32 is reserved as the network address. Address 199.1.1.47 is reserved as the broadcast

address. This leaves 14 addresses to allocate, from 199.1.1.33 through 199.1.1.46. If you want to allocate a

sub-block of 10 addresses using DHCP, enter “10” in the DHCP Setup screen’s Number of Addresses to

Allocate item. Then, in the same screen’s First Address item, enter the ﬁrst address in the sub-block to

allocate so that all 10 addresses are within your original block. You could enter 199.1.1.33, or 199.1.1.37, or

any address between them. Note that if you entered 199.1.1.42 as the ﬁrst address, network routing errors

would probably result because you would be using a range with addresses that do not belong to your network

(199.1.1.49, 199.1.1.50, and 199.1.1.51). The DHCP server would not initialize if set incorrectly.

Download from Www.Somanuals.com. All Manuals Search And Download.

Understanding IP Addressing B-11

Nested IP Subnets

Under certain circumstances, you may want to create remote subnets from the limited number of IP addresses

issued by your ISP or other authority. You can do this using connection proﬁles. These subnets can be nested

within the range of IP addresses available to your network.

For example, suppose that you obtain the Class C network address a.b.c.0 to be distributed among three

networks. This network address can be used on your main network, while portions of it can be subnetted to the

two remaining networks.

Note: The IP address a.b.c.0 has letters in place of the ﬁrst three numbers to generalize it for this example.

The ﬁgure shows a possible network conﬁguration following this scheme. The main network is set up with the

Class C address a.b.c.0, and contains Router A (which could be a Router), a Router, and a number of other

hosts. Router A maintains a link to the Internet and can be used as the default gateway.

Download from Www.Somanuals.com. All Manuals Search And Download.

B-12 Firmware User Guide

Internet

a.b.c.16

a.b.c.1

Router A

a.b.c.0

a.b.c.2

Router B

Router C

a.b.c.248

a.b.c.249

a.b.c.128

a.b.c.129

Routers B and C (which could also be Routers) serve the two remote networks that are subnets of a.b.c.0. The

subnetting is accomplished by conﬁguring the Router with connection proﬁles for Routers B and C (see the

following table).

Bits available for host

Connection proﬁle Remote IP address

Remote IP mask

address

For Router B

For Router C

a.b.c.128

a.b.c.248

255.255.255.192

255.255.255.248

The Router’s connection proﬁles for Routers B and C create entries in its IP routing table. One entry points to

the subnet a.b.c.128, while a second entry points to the subnet a.b.c.248. The IP routing table might look

similar to the following:

Download from Www.Somanuals.com. All Manuals Search And Download.

Understanding IP Addressing B-13

IP Routing Table

Network Address-Subnet Mask-----via Router------Port------------------Type----

----------------------------------SCROLL UP-----------------------------------

0.0.0.0

a.b.c.1

Other

Local

127.0.0.1

a.b.c.128

a.b.c.248

255.255.255.255 127.0.0.1

255.255.255.192 a.b.c.128

255.255.255.248 a.b.c.248

Loopback

WAN

---------------------------------SCROLL DOWN----------------------------------

UPDATE

Let’s see how a packet from the Internet gets routed to the host with IP address a.b.c.249, which is served by

Router C. The packet ﬁrst arrives at Router A, which delivers it to its local network (a.b.c.0). The packet is then

received by the Router, which examines its destination IP address.

The Router compares the packet’s destination IP address with the routes in its IP routing table. It begins with

the route at the bottom of the list and works up until there’s a match or the route to the default gateway is

reached.

When a.b.c.249 is masked by the ﬁrst route’s subnet mask, it yields a.b.c.248, which matches the network

address in the route. The Router uses the connection proﬁle associated with the route to connect to Router C,

and then forwards the packet. Router C delivers the packet to the host on its local network.

Download from Www.Somanuals.com. All Manuals Search And Download.

B-14 Firmware User Guide

The following diagram illustrates the IP address space taken up by the two remote IP subnets. You can see from

the diagram why the term nested is appropriate for describing these subnets.

Address range

available to

a.b.c.0, less

the two nested

subnets

129

valid addresses used

by a.b.c.128

190

249

valid addresses used

by a.b.c.248

254

Broadcasts

As mentioned earlier, binary IP host or subnet addresses composed entirely of ones or zeros are reserved for

broadcasting. A broadcast packet is a packet that is to be delivered to every host on the network if both the

host address and the subnet address are all ones or all zeros, or to every host on the subnetwork if the host

address is all ones or all zeros but the subnet address is a combination or zeros and ones. Instead of making

many copies of the packet, individually addressed to different hosts, all the host machines know to pay

attention to broadcast packets, as well as to packets addressed to their speciﬁc individual host addresses.

Depending on the age and type of IP equipment you use, broadcasts will be addressed using either all zeros or

all ones, but not both. If your network requires zeros broadcasting, you must conﬁgure this through SNMP.

Packet header types

As previously mentioned, IP works with other protocols to allow communication over IP networks. When IP is

used on an Ethernet network, IP works with the Ethernet or 802.3 framing standards, among other protocols.

These two protocols specify two different ways to organize the very ﬁrst signals in the sequence of electrical

signals that make up an IP packet travelling over Ethernet. By default, the Router uses Ethernet packet headers

for IP trafﬁc. If your network requires 802.3 IP framing, you must conﬁgure this through SNMP.

Download from Www.Somanuals.com. All Manuals Search And Download.

Binary Conversion Table C-1

Appendix C

Binary Conversion Table

This table is provided to help you choose subnet numbers and host numbers for IP and MacIP networks that

use subnetting for IP addresses.

Decimal

Binary

Decimal

Binary

Decimal

Binary

Decimal

Binary

100000

1000000

1000001

1000010

1000011

1000100

1000101

1000110

1000111

1001000

1001001

1001010

1001011

1001100

1001101

1001110

1001111

1010000

1010001

1010010

1010011

1010100

1010101

1010110

1010111

1011000

1011001

1011010

1011011

1011100

1011101

1011110

1011111

1100000

1100001

1100010

1100011

1100100

1100101

1100110

1100111

1101000

1101001

1101010

1101011

1101100

1101101

1101110

1101111

1110000

1110001

1110010

1110011

1110100

1110101

1110110

1110111

1111000

1111001

1111010

1111011

1111100

1111101

1111110

1111111

1000001

100010

100011

100100

100101

100110

100111

101000

101001

101010

101011

101100

101101

101110

101111

110000

110001

110010

110011

110100

110101

110110

110111

111000

111001

111010

111011

111100

111101

111110

111111

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

101

110

111

1000

1001

1010

1011

1100

1101

1110

1111

10000

10001

10010

10011

10100

10101

10110

10111

11000

11001

11010

11011

11100

11101

11110

11111

Download from Www.Somanuals.com. All Manuals Search And Download.

C-2 Firmware User Guide

Decimal

Binary

Decimal

Binary

Decimal

Binary

Decimal

Binary

128

10000000

10000001

10000010

10000011

10000100

10000101

10000110

10000111

10001000

10001001

10001010

10001011

10001100

10001101

10001110

10001111

10010000

10010001

10010010

10010011

10010100

10010101

10010110

10010111

10011000

10011001

10011010

10011011

10011100

10011101

10011110

10011111

160

10100000

10100001

10100010

10100011

10100100

10100101

10100110

10100111

10101000

10101001

10101010

10101011

10101100

10101101

10101110

10101111

10110000

10110001

10110010

10110011

10110100

10110101

10110110

10110111

10111000

10111001

10111010

10111011

10111100

10111101

10111110

10111111

192

11000000

11000001

11000010

11000011

11000100

11000101

11000110

11000111

11001000

11001001

11001010

11001011

11001100

11001101

11001110

11001111

11010000

11010001

11010010

11010011

11010100

11010101

11010110

11010111

11011000

11011001

11011010

11011011

11011100

11011101

11011110

11011111

224

11100000

11100001

11100010

11100011

11100100

11100101

11100110

11100111

11101000

11101001

11101010

11101011

11101100

11101101

11101110

11101111

11110000

11110001

11110010

11110011

11110100

11110101

11110110

11110111

11111000

11111001

11111010

11111011

11111100

11111101

11111110

11111111

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

Download from Www.Somanuals.com. All Manuals Search And Download.

Index-1

configuring terminal emulation software

1-4

configuring the console 2-43

Connection profiles 2-24

console

Index

add static route 6-8

ADSL Line Configuration 2-2

advanced configuration

features 2-35

configuring 2-43

connection problems A-2

console configuration 2-43

console-based management

configuring with 1-2, 2-1

Constant Bit Rate (CBR) 2-18

ATMP 4-10

tunnel options 4-8

backup default gateway 7-13

backup, line 7-1

D. port 10-23

Data Encryption Standard (DES) 4-10

basic firewall 10-32

BootP 6-17

date and time

setting 2-42

clients 6-23

dead peer detection 5-12

Default Profile 2-28

default profile 2-28

broadcasts B-14

change static route 6-9

community strings 9-12

configuration

default terminal emulation software set-

tings 1-6

delete static route 6-9

DES 4-3, 4-7, 5-1

troubleshooting

PC A-1

designing a new filter set 10-25

configuration files

downloading with TFTP 11-8

downloading with XMODEM 11-11

uploading with TFTP 11-9

uploading with XMODEM 11-11

Configuration Management 10-44

configuration screens

protecting 10-16

DHCP

defined B-8

DHCP Lease 6-18

DHCP NetBIOS options 6-22

DHCP Relay Agent 6-30

diagnostics

T1 11-12

display static routes 6-7

distributing IP addresses B-5

downloading configuration files 11-8, 11-

configuring

with console-based management 1-

2, 2-1

Download from Www.Somanuals.com. All Manuals Search And Download.

Index-2

adding to a filter set 10-28

defined 10-18

with TFTP 11-8

with XMODEM 11-11

Dynamic Host Configuration Protocol

(DHCP) 6-17

deleting 10-31

disadvantages of 10-25

input 10-28

Dynamic Host Configuration Protocol,

see DHCP

Dynamic WAN 6-17

modifying 10-30

output 10-28

using 10-26

viewing 10-30

Easy Setup

firewall 10-31

navigating 1-7

firmware files

encryption 4-3, 4-7, 4-10, 5-1

event history

updating with TFTP 11-7

updating with XMODEM 11-10

FTP sessions 10-34

device 9-5

WAN 9-5

Exposed Addresses 2-40

filter

G.SHDSL Line Configuration 2-6

general statistics 9-7

parts 10-21

how to reach us A-4

parts of 10-21

filter priority 10-19

filter set

IDSL Line Configuration 2-5

IKE 5-1

input filter 3 10-32

adding 10-27

display 10-23

input filters 1 and 2 10-32

input filters 4 and 5 10-32

Internet addresses, see IP addresses

Internet Key Exchange 5-1

Internet Key Exchange (IKE) 4-7 , 5-1

Internet Protocol (IP) 6-1

IP address serving 6-17

IP addresses B-1

filter sets

adding 10-27

defined 10-18

deleting 10-31

disadvantages 10-25

sample (Basic Firewall) 10-31

using 10-26

filtering example #1 10-24

filters

about B-1

distributing B-5

actions a filter can take 10-20

distribution rules B-10

Download from Www.Somanuals.com. All Manuals Search And Download.

Index-3

static B-8

IP profile parameters 3-21

IP passthrough 3-27

IP setup 6-2

IP setup 3-7

map lists 3-8

IP trap receivers

deleting 9-13

modifying map lists 3-13

outside ranges 3-8

server lists 3-8

modifying 9-13

setting 9-13

navigating

viewing 9-13

Easy Setup 1-7

IPsec 4-3, 4-7, 5-1

NCSA Telnet 1-4

nested IP subnets B-11

NetBIOS 6-22

latency 10-35

LED status 9-3

LEDs 9-3

line backup 7-1

backup IP gateway 7-15

connection profiles 7-7

management and statistics 7-10 , 7-

scheduled connections 7-8

WAN configuration 7-2 , 7-3

MIBs supported 9-10

model numbers 1-3

MPPE 4-10

NetBIOS scope 6-23

Netopia

distributing IP addresses 6-17, B-5

models 1-3

monitoring 9-1

security 10-1

system utilities and diagnostics 11-1

Network Address Translation

see NAT 6-1

network problems A-2

network status overview 9-1

output filter 1 10-33

MS-CHAPv2 4-11

Multicast Forwarding 6-34

Multiple Data Link Encapsulation Set-

tings 2-25

packet

header B-14

password

multiple subnets 6-4

to protect security screen 10-16

user accounts 10-15

PAT (Port Address Translation) 3-2

permanent virtual circuit 2-16

ping 11-2

NAT

adding server lists 3-15

defined 6-1

Easy Setup Profile 3-6

ping test, configuring and initiating 11-2

Download from Www.Somanuals.com. All Manuals Search And Download.

Index-4

port number

Security Policy Database (SPD) 5-2

Simple Network Management Protocol,

see SNMP

comparisons 10-22

port numbers 10-21

PPTP 4-10

SNMP

tunnel options 4-4

PVC 2-16

community strings 9-12

MIBs supported 9-10

setup screen 9-11

traps 9-12

quality of service 10-35

Quick View 9-1

SNMP-V2c 9-10

src. port

restarting the system 11-12

restricting telnet access 10-17

RFC-1483 Transparent Bridging 2-44

RIP-2 MD5 Authentication 6-10

router to serve IP addresses to hosts 6-

10-23

Stateful inspection 2-37

static IP addresses B-8

static route

rules of installation 6-9

static routes 6-3, 6-6

strong encryption 4-11

subnet masks B-3

subnets B-2–B-5

multiple 6-4

routing tables

IP 6-6, 9-7

scheduled connections 2-29

adding 2-31

nested B-11

deleting 2-34

subnets and subnet masks B-2

modifying 2-34

support

once-only 2-33

technical A-4

viewing 2-30

weekly 2-32

T1 diagnostics 11-12

T1 Line Configuration 2-7

technical support A-4

telnet 1-4

SDSL/IDSL Line Configuration 2-3

security

filters 10-18–10-34

measures to increase 10-1

telnet 10-17

access 10-17

terminal emulation software

configuring 1-4

user accounts (passwords) 10-15

security options screen 10-15

protecting 10-16

default settings 1-6

TFTP

Download from Www.Somanuals.com. All Manuals Search And Download.

Index-5

defined 11-6

Virtual Private Networks (VPN) 4-1

VPN 4-1

downloading configuration files 11-8

updating firmware 11-7

uploading configuration files 11-9

TFTP, transferring files 11-6

tiered access 10-2

allowing through a firewall 4-19

ATMP tunnel options 4-8

default answer profile 4-11

encryption support 4-10

PPTP tunnel options 4-4

TOS bit 10-35

Trivial File Transfer Protocol (TFTP) 11-6

Trivial File Transfer Protocol, see TFTP

troubleshooting A-1

configuration

WAN

event history 9-5

WAN event history 9-5

Windows NT Domain Name 4-6

PC A-1

event histories 9-4

trusted host 10-33

XMODEM 11-9

trusted subnet 10-33

XMODEM file transfers

downloading configuration files 11-

tunnel options

ATMP 4-8

PPTP 4-4

updating firmware 11-10

uploading configuration files 11-11

tunneling 4-2

Universal Plug and Play (UPnP™) 10-2

Unspecified Bit Rate (UBR) 2-18

updating firmware

with TFTP 11-7

with XMODEM 11-10

updating Netopia’s firmware 11-7

upgrade 1-3

uploading configuration files 11-9

with TFTP 11-9

with XMODEM 11-11

user accounts 10-15

utilities and diagnostics 11-1

viewing scheduled connections 2-30

Download from Www.Somanuals.com. All Manuals Search And Download.

Index-6

Download from Www.Somanuals.com. All Manuals Search And Download.

Milwaukee DVD Player 2320 20 User Manual
MTD Blower 24695 8 User Manual
Multiquip Trash Compactor MVC80VH VHW User Manual
Nady Systems DJ Equipment SRM 12X User Manual
NEC Car Video System X401S User Manual
Nortec Portable DVD Player E DVKIT006 User Manual
Onkyo CD Player CR 445 User Manual
Panasonic Camcorder AG HMC70 User Manual
Panasonic Car Video System CQ3700EU User Manual
ParaBody Home Gym PBF 472 User Manual