P-661H-D Series ADSL2+ 4-port Security Gateway Support Notes Version3.40 Mar.
P-661H-D Series Support Notes FAQ .................................................................................................................5 ZyNOS FAQ .................................................................................................5 1. What is ZyNOS? ...................................................................................5 2. What’s Multilingual Embedded Web Configurator?...............................5 3. How do I access the P-661H-D Command Line Interface (CLI)?.......
P-661H-D Series Support Notes 17. What do the ATM QoS Types (CBR, UBR, VBR-nRT, VBR-RT) mean? ................................................................................................................15 18. What is content filter? .......................................................................15 ADSL FAQ .................................................................................................17 1. How does ADSL compare to Cable modems?....................................17 2.
P-661H-D Series Support Notes General FAQ...........................................................................................28 1. What is VPN? .......................................................................28 2. Why do I need VPN? ............................................................28 3. What are most common VPN protocols?..............................28 4. What is PPTP? .....................................................................28 5. What is L2TP? ........................
P-661H-D Series Support Notes 3. Setup the P-661H-D as a DHCP Relay ................................41 4. SUA Notes............................................................................42 5. Using Full Feature NAT ........................................................51 6. Using the Dynamic DNS (DDNS) .........................................63 7. Network Management Using SNMP .....................................65 8. Using syslog ...................................................................
P-661H-D Series Support Notes FAQ ZyNOS FAQ 1. What is ZyNOS? ZyNOS is ZyXEL's proprietary Network Operating System. It is the platform on all Prestige routers that delivers network services and applications. It is designed in a modular fashion so it is easy for developers to add new features. New ZyNOS software upgrades can be easily downloaded from our FTP sites as they become available. 2.
P-661H-D Series Support Notes b. Enter CI command 'sys stdio 0' to disable Stdio idle timeout c. To upgrade firmware, use TFTP client program to put firmware in file 'ras' in the Prestige. After data transfer is finished, the P-661H-D will program the upgraded firmware into FLASH ROM and reboot itself. d. To backup your firmware, use the TFTP client program to get file 'ras' from the Prestige. 6. How do I restore P-661H-D configurations by using TFTP client program via LAN? a.
P-661H-D Series Support Notes with its own address and the source port in the TCP or UDP header with another value chosen out of a local pool. It then recomputes the appropriate header checksums and forwards the packet to the Internet as if it is originated from Prestige using the IP address assigned by ISP.
P-661H-D Series Support Notes must be configured. (You can configure it in Web Configurator, Advanced Setup, Network -> NAT -> Port Forwarding). 12. When do I need select Full Feature NAT? • Make multiple local servers on the LAN accessible from outside with multiple global IP addresses With SUA, 'visible' servers had to be mapped to different ports, since the servers share only one global IP.
P-661H-D Series Support Notes The following table summarizes the five types. NAT Type IP Mapping One-to-One ILA1<--->IGA1 Many-to-One (SUA/PAT) ILA1<--->IGA1 ILA2<--->IGA1 ... ILA1<--->IGA1 ILA2<--->IGA2 Many-to-Many ILA3<--->IGA1 Overload ILA4<--->IGA2 ... Many One-to-One Server ILA1<--->IGA1 ILA2<--->IGA2 ILA3<--->IGA3 ILA4<--->IGA4 ... Server 1 IP<--->IGA1 Server 2 IP<--->IGA1 14.
P-661H-D Series Support Notes • Allow everything that is not spoofing us Filter rule setup: • • • • • • Filter type =TCP/IP Filter Rule Active =Yes Source IP Addr =a.b.c.d Source IP Mask =w.x.y.z Action Matched =Drop Action Not Matched =Forward Where a.b.c.d is an IP address on your local network and w.x.y.
P-661H-D Series Support Notes Product FAQ 1. How can I manage P-661H-D? Multilingual Embedded Web GUI for Local and Remote management CLI (Command-line interface) Telnet support (Administrator Password Protected ) for remote configuration change and status monitoring FTP/ TFTP sever, firmware upgrade and configuration backup and restore are supported(Administrator Password Protected) 2.
P-661H-D Series Support Notes do not interfere with your voice transmissions. For the details about how to connect the micro filter please refer to the user's manual. 6. The P-661H-D supports Bridge and Router mode, what's the difference between them? When the ISP limits some specific computers to access Internet, that means only the traffic to/from these computers will be forwarded and the other will be filtered. In this case, we use bridge mode which works as an ADSL modem to connect to the ISP.
P-661H-D Series Support Notes The outside users can always access the web server using the www.zyxel.com.tw regardless of the WAN IP of the P-661H-D. When the ISP assigns the P-661H-D a new IP, the P-661H-D updates this IP to DDNS server so that the server can update its IP-to-DNS entry. Once the IP-to-DNS table in the DDNS server is updated, the DNS name for your web server (i.e., www.zyxel.com.tw) is still usable. 10.
P-661H-D Series Support Notes For forwarding the inbound IPSec ESP tunnel, A 'Default' server set is required. You could configure it in Web Configurator, Advanced Setup, Network -> NAT -> Port Forwarding -> Default Server Setup: It is because SUA makes your LAN appear as a single machine to the outside world. LAN users are invisible to outside users. So, to make an internal server for outside access, we must specify the service port and the LAN IP of this server in Web configurator.
P-661H-D Series Support Notes 16. What do the parameters (PCR, SCR, MBS) mean? Traffic shaping parameters (PCR, SCR, MBS) can be set in Web Configurator, Advanced Setup, Network -> Remote Node -> Edit -> ATM Setup: Peak Cell Rate(PCR): The maximum bandwidth allocated to this connection. The VC connection throughput is limited by PCR. Sustainable Cell Rate(SCR): The least guaranteed bandwidth of a VC. When there are multi-VCs on the same line, the VC throughput is guaranteed by SCR.
P-661H-D Series Support Notes when the P-661H-D performs content filtering. You can also specify trusted IP Addresses on LAN for which the P-661H-D will not perform content filtering. You can configure the details about it in Web Configurator, Advanced setup, Security -> Content Filter. 16 All contents copyright © 2006 ZyXEL Communications Corporation.
P-661H-D Series Support Notes ADSL FAQ 1. How does ADSL compare to Cable modems? ADSL provides a dedicated service over a single telephone line; cable modems offer a dedicated service over a shared media. While cable modems have greater downstream bandwidth capabilities (up to 30 Mbps), that bandwidth is shared among all users on a line, and will therefore vary, perhaps dramatically, as more users in a neighborhood get online at the same time.
P-661H-D Series Support Notes 6. Does the VC-based multiplexing perform better than the LLC-based multiplexing? Though the LLC-based multiplexing can carry multiple protocols over a single VC, it requires extra header information to identify the protocol being carried on the virtual circuit (VC). The VC-based multiplexing needs a separate VC for carrying each protocol but it does not need the extra headers. Therefore, the VC-based multiplexing is more efficient. 7.
P-661H-D Series Support Notes More and more Telco/ISPs are providing three kinds of services (VoIP, Video and Internet) over one existing ADSL connection. • • • • The different services (such as video, VoIP and Internet access) require different Qulity of Service. The high priority is Voice (VoIP) data. The Medium priority is Video (IPTV) data.
P-661H-D Series Support Notes Firewall FAQ General 1. What is a network firewall? A firewall is a system or group of systems that enforces an access-control policy between two networks. It may also be defined as a mechanism used to protect a trusted network from an untrusted network. The firewall can be thought of two mechanisms: One to block the traffic, and the other to permit traffic. 2.
P-661H-D Series Support Notes address and protocol. They also 'inspect' the session data to assure the integrity of the connection and to adapt to dynamic protocols. The flexible nature of Stateful Inspection firewalls generally provides the best speed and transparency, however, they may lack the granular application level access control or caching that some proxies support. 4. What kind of firewall is the P-661H-D? 1. The P-661H-D's firewall inspects packets contents and IP headers.
P-661H-D Series Support Notes 1. Those that exploits bugs in a TCP/IP implementation such as Ping of Death and Teardrop. 2. Those that exploits weaknesses in the TCP/IP specification such as SYN Flood and LAND Attacks. 3. Brute-force attacks that flood a network with useless data such as Smurf attack. 4. IP Spoofing 7. What is Ping of Death attack? Ping of Death uses a 'PING' utility to create an IP packet that exceeds the maximum 65535 bytes of data allowed by the IP specification.
P-661H-D Series Support Notes 11 What is Brute-force attack? A Brute-force attack, such as 'Smurf' attack, targets a feature in the IP specification known as directed or subnet broadcasting, to quickly flood the target network with useless data. A Smurf hacker flood a destination IP address of each packet is the broadcast address of the network, the router will broadcast the ICMP echo request packet to all hosts on the network.
P-661H-D Series Support Notes 1. Change the default Administrator password since it is required when setting up the firewall. 2. Limit who can access to your P-661H-D’s Web Configurator or CLI. You can enter the IP address of the secured LAN host in Web Configurator, Advanced Setup, Advanced -> Remote MGNT -> [Service] ->Secured Client IP to allow special access to your P-661H-D: The default value in this field is 0.0.0.0, which means you do not care which host is trying to telnet your P-661H-D or access.
P-661H-D Series Support Notes (3) WWW/Telnet service is enabled but your host IP is not the secured host entered in Web Configurator, Advanced setup, Advanced -> Remote MGNT: (4)A filter set which blocks WWW/Telnet from WAN is applied to WAN node. You can check by command: wan node index [index #] wan node display 4. Why can't I upload the firmware and configuration file using FTP over WAN? (1) When the firewall is turned on, all connections from WAN to LAN are blocked by the default ACL rule.
P-661H-D Series Support Notes (2) You have disabled FTP service in Web Configurator, Advanced setup, Advanced -> Remote MGNT. (3) FTP service is enabled but your host IP is not the secured host entered in Web Configurator, Advanced setup, Advanced -> Remote MGNT. (4) A filter set which blocks FTP from WAN is applied to WAN node. You can check by command: wan node index [index #] wan node display Log and Alert 1.
P-661H-D Series Support Notes • Web configuration: Advanced Setup, Maintenance -> Logs -> Log Settings, check Access Control and Attacks options depending on your real situation. • CI command: sys logs category [access | attack] (2) Enable log function in firewall default policy or in firewall rules. After the above two steps, you can view firewall logs via • Web Configurator: Advanced setup, Maintenance -> Logs ->View Log.
P-661H-D Series Support Notes VPN FAQ General FAQ 1. What is VPN? A VPN gives users a secure link to access corporate network over the Internet or other public or private networks without the expense of lease lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing technologies/services used to transport traffic over the Internet or any insecure network that uses the TCP/IP protocol suite for communication. 2.
P-661H-D Series Support Notes PPTP is a tunneling protocol defined by the PPTP forum that allows PPP packets to be encapsulated within Internet Protocol (IP) packets and forwarded over any IP network, including the Internet itself. The PPTP is supported in Windows NT and Windows 98 already. For Windows 95, it needs to be upgraded by the Dial-Up Networking 1.2 upgrade. 5.
P-661H-D Series Support Notes There is no restriction that the IPSec hosts and the security gateway must be separate machines. Both IPSec protocols, AH and ESP, can operate in either transport mode and tunnel mode. 9. What is SA? A Security Association (SA) is a contract between two parties indicating what security parameters, such as keys and algorithms they will use. 10. What is IKE? IKE is short for Internet Key Exchange.
P-661H-D Series Support Notes IP address dynamically assigned from ISP, so P-661H-D needs additional information to make the decision. Such additional information is what we call phase 1 ID. In the IKE payload, there are local and peer ID field to achieve this. 14. What is FQDN? FQDN(Fully Qualified Domain Name), IKE standard takes it as one type of Phase 1 ID. As we mentioned, Phase 1 ID is an identification for each VPN peer. The type of Phase 1 ID may be IP/FQDN(DNS)/Ueser FQDN(E-mail).
P-661H-D Series Support Notes 2. What kind of VPN protocols are supported on P-661H-D? All P-661H-D series support IPSec VPN, in other words, we can build IPSec VPN on P-661H-D. And also note that P-661H-D is of VPN (IPSec, PPTP) passthrough supported NAT. 3. What types of encryption does P-661H-D VPN support? P-661H-D supports DES/3DES/AES encryption. 4. What types of authentication does P-661H-D VPN support? VPN vendors support a number of different authentication methods.
P-661H-D Series Support Notes VPN Gateway behind NAT NAT in Transport mode ESP Tunnel mode None (3) Source IP/Destination IP-- Please do not number the LANs (local and remote) using the same range of private IP addresses. This will make VPN destination addresses and the local LAN addresses are indistinguishable, and VPN will not work. (4) Secure Gateway IP Address --It is usually a static IP so that we can pre-configure it in P-661H-D for making VPN connections.
P-661H-D Series Support Notes We have tested P-661H-D successfully with the following third party VPN gateway: • • • • • • • Cisco 1720 Router, IOS 12.2(2)XH, IP/ADSL/ FW/IDS PLUS IPSEC 3DES NetScreen 5, ScreenOS 2.6.0r6 SonicWALL SOHO 2 WatchGuard Firebox II Avaya VPN Netopia VPN III VPN 8. What VPN software has been tested with P-661H-D successfully? We have tested P-661H-D successfully with the following third party VPN software.
P-661H-D Series Support Notes NAT* NAT in Transport mode None * The NAT router must support IPSec pass through. For example, for P-661H-D SUA/NAT routers, the default port and the client IP have to be specified in Web Configurator, Network -> NAT ->SUA Server Setup. 11. How do I configure P-661H-D with NAT for internal servers? Generally, without IPSec, to configure an internal server for outside access, we need to configure the server private IP and its service port in SUA/NAT Server Table.
P-661H-D Series Support Notes disconnected either manually, by idle timer, or because of power cycle, packet triggering is still necessary to make the tunnel up. 14. Single, Range, Subnet, which types of IP address do P-661H-D support in VPN/IPSec? P-661H-D supports all of the types. In other words, you can specify a single PC, a range of PCs or even a network of PCs to utilize the VPN/IPSec service. 15. Can P-661H-D support VPN passthrough? Yes, P-661H-D can support VPN (IPSec, PPTP) passthrough.
P-661H-D Series Support Notes Application Notes General Application Notes 1. Internet Access Using P-661H-D under Bridge mode • • Setup your workstation Setup your P-661H-D under bridge mode If the ISP limits some specific computers to access Internet, that means only the traffic to/from these computers will be forwarded and the other will be filtered. In this case, we use P-661H-D which works as an ADSL bridge modem to connect to the ISP.
P-661H-D Series Support Notes Setup your P-661H-D under bridge mode The following procedure shows you how to configure your P-661H-D as bridge mode. We will use Web Configurator to guide you through the related menu. (1) Configure P-661H-D as bridge mode and configure Internet setup parameters in Web Configurator, Advanced Setup, Network -> WAN -> 38 All contents copyright © 2006 ZyXEL Communications Corporation.
P-661H-D Series Support Notes Internet Connection. Key Settings: Option Description Encapsulation Select the correct Encapsulation type that your ISP supports. For example, RFC 1483. Multiplexing Select the correct Multiplexing type that your ISP supports. For example, LLC. VPI & VCI number Specify a VPI (Virtual Path Identifier) and a VCI (Virtual Channel Identifier) given to you by your ISP.
P-661H-D Series Support Notes Connect the LAN ports of all computers to the LAN Interface of P-661H-D using Ethernet cable. (2) TCP/IP configuration Since the P-661H-D is set to DHCP server as default, so you need only to configure the workstations as the DHCP clients in the networking settings. In this case, the IP address of the computer is assigned by the P-661H-D. The P-661H-D can also provide the DNS to the clients via DHCP if it is available.
P-661H-D Series Support Notes Option Description Encapsulation Select the correct Encapsulation type that your ISP supports. For example, RFC 1483. Multiplexing Select the correct Multiplexing type that your ISP supports. For example, LLC. VPI & VCI number Specify a VPI (Virtual Path Identifier) and a VCI (Virtual Channel Identifier) given to you by your ISP. IP Address Assignment Set to Dynamic if the ISP provides the IP for the P-661H-D dynamically.
P-661H-D Series Support Notes 4. SUA Notes Tested SUA/NAT Applications (e.g., Cu-SeeMe, ICQ, NetMeeting) Introduction Generally, SUA makes your LAN appear as a single machine to the outside world. LAN users are invisible to outside users. However, some applications such as Cu-SeeMe, and ICQ will need to connect to the local user behind the P-661H-D. In such case, a SUA server must be configured to forward the incoming packets to the true destination behind SUA.
P-661H-D Series Support Notes mIRC None for Chat. For DCC, please set Default/Client IP . Windows PPTP None 1723/client IP ICQ 99a None for Chat. For DCC, please set: ICQ -> preference -> connections -> firewall and set the firewall time out to 80 seconds in firewall setting. Default/client IP ICQ 2000b None for Chat None for Chat ICQ Phone 2000b None 6701/client IP None 7648/client IP 7648/client IP & 24032/client IP Default/client IP White Pine 4.
P-661H-D Series Support Notes Network Time Protocol (NTP) None 123 /server IP Win2k Terminal Server None 3389/server IP Remote Anything None 3996 - 4000/client IP None 5500/client IP 5800/client IP 5900/client IP Virtual Network Computing (VNC) AIM (AOL Instant Messenger) None for Chat and IM None for Chat and IM e-Donkey None 4661 - 4662/client IP POLYCOM Video Conferencing None Default/client IP iVISTA 4.
P-661H-D Series Support Notes Configure an Internal Server behind SUA Introduction If you wish, you can make internal servers (e.g., Web, ftp or mail server) accessible for outside users, even though SUA makes your LAN appear as a single machine to the outside world. A service is identified by the port number.
P-661H-D Series Support Notes Setup, Network -> NAT -> Port Forwarding. The outside users can access the local server using the P-661H-D's WAN IP address which can be obtained from Web Configurator, Status -> WAN Information. For example: Configuring an internal Web server for outside access (suppose the Server IP Address is 192.168.1.
P-661H-D Series Support Notes FTP 21 Telnet 23 SMTP 25 DNS (Domain Name Server) 53 www-http (Web) 80 Configure a PPTP server behind SUA Introduction PPTP is a tunneling protocol defined by the PPTP forum that allows PPP packets to be encapsulated within Internet Protocol (IP) packets and forwarded over any IP network, including the Internet itself. In order to run the Windows 9x PPTP client, you must be able to establish an IP connection with a tunnel server such as the Windows NT Server 4.
P-661H-D Series Support Notes Window98 PPTP Client / Internet / NT RAS Server Protocol Stack PPTP appears as new modem type (Virtual Private Networking Adapter) that can be selected when setting up a connection in the Dial-Up Networking folder. The VPN Adapter type does not appear elsewhere in the system. Since PPTP encapsulates its data stream in the PPP protocol, the VPN requires a second dial-up adapter.
P-661H-D Series Support Notes Example The following example shows how to dial to an ISP via the P-661H-D and then establish a tunnel to a private network. There will be three items that you need to set up for PPTP application, these are PPTP server (WinNT), PPTP client (Win9x) and the P-661H-D.
P-661H-D Series Support Notes Select service name as ‘PPTP’, fill in the Server IP Address, then press button ‘Add’. When you have finished the above settings, you can ping to the remote Win9x client from WinNT. This ping command is used to demonstrate that remote the Win9x can be reached across the Internet. If the Internet connection between two LANs is achievable, you can place a VPN call from the remote Win9x client. For example: C:\ping 203.66.113.
P-661H-D Series Support Notes 5. Using Full Feature NAT When P-661H-D is in Routing mode, you can select NAT Option as Full Feature in Network -> Remote Node -> Edit: Key Settings: Field Options Description Full Feature When you select this option you can select Address Mapping Set Number 1~8 in the pull-down menu on the right. None NAT is disabled when you select this option. When you select this option, this remote node will use default SUA Address Mapping Set.
P-661H-D Series Support Notes The P-661H-D has 8 remote nodes and so allows you to configure 8 NAT Address Mapping Sets, You must specify which NAT Address Mapping Set (1~8) to use in the remote node when you select Full Feature NAT. You can edit 10 rules for each Address Mapping Set. You can edit the rules for Address Mapping Sets #1 in Web Configurator. The other Address Mapping Sets #2~8 can only be configured in CLI (Command Line Interface).
P-661H-D Series Support Notes IP. Global End This is the ending global IP address (IGA). IP N/A Type Many-to-One and Server This is the NAT mapping types. Here we’ll guide you to configure Address Mapping Sets from Web Configurator and CLI. (Since in Web Configurator we can only edit the rules for Address Mapping Sets #1.
P-661H-D Series Support Notes The following table describes the fields in this screen. Field Description Type 1. One-to-One 2. Many-to-One 3. Many-to-Many You can select one of the five mapping types from the Overload pull-down menu 4. Many-to-Many No Overload 5. Server Start This is the starting local IP address (ILA) Option/Example 0.0.0.0 This is the ending local IP address (ILA). If the rule is Local for all local IPs, then put the Start IP as 0.0.0.0 and the IP End 255.255.255.255 End IP as 255.
P-661H-D Series Support Notes Setp 3: Set NAT address mapping rule for the Address Mapping Set you just configured (Set 2 in this example) by command ‘ip nat addrmap rule [rule#] [insert | edit] [type] [local start IP] [local end IP] [global start IP] [global end IP] [server set #]’. Suppose we set a Many-to-One rule for set 2 by command ‘ip nat addrmap rule 1 edit 1 192.168.1.10 192.168.1.20 172.1.1.1 172.1.1.1’ Setp 4: Save the configuration by command ‘ip nat addrmap save’.
P-661H-D Series Support Notes server sets ip nat server save ip nat server clear [set#] ip nat server edit [rule#] active Save the NAT server set buffer into flash Clear the server set [set#], must use “save” command to let it save into flash Activate the rule [rule#], rule number is 1 to 24, the number 25-36 is for UPNP application ip nat server edit [rule#] svrport to port> ip nat server edit [rule#] remotehost Configure the IP
P-661H-D Series Support Notes Please note that a server can support more than one service, e.g., a server can provide both FTP and Mail service, while another provides only Web service. The following procedures show how to configure a server behind NAT. Step 1: Login Web Configurator, Advanced Setup, Network -> NAT -> Port Forwarding. Step 2: Select the service name from the pull-down menu, and fill in the server Address on ‘Server IP Address’, then click button ‘Add’ to save it.
P-661H-D Series Support Notes In our Internet Access example, we only need one rule where all our ILAs map to one IGA assigned by the ISP. You can just use the default SUA NAT, or you could select Full Feature NAT and select an Address Mapping Set with a Many-to-One Rule. See the following figure.
P-661H-D Series Support Notes below: (3) Using Multiple Global IP addresses for clients and servers (One-to-One, Many-to-One, Server Set mapping types are used) In this case we have 3 IGAs from the ISP. We have two very busy internal FTP servers and also an internal general server for the web and mail. In this case, we want to assign the 3 IGAs by the following way using 4 NAT rules. • • • • Rule 1 (One-to-One type) to map the FTP Server 1 with ILA1 (192.168.1.10) to IGA1 (200.0.0.1).
P-661H-D Series Support Notes Step 1: In this case, we need to map ILA to more than one IGA, therefore we must choose the Full Feature option from the NAT field in currently active remote node, and assign IGA3 to P-661H-D’s WAN IP Address. Step 2: Go to Web Configurator, Advanced Setup, Network -> NAT -> Address Mapping to begin configuring Address Mapping Set #1. We can see there are 10 blank rule table that could be configured. See the following setup for the four rules in our case.
P-661H-D Series Support Notes Rule 3 Setup: Select Many-to-One type to map the other clients to IGA3 (200.0.0.3). Rule 4 Setup: Select Server type to map our web server and mail server with ILA3 (192.168.1.20) to IGA3. Menu Network -> NAT -> Address Mapping should look as follows now: 61 All contents copyright © 2006 ZyXEL Communications Corporation.
P-661H-D Series Support Notes Step 3: Now we configure all other incoming traffic to go to our web server and mail server from Web Configurator, Advanced Setup, Network -> NAT -> Port Forwarding: (4) Support Non NAT Friendly Applications Some servers providing Internet applications such as some mIRC servers do not allow users to login using the same IP address.
P-661H-D Series Support Notes One rule configured for using Many-to-Many No Overload mapping type is shown below. We can also do this by configure threeOne-to-One mapping type rules. 6. Using the Dynamic DNS (DDNS) • What is DDNS? The DDNS service, an IP Registry provides a public central database where information such as email addresses, hostnames, IPs etc. can be stored and retrieved. This solves the problems if your DNS server uses an IP associated with dynamic IPs.
P-661H-D Series Support Notes When the ISP assigns the P-661H-D a new IP, the P-661H-D must inform the DDNS server the change of this IP so that the server can update its IP-to-DNS entry. Once the IP-to-DNS table in the DDNS server is updated, the DNS name for your web server (i.e., www.zyxel.com.tw) is still usable. The DDNS servers the P-661H-D supports currently is WWW.DYNDNS.ORG where you apply the DNS from and update the WAN IP to. • Setup the DDNS 1.
P-661H-D Series Support Notes User Name Enter the user name that the DDNS server gives to you. Password Enter the password that the DDNS server gives to you. Enter the hostname for the wildcard function that the Enable Wildcard WWW.DYNDNS.ORG supports. Note that Wildcard option is available only when the provider is http://www.dyndns.org/. 7. Network Management Using SNMP • ZyXEL SNMP Implementation ZyXEL currently includes SNMP support in some P-661H-D routers.
P-661H-D Series Support Notes When receiving any SNMP get or set requirement with wrong community, this trap is sent to the manager. 6. whyReboot (defined in ZYXEL-MIB) : When the system is going to restart (warmstart), the trap will be sent with the reason of restart before rebooting. (1) For intentional reboot : In some cases (download new files, CI command "sys reboot", ...), reboot is done intentionally. And traps with the message "System reboot by user !" will be sent.
P-661H-D Series Support Notes The SNMP related settings in P-661H-D are configured in Web Configurator, Advanced Setup, Advanced -> Remote MGNT -> SNMP The following steps describe a simple setup procedure for configuring all SNMP settings. Key Settings: Option Descriptions Enter the correct Get Community. This Get Community must match the Get 'Get-' and 'GetNext' community requested from the NMS. The default is Community 'public'. Enter the correct Set Community.
P-661H-D Series Support Notes Enter the IP address of the NMS that you wish to send the traps to. If Trap 0.0.0.0 is entered, the P-661H-DHW-DX will not send trap any NMS Destination manager. Note: You may need to edit a firewall rule to permit SNMP Packets. 8. Using syslog You can configure it in Web Configurator, Advanced Setup, Maintenance -> Logs -> Log Settings -> Syslog logging. Key Settings: Active: Select it to active UNIX Syslog.
P-661H-D Series Support Notes The P-661H-D supports three virtual LAN interfaces via its single physical Ethernet interface. The first network can be configured in Web Configurator, Advanced Setup, Network -> LAN -> DHCP Setup. The second and third networks that we call 'IP Alias 1' and 'IP Alias 2' can be configured in Network -> LAN -> IP Alias. There are three internal virtual LAN interfaces for the P-661H-D to route the packets from/to the three networks correctly.
P-661H-D Series Support Notes You can edit filter rule to accept or deny LAN packets from/to the IP alias 1/2 go through the P-661H-D by command in CLI: lan index [index number] Usage: index number =1 main LAN 2 IP Alias#1 3 IP Alias#2 lan filter [set#] Usage: set#= the corresponding filter set number you’ve configured lan save • IP Alias Setup (1) Edit the first network in Web Configurator, Advanced Setup, Network -> LAN -> IP/DHCP Setup by configuring the P-661H-D's
P-661H-D Series Support Notes and remote node connections, we can route the Web packets to the Internet using one policy and route the FTP packets to the remote LAN using another policy. See the figure below. Use IPPR to distribute traffic among multiple paths • Benefits Source-Based Routing - Network administrators can use policy-based routing to direct traffic from different users through different connections.
P-661H-D Series Support Notes The actions that can be taken include routing the packet to a different gateway (and hence the outgoing interface) and the TOS and precedence fields in the IP header. IPPR follows the existing packet filtering facility of ZyNOS in style and in implementation. The policies are divided into sets, where related policies are grouped together. A use defines the policies before applying them to an interface or a remote node, in the same fashion as the filters.
P-661H-D Series Support Notes (Set the protocol ID as 6(TCP) for the rule) ip policyrouting set criteria serviceType 0 (Set the criteria type of service as don’t care for this rule) ip policyrouting set criteria precedence 8 (Set the precedence as don’t care for this rule) ip policyrouting set criteria packetlength 0 (Set the packet length as 0 for the rule) ip policyrouting set criteria srcip 192.168.1.2 192.168.1.20 (Set the source IP address for the rule: Start=192.168.1.2, end=192.168.1.
P-661H-D Series Support Notes 11. Using Call Scheduling • What is Call Scheduling? Call scheduling enables the mechanism for the P-661H-D to run the remote node connection according to the pre-defined schedule. This feature is just like the scheduler ina video recorder which records the program according to the specified time. Users can apply at most 4 schedule sets in Remote Node.
P-661H-D Series Support Notes wan callsch oncedate 2005 12 27 (Set the schedule used just once, it works on 2005-12-27) wan callsch starttime 12 00 (Set the schedule start time as 12:00) wan callsch duration 16 00 (Set schedule duration time as 16 hours) wan callsch action 2 (Set action as dial-on-demand) wan callsch save (Save the current call schedule set) Key Settings: Start Date Start date of this schedule rule. It can be unmatched with weekday setting.
P-661H-D Series Support Notes • Time Service in P-661H-D There is no RTC (Real-Time Clock) chip so the P-661H-D should launch a mechanism to get current time and date from external server in boot time. Time service is implemented by the Daytime protocol(RFC-867), Time protocol(RFC-868), and NTP protocol(RFC-1305). You have to assign an IP address of a time server and then, the P-661H-D will get the date, time, and time-zone information from this server.
P-661H-D Series Support Notes needs to be forwarded. At start up, the P-661H-D queries all directly connected networks to gather group membership. After that, the P-661H-D updates the information by periodic queries. The P-661H-D implementation of IGMP is also compatible with version 1. The multicast setting can be turned on or off on Ethernet and remote nodes. • IP Multicast Setup (1) Enable IGMP in P-661H-D's LAN in Web Configurator, Advanced Setup, Network -> LAN -> IP -> Advanced Setup.
P-661H-D Series Support Notes Fairness-Based is chosen, then the bandwidth is allocated by ratio. Which means if A class needs 300 kbps, B class needs 600 kbps, then the ratio of A and B's actual bandwidth is 1:2. So if we get 450 kbps in total, then A would get 150 kbps, B would get 300 kbps. We select Priority-Based in this example. Key Settings: Check the box to enable BWM on the interface.
P-661H-D Series Support Notes Step 3: You can modify the rule by clicking the button ‘Edit’ on the rule: Key Settings: RuleName Give this rule a name, for example, 'WWW' BW Budget Configure the bandwidth you would like to allocate to this rule Priority Use All Managed Bandwidth Enter a number between 0 and 7 to set the priority of this class. The higher the number, the higher the priority. The default setting is 3.
P-661H-D Series Support Notes Destination Enter the destination subnet mask. Subnet Mask Destination Enter the destination port number of the traffic. Port Source IP Address Source Subnet Mask Enter the IP address of source that meats this class. Note that for traffic from 'LAN to WAN', since BWM is before NAT, you should use the IP address before NAT processing. Enter the destination subnet mask. Source Port Enter the source port number of the traffic.
P-661H-D Series Support Notes services of the line will be. After that, system will save back the correct VPI, VCI and also services (encapsulation) type into profile of WAN interface. • Configure the VC auto-hunting preconfigured table.
P-661H-D Series Support Notes (3) Delete items from the auto-haunting preconfigured table by useing command: wan atm vchunt remove • Using Zero configuration. You can enable/disable Zero Configuration in Network -> WAN -> Advanced Setup: (1) After configure the auto-haunting preconfigured table. You just need a PC connected to the device LAN Ethernet port with the DSL sync up. (2) Open your web browser to access a Web site.
P-661H-D Series Support Notes (4) Basically the zero configuration only work on the VC that was preconigured in the auto-haunting preconfigured table. 15.
P-661H-D Series Support Notes The packet filter function on P-661H-D is the same as before, just that you could only configure the filter set and apply them by command in CLI. It’s very complex for common users to do it. So here’s the recommendation: (1) Usually if you want to block special packets, you could edit a firewall rule in Web Configurator.
P-661H-D Series Support Notes • Apply to LAN Interface: lan index [index#] Usage: index#=1 main LAN 2 IP Alias#1 3 IP Alias#2 lan filter Usage: You can apply at most four filter sets to LAN Interface. lan save (3) If you are very advanced user, you could edit filter set by the following command: sys filter set [set#] [rule#] Usage: Set up a filter set index to edit a set.
P-661H-D Series Support Notes mask] the rule sys filter set destport [port#] [compare type = none|equal|notequal|less|greater] sys filter set srcip [address] [subnet mask] Set the destination port and compare type (compare type could be 0(none)|1(equal)|2(not equal)|3(less)|4(greater) ) Set the source IP address and subnet mask sys filter set srcport [port#] [compare Set the source port and compare type (compare type = none|equal|not type could be 0(none)|1(equal)|2(not equal|less|greater] equal)|3
P-661H-D Series Support Notes IPSEC VPN Application Notes 1. How to use P-661H-D to build VPN Tunnel with another VPN Gateway/ Software? This page will guide you to setup a VPN connection between two Prestige routers. In addition to Prestige to Prestige, Prestige can also talk to other VPN hardwards/softwares. The tested VPN hardwares are shown below: • Cisco 1720 Router, IOS 12.2(2)XH, IP/ADSL/FW/IDS PLUS IPSEC 3DES • NetScreen 5, ScreenOS 2.6.
P-661H-D Series Support Notes The IP addresses we use in this example are as below. PC 1 192.168.1.33 Prestige A Prestige B PC 2 LAN: 192.168.1.1 LAN: 192.168.2.1 192.168.2.33 WAN: 202.132.154.1 WAN: 168.10.10.66 Note: The following configurations are supposed both two VPN gateways have fixed IP addresses. If one of VPN gateways uses dynamic IP, we enter 0.0.0.0 as the secure gateway IP address.
P-661H-D Series Support Notes (3) On the SUMMARY menu, select a policy to edit by clicking Edit. On P-661H-D, we can build at most 2 VPN Tunnels. Just make a click on the ‘Edit’ button in the table, we can begin to configure the VPN rule. (4) In the IPSEC Setup field, toggle Active check box and give a name, Test in the example to this policy. Select IPSec Key Mode to IKE, Negotiation Mode to Main, and Encapsulation Mode to Tunnel, just the same as we will configure in Prestige B.
P-661H-D Series Support Notes (6) Fill in the VPN Gateway information in the Address Information field. My IP Address is the WAN IP of Prestige A, 202.132.154.1 in the example. Secure Gateway Address is the remote secure gateway, Prestige B’s WAN IP, 168.10.10.66 in the example. Local ID Type as IP, and Content as 0.0.0.0 in the example. Peer ID Type as IP, and Content as 0.0.0.1 in the example. Note: Make sure the ID Type and content consistent between the two VPN secure gateways.
P-661H-D Series Support Notes Note: If there’s a NAT router between the two VPN Secure Gateways, we should only choose ‘ESP’ VPN Protocol The minimum length of Pre-Shared Key is 8. (8) A common VPN Rule has been completed, you can click ‘Apply’ to save it. But if you want to make more special configuration, you could click ‘Advanced’ to continue: Note: If you make any change in advanced setup, you need to configure the same on Prestige B. We don’t do any anvanced setup in the example.
P-661H-D Series Support Notes Secure Gateway Address is the remote secure gateway, Prestige A’s WAN IP, 202.132.154.1 in the example. (3) Local ID Type /Content should be the same as Prestige A’s Peer ID Type/Content, IP/0.0.0.1 in the example. Peer ID Type /Content should be the same as Prestige A’s Local ID Type/ Content, IP/0.0.0.0 in the example. Step 3: Verify if the VPN Tunnel has been established successfully If the connection between PC 1 and PC 2 is ok, we know the tunnel works.
P-661H-D Series Support Notes Prestige> ipsec debug 1 IPSEC debug level 1 Prestige> catcher(): recv pkt numPkt<1> get_hdr nxt_payload<1> exchMode<2> m_id<0> len<80> f76af206 b187aae3 00000000 00000000 01100200 00000000 00000050 00000034 00000001 00000001 00000028 01010001 00000020 01010000 80010001 80020001 80040001 80030001 800b0001 800c0e10 In isadb_get_entry, nxt_pyld=1, exch=2 New SA (2) View IPSec Log We can also view the log for IPSec and IKE connections for trouble shooting.
P-661H-D Series Support Notes Most of the cases, static IP addresses are used for VPN tunneling endpoints. But for SOHO users, generally, it is a dynamic case. In this case, this IP will not be available to be predefined in the VPN box. There are some tips when configure Prestige in any dynamic case. • Prestige static WAN IP v.s. peer side dynamic IP We need to note: (1) In VPN settings of Prestige, please specify the IP address of Secure Gateway as 0.0.0.
P-661H-D Series Support Notes Step 1: In Prestige A, please register a DDNS account from http://www.dyndns.org or http://dynupdate.no-ip.com Setp 2: Enable DynDNS function on Prestige A via Web configurator, Advanced -> Dynamic DNS. And in VPN settings on Prestige A, please specify the IP address of My IP as 0.0.0.0 and Secure Gateway as 0.0.0.0 (Here we take P-661H-D Web Configurator as the example). Step 3: In Prestige B, please specify the IP address of My IP as 0.0.0.
P-661H-D Series Support Notes internal server according to the service port and private IP entered in SUA/NAT Server Table. However, if both NAT and IPSec is enabled in Prestige, the edit of the table is necessary only if the connection is a non-secure connections. For secure connections, none SUA server settings are required since private IP is reachable in the VPN case. Remember, IPSec is an IP-in-IP encapsulation, the internal IP header is not translated by NAT.
P-661H-D Series Support Notes The IP addresses we use in this example are as shown below. Branch_A Headquarter Branch_B WAN:202.3.1.1 LAN:192.168.3.1 WAN:202.1.1.1 LAN:192.168.1.1 WAN:202.2.1.1 LAN:192.168.2.1 LAN of Branch_A LAN of Headquarter LAN of Branch_B 192.168.3.0/24 192.168.1.0/24 192.168.2.0/24 Setp 1: Setup VPN in branch office A Because VPN routing enables branch offices to talk to each other via tunnels concentrated on headquarter.
P-661H-D Series Support Notes Be very careful about the remote IP address in branch office B, because systems behind branch office B want to access systems behind branch office A and headquarter, we have to specify these two segments in Remote section. However if we include these two segments in one rule, the LAN segment of branch office B will be also included in this single rule, which means intercommunication inside branch office B will run into VPN tunnel.
P-661H-D Series Support Notes (2) My IP Address is the WAN IP of Prestige in Branch_B, 202.2.1.1 in the example. Secure Gateway Address is IP address of Headquarter, 202.1.1.1 in the example. (3) Suppose the pre-shared key is 01234567, we should configure the same key in the corresponding rule in Headquarter VPN Gateway. (4) You can setup IKE phase 1 and phase 2 parameters by pressing Advanced button.
P-661H-D Series Support Notes Remote Address Type is Range Address and IP Address Start is 192.168.2.0, IP Address End is 192.168.2.255. This section covers the LAN segment of branch office B. (2) My IP Address is the IP Address of Headquarter, 202.1.1.1 in the example. Secure Gateway Address is WAN IP of Prestige in Branch_B, 202.2.1.1 in the example. (3) Suppose the pre-shared key is 01234567, we should configure the same key in the corresponding rule in Headquarter VPN Gateway.
P-661H-D Series Support Notes Support Tool 1. LAN/WAN Packet Trace The Prestige packet trace records and analyzes packets running on LAN and WAN interfaces. It is designed for users with technical backgrounds who are interested in the details of the packet flow on LAN or WAN end of Prestige. It is also very helpful for diagnostics if you have compatibility problems with your ISP or if you want to know the details of a packet for configuring a filter rule.
P-661H-D Series Support Notes (2) Trace WAN packet • Disable the capture of the LAN packet by entering: sys trcp channel enet0 none • Enable to capture the WAN packet by entering: sys trcp channel mpoa00 bothway • • • Enable the trace log by entering: sys trcp sw on & sys trcl sw on Display the brief trace online by entering: sys trcd brief Display the detailed trace online by entering: sys trcd parse Example: 102 All contents copyright © 2006 ZyXEL Communications Corporation.
P-661H-D Series Support Notes • • Offline Trace Disable the capture of the WAN packet by entering: sys trcp channel mpoa00 none • Enable the capture of the LAN packet by entering: sys trcp channel enet0 bothway • • • • • Enable the trace log by entering: sys trcp sw on & sys trcl sw on Wait for packet passing through the Prestige over LAN Disable the trace log by entering: sys trcp sw off & sys trcl sw off Display the trace briefly by entering: sys trcp brief Display specific packets by using: sys trc
P-661H-D Series Support Notes • Capture the detailed logs by Hyper Terminal Step 1: Initiate a hyper terminal connection from your PC(suppose you connected to the LAN port of P-661H-D) Step 2: Click the ‘properties’ to configure parameters to telnet to the P-661H-D. 104 All contents copyright © 2006 ZyXEL Communications Corporation.
P-661H-D Series Support Notes Step 3: So that after you invoke the relevant commands, you could save the logs you’ve captured. 105 All contents copyright © 2006 ZyXEL Communications Corporation.
P-661H-D Series Support Notes 2.
P-661H-D Series Support Notes The 192.168.1.1 is the IP address of the Prestige. The local file is the source file of the ZyNOS firmware that is available in your hard disk. The remote file is the file name that will be saved in Prestige. Check the port number 69 and 512-Octet blocks for TFTP. Check 'Binary' mode for file transfering.
P-661H-D Series Support Notes The 192.168.1.1 is the IP address of the Prestige. The local file is the source file of your configuration file that is available in your hard disk. The remote file is the file name that will be saved in Prestige. Check the port number 69 and 512-Octet blocks for TFTP. Check 'Binary' mode for file transfering.
P-661H-D Series Support Notes [cppwu@faelinux cppwu]$ tftp -I 192.168.1.1 put [local-ras] ras <- upload firmware 3. Using FTP to Upload the Firmware and Configuration Files In addition to upload the firmware and configuration file via the console port and TFTP client, you can also upload the firmware and configuration files to the Prestige using FTP. To use this feature, your workstation must have a FTP client software. See the example shown below.
P-661H-D Series Support Notes 'Binary'. Step 2: Press 'OK' to ignore the 'Username' prompt. Step 3: To upload the firmware file, we transfer the local 'ras' file to overwrite the remote 'ras' file. To upload the configuration file, we transfer the local 'rom-0' to overwrite the remote 'rom-0' file. 110 All contents copyright © 2006 ZyXEL Communications Corporation.
P-661H-D Series Support Notes Step 4: The Prestige reboots automatically after the uploading is finished. Please do not power off the router at this moment. 111 All contents copyright © 2006 ZyXEL Communications Corporation.
P-661H-D Series Support Notes CI Command Reference Command Syntax and General User Interface CI has the following command syntax: command subcommand [param] command subcommand [param] command ? | help command subcommand ? | help General user interface: Shows the following commands and all major (sub)commands 1. ? 2. exit Exit Subcommand To get the latest CI Command list The latest CI Command list is available in release note of every ZyXEL firmware release.
