BCM50e Integrated Router Configuration - Advanced BCM50e Business Secure Router Document Number: N0115789 Document Version: 1.
Copyright © Nortel 2005–2006 All rights reserved. The information in this document is subject to change without notice. The statements, configurations, technical data, and recommendations in this document are believed to be accurate and reliable, but are presented without express or implied warranty. Users must take full responsibility for their applications of any products specified in this document. The information in this document is proprietary to Nortel.
Contents Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Text conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Related publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Contents IPSec VPN capability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 HTTPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Firewall . . . . . . . . . . . . . .
Contents 5 Main menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Changing the system password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 SMT menus at a glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 SMT menu 1 - general setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Introduction to general setup . . . . . .
Contents PPPoE Encapsulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Outgoing Authentication Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Nailed-Up Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 PPTP Encapsulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Edit IP . . . . . . . . . . . . . . . . . . . . . . . .
Contents 7 Chapter 10 Introducing the firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Using SMT menus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Activating the firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Chapter 11 Filter configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Contents System information and console port speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148 System Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149 Console port speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 Log and trace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 Syslog logging . . . . . . . .
Contents 9 Chapter 16 System Maintenance menus 8 to 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 Command Interpreter mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173 Command syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174 Command usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175 Call control support . . . . . . . . . . . .
Contents Triangle Route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 The Ideal Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 The Triangle Route Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 The Triangle Route Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204 IP aliasing . . . . . .
Contents 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231 Appendix G IP subnetting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 IP addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 IP classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Contents Enhanced DHCP option commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 Enhanced DHCP option commands introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 Specifying the Nortel BCM50 IP address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 Nortel BCM50 DHCP server options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 BCM50 DHCP server settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Figures Figure 1 Secure Internet Access and VPN Application . . . . . . . . . . . . . . . . . . . . . 37 Figure 2 Initial screen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Figure 3 SMT Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Figure 4 Main menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Figure 5 Menu 23.
Figures Figure 29 Menu 14- Dial-in User Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Figure 30 Menu 14.1- Edit Dial-in User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Figure 31 Menu 4: Applying NAT for Internet Access . . . . . . . . . . . . . . . . . . . . . . . . 90 Figure 32 Menu 11.1.2: Applying NAT to the Remote Node . . . . . . . . . . . . . . . . . . . 91 Figure 33 Menu 15: NAT Setup . . . . . . . . . . . . . . . . . . . . . . .
Figures 15 Figure 64 Protocol and Device Filter Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Figure 65 Filtering LAN Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Figure 66 Filtering Remote Node Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 Figure 67 Menu 22: SNMP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 Figure 68 Menu 23 System security . . . . . . . . . .
Figures Figure 99 Applying Schedule Sets to a Remote Node (PPPoE) . . . . . . . . . . . . . . . 190 Figure 100 WIndows 95/98/Me: network: configuration . . . . . . . . . . . . . . . . . . . . . . 192 Figure 101 Windows 95/98/Me: TCP/IP properties: IP address . . . . . . . . . . . . . . . . 193 Figure 102 Windows 95/98/Me: TCP/IP Properties: DNS configuration . . . . . . . . . . 194 Figure 103 Windows XP: Start menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Figures 17 Figure 134 Business Secure Router secure login screen . . . . . . . . . . . . . . . . . . . . . 222 Figure 135 Single-PC per Router Hardware Configuration . . . . . . . . . . . . . . . . . . . . 224 Figure 136 Business Secure Router as a PPPoE Client . . . . . . . . . . . . . . . . . . . . . 225 Figure 137 Transport PPP frames over Ethernet . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 Figure 138 Business Secure Router as a PPTP client . . . . . . . . . . . . . . . . . . . . . . .
Figures N0115789
Tables Table 1 Feature Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Table 2 Main menu commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Table 3 Main menu summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Table 4 General setup menu fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Table 5 Configure dynamic DNS menu fields . . . . . .
Tables Table 30 Generic Filter Rule Menu fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Table 31 SNMP Configuration Menu Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Table 32 SNMP Traps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Table 33 Menu 23.2 System Security: RADIUS Server . . . . . . . . . . . . . . . . . . . . . 143 Table 34 System Maintenance: Status Menu Fields . . . . . . . . . . . .
Tables 21 Table 65 IPSec commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259 Table 66 Sys firewall commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 Table 67 Bandwidth management commands . . . . . . . . . . . . . . . . . . . . . . . . . . . 266 Table 68 Certificates commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 Table 69 NetBIOS filter default settings . . . . . . . . . . .
Tables N0115789
Preface Before you begin This guide is designed to assist you with advanced configuration of your Business Secure Router for its various applications. Note: This guide explains how to use the System Management Terminal (SMT) or the command interpreter interface to configure your Business Secure Router. See the basic manual for how to use the WebGUI to configure your Business Secure Router. Not all features can be configured through all interfaces.
Preface A single keystroke is written in Arial font and enclosed in square brackets, for instance, [ENTER] means the Enter key; [ESC] means the escape key and [SPACE BAR] means the space bar. [UP] and [DOWN] are the up and down arrow keys. Mouse action sequences are denoted using a comma. For example, “click the Apple icon, Control Panels and then Modem” means first click the Apple icon, then point your mouse pointer to Control Panels and then click Modem.
Preface 25 USA and Canada Authorized Distributors Technical Support - GNTS/GNPS Telephone: 1-800-4NORTEL (1-800-466-7835) If you already have a PIN Code, you can enter Express Routing Code (ERC) 196#. If you do not yet have a PIN Code, or for general questions and first line support, you can enter ERC 338#. Web Site: www.nortel.
Preface CALA (Caribbean & Latin America) Technical Support - CTAS Telephone: 1-954-858-7777 E-mail: csrmgmt@nortel.com APAC (Asia Pacific) Service Business Centre & Pre-Sales Help Desk: +61-2-8870-5511 (Sydney) Technical Support - GNTS Telephone: +612 8870 8800 Fax: +612 8870 5569 E-mail: asia_support@nortel.
Preface Thailand 001-800-611-3007 Service Business Centre & Pre-Sales Help Desk +61-2-8870-5511 27 BCM50e Integrated Router Configuration - Advanced
Preface N0115789
Chapter 1 Getting to know your BCM50e Integrated Router This chapter introduces the main features and applications of the Business Secure Router. Introducing the BCM50e Integrated Router The BCM50e Integrated Router is an ideal secure gateway for all data passing between the Internet and the Local Area Network (LAN).
Chapter 1 Getting to know your BCM50e Integrated Router Table 1 Feature Specifications Feature Specification Number of concurrent IKE Phase 1 Security Associations: These correspond to the gateway policies. 10 Number of concurrent IPSec VPN tunnels (Phase 2 Security Associations): These correspond to the network policies and are also monitorable and manageable. For example, five IKE gateway policies could each use 12 IPSec tunnels for a total of 60 phase 2 IPSec VPN tunnels.
Chapter 1 Getting to know your BCM50e Integrated Router 31 Autonegotiating 10/100 Mb/s Ethernet WAN The 10/100 Mb/s Ethernet WAN port attaches to the Internet via broadband modem or router and automatically detects if it is on a 10 or a 100 Mb/s Ethernet. Time and date Using the Business Secure Router, you can get the current time and date from an external server when you turn on your Business Secure Router. You can also set the time manually.
Chapter 1 Getting to know your BCM50e Integrated Router SSH The Business Secure Router uses the SSH (Secure Shell) secure communication protocol to provide secure encrypted communication between two hosts over an unsecured network. HTTPS HyperText Transfer Protocol over Secure Socket Layer, or HTTP over SSL is a web protocol that encrypts and decrypts web sessions. Use HTTPS for secure WebGUI access to the Business Secure Router.
Chapter 1 Getting to know your BCM50e Integrated Router 33 Universal Plug and Play (UPnP) Using the standard TCP/IP protocol, the Business Secure Router and other UPnP-enabled devices can dynamically join a network, obtain an IP address, and convey its capabilities to other devices on the network. Call scheduling Configure call time periods to restrict and allow access for users on remote nodes.
Chapter 1 Getting to know your BCM50e Integrated Router IP Alias Using IP Alias, you can partition a physical network into logical networks over the same Ethernet interface. The Business Secure Router supports three logical LAN interfaces via its single physical Ethernet LAN interface with the Business Secure Router itself as the gateway for each LAN network.
Chapter 1 Getting to know your BCM50e Integrated Router 35 Port Forwarding Use this feature to forward incoming service requests to a server on your local network. You can enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server. DHCP (Dynamic Host Configuration Protocol) With DHCP (Dynamic Host Configuration Protocol), individual client computers can obtain the TCP/IP configuration at start-up from a centralized DHCP server.
Chapter 1 Getting to know your BCM50e Integrated Router Upgrade Business Secure Router Firmware The firmware of the Business Secure Router can be upgraded manually via the WebGUI. Embedded FTP and TFTP Servers The Business Secure Router’s embedded FTP and TFTP Servers enable fast firmware upgrades, as well as configuration file backups and restoration.
Chapter 1 Getting to know your BCM50e Integrated Router 37 Figure 1 Secure Internet Access and VPN Application BCM50e Integrated Router BCM50e Integrated Router Configuration - Advanced
Chapter 1 Getting to know your BCM50e Integrated Router N0115789
Chapter 2 Introducing the SMT This chapter explains how to access the System Management Terminal and gives an overview of its menus. Introduction to the SMT The Business Secure Router SMT (System Management Terminal) is a menu-driven interface that you can access over a Telnet connection. This chapter shows you how to navigate the SMT, and how to configure SMT menus. Initial screen When you turn on your Business Secure Router, it performs several internal tests as well as line initialization.
Chapter 2 Introducing the SMT Type the username (nnadmin is the default) and press [ENTER]. The logon screen prompts you to enter the password. Figure 3 SMT Login Enter Username : XXXX Enter Password : XXXX Type the password (PlsChgMe! is the default) and press [ENTER]. As you type the password, the screen displays an X for each character you type.
Chapter 2 Introducing the SMT 41 Table 2 Main menu commands Operations Keystrokes Descriptions Move the cursor [ENTER] or [UP] or [DOWN] arrow keys Within a menu, press [ENTER] to move to the next field. You can also use the [UP] or [DOWN] arrow keys to move to the previous or the next fields, respectively. When you are at the top of a menu, press the [UP] arrow key to move to the bottom of a menu. Entering information Fill in, or press [SPACE BAR], then press [ENTER] to select from choices.
Chapter 2 Introducing the SMT Figure 4 Main menu Business Secure Router Main Menu Getting Started 1. 2. 3. 4. Advanced Management General Setup WAN Setup LAN Setup Internet Access Setup Advanced Applications 11. Remote Node Setup 12. Static Routing Setup 14. Dial-in User Setup 15. NAT Setup 21. 22. 23. 24. 26. Filter and Firewall Setup SNMP Configuration System Security System Maintenance Schedule Setup 99.Exit Enter Menu Selection Number: Table 3 describes the fields in Figure 4.
Chapter 2 Introducing the SMT 43 Table 3 Main menu summary No. Menu Title Function 22 SNMP Configuration Use this menu to configure SNMP-related parameters. 23 System Security Use this menu to change your password and enable network user authentication. 24 System Maintenance From displaying system status to uploading firmware, this menu provides comprehensive system maintenance. 26 Schedule Setup Use this menu to schedule outgoing calls.
Chapter 2 Introducing the SMT SMT menus at a glance Figure 6 SMT overview N0115789
SMT menu 1 - general setup Introduction to general setup Menu 1 - general setup contains administrative and system-related information. Configuring general setup Enter 1 in the main menu to open Menu 1: general setup. The Menu 1 - General Setup screen appears, as shown in Figure 7. Fill in the required fields. Figure 7 menu 1: general setup Menu 1 - General Setup System Name= Business Secure Router Domain Name= www.nortel.
Chapter 2 SMT menu 1 - general setup Table 4 describes the fields in Figure 7. Table 4 General setup menu fields N0115789 Field Description Example System name Choose a descriptive name for identification purposes. Business Nortel recommends you enter your computer name in Secure Router this field. This name can be up to 30 alphanumeric characters long. Spaces, dashes - and underscores _ are accepted. Domain name Enter the domain name (if you know it) here. If you nortel.
Chapter 2 SMT menu 1 - general setup 47 Table 4 General setup menu fields Field Description Example First system DNS server DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because Second system without it, you must know the IP address of a machine before you can access it.
Chapter 2 SMT menu 1 - general setup Table 4 General setup menu fields Field Description Example You must also configure a VPN branch office rule since the Business Secure Router uses a VPN tunnel when it relays DNS queries to the private DNS server. One of the rule’s IP policies must include the LAN IP address of the Business Secure Router as a local IP address and the IP address of the DNS server as a remote IP address. A Private DNS entry with the IP address set to 0.0.0.
Chapter 2 SMT menu 1 - general setup 49 Figure 8 Configure dynamic DNS Menu 1.1 - Configure Dynamic DNS Service Provider= WWW.DynDNS.
Chapter 2 SMT menu 1 - general setup Table 5 Configure dynamic DNS menu fields Field Description Offline This field is only available when CustomDNS is selected in the DDNS Type field. Press [SPACE BAR] and then [ENTER] to select Yes. When Yes is selected, http://www.dyndns.org/ Example traffic is redirected to a URL that you have previously specified (see www.dyndns.org for details).
Chapter 3 WAN Setup This chapter describes how to configure the WAN using menu 2. Introduction to WAN setup This chapter explains how to configure settings for your WAN port.
Chapter 3 WAN Setup Figure 9 Menu 2 Menu 2 - WAN Setup MAC Address: Assigned By= Factory default IP Address= N/A Dial-Backup: Active= No Port Speed= 115200 AT Command String: Init= at&fs0=0 Edit Advanced Setup= No Press ENTER to Confirm or ESC to Cancel: Press Space Bar to Toggle. Table 6 describes the fields in Figure 9.
Chapter 4 LAN setup This chapter describes how to configure the LAN using Menu 3: LAN Setup. Introduction to LAN setup This section describes how to configure the Business Secure Router for LAN connections. Accessing the LAN menus From the main menu, enter 3 to open Menu 3 – LAN setup Figure 10 Menu 3: LAN setup. Menu 3 - LAN Setup 1. LAN Port Filter Setup 2.
Chapter 4 LAN setup Figure 11 Menu 3.1: LAN port filter setup Menu 3.1 – LAN Port Filter Setup Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Press ENTER to Confirm or ESC to Cancel: TCP/IP and DHCP ethernet setup menu From the main menu, enter 3 to open Menu 3 - LAN Setup to configure TCP/IP (RFC 1155) and DHCP Ethernet setup. Figure 12 Menu 3: TCP/IP and DHCP setup Menu 3 - LAN Setup 1. LAN Port Filter Setup 2.
Chapter 4 LAN setup 55 Figure 13 Figure 21-4 menu 3.2: TCP/IP and DHCP Ethernet setup Menu 3.2 - TCP/IP and DHCP Ethernet Setup DHCP= Server TCP/IP Setup: Client IP Pool: Starting Address= 192.168.1.2 IP Address= 192.168.1.1 Size of Client IP Pool= 126 IP Subnet Mask= 255.255.255.
Chapter 4 LAN setup Table 7 DHCP Ethernet setup menu fields N0115789 Field Description Example Size of Client IP Pool This field specifies the size or count of the IP address pool. 126 First DNS Server Second DNS Server Third DNS Server The Business Secure Router passes a DNS (Domain Name System) server IP address (in the order you specify here) to the DHCP clients. Select From ISP if your ISP dynamically assigns DNS server information (and the Business Secure Router's WAN IP address).
Chapter 4 LAN setup 57 Use the instructions in Table 8 to configure TCP/IP parameters for the LAN port. Table 8 LAN TCP/IP setup menu fields Field Description Example IP Address Enter the IP address of your Business Secure Router in dotted decimal notation. 192.168.1.1 (default) IP Subnet Mask Your Business Secure Router automatically calculates the subnet mask based on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the Business Secure Router.
Chapter 4 LAN setup Figure 14 Menu 3.2.1: IP Alias setup Menu 3.2.1 - IP Alias Setup IP Alias 1= No IP Address= N/A IP Subnet Mask= N/A RIP Direction= N/A Version= N/A Incoming protocol filters= N/A Outgoing protocol filters= N/A IP Alias 2= No IP Address= N/A IP Subnet Mask= N/A RIP Direction= N/A Version= N/A Incoming protocol filters= N/A Outgoing protocol filters= N/A Enter here to CONFIRM or ESC to CANCEL: Press Space Bar to Toggle.
Chapter 4 LAN setup 59 Table 9 IP Alias setup menu field Field Description Example RIP Direction Press [SPACE BAR] and then [ENTER] to select the RIP direction. Options are Both, In Only, Out Only or None. None Version Press [SPACE BAR] and then [ENTER] to select the RIP version. Options are RIP-1, RIP-2B or RIP-2M. RIP-1 Incoming Protocol Filters Enter the filter sets you wish to apply to the incoming traffic between this node and the Business Secure Router.
Chapter 4 LAN setup N0115789
Chapter 5 Internet access This chapter shows you how to configure your Business Secure Router for Internet access. Introduction to internet access setup Use the information from your ISP along with the instructions in this chapter to set up your Business Secure Router to access the Internet. There are three different menu 4 screens, depending on whether you chose Ethernet, PPTP or PPPoE Encapsulation. Contact your ISP to determine which encapsulation type you should use.
Chapter 5 Internet access Figure 15 Menu 4: internet access setup (Ethernet) Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Retype to Confirm= N/A Login Server IP= N/A IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Address= N/A Network Address Translation= SUA Only Press ENTER to Confirm or ESC to Cancel: Table 10 describes the fields in Figure 15.
Chapter 5 Internet access 63 Table 10 Menu 4: internet access setup menu fields Field Description Retype to Confirm Enter the password again to make sure that you have entered it correctly. Login Server The Business Secure Router finds the Road Runner Server IP if this field is left blank. If it does not, then you must enter the authentication server IP address.
Chapter 5 Internet access After configuring My Login and Password for PPP connection, press [SPACE BAR] and then [ENTER] in the Encapsulation field in Menu 4 -Internet Access Setup to choose PPTP as your encapsulation option. This brings up the screen show in Figure 16.
Chapter 5 Internet access 65 Figure 17 Internet access setup (PPPoE) Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= PPPoE Service Type= N/A My Login= My Password= ******** Retype to Confirm= ****** Idle Timeout= 100 IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Address= N/A Network Address Translation= Full Feature Press ENTER to Confirm or ESC to Cancel: Press Space Bar to Toggle. Table 12 describes the fields in Figure 17.
Chapter 5 Internet access Basic setup complete Well done! You have successfully connected, installed and set up your Business Secure Router to operate on your network, as well as access the Internet. Note: When the firewall is activated, the default policy can communicate to the Internet if the communication originates from the LAN, and blocks all traffic to the LAN that originates from the Internet. You can deactivate the firewall in menu 21.2 or via the Business Secure Router embedded WebGUI.
Chapter 6 Remote Node setup This chapter shows you how to configure a remote node. Introduction to Remote Node setup A remote node is required for placing calls to a remote gateway. A remote node represents both the remote gateway and the network behind it across a WAN connection. Note that when you use menu 4 to set up Internet access, you are actually configuring a remote node. The following describes how to configure Menu 11.1 Remote Node Profile, Menu 11.1.
Chapter 6 Remote Node setup Figure 18 Menu 11 Remote Node Setup Menu 11 - Remote Node Setup 1. ChangeMe (ISP, SUA) 2. -GUI (BACKUP_ISP, SUA) Enter Node # to Edit: Remote Node profile setup This section explains how to configure the remote node profile menu. Ethernet Encapsulation There are two variations of menu 11.1 depending on whether you choose Ethernet Encapsulation or PPPoE Encapsulation. You must choose the Ethernet option when the WAN port is used as a regular Ethernet. The first menu 11.
Chapter 6 Remote Node setup 69 Figure 19 Menu 11.1: Remote Node profile for Ethernet Encapsulation Menu 11.1 - Remote Node Profile Rem Node Name= ChangeMe Active= Yes Route= IP Encapsulation= Ethernet Service Type= Standard Service Name= N/A Outgoing: My Login= N/A My Password= N/A Retype to Confirm= N/A Server= N/A Edit IP= No Session Options: Edit Filter Sets= No Edit Traffic Redirect= No Press ENTER to Confirm or ESC to Cancel: Press Space Bar to Toggle. Table 13 describes the fields in Figure 19.
Chapter 6 Remote Node setup Table 13 Fields in menu 11.1 Field Description Example Service Name If you are using PPPoE encapsulation, then type the name of your PPPoE service here. Only valid with PPPoE encapsulation. poellc Outgoing My Login This field is applicable for PPPoE encapsulation only. Enter the logon name assigned by your ISP when the Business Secure Router calls this remote node. Some ISPs append this field to the Service Name field above (e.g., jim@poellc) to access the PPPoE server.
Chapter 6 Remote Node setup 71 Figure 20 Menu 11.1: Remote Node profile for PPPoE Encapsulation Menu 11.
Chapter 6 Remote Node setup Nailed-Up Connection A nailed-up connection is a dial-up line where the connection is always up, regardless of traffic demand. The Business Secure Router does two things when you specify a nailed-up connection. The first is that idle timeout is disabled. The second is that the Business Secure Router tries to bring up the connection when turned on and whenever the connection is down. A nailed-up connection can be very expensive.
Chapter 6 Remote Node setup 73 PPTP Encapsulation If you change the Encapsulation to PPTP in menu 11.1, then you will see the next screen. See Appendix F, “PPTP,” on page 231 for information about PPTP. Figure 21 Menu 11.1: Remote Node Profile for PPTP Encapsulation Menu 11.
Chapter 6 Remote Node setup Table 15 Fields in Menu 11.1 (PPTP Encapsulation) Field Description Example Connection ID/ Name Enter the connection ID or connection name in the N:My ISP ANT. It must follow the “c:id” and “n:name” format. This field is optional and depends on the requirements of your DSL modem. Schedules You can apply up to four call schedule sets here.
Chapter 6 Remote Node setup 75 Figure 22 Menu 11.1.2: Remote Node Network Layer Options for Ethernet Encapsulation Menu 11.1.2 - Remote Node Network Layer Options IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Addr= N/A Network Address Translation= SUA Only Metric= N/A Private= N/A RIP Direction= None Version= N/A Multicast= None Enter here to CONFIRM or ESC to CANCEL: Press Space Bar to Toggle.
Chapter 6 Remote Node setup Table 16 Remote Node Network Layer Options Menu Fields N0115789 Field Description Example Gateway IP Addr This field is applicable to Ethernet encapsulation only. Enter the gateway IP address assigned to you if you are using a static IP address. My WAN Addr This field is applicable to PPPoE and PPTP encapsulations only.
Chapter 6 Remote Node setup 77 Table 16 Remote Node Network Layer Options Menu Fields Field Description Example Version Press [SPACE BAR] and then [ENTER] to select the RIP version from RIP-1/RIP-2B/RIP-2M or None. N/A Multicast IGMP (Internet Group Multicast Protocol) is a None network-layer protocol used to establish membership in a (default) Multicast group. The Business Secure Router supports both IGMP version 1 (IGMP-v1) and version 2 (IGMP-v2).
Chapter 6 Remote Node setup Figure 23 Menu 11.1.4: Remote Node filter (Ethernet Encapsulation) Menu 11.1.4 - Remote Node Filter Input Filter Sets: protocol filters= device filters= Output Filter Sets: protocol filters= device filters= Enter here to CONFIRM or ESC to CANCEL: Figure 24 Menu 11.1.4: Remote Node filter (PPPoE or PPTP Encapsulation) Menu 11.1.
Chapter 6 Remote Node setup 79 Figure 25 Menu 11.1: Remote Node Profile Menu 11.1 - Remote Node Profile Rem Node Name= ChangeMe Active= Yes Route= IP Encapsulation= Ethernet Service Type= Standard Service Name= N/A Outgoing: My Login= N/A My Password= N/A Retype to Confirm= N/A Server= N/A Edit IP= No Session Options: Edit Filter Sets= No Edit Traffic Redirect= No Press ENTER to Confirm or ESC to Cancel: Press Space Bar to Toggle.
Chapter 6 Remote Node setup Traffic Redirect setup Configure parameters that determine when the Business Secure Router forwards WAN traffic to the backup gateway using Menu 11.1.5 — Traffic Redirect Setup. Figure 26 Menu 11.1.5: Traffic Redirect setup Menu 11.1.5 - Traffic Redirect Setup Active= Yes Configuration: Backup Gateway IP Address= 0.0.0.0 Metric= 15 Check WAN IP Address= 0.0.0.
Chapter 6 Remote Node setup 81 Table 18 Menu 11.1.5: Traffic Redirect setup Field Description Example Check WAN IP Address Enter the IP address of a reliable nearby computer (for example, your ISP’s DNS server address) to test your Business Secure Router’s WAN accessibility. The Business Secure Router uses the default gateway IP address if you do not enter an IP address here. If you are using PPTP or PPPoE Encapsulation, enter 0.0.0.
Chapter 6 Remote Node setup N0115789
Chapter 7 IP Static Route Setup This chapter shows you how to configure static routes with your Business Secure Router. IP Static Route Setup Enter 12 from the main menu. Select one of the IP static routes as shown in Figure 27 to configure IP static routes in menu 12. 1. Note: The “Reserved” static route entry is for the default WAN route. You cannot modify or delete a static default route. Figure 27 Menu 12: IP Static Route Setup Menu 12 - IP Static Route Setup 1. Reserved 2. ________ 3. ________ 4.
Chapter 7 IP Static Route Setup 12. ________ Enter selection number: Now, enter the index number of the static route that you want to configure. Figure 28 Menu 12. 1: Edit IP Static Route Menu 12.1 - Edit IP Static Route Route #: 2 Route Name= ? Active= No Destination IP Address= ? IP Subnet Mask= ? Gateway IP Address= ? Metric= 2 Private= No Press ENTER to CONFIRM or ESC to CANCEL: Table 19 describes the IP Static Route Menu fields.
Chapter 7 IP Static Route Setup 85 Table 19 IP Static Route Menu Fields Field Description Metric Enter a number from 1 to 15 to set the priority for the route among the Business Secure Router routes. The smaller the number, the higher priority the route has. Private This parameter determines if the Business Secure Router includes the route to this remote node in its RIP broadcasts. If set to Yes, this route is kept private and not included in RIP broadcast.
Chapter 7 IP Static Route Setup N0115789
Chapter 8 Dial-in User Setup This chapter shows you how to create user accounts on the Business Secure Router. Dial-in User Setup By storing user profiles locally, your Business Secure Router can authenticate users without interacting with a network RADIUS server. Follow the steps below to set up user profiles on your Business Secure Router. From the main menu, enter 14 to display Menu 14 - Dial-in User Setup. Figure 29 Menu 14- Dial-in User Setup Menu 14 - Dial-in User Setup 1. 2. 3. 4. 5. 6. 7. 8.
Chapter 8 Dial-in User Setup Figure 30 Menu 14.1- Edit Dial-in User Menu 14.1 - Edit Dial-in User User Name= test Active= Yes Password= ******** Press ENTER to Confirm or ESC to Cancel: Leave name field blank to delete profile Table 20 describes the fields in Figure 30. Table 20 Menu 14.1- Edit Dial-in User Field Description User Name Enter a username up to 31 alphanumeric characters long for this user profile. This field is case sensitive.
Chapter 9 Network Address Translation (NAT) This chapter discusses how to configure NAT on the Business Secure Router. Using NAT Note: You must create a firewall rule in addition to setting up SUA/ NAT, to allow traffic from the WAN to be forwarded through the Business Secure Router. SUA (Single User Account) Versus NAT SUA (Single User Account) is an implementation of a subset of NAT that supports two types of mapping, Many-to-One and Server.
Chapter 9 Network Address Translation (NAT) Figure 31 Menu 4: Applying NAT for Internet Access Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Retype to Confirm= N/A Login Server= N/A IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Address= N/A Network Address Translation= SUA Only Press ENTER to Confirm or ESC to Cancel: Press ENTER to Confirm or ESC to Cancel: Figure 32 shows how you apply
Chapter 9 Network Address Translation (NAT) 91 Figure 32 Menu 11.1.2: Applying NAT to the Remote Node Menu 11.1.2 - Remote Node Network Layer Options IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Addr= N/A Network Address Translation= Full Feature Metric= N/A Private= N/A RIP Direction= None Version= N/A Multicast= None Enter here to CONFIRM or ESC to CANCEL: Table 21 describes the fields in Figure 32. Table 21 Applying NAT in Menus 4 & 11.1.
Chapter 9 Network Address Translation (NAT) NAT setup Use the address mapping sets menus and submenus to create the mapping table used to assign global addresses to computers on the LAN. You can see two NAT address mapping sets in menu 15.1. You can only configure Set 1. Set 255 is used for SUA. When you select Full Feature in menu 4 or 11.1.2, the SMT uses Set 1. When you select SUA Only, the SMT uses the pre-configured Set 255 (read only).
Chapter 9 Network Address Translation (NAT) 93 Figure 34 Menu 15.1: Address Mapping Sets Menu 15.1 — Address Mapping Sets 1. NAT_SET 255. SUA (read only) Enter Menu Selection Number: SUA Address Mapping Set Enter 255 to display the screen shown in Figure 35 (see “SUA (Single User Account) Versus NAT” on page 89). The fields in this menu cannot be changed.
Chapter 9 Network Address Translation (NAT) Figure 35 Menu 15.1.255: SUA Address Mapping Rules Menu 15.1.255 - Address Mapping Rules Set Name= SUA Idx Local Start IP Local End IP --- --------------- --------------- 0.0.0.0 255.255.255.255 1. 2. Global Start IP --------------- Global End IP Type --------------- ------ 0.0.0.0 M-1 0.0.0.0 Server 3. 4. 5. 6. 7. 8. 9. 10. Press ENTER to Confirm or ESC to Cancel: Table 22 explains the fields in Figure 35. Note: Menu 15.1.255 is read-only.
Chapter 9 Network Address Translation (NAT) 95 Table 22 SUA Address Mapping Rules Field Description Example Local End IP Local End IP is the ending local IP address (ILA). If 255.255.255.255 the rule is for all local IPs, then the start IP is 0.0.0.0 and the end IP is 255.255.255.255. Global Start IP This is the starting global IP address (IGA). If you 0.0.0.0 have a dynamic IP, enter 0.0.0.0 as the Global Start IP. Global End IP This is the ending global IP address (IGA).
Chapter 9 Network Address Translation (NAT) Figure 36 Menu 15.1.1: First Set Menu 15.1.1 - Address Mapping Rules Set Name= NAT_SET Idx Local Start IP Local End IP --- --------------- --------------- Global Start IP --------------- Global End IP Type --------------- ------ 1. 2 3. 4. 5. 6. 7. 8. 9. 10. Action= Edit Select Rule= Press ENTER to Confirm or ESC to Cancel: Note: The Type, Local and Global Start/End IPs are configured in menu 15.1.1.
Chapter 9 Network Address Translation (NAT) 97 have already configured rules 1 to 6 in your current set and now you configure rule number 9. In the set summary screen, the new rule will be rule 7, not 9. If you delete rule 4, rules 5 to 7 will be pushed up by 1 rule, so as old rule 5 becomes rule 4, old rule 6 becomes rule 5 and old rule 7 becomes rule 6. Table 23 Fields in menu 15.1.1 Field Description Example Set Name Enter a name for this set of rules. This is a required field.
Chapter 9 Network Address Translation (NAT) Figure 37 Menu 15.1.1.1: Editing or configuring an individual rule in a set Menu 15.1.1.1 Address Mapping Rule Type= One-to-One Local IP: Start= End = N/A Global IP: Start= End = N/A Press ENTER to Confirm or ESC to Cancel: Table 24 describes the fields in Figure 37. Table 24 Menu 15.1.1.1: Editing or configuring an individual rule in a set Field Description Example Type Press [SPACE BAR] and then [ENTER] to select from a total of five types.
Chapter 9 Network Address Translation (NAT) 99 Table 24 Menu 15.1.1.1: Editing or configuring an individual rule in a set Field Global IP Start End Description Example Enter the starting global IP address (IGA). If you have a dynamic IP, enter 0.0.0.0 as the Global IP Start. Note that Global IP Start can be set to 0.0.0.0 only if the types are Many-to-One or Server. 0.0.0.0 Enter the ending global IP address (IGA). This field is N/A for N/A One-to-One, Many-to-One and Server types.
Chapter 9 Network Address Translation (NAT) Figure 38 Menu 15.2: NAT Server Sets Menu 15.2 - NAT Server Setup Default Server: 0.0.0.0 Rule Act. Start Port End Port IP Address -----------------------------------------------------001 No 0 0 0.0.0.0 002 No 0 0 0.0.0.0 003 No 0 0 0.0.0.0 004 No 0 0 0.0.0.0 005 No 0 0 0.0.0.0 006 No 0 0 0.0.0.0 007 No 0 0 0.0.0.0 008 No 0 0 0.0.0.0 009 No 0 0 0.0.0.0 010 No 0 0 0.0.0.
Chapter 9 Network Address Translation (NAT) 101 Figure 39 15.2.1: NAT Server Configuration 15.2.1 - NAT Server Configuration Index= 1 ----------------------------------------------------------------Name= Active= No Start port= 0 End port= 0 IP Address= 0.0.0.0 Press ENTER to Confirm or ESC to Cancel: The following table describes the fields in this screen. Table 25 15.2.1: NAT Server Configuration Field Description Index This is the index number of an individual port forwarding server entry.
Chapter 9 Network Address Translation (NAT) 5 Enter the inside IP address of the server in the IP Address field. In the following figure, you have a computer acting as an FTP, Telnet and SMTP server (ports 21, 23 and 25) at 192.168.1.33. 6 Press [ENTER] at the “Press ENTER to confirm …” prompt to save your configuration after you define all the servers or press [ESC] at any time to cancel. Figure 40 Menu 15.2: NAT Server Setup Menu 15.2 - NAT Server Setup Default Server: 0.0.0.0 Rule Act.
Chapter 9 Network Address Translation (NAT) 103 Figure 41 Multiple servers behind NAT example BCM50e Integrated Router General NAT examples The following are some examples of NAT configuration. Internet access only In the Internet access example shown in Figure 42, you only need one rule where all your ILAs (Inside Local addresses) map to one dynamic IGA (Inside Global Address) assigned by your ISP.
Chapter 9 Network Address Translation (NAT) Figure 43 Menu 4: Internet access & NAT example Menu 4 - Internet Access Setup ISP's Name= ChangeMe Encapsulation= Ethernet Service Type= Standard My Login= N/A My Password= N/A Login Server IP= N/A IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Address= N/A Network Address Translation= SUA Only Press ENTER to Confirm or ESC to Cancel: From menu 4 shown above, simply choose the SUA Only option from the Network Address Translatio
Chapter 9 Network Address Translation (NAT) 105 Example 2: Internet access with an inside server Figure 44 NAT Example 2 BCM50e Integrated Router In this case, you do exactly as shown in Figure 44 (use the convenient pre-configured SUA Only set), and also go to menu 15.2 to specify the Inside Server behind the NAT as shown in Figure 45.
Chapter 9 Network Address Translation (NAT) Figure 45 Menu 15.2: Specifying an inside server Menu 15.2 - NAT Server Setup Default Server: 192.168.1.10 Rule Act. Start Port End Port IP Address -----------------------------------------------------001 No 0 0 0.0.0.0 002 No 0 0 0.0.0.0 003 No 0 0 0.0.0.0 004 No 0 0 0.0.0.0 005 No 0 0 0.0.0.0 006 No 0 0 0.0.0.0 007 No 0 0 0.0.0.0 008 No 0 0 0.0.0.0 009 No 0 0 0.0.0.0 010 No 0 0 0.0.0.
Chapter 9 Network Address Translation (NAT) 107 The example situation looks like this: Figure 46 NAT example 3 BCM50e Integrated Router 1 In this case you must configure Address Mapping Set 1 from Menu 15.1 Address Mapping Sets. Therefore, you must choose the Full Feature option from the Network Address Translation field (in menu 4 or menu 11.1.2) (see Figure 47). 2 Enter 15 from the main menu. 3 Enter 1 to configure the Address Mapping Sets. 4 Enter 1 to begin configuring this new set.
Chapter 9 Network Address Translation (NAT) Figure 47 Example 3: Menu 11.1.2 Menu 11.1.2 - Remote Node Network Layer Options IP Address Assignment= Dynamic IP Address= N/A IP Subnet Mask= N/A Gateway IP Addr= N/A Network Address Translation= Full Feature Metric= N/A Private= N/A RIP Direction= None Version= N/A Enter here to CONFIRM or ESC to CANCEL: Figure 48 shows how to configure the first rule.
Chapter 9 Network Address Translation (NAT) 109 Figure 48 Example 3: Menu 15.1.1.1 Menu 15.1.1.1 Address Mapping Rule Type= One-to-One Local IP: Start= 192.168.1.10 End = N/A Global IP: Start= 10.132.50.
Chapter 9 Network Address Translation (NAT) Figure 49 Example 3: Final Menu 15.1.1 Menu 15.1.1 - Address Mapping Rules Set Name= Example3 Idx Local Start IP Local End IP --- --------------- --------------- Global Start IP --------------- Global End IP Type --------------- ------ 1. 192.168.1.10 10.132.50.1 1-1 2 10.132.50.2 1-1 10.132.50.3 M-1 192.168.1.11 3. 0.0.0.0 255.255.255.255 4. 10.132.50.3 Server 5. 6. 7. 8. 9. 10.
Chapter 9 Network Address Translation (NAT) 111 Figure 50 Example 3: Menu 15.2 Menu 15.2 - NAT Server Setup Default Server: 0.0.0.0 Rule Act. Start Port End Port IP Address -----------------------------------------------------001 Yes 80 80 192.168.1.21 002 Yes 25 25 192.168.1.20 003 No 0 0 0.0.0.0 004 No 0 0 0.0.0.0 005 No 0 0 0.0.0.0 006 No 0 0 0.0.0.0 007 No 0 0 0.0.0.0 008 No 0 0 0.0.0.0 009 No 0 0 0.0.0.0 010 No 0 0 0.0.0.
Chapter 9 Network Address Translation (NAT) Figure 51 Menu 15.3: Trigger Port Setup Menu 15.3 - Trigger Port Setup Incoming Rule Name Start Port Trigger End Port Start Port End Port ---------------------------------------------------------------------1. Real Audio 6970 7170 7070 7070 2. 0 0 0 0 3. 0 0 0 0 4. 0 0 0 0 5. 0 0 0 0 6. 0 0 0 0 7. 0 0 0 0 8. 0 0 0 0 9. 0 0 0 0 10. 0 0 0 0 11. 0 0 0 0 12.
Chapter 9 Network Address Translation (NAT) 113 Table 26 Menu 15.3: Trigger Port setup description Field Description Example End Port Enter a port number or the ending port number in a range of port 7170 numbers. Trigger The trigger port is a port (or a range of ports) that causes (or triggers) the Business Secure Router to record the IP address of the LAN computer that sent the traffic to a server on the WAN. Start Port Enter a port number or the starting port number in a range of port numbers.
Chapter 9 Network Address Translation (NAT) N0115789
Chapter 10 Introducing the firewall This chapter shows you how to get started with the firewall. Using SMT menus From the main menu enter 21 to go to Menu 21 - Filter Set and Firewall Configuration to display the screen shown in Figure 52. Figure 52 Menu 21: Filter and Firewall Setup Menu 21 - Filter and Firewall Setup 1. Filter Setup 2. Firewall Setup Enter Menu Selection Number: Activating the firewall Enter option 2 in this menu to bring up the screen shown in Figure 53.
Chapter 10 Introducing the firewall Figure 53 Menu 21.2: Firewall Setup Menu 21.2 - Firewall Setup The firewall protects against Denial of Service (DoS) attacks when it is active. Your network is vulnerable to attacks when the firewall is turned off. Refer to the User’s Guide for details about the firewall default policies. You may define additional Policy rules or modify existing ones but please exercise extreme caution in doing so. Active: Yes You can use the WebGUI to configure the firewall.
Chapter 11 Filter configuration This chapter shows you how to create and apply filters. Introduction to filters Your Business Secure Router uses filters to decide whether to allow passage of a data packet, make a call, or both. There are two types of filter applications: data filtering and call filtering. Filters are subdivided into device and protocol filters. Data filtering screens the data to determine if the packet is allowed to pass.
Chapter 11 Filter configuration Figure 54 Outgoing packet filtering process C all Filtering O utgoing P acket D ata Filtering N o m atch M atch D rop packet B uilt-in default C all Filters N o m atch U ser-defined C all Filters (if applicable) M atch D roppacket if linenot up N o m atch A ctiveD ata Initiatecall if linenot up S endpacket andreset IdleTim er M atch D roppacket if linenot up O r O r S endpacket but donot reset IdleTim er S endpacket but donot reset IdleTim er For incom
Chapter 11 Filter configuration 119 Figure 55 Filter rule process Start Packet into filter Fetch First Filter Set Filter Set Fetch Next Filter Set Fetch First Filter Rule Fetch Next Filter Rule Yes Yes Next Filter Set Available? No Next filter Rule Available? No Active? Yes No Check Next Rule Execute Filter Rule Forward Drop Drop Packet Accept Packet You can apply up to four filter sets to a particular port to block multiple types of packets.
Chapter 11 Filter configuration Configuring a Filter Set The Business Secure Router includes filtering for NetBIOS over TCP/IP packets by default. To configure another filter set, follow the procedure below. 1 Enter 21 in the main menu to open menu 21. Figure 56 Menu 21: Filter and Firewall Setup Menu 21 - Filter and Firewall Setup 1. Filter Setup 2.
Chapter 11 Filter configuration 121 2 Enter 1 to bring up the menu 21.1. Figure 57 Menu 21.1: Filter Set Configuration Menu 21.
Chapter 11 Filter configuration Table 27 Abbreviations used in the Filter Rules Summary Menu Field Description # The filter rule number: 1 to 6. A Active: “Y” means the rule is active. “N” means the rule is inactive. Type The type of filter rule: “GEN” for Generic, “IP” for TCP/IP. Filter Rules These parameters are displayed here. M More: “Y” means there are more rules to check which form a rule chain with the present rule. An action cannot be taken until the rule chain is complete.
Chapter 11 Filter configuration 123 Configuring a Filter Rule To configure a filter rule, type its number in Menu 21.1.1 - Filter Rules Summary and press [ENTER] to open menu 21.1.1.1 for the rule. To speed up filtering, all rules in a filter set must be of the same class, for example, protocol filters or generic filters. The class of a filter set is determined by the first rule that you create. When applying the filter sets to a port, separate menu fields are provided for protocol and device filter sets.
Chapter 11 Filter configuration Figure 58 Menu 21.1.1.1: TCP/IP Filter Rule Menu 21.1.1.2 - TCP/IP Filter Rule Filter #: 1,2 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 0 IP Source Route= No Destination: IP Addr= IP Mask= Port #= Port # Comp= None Source: IP Addr= IP Mask= Port #= Port # Comp= None TCP Estab= N/A More= No Log= None Action Matched= Check Next Rule Action Not Matched= Check Next Rule Press ENTER to Confirm or ESC to Cancel: Press Space Bar to Toggle.
Chapter 11 Filter configuration 125 Table 29 TCP/IP Filter Rule Menu fields Field Description Options IP Address Enter the destination IP Address of the packet you wish to filter. This field is ignored if it is 0.0.0.0. 0.0.0.0 IP Mask Enter the IP mask to apply to the Destination: IP Addr. 0.0.0.0 Port # Enter the destination port of the packets that you wish to filter. The range of this field is 0 to 65 535. This field is ignored if it is 0.
Chapter 11 Filter configuration Table 29 TCP/IP Filter Rule Menu fields Field Description Options Log Press [SPACE BAR] and then [ENTER] to select a logging option from the following: None – No packets are logged. Action Matched - Only packets that match the rule parameters are logged. Action Not Matched - Only packets that do not match the rule parameters are logged. Both – All packets are logged.
Chapter 11 Filter configuration 127 Figure 59 Executing an IP filter Packet into IP Filter Filter Active? No Yes Apply SrcAddrMask to Src Addr Check Src IP Addr Not Matched Matched Apply DestAddrMask to Dest Addr Check Dest IP Addr Not Matched Matched Check IP Protocol Not Matched Matched Check Src & Dest Port Not Matched Matched More? Yes No Action Matched Drop Drop Packet Action Not Matched Check Next Rule Check Next Rule Drop Forward Forward Check Next Rule Accept Packet BCM50e Integra
Chapter 11 Filter configuration Configuring a Generic Filter Rule This section shows you how to configure a generic filter rule. With generic rules you can filter non-IP packets. For IP packets, it is generally easier to use the IP rules directly. For generic rules, the Business Secure Router treats a packet as a byte stream as opposed to an IP or IPX packet. You specify the portion of the packet to check with the Offset (from 0) and the Length fields, both in bytes.
Chapter 11 Filter configuration 129 Table 30 describes the fields in the Generic Filter Rule menu. Table 30 Generic Filter Rule Menu fields Field Description Options Filter # This is the filter set, filter rule coordinates, for example, 2,3 refers to the second filter set and the third rule of that set. Filter Type Use [SPACE BAR] and then [ENTER] to select a rule type. Parameters displayed below each type will be different.
Chapter 11 Filter configuration Table 30 Generic Filter Rule Menu fields Field Description Options Action Not Matched Select the action for a packet not matching the rule. Check Next Rule Forward Drop After you complete filling in Menu 21.1.1.1 - Generic Filter Rule, press [ENTER] at the message “Press ENTER to Confirm” to save your configuration, or press [ESC] to cancel. This data is now be displayed on Menu 21.1.1 Filter Rules Summary.
Chapter 11 Filter configuration 131 3 Enter the index of the filter set you wish to configure (for example 3) and press [ENTER]. 4 Enter a descriptive name or comment in the Edit Comments field and press [ENTER]. 5 Press [ENTER] at the message [Press ENTER to confirm] to open Menu 21.1.3 - Filter Rules Summary. 6 Enter 1 to configure the first filter rule (the only filter rule of this set). Make the entries in this menu as shown in Figure 62. Figure 62 Example Filter: Menu 21.1.3.1 Menu 21.1.3.
Chapter 11 Filter configuration Figure 63 Example Filter Rules Summary: Menu 21.1.3 Menu 21.1.3 - Filter Rules Summary # A Type Filter Rules M m n - - ---- --------------------------------------------------------------- - 1 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=23 N D F 2 N 3 N 4 N 5 N 6 N Enter Filter Rule Number (1-6) to Configure: 1 After you have created the filter set, you must apply it. N0115789 1 Enter 11 from the main menu to go to menu 11. 2 Then enter 1 to open Menu 11.
Chapter 11 Filter configuration 133 Filter Types and NAT There are two classes of filter rules, Generic Filter (Device) rules and protocol filter (TCP/IP) rules. Generic filter rules act on the raw data that’s going through between LAN and WAN. Protocol filter rules act on the IP packets. Generic and TCP/IP filter rules are discussed in more detail in the next section.
Chapter 11 Filter configuration Applying a Filter This section shows you where to apply the filters after you design them. The Business Secure Router already has filters to prevent NetBIOS traffic from triggering calls, and block incoming Telnet, FTP and HTTP connections. Note: Nortel recommends that you apply filters if you do not activate the firewall. Applying LAN Filters LAN traffic filter sets are useful to block certain packets, reduce traffic and prevent security breaches. Go to menu 3.
Chapter 11 Filter configuration 135 Applying Remote Node Filters Go to menu 11.1.4 (shown in Figure 66 – note that call filter sets are only present for PPPoE encapsulation) and enter the numbers of the filter sets, as appropriate. You can cascade up to four filter sets by entering their numbers separated by commas. The Business Secure Router already has filters to prevent NetBIOS traffic from triggering calls, and to block incoming Telnet, FTP and HTTP connections.
Chapter 11 Filter configuration N0115789
Chapter 12 SNMP Configuration This chapter explains SNMP configuration menu 22. Note: SNMP is only available if TCP/IP is configured. SNMP Configuration To configure SNMP, enter 22 from the main menu to display Menu 22 - SNMP Configuration as shown next. The community for Get, Set and Trap fields is SNMP terminology for password. Figure 67 Menu 22: SNMP Configuration Menu 22 - SNMP Configuration SNMP: Get Community= Set Community= Trusted Host= 0.0.0.0 Trap: Community= Destination= 0.0.0.
Chapter 12 SNMP Configuration Table 31 describes the SNMP configuration parameters. Table 31 SNMP Configuration Menu Fields Field Description Example Get Community Type the Get community, which is the password for the incoming Get- and GetNext requests from the management station. Public (default) Set Community Type the Set community, which is the password for incoming Set requests from the management station.
Chapter 12 SNMP Configuration 139 Table 32 SNMP Traps Trap # Trap Name Description 6 whyReboot (defined in MIB) A trap is sent with the reason of restart before rebooting when the system is going to restart (warm start). 6a For intentional reboot: A trap is sent with the message "System reboot by user!" if reboot is done intentionally, (for example, download new files, CI command "sys reboot", and others).
Chapter 12 SNMP Configuration N0115789
Chapter 13 System security This chapter describes how to configure the system security on the Business Secure Router. System security You can configure the system password, an external RADIUS server and 802.1x in this menu. System password Figure 68 Menu 23 System security Menu 23 - System Security 1. Change Password 2. RADIUS Server 4. IEEE802.1x Enter Menu Selection Number: Nortel recommends you change the default password.
Chapter 13 System security Configuring external RADIUS server Enter 23 in the main menu to display Menu 23 – System security. Figure 69 Menu 23 system security Menu 23 - System Security 1. Change Password 2. RADIUS Server 4. IEEE802.1x Enter Menu Selection Number: From Menu 23- System Security, enter 2 to display Menu 23.2 – System Security – RADIUS Server, as shown in Figure 70. Figure 70 Menu 23.2 System Security: RADIUS server Menu 23.
Chapter 13 System security 143 Table 33 describes the fields in Figure 70. Table 33 Menu 23.2 System Security: RADIUS Server Field Description Authentication Server Active Press [SPACE BAR] to select Yes and press [ENTER] to enable user authentication through an external authentication server. Server Address Enter the IP address of the external authentication server in dotted decimal notation. Port # The default port of the RADIUS server for authentication is 1812.
Chapter 13 System security N0115789
Chapter 14 System information and diagnosis This chapter covers SMT menus 24.1 to 24.4. Introduction to System Status This chapter covers the diagnostic tools that help you to maintain your Business Secure Router. These tools include updates on system status, port status and log and trace capabilities. Select menu 24 in the main menu to open Menu 24 - System Maintenance, as shown in Figure 71.
Chapter 14 System information and diagnosis Figure 71 Menu 24: System Maintenance Menu 24 - System Maintenance 1. System Status 2. System Information and Console Port Speed 3. Log and Trace 4. Diagnostic 5. Backup Configuration 6. Restore Configuration 7. Upload Firmware 8. Command Interpreter Mode 9. Call Control 10. Time and Date Setting 11.
Chapter 14 System information and diagnosis 147 Figure 72 Menu 24.1: System Maintenance: Status Figure 73 Menu 24.1 — System Maintenance — Status Port WAN LAN Port WAN LAN Status Down 100M/Full Menu 24.1 - System Maintenance - Status 00:22:34 Sat. Jan. 01, 2000 TxPkts 0 0 Rx B/s 0 0 Ethernet Address 00:13:49:00:00:02 00:13:49:00:00:01 System up Time: RxPkts 0 0 Cols 0 0 IP Address 0.0.0.0 192.168.1.1 Tx B/s 0 0 IP Mask 0.0.0.0 255.255.255.
Chapter 14 System information and diagnosis Table 34 System Maintenance: Status Menu Fields Field Description Up Time Total amount of time the line has been up. Ethernet Address The Ethernet address of the port listed on the left. IP Address The IP address of the port listed on the left. IP Mask The IP mask of the port listed on the left. DHCP The DHCP setting of the port listed on the left. System up Time The total time the Business Secure Router has been on.
Chapter 14 System information and diagnosis 149 Figure 74 System Information and Console Port Speed Menu 24.2 - System Information and Console Port Speed 1. System Information 2. Console Port Speed Please enter selection: System Information System Information gives you information about your system, as shown in Figure 75. More specifically, it gives you information on your routing protocol, Ethernet address and IP address.
Chapter 14 System information and diagnosis Figure 75 Menu 24.2.1: System Maintenance Information Menu 24.2.1 - System Maintenance - Information Name: Routing: IP RAS F/W Version: VBCM222_2.6.0.0.002 | 07/24/2006 Country Code: 255 LAN Ethernet Address: 00:13:49:00:00:01 IP Address: 192.168.1.1 IP Mask: 255.255.255.
Chapter 14 System information and diagnosis 151 Console port speed You can change the speed of the console port through Menu 24.2.2 – Console Port Speed. Your Business Secure Router supports 9 600 (default), 19 200, 38 400, 57 600, and 115 200 b/s for the console port. Press [SPACE BAR] and then [ENTER] to select the desired speed in menu 24.2.2, as shown in Figure 76. Figure 76 Menu 24.2.2: System Maintenance: Change Console Port Speed Menu 24.2.
Chapter 14 System information and diagnosis Figure 78 Menu 24.3.2: System Maintenance: Syslog Logging Menu 24.3.2 - System Maintenance - Syslog Logging Syslog: Active= No Syslog Server IP Address= ? Log Facility= Local 1 Press ENTER to Confirm or ESC to Cancel Configure the syslog parameters described in Table 36 to activate syslog, and then choose what you want to log.
Chapter 14 System information and diagnosis 153 board = the hardware board ID line = the WAN ID in a board Channel = channel ID within the WAN call = the call reference number which starts from 1 and increments by 1 for each new call str = C01 Outgoing Call dev xx ch xx (dev:device No. ch:channel No.) L02 Tunnel Connected(L2TP) C02 OutCall Connected xxxx (means connected speed) xxxxx (means Remote Call Number) L02 Call Terminated C02 Call Terminated Jul 19 11:19:27 192.168.102.
Chapter 14 System information and diagnosis IP[…] is the packet header and S04>R01mD means filter set 4 (S) and rule 1 (R), match (m) drop (D). Src: Source Address Dst: Destination Address prot: Protocol (“TCP”,”UDP”,”ICMP”) spo: Source port dpo: Destination port Mar 03 10:39:43 202.132.155.97 RAS: GEN[fffffffffffnordff0080] }S05>R01mF Mar 03 10:41:29 202.132.155.97 RAS: GEN[00a0c5f502fnord010080] }S05>R01mF Mar 03 10:41:34 202.132.155.97 RAS: IP[Src=192.168.1.33 Dst=202.132.155.
Chapter 14 System information and diagnosis 155 Firewall log Firewall Log Message Format SdcmdSyslogSend(SYSLOG_FIREWALL, SYSLOG_NOTICE, buf); buf = IP[Src=xx.xx.xx.xx : spo=xxxx Dst=xx.xx.xx.
Chapter 14 System information and diagnosis Flags = 0x00 Fragment Offset = 0x00 Time to Live = 0xFE (254) Protocol = 0x06 (TCP) Header Checksum = 0xFB20 (64288) Source IP = 0xC0A80101 (192.168.1.1) Destination IP = 0x00000000 (0.0.0.0) TCP Header: Source Port = 0x0401 (1025) Destination Port = 0x000D (13) Sequence Number = 0x05B8D000 (95997952) Ack Number = 0x00000000 (0) Header Length = 24 Flags = 0x02 (....S.
Chapter 14 System information and diagnosis 157 Follow the procedure below to get to Menu 24.4 - System Maintenance – Diagnostic. 1 From the main menu, select option 24 to open Menu 24 - System Maintenance. 2 From this menu, select option 4. Diagnostic. This opens Menu 24.4 - System Maintenance - Diagnostic. Figure 80 Menu 24.4: System Maintenance: Diagnostic Menu 24.4 - System Maintenance - Diagnostic TCP/IP 1. Ping Host 2. WAN DHCP Release 3. WAN DHCP Renewal 4. PPPoE/PPTP Setup Test System 11.
Chapter 14 System information and diagnosis Figure 81 WAN & LAN DHCP BCM50e Integrated Router Table 37 describes the diagnostic tests available in menu 24.4 for your Business Secure Router and associated connections. Table 37 System Maintenance menu diagnostic Field Description Ping Host Enter 1 to ping any machine (with an IP address) on your LAN or WAN. Enter its IP address in the Host IP Address field below. WAN DHCP Release Enter 2 to release your WAN DHCP settings.
Chapter 15 Firmware and configuration file maintenance This chapter tells you how to backup and restore your configuration file, as well as upload new firmware and configuration files. Filename conventions The configuration file (often called the romfile or rom-0) contains the factory default settings in the menus such as password, DHCP Setup and TCP/IP Setup. It comes with a rom filename extension.
Chapter 15 Firmware and configuration file maintenance If your (T)FTP client does not allow you to have a destination filename different than the source, you must rename the firmware and config file names as the Business Secure Router only recognizes rom-0 and ras. Be sure you keep unaltered copies of both files for later use. Table 38 is a summary.
Chapter 15 Firmware and configuration file maintenance 161 Backup configuration Follow the instructions as shown in Menu 24.5 (Figure 82). Figure 82 Menu 24.5 - System Maintenance - Backup Configuration Menu 24.5 - System Maintenance - Backup Configuration To transfer the configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your Business Secure Router. Then type "nnadmin" and SMT password as requested. 3.
Chapter 15 Firmware and configuration file maintenance Example of FTP commands from the command line Figure 83 FTP Session Example 331 Enter PASS command Password: 230 Logged in ftp> bin 200 Type I OK ftp> get rom-0 config.rom 200 Port command okay 150 Opening data connection for STOR ras 226 File received OK ftp: 16384 bytes sent in 1.10Seconds 297.89Kbytes/sec. ftp> quit GUI-based FTP clients Table 39 describes some of the commands that you can see in GUI-based FTP clients.
Chapter 15 Firmware and configuration file maintenance 163 • • • You disable Telnet service in menu 24.11. You apply a filter in menu 3.1 (LAN) or in menu 11.1.4 (WAN) to block Telnet service. The IP address in the Secured Client IP field in menu 24.11 does not match the client IP. If it does not match, the Business Secure Router disconnects the Telnet session immediately.
Chapter 15 Firmware and configuration file maintenance 5 Use the TFTP client (see the example below) to transfer files between the Business Secure Router and the computer. The file name for the configuration file is “rom-0” (rom-zero, not capital o). Note: Telnet connection must be active and the SMT must be in CI mode before and during the TFTP transfer. For details on TFTP commands (see “TFTP command example” on page 164), consult the documentation of your TFTP client program.
Chapter 15 Firmware and configuration file maintenance 165 Table 40 General commands for GUI-based TFTP clients Command Description Binary Transfer the file in binary mode. Abort Stop transfer of the file. Refer to Chapter 17, “Remote Management,” on page 183 for information about configurations that disallow TFTP and FTP over WAN. Restore configuration This section shows you how to restore a previously saved configuration.
Chapter 15 Firmware and configuration file maintenance Figure 84 Telnet into Menu 24.6 Menu 24.6 -- System Maintenance - Restore Configuration To transfer the firmware and configuration file to your workstation, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your Business Secure Router. Then type "nnadmin" and SMT password as requested. 3.
Chapter 15 Firmware and configuration file maintenance 167 Restore using FTP session example Figure 85 Restore using FTP session example ftp> put config.rom rom-0 200 Port command okay 150 Opening data connection for STOR rom-0 226 File received OK 221 Goodbye for writing flash ftp: 16384 bytes sent in 0.06Seconds 273.07Kbytes/sec. ftp>quit Refer to Chapter 17, “Remote Management,” on page 183 to read about configurations that disallow TFTP and FTP over WAN.
Chapter 15 Firmware and configuration file maintenance Figure 86 Telnet Into Menu 24.7.1 Upload System Firmware Menu 24.7.1 - System Maintenance - Upload System Firmware To upload the system firmware, follow the procedure below: 1. Launch the FTP client on your workstation. 2. Type "open" and the IP address of your system. Then type "nnadmin" and SMT password as requested. 3.
Chapter 15 Firmware and configuration file maintenance 169 To upload the firmware and the configuration files, follow the examples in the rest of this chapter: FTP file upload command from the DOS prompt example 1 Launch the FTP client on your computer. 2 Enter “open”, followed by a space and the IP address of your Business Secure Router. 3 Press [ENTER] when prompted for a username. 4 Enter your password as requested (the default is “PlsChgMe!”). 5 Enter “bin” to set transfer mode to binary.
Chapter 15 Firmware and configuration file maintenance FTP Session Example of Firmware File Upload Figure 88 FTP Session Example of Firmware File Upload 331 Enter PASS command Password: 230 Logged in ftp> bin 200 Type I OK ftp> put firmware.bin ras 200 Port command okay 150 Opening data connection for STOR ras 226 File received OK ftp: 1103936 bytes sent in 1.10Seconds 297.89Kbytes/sec. ftp> quit More commands (found in GUI-based FTP clients) are listed earlier in this chapter.
Chapter 15 Firmware and configuration file maintenance 171 5 Launch the TFTP client on your computer and connect to the Business Secure Router. Set the transfer mode to binary before starting data transfer. 6 Use the TFTP client (see the example below) to transfer files between the Business Secure Router and the computer. The file name for the firmware is ras. Note that the telnet connection must be active and the Business Secure Router must be in CI mode before and during the TFTP transfer.
Chapter 15 Firmware and configuration file maintenance N0115789
Chapter 16 System Maintenance menus 8 to 10 This chapter leads you through SMT menus 24.8 to 24.10. Command Interpreter mode The Command Interpreter (CI) is a part of the main router firmware. The CI provides much of the same functionality as the SMT, while adding some low-level setup and diagnostic functions. Enter the CI from the SMT by selecting menu 24.8. Access can be by Telnet connection, although some commands are only available with a serial connection. See the included disk or www.nortel.
Chapter 16 System Maintenance menus 8 to 10 Figure 89 Command mode in Menu 24 Menu 24 - System Maintenance 1. System Status 2. System Information and Console Port Speed 3. Log and Trace 4. Diagnostic 5. Backup Configuration 6. Restore Configuration 7. Firmware Update 8. Command Interpreter Mode 9. Call Control 10. Time and Date Setting 11. Remote Management Setup Enter Menu Selection Number: Command syntax The command keywords are in Courier New font.
Chapter 16 System Maintenance menus 8 to 10 175 means that you must specify the type of netbios filter and whether to turn it on or off. Command usage A list of commands can be found by typing help or ? at the command prompt. Always type the full command. Type exit to return to the SMT main menu when finished.
Chapter 16 System Maintenance menus 8 to 10 Call control support The Business Secure Router provides two call control functions: budget management and call history. Note that this menu is only applicable when Encapsulation is set to PPPoE or PPTP in menu 4 or menu 11.1. With the budget management function, you can set a limit on the total outgoing call time of the Business Secure Router within certain times.
Chapter 16 System Maintenance menus 8 to 10 177 Figure 92 Budget Management Menu 24.9.1 - Budget Management Remote Node 1.ChangeMe Connection Time/Total Budget No Budget Elapsed Time/Total Period No Budget 2.GUI No Budget No Budget Reset Node (0 to update screen): The total budget is the time limit on the accumulated time for outgoing calls to a remote node. When this limit is reached, the call is dropped and further outgoing calls to that remote node is blocked.
Chapter 16 System Maintenance menus 8 to 10 Call History This is the second option in Menu 24.9 - System Maintenance - Call Control. It displays information about past incoming and outgoing calls. Enter 2 from Menu 24.9 - System Maintenance - Call Control. Figure 93 Call History Menu 24.9.2 - Call History Phone Number 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Dir Rate #call Max Min Total Enter Entry to Delete(0 to exit): Table 43 describes the fields in Figure 93.
Chapter 16 System Maintenance menus 8 to 10 179 Time and Date setting There is a software mechanism to set the time manually or get the current time and date from an external server when you turn on your Business Secure Router. With Menu 24.10, you can update the time and date settings of your Business Secure Router. The real time is then displayed in the Business Secure Router error logs and firewall logs. Select menu 24 in the main menu to open Menu 24 - System Maintenancet.
Chapter 16 System Maintenance menus 8 to 10 Figure 95 Menu 24.10 System Maintenance: Time and Date Setting Menu 24.10 - System Maintenance - Time and Date Setting Time Protocol= NTP (RFC-1305) Time Server Address= a.ntp.alphazed.net Current Time: New Time (hh:mm:ss): 01 : 07 : 41 N/A N/A N/A Current Date: New Date (yyyy-mm-dd): 2000 - 01 - 01 N/A N/A N/A Time Zone= GMT Daylight Saving= No Start Date (mm-nth-week-hr): End Date (mm-nth-week-hr): Jan. - 1st Jan. - 1st - Sat. - Sat.
Chapter 16 System Maintenance menus 8 to 10 181 Table 44 Time and Date Setting Fields Field Description Current Date This field displays an updated date only when you reenter this menu. New Date Enter the new date in year, month and day format. This field is available when you select Manual in the Time Protocol field. Time Zone Press [SPACE BAR] and then [ENTER] to set the time difference between your time zone and Greenwich Mean Time (GMT).
Chapter 16 System Maintenance menus 8 to 10 Resetting the Time The Business Secure Router resets the time in three instances: • • • N0115789 After you make changes to and leave menu 24.10 After starting up the Business Secure Router starts up, if a time server configured in menu 24.
Chapter 17 Remote Management This chapter covers remote management found in SMT menu 24.11. Remote Management With remote management, you can determine which services and protocols can access which Business Secure Router interface (if any) from which computers.
Chapter 17 Remote Management Figure 96 Menu 24.11 – Remote Management Control Menu 24.11 - Remote Management Control TELNET Server: FTP Server: SSH Server: HTTPS Server: HTTP Server: SNMP Service: DNS Service: Port = 23 Access = Disable Secure Client IP = 0.0.0.0 Port = 21 Access = Disable Secure Client IP = 0.0.0.0 Certificate = auto_generated_self_signed_cert Port = 22 Access = Disable Secure Client IP = 0.0.0.
Chapter 17 Remote Management 185 Table 45 Menu 24.11 – Remote Management control Field Description Certificate Press [SPACE BAR] and then [ENTER] to select the certificate that the Business Secure Router uses to identify itself. The Business Secure Router is the SSL server and must always authenticate itself to the SSL client (the computer that requests the HTTPS connection with the Business Secure Router).
Chapter 17 Remote Management N0115789
Chapter 18 Call scheduling Using call scheduling (applicable only for PPPoA or PPPoE encapsulation), you can dictate when a remote node is called and for how long. Introduction Using the call scheduling feature, the Business Secure Router can manage a remote node and dictate when a remote node is called and for how long. This feature is similar to the scheduler in a video cassette recorder (you can specify a time period for the VCR to record). You can apply up to 4 schedule sets in Menu 11.
Chapter 18 Call scheduling Lower numbered sets take precedence over higher numbered sets, thereby avoiding scheduling conflicts. For example, if sets 1, 2, 3, and 4 are applied in the remote node then set 1 takes precedence over sets 2, 3, and 4 as the Business Secure Router, by default, applies the lowest numbered set first. Set 2 takes precedence over sets 3 and 4, and so on. You can design up to 12 schedule sets, but you can only apply up to four schedule sets for a remote node.
Chapter 18 Call scheduling 189 If a connection is already established, your Business Secure Router does not drop it. After the connection is dropped manually or it times out, then that remote node cannot be triggered until the end of the Duration. Table 46 Menu 26.1 Schedule Set Setup Field Description Example Active Press [SPACE BAR] to select Yes or No. Choose Yes and press [ENTER] to activate the schedule set.
Chapter 18 Call scheduling After you configure your schedule sets, you must apply them to the desired remote nodes. Enter 11 from the Main Menu and then enter the target remote node index. Using [SPACE BAR], select PPPoE or PPPoA in the Encapsulation field and then press [ENTER] to make the schedule sets field available, as shown in Figure 99. Figure 99 Applying Schedule Sets to a Remote Node (PPPoE) Menu 11.
Appendix A Setting up your computer IP address All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed. Windows 95/98/Me/NT/2000/XP, and Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/IP on your computer. Windows 3.1 requires the purchase of a third-party TCP/IP application package.
Appendix A Setting up your computer IP address Figure 100 WIndows 95/98/Me: network: configuration Installing components The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for Microsoft Networks. If you need the adapter: a In the Network window, click Add. b Select Adapter and click Add. c Select the manufacturer and model of your network adapter and click OK.
Appendix A Setting up your computer IP address 193 a Click Add. b Select Client and click Add. c Select Microsoft from the list of manufacturers. d Select Client for Microsoft Networks from the list of network clients and click OK. e Restart your computer so your changes take effect. Configuring 1 In the Network window Configuration tab, select your network adapter's TCP/IP entry and click Properties 2 Click the IP Address tab.
Appendix A Setting up your computer IP address — If you know your DNS information, select Enable DNS and type the information in the fields below (you do not need to fill them all in). Figure 102 Windows 95/98/Me: TCP/IP Properties: DNS configuration 4 Click the Gateway tab. — If you do not know your gateway’s IP address, remove previously installed gateways. — If you have a gateway IP address, type it in the New gateway field and click Add.
Appendix A Setting up your computer IP address 195 Windows 2000/NT/XP 1 For Windows XP, click Start, Control Panel. In Windows 2000/NT, click Start, Settings, Control Panel. Figure 103 Windows XP: Start menu 2 For Windows XP, click Network Connections. For Windows 2000/NT, click Network and Dial-up Connections.
Appendix A Setting up your computer IP address 3 Right-click Local Area Connection and then click Properties. Figure 105 Windows XP: Control Panel: Network Connections: Properties 4 Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and click Properties.
Appendix A Setting up your computer IP address 197 5 The Internet Protocol TCP/IP Properties window appears (the General tab in Windows XP). — If you have a dynamic IP address, click Obtain an IP address automatically. — If you have a static IP address, click Use the following IP Address and fill in the IP address, Subnet mask, and Default gateway fields. Click Advanced.
Appendix A Setting up your computer IP address — In TCP/IP Gateway Address, type the IP address of the default gateway in Gateway. To manually configure a default metric (the number of transmission hops), clear the Automatic metric check box and type a metric in Metric. — Click Add. — Repeat the previous three steps for each default gateway you want to add. — Click OK when finished.
Appendix A Setting up your computer IP address 199 10 Turn on your Business Secure Router and restart your computer (if prompted). Verifying Settings 1 Click Start, All Programs, Accessories and then Command Prompt. 2 In the Command Prompt window, type ipconfig and press [ENTER]. You can also open Network Connections, right-click a network connection, click Status and then click the Support tab.
Appendix A Setting up your computer IP address 2 Select Ethernet built-in from the Connect via list. Figure 110 Macintosh OS 8/9: TCP/IP 3 For dynamically assigned settings, select Using DHCP Server from the Configure: list. 4 For statically assigned settings, do the following: — — — — From the Configure box, select Manually. Type your IP address in the IP Address box. Type your subnet mask in the Subnet mask box. Type the IP address of your Business Secure Router in the Router address box.
Appendix A Setting up your computer IP address 201 Macintosh OS X 1 Click the Apple menu, and click System Preferences to open the System Preferences window. Figure 111 Macintosh OS X: Apple menu 2 Click Network in the icon bar. — Select Automatic from the Location list. — Select Built-in Ethernet from the Show list. — Click the TCP/IP tab. 3 For dynamically assigned settings, select Using DHCP from the Configure list.
Appendix A Setting up your computer IP address 4 For statically assigned settings, do the following: — — — — From the Configure box, select Manually. Type your IP address in the IP Address box. Type your subnet mask in the Subnet mask box. Type the IP address of your Business Secure Router in the Router address box. 5 Click Apply Now and close the window. 6 Turn on your Business Secure Router and restart your computer (if prompted).
Appendix B Triangle Route The Ideal Setup When the firewall is on, your Business Secure Router acts as a secure gateway between your LAN and the Internet. In an ideal network topology, all incoming and outgoing network traffic passes through the Business Secure Router to protect your LAN against attacks. Figure 113 Ideal Setup BCM50e Integrated Router The Triangle Route Problem You can have more than one connection to the Internet (through one or more ISPs).
Appendix B Triangle Route 1 A computer on the LAN initiates a connection by sending out a SYN packet to a receiving server on the WAN. 2 The Business Secure Router reroutes the SYN packet through Gateway B on the LAN to the WAN. 3 The reply from the WAN goes directly to the computer on the LAN without going through the Business Secure Router. As a result, the Business Secure Router resets the connection, as the connection is not acknowledged.
Appendix B Triangle Route 205 2 The Business Secure Router reroutes the packet to Gateway B, which is in Subnet 2. 3 The reply from WAN goes to the Business Secure Router. 4 The Business Secure Router ends the response to the computer in Subnet 1.
Appendix B Triangle Route N0115789
Appendix C Importing certificates This appendix shows examples for importing certificates. Import Business Secure Router certificates into Netscape Navigator In Netscape Navigator, you can permanently trust the Business Secure Router server certificate by importing it into your operating system as a trusted certification authority. Select Accept This Certificate Permanently in Figure 116 to do this.
Appendix C Importing certificates Importing the Business Secure Router Certificate into Internet Explorer For Internet Explorer to trust a self-signed certificate from the Business Secure Router, simply import the self-signed certificate into your operating system as a trusted certification authority.
Appendix C Importing certificates 209 2 Click Install Certificate to open the Install Certificate wizard.
Appendix C Importing certificates 3 Click Next to begin the Install Certificate wizard.
Appendix C Importing certificates 211 4 Select where you want to store the certificate and click Next.
Appendix C Importing certificates 5 Click Finish to complete the Import Certificate wizard. Figure 121 Certificate Import Wizard 3 6 Click Yes to add the Business Secure Router certificate to the root store.
Appendix C Importing certificates 213 Figure 123 Certificate General Information after Import Enrolling and Importing SSL Client Certificates The SSL client needs a certificate if Authenticate Client Certificates is selected on the Business Secure Router. You must have imported at least one trusted CA to the Business Secure Router in order for the Authenticate Client Certificates to be active (see “Certificates” in BCM50e Integrated Router Configuration - Basics (N0115788) for details).
Appendix C Importing certificates Figure 124 Business Secure Router Trusted CA screen The CA sends you a package containing the CA’s trusted certificate, your personal certificates and a password to install the personal certificates.
Appendix C Importing certificates 215 Installing the CA’s certificate 1 Double click the CA’s trusted certificate to produce a screen similar to the one shown in Figure 125. Figure 125 CA certificate example 2 Click Install Certificate and follow the wizard as shown earlier in this appendix. Installing your personal certificates You need a password in advance. The CA can issue the password or you can specify it during the enrollment.
Appendix C Importing certificates 1 Click Next to begin the wizard.
Appendix C Importing certificates 217 2 The file name and path of the certificate you double-clicked automatically appears in the File name text box. Click Browse if you wish to import a different certificate.
Appendix C Importing certificates 3 Enter the password given to you by the CA.
Appendix C Importing certificates 219 4 Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location.
Appendix C Importing certificates 5 Click Finish to complete the wizard and begin the import process. Figure 130 Personal certificate import wizard 5 6 Figure 131 shows the screen that appears when the certificate is correctly installed on your computer.
Appendix C Importing certificates 221 Using a certificate when accessing the Business Secure Router example Use the following procedure to access the Business Secure Router via HTTPS. 1 Enter https://Business Secure Router IP Address/ in your browser’s web address field. Figure 132 Access the Business Secure Router via HTTPS 2 When Authenticate Client Certificates is selected on the Business Secure Router, you are asked to select a personal certificate to send to the Business Secure Router.
Appendix C Importing certificates 3 The Business Secure Router login screen appears.
Appendix D PPPoE PPPoE in action An ADSL modem bridges a PPP session over Ethernet (PPP over Ethernet, RFC 2516) from your PC to an ATM PVC (Permanent Virtual Circuit), which connects to a DSL Access Concentrator where the PPP session terminates (see Figure 135). One PVC can support any number of PPP sessions from your LAN. PPPoE provides access control and billing functionality in a manner similar to dial-up services using PPP.
Appendix D PPPoE Figure 135 Single-PC per Router Hardware Configuration BCM50e Integrated Router How PPPoE works The PPPoE driver makes the Ethernet appear as a serial link to the PC and the PC runs PPP over it, while the modem bridges the Ethernet frames to the Access Concentrator (AC). Between the AC and an ISP, the AC acts as an L2TP (Layer 2 Tunneling Protocol) LAC (L2TP Access Concentrator) and tunnels the PPP frames to the ISP. The L2TP tunnel is capable of carrying multiple PPP sessions.
Appendix D PPPoE 225 Figure 136 Business Secure Router as a PPPoE Client BCM50e Integrated Router BCM50e Integrated Router Configuration - Advanced
Appendix D PPPoE N0115789
Appendix E PPTP What is PPTP? PPTP (Point-to-Point Tunneling Protocol) is a Microsoft proprietary protocol (RFC 2637 for PPTP is informational only) to tunnel PPP frames. How can we transport PPP frames from a PC to a broadband modem over Ethernet? A solution is to build PPTP into the ANT (ADSL Network Termination) where PPTP is used only over the short haul between the PC and the modem over Ethernet.
Appendix E PPTP PPTP and the Business Secure Router When the Business Secure Router is deployed in such a setup, it appears as a PC to the ANT. In Windows VPN or PPTP Pass-Through feature, the PPTP tunneling is created from Windows 95, 98, and NT clients to an NT server in a remote location. Using the pass-through feature, users on the network can access a different remote server using the Business Secure Router's Internet connection.
Appendix E PPTP 229 PAC must have IP connectivity; however, the PAC must also have dial-up capability. The phone call is between the user and the PAC and the PAC tunnels the PPP frames to the PNS. The PPTP user is unaware of the tunnel between the PAC and the PNS. Figure 139 PPTP protocol overview Microsoft includes PPTP as a part of the Windows OS.
Appendix E PPTP Figure 140 Example message exchange between PC and an ANT PPP data connection The PPP frames are tunneled between the PNS and PAC over GRE (General Routing Encapsulation, RFC 1701, 1702). The individual calls within a tunnel are distinguished using the Call ID field in the GRE header.
Appendix F Hardware specifications Cable pin assignments Table 47 General specifications Power Specification I/P AC 120V / 60Hz; O/P DC 12V 1200 mA MTBF 389 921 hrs (Mean Time Between Failures) Operation Temperature 0º C ~ 40º C Ethernet Specification for WAN 10/100Mb/s Half / Full autonegotiation Ethernet Specification for LAN/ VPN Ports 10/100Mb/s Half / Full autonegotiation, autosensing Figure 141 Ethernet cable pin assignments WAN/LAN Ethernet Cable Pin Layout: Straight-Through Crossove
Appendix F N0115789
Appendix G IP subnetting IP addressing Routers route based on the network number. The router that delivers the data packet to the correct destination host uses the host ID. IP classes An IP address is made up of four octets (eight bits), written in dotted decimal notation, for example, 192.168.1.1. IP addresses are categorized into different classes. The class of an address depends on the value of its first octet. • • • • Class A addresses have a 0 in the left-most bit.
Appendix G IP subnetting Table 48 Classes of IP addresses IP Address: Octet 1 Octet 2 Octet 3 Octet 4 Class A 0 Network number Host ID Host ID Host ID Class B 10 Network number Network number Host ID Host ID Class C 110 Network number Network number Network number Host ID Note: Host IDs of all zeros or all ones are not allowed. Therefore: A class C network (8 host bits) can have 28 –2 or 254 hosts. A class B address (16 host bits) can have 216 –2 or 65 534 hosts.
Appendix G IP subnetting 235 Subnet masks A subnet mask is used to determine which bits are part of the network number, and which bits are part of the host ID (using a logical AND operation). A subnet mask contains 32 bits. If there is a 1 in the bit, then the corresponding bit of the IP address is part of the network number. If a bit in the subnet mask is 0 then the corresponding bit in the IP address is part of the host ID. Subnet masks are expressed in dotted decimal notation just as IP addresses are.
Appendix G IP subnetting Table 51 shows all possible subnet masks for a class C address using both notations. Table 51 Alternative Subnet Mask Notation Subnet mask IP address Subnet mask 1 Bits Last octet bit value 255.255.255.0 /24 0000 0000 255.255.255.128 /25 1000 0000 255.255.255.192 /26 1100 0000 255.255.255.224 /27 1110 0000 255.255.255.240 /28 1111 0000 255.255.255.248 /29 1111 1000 255.255.255.252 /30 1111 1100 The first mask shown is the class C natural mask.
Appendix G IP subnetting 237 Divide the network 192.168.1.0 into two separate subnets by converting one of the host ID bits of the IP address to a network number bit. The borrowed host ID bit can be either 0 or 1, thus giving two subnets; 192.168.1.0 with mask 255.255.255.128 and 192.168.1.128 with mask 255.255.255.128. Note: In the following charts, shaded or bolded last-octet bit values indicate host ID bits borrowed to form network ID bits.
Appendix G IP subnetting 192.168.1.0 with mask 255.255.255.128 is the subnet itself, and 192.168.1.127 with mask 255.255.255.128 is the directed broadcast address for the first subnet. Therefore, the lowest IP address that can be assigned to an actual host for the first subnet is 192.168.1.1 and the highest is 192.168.1.126. Similarly the host ID range for the second subnet is 192.168.1.129 to 192.168.1.254.
Appendix G IP subnetting 239 Table 56 Subnet 3 Network number Last Octet Bit Value IP Address 192.168.1. 128 IP Address (Binary) 11000000.10101000.00000001. 10000000 Subnet Mask (Binary) 11111111.11111111.11111111. 11000000 Subnet Address: 192.168.1.128 Lowest Host ID: 192.168.1.129 Broadcast Address: 192.168.1.191 Highest Host ID: 192.168.1.190 Table 57 Subnet 4 Network number Last Octet Bit Value IP Address 192.168.1. 192 IP Address (Binary) 11000000.10101000.00000001.
Appendix G IP subnetting Table 58 Eight subnets Subnet Subnet Address First Address Last Address Broadcast Address 7 192 193 222 223 8 224 225 254 255 Table 59 is a summary for class C subnet planning. Table 59 Class C subnet planning No. Borrowed Host Bits Subnet Mask No. Subnets No. Hosts per Subnet 1 255.255.255.128 (/25) 2 126 2 255.255.255.192 (/26) 4 62 3 255.255.255.224 (/27) 8 30 4 255.255.255.240 (/28) 16 14 5 255.255.255.248 (/29) 32 6 6 255.255.255.
Appendix G IP subnetting 241 Table 60 Class B subnet planning No. “Borrowed” Host Bits Subnet Mask No. Subnets No. Hosts per Subnet 5 255.255.248.0 (/21) 32 2 046 6 255.255.252.0 (/22) 64 1 022 7 255.255.254.0 (/23) 128 510 8 255.255.255.0 (/24) 256 254 9 255.255.255.128 (/25) 512 126 10 255.255.255.192 (/26) 1 024 62 11 255.255.255.224 (/27) 2 048 30 12 255.255.255.240 (/28) 4 096 14 13 255.255.255.248 (/29) 8 192 6 14 255.255.255.252 (/30) 16 384 2 15 255.255.
Appendix G IP subnetting N0115789
Appendix H Command Interpreter The following describes how to use the command interpreter. Enter 24 in the main menu to bring up the system maintenance menu. Enter 8 to go to Menu 24.8 Command Interpreter Mode. See the included disk or www.nortel.com for more detailed information on these commands. Note: Use of undocumented commands or misconfiguration can damage the unit and possibly render it unusable. Command Syntax • • • • • The command keywords are in Courier New font.
Appendix H Command Interpreter Sys commands Table 61 lists and describes the system commands. Each of these commands must be preceded by sys. For example, type sys stdio 60 to set the management session inactivity timeout to 60 minutes. Table 61 Sys commands Command Description atsh Displays the MRD field. callhist Displays the call history. display remove Removes an entry from the call history. name [name] Sets or displays the client logon name.
Appendix H Command Interpreter 245 Table 61 Sys commands Command Description logs category 8021x Records logs for IEEE 802.1X. access [0:none/1:log/ 2:alert/3:both] Records, sends alerts, or both for access control logs. attack [0:none/1:log/ 2:alert/3:both] Records, sends alerts, or both for firewall attack logs. cdr [0:none/1:log] Records Call Detail Record logs. display Displays the category settings. error [0:none/1:log/ 2:alert/3:both] Records, sends alerts, or both for system error logs.
Appendix H Command Interpreter Table 61 Sys commands Command Description disp Displays the error log. online Turns the error log online display on or off. Loads the log settings buffer. Use this command before you configure the log settings. Use sys logs save after you configure the log settings. load mail alertAddr [mail address] Sends alerts to this e-mail address. clearLog [0:no/1:yes] Enables the switch to clear the log after sending logs via e-mail.
Appendix H Command Interpreter 247 Table 61 Sys commands Command Description display Displays the syslog settings. facility [Local ID(1-7)] Specifies the file to which the device logs the syslog messages. server [domainName/IP] Specifies the IP address of the syslog server the syslogs are sent. switch <0:on|1:off> Turns log consolidation on or off. period Sets the consolidation period (in seconds). msglist Displays the consolidated messages.
Appendix H Command Interpreter Table 61 Sys commands Command Description display Shows all runtime Temporarily Open Sessions. debug Turns TOS debug message on or off. listPerHost Displays all hosts session counts. sessPerHost Sets the session per host limit. timeout display Displays all TOS (Temporarily Open Session) timeout information. icmp Sets the ICMP session idle timeout value. igmp Sets the IGMP session idle timeout value. tcpsyn Sets the SYN TCP session idle timeout value.
Appendix H Command Interpreter 249 Table 61 Sys commands Command Description level [level] Sets the level (1-10) of trace logs (1 shows the least) to display. type Uses hexadecimal characters to set the type of trace logs to record. disp Shows the trace log. clear Erases the trace log. call Shows call events. encapmask Shows which type of encapsulation the trace log records, or sets the encapsulation if you specify the encapsulation’s hexadecimal character.
Appendix H Command Interpreter Table 61 Sys commands Command Description parse [[start_idx], end_idx] Displays detailed packet details of the packet range specified. Displays a brief listing of packet contents. brief Displays the RAS code and driver versions. version Displays the specified text file. switch [on|off] Turns the watchdog firmware protection feature on or off. cnt [value] Sets (0-34 463) or displays the current watchdog count (in 1.6 sec units).
Appendix H Command Interpreter 251 Table 61 Sys commands Command Description Saves UPnP information. load reserve m50Enable [0:deny/1:permit] save Saves UPnP information. [yes|no] Turns Nortel’s proprietary DHCP enhancement feature on or off. Displays the system socket’s ID #, type, control block address (PCB), IP address and port number of peer device connected to the socket (Remote Socket) and task control block (Owner). socket filter netbios disp Displays the current NetBIOS filter modes.
Appendix H Command Interpreter Exit Command Table 62 Exit Command Command Description exit Ends the command interpreter session. Ethernet Commands Table 63 lists and describes the Ethernet commands. Each of these commands must be preceded by ether. For example, type ether config to display information on the LAN configuration. Table 63 Ether Commands Command Description config Displays LAN configuration information. driver cnt status disp Displays the Ethernet driver counters.
Appendix H Command Interpreter 253 Table 63 Ether Commands Command Description set Sets physical port to a specific channel. Displays channel setting stored in SPT. spt IP commands Table 64 lists and describes the IP commands. Each of these commands must be preceded by ip. For example, type ip address to display the host IP address. Table 64 IP commands Command Description address [addr] Displays the host IP address. alias Sets an alias for the specified interface.
Appendix H Command Interpreter Table 64 IP commands Command Description lan httpd edit <0: first|1: second|2: third> <0:from ISP|1:usr-def|2:n one> [IP addr ess if choosing 1] Configures the system DNS server settings. edit <0: first|1: second|2: third> <0:from ISP|1:usr-def|2:D NS Relay|3: n one> [IP address if choosing 1] Configures the LAN DNS server settings. display Shows the LAN DNS server settings. debug [on|off] Enables or disables the HTTP debug flag.
Appendix H Command Interpreter 255 Table 64 IP commands Command Description status Displays IP statistic counters. udp Displays the UDP status. status These are the Routing Information Protocol commands. rip accept Drops an entry from the RIP refuse list. Enables RIP. activate merge [on|off] Sets the RIP merge flag. refuse Adds an entry to the RIP refuse list. request [port] Sends a RIP request to the specified address and port.
Appendix H Command Interpreter Table 64 IP commands Command Description enable [0:no/1:yes] Enables or disables content filtering. display Displays content filtering exempt zone information. actionFlags [type(1-3)][enabl e/disable] Enables or disables content filtering exempt zone action flags that determine to which IP addresses content filtering applies. add [ip1] [ip2] Sets a range of IP addresses to be in the exempt zone.
Appendix H Command Interpreter 257 Table 64 IP commands Command Description timeout Sets the number of seconds the device waits for a response from the target. checktime Sets the number of seconds the device waits between attempts to connect to the target. active Enables or disables traffic redirect. save Saves traffic redirect configuration. disp Displays the traffic redirect configuration. debug Sets the traffic redirect debug value.
Appendix H Command Interpreter Table 64 IP commands Command Description private Turns private mode on or off. active Enables or disables a static route rule. [0|1] Sets whether or not the device allows ICMP fragment packets. debug [level] Sets IGMP debug level. forwardall [on|off] Activates or deactivates IGMP forwarding to all interfaces flag. querier [on|off] Turns on or off IGMP stop query flag.
Appendix H Command Interpreter 259 Table 64 IP commands Command Description enable Turns on the ALG. disable Turns off the ALG. IPSec commands Table 65 lists and describes the IP Sec commands. Each of these commands must be preceded by ipsec. For example, type ipsec display 3 to display the third IPSec rule, if you have it configured.
Appendix H Command Interpreter Table 65 IPSec commands Command show_runtime Description chk_conn. <0~255> Sets the idle timeout for IPSec connections. The system disconnects an IPSec connection with no traffic for the timeout period. The interval is in minutes (2 default) and 0 means the connection never times out. dpdTime Sets the idle timeout for IPSec connections where the Business Secure Router is waiting for a response from the peer.
Appendix H Command Interpreter 261 Table 65 IPSec commands Command load Description Edit an IPSec branch office rule with the specified rule number. save Saves the IPSec branch office rule. config Uses these commands to configure the IPSec rule. name Sets the name of the rule. active Turns the rule on or off. negotiationMode <0:Main | 1:Aggressive> Sets the negotiation mode. natTraversal Turns NAT traversal on or off.
Appendix H Command Interpreter Table 65 IPSec commands Command N0115789 Description nailUp Turns nailed up feature on or off. activeProtocol <0:AH | 1:ESP> Sets the protocol. p2MultiPro Turns phase 2 multiple proposal on or off. p2EncryAlgo <0:Null | 1:DES | 2:3DES | 3:AES> Sets the phase 2 encryption algorithm. p2EncryKeyLen <0:128 | 1:192 | 2:256> Sets the phase 2 encryption key length (with AES encryption).
Appendix H Command Interpreter 263 Table 65 IPSec commands Command Description exUseMode [enable|disable ] Turns the exclusive use mode for the Contivity Client tunnel on or off. exUseMac [MAC address] Specifies which MAC address is allowed to use the Contivity Client tunnel with exclusive use mode. clientFailOver Sets the Contivity Client fail over IP addresses (of back up remote Contivity VPN switches).
Appendix H Command Interpreter Table 65 IPSec commands Command Description rmAddrType <0:single | 1:range | 2:subnet> Sets the remote address type. rmAddrStart Sets the remote starting IP address. rmAddrEndMask Sets the remote ending IP address or subnet mask. rmPortStart Sets the remote starting port number. rmPortEnd Sets the remote ending port number. btNatActive Turns branch tunnel NAT address mapping on or off.
Appendix H Command Interpreter 265 Table 65 IPSec commands Command Description sourceStart Sets the exempt host’s source start IP address. sourceEnd Sets the exempt host’s source end IP address. destStart Sets the exempt host’s destination start IP address. destEnd Sets the exempt host’s destination end IP address. Saves an exempt host. save Displays the branch tunnel NAT entries.
Appendix H Command Interpreter Table 66 Sys firewall commands Command Description smtp Enables or disables the SMTP DoS defender. display Displays the SMTP DoS defender setting. ignore Sets if the firewall ignores DoS attacks on the LAN or WAN. dos Sets if the firewall ignores DoS attacks on the LAN or WAN. logBroadcast Displays the status of the broadcast log. triangle Sets if the firewall ignores triangle route packets on the LAN or WAN.
Appendix H Command Interpreter 267 Table 67 Bandwidth management commands Command Description Sets the queueing mechanism to fairness-based (WRR) or priority-based (PRR). Turns on the work-conserving feature. Disables bandwidth management for traffic going out the WAN interface. disable class lan add # bandwidth xxx Adds a class with bandwidth xxx b/s in LAN. The name is for your information. Sets the class priority.
Appendix H Command Interpreter Table 67 Bandwidth management commands Command Description Deletes the class # and its filter and all its children class and their filters in WAN. del # mod # filter lan add # Modifies the parameters of the class in the WAN. A bandwidth value is optional. Sets the class name. Sets the class priority. The range is between 0 (the lowest) to 7 (the highest).
Appendix H Command Interpreter 269 Table 67 Bandwidth management commands Command Description wan Displays the WAN interface settings. lan Displays the LAN classes. wan Displays the WAN classes. lan Displays the LAN filter settings. wan Displays the WAN filter settings. lan Displays the statistics of the LAN classes. wan Displays the statistics of the LAN classes. lan <#> Displays the bandwidth usage of the specified LAN class (or all of the LAN classes if you do not specify one).
Appendix H Command Interpreter Certificates commands Table 68 describes the certificate commands. Each of these commands must be preceded by certificates (or cert for short). For example, type cert my_cert list to display all of your certificate names and basic information. All of these commands start with certificates. Table 68 Certificates commands Command Description my_cert create N0115789 create selfsigned [key size] Creates a self-signed local host certificate.
Appendix H Command Interpreter 271 Table 68 Certificates commands Command Description create scep_enroll [key size] Creates a certificate request and enrolls for a certificate immediately online using SCEP protocol. specifies a descriptive name for the enrolled certificate. specifies the CA server address. specifies the name of the CA certificate. specifies the key used for user authentication.
Appendix H Command Interpreter Table 68 Certificates commands Command Description view Views the information of the specified local host certificate. specifies the name of the certificate to be viewed. verify [timeout] Verifies the certification path of the specified local host certificate. specifies the name of the certificate to be verified. [timeout] specifies the timeout value in seconds (optional). The default timeout value is 20 seconds.
Appendix H Command Interpreter 273 Table 68 Certificates commands Command Description verify [timeout] Verifies the certification path of the specified trusted CA certificate. specifies the name of the certificate to be verified. [timeout] specifies the timeout value in seconds (optional). The default timeout value is 20 seconds. delete Deletes the specified trusted CA certificate. specifies the name of the certificate to be deleted.
Appendix H Command Interpreter Table 68 Certificates commands Command Description Lists all trusted remote host certificate names and basic information. list rename Renames the specified trusted remote host certificate. specifies the name of the certificate to be renamed. specifies the new name the certificate is saved as. add [login:pswd] Adds a new directory service. specifies a descriptive name for the directory server.
Appendix I NetBIOS filter commands The following describes the NetBIOS packet filter commands. Introduction NetBIOS (Network Basic Input/Output System) are TCP or UDP packets that enable a computer to connect to and communicate with a LAN. For some dial-up services, such as PPPoE or PPTP, NetBIOS packets cause unwanted calls. You can configure NetBIOS filters to do the following: • • • Allow or disallow the sending of NetBIOS packets from the LAN to the WAN and from the WAN to the LAN.
Appendix I NetBIOS filter commands Display NetBIOS filter settings Figure 142 NetBIOS Display Filter Settings Command Example ============== NetBIOS Filter Status =============== Between LAN and WAN: Block IPSec Packets: Forward Trigger Dial: Disabled Syntax: sys filter netbios disp This command gives a read-only list of the current NetBIOS filter modes.
Appendix I NetBIOS filter commands 277 • • 0 = LAN to WAN and WAN to LAN 3 = IPSec packet pass through is a switch to enable or disable the filter. • • For type 0, use on to enable the filter and block NetBIOS packets. Use off to disable the filter and forward NetBIOS packets. For type 3, use on to block NetBIOS packets from being sent through a VPN connection. Use off to allow NetBIOS packets to be sent through a VPN connection.
Appendix J Enhanced DHCP option commands The following describes the DHCP option commands. Enhanced DHCP option commands introduction The enhanced DHCP feature allows you to use DHCP option commands to add site-specific options to the DHCP server’s offer messages. Specifying the Nortel BCM50 IP address Syntax: ip dhcp server m50ipreserve [ [ip ] | [index ] ] where: Specify an interface on the device.
Appendix J Enhanced DHCP option commands 279 The following example sets the Business Secure Router to assign an IP address of 11.12.13.10 to the Nortel BCM50. ip dhcp server m50ipreserve ip 11.12.13.10 Nortel BCM50 DHCP server options Use these commands to add site-specific options to the DHCP server’s offer messages that it sends to the BCM50.
Appendix J Enhanced DHCP option commands [0:disable | 1:IP phones only | 2:All devices | 3:automatic] This is the Nortel BCM50 DHCP server setting. “0” disables the DHCP server. “1” enables the DHCP server for IP phones. “2” enables the DHCP server for all devices that send DHCP requests. “3” enables the DHCP server. The BCM50 automatically determines whether to assign IP addresses to IP phones or any device that sends a DHCP request.
Appendix J Enhanced DHCP option commands 281 where: Specify an interface on the device. Currently you can use this command with the LAN interface (enif0). [0|1] Use “1” to have the Nortel BCM50 assign VoIP server (DHCP option 128) and VLAN (DHCP option 191) settings to Nortel’s IP Telephone 2004. Use “0” to not have the Nortel BCM50 assign VoIP server and VLAN settings to Nortel’s IP Telephone 2004.
Appendix J Enhanced DHCP option commands [port (1~65535)] This is the VoIP server’s listening port (1~65535). [retry count (0~255)] This sets the number of times (0-255) the i2004 can attempt to connect to this VoIP server (without a response), before trying to connect to the other server. Use this command to assign VoIP server information to Nortel’s i2004 VoIP telephones. This command sets DHCP option 128.
Appendix J Enhanced DHCP option commands 283 This command sets DHCP option 191. The following example sets the Business Secure Router to assign a VLAN ID of five to VoIP telephones. ip dhcp enif0 server vlanid 5 Nortel WLAN handsets 2210 & 2211 phone options Nortel's WLAN Handsets 2210 & 2211 phones require the same options as the IP Phone 2004.
Appendix J Enhanced DHCP option commands WLAN IP Telephony Manager IP Address Assignment Syntax: ip dhcp server wlantelmanager [none |] where: Specify an interface on the device. Currently you can use this command with the LAN interface (enif0). none | Specify the address of a WLAN Telephony Manager 2245 for the Nortel WLAN Handsets 2210 & 2211.
Appendix K Log descriptions This appendix provides descriptions of log messages. Table 70 System error logs Log Message Description %s exceeds the max. number of session per host! This attempt to create a SUA/NAT session exceeds the maximum number of SUA/NAT session table entries allowed to be created per host. Table 71 System maintenance logs Log Message Description Time calibration is successful The router has adjusted its time based on information from the time server.
Appendix K Log descriptions Table 71 System maintenance logs Log Message Description TELNET Login Fail Someone has failed to log on to the router via Telnet. FTP Login Successfully Someone has logged on to the router via FTP. FTP Login Fail Someone has failed to log on to the router via FTP. NAT Session Table is Full! The maximum number of SUA/NAT session table entries has been exceeded and the table is full.
Appendix K Log descriptions 287 Table 74 Attack logs Log Message Description attack TCP The firewall detected a TCP attack. attack UDP The firewall detected an UDP attack. attack IGMP The firewall detected an IGMP attack. attack ESP The firewall detected an ESP attack. attack GRE The firewall detected a GRE attack. attack OSPF The firewall detected an OSPF attack. attack ICMP (type:%d, code:%d) The firewall detected an ICMP attack; see the section on ICMP messages for type and code details.
Appendix K Log descriptions Table 74 Attack logs Log Message Description teardrop TCP The firewall detected a TCP teardrop attack. teardrop UDP The firewall detected an UDP teardrop attack. teardrop ICMP (type:%d, code:%d) The firewall detected an ICMP teardrop attack. illegal command TCP The firewall detected a TCP illegal command attack. NetBIOS TCP The firewall detected a TCP NetBIOS attack.
Appendix K Log descriptions 289 Table 75 Access logs Log Message Description Firewall default policy: TCP (set:%d) TCP access matched the default policy of the listed ACL set and the Business Secure Router blocked or forwarded it according to the ACL set’s configuration. Firewall default policy: UDP (set:%d) UDP access matched the default policy of the listed ACL set and the Business Secure Router blocked or forwarded it according to the ACL set’s configuration.
Appendix K Log descriptions Table 75 Access logs N0115789 Log Message Description Firewall rule match: GRE (set:%d, rule:%d) GRE access matched the listed firewall rule and the Business Secure Router blocked or forwarded it according to the rule’s configuration. Firewall rule match: OSPF (set:%d, rule:%d) OSPF access matched the listed a firewall rule and the Business Secure Router blocked or forwarded it according to the rule’s configuration.
Appendix K Log descriptions 291 Table 75 Access logs Log Message Description (set:%d) With firewall messages, this is the number of the ACL policy set and denotes the packet's direction (see Table 76). With filter messages, this is the number of the filter set. (rule:%d) With firewall messages, the firewall rule number denotes the number of a firewall rule within an ACL policy set.With filter messages, this is the number of an individual filter rule.
Appendix K Log descriptions Table 76 ACL setting notes ACL Set Number Direction Description 1 LAN to WAN ACL set 1 for packets traveling from the LAN to the WAN. 2 WAN to LAN ACL set 2 for packets traveling from the WAN to the LAN. 7 LAN to LAN/Business Secure Router ACL set 7 for packets traveling from the LAN to the LAN or the Business Secure Router. 8 WAN to WAN/Business Secure Router ACL set 8 for packets traveling from the WAN to the WAN or the Business Secure Router.
Appendix K Log descriptions 293 Table 77 ICMP notes Type Code Description 0 Echo message Time Exceeded 11 0 Time to live exceeded in transit 1 Fragment reassembly time exceeded Parameter Problem 12 0 Pointer indicates the error Timestamp 13 0 Timestamp request message Timestamp Reply 14 0 Timestamp reply message Information Request 15 0 Information request message Information Reply 16 0 Information reply message Table 78 Sys log LOG MESSAGE DESCRIPTION Mon dd hr:mm:ss hostname This mess
Appendix K Log descriptions Figure 143 Example VPN initiator IPSec log Index: Date/Time: Log: -----------------------------------------------------------001 01 Jan 08:02:22 Send Main Mode request to <192.168.100.
Appendix K Log descriptions 295 VPN responder IPSec log Figure 144 shows a typical log from the VPN connection peer. Figure 144 Example VPN responder IPSec log Index: Date/Time: Log: -----------------------------------------------------------001 01 Jan 08:08:07 Recv Main Mode request from <192.168.100.
Appendix K Log descriptions Table 79 Sample IKE key exchange logs N0115789 Log Message Description Send Mode request to Send Mode request to The Business Secure Router has started negotiation with the peer. Recv Mode request from Recv Mode request from The Business Secure Router has received an IKE negotiation request from the peer. Recv: IKE uses the ISAKMP protocol (refer to RFC2408 – ISAKMP) to transmit data.
Appendix K Log descriptions 297 Table 79 Sample IKE key exchange logs Log Message Description !! Active connection allowed exceeded The Business Secure Router limits the number of simultaneous Phase 2 SA negotiations. The IKE key exchange process fails if this limit is exceeded. !! IKE Packet Retransmit The Business Secure Router did not receive a response from the peer and so retransmits the last packet sent.
Appendix K Log descriptions Table 80 shows sample log messages during packet transmission. Table 80 Sample IPSec logs during packet transmission N0115789 LOG MESSAGE DESCRIPTION !! WAN IP changed to If the Business Secure Router’s WAN IP changes, all configured “My IP Addr” are changed to “0.0.0.0”. If this field is configured as 0.0.0.0, the Business Secure Router uses the current Business Secure Router WAN IP address (static or dynamic) to set up the VPN tunnel.
Appendix K Log descriptions 299 Table 81 shows RFC-2408 ISAKMP payload types that the log displays. Refer to the RFC for detailed information on each type.
Appendix K Log descriptions Table 82 PKI logs N0115789 Log Message Description Failed to resolve The CMP online certificate enrollment failed because the certification authority server’s IP address cannot be resolved. Rcvd ca cert: The router received a certification authority certificate, with subject name as recorded, from the LDAP server whose IP address and port are recorded in the Source field.
Appendix K Log descriptions 301 Table 83 Certificate path verification failure reason codes Code Description 1 Algorithm mismatch between the certificate and the search constraints. 2 Key usage mismatch between the certificate and the search constraints. 3 Certificate was not valid in the time interval. 4 (Not used) 5 Certificate is not valid. 6 Certificate signature was not verified correctly. 7 Certificate was revoked by a CRL. 8 Certificate was not added to the cache.
Appendix K Log descriptions Go to the command interpreter interface (see Appendix H, “Command Interpreter” on page 243 for information on how to access and use the commands). Configuring what you want the Business Secure Router to log Use the sys logs load command to load the log setting buffer that is used to configure which logs the Business Secure Router is to record. Use sys logs category followed by a log category and a parameter to decide what to record.
Appendix K Log descriptions 303 Displaying logs Use the sys logs display command to show all of the logs in the Business Secure Router’s log. Use the sys logs category display command to show the log settings for all of the log categories. Use the sys logs display [log category] command to show the logs in an individual Business Secure Router log category. Use the sys logs clear command to erase all of the Business Secure Router’s logs.
Appendix K Log descriptions N0115789
Appendix L Brute force password guessing protection Table 85 describes the commands for enabling, disabling and configuring the brute force password guessing protection mechanism for the password. Table 85 Brute force password guessing protection commands Command Description sys pwderrtm This command displays the brute-force guessing password protection settings. sys pwderrtm 0 This command turns off the password’s protection from brute-force guessing.
Appendix L Brute force password guessing protection N0115789
Index Numbers 10/100 Mb/s Ethernet WAN 31 4-Port Switch 30 A Active 69 Allocated Budget 72 Alternative Subnet Mask Notation 236 Applications 36 AT command 160 Authen 72 Authentication 71, 72 Authentication Protocol 71 Autonegotiating 10/100 Mb/s Ethernet LAN 30 Autosensing 10/100 Mb/s Ethernet LAN 30 B Call-Triggering Packet 155 Central Network Management 34 CHAP 72 Command Interpreter Mode 173 Community 137 Conditions that prevent TFTP and FTP from working over WAN 162 Connection ID/Name 74 Console
Index EMAIL 49 E-mail Address 49 Enable Wildcard 49 Encapsulation 62, 69, 73 Entering Information 41 Ethernet Encapsulation 61, 68, 69, 73, 78 Ethernet Specification for WAN 231 G Gateway IP Addr 76 Gateway IP Address 63, 84 General Setup 45 H Hidden Menus 40 F Host 49 F/W Version 160 HTTPS 32 Factory Default 52 Fail Tolerance 81 Features 29 Filename Conventions 159 Filter 77 Applying 134 Configuration 117 Configuring 120 Example 130 Generic Filter Rule 128 Generic Rule 129 NAT 133 Remote Node 13
Index 309 IPSec VPN Capability 31 ISP’s Name 62 L Network Address Translation (NAT) 34, 89 O Offline 50 LAN Port Filter Setup 53 Operation Temperature 231 LAN Setup 53, 54 Outgoing Protocol Filters 59 Log 151 Log Facility 152 P Logging 35 Packet Filtering 32 Logging In to the SMT 39 PAP 72 Login Name 62 Password 40, 43, 62, 63, 137 Login Screen 39, 40 Period(hr) 72 M Ping 158 Port Forwarding 35 MAC Address 52 PPPoE 33, 223 Main Menu 41 PPPoE Encapsulation 61, 65, 68, 70, 72, 78 Mean
Index Required fields 41 System Maintenance 145, 146, 147, 148, 150, 151, 152, 157, 158, 160, 163, 170, 173, 176, 178, 180 Reset Button 31 System Management Terminal 40 Resetting the Time 182 System Name 46 Restore Configuration 165 System Status 146 RIP 57, 59, 76 Direction 59 Version 59, 77 T Remote Node Filter 77 RoadRunner Support 35 TCP/IP 54, 57, 74, 123, 124, 126, 129, 133 Setup 57 Route 70 TCP/IP and DHCP Setup 54 S TCP/IP filter rule 123 technical publications 24 Schedule Sets
Index 311 W WAN DHCP 157, 158 WAN Setup 51, 52 WebGUI 116 www.dyndns.
