Nortel Contivity 221 User manual

Version 2.00

Part No. 317517-A Rev 00

November 2003

600 Technology Park Drive

Billerica, MA 01821-4130

Contivity 221 VPN Switch

User’s Guide

ii

Copyright © 2003 Nortel Networks.

All rights reserved. December 2003.

The information in this document is subject to change without notice. The statements, configurations, technical data, and recommendations in this document are believed to be accurate and reliable, but are presented without express or implied warranty. Users must take full responsibility for their applications of any products specified in this document. The information in this document is proprietary to Nortel Networks Inc.

The software described in this document is furnished under a license agreement and may be used only in accordance with the terms of that license. The software license agreement is included in this document.

Trademarks

Nortel Networks, the Nortel Networks logo, and Contivity are trademarks of Nortel Networks.

Adobe and Acrobat Reader are trademarks of Adobe Systems Incorporated.

Check Point and Firewall 1 are trademarks of Check Point Software Technologies Ltd.

Java is a trademark of Sun Microsystems.

Microsoft, Windows, Windows NT, and MS-DOS are trademarks of Microsoft Corporation.

NETVIEW is a trademark of International Business Machines Corp (IBM).

OPENView is a trademark of Hewlett-Packard Company.

SPECTRUM is a trademark of Cabletron Systems, Inc.

All other trademarks and registered trademarks are the property of their respective owners.

Restricted rights legend

Use, duplication, or disclosure by the United States Government is subject to restrictions as set forth in subparagraph

(c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013.

Notwithstanding any other license agreement that may pertain to, or accompany the delivery of, this computer software, the rights of the United States Government regarding its use, reproduction, and disclosure are as set forth in the

Commercial Computer Software-Restricted Rights clause at FAR 52.227-19.

Statement of conditions

In the interest of improving internal design, operational function, and/or reliability, Nortel Networks Inc. reserves the right to make changes to the products described in this document without notice.

Nortel Networks Inc. does not assume any liability that may occur due to the use or application of the product(s) or circuit layout(s) described herein.

Portions of the code in this software product may be Copyright © 1988, Regents of the University of California. All rights reserved. Redistribution and use in source and binary forms of such portions are permitted, provided that the above copyright notice and this paragraph are duplicated in all such forms and that any documentation, advertising materials, and other materials related to such distribution and use acknowledge that such portions of the software were developed by the University of California, Berkeley. The name of the University may not be used to endorse or promote products derived from such portions of the software without specific prior written permission.

SUCH PORTIONS OF THE SOFTWARE ARE PROVIDED “AS IS” AND WITHOUT ANY EXPRESS OR IMPLIED

WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF

MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

In addition, the program and information contained herein are licensed only pursuant to a license agreement that contains restrictions on use and disclosure (that may incorporate by reference certain limitations and notices imposed by third parties).

317517-A Rev 00

iii

Nortel Networks Inc. software license agreement

This Software License Agreement (“License Agreement”) is between you, the end-user (“Customer”) and Nortel

Networks Corporation and its subsidiaries and affiliates (“Nortel Networks”). PLEASE READ THE FOLLOWING

CAREFULLY. YOU MUST ACCEPT THESE LICENSE TERMS IN ORDER TO DOWNLOAD AND/OR USE THE

SOFTWARE. USE OF THE SOFTWARE CONSTITUTES YOUR ACCEPTANCE OF THIS LICENSE

AGREEMENT. If you do not accept these terms and conditions, return the Software, unused and in the original shipping container, within 30 days of purchase to obtain a credit for the full purchase price.

“Software” is owned or licensed by Nortel Networks, its parent or one of its subsidiaries or affiliates, and is copyrighted and licensed, not sold. Software consists of machine-readable instructions, its components, data, audio-visual content

(such as images, text, recordings or pictures) and related licensed materials including all whole or partial copies. Nortel

Networks grants you a license to use the Software only in the country where you acquired the Software. You obtain no rights other than those granted to you under this License Agreement. You are responsible for the selection of the

Software and for the installation of, use of, and results obtained from the Software.

1. Licensed Use of Software. Nortel Networks grants Customer a nonexclusive license to use a copy of the Software on only one machine at any one time or to the extent of the activation or authorized usage level, whichever is applicable. To the extent Software is furnished for use with designated hardware or Customer furnished equipment (“CFE”), Customer is granted a nonexclusive license to use Software only on such hardware or CFE, as applicable. Software contains trade secrets and Customer agrees to treat Software as confidential information using the same care and discretion Customer uses with its own similar information that it does not wish to disclose, publish or disseminate. Customer will ensure that anyone who uses the Software does so only in compliance with the terms of this Agreement. Customer shall not a) use, copy, modify, transfer or distribute the Software except as expressly authorized; b) reverse assemble, reverse compile, reverse engineer or otherwise translate the Software; c) create derivative works or modifications unless expressly authorized; or d) sublicense, rent or lease the Software. Licensors of intellectual property to Nortel Networks are beneficiaries of this provision. Upon termination or breach of the license by Customer or in the event designated hardware or CFE is no longer in use, Customer will promptly return the Software to Nortel Networks or certify its destruction. Nortel Networks may audit by remote polling or other reasonable means to determine Customer’s Software activation or usage levels. If suppliers of third party software included in Software require Nortel Networks to include additional or different terms, Customer agrees to abide by such terms provided by Nortel Networks with respect to such third party software.

2. Warranty. Except as may be otherwise expressly agreed to in writing between Nortel Networks and Customer,

Software is provided “AS IS” without any warranties (conditions) of any kind. NORTEL NETWORKS DISCLAIMS

ALL WARRANTIES (CONDITIONS) FOR THE SOFTWARE, EITHER EXPRESS OR IMPLIED, INCLUDING,

BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

PARTICULAR PURPOSE AND ANY WARRANTY OF NON-INFRINGEMENT. Nortel Networks is not obligated to provide support of any kind for the Software. Some jurisdictions do not allow exclusion of implied warranties, and, in such event, the above exclusions may not apply.

3. Limitation of Remedies. IN NO EVENT SHALL NORTEL NETWORKS OR ITS AGENTS OR SUPPLIERS BE

LIABLE FOR ANY OF THE FOLLOWING: a) DAMAGES BASED ON ANY THIRD PARTY CLAIM; b) LOSS OF,

OR DAMAGE TO, CUSTOMER’S RECORDS, FILES OR DATA; OR c) DIRECT, INDIRECT, SPECIAL,

INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES (INCLUDING LOST PROFITS OR SAVINGS),

WHETHER IN CONTRACT, TORT OR OTHERWISE (INCLUDING NEGLIGENCE) ARISING OUT OF YOUR

USE OF THE SOFTWARE, EVEN IF NORTEL NETWORKS, ITS AGENTS OR SUPPLIERS HAVE BEEN

ADVISED OF THEIR POSSIBILITY. The forgoing limitations of remedies also apply to any developer and/or supplier of the Software. Such developer and/or supplier is an intended beneficiary of this Section. Some jurisdictions do not allow these limitations or exclusions and, in such event, they may not apply.

Contivity 221 VPN Switch User’s Guide

iv

4. General

a. If Customer is the United States Government, the following paragraph shall apply: All Nortel Networks Software available under this License Agreement is commercial computer software and commercial computer software documentation and, in the event Software is licensed for or on behalf of the United States Government, the respective rights to the software and software documentation are governed by Nortel Networks standard commercial license in accordance with U.S. Federal Regulations at 48 C.F.R. Sections 12.212 (for non-DoD entities) and 48 C.F.R. 227.7202

(for DoD entities). b. Customer may terminate the license at any time. Nortel Networks may terminate the license if Customer fails to comply with the terms and conditions of this license. In either event, upon termination, Customer must either return the

Software to Nortel Networks or certify its destruction. c. Customer is responsible for payment of any taxes, including personal property taxes, resulting from Customer’s use of the Software. Customer agrees to comply with all applicable laws including all applicable export and import laws and regulations. d. Neither party may bring an action, regardless of form, more than two years after the cause of the action arose. e. The terms and conditions of this License Agreement form the complete and exclusive agreement between Customer and Nortel Networks. f. This License Agreement is governed by the laws of the country in which Customer acquires the Software. If the

Software is acquired in the United States, then this License Agreement is governed by the laws of the state of New York.

317517-A Rev 00

v

Federal Communications Commission (FCC) Interference

Statement

This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions:

This device may not cause harmful interference.

This device must accept any interference received, including interference that may cause undesired operations.

This equipment has been tested and found to comply with the limits for a CLASS

B digital device pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy, and if not installed and used in accordance with the instructions, may cause harmful interference to radio communications.

If this equipment does cause harmful interference to radio/television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:

Reorient or relocate the receiving antenna.

Increase the separation between the equipment and the receiver.

Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.

Consult the dealer or an experienced radio/TV technician for help.

Notice 1

Changes or modifications not expressly approved by the party responsible for compliance could void the user's authority to operate the equipment.

Certifications

Refer to the product page at

www.nortelnetworks.com

.


vi

Information for Canadian Users

The Industry Canada label identifies certified equipment. This certification means that the equipment meets certain telecommunications network protective, operation, and safety requirements. The Industry Canada does not guarantee that the equipment will operate to a user's satisfaction.

Before installing this equipment, users should ensure that it is permissible to be connected to the facilities of the local telecommunications company. The equipment must also be installed using an acceptable method of connection. In some cases, the company's inside wiring associated with a single line individual service may be extended by means of a certified connector assembly. The customer should be aware that the compliance with the above conditions may not prevent degradation of service in some situations.

Repairs to certified equipment should be made by an authorized Canadian maintenance facility designated by the supplier. Any repairs or alterations made by the user to this equipment, or equipment malfunctions, may give the telecommunications company cause to request the user to disconnect the equipment.

For their own protection, users should ensure that the electrical ground connections of the power utility, telephone lines, and internal metallic water pipe system, if present, are connected together. This precaution may be particularly important in rural areas.

Caution

Users should not attempt to make such connections themselves, but should contact the appropriate electrical inspection authority, or electrician, as appropriate.

Note

This digital apparatus does not exceed the class A limits for radio noise emissions from digital apparatus set out in the radio interference regulations of Industry

315717-A Rev 00

vii

Table of Contents

List of Figures ............................................................................................................................ xvii

List of Tables ............................................................................................................................ xxvii

Preface .....................................................................................................................................xxxiii

Overview .............................................................................................................................................I

Chapter 1 Getting to Know Your Contivity 221..........................................................................1-1

1.1 Introducing the Contivity 221....................................................................................1-1

1.2 Features......................................................................................................................1-1

1.3 Applications for the Contivity 221 ............................................................................1-6

Getting Started................................................................................................................................... II

Chapter 2 Introducing the WebGUI.............................................................................................2-1

2.2

2.3

Accessing the Contivity 221 WebGUI ......................................................................2-1

Resetting the Contivity 221 .......................................................................................2-2

2.4 Navigating the Contivity 221 WebGUI .....................................................................2-3

Chapter 3 Wizard Setup...............................................................................................................3-1

3.2

3.3

3.4

Wizard Setup: General Setup and System Name.......................................................3-1

Wizard Setup: Screen 2 .............................................................................................3-2

Wizard Setup: Screen 3 .............................................................................................3-8

System LAN and WAN ..................................................................................................................... II

Chapter 4 System Screens ...........................................................................................................4-1


viii Table of Contents

Chapter 5 LAN Screens ...............................................................................................................5-1

5.6 Configuring IP Alias ..................................................................................................5-7

Chapter 6 WAN Screens ..............................................................................................................6-1

6.2 TCP/IP Priority (Metric) ............................................................................................6-1

6.10 Advanced Modem Setup ......................................................................................6-20

NAT and Static Route .......................................................................................................................IV

Chapter 7 Network Address Translation (NAT) Screens .............................................................7-1

315717-A Rev 00

Table of Contents ix

7.6 Trigger Forwarding ..........................................................................................7-12

7.7 Configuring Trigger Port Forwarding .....................................................................7-14

Chapter 8 Static Route Screens ...................................................................................................8-1

8.1

8.2

Static Route Overview...............................................................................................8-1

Configuring IP Static Route.......................................................................................8-1

Firewall and Content Filters .............................................................................................................. V

Chapter 9 Firewalls .....................................................................................................................9-1

9.3 Introduction to Nortel Networks Firewall .................................................................9-2

9.6

9.7

Guidelines For Enhancing Security With Your Firewall.........................................9-12

Packet Filtering Vs Firewall ....................................................................................9-12

Chapter 10 Firewall Screens......................................................................................................10-1

10.2 Firewall Policies Overview......................................................................................10-1

10.3 Rule Logic Overview...............................................................................................10-2

10.4 Connection Direction Examples ..............................................................................10-3

10.6 Example Firewall Rule ..........................................................................................10-12


x Table of Contents

10.8 Alerts......................................................................................................................10-19

Chapter 11 Content Filtering Screens ........................................................................................11-1

11.1 Introduction to Content Filtering .............................................................................11-1

11.2 Restrict Web Features ..............................................................................................11-1

11.3 Days and Times .......................................................................................................11-1

11.4 Configure Content Filtering.....................................................................................11-1

VPN/IPSec........................................................................................................................................VI

Chapter 12 Introduction to IPSec ..............................................................................................12-1

12.3 Encapsulation .......................................................................................................12-4

12.4 IPSec and NAT ....................................................................................................12-5

Chapter 13 VPN Screens ...........................................................................................................13-1

13.3

13.4

My IP Address......................................................................................................13-2

Secure Gateway Address......................................................................................13-2

13.8 ID Type and Content ............................................................................................13-9

13.10 Configuring Contivity Client VPN Rule Setup ..................................................13-11

13.11 Configuring Branch Office VPN Rule Setup .....................................................13-13

315717-A Rev 00

Table of Contents xi

13.12 Configuring an IP Policy....................................................................................13-21

13.14 Configuring Advanced Branch Office Setup .....................................................13-27

Remote Management and UPnP......................................................................................................VII

Chapter 14 Remote Management Screens.................................................................................14-1

14.1 Remote Management Overview ..............................................................................14-1

14.2 Telnet .......................................................................................................................14-2

Chapter 15 UPnP .......................................................................................................................15-1

15.1 Universal Plug and Play Overview..........................................................................15-1

15.4 Installing UPnP in Windows Example ....................................................................15-4

15.5 Using UPnP in Windows XP Example....................................................................15-6

Logs ............................................................................................................................................... VIII

Chapter 16 Logs Screens ...........................................................................................................16-1


xii Table of Contents

Maintenance .....................................................................................................................................IX

Chapter 17 Maintenance ............................................................................................................17-1

SMT General Configuration .............................................................................................................. X

Chapter 18 Introducing the SMT...............................................................................................18-1

18.1

18.2

18.3

Introduction to the SMT.......................................................................................18-1

Accessing the SMT via the Console Port.............................................................18-1

Navigating the SMT Interface..............................................................................18-2

18.4

18.5

Changing the System Password ...........................................................................18-8

Resetting the Contivity 221..................................................................................18-8

Chapter 19 SMT Menu 1 - General Setup .................................................................................19-1

19.1 Introduction to General Setup ..............................................................................19-1

Chapter 20 WAN and Dial Backup Setup..................................................................................20-1

20.1 Introduction to WAN and Dial Backup Setup......................................................20-1

20.4

20.5

20.6

Configuring Dial Backup in Menu 2....................................................................20-2

Advanced WAN Setup .........................................................................................20-4

Remote Node Profile (Backup ISP) .....................................................................20-6

20.8 Editing TCP/IP Options .....................................................................................20-10

315717-A Rev 00

20.9

Table of Contents xiii

Editing Login Script...........................................................................................20-12

Chapter 21 LAN Setup ..............................................................................................................21-1

21.1 Introduction to LAN Setup ..................................................................................21-1

21.2

21.3

Accessing the LAN Menus ..................................................................................21-1

LAN Port Filter Setup ..........................................................................................21-1

Chapter 22 Internet Access........................................................................................................22-1

22.1 Introduction to Internet Access Setup ..................................................................22-1

22.3

22.4

Configuring the PPTP Client ...............................................................................22-3

Configuring the PPPoE Client .............................................................................22-4

SMT Advanced Applications............................................................................................................ XI

Chapter 23 Remote Node Setup ................................................................................................23-1

23.1 Introduction to Remote Node Setup ........................................................................23-1

23.3 Remote Node Profile Setup .....................................................................................23-2

Chapter 24 IP Static Route Setup ..............................................................................................24-1

24.1 IP Static Route Setup ...............................................................................................24-1

Chapter 25 Network Address Translation (NAT) ......................................................................25-1

25.3 Configuring a Server behind NAT ..........................................................................25-9

25.4 General NAT Examples.........................................................................................25-11


xiv Table of Contents

25.5 Configuring Trigger Port Forwarding....................................................................25-20

Chapter 26 Introducing the Firewall..........................................................................................26-1

26.1 Using SMT Menus...................................................................................................26-1

Chapter 27 Filter Configuration.................................................................................................27-1

27.1 Introduction to Filters ..............................................................................................27-1

27.2 Configuring a Filter Set ...........................................................................................27-4

27.4 Filter Types and NAT ............................................................................................27-15

27.5 Firewall Versus Filters...........................................................................................27-16

27.6 Applying a Filter ....................................................................................................27-16

Chapter 28 SNMP Configuration ..............................................................................................28-1

SMT System Maintenance.............................................................................................................. XII

Chapter 29 System Information & Diagnosis............................................................................29-1

29.1 Introduction to System Status ..................................................................................29-1

29.3 System Information and Console Port Speed ..........................................................29-3

29.4 Log and Trace ..........................................................................................................29-6

Chapter 30 Firmware and Configuration File Maintenance ......................................................30-1

30.1 Introduction..............................................................................................................30-1

33.3 Uploading Firmware and Configuration Files .......................................................30-11

Chapter 31 System Maintenance Menus 8 to 10 .......................................................................31-1

315717-A Rev 00

Table of Contents xv

31.1 Command Interpreter Mode ....................................................................................31-1

31.3 Time and Date Setting .............................................................................................31-6

Chapter 32 Remote Management ..............................................................................................32-1

SMT Advanced Management ........................................................................................................ XIII

Chapter 33 Call Scheduling.......................................................................................................33-1

33.1 Introduction to Call Scheduling...............................................................................33-1

General Appendices....................................................................................................................... XIV

Appendix A Setting up Your Computer’s IP Address................................................................. A-1

Appendix B Triangle Route........................................................................................................ B-1

Appendix C The Big Picture ...................................................................................................... C-1

Appendix D PPPoE .................................................................................................................... D-1

Appendix E PPTP....................................................................................................................... E-1

Appendix F Hardware Specifications..........................................................................................F-1

Appendix G IP Subnetting.......................................................................................................... G-1

Appendix H Safety Warnings and Instructions .......................................................................... H-1

Command and Log Appendices ..................................................................................................... XV

Appendix I Command Interpreter ............................................................................................... I-1

Appendix J NetBIOS Filter Commands ...................................................................................... J-1

Appendix K Boot Commands .................................................................................................... K-1

Appendix L Log Descriptions .................................................................................................... L-1

Appendix M Brute-Force Password Guessing Protection ......................................................... M-1

Index.............................................................................................................................................. XVI

Appendix N Index ...................................................................................................................... N-1


xvii

List of Figures

Figure 1-1 Secure Internet Access and VPN Application................................................................1-7

Figure 2-1 Change Password Screen ...............................................................................................2-2

Figure 2-2 Example Xmodem Upload ............................................................................................2-3

Figure 2-3 The MAIN MENU Screen of the WebGUI ...................................................................2-4

Figure 3-1 Wizard 1.........................................................................................................................3-2

Figure 3-2 Wizard 2: Ethernet Encapsulation .................................................................................3-3

Figure 3-3 Wizard 2: PPTP Encapsulation ......................................................................................3-5

Figure 3-4 Wizard2: PPPoE Encapsulation .....................................................................................3-7

Figure 3-5 Wizard 3....................................................................................................................... 3-11

Figure 4-1 System General Setup....................................................................................................4-2

Figure 4-2 DDNS ............................................................................................................................4-4

Figure 4-3 Password ........................................................................................................................4-6

Figure 4-4 Time Setting...................................................................................................................4-7

Figure 5-1 IP....................................................................................................................................5-3

Figure 5-2 Static DHCP...................................................................................................................5-6

Figure 5-3 IP Alias...........................................................................................................................5-7

Figure 6-1 WAN Setup: Route ........................................................................................................6-2

Figure 6-2 Ethernet Encapsulation ..................................................................................................6-3

Figure 6-3 PPPoE Encapsulation ....................................................................................................6-4

Figure 6-4 PPTP Encapsulation.......................................................................................................6-6

Figure 6-5 RR Service Type ............................................................................................................6-7

Figure 6-6 IP Setup..........................................................................................................................6-9

Figure 6-7 MAC Setup ..................................................................................................................6-12

Figure 6-8 Traffic Redirect WAN Setup........................................................................................6-12


xviii List of Figures

Figure 6-9 Traffic Redirect LAN Setup.........................................................................................6-13

Figure 6-10 Traffic Redirect ..........................................................................................................6-14

Figure 6-11 Dial Backup Setup .....................................................................................................6-16

Figure 6-12 Advanced Setup .........................................................................................................6-21

Figure 7-1 How NAT Works............................................................................................................7-3

Figure 7-2 NAT Application With IP Alias......................................................................................7-4

Figure 7-3 Multiple Servers Behind NAT Example ........................................................................7-7

Figure 7-4 SUA/NAT Setup.............................................................................................................7-8

Figure 7-5 Address Mapping .........................................................................................................7-10

Figure 7-6 Address Mapping Edit .................................................................................................7-11

Figure 7-7 Trigger Port Forwarding Process: Example .................................................................7-13

Figure 7-8 Trigger Port ..................................................................................................................7-14

Figure 8-1 Example of Static Routing Topology .............................................................................8-1

Figure 8-2 Static Route Screen ........................................................................................................8-2

Figure 8-3 Edit IP Static Route........................................................................................................8-3

Figure 9-1 Contivity 221 Firewall Application ...............................................................................9-3

Figure 9-2 Three-Way Handshake ...................................................................................................9-5

Figure 9-3 SYN Flood .....................................................................................................................9-6

Figure 9-4 Smurf Attack ..................................................................................................................9-7

Figure 9-5 Stateful Inspection .........................................................................................................9-9

Figure 10-1 LAN to WAN Traffic .................................................................................................10-4

Figure 10-2 WAN to LAN Traffic .................................................................................................10-5

Figure 10-3 Enabling the Firewall.................................................................................................10-6

Figure 10-4 Creating/Editing A Firewall Rule...............................................................................10-9

Figure 10-5 Adding/Editing Source and Destination Addresses .................................................10-11

Figure 10-6 Creating/Editing A Custom Port ..............................................................................10-12

315717-A Rev 00

List of Figures xix

Figure 10-7 Firewall Edit Rule Screen ........................................................................................10-13

Figure 10-8 Firewall Rule Edit IP Example ................................................................................10-14

Figure 10-9 Edit Custom Port Example ......................................................................................10-14

Figure 10-10 MyService Rule Configuration..............................................................................10-15

Figure 10-11 My Service Example Rule Summary.....................................................................10-16

Figure 10-12 Attack Alert............................................................................................................10-22

Figure 11-1 Content Filter ............................................................................................................. 11-2

Figure 12-1 Encryption and Decryption........................................................................................12-2

Figure 12-2 IPSec Architecture .....................................................................................................12-3

Figure 12-3 Transport and Tunnel Mode IPSec Encapsulation .....................................................12-4

Figure 13-1 IPSec Summary Fields...............................................................................................13-3

Figure 13-2 Summary....................................................................................................................13-4

Figure 13-3 NAT Router Between VPN Switches ........................................................................13-8

Figure 13-4 VPN Contivity Client Rule Setup............................................................................13-12

Figure 13-5 VPN Branch Office Rule Setup ...............................................................................13-14

Figure 13-6 VPN Branch Office - IP Policy................................................................................13-21

Figure 13-7 Two Phases to Set Up the IPSec SA ........................................................................13-25

Figure 13-8 VPN Branch Office Advanced Rule Setup ..............................................................13-28

Figure 13-9 VPN SA Monitor .....................................................................................................13-31

Figure 13-10 VPN Global Setting ...............................................................................................13-33

Figure 14-1 Telnet Configuration on a TCP/IP Network...............................................................14-3

Figure 14-2 Telnet .........................................................................................................................14-3

Figure 14-3 FTP ............................................................................................................................14-5

Figure 14-4 WWW ........................................................................................................................14-6

Figure 14-5 SNMP Management Model .......................................................................................14-7

Figure 14-6 SNMP ........................................................................................................................14-9


xx List of Figures

Figure 14-7 DNS .........................................................................................................................14-11

Figure 14-8 Security ....................................................................................................................14-12

Figure 15-1 Configuring UPnP......................................................................................................15-3

Figure 16-1 View Log....................................................................................................................16-2

Figure 16-2 Log Settings ...............................................................................................................16-4

Figure 16-3 Reports .......................................................................................................................16-7

Figure 16-4 Web Site Hits Report Example ..................................................................................16-8

Figure 16-5 Protocol/Port Report Example ...................................................................................16-9

Figure 16-6 LAN IP Address Report Example ............................................................................16-10

Figure 17-1 System Status .............................................................................................................17-1

Figure 17-2 System Status: Show Statistics ..................................................................................17-2

Figure 17-3 DHCP Table ...............................................................................................................17-4

Figure 17-4 Firmware Upload .......................................................................................................17-5

Figure 17-5 Firmware Upload .......................................................................................................17-5

Figure 17-6 Firmware Upload In Process......................................................................................17-6

Figure 17-7 Network Temporarily Disconnected ..........................................................................17-6

Figure 17-8 Firmware Upload Error..............................................................................................17-7

Figure 17-9 Configuration .............................................................................................................17-8

Figure 17-10 Reset Warning Message ...........................................................................................17-9

Figure 17-11 Configuration Upload Successful ..........................................................................17-10

Figure 17-12 Network Temporarily Disconnected ......................................................................17-10

Figure 18-1 Initial Screen ..............................................................................................................18-2

Figure 18-2 Password Screen ........................................................................................................18-2

Figure 18-3 Main Menu.................................................................................................................18-4

Figure 18-4 Getting Started and Advanced Applications SMT Menus .........................................18-6

Figure 18-5 Advanced Management SMT Menus.........................................................................18-7

315717-A Rev 00

List of Figures xxi

Figure 18-6 Schedule Setup Menu ................................................................................................18-8

Figure 18-7 Menu 23: System Password.......................................................................................18-8

Figure 19-1 Menu 1: General Setup ..............................................................................................19-1

Figure 19-2 Configure Dynamic DNS ..........................................................................................19-3

Figure 20-1 MAC Address Cloning in WAN Setup ......................................................................20-1

Figure 20-2 Menu 2: Dial Backup Setup......................................................................................20-3

Figure 20-3 Menu 2.1 Advanced WAN Setup ...............................................................................20-4

Figure 20-4 Menu 11.1 Remote Node Profile (Backup ISP).........................................................20-6

Figure 20-5 Menu 11.2: Remote Node PPP Options.....................................................................20-9

Figure 20-6 Menu 11.3: Remote Node Network Layer Options .................................................20-10

Figure 20-7 Menu 11.4: Remote Node Setup Script ...................................................................20-13

Figure 20-8 Menu 11.5: Dial Backup Remote Node Filter .........................................................20-14

Figure 21-1 Menu 3: LAN Setup...................................................................................................21-1

Figure 21-2 Menu 3.1: LAN Port Filter Setup ..............................................................................21-2

Figure 21-3 Menu 3: TCP/IP and DHCP Setup.............................................................................21-2

Figure 21-4 Menu 3.2: TCP/IP and DHCP Ethernet Setup ...........................................................21-3

Figure 21-5 Menu 3.2.1: IP Alias Setup ........................................................................................21-6

Figure 22-1 Menu 4: Internet Access Setup (Ethernet) .................................................................22-1

Figure 22-2 Internet Access Setup (PPTP) ....................................................................................22-4

Figure 22-3 Internet Access Setup (PPPoE) ..................................................................................22-5

Figure 23-1 Menu 11 Remote Node Setup ....................................................................................23-2

Figure 23-2 Menu 11.1: Remote Node Profile for Ethernet Encapsulation ..................................23-3

Figure 23-3 Menu 11.1: Remote Node Profile for PPPoE Encapsulation.....................................23-4

Figure 23-4 Menu 11.1: Remote Node Profile for PPTP Encapsulation .......................................23-7

Figure 23-5 Menu 11.3: Remote Node Network Layer Options for Ethernet Encapsulation .......23-8

Figure 23-6 Menu 11.5: Remote Node Filter (Ethernet Encapsulation)...................................... 23-11


xxii List of Figures

Figure 23-7 Menu 11.5: Remote Node Filter (PPPoE or PPTP Encapsulation) ..........................23-11

Figure 23-8 Menu 11.1: Remote Node Profile ............................................................................23-12

Figure 23-9 Menu 11.6: Traffic Redirect Setup...........................................................................23-13

Figure 24-1 Menu 12: IP Static Route Setup .................................................................................24-1

Figure 24-2 Menu 12. 1: Edit IP Static Route ...............................................................................24-2

Figure 25-1 Menu 4: Applying NAT for Internet Access ..............................................................25-2

Figure 25-2 Menu 11.3: Applying NAT to the Remote Node........................................................25-3

Figure 25-3 Menu 15: NAT Setup .................................................................................................25-4

Figure 25-4 Menu 15.1: Address Mapping Sets ............................................................................25-5

Figure 25-5 Menu 15.1.255: SUA Address Mapping Rules ..........................................................25-5

Figure 25-6 Menu 15.1.1: First Set................................................................................................25-7

Figure 25-7 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set ..............................25-8

Figure 25-8 Menu 15.2: NAT Server Setup .................................................................................25-10

Figure 25-9 Multiple Servers Behind NAT Example ..................................................................25-11

Figure 25-10 NAT Example 1......................................................................................................25-12

Figure 25-11 Menu 4: Internet Access & NAT Example.............................................................25-12


Figure 25-13 Menu 15.2: Specifying an Inside Server................................................................25-13


Figure 25-15 Example 3: Menu 11.3 ...........................................................................................25-16

Figure 25-16 Example 3: Menu 15.1.1.1 .....................................................................................25-16

Figure 25-17 Example 3: Final Menu 15.1.1...............................................................................25-17

Figure 25-18 Example 3: Menu 15.2...........................................................................................25-17


Figure 25-20 Example 4: Menu 15.1.1.1: Address Mapping Rule ..............................................25-19

Figure 25-21 Example 4: Menu 15.1.1: Address Mapping Rules ...............................................25-19

315717-A Rev 00

List of Figures xxiii

Figure 25-22 Menu 15.3: Trigger Port Setup ..............................................................................25-20

Figure 26-1 Menu 21: Filter and Firewall Setup ...........................................................................26-1

Figure 26-2 Menu 21.2: Firewall Setup ........................................................................................26-2

Figure 27-1 Outgoing Packet Filtering Process.............................................................................27-2

Figure 27-2 Filter Rule Process.....................................................................................................27-3

Figure 27-4 Menu 21: Filter and Firewall Setup ...........................................................................27-4

Figure 27-5 Menu 21.1: Filter Set Configuration..........................................................................27-4

Figure 27-6 Menu 21.1.1.1: TCP/IP Filter Rule ............................................................................27-7

Figure 27-7 Executing an IP Filter ..............................................................................................27-10

Figure 27-8 Menu 21.1.1.1: Generic Filter Rule ......................................................................... 27-11

Figure 27-9 Telnet Filter Example...............................................................................................27-13

Figure 27-10 Example Filter: Menu 21.1.3.1 ..............................................................................27-14

Figure 27-11 Example Filter Rules Summary: Menu 21.1.3.......................................................27-15

Figure 27-12 Protocol and Device Filter Sets .............................................................................27-16

Figure 27-13 Filtering LAN Traffic ............................................................................................27-17

Figure 27-14 Filtering Remote Node Traffic...............................................................................27-18

Figure 28-1 Menu 22: SNMP Configuration.................................................................................28-1

Figure 29-1 Menu 24: System Maintenance .................................................................................29-1

Figure 29-2 Menu 24.1: System Maintenance: Status...................................................................29-2

Figure 29-3 Menu 24.2: System Information and Console Port Speed.........................................29-4

Figure 29-4 Menu 24.2.1: System Maintenance: Information ......................................................29-4

Figure 29-5 Menu 24.2.2: System Maintenance: Change Console Port Speed.............................29-5

Figure 29-6 Menu 24.3: System Maintenance: Log and Trace .....................................................29-6

Figure 29-7 Menu 24.3.2: System Maintenance: Syslog Logging ................................................29-6

Figure 29-8 Call-Triggering Packet Example..............................................................................29-10

Figure 29-9 Menu 24.4: System Maintenance: Diagnostic ......................................................... 29-11


xxiv List of Figures

Figure 29-10 WAN & LAN DHCP .............................................................................................29-12

Figure 30-1 Telnet into Menu 24.5 ................................................................................................30-3

Figure 30-2 FTP Session Example ................................................................................................30-4

Figure 30-3 System Maintenance: Backup Configuration ............................................................30-7

Figure 30-4 System Maintenance: Starting Xmodem Download Screen ......................................30-7

Figure 30-5 Backup Configuration Example.................................................................................30-8

Figure 30-6 Successful Backup Confirmation Screen ...................................................................30-8

Figure 30-7 Telnet into Menu 24.6 ................................................................................................30-9

Figure 30-8 Restore Using FTP Session Example.......................................................................30-10

Figure 30-9 System Maintenance: Restore Configuration ..........................................................30-10

Figure 30-10 System Maintenance: Starting Xmodem Download Screen ..................................30-11

Figure 30-11 Restore Configuration Example.............................................................................30-11

Figure 30-12 Successful Restoration Confirmation Screen.........................................................30-11

Figure 30-13 Telnet Into Menu 24.7.1: Upload System Firmware..............................................30-12

Figure 30-14 Telnet Into Menu 24.7.2: System Maintenance .....................................................30-13

Figure 30-15 FTP Session Example of Firmware File Upload....................................................30-14

Figure 30-16 Menu 24.7.1 As Seen Using the Console Port .......................................................30-16

Figure 30-17 Example Xmodem Upload.....................................................................................30-17

Figure 30-18 Menu 24.7.2 As Seen Using the Console Port .......................................................30-18

Figure 30-19 Example Xmodem Upload.....................................................................................30-19

Figure 31-1 Command Mode in Menu 24 .....................................................................................31-1

Figure 31-2 Valid Commands ........................................................................................................31-2

Figure 31-3 Call Control................................................................................................................31-3

Figure 31-4 Budget Management ..................................................................................................31-4

Figure 31-5 Call History................................................................................................................31-5

Figure 31-6 Menu 24: System Maintenance..................................................................................31-6

315717-A Rev 00

List of Figures xxv

Figure 31-7 Menu 24.10 System Maintenance: Time and Date Setting........................................31-7

Figure 32-1 Menu 24.11 – Remote Management Control.............................................................32-2

Figure 33-1 Schedule Setup ..........................................................................................................33-1

Figure 33-2 Schedule Set Setup ....................................................................................................33-2

Figure 33-3 Applying Schedule Set(s) to a Remote Node (PPPoE)..............................................33-4

Figure 33-4 Applying Schedule Set(s) to a Remote Node (PPTP)................................................33-5


xxvii

List of Tables

Table 3-1 Ethernet Encapsulation....................................................................................................3-3

Table 3-2 PPTP Encapsulation ........................................................................................................3-5

Table 3-3 PPPoE Encapsulation ......................................................................................................3-7

Table 3-4 Private IP Address Ranges...............................................................................................3-8

Table 3-5 Example of Network Properties for LAN Servers with Fixed IP Addresses.................3-10

Table 3-6 WAN Setup.................................................................................................................... 3-11

Table 4-1 System General Setup .....................................................................................................4-2

Table 4-2 DDNS ..............................................................................................................................4-4

Table 4-3 Password .........................................................................................................................4-6

Table 4-4 Time Setting ....................................................................................................................4-7

Table 5-1 IP .....................................................................................................................................5-4

Table 5-2 Static DHCP ....................................................................................................................5-6

Table 5-3 IP Alias ............................................................................................................................5-7

Table 6-1 WAN Setup: Route ..........................................................................................................6-2

Table 6-2 Ethernet Encapsulation....................................................................................................6-3

Table 6-3 PPPoE Encapsulation ......................................................................................................6-5

Table 6-4 PPTP Encapsulation ........................................................................................................6-6

Table 6-5 RR Service Type..............................................................................................................6-8

Table 6-6 IP Setup ...........................................................................................................................6-9

Table 6-7 Traffic Redirect .............................................................................................................6-14

Table 6-8 Dial Backup Setup.........................................................................................................6-17

Table 6-9 Advanced Setup.............................................................................................................6-21

Table 7-1 NAT Definitions ..............................................................................................................7-1

Table 7-2 NAT Mapping Types .......................................................................................................7-5


xxviii List of Tables

Table 7-3 Services and Port Numbers .............................................................................................7-6

Table 7-4 SUA/NAT Setup ..............................................................................................................7-9

Table 7-5 Address Mapping...........................................................................................................7-10

Table 7-6 Address Mapping Edit ...................................................................................................7-12

Table 7-7 Trigger Port....................................................................................................................7-15

Table 8-1 IP Static Route Summary.................................................................................................8-2

Table 8-2 Edit IP Static Route .........................................................................................................8-3

Table 9-1 Common IP Ports.............................................................................................................9-4

Table 9-2 ICMP Commands That Trigger Alerts.............................................................................9-7

Table 9-3 Legal NetBIOS Commands .............................................................................................9-7

Table 9-4 Legal SMTP Commands .................................................................................................9-8

Table 10-1 Firewall Rules Summary: First Screen ........................................................................10-6

Table 10-2 Creating/Editing A Firewall Rule ................................................................................10-9

Table 10-3 Adding/Editing Source and Destination Addresses ...................................................10-11

Table 10-4 Creating/Editing A Custom Port ................................................................................10-12

Table 10-5 Predefined Services ...................................................................................................10-17

Table 10-6 Attack Alert................................................................................................................10-22

Table 11-1 Content Filter...............................................................................................................11-2

Table 12-1 VPN and NAT..............................................................................................................12-5

Table 13-1 AH and ESP.................................................................................................................13-2

Table 13-2 Summary .....................................................................................................................13-4

Table 13-3 Local ID Type and Content Fields.............................................................................13-10

Table 13-4 Peer ID Type and Content Fields...............................................................................13-10

Table 13-5 Matching ID Type and Content Configuration Example...........................................13-10

Table 13-6 Mismatching ID Type and Content Configuration Example .....................................13-11

Table 13-7 VPN Contivity Client Rule Setup..............................................................................13-12

315717-A Rev 00

List of Tables xxix

Table 13-8 VPN Branch Office Rule Setup.................................................................................13-15

Table 13-9 VPN Branch Office - IP Policy .................................................................................13-22

Table 13-10 VPN Branch Office Advanced Rule Setup..............................................................13-28

Table 13-11 VPN SA Monitor .....................................................................................................13-32

Table 13-12 VPN Global Setting.................................................................................................13-33

Table 14-1 Telnet ...........................................................................................................................14-4

Table 14-2 FTP ..............................................................................................................................14-5

Table 14-3 WWW..........................................................................................................................14-6

Table 14-4 SNMP Traps ................................................................................................................14-8

Table 14-5 SNMP ........................................................................................................................14-10

Table 14-6 DNS........................................................................................................................... 14-11

Table 14-7 Security .....................................................................................................................14-12

Table 15-1 Configuring UPnP .......................................................................................................15-3

Table 16-1 View Log .....................................................................................................................16-2

Table 16-2 Log Settings Screen.....................................................................................................16-5

Table 16-3 Reports ........................................................................................................................16-7

Table 16-4 Web Site Hits Report ...................................................................................................16-8

Table 16-5 Protocol/ Port Report...................................................................................................16-9

Table 16-6 LAN IP Address Report.............................................................................................16-10

Table 16-7 Report Specifications ................................................................................................ 16-11

Table 17-1 System Status ..............................................................................................................17-2

Table 17-2 System Status: Show Statistics ....................................................................................17-3

Table 17-3 DHCP Table.................................................................................................................17-4

Table 17-4 Restore Configuration .................................................................................................17-9

Table 18-1 Main Menu Commands ...............................................................................................18-2

Table 18-2 Main Menu Summary..................................................................................................18-4


xxx List of Tables

Table 19-1 General Setup Menu Field...........................................................................................19-2

Table 19-2 Configure Dynamic DNS Menu Fields .......................................................................19-3

Table 20-1 MAC Address Cloning in WAN Setup ........................................................................20-1

Table 20-2 Menu 2: Dial Backup Setup ........................................................................................20-3

Table 20-3 Advanced WAN Port Setup: AT Commands Fields.....................................................20-5

Table 20-4 Advanced WAN Port Setup: Call Control Parameters.................................................20-5

Table 20-5 Fields in Menu 11.1 Remote Node Profile (Backup ISP)............................................20-7

Table 20-6 Remote Node PPP Options Menu Fields.....................................................................20-9

Table 20-7 Remote Node Network Layer Options Menu Fields .................................................20-10

Table 20-8 Menu 11.4: Remote Node Script Menu Fields ..........................................................20-13

Table 21-1 DHCP Ethernet Setup Menu Fields .............................................................................21-3

Table 21-2 LAN TCP/IP Setup Menu Fields .................................................................................21-4

Table 21-3 IP Alias Setup Menu Fields .........................................................................................21-6

Table 22-1 Menu 4: Internet Access Setup Menu Fields ...............................................................22-2

Table 22-2 New Fields in Menu 4 (PPTP) Screen.........................................................................22-4

Table 22-3 New Fields in Menu 4 (PPPoE) screen .......................................................................22-5

Table 23-1 Fields in Menu 11.1 .....................................................................................................23-3

Table 23-2 Fields in Menu 11.1 (PPPoE Encapsulation Specific).................................................23-6

Table 23-3 Fields in Menu 11.1 (PPTP Encapsulation).................................................................23-7

Table 23-4 Remote Node Network Layer Options Menu Fields ...................................................23-8

Table 23-5 Menu 11.1: Remote Node Profile (Traffic Redirect Field)........................................23-12

Table 23-6 Menu 11.6: Traffic Redirect Setup ............................................................................23-13

Table 24-1 IP Static Route Menu Fields ........................................................................................24-2

Table 25-1 Applying NAT in Menus 4 & 11.3...............................................................................25-3

Table 25-2 SUA Address Mapping Rules ......................................................................................25-6

Table 25-3 Fields in Menu 15.1.1 ..................................................................................................25-8

315717-A Rev 00

List of Tables xxxi

Table 25-4 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set ...............................25-9

Table 25-5 Menu 15.3: Trigger Port Setup Description ..............................................................25-20

Table 27-1 Abbreviations Used in the Filter Rules Summary Menu.............................................27-5

Table 27-2 Rule Abbreviations Used.............................................................................................27-6

Table 27-3 TCP/IP Filter Rule Menu Fields..................................................................................27-7

Table 27-4 Generic Filter Rule Menu Fields ............................................................................... 27-11

Table 28-1 SNMP Configuration Menu Fields..............................................................................28-1

Table 28-2 SNMP Traps ................................................................................................................28-2

Table 29-1 System Maintenance: Status Menu Fields...................................................................29-2

Table 29-2 Fields in System Maintenance: Information ...............................................................29-5

Table 29-3 System Maintenance Menu Syslog Parameters...........................................................29-7

Table 29-4 System Maintenance Menu Diagnostic .....................................................................29-12

Table 30-1 Filename Conventions.................................................................................................30-2

Table 30-2 General Commands for GUI-based FTP Clients .........................................................30-4

Table 30-3 General Commands for GUI-based TFTP Clients ......................................................30-6

Table 31-1 Valid Commands .........................................................................................................31-2

Table 31-2 Budget Management ...................................................................................................31-4

Table 31-3 Call History Fields ......................................................................................................31-5

Table 31-4 Time and Date Setting Fields ......................................................................................31-7

Table 32-1 Menu 24.11 – Remote Management Control ..............................................................32-2

Table 33-1Schedule Set Setup Fields ............................................................................................33-2


xxxiii

Preface

Congratulations on your purchase of the Contivity 221 VPN Switch.

About This User's Manual

This manual is designed to guide you through the configuration of your Contivity

221 for its various applications.

This manual may refer to the Contivity 221 VPN Switch as the Contivity 221.

You may use the System Management Terminal (SMT), WebGUI or command interpreter interface to configure your Contivity 221.

Not all features can be configured through all interfaces. This

User's Guide primarily shows SMT configuration but includes the other interfaces where appropriate.

The WebGUI parts of this guide contain background information on features configurable by the WebGUI and the SMT. The SMT parts of this guide contain background information solely on features not configurable by the WebGUI.

Related Publications

¾

¾

Quick Start Guide

The Quick Start Guide is designed to help you get up and running right away. It contains a detailed easy-to-follow connection diagram, default settings, handy checklists and information on setting up your network and configuring for Internet access.

WebGUI Online Help

Embedded web help for descriptions of individual screens and supplementary information.

Syntax Conventions

• “Enter” means for you to type one or more characters and press the carriage return. “Select” or “Choose” means for you to use one of the predefined choices.

• The SMT menu titles and labels are in Bold Times New Roman font.

• The choices of a menu item are in Bold Arial font.

• A single keystroke is in Arial font and enclosed in square brackets, for instance, [ENTER] means the Enter, or carriage return, key; [ESC] means the


xxxiv Preface

escape key and [SPACE BAR] means the space bar. [UP] and [DOWN] are the up and down arrow keys.

• Mouse action sequences are denoted using a comma. For example, “click the

Apple icon, Control Panels and then Modem” means first click the Apple icon, then point your mouse pointer to Control Panels and then click Modem.

• For brevity’s sake, we will use “e.g.” as a shorthand for “for instance” and

“i.e.” for “that is” or “in other words” throughout this manual.

How to get help

If you purchased a service contract for your Nortel Networks product from a distributor or authorized reseller, contact the technical support staff for that distributor or reseller for assistance.

If you purchased a Nortel Networks service program, contact one of the following Nortel Networks

Technical Solutions Centers:

Technical Solutions Center

Europe, Middle East, and Africa

North America

Asia Pacific

China

Telephone

(33) (4) 92-966-968

(800) 4NORTEL or (800) 466-7835

(61) (2) 9927-8800

(800) 810-5000

Additional information about the Nortel Networks Technical Solutions Centers is available from the

www.nortelnetworks.com/help/contact/global

URL.

An Express Routing Code (ERC) is available for many Nortel Networks products and services.

When you use an ERC, your call is routed to a technical support person who specializes in supporting that product or service. To locate an ERC for your product or service, go to the

http://www.nortelnetworks.com/help/contact/erc/index.html

URL.

315717-A Rev 00

Overview

Part I:

Overview

This part covers Getting to Know Your Contivity 221

I

1-1

Chapter 1

Getting to Know Your Contivity 221

This chapter introduces the main features and applications of the Contivity 221.

1.1

Introducing the Contivity 221

The Contivity 221 VPN Switch is an ideal secure gateway for all data passing between the Internet and the LAN.

By integrating NAT, firewall and VPN capability, Nortel Networks’ Contivity 221 is a complete security solution that protects your Intranet and efficiently manages data traffic on your network.

The embedded WebGUI is easy to operate and totally independent of your operating system platform.

1.2

Features

Here is a list of the Contivity 221’s key features.

1.2.1 Physical Features

4-Port Switch

A combination of switch and router makes your Contivity 221 a cost-effective and viable network solution. You can connect up to four computers to the Contivity

221 without the cost of a hub. Use a hub to add more than four computers to your

LAN.

Auto-negotiating 10/100 Mbps Ethernet LAN

The LAN interfaces automatically detect if they are on a 10 or a 100 Mbps

Ethernet.

Auto-sensing 10/100 Mbps Ethernet LAN

The LAN interfaces automatically adjust to either a crossover or straight-through

Ethernet cable.


1-2 Getting to Know Your Contivity 221

Auto-negotiating 10/100 Mbps Ethernet WAN

The 10/100 Mbps Ethernet WAN port attaches to the Internet via broadband modem or router and automatically detects if it’s on a 10 or a 100 Mbps Ethernet.

Auxiliary Port

The Contivity 221 uses the same port for console management and for an auxiliary

WAN backup. The AUX port can be used in reserve as a traditional dial-up connection when/if ever the broadband connection to the WAN port fails.

Time and Date

The Contivity 221 allows you to get the current time and date from an external server when you turn on your Contivity 221. You can also set the time manually.

Reset Button

The Contivity 221 reset button is built into the rear panel. Use this button to restore the factory default password to setup, IP address to 192.168.1.1, subnet mask to

255.255.255.0 and DHCP server enabled with a pool of 32 IP addresses starting at

192.168.1.3.

1.2.2 Non-Physical Features

IPSec VPN Capability

Establish Virtual Private Network (VPN) tunnels to connect (home) office computers to your company network using data encryption and the Internet; thus providing secure communications without the expense of leased site-to-site lines.

VPN is based on the IPSec standard and is fully interoperable with other IPSecbased VPN products.

The Contivity 221 supports five simultaneous VPN connections.

Firewall

The Contivity 221 has a stateful inspection firewall with DoS (Denial of Service) protection. By default, when the firewall is activated, all incoming traffic from the

WAN to the LAN is blocked unless it is initiated from the LAN. The Contivity 221 firewall supports TCP/UDP inspection, DoS detection and protection, real time alerts, reports and logs.

317517-A Rev 00

Getting to Know Your Contivity 221

1-3

Brute-Force Password Guessing Protection

The Contivity 221 has a special protection mechanism to discourage brute-force password guessing attacks on the Contivity 221’s management interfaces. You can specify a wait-time that must expire before entering a fourth password after three incorrect passwords have been entered. Please see the appendices for details about this feature.

Content Filtering

The Contivity 221 can block web features such as ActiveX controls, Java applets and cookies, as well as disable web proxies. The Contivity 221 can block specific

URLs by using the keyword feature. It also allows the administrator to define time periods and days during which content filtering is enabled.

Packet Filtering

The packet filtering mechanism blocks unwanted traffic from entering/leaving your network.

Universal Plug and Play (UPnP)

Using the standard TCP/IP protocol, the Contivity 221 and other UPnP enabled devices can dynamically join a network, obtain an IP address and convey its capabilities to other devices on the network.

Call Scheduling

Configure call time periods to restrict and allow access for users on remote nodes.

PPPoE

PPPoE facilitates the interaction of a host with an Internet modem to achieve access to high-speed data networks via a familiar "dial-up networking" user interface.

PPTP Encapsulation

Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual

Private Network (VPN) using a TCP/IP-based network.

PPTP supports on-demand, multi-protocol and virtual private networking over public networks, such as the Internet. The Contivity 221 supports one PPTP server connection at any given time.



Dynamic DNS Support

IP Multicast

With Dynamic DNS (Domain Name System) support, you can have a static hostname alias for a dynamic IP address, allowing the host to be more easily accessible from various locations on the Internet. You must register for this service with a Dynamic DNS service provider.

IP Alias

IP Alias allows you to partition a physical network into logical networks over the same Ethernet interface. The Contivity 221 supports three logical LAN interfaces via its single physical Ethernet LAN interface with the Contivity 221 itself as the gateway for each LAN network.

Central Network Management

Central Network Management (CNM) allows an enterprise or service provider network administrator to manage your Contivity 221. The enterprise or service provider network administrator can configure your Contivity 221, perform firmware upgrades and do troubleshooting for you.

SNMP

Deliver IP packets to a specific group of hosts using IP multicast. IGMP (Internet

Group Management Protocol) is the protocol used to support multicast groups. The latest version is version 2 (see RFC 2236); the Contivity 221 supports both versions 1 and 2.

SNMP (Simple Network Management Protocol) is a protocol used for exchanging management information between network devices. SNMP is a member of the

TCP/IP protocol suite. Your Contivity 221 supports SNMP agent functionality, which allows a manager station to manage and monitor the Contivity 221 through the network. The Contivity 221 supports SNMP version one (SNMPv1).

Network Address Translation (NAT)

NAT (Network Address Translation - NAT, RFC 1631) allows the translation of multiple IP addresses used within one network to different IP addresses known within another network.

317517-A Rev 00


1-5

Traffic Redirect

Traffic Redirect forwards WAN traffic to a backup gateway when the Contivity

221 cannot connect to the Internet, thus acting as an auxiliary backup when your regular WAN connection fails.

Port Forwarding

Use this feature to forward incoming service requests to a server on your local network. You may enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server.

DHCP (Dynamic Host Configuration Protocol)

DHCP (Dynamic Host Configuration Protocol) allows the individual client computers to obtain the TCP/IP configuration at start-up from a centralized DHCP server. The Contivity 221 has built-in DHCP server capability, enabled by default, which means it can assign IP addresses, an IP default gateway and DNS servers to all systems that support the DHCP client. The Contivity 221 can also act as a surrogate DHCP server (DHCP Relay) where it relays IP address assignment from another DHCP server to the clients.

Full Network Management

The embedded WebGUI is an all-platform web-based utility that allows you to easily access the Contivity 221’s management settings and configure the firewall.

The Contivity 221 also provides the SMT (System Management Terminal) interface. The SMT is a menu-driven interface that you can access from a terminal emulator through the console port or over a telnet connection.

RoadRunner Support

In addition to standard cable modem services, the Contivity 221 supports Time

Warner’s RoadRunner Service.

Logging and Tracing

♦

♦

♦

♦

Built-in message logging and packet tracing.

Unix syslog facility support.

Firewall logs.

Content filtering logs.



Upgrade Contivity 221 Firmware

The firmware of the Contivity 221 can be upgraded via the console port or the

LAN.

Embedded FTP and TFTP Servers

The Contivity 221’s embedded FTP and TFTP Servers enable fast firmware upgrades as well as configuration file backups and restoration.

1.3

Applications for the Contivity 221

1.3.1 Secure Broadband Internet Access and VPN

You can connect a cable, DSL or wireless modem to the Contivity 221 via

Ethernet for broadband Internet access. The Contivity 221 also provides IP address sharing and a firewall-protected local network with traffic management.

VPN is an ideal cost-effective way to connect branch offices and business partners over the Internet without the need (and expense) of leased lines between sites. The

LAN computers can share the five VPN tunnels for secure connections to remote computers.

317517-A Rev 00

Figure 1-1 Secure Internet Access and VPN Application


1-7

1.4

Hardware Setup

Please refer to your Quick Start Guide for hardware connection instructions.

To keep the Contivity 221 operating at optimal internal temperature, keep the bottom, sides and rear clear of obstructions and away from the exhaust of other equipment.

After installing your Contivity 221, continue with the rest of this User’s Guide for configuration instructions.


Getting Started

Part II:

Getting Started

This part helps you get to know your Contivity 221, introduces the WebGUI and covers how to configure the Wizard Setup screens.

II

2-1

Chapter 2

Introducing the WebGUI

This chapter describes how to access the Contivity 221 WebGUI and provides an overview of its screens.

2.1

WebGUI Overview

The embedded WebGUI allows you to manage the Contivity 221 from anywhere through a browser such as Microsoft Internet Explorer or Netscape Navigator. Use Internet Explorer 6.0 and later or Netscape Navigator 7.0 and later versions with JavaScript enabled. It is recommended that you set your screen resolution to 1024 by 768 pixels. The screens you see in the WebGUI may vary somewhat from the ones shown in this document due to differences between individual Contivity

221 models or firmware versions.

2.2

Step 1.

Step 2.

Step 3.

Step 4.

Step 5.

Accessing the Contivity 221 WebGUI

Make sure your Contivity 221 hardware is properly connected and prepare your computer/computer network to connect to the Contivity 221 (refer to the Quick Start

Guide).

Launch your web browser.

Type "192.168.1.1" as the URL.

Type "setup" (default) as the password and click Login. In some versions, the default password appears automatically - if this is the case, click Login.

You should see a screen asking you to change your password (highly recommended) as shown next. Type a new password (and retype it to confirm) and click Apply or click Ignore.


2-2 Introducing the WebGUI

Figure 2-1 Change Password Screen

Step 6.

You should now see the MAIN MENU screen (see Figure 2-3).

The management session automatically times out when the time period set in the

Administrator Inactivity Timer field expires (default five minutes). Simply log back

into the Contivity 221 if this happens to you.

2.3

Resetting the Contivity 221

If you forget your password or cannot access the SMT menu, you will need to reload the factorydefault configuration file or use the RESET button the back of the Contivity 221. Uploading this configuration file replaces the current configuration file with the factory-default configuration file.

This means that you will lose all configurations that you had previously and the speed of the console port will be reset to the default of 9600bps with 8 data bit, no parity, one stop bit and flow control set to none. The password will be reset to “setup”, also.

2.3.1 Procedure To Use The Reset Button

Step 1.

Press the RESET button for ten seconds, and then release it. The Contivity 221 restarts.

Otherwise, go to step 2.

Step 2.

Turn the Contivity 221 off.

Step 3.

While pressing the RESET button, turn the Contivity 221 on.

317517-A Rev 00

Introducing the WebGUI 2-3

Step 4.

Continue to hold the RESET button for about 10 or 15 seconds. The Contivity 221 restarts.

Step 5.

Release the RESET button and wait for the Contivity 221 to finish restarting.

2.3.2 Uploading a Configuration File Via Console Port

Step 1.

Download the default configuration file from the Nortel Networks FTP site, unzip it and save it in a folder.

Step 2.

Turn off the Contivity 221, begin a terminal emulation software session and turn on the Contivity

221 again. When you see the message "Press Any key to enter Debug Mode within 3 seconds", press any key to enter debug mode.

Step 3.

Enter "y" at the prompt below to go into debug mode.

Step 4.

Enter "atlc" after "Enter Debug Mode" message.

Step 5.

Wait for "Starting XMODEM upload" message before activating Xmodem upload on your terminal. This is an example Xmodem configuration upload using HyperTerminal.

Step 6.

Click Transfer, then Send File to display the following screen.

Figure 2-2 Example Xmodem Upload

Type the configuration file’s location, or click Browse to search for it.

Choose the Xmodem protocol.

Then click Send.

Step 7.

After successful firmware upload, enter "atgo" to restart the router.

2.4

Navigating the Contivity 221 WebGUI

The following summarizes how to navigate the WebGUI from the MAIN MENU screen.


2-4 Introducing the WebGUI

Follow the instructions you see in the MAIN MENU screen or click the

(located in the top right corner of most screens) to view online help.

icon

The icon does not appear in the MAIN MENU screen.

Figure 2-3 The MAIN MENU Screen of the WebGUI

Click WIZARD for initial configuration including general setup, ISP parameters for Internet Access and WAN IP/DNS Server/MAC address assignment.

Use submenus to configure Contivity 221 features.

Click LOGOUT at any time to exit the

WebGUI.

Click MAINTENANCE to view information about your Contivity 221 or upgrade configuration/firmware files. Maintenance includes SYSTEM STATUS (Statistics), DHCP

TABLE, F/W (firmware) UPGRADE and CONFIGURATION (Backup, Restore Default).

317517-A Rev 00

3-1

Chapter 3

Wizard Setup

This chapter provides information on the Wizard screens in the WebGUI.

3.1

Wizard Overview

The WebGUI’s setup wizard helps you configure your device to access the Internet. The second screen has three variations depending on what encapsulation type you use. Refer to your ISP checklist in the Quick Start Guide to know what to enter in each field. Leave a field blank if you don’t have that information.

3.2

Wizard Setup: General Setup and System Name

General Setup contains administrative and system-related information. System Name is for

identification purposes. However, because some ISPs check this name you should enter your computer's "Computer Name".

•

In Windows 95/98 click Start, Settings, Control Panel, Network. Click the Identification tab, note the entry for the Computer Name field and enter it as the System Name.

•

In Windows 2000, click Start, Settings, Control Panel and then double-click System. Click the Network Identification tab and then the Properties button. Note the entry for the

Computer name field and enter it as the System Name.

•

In Windows XP, click Start, My Computer, View system information and then click the

Computer Name tab. Note the entry in the Full computer name field and enter it as the

Contivity 221 System Name.

The Domain Name entry is what is propagated to the DHCP clients on the LAN. If you leave this blank, the domain name obtained by DHCP from the ISP is used. While you must enter the host name (System Name) on each individual computer, the domain name can be assigned from the

Contivity 221 via DHCP.

Click Next to configure the Contivity 221 for Internet access.


3-2 Wizard Setup

Figure 3-1 Wizard 1

3.3

Wizard Setup: Screen 2

The Contivity 221 offers three choices of encapsulation. They are Ethernet, PPTP or PPPoE.

3.3.1 Ethernet

Choose Ethernet when the WAN port is used as a regular Ethernet.

317517-A Rev 00

Figure 3-2 Wizard 2: Ethernet Encapsulation

Wizard Setup 3-3

The following table describes the fields in this screen.

Table 3-1 Ethernet Encapsulation

LABEL DESCRIPTION

ISP Parameters for Internet Access

Encapsulation You must choose the Ethernet option when the WAN port is used as a regular

Ethernet. Otherwise, choose PPPoE or PPTP for a dial-up connection.

Service Type Choose from Standard, RR-Telstra (Telstra authentication method), RR-Manager

(Roadrunner Manager authentication method) or RR-Toshiba (Roadrunner Toshiba authentication method).

For ISPs (such as Telstra) that send UDP heartbeat packets to verify that the customer is still online, please create a WAN-to-WAN/Contivity221 firewall rule that allows access for port 1026 (UDP).

The following fields are not applicable (N/A) for the Standard service type.




LABEL

User Name

DESCRIPTION

Type the user name given to you by your ISP.

Password

Login Server IP

Address

Next

Back

Type the password associated with the user name above.

Type the authentication server IP address here if your ISP gave you one.

Click Next to continue.

Click Back to return to the previous screen.

Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables transfers of data from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IP-based networks.

PPTP supports on-demand, multi-protocol, and virtual private networking over public networks, such as the Internet.

Refer to the appendices for more information on PPTP.

317517-A Rev 00

Wizard Setup 3-5

The CONTIVITY 221 supports one PPTP server connection at any given time.

Figure 3-3 Wizard 2: PPTP Encapsulation


Table 3-2 PPTP Encapsulation



Encapsulation Select PPTP from the drop-down list box.

User Name Type the user name given to you by your ISP.

Password

Nailed Up

Connection

Type the password associated with the User Name above.

Select Nailed Up Connection if you do not want the connection to time out.





Idle Timeout Type the time in seconds that elapses before the router automatically disconnects from the PPTP server. The default is 45 seconds.

PPTP Configuration

My IP Address

My IP Subnet

Mask

Type the (static) IP address assigned to you by your ISP.

Type the subnet mask assigned to you by your ISP (if given).

Server IP Address Type the IP address of the PPTP server.

Connection

ID/Name

Enter the connection ID or connection name in this field. It must follow the "c:id" and

"n:name" format. For example, C:12 or N:My ISP.

This field is optional and depends on the requirements of your xDSL modem.

Next

Back



Point-to-Point Protocol over Ethernet (PPPoE) functions as a dial-up connection. PPPoE is an IETF

(Internet Engineering Task Force) draft standard specifying how a host personal computer interacts with a broadband modem (for example xDSL, cable, wireless, etc.) to achieve access to high-speed data networks. It preserves the existing Microsoft Dial-Up Networking experience and requires no new learning or procedures.

For the service provider, PPPoE offers an access and authentication method that works with existing access control systems (for instance, Radius). For the user, PPPoE provides a login and authentication method that the existing Microsoft Dial-Up Networking software can activate, and therefore requires no new learning or procedures for Windows users.

One of the benefits of PPPoE is the ability to let end users access one of multiple network services, a function known as dynamic service selection. This enables the service provider to easily create and offer new IP services for specific users.

Operationally, PPPoE saves significant effort for both the subscriber and the ISP/carrier, as it requires no specific configuration of the broadband modem at the subscriber’s site.

By implementing PPPoE directly on the Contivity 221 (rather than individual computers), the computers on the LAN do not need PPPoE software installed, since the Contivity 221 does that part of the task. Furthermore, with NAT, all of the LAN's computers will have Internet access.

Refer to the Appendices for more information on PPPoE.

317517-A Rev 00

Figure 3-4 Wizard2: PPPoE Encapsulation

Wizard Setup 3-7


Table 3-3 PPPoE Encapsulation


ISP Parameter for Internet Access

Encapsulation Choose an encapsulation method from the pull-down list box. PPPoE forms a dial-up connection.

Service Name Type the name of your service provider.

User Name

Password



Nailed Up Select Nailed Up Connection if you do not want the connection to time out.





Connection

Idle Timeout

Next

Back

Type the time in seconds that elapses before the router automatically disconnects from the PPPoE server. The default time is 100 seconds.



3.4

Wizard Setup: Screen 3

The third wizard screen allows you to configure WAN IP address assignment, DNS server address assignment and the WAN MAC address.

3.4.1 WAN IP Address Assignment

Every computer on the Internet must have a unique IP address. If your networks are isolated from the Internet, for instance, only between your two branch offices, you can assign any IP addresses to the hosts without problems. However, the Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of IP addresses specifically for private networks.

Table 3-4 Private IP Address Ranges

192.168.0.0 - 192.168.255.255

You can obtain your IP address from the IANA, from an ISP or have it assigned by a private network. If you belong to a small organization and your Internet access is through an ISP, the ISP can provide you with the Internet addresses for your local networks. On the other hand, if you are part of a much larger organization, you should consult your network administrator for the appropriate IP addresses.

317517-A Rev 00

Wizard Setup 3-9

Regardless of your particular situation, do not create an arbitrary IP address; always follow the guidelines above. For more information on address assignment, please refer to RFC 1597, Address Allocation for Private Internets and RFC 1466,

Guidelines for Management of IP Address Space.

3.4.2 IP Address and Subnet Mask

Similar to the way houses on a street share a common street name, so too do computers on a LAN share one common network number.

Where you obtain your network number depends on your particular situation. If the ISP or your network administrator assigns you a block of registered IP addresses, follow their instructions in selecting the IP addresses and the subnet mask.

If the ISP did not explicitly give you an IP network number, then most likely you have a single user account and the ISP will assign you a dynamic IP address when the connection is established. If this is the case, it is recommended that you select a network number from 192.168.0.0 to

192.168.255.0 and you must enable the Network Address Translation (NAT) feature of the

Contivity 221. The Internet Assigned Number Authority (IANA) reserved this block of addresses specifically for private use; please do not use any other number unless you are told otherwise. Let's say you select 192.168.1.0 as the network number; which covers 254 individual addresses, from

192.168.1.1 to 192.168.1.254 (zero and 255 are reserved). In other words, the first three numbers specify the network number while the last number identifies an individual computer on that network.

Once you have decided on the network number, pick an IP address that is easy to remember, for instance, 192.168.1.1, for your Contivity 221, but make sure that no other device on your network is using that IP address.

The subnet mask specifies the network number portion of an IP address. Your Contivity 221 will compute the subnet mask automatically based on the IP address that you entered. You don't need to change the subnet mask computed by the Contivity 221 unless you are instructed to do otherwise.

Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa, for instance, the IP address of www.nortelnetworks.com is 47.249.48.20. The DNS server is extremely important because without it, you must know the IP address of a computer before you can access it.

The Contivity 221 can get the DNS server addresses in the following ways.



1.

2.

The ISP tells you the DNS server addresses, usually in the form of an information sheet, when you sign up. If your ISP gives you DNS server addresses, enter them in the DNS Server fields in DHCP Setup.

If the ISP did not give you DNS server information, leave the DNS Server fields in DHCP

Setup set to 0.0.0.0 for the ISP to dynamically assign the DNS server IP addresses.

Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address is assigned at the factory and consists of six pairs of hexadecimal characters, for example,

00:A0:C5:00:00:02.

You can configure the WAN port's MAC address by either using the factory default or cloning the

MAC address from a computer on your LAN. Once it is successfully configured, the address will be copied to the "rom" file (configuration file). It will not change unless you change the setting or upload a different "rom" file.

Nortel Networks recommends you clone the MAC address from a computer on your

LAN even if your ISP does not require MAC address authentication.

Your Contivity 221’s WAN Port is set at half-duplex mode as most cable/DSL modems only support half-duplex mode. Make sure your modem is in half-duplex mode. Your Contivity 221 supports full duplex mode on the LAN side.

Table 3-5 Example of Network Properties for LAN Servers with Fixed IP Addresses

Choose an IP address

Subnet mask

192.168.1.2-192.168.1.32; 192.168.1.65-192.168.1.254.

255.255.255.0

Gateway (or default route) 192.168.1.1(Contivity 221 LAN IP)

The third wizard screen varies according to the type of encapsulation that you select in the second wizard screen.

317517-A Rev 00

Wizard Setup 3-11

Figure 3-5 Wizard 3


Table 3-6 WAN Setup

LABEL

WAN IP Address Assignment

DESCRIPTION

Get automatically from

ISP

Select this option If your ISP did not assign you a fixed IP address. This is the default selection.

Use fixed IP address Select this option If the ISP assigned a fixed IP address.

IP Address

Enter your WAN IP address in this field if you selected Use Fixed IP Address.

IP Subnet Mask Enter the IP subnet mask in this field if you selected Use Fixed IP Address.

This field is not available when you select PPPoE encapsulation in the previous wizard screen.

Gateway IP Address Enter the gateway IP address in this field if you selected Use Fixed IP

Address. This field is not available when you select PPPoE encapsulation in




LABEL

the previous wizard screen.

DESCRIPTION

DNS Server Address

Assignment

DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa, e.g., the IP address of www.nortelnetworks.com is 47.249.48.20. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it.

Get automatically from

ISP

Use fixed IP address -

DNS Server IP Address

Select this option if your ISP does not give you DNS server addresses. This option is selected by default.

Select this option If your ISP provides you a DNS server address.

System DNS Servers (if applicable)

DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it. The Contivity 221 uses a system DNS server (in the order you specify here) to resolve domain names for VPN, DDNS and the time server.

First DNS Server

Second DNS Server

Third DNS Server

Select From ISP if your ISP dynamically assigns DNS server information (and the Contivity 221’s WAN IP address). The field to the right displays the (readonly) DNS server IP address that the ISP assigns. If you chose From ISP, but the Contivity 221 has a fixed WAN IP address, From ISP changes to None after you click Apply. If you chose From ISP for the second or third DNS server, but the ISP does not provide a second or third IP address, From ISP changes to

None after you click Apply.

Select User-Defined if you have the IP address of a DNS server. Enter the

DNS server's IP address in the field to the right. If you chose User-Defined, but leave the IP address set to 0.0.0.0, User-Defined changes to None after you click Apply. If you set a second choice to User-Defined, and enter the same IP address, the second User-Defined changes to None after you click Apply.

Select None if you do not want to configure DNS servers. If you do not configure a system DNS server, you must use IP addresses when configuring

VPN, DDNS and the time server.

WAN MAC Address The MAC address field allows you to configure the WAN port's MAC Address by either using the factory default or cloning the MAC address from a computer on your LAN.

Factory Default

Select this option to use the factory assigned default MAC Address.

317517-A Rev 00

Wizard Setup 3-13


LABEL

Spoof this Computer's

MAC address - IP

Address

DESCRIPTION

Select this option and enter the IP address of the computer on the LAN whose

MAC you are cloning. Once it is successfully configured, the address will be copied to the rom file (configuration file). It will not change unless you change the setting or upload a different rom file. It is advisable to clone the MAC address from a computer on your LAN even if your ISP does not presently require MAC address authentication.

Back Click Back to return to the previous screen.

Finish Click Finish to complete and save the wizard setup.

3.5

Basic Setup Complete

Well done! You have successfully set up your Contivity 221 to operate on your network and access the Internet.


System LAN and WAN

Part III:

System LAN and WAN

This part covers configuration of the system LAN and WAN screens.

II

4-1

Chapter 4

System Screens

This chapter provides information on the System screens.

4.1

System Overview

See the Wizard Setup chapter for more information on the next few screens.

There are three places where you can configure DNS setup on the Contivity 221.

1. Use the System General screen to configure the Contivity 221 to use a DNS server to resolve domain names for Contivity 221 system features like VPN, DDNS and the time server.

2. Use the LAN IP screen to configure the DNS server information that the Contivity 221 sends to the DHCP client devices on the LAN.

3. Use the Remote Management DNS screen to configure the Contivity 221 to accept or discard DNS queries.

4.2

Configuring General Setup

Click SYSTEM to open the General screen.


4-2 System Screens

Figure 4-1 System General Setup


Table 4-1 System General Setup


System Name

Domain Name

Administrator

Inactivity Timer

Choose a descriptive name for identification purposes. It is recommended you enter your computer’s “Computer name” in this field (see the Wizard Setup chapter for how to find your computer’s name). This name can be up to 30 alphanumeric characters long. Spaces are not allowed, but dashes “-” and underscores "_" are accepted.

Enter the domain name (if you know it) here. If you leave this field blank, the ISP may assign a domain name via DHCP.

The domain name entered by you is given priority over the ISP assigned domain name.

Type how many minutes a management session (either via the WebGUI or SMT) can be left idle before the session times out. The default is 5 minutes. After it times out you have to log in with your password again. Very long idle timeouts may have security risks. A value of "0" means a management session never times out, no matter how long it has been left idle (not recommended).

317517-A Rev 00

System Screens 4-3

Table 4-1 System General Setup


System DNS Servers (if applicable)

DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it. The Contivity 221 uses a system DNS server (in the order you specify here) to resolve domain names for VPN, DDNS and the time server.

First DNS Server

Second DNS

Server

Third DNS

Server

Select From ISP if your ISP dynamically assigns DNS server information (and the

Contivity 221’s WAN IP address). The field to the right displays the (read-only) DNS server IP address that the ISP assigns. If you chose From ISP, but the Contivity 221 has a fixed WAN IP address, From ISP changes to None after you click Apply. If you chose From ISP for the second or third DNS server, but the ISP does not provide a second or third IP address, From ISP changes to None after you click Apply.

Select User-Defined if you have the IP address of a DNS server. Enter the DNS server's IP address in the field to the right. If you chose User-Defined, but leave the IP address set to 0.0.0.0, User-Defined changes to None after you click Apply. If you set a second choice to User-Defined, and enter the same IP address, the second User-

Defined changes to None after you click Apply.

Select None if you do not want to configure DNS servers. If you do not configure a system DNS server, you must use IP addresses when configuring VPN, DDNS and the time server.

4.3

Dynamic DNS

Dynamic DNS allows you to update your current dynamic IP address with one or many dynamic

DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.). You can also access your FTP server or Web site on your own computer using a domain name (for instance myhost.dhs.org, where myhost is a name of your choice) that will never change instead of using an

IP address that changes each time you reconnect. Your friends or relatives will always be able to call you even if they don't know your IP address.

First of all, you need to have registered a dynamic DNS account with www.dyndns.org. This is for people with a dynamic IP from their ISP or DHCP server that would still like to have a domain name. The Dynamic DNS service provider will give you a password or key.

Enabling the wildcard feature for your host causes *.yourhost.dyndns.org to be aliased to the same

IP address as yourhost.dyndns.org. This feature is useful if you want to be able to use, for example, www.yourhost.dyndns.org and still reach your hostname.



If you have a private WAN IP address, then you cannot use Dynamic DNS.

4.4

Configuring Dynamic DNS

To change your Contivity 221’s DDNS, click SYSTEM, then the DDNS tab. The screen appears as shown.

Figure 4-2 DDNS


Table 4-2 DDNS


Active

Service Provider

Select this check box to use dynamic DNS.

Select the name of your Dynamic DNS service provider.

317517-A Rev 00

System Screens 4-5

Table 4-2 DDNS


DDNS Type

Host Names 1~3

Select the type of service that you are registered for from your Dynamic DNS service provider.

Enter the host names in the three fields provided. You can specify up to two host names in each field separated by a comma (",").

Password

Enable Wildcard

Off Line

Enter the password assigned to you.

Select the check box to enable DYNDNS Wildcard.

This option is available when CustomDNS is selected in the DDNS Type field.

Check with your Dynamic DNS service provider to have traffic redirected to a

URL (that you can specify) while you are off line.

Edit Update IP Address:

Server Auto Detect Select this option to update the IP address of the host name(s) automatically by the DDNS server. It is recommended that you select this option.

User Specify Select this option to update the IP address of the host name(s) to the IP address specified below. Use this option if you have a static IP address.

IP Addr Enter the IP address if you select the User Specify option.

4.5

Configuring Password

To change your Contivity 221’s password (recommended), click SYSTEM, then the Password tab. The screen appears as shown. This screen allows you to change the Contivity 221’s password.



Figure 4-3 Password


Table 4-3 Password


Old Password

New Password

Retype to Confirm

Type the default password or the existing password you use to access the system in this field.

Type the new password in this field.

Type the new password again in this field.

4.6

Configuring Time Setting

To change your Contivity 221’s time and date, click SYSTEM, then the Time Setting tab. The screen appears as shown. Use this screen to configure the Contivity 221’s time based on your local time zone.

317517-A Rev 00

System Screens 4-7

Figure 4-4 Time Setting


Table 4-4 Time Setting


Time Protocol Select the time service protocol that your time server sends when you turn on the

Contivity 221. Not all time servers support all protocols, so you may have to check with your ISP/network administrator or use trial and error to find a protocol that works.

The main differences between them are the format.

Daytime (RFC-867) format is day/month/year/time zone of the server.

Time (RFC-868) format displays a 4-byte integer giving the total number of seconds since 1970/1/1 at 0:0:0.

The default, NTP (RFC-1305), is similar to Time (RFC-868).

Select None to enter the time and date manually.

Time Server

Address

Enter the address of your time server. Check with your ISP/network administrator if you are unsure of this information (the default is time-b.nist.gov).



Table 4-4 Time Setting


Current Time

New Time

Current Date

New Date

Time Setting

Daylight Savings

Start Date

End Date

This field displays the time of your Contivity 221.

Each time you reload this page, the Contivity 221 synchronizes the time with the time server.

This field displays the last updated time from the time server.

When you select None in the Use Time Server when Bootup field, enter the new time in this field and then click Apply.

This field displays the date of your Contivity 221.

Each time you reload this page, the Contivity 221 synchronizes the time with the time server.

This field displays the last updated date from the time server.

When you select None in the Use Time Server when Bootup field, enter the new date in this field and then click Apply.

Choose the Time Setting of your location. This will set the time difference between your time zone and Greenwich Mean Time (GMT).

Select this option if you use daylight savings time. Daylight saving is a period from late spring to early fall when many countries set their clocks ahead of normal local time by one hour to give more daytime light in the evening.

Enter the month and day that your daylight-savings time starts on if you selected

Daylight Savings.

Enter the month and day that your daylight-savings time ends on if you selected

Daylight Savings.

317517-A Rev 00

5-1

Chapter 5

LAN Screens

This chapter describes how to configure LAN settings.

5.1

LAN Overview

Local Area Network (LAN) is a shared communication system to which many computers are attached. The LAN screens can help you configure a LAN DHCP server, manage IP addresses, and partition your physical network into logical networks.

5.2

DHCP Setup

DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the Contivity 221 as a

DHCP server or disable it. When configured as a server, the Contivity 221 provides the TCP/IP configuration for the clients. If set to None, DHCP service will be disabled and you must have another DHCP server on your LAN, or else the computer must be manually configured.

The Contivity 221 is pre-configured with a pool of 32 IP addresses starting from 192.168.1.3 to

192.168.1.34. This configuration leaves 31 IP addresses (excluding the Contivity 221 itself) in the lower range for other server computers, for instance, servers for mail, FTP, TFTP, web, etc., that you may have.

Use the LAN IP screen to configure the DNS server information that the Contivity 221 sends to the

DHCP client devices on the LAN.

5.3

LAN TCP/IP

The Contivity 221 has built-in DHCP server capability that assigns IP addresses and DNS servers to systems that support DHCP client capability.

The LAN parameters of the Contivity 221 are preset in the factory with the following values:


5-2 LAN Screens

¾ IP address of 192.168.1.1 with subnet mask of 255.255.255.0 (24 bits)

¾ DHCP server enabled with 32 client IP addresses starting from 192.168.1.3.

These parameters should work for the majority of installations. If your ISP gives you explicit DNS server address(es), read the embedded WebGUI help regarding what fields need to be configured.

5.3.2 IP Address and Subnet Mask

Refer to the IP Address and Subnet Mask section in the Wizard Setup chapter for this information.

RIP (Routing Information Protocol, RFC 1058 and RFC 1389) allows a router to exchange routing information with other routers. RIP Direction controls the sending and receiving of RIP packets.

When set to Both or Out Only, the Contivity 221 will broadcast its routing table periodically.

When set to Both or In Only, it will incorporate the RIP information that it receives; when set to

None, it will not send any RIP packets and will ignore any RIP packets received.

RIP Version controls the format and the broadcasting method of the RIP packets that the Contivity

221 sends (it recognizes both formats when receiving). RIP-1 is universally supported; but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology.

Both RIP-2B and RIP-2M send routing data in RIP-2 format; the difference being that RIP-2B uses subnet broadcasting while RIP-2M uses multicasting. Multicasting can reduce the load on non-router machines since they generally do not listen to the RIP multicast address and so will not receive the RIP packets. However, if one router uses multicasting, then all routers on your network must use multicasting, also.

By default, RIP Direction is set to Both and RIP Version to RIP-1.

5.3.4 Multicast

Traditionally, IP packets are transmitted in one of either two ways - Unicast (1 sender - 1 recipient) or Broadcast (1 sender - everybody on the network). Multicast delivers IP packets to a group of hosts on the network - not everybody and not just 1.

IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use. If you would like to read more detailed information about interoperability between IGMP version 2 and version

1, please see sections 4 and 5 of RFC 2236. The class D IP address is used to identify host groups and can be in the range 224.0.0.0 to 239.255.255.255. The address 224.0.0.0 is not assigned to any group and is used by IP multicast computers. The address 224.0.0.1 is used for query messages and

317517-A Rev 00

LAN Screens 5-3 is assigned to the permanent group of all IP hosts (including gateways). All hosts must join the

224.0.0.1 group in order to participate in IGMP. The address 224.0.0.2 is assigned to the multicast routers group.

The Contivity 221 supports both IGMP version 1 (IGMP-v1) and IGMP version 2 (IGMP-v2). At start up, the Contivity 221 queries all directly connected networks to gather group membership.

After that, the Contivity 221 periodically updates this information. IP multicasting can be enabled/disabled on the Contivity 221 LAN and/or WAN interfaces in the WebGUI (LAN; WAN).

Select None to disable IP multicasting on these interfaces.

5.4

Configuring IP

Click LAN to open the IP screen.

Figure 5-1 IP



5-4 LAN Screens

Table 5-1 IP


DHCP Server

DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients (workstations) to obtain TCP/IP configuration at startup from a server. Unless you are instructed by your ISP, leave the DHCP Server check box selected. Clear it to disable the Contivity 221 acting as a DHCP server. When configured as a server, the Contivity 221 provides TCP/IP configuration for the clients. If not, DHCP service is disabled and you must have another DHCP sever on your LAN, or else the workstation must be manually configured. When set as a server, fill in the following four fields.

IP Pool Starting

Address

Pool Size

This field specifies the first of the contiguous addresses in the IP address pool. The default is 192.168.1.3.

This field specifies the size, or count, of the IP address pool. The default is 32.

DNS Servers Assigned by DHCP Server

The Contivity 221 passes a DNS (Domain Name System) server IP address (in the order you specify here) to the DHCP clients. The Contivity 221 only passes this information to the LAN DHCP clients when you select the DHCP Server check box. When you clear the DHCP Server check box, DHCP service is disabled and you must have another DHCP sever on your LAN, or else the computers must have their

DNS server addresses manually configured.

First DNS Server

Second DNS

Server

Third DNS Server

Select From ISP if your ISP dynamically assigns DNS server information (and the

Contivity 221's WAN IP address). The field to the right displays the (read-only) DNS server IP address that the ISP assigns.

Select User-Defined if you have the IP address of a DNS server. Enter the DNS server's IP address in the field to the right.

Select DNS Relay to have the Contivity 221 act as a DNS proxy. The Contivity 221's

LAN IP address displays in the field to the right (read-only). The Contivity 221 tells the DHCP clients on the LAN that the Contivity 221 itself is the DNS server. When a computer on the LAN sends a DNS query to the Contivity 221, the Contivity 221 forwards the query to the Contivity 221's system DNS server (configured in the

SYSTEM General screen) and relays the response back to the computer. You can only select DNS Relay for one of the three servers;

Select None if you do not want to configure DNS servers. If you do not configure a

DNS server, you must know the IP address of a machine in order to access it.

LAN TCP/IP

IP Address

Type the IP address of your Contivity 221 in dotted decimal notation (192.168.1.1

(factory default).

317517-A Rev 00

LAN Screens 5-5

Table 5-1 IP


IP Subnet Mask

RIP Direction

The subnet mask specifies the network number portion of an IP address. Your

Contivity 221 will automatically calculate the subnet mask based on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the Contivity 221 255.255.255.0.

RIP (Routing Information Protocol, RFC 1058 and RFC 1389) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. Select the RIP direction from Both/In

Only/Out Only/None. When set to Both or Out Only, the Contivity 221 will broadcast its routing table periodically. When set to Both or In Only, it will incorporate the RIP information that it receives; when set to None, it will not send any RIP packets and will ignore any RIP packets received. None is the default.

RIP Version

The RIP Version field controls the format and the broadcasting method of the RIP packets that the Contivity 221 sends (it recognizes both formats when receiving).

RIP-1 is universally supported but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology. Both

RIP-2B and RIP-2M sends the routing data in RIP-2 format; the difference being that

RIP-2B uses subnet broadcasting while RIP-2M uses multicasting. Multicasting can reduce the load on non-router machines since they generally do not listen to the RIP multicast address and so will not receive the RIP packets. However, if one router uses multicasting, then all routers on your network must use multicasting, also. By default, RIP direction is set to Both and the Version set to RIP-1.

Multicast

Select IGMP V-1 or IGMP V-2 or None. IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version

1 (RFC 1112) but IGMP version 1 is still in wide use. If you would like to read more detailed information about interoperability between IGMP version 2 and version 1, please see sections 4 and 5 of RFC 2236.

Windows Networking (NetBIOS over TCP/IP)

Allow between

LAN and WAN

Apply

Reset

Select this option to forward NetBIOS packets between the LAN port and the WAN port.

Click Apply to save your changes back to the Contivity 221.

Click Reset to begin configuring this screen afresh.

5.5

Configuring Static DHCP

This table allows you to assign IP addresses on the LAN to specific individual computers based on their MAC Addresses.


5-6 LAN Screens

Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address is assigned at the factory and consists of six pairs of hexadecimal characters, for example,

00:A0:C5:00:00:02.

To change your Contivity 221’s Static DHCP settings, click LAN, then the Static DHCP tab. The screen appears as shown.

Figure 5-2 Static DHCP


Table 5-2 Static DHCP


#

MAC Address

IP Address

This is the index number of the Static IP table entry (row).

Type the MAC address (with colons) of a computer on your LAN.

This field specifies the size, or count of the IP address pool.

317517-A Rev 00

LAN Screens 5-7

5.6

Configuring IP Alias

IP Alias allows you to partition a physical network into different logical networks over the same

Ethernet interface. The Contivity 221 supports three logical LAN interfaces via its single physical

Ethernet interface with the Contivity 221 itself as the gateway for each LAN network.

To change your Contivity 221’s IP Alias settings, click LAN, then the IP Alias tab. The screen appears as shown.

Figure 5-3 IP Alias


Table 5-3 IP Alias


IP Alias 1,2

IP Address

IP Subnet Mask

Select the check box to configure another LAN network for the Contivity 221.

Enter the IP address of your Contivity 221 in dotted decimal notation.

Your Contivity 221 will automatically calculate the subnet mask based on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the Contivity 221.


5-8 LAN Screens

Table 5-3 IP Alias


RIP Direction

RIP Version

RIP (Routing Information Protocol, RFC1058 and RFC 1389) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets. Select the RIP direction from Both/In

Only/Out Only/None. When set to Both or Out Only, the Contivity 221 will broadcast its routing table periodically. When set to Both or In Only, it will incorporate the RIP information that it receives; when set to None, it will not send any RIP packets and will ignore any RIP packets received.


RIP-1 is universally supported but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology. Both


RIP-2B uses subnet broadcasting while RIP-2M uses multicasting. Multicasting can reduce the load on non-router machines since they generally do not listen to the RIP multicast address and so will not receive the RIP packets. However, if one router uses multicasting, then all routers on your network must use multicasting, also. By default, RIP direction is set to Both and the Version set to RIP-1.

317517-A Rev 00

WAN Screens


6-1

Chapter 6

WAN Screens

This chapter describes how to configure WAN settings.

6.1

WAN Overview

See the Wizard Setup chapter for more information on the fields in the WAN screens.

6.2

TCP/IP Priority (Metric)

The metric represents the "cost of transmission". A router determines the best route for transmission by choosing a path with the lowest "cost". RIP routing uses hop count as the measurement of cost, with a minimum of "1" for directly connected networks. The number must be between "1" and "15"; a number greater than "15" means the link is down. The smaller the number, the lower the "cost".

The metric sets the priority for the Contivity 221’s routes to the Internet. If any two of the default routes have the same metric, the Contivity 221 uses the following pre-defined priorities:

1. Normal route: designated by the ISP (see section 6.5) or a static route (see the IP Static Route

Setup chapter)

2. Traffic-redirect route (see section 6.8)

3. Dial-backup route (see section 6.9)

For example, if the normal route has a metric of "1" and the traffic-redirect route has a metric of

"2" and dial-backup route has a metric of "3", then the normal route acts as the primary default route. If the normal route fails to connect to the Internet, the Contivity 221 tries the traffic-redirect route next. In the same manner, the Contivity 221 uses the dial-backup route if the traffic-redirect route also fails.

If you want the dial-backup route to take first priority over the traffic-redirect route or even the normal route, all you need to do is set the dial-backup route’s metric to "1" and the others to "2" (or greater).

6.3

Configuring Route

Click WAN to open the Route screen.


6-2 WAN Screens

Figure 6-1 WAN Setup: Route


Table 6-1 WAN Setup: Route


WAN

Traffic

Redirect

Dial Backup

The default WAN connection is "1' as your broadband connection via the WAN port should always be your preferred method of accessing the WAN. The default priority of the routes is WAN, Traffic Redirect and then Dial Backup (dial backup does not apply to all Contivity 221 models):

You have two choices for an auxiliary connection in the event that your regular WAN connection goes down. If Dial Backup is preferred to Traffic Redirect, then type "14" in the Dial Backup Priority (metric) field (and leave the Traffic Redirect Priority (metric) at the default of "15").

6.4

Configuring WAN ISP

To change your Contivity 221’s WAN ISP settings, click WAN, then the WAN ISP tab.

The screen differs by the encapsulation.

The screen shown next is for Ethernet encapsulation.

317517-A Rev 00

Figure 6-2 Ethernet Encapsulation

WAN Screens 6-3




Encapsulation You must choose the Ethernet option when the WAN port is used as a regular

Ethernet.

Service Type Choose from Standard, Telstra (RoadRunner Telstra authentication method), RR-

Manager (Roadrunner Manager authentication method) or RR-Toshiba (Roadrunner

Toshiba authentication method).

The following fields do not appear with the Standard service type.

User Name

Password

Login Server IP

Address



Type the authentication server IP address here if your ISP gave you one.

The Contivity 221 supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF

Draft standard (RFC 2516) specifying how a personal computer (PC) interacts with a broadband modem (DSL, cable, wireless, etc.) connection. The PPPoE option is for a dial-up connection using PPPoE.


6-4 WAN Screens

For the service provider, PPPoE offers an access and authentication method that works with existing access control systems (for example Radius). PPPoE provides a login and authentication method that the existing Microsoft Dial-Up Networking software can activate, and therefore requires no new learning or procedures for Windows users.

One of the benefits of PPPoE is the ability to let you access one of multiple network services, a function known as dynamic service selection. This enables the service provider to easily create and offer new IP services for individuals.

Operationally, PPPoE saves significant effort for both you and the ISP or carrier, as it requires no specific configuration of the broadband modem at the customer site.

By implementing PPPoE directly on the Contivity 221 (rather than individual computers), the computers on the LAN do not need PPPoE software installed, since the Contivity 221 does that part of the task. Furthermore, with NAT, all of the LANs’ computers will have access.

The screen shown next is for PPPoE encapsulation.

Figure 6-3 PPPoE Encapsulation


317517-A Rev 00

WAN Screens 6-5




Encapsulation The PPPoE choice is for a dial-up connection using PPPoE. The router supports

PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF Draft standard (RFC

2516) specifying how a personal computer (PC) interacts with a broadband modem (i.e. xDSL, cable, wireless, etc.) connection. Operationally, PPPoE saves significant effort for both the end user and ISP/carrier, as it requires no specific configuration of the broadband modem at the customer site. By implementing PPPoE directly on the router rather than individual computers, the computers on the LAN do not need PPPoE software installed, since the router does that part of the task. Further, with NAT, all of the LAN's computers will have access.

Service Name Type the PPPoE service name provided to you. PPPoE uses a service name to identify and reach the PPPoE server.

User Name

Password

Nailed Up

Connection

Idle Timeout

Type the User Name given to you by your ISP.



This value specifies the time in seconds that elapses before the router automatically disconnects from the PPPoE server.

Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IPbased networks.

PPTP supports on-demand, multi-protocol and virtual private networking over public networks, such as the Internet.

The screen shown next is for PPTP encapsulation.


6-6 WAN Screens

Figure 6-4 PPTP Encapsulation





Tunneling (PPTP) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a Virtual Private

Network (VPN) using TCP/IP-based networks. PPTP supports on-demand, multiprotocol, and virtual private networking over public networks, such as the Internet.

The Contivity 221 supports only one PPTP server connection at any given time. To configure a PPTP client, you must configure the My Login and Password fields for a PPP connection and the PPTP parameters for a PPTP connection.

User Name

Password

Nailed-up

Connection

Type the User Name given to you by your ISP.



317517-A Rev 00

WAN Screens 6-7



Idle Timeout This value specifies the time in seconds that elapses before the Contivity 221 automatically disconnects from the PPTP server.

PPTP Configuration

My IP Address Type the (static) IP address assigned to you by your ISP.

My IP Subnet Mask Your Contivity 221 will automatically calculate the subnet mask based on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the Contivity 221.

Server IP Address Type the IP address of the PPTP server.

Connection ID/Name Type your identification name for the PPTP server.

6.4.4

Service Type

The screen shown next is for RR- Service Type.

Figure 6-5 RR Service Type


6-8 WAN Screens


Table 6-5 RR Service Type


Encapsulation

Service Type

You must choose the Ethernet option when the WAN port is used as a regular

Ethernet.

Select from Standard, RR-Toshiba (RoadRunner Toshiba authentication method),

RR-Manager (Roadrunner Manager authentication method) or RR-Telstra. Choose a

Roadrunner service type if your ISP is Time Warner's Roadrunner; otherwise choose

Standard.

User Name

Password

Login Server IP

Address

Enter the username given to you by your ISP.

Enter the password associated with the login name above.

The Contivity 221 will find the Roadrunner Server IP address if this field is left blank. If it does not, then you must enter the authentication server IP address.

6.5

Configuring WAN IP

To change your Contivity 221’s WAN IP settings, click WAN, then the WAN IP tab.

This screen varies according to the type of encapsulation you select.

If your ISP did not assign you a fixed IP address, click Get automatically from ISP

(Default);otherwise click Use fixed IP Address and enter the IP address in the following field.

317517-A Rev 00

Figure 6-6 IP Setup

WAN Screens 6-9


Table 6-6 IP Setup

LABEL

WAN IP Address Assignment

DESCRIPTION

Get automatically from ISP

Use fixed IP address

IP Address

IP Subnet Mask

Select this option If your ISP did not assign you a fixed IP address. This is the default selection.

Select this option If the ISP assigned a fixed IP address.

Enter your WAN IP address in this field if you selected Use Fixed IP Address.

Enter the IP subnet mask (if your ISP gave you one) in this field if you selected Use

Fixed IP Address.


6-10 WAN Screens


LABEL

Gateway IP

Address

DESCRIPTION

Enter the gateway IP address (if your ISP gave you one) in this field if you selected

Use Fixed IP Address.

Network Address

Translation

Metric (PPPoE and PPTP only)

Private (PPPoE and PPTP only)

RIP Direction

Network Address Translation (NAT) allows the translation of an Internet protocol address used within one network (for example a private IP address used in a local network) to a different IP address known within another network (for example a public IP address used on the Internet).

Choose None to disable NAT.

Choose SUA Only if you have a single public IP address. SUA (Single User

Account) is a subset of NAT that supports two types of mapping: Many-to-One and

Server.

Choose Full Feature if you have multiple public IP addresses. Full Feature mapping types include: One-to-One, Many-to-One (SUA/PAT), Many-to-Many Overload,

Many- One-to-One and Server. When you select Full Feature you must configure at least one address mapping set!

For more information about NAT refer to the NAT chapter in this User's Guide.

This field sets this route's priority among the routes the Contivity 221 uses.


This parameter determines if the Contivity 221 will include the route to this remote node in its RIP broadcasts. If set to Yes, this route is kept private and not included in

RIP broadcast. If No, the route to this remote node will be propagated to other hosts through RIP broadcasts.

RIP (Routing Information Protocol) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets.

Choose Both, None, In Only or Out Only.


When set to Both or In Only, the Contivity 221 will incorporate RIP information that it receives.

When set to None, the Contivity 221 will not send any RIP packets and will ignore any RIP packets received.

By default, RIP Direction is set to Both.

317517-A Rev 00

WAN Screens 6-11


LABEL

RIP Version

DESCRIPTION


Choose RIP-1, RIP-2B or RIP-2M.

RIP-1 is universally supported; but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology. Both


RIP-2B uses subnet broadcasting while RIP-2M uses multicasting. Multicasting can reduce the load on non-router machines since they generally do not listen to the RIP multicast address and so will not receive the RIP packets. However, if one router uses multicasting, then all routers on your network must use multicasting, also. By default, the RIP Version field is set to RIP-1.

Protocol) is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use. If you would like to read more detailed information about interoperability between IGMP version 2 and version 1, please see sections 4 and 5 of RFC 2236.

Windows Networking (NetBIOS over TCP/IP): Windows Networking (NetBIOS over TCP/IP): NetBIOS

(Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN. For some dial-up services such as PPPoE or PPTP, NetBIOS packets cause unwanted calls.

Allow From WAN to LAN

Select this option to forward NetBIOS packets from the WAN port to the LAN port.

Allow Trigger Dial Select this option to allow NetBIOS packets to initiate calls.

6.6

Configuring WAN MAC

To change your Contivity 221’s WAN MAC settings, click WAN, then the WAN MAC tab. The screen appears as shown.



Figure 6-7 MAC Setup

The MAC address screen allows users to configure the WAN port's MAC Address by either using the factory default or cloning the MAC address from a computer on your LAN. Choose Factory

Default to select the factory assigned default MAC Address.

Otherwise, click Spoof this computer's MAC address - IP Address and enter the IP address of the computer on the LAN whose MAC you are cloning. Once it is successfully configured, the address will be copied to the rom file (configuration file). It will not change unless you change the setting or upload a different ROM file.

6.7

Traffic Redirect

Traffic redirect forwards WAN traffic to a backup gateway when the Contivity 221 cannot connect to the Internet through its normal gateway. Connect the backup gateway on the WAN so that the

Contivity 221 still provides firewall protection. This feature is not available on all models.

Figure 6-8 Traffic Redirect WAN Setup

317517-A Rev 00

WAN Screens 6-13

The following network topology allows you to avoid triangle route security issues (see Appendices) when the backup gateway is connected to the LAN. Use IP alias to configure the LAN into two or three logical networks with the Contivity 221 itself as the gateway for each LAN network. Put the protected LAN in one subnet (Subnet 1 in the following figure) and the backup gateway in another subnet (Subnet 2). Configure a LAN to LAN/Contivity 221 firewall rule that forwards packets from the protected LAN (Subnet 1) to the backup gateway (Subnet 2).

Figure 6-9 Traffic Redirect LAN Setup

6.8

Configuring Traffic Redirect

To change your Contivity 221’s Traffic Redirect settings, click WAN, then the Traffic Redirect tab. The screen appears as shown.



Figure 6-10 Traffic Redirect


Table 6-7 Traffic Redirect


Active

Backup

Gateway IP

Address

Metric

Select this check box to have the Contivity 221 use traffic redirect if the normal WAN connection goes down.

Type the IP address of your backup gateway in dotted decimal notation. The Contivity

221 automatically forwards traffic to this IP address if the Contivity 221's Internet connection terminates.

This field sets this route's priority among the routes the Contivity 221 uses.


317517-A Rev 00

WAN Screens 6-15

Table 6-7 Traffic Redirect


Check WAN

IP Address

Configuration of this field is optional. If you do not enter an IP address here, the Contivity

221 will use the default gateway IP address. Configure this field to test your Contivity

221's WAN accessibility. Type the IP address of a reliable nearby computer (for example, your ISP's DNS server address). If you are using PPTP or PPPoE Encapsulation, type

"0.0.0.0" to configure the Contivity 221 to check the PVC (Permanent Virtual Circuit) or

PPTP tunnel.

Fail Tolerance Type the number of times your Contivity 221 may attempt and fail to connect to the

Internet before traffic is forwarded to the backup gateway.

Period (sec) Type the number of seconds for the Contivity 221 to wait between checks to see if it can connect to the WAN IP address (Check WAN IP Address field) or default gateway.

Allow more time if your destination IP address handles lots of traffic.

Timeout (sec) Type the number of seconds for your Contivity 221 to wait for a ping response from the

IP Address in the Check WAN IP Address field before it times out. The WAN connection is considered "down" after the Contivity 221 times out the number of times specified in the Fail Tolerance field. Use a higher value in this field if your network is busy or congested.

6.9

Configuring Dial Backup

To change your Contivity 221’s Dial Backup settings, click WAN, then the Dial Backup tab. The screen appears as shown.



Figure 6-11 Dial Backup Setup

317517-A Rev 00

WAN Screens 6-17


Table 6-8 Dial Backup Setup


Enable Dial Backup

Basic Settings

Select this check box to turn on dial backup.

Login Name Type the login name assigned by your ISP.

Password Type the password assigned by your ISP.

Authentication Type Use the drop-down list box to select an authentication protocol for outgoing calls.

Options are:

CHAP/PAP - Your Contivity 221 accepts either CHAP or PAP when requested by this remote node.

CHAP - Your Contivity 221 accepts CHAP only.

PAP - Your Contivity 221 accept PAP only.

Primary/ Secondary

Phone Number

Type the first (primary) phone number from the ISP for this remote node. If the

Primary Phone number is busy or does not answer, your Contivity 221 dials the

Secondary Phone number if available. Some areas require dialing the pound sign

# before the phone number for local calls. Include a # symbol at the beginning of the phone numbers as required.

Dial Backup Port

Speed

Use the drop-down list box to select the speed of the connection between the

Dial Backup port and the external device. Available speeds are: 9600, 19200,

38400, 57600, 115200 or 230400 bps.

AT Command Initial

String

Type the AT command string to initialize the WAN device. Consult the manual of your WAN device connected to your Dial Backup port for specific AT commands.

Advanced Modem

Setup

TCP/IP Options

Click this button to display the Advanced Setup screen and edit the details of your dial backup setup.

Priority (Metric) This field sets this route's priority among the three routes the Contivity 221 uses

(normal, traffic redirect and dial backup). Type a number (1 to 15) to set the priority of the dial backup route for data transmission. The smaller the number, the higher the priority.

If the three routes have the same metrics, the priority of the routes is as follows:

WAN, Traffic Redirect, Dial Backup.

Get IP Address

Automatically from

Remote Server

Type the login name assigned by your ISP for this remote node.





Used Fixed IP

Address

Select this check box if your ISP assigned you a fixed IP address, then enter the

IP address in the following field.

Contivity 221 WAN IP

Address

Remote IP Subnet

Mask

Leave the field set to 0.0.0.0 (default) to have the ISP or other remote router dynamically (automatically) assign your WAN IP address if you do not know it.

Type your WAN IP address here if you know it (static). This is the address assigned to your local Contivity 221, not the remote router.

Leave this field set to 0.0.0.0 (default) to have the ISP or other remote router dynamically send its subnet mask if you do not know it. Type the remote gateway's subnet mask here if you know it (static).

Remote Node IP

Address

Leave this field set to 0.0.0.0 (default) to have the ISP or other remote router dynamically (automatically) send its IP address if you do not know it. Type the remote gateway's IP address here if you know it (static).

Contivity 221

Operating Mode

Network Address Translation (NAT) allows the translation of an Internet protocol address used within one network to a different IP address known within another network. Select SUA Only or None.

SUA (Single User Account) is a subset of NAT that supports two types of mapping: Many-to-One and Server. When you select this option the Contivity 221 will use Address Mapping Set 255 (see your User's Guide for more information).

Select None to disable NAT.

Enable RIP Select this check box to turn on RIP (Routing Information Protocol), which allows a router to exchange routing information with other routers.

RIP Version The RIP Version field controls the format and the broadcasting method of the

RIP packets that the Contivity 221 sends (it recognizes both formats when receiving).

Choose RIP-1, RIP-2B or RIP-2M.

RIP-1 is universally supported; but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology. Both RIP-2B and RIP-2M sends the routing data in RIP-2 format; the difference being that RIP-2B uses subnet broadcasting while RIP-2M uses multicasting. Multicasting can reduce the load on non-router machines since they generally do not listen to the RIP multicast address and so will not receive the

RIP packets. However, if one router uses multicasting, then all routers on your network must use multicasting, also.

317517-A Rev 00

WAN Screens 6-19



RIP Direction RIP (Routing Information Protocol) allows a router to exchange routing information with other routers. The RIP Direction field controls the sending and receiving of RIP packets.

Choose Both, In Only or Out Only.


When set to Both or In Only, the Contivity 221 will incorporate RIP information that it receives.

Broadcast Dial

Backup Route

Select this check box to forward the backup route broadcasts to the WAN.

Enable Multicast Select this check box to turn on IGMP (Internet Group Multicast Protocol). IGMP is a network-layer protocol used to establish membership in a Multicast group - it is not used to carry user data.

Multicast Version Select IGMP-v1 or IGMP-v2. IGMP version 2 (RFC 2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use. If you would like to read more detailed information about interoperability between IGMP version 2 and version 1, please see sections 4 and 5 of RFC 2236.

Budget

Always On Select this check box to have the dial backup connection on all of the time.

Configure Budget Select this check box to have the dial backup connection on during the time that you select.

Allocated Budget Type the amount of time (in minutes) that the dial backup connection can be used during the time configured in the Period field. Set an amount that is less than the time period configured in the Period field.

Idle Timeout

Period Type the time period (in hours) for how often the budget should be reset. For example, to allow calls to this remote node for a maximum of 10 minutes every hour, set the Allocated Budget to 10 (minutes) and the Period to 1 (hour).

Type the number of seconds of idle time (when there is no traffic from the

Contivity 221 to the remote node) for the Contivity 221 to wait before it automatically disconnects the dial backup connection. This option applies only when the Contivity 221 initiates the call. The dial backup connection never times out if you set this field to "0" (it is the same as selecting Always On).



6.10

Advanced Modem Setup

For regular telephone lines, the default “Dial” string tells the modem that the line uses tone dialing.

“ATDT” is the command for a switch that requires tone dialing. If your switch requires pulse dialing, change the string to “ATDP”.

For ISDN lines, there are many more protocols and operational modes. Please consult the documentation of your TA. You may need additional commands in both “Dial” and “Init” strings.

The majority of WAN devices default to hanging up the current call when the DTR (Data Terminal

Ready) signal is dropped by the DTE. When the “Drop DTR When Hang Up” check box is selected, the Contivity 221 uses this hardware signal to force the WAN device to hang up, in addition to issuing the drop command “ATH”.

The response strings tell the Contivity 221 the tags, or labels, immediately preceding the various call parameters sent from the WAN device. The response strings have not been standardized; please consult the documentation of your WAN device to find the correct tags.

6.11

Configuring Advanced Modem Setup

Click the Edit button in the Dial Backup screen to display the Advanced Setup screen shown next.

Consult the manual of your WAN device connected to your dial backup port for specific AT commands.

317517-A Rev 00

Figure 6-12 Advanced Setup

WAN Screens 6-21


Table 6-9 Advanced Setup

AT Command

Strings

Dial Type the AT Command string to make a call.

Drop Type the AT Command string to drop a call. "~" represents a one second wait, for example, "~~~+++~~ath" can be used if your modem has a slow response time.

Answer Type the AT Command string to answer a call.

Drop DTR When

Hang Up

Select this check box to have the Contivity 221 drop the DTR (Data

Terminal Ready) signal after the "AT Command String: Drop" is sent out.

AT Response

Strings atdt

~~+++~~ath ata



Table 6-9 Advanced Setup

CLID Type the keyword that precedes the CLID (Calling Line Identification) in the AT response string. This lets the Contivity 221 capture the CLID in the AT response string that comes from the WAN device. CLID is required for CLID authentication.

Called ID Type the keyword preceding the dialed number.

Speed Type the keyword preceding the connection speed.

Call Control

Dial Timeout

(sec)

Type a number of seconds for the Contivity 221 to try to set up an outgoing call before timing out (stopping).

Retry Count Type a number of times for the Contivity 221 to retry a busy or noanswer phone number before blacklisting the number.

Retry Interval

(sec)

Type a number of seconds for the Contivity 221 to wait before trying another call after a call has failed. This applies before a phone number is blacklisted.

Drop Timeout

(sec)

Type the number of seconds for the Contivity 221 to wait before dropping the DTR signal if it does not receive a positive disconnect confirmation.

Call Back Delay

(sec)

Type a number of seconds for the Contivity 221 to wait between dropping a callback request call and dialing the corresponding callback call.

NMBR

CONNECT

60

0

10

20

15

317517-A Rev 00

NAT and Static Route

Part IV:

NAT and Static Route

This part covers Network Address Translation and setting up static routes.

IV

7-1

Chapter 7

Network Address Translation (NAT) Screens

This chapter discusses how to configure NAT on the Contivity 221.

7.1

NAT Overview

NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a packet. For example, the source address of an outgoing packet, used within one network is changed to a different IP address known within another network.

Inside/outside denotes where a host is located relative to the Contivity 221. For example, the computers of your subscribers are the inside hosts, while the web servers on the Internet are the outside hosts.

Global/local denotes the IP address of a host in a packet as the packet traverses a router. For example, the local address refers to the IP address of a host when the packet is in the local network, while the global address refers to the IP address of the host when the same packet is traveling in the

WAN side.

Note that inside/outside refers to the location of a host, while global/local refers to the IP address of a host used in a packet. Thus, an inside local address (ILA) is the IP address of an inside host in a packet when the packet is still in the local network, while an inside global address (IGA) is the IP address of the same inside host when the packet is on the WAN side. The following table summarizes this information.

Table 7-1 NAT Definitions

TERM

Inside

Outside

Local

Global

DESCRIPTION

This refers to the host on the LAN.

This refers to the host on the WAN.

This refers to the packet address (source or destination) as the packet travels on the LAN.

This refers to the packet address (source or destination) as the packet travels on the WAN.


7-2 NAT

NAT never changes the IP address (either local or global) of an outside host.

7.1.2 What NAT Does

In the simplest form, NAT changes the source IP address in a packet received from a subscriber

(the inside local address) to another (the inside global address) before forwarding the packet to the

WAN side. When the response comes back, NAT translates the destination address (the inside global address) back to the inside local address before forwarding it to the original inside host.

Note that the IP address (either local or global) of an outside host is never changed.

The global IP addresses for the inside hosts can be either static or dynamically assigned by the ISP.

In addition, you can designate servers (for example a web server and a telnet server) on your local network and make them accessible to the outside world. You can make designated servers on the

LAN accessible to the outside world. If you do not define any servers (for Many-to-One and Manyto-Many Overload mapping), NAT offers the additional benefit of firewall protection. With no servers defined, your Contivity 221 filters out all incoming inquiries, thus preventing intruders from probing your network. For more information on IP address translation, refer to RFC 1631,

The IP Network Address Translator (NAT).

Each packet has two addresses – a source address and a destination address. For outgoing packets, the ILA (Inside Local Address) is the source address on the LAN, and the IGA (Inside Global

Address) is the source address on the WAN. For incoming packets, the ILA is the destination address on the LAN, and the IGA is the destination address on the WAN. NAT maps private (local)

IP addresses to globally unique ones required for communication with hosts on other networks. It replaces the original IP source address (and TCP or UDP source port numbers for Many-to-One and Many-to-Many Overload NAT mapping) in each packet and then forwards it to the Internet.

The Contivity 221 keeps track of the original addresses and port numbers so incoming reply packets can have their original values restored. The following figure illustrates this.

317517-A Rev 00

Figure 7-1 How NAT Works

NAT 7-3


7-4 NAT

The following figure illustrates a possible NAT application, where three inside LANs (logical

LANs using IP Alias) behind the Contivity 221 can communicate with three distinct WAN networks. More examples follow at the end of this chapter.

Figure 7-2 NAT Application With IP Alias

7.1.5 NAT Mapping Types

NAT supports five types of IP/port mapping. They are:

¾ One to One: In One-to-One mode, the Contivity 221 maps one local IP address to one global IP address.

¾ Many to One: In Many-to-One mode, the Contivity 221 maps multiple local IP addresses to one global IP address. This is equivalent to SUA (i.e., PAT, port address translation), the

Single User Account feature (the SUA Only option).

¾ Many to Many Overload: In Many-to-Many Overload mode, the Contivity 221 maps the multiple local IP addresses to shared global IP addresses.

317517-A Rev 00

NAT 7-5

¾ Many One to One: In Many-One-to-One mode, the Contivity 221 maps each local IP address to a unique global IP address.

¾ Server: This type allows you to specify inside servers of different services behind the NAT to be accessible to the outside world. Port numbers do not change for One-to-One and

Many-One-to-One NAT mapping types.

The following table summarizes these types.

Table 7-2 NAT Mapping Types

One-to-One ILA1

ÅÆ IGA1

Many-to-One (SUA/PAT) ILA1

ÅÆ IGA1

ILA2

ÅÆ IGA1

…

Many-to-Many Overload ILA1

ÅÆ IGA1

ILA2

ÅÆ IGA2

ILA3

ÅÆ IGA1

ILA4

ÅÆ IGA2

…

Many-One-to-One ILA1

ÅÆ IGA1

ILA2

ÅÆ IGA2

ILA3

ÅÆ IGA3

…

1-1

M-1

M-M Ov

M-1-1

1 Server

Server 2 IP

ÅÆ IGA1

Server 3 IP

ÅÆ IGA1

7.2

Using NAT

You must create a firewall rule in addition to setting up SUA/NAT, to allow traffic from the WAN to be forwarded through the Contivity 221.

7.2.1 SUA (Single User Account) Versus NAT

SUA (Single User Account) is an implementation of a subset of NAT that supports two types of mapping, Many-to-One and Server. The Contivity 221 also supports Full Feature NAT to map


7-6 NAT multiple global IP addresses to multiple private LAN IP addresses of clients or servers using mapping types. Select either SUA Only or Full Feature in WAN IP.

7.3

SUA Server

A SUA server set is a list of inside (behind NAT on the LAN) servers, for example, web or FTP, that you can make visible to the outside world even though SUA makes your whole inside network appear as a single computer to the outside world.

You may enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server. The port number identifies a service; for example, web service is on port 80 and FTP on port 21. In some cases, such as for unknown services or where one server can support more than one service (for example both FTP and web service), it might be better to specify a range of port numbers. You can allocate a server IP address that corresponds to a port or a range of ports.

Many residential broadband ISP accounts do not allow you to run any server processes (such as a

Web or FTP server) from your location. Your ISP may periodically check for servers and may suspend your account if it discovers any active services at your location. If you are unsure, refer to your ISP.

Server Address

In addition to the servers for specified services, NAT supports a default server IP address. A default server receives packets from ports that are not specified in this screen.

If you do not assign a Default Server IP Address, the Contivity 221 discards all

packets received for ports that are not specified here or in the remote management setup.

7.3.2 Port Forwarding: Services and Port Numbers

The most often used port numbers are shown in the following table. Please refer to RFC 1700 for further information about port numbers. Please also refer to the Supporting CD for more examples and details on SUA/NAT.

Table 7-3 Services and Port Numbers

ECHO 7

FTP (File Transfer Protocol) 21

317517-A Rev 00

NAT 7-7

Table 7-3 Services and Port Numbers

SMTP (Simple Mail Transfer Protocol)

DNS (Domain Name System)

25

53

Finger 79

HTTP (Hyper Text Transfer protocol or WWW, Web) 80

POP3 (Post Office Protocol)

NNTP (Network News Transport Protocol)

SNMP (Simple Network Management Protocol)

SNMP trap

PPTP (Point-to-Point Tunneling Protocol)

110

119

161

162

1723

Let's say you want to assign ports 22-25 to one server, port 80 to another and assign a default server IP address of 192.168.1.35 as shown in the next figure.

Figure 7-3 Multiple Servers Behind NAT Example


7-8 NAT

7.4

Configuring SUA Server

If you do not assign a Default Server IP Address, then all packets received for ports

not specified in this screen will be discarded.

Click SUA/NAT to open the SUA Server screen.

Refer to the firewall chapters for port numbers commonly used for particular services.

Figure 7-4 SUA/NAT Setup


317517-A Rev 00

NAT 7-9

Table 7-4 SUA/NAT Setup


Default Server

#

Active

Name

Start Port

End Port

Server IP

Address

In addition to the servers for specified services, NAT supports a default server. A default server receives packets from ports that are not specified in this screen. If you do not assign a default server IP address, then all packets received for ports not specified in this screen will be discarded.

Number of an individual SUA server entry.

Select this check box to enable the SUA server entry. Clear this checkbox to disallow forwarding of these ports to an inside server without having to delete the entry.

Enter a name to identify this port-forwarding rule.

Enter a port number here. To forward only one port, enter it again in the End Port field.

To specify a range of ports, enter the last port to be forwarded in the End Port No field

Enter the inside IP address of the server here.

7.5

Configuring Address Mapping

Ordering your rules is important because the Contivity 221 applies the rules in the order that you specify. When a rule matches the current packet, the Contivity 221 takes the corresponding action and the remaining rules are ignored. If there are any empty rules before your new configured rule, your configured rule will be pushed up by that number of empty rules. For example, if you have already configured rules 1 to 6 in your current set and now you configure rule number 9. In the set summary screen, the new rule will be rule 7, not 9. Now if you delete rule 4, rules 5 to 7 will be pushed up by 1 rule, so old rules 5, 6 and 7 become new rules 4, 5 and 6.

To change your Contivity 221’s Address Mapping settings, click SUA/NAT, then the Address

Mapping tab. The screen appears as shown.


7-10 NAT

Figure 7-5 Address Mapping


Table 7-5 Address Mapping


Local Start IP This refers to the Inside Local Address (ILA), that is the starting local IP address. Local

IP addresses are N/A for Server port mapping.

Local End IP This is the end Inside Local Address (ILA). If the rule is for all local IP addresses, then this field displays 0.0.0.0 and 255.255.255.255 as the Local End IP address. This field is

N/A for One-to-One and Server mapping types.

Global Start IP This refers to the Inside Global IP Address (IGA). 0.0.0.0 is for a dynamic IP address from your ISP with Many-to-One and Server mapping types.

Global End IP This is the ending Inside Global Address (IGA), that is the starting global IP address.

This field is N/A for One-to-One, Many-to-One and Server mapping types.

317517-A Rev 00

NAT 7-11

Table 7-5 Address Mapping


numbers do not change for the One-to-one NAT mapping type.

2. Many-to-One mode maps multiple local IP addresses to one global IP address. This is equivalent to SUA (i.e., PAT, port address translation), the Single User Account feature.

3. Many-to-Many Overload mode maps multiple local IP addresses to shared global IP addresses.

4. Many One-to-One mode maps each local IP address to unique global IP addresses.

5. Server allows you to specify inside servers of different services behind the NAT to be accessible to the outside world.

Configuring Address Mapping

To edit an Address Mapping rule, click the Edit button to display the screen shown next.

Figure 7-6 Address Mapping Edit



7-12 NAT

Table 7-6 Address Mapping Edit


Type

Local Start IP

Local End IP

Global Start IP

Global End IP

Choose the port mapping type from one of the following.

1. One-to-One: One-to-one mode maps one local IP address to one global IP address. Note that port numbers do not change for One-to-one NAT mapping type.

2. Many-to-One: Many-to-One mode maps multiple local IP addresses to one global

IP address. This is equivalent to SUA (i.e., PAT, port address translation), the Single

User Account feature.

3. Many-to-Many Ov (Overload): Many-to-Many Overload mode maps multiple local

IP addresses to shared global IP addresses.

4. Many One-to-One: Many One-to-one mode maps each local IP address to unique global IP addresses.

5. Server: This type allows you to specify inside servers of different services behind the NAT to be accessible to the outside world.

This is the starting Inside Local IP Address (ILA). Local IP addresses are N/A for

Server port mapping.

This is the end Inside Local IP Address (ILA). If your rule is for all local IP addresses, then enter 0.0.0.0 as the Local Start IP address and 255.255.255.255 as the Local

End IP address.

This field is N/A for One-to-One and Server mapping types.

This is the starting Inside Global IP Address (IGA). Enter 0.0.0.0 here if you have a dynamic IP address from your ISP.

This is the ending Inside Global IP Address (IGA). This field is N/A for One-to-One,

Many-to-One and Server mapping types.

7.6

Trigger Port Forwarding

Some services use a dedicated range of ports on the client side and a dedicated range of ports on the server side. With regular port forwarding you set a forwarding port in NAT to forward a service

(coming in from the server on the WAN) to the IP address of a computer on the client side (LAN).

The problem is that port forwarding only forwards a service to a single LAN IP address. In order to use the same service on a different LAN computer, you have to manually replace the LAN computer's IP address in the forwarding port with another LAN computer's IP address,

317517-A Rev 00

NAT 7-13

Trigger port forwarding solves this problem by allowing computers on the LAN to dynamically take turns using the service. The Contivity 221 records the IP address of a LAN computer that sends traffic to the WAN to request a service with a specific port number and protocol (a "trigger" port). When the Contivity 221's WAN port receives a response with a specific port number and protocol ("incoming" port), the Contivity 221 forwards the traffic to the LAN IP address of the computer that sent the request. After that computer’s connection for that service closes, another computer on the LAN can use the service in the same manner. This way you do not need to configure a new IP address each time you want a different LAN computer to use the application.

The following is an example of trigger port forwarding.

Figure 7-7 Trigger Port Forwarding Process: Example

1. Jane (A) requests a file from the Real Audio server (port 7070).

2. Port 7070 is a “trigger” port and causes the Contivity 221 to record Jane’s computer IP address.

The Contivity 221 associates Jane's computer IP address with the "incoming" port range of 6970-

7170.

3. The Real Audio server responds using a port number ranging between 6970-7170.

4. The Contivity 221 forwards the traffic to Jane’s computer IP address.

5. Only Jane can connect to the Real Audio server until the connection is closed or times out. The

Contivity 221 times out in three minutes with UDP (User Datagram Protocol) or two hours with

TCP/IP (Transfer Control Protocol/Internet Protocol).

7.6.2 Two Points To Remember About Trigger Ports

1. Trigger events only happen on data that is going coming from inside the Contivity 221 and going to the outside.


7-14 NAT

2. If an application needs a continuous data stream, that port (range) will be tied up so that another computer on the LAN can’t trigger it.

7.7

Configuring Trigger Port Forwarding

To change your Contivity 221’s trigger port settings, click SUA/NAT and the Trigger Port tab.

The screen appears as shown.

Only one LAN computer can use a trigger port (range) at a time.

Figure 7-8 Trigger Port


317517-A Rev 00

NAT 7-15

Table 7-7 Trigger Port


No.

Name

This is the rule index number (read-only).

Type a unique name (up to 15 characters) for identification purposes. All characters are permitted - including spaces.

Incoming Incoming is a port (or a range of ports) that a server on the WAN uses when it sends out a particular service. The Contivity 221 forwards the traffic with this port (or range of ports) to the client computer on the LAN that requested the service.

Start Port Type a port number or the starting port number in a range of port numbers.

End Port Type a port number or the ending port number in a range of port numbers.

Trigger The trigger port is a port (or a range of ports) that causes (or triggers) the Contivity 221 to record the IP address of the LAN computer that sent the traffic to a server on the WAN.

Start Port Type a port number or the starting port number in a range of port numbers.

End Port Type a port number or the ending port number in a range of port numbers.


8-1

Chapter 8

Static Route Screens

This chapter shows you how to configure static routes for your Contivity 221.

8.1

Static Route Overview

Each remote node specifies only the network to which the gateway is directly connected, and the

Contivity 221 has no knowledge of the networks beyond. For instance, the Contivity 221 knows about network N2 in the following figure through remote node Router 1. However, the Contivity

221 is unable to route a packet to network N3 because it doesn't know that there is a route through the same remote node Router 1 (via gateway Router 2). The static routes are for you to tell the

Contivity 221 about the networks beyond the remote nodes.

Figure 8-1 Example of Static Routing Topology

8.2

Configuring IP Static Route

Click STATIC ROUTE to open the Route Entry screen.


8-2 Static Route

Figure 8-2 Static Route Screen


Table 8-1 IP Static Route Summary


#

Name

Active

Destination

Gateway

Edit

Number of an individual static route.

Name that describes or identifies this route.

This field shows whether this static route is active (Yes) or not (No).

This parameter specifies the IP network address of the final destination. Routing is always based on network number.

This is the IP address of the gateway. The gateway is an immediate neighbor of your

Contivity 221 that will forward the packet to the destination. On the LAN, the gateway must be a router on the same segment as your Contivity 221; over the WAN, the gateway must be the IP address of one of the remote nodes.

Click a static route index number and then click Edit to set up a static route on the

Contivity 221.

317517-A Rev 00

Static Route 8-3

8.2.1 Configuring Route Entry

Select a static route index number and click Edit. The screen shown next appears. Fill in the required information for each static route.

Figure 8-3 Edit IP Static Route


Table 8-2 Edit IP Static Route


Route Name

Active

Destination IP

Address

Enter the name of the IP static route. Leave this field blank to delete this static route.

This field allows you to activate/deactivate this static route.

This parameter specifies the IP network address of the final destination. Routing is always based on network number. If you need to specify a route to a single host, use a subnet mask of 255.255.255.255 in the subnet mask field to force the network number to be identical to the host ID.

IP Subnet Mask Enter the IP subnet mask here.

Gateway IP

Address

Enter the IP address of the gateway. The gateway is an immediate neighbor of your

Contivity 221 that will forward the packet to the destination. On the LAN, the gateway must be a router on the same segment as your Contivity 221; over the WAN, the gateway must be the IP address of one of the Remote Nodes.


8-4 Static Route

Table 8-2 Edit IP Static Route


Metric

Private

Metric represents the “cost” of transmission for routing purposes. IP routing uses hop count as the measurement of cost, with a minimum of 1 for directly connected networks. Enter a number that approximates the cost for this link. The number need not be precise, but it must be between 1 and 15. In practice, 2 or 3 is usually a good number.

This parameter determines if the Contivity 221 will include this route to a remote node in its RIP broadcasts.

Select this check box to keep this route private and not included in RIP broadcasts.

Clear this checkbox to propagate this route to other hosts through RIP broadcasts.

317517-A Rev 00

Firewall and Content Filters

Part V:

Firewall and Content Filters

This part introduces firewalls in general and the Contivity 221 firewall. It also explains how to configure the Contivity 221 firewall and content filtering.

V

9-1

Chapter 9

Firewalls

This chapter gives some background information on firewalls and introduces the Contivity 221 firewall.

9.1

Firewall Overview

Originally, the term firewall referred to a construction technique designed to prevent the spread of fire from one room to another. The networking term “firewall” is a system or group of systems that enforces an access-control policy between two networks. It may also be defined as a mechanism used to protect a trusted network from an untrusted network. Of course, firewalls cannot solve every security problem. A firewall is one of the mechanisms used to establish a network security perimeter in support of a network security policy. It should never be the only mechanism or method employed. For a firewall to guard effectively, you must design and deploy it appropriately. This requires integrating the firewall into a broad information-security policy. In addition, specific policies must be implemented within the firewall itself.

9.2

Types of Firewalls

There are three main types of firewalls:

1. Packet Filtering Firewalls

2. Application-level Firewalls

3. Stateful Inspection Firewalls

9.2.1 Packet Filtering Firewalls

Packet filtering firewalls restrict access based on the source/destination computer network address of a packet and the type of application.

9.2.2 Application-level Firewalls

Application-level firewalls restrict access by serving as proxies for external servers. Since they use programs written for specific Internet services, such as HTTP, FTP and telnet, they can evaluate network packets for valid application-specific data. Application-level firewalls have a number of general advantages over the default mode of permitting application traffic directly to internal hosts:


9-2 Firewalls i. ii.

Information hiding prevents the names of internal systems from being made known via

DNS to outside systems, since the application gateway is the only host whose name must be made known to outside systems.

Robust authentication and logging pre-authenticates application traffic before it reaches internal hosts and causes it to be logged more effectively than if it were logged with standard host logging. Filtering rules at the packet filtering router can be less complex than they would be if the router needed to filter application traffic and direct it to a number of specific systems.

The router need only allow application traffic destined for the application gateway and reject the rest.

9.2.3 Stateful Inspection Firewalls

Stateful inspection firewalls restrict access by screening data packets against defined access rules.

They make access control decisions based on IP address and protocol. They also "inspect" the session data to assure the integrity of the connection and to adapt to dynamic protocols. These firewalls generally provide the best speed and transparency; however, they may lack the granular application level access control or caching that some proxies support. See section 9.5 for more information on Stateful Inspection.

Firewalls, of one type or another, have become an integral part of standard security solutions for enterprises.

9.3

Introduction to Nortel Networks Firewall

The Contivity 221 firewall is a stateful inspection firewall and is designed to protect against Denial of Service attacks when activated (in SMT menu 21.2 or in the WebGUI). The Contivity 221’s purpose is to allow a private Local Area Network (LAN) to be securely connected to the Internet.

The Contivity 221 can be used to prevent theft, destruction and modification of data, as well as log events, which may be important to the security of your network. The Contivity 221 also has packetfiltering capabilities.

The Contivity 221 is installed between the LAN and a broadband modem connecting to the

Internet. This allows it to act as a secure gateway for all data passing between the Internet and the

LAN.

The Contivity 221 has one Ethernet WAN port and one Ethernet LAN port, which are used to physically separate the network into two areas.

The WAN (Wide Area Network) port attaches to the broadband modem (cable or ADSL) connecting to the Internet.

317517-A Rev 00

Firewalls 9-3

The LAN (Local Area Network) port attaches to a network of computers, which needs security from the outside world. These computers will have access to Internet services such as e-mail,

FTP, and the World Wide Web. However, “inbound access” will not be allowed unless the remote host is authorized to use a specific service.

Figure 9-1 Contivity 221 Firewall Application

9.4

Denial of Service

Denials of Service (DoS) attacks are aimed at devices and networks with a connection to the

Internet. Their goal is not to steal information, but to disable a device or network so users no longer have access to network resources. The Contivity 221 is pre-configured to automatically detect and thwart all known DoS attacks.

9.4.1 Basics

Computers share information over the Internet using a common language called TCP/IP. TCP/IP, in turn, is a set of application protocols that perform specific functions. An “extension number”, called the "TCP port" or "UDP port" identifies these protocols, such as HTTP (Web), FTP (File

Transfer Protocol), POP3 (E-mail), etc. For example, Web traffic by default uses TCP port 80.


9-4 Firewalls

When computers communicate on the Internet, they are using the client/server model, where the server "listens" on a specific TCP/UDP port for information requests from remote client computers on the network. For example, a Web server typically listens on port 80. Please note that while a computer may be intended for use over a single port, such as Web on port 80, other ports are also active. If the person configuring or managing the computer is not careful, a hacker could attack it over an unprotected port.

Some of the most common IP ports are:

Table 9-1 Common IP Ports

21 FTP

23 Telnet

25 SMTP

53 DNS

80 HTTP

9.4.2 Types of DoS Attacks

There are four types of DoS attacks:

1. Those that exploit bugs in a TCP/IP implementation.

2. Those that exploit weaknesses in the TCP/IP specification.

3. Brute-force attacks that flood a network with useless data.

4. IP Spoofing.

1. "Ping of Death" and "Teardrop" attacks exploit bugs in the TCP/IP implementations of various computer and host systems.

1-a

Ping of Death uses a "ping" utility to create an IP packet that exceeds the maximum

65,536 bytes of data allowed by the IP specification. The oversize packet is then sent to an unsuspecting system. Systems may crash, hang or reboot.

1-b

Teardrop attack exploits weaknesses in the reassembly of IP packet fragments. As data is transmitted through a network, IP packets are often broken up into smaller chunks. Each fragment looks like the original IP packet except that it contains an offset field that says, for instance, "This fragment is carrying bytes 200 through 400 of the original (non fragmented) IP packet." The Teardrop program creates a series of IP fragments with overlapping offset fields. When these fragments are reassembled at the destination, some systems will crash, hang, or reboot.

2. Weaknesses in the TCP/IP specification leave it open to "SYN Flood" and "LAND" attacks.

These attacks are executed during the handshake that initiates a communication session between two applications.

317517-A Rev 00

Firewalls 9-5

Figure 9-2 Three-Way Handshake

Under normal circumstances, the application that initiates a session sends a SYN (synchronize) packet to the receiving server. The receiver sends back an ACK (acknowledgment) packet and its own SYN, and then the initiator responds with an ACK (acknowledgment). After this handshake, a connection is established.

2-a

SYN Attack floods a targeted system with a series of SYN packets. Each packet causes the targeted system to issue a SYN-ACK response. While the targeted system waits for the ACK that follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is known as a backlog queue. SYN-ACKs are moved off the queue only when an

ACK comes back or when an internal timer (which is set at relatively long intervals) terminates the three-way handshake. Once the queue is full, the system will ignore all incoming SYN requests, making the system unavailable for legitimate users.


9-6 Firewalls

Figure 9-3 SYN Flood

2-b

In a LAND Attack, hackers flood SYN packets into the network with a spoofed source

IP address of the targeted system. This makes it appear as if the host computer sent the packets to itself, making the system unavailable while the target system tries to respond to itself.

3. A brute-force attack, such as a "Smurf" attack, targets a feature in the IP specification known as directed or subnet broadcasting, to quickly flood the target network with useless data. A

Smurf hacker floods a router with Internet Control Message Protocol (ICMP) echo request packets (pings). Since the destination IP address of each packet is the broadcast address of the network, the router will broadcast the ICMP echo request packet to all hosts on the network. If there are numerous hosts, this will create a large amount of ICMP echo request and response traffic. If a hacker chooses to spoof the source IP address of the ICMP echo request packet, the resulting ICMP traffic will not only clog up the "intermediary" network, but will also congest the network of the spoofed source IP address, known as the "victim" network. This flood of broadcast traffic consumes all available bandwidth, making communications impossible.

317517-A Rev 00

Firewalls 9-7

Figure 9-4 Smurf Attack

ICMP Vulnerability

ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types trigger an alert:

Table 9-2 ICMP Commands That Trigger Alerts

5 REDIRECT

13 TIMESTAMP_REQUEST

14 TIMESTAMP_REPLY

17 ADDRESS_MASK_REQUEST

18 ADDRESS_MASK_REPLY

Illegal Commands (NetBIOS and SMTP)

The only legal NetBIOS commands are the following - all others are illegal.

Table 9-3 Legal NetBIOS Commands

MESSAGE:

REQUEST:

POSITIVE:

NEGATIVE:

RETARGET:

KEEPALIVE:

All SMTP commands are illegal except for those displayed in the following tables.


9-8 Firewalls

Table 9-4 Legal SMTP Commands

AUTH DATA EHLO ETRN EXPN HELO HELP MAIL NOOP

Traceroute

Traceroute is a utility used to determine the path a packet takes between two endpoints. Sometimes when a packet filter firewall is configured incorrectly an attacker can traceroute the firewall gaining knowledge of the network topology inside the firewall.

4. Often, many DoS attacks also employ a technique known as "IP Spoofing" as part of their attack. IP Spoofing may be used to break into systems, to hide the hacker's identity, or to magnify the effect of the DoS attack. IP Spoofing is a technique used to gain unauthorized access to computers by tricking a router or firewall into thinking that the communications are coming from within the trusted network. To engage in IP spoofing, a hacker must modify the packet headers so that it appears that the packets originate from a trusted host and should be allowed through the router or firewall. The Contivity 221 blocks all IP Spoofing attempts.

9.5

Stateful Inspection

With stateful inspection, fields of the packets are compared to packets that are already known to be trusted. For example, if you access some outside service, the proxy server remembers things about your original request, like the port number and source and destination addresses. This

“remembering” is called saving the state. When the outside system responds to your request, the firewall compares the received packets with the saved state to determine if they are allowed in. The

Contivity 221 uses stateful packet inspection to protect the private LAN from hackers and vandals on the Internet. By default, the Contivity 221’s stateful inspection allows all communications to the

Internet that originate from the LAN, and blocks all traffic to the LAN that originates from the

Internet. In summary, stateful inspection:

Allows all sessions originating from the LAN (local network) to the WAN (Internet).

Denies all sessions originating from the WAN to the LAN.

317517-A Rev 00

Firewalls 9-9

Figure 9-5 Stateful Inspection

The previous figure shows the Contivity 221’s default firewall rules in action as well as demonstrates how stateful inspection works. User A can initiate a Telnet session from within the

LAN and responses to this request are allowed. However other Telnet traffic initiated from the

WAN is blocked.

9.5.1 Stateful Inspection Process

In this example, the following sequence of events occurs when a TCP packet leaves the LAN network through the firewall's WAN interface. The TCP packet is the first in a session, and the packet's application layer protocol is configured for a firewall rule inspection:

1. The packet travels from the firewall's LAN to the WAN.

2. The packet is evaluated against the interface's existing outbound access list, and the packet is permitted (a denied packet would simply be dropped at this point).

3. The packet is inspected by a firewall rule to determine and record information about the state of the packet's connection. This information is recorded in a new state table entry created for the new connection. If there is not a firewall rule for this packet and it is not an attack, then Action for packets that don’t match firewall rules field determines the action for this packet.

4. Based on the obtained state information, a firewall rule creates a temporary access list entry that is inserted at the beginning of the WAN interface's inbound extended access list.

This temporary access list entry is designed to permit inbound packets of the same connection as the outbound packet just inspected.


9-10 Firewalls

5. The outbound packet is forwarded out through the interface.

6. Later, an inbound packet reaches the interface. This packet is part of the connection previously established with the outbound packet. The inbound packet is evaluated against the inbound access list, and is permitted because of the temporary access list entry previously created.

7. The packet is inspected by a firewall rule, and the connection's state table entry is updated as necessary. Based on the updated state information, the inbound extended access list temporary entries might be modified, in order to permit only packets that are valid for the current state of the connection.

8. Any additional inbound or outbound packets that belong to the connection are inspected to update the state table entry and to modify the temporary inbound access list entries as

9. required, and are forwarded through the interface.

When the connection terminates or times out, the connection's state table entry is deleted and the connection's temporary inbound access list entries are deleted.

9.5.2 Stateful Inspection and the Contivity 221

Additional rules may be defined to extend or override the default rules. For example, a rule may be created which will: i. Block all traffic of a certain type, such as IRC (Internet Relay Chat), from the LAN to the ii.

Internet.

Allow certain types of traffic from the Internet to specific hosts on the LAN. iii. iv.

Allow access to a Web server to everyone but competitors.

Restrict use of certain protocols, such as Telnet, to authorized users on the LAN.

These custom rules work by evaluating the network traffic’s Source IP address, Destination IP address, IP protocol type, and comparing these to rules set by the administrator.

The ability to define firewall rules is a very powerful tool. Using custom rules, it is possible to disable all firewall protection or block all access to the Internet. Use extreme caution when creating or deleting firewall rules. Test changes after creating them to make sure they work correctly.

Below is a brief technical description of how these connections are tracked. Connections may either be defined by the upper protocols (for instance, TCP), or by the Contivity 221 itself (as with the "virtual connections" created for UDP and ICMP).

317517-A Rev 00

Firewalls 9-11

9.5.3 TCP Security

The Contivity 221 uses state information embedded in TCP packets. The first packet of any new connection has its SYN flag set and its ACK flag cleared; these are "initiation" packets. All packets that do not have this flag structure are called "subsequent" packets, since they represent data that occurs later in the TCP stream.

If an initiation packet originates on the WAN, this means that someone is trying to make a connection from the Internet into the LAN. Except in a few special cases (see "Upper Layer

Protocols" shown next), these packets are dropped and logged.

If an initiation packet originates on the LAN, this means that someone is trying to make a connection from the LAN to the Internet. Assuming that this is an acceptable part of the security policy (as is the case with the default policy), the connection will be allowed. A cache entry is added which includes connection information such as IP addresses, TCP ports, sequence numbers, etc.

When the Contivity 221 receives any subsequent packet (from the Internet or from the LAN), its connection information is extracted and checked against the cache. A packet is only allowed to pass through if it corresponds to a valid connection (that is, if it is a response to a connection which originated on the LAN).

9.5.4 UDP/ICMP Security

UDP and ICMP do not themselves contain any connection information (such as sequence numbers). However, at the very minimum, they contain an IP address pair (source and destination).

UDP also contains port pairs, and ICMP has type and code information. All of this data can be analyzed in order to build "virtual connections" in the cache.

For instance, any UDP packet that originates on the LAN will create a cache entry. Its IP address and port pairs will be stored. For a short period of time, UDP packets from the WAN that have matching IP and UDP information will be allowed back in through the firewall.

A similar situation exists for ICMP, except that the Contivity 221 is even more restrictive.

Specifically, only outgoing echoes will allow incoming echo replies, outgoing address mask requests will allow incoming address mask replies, and outgoing timestamp requests will allow incoming timestamp replies. No other ICMP packets are allowed in through the firewall, simply because they are too dangerous and contain too little tracking information. For instance, ICMP redirect packets are never allowed in, since they could be used to reroute traffic through attacking machines.


9-12 Firewalls

9.5.5 Upper Layer Protocols

Some higher layer protocols (such as FTP and RealAudio) utilize multiple network connections simultaneously. In general terms, they usually have a "control connection" which is used for sending commands between endpoints, and then "data connections" which are used for transmitting bulk information.

Consider the FTP protocol. A user on the LAN opens a control connection to a server on the

Internet and requests a file. At this point, the remote server will open a data connection from the

Internet. For FTP to work properly, this connection must be allowed to pass through even though a connection from the Internet would normally be rejected.

In order to achieve this, the Contivity 221 inspects the application-level FTP data. Specifically, it searches for outgoing "PORT" commands, and when it sees these; it adds a cache entry for the anticipated data connection. This can be done safely, since the PORT command contains address and port information, which can be used to uniquely identify the connection.

Any protocol that operates in this way must be supported on a case-by-case basis. You can use the

WebGUI’s Custom Ports feature to do this.

9.6

Guidelines For Enhancing Security With Your

Firewall

1. Change the default password via SMT or WebGUI.

2. Think about access control before you connect a console port to the network in any way, including attaching a modem to the port. Be aware that a break on the console port might give unauthorized individuals total control of the firewall, even with access control configured.

3. Limit who can telnet into your router.

4. Don't enable any local service (such as SNMP or NTP) that you don't use. Any enabled service could present a potential security risk. A determined hacker might be able to find creative ways to misuse the enabled services to access the firewall or the network.

5. For local services that are enabled, protect against misuse. Protect by configuring the services to communicate only with specific peers, and protect by configuring rules to block packets for the services at specific interfaces.

6. Protect against IP spoofing by making sure the firewall is active.

7. Keep the firewall in a secured (locked) room.

9.7

Packet Filtering Vs Firewall

Below are some comparisons between the Contivity 221’s filtering and firewall functions.

317517-A Rev 00

Firewalls 9-13

9.7.1 Packet Filtering:

The router filters packets as they pass through the router’s interface according to the filter rules you designed.

Packet filtering is a powerful tool, yet can be complex to configure and maintain, especially if you need a chain of rules to filter a service.

Packet filtering only checks the header portion of an IP packet.

When To Use Filtering

1. To block/allow LAN packets by their MAC addresses.

2. To block/allow special IP packets which are neither TCP nor UDP, nor ICMP packets.

3. To block/allow both inbound (WAN to LAN) and outbound (LAN to WAN) traffic between the specific inside host/network "A" and outside host/network "B". If the filter blocks the traffic from A to B, it also blocks the traffic from B to A. Filters cannot distinguish traffic originating from an inside host or an outside host by IP address.

4. To block/allow IP trace route.

9.7.2 Firewall

The firewall inspects packet contents as well as their source and destination addresses.

Firewalls of this type employ an inspection module, applicable to all protocols, that understands data in the packet is intended for other layers, from the network layer (IP headers) up to the application layer.

The firewall performs stateful inspection. It takes into account the state of connections it handles so that, for example, a legitimate incoming packet can be matched with the outbound request for that packet and allowed in. Conversely, an incoming packet masquerading as a response to a nonexistent outbound request can be blocked.

The firewall uses session filtering, i.e., smart rules, that enhance the filtering process and control the network session rather than control individual packets in a session.

The firewall provides e-mail service to notify you of routine reports and when alerts occur.

When To Use The Firewall

1. To prevent DoS attacks and prevent hackers cracking your network.

2. A range of source and destination IP addresses as well as port numbers can be specified within one firewall rule making the firewall a better choice when complex rules are required.

3. To selectively block/allow inbound or outbound traffic between inside host/networks and outside host/networks. Remember that filters cannot distinguish traffic originating from an inside host or an outside host by IP address.


9-14 Firewalls

4. The firewall performs better than filtering if you need to check many rules.

5. Use the firewall if you need routine e-mail reports about your system or need to be alerted when attacks occur.

6. The firewall can block specific URL traffic that might occur in the future. The URL can be saved in an Access Control List (ACL) database.

317517-A Rev 00

10-1

Chapter 10

Firewall Screens

This chapter shows you how to configure your Contivity 221 firewall.

10.1

Access Methods

The WebGUI is, by far, the most comprehensive firewall configuration tool your Contivity 221 has to offer. For this reason, it is recommended that you configure your firewall using the WebGUI.

SMT screens allow you to activate the firewall. CLI commands provide limited configuration options and are only recommended for advanced users, please refer to the Appendices for firewall

CLI commands.

10.2

Firewall Policies Overview

Firewall rules are grouped based on the direction of travel of packets to which they apply:

• LAN to • WAN to LAN

LAN/Contivity 221

• LAN to WAN • WAN to

WAN/Contivity 221

By default, the Contivity 221’s stateful packet inspection allows packets traveling in the following directions:

• LAN to LAN/Contivity 221

This allows computers on the LAN to manage the Contivity 221 and communicate between networks or subnets connected to the LAN interface.

• LAN to WAN

By default, the Contivity 221’s stateful packet inspection blocks packets traveling in the following directions:

• WAN to LAN

• WAN to WAN/Contivity 221

This prevents computers on the WAN from using the Contivity 221 as a gateway to communicate with other computers on the WAN and/or managing the Contivity 221.

You may define additional rules and sets or modify existing ones but please exercise extreme caution in doing so.


10-2 Firewall Screens

If you configure firewall rules without a good understanding of how they work, you might inadvertently introduce security risks to the firewall and to the protected network. Make sure you test your rules after you configure them.

For example, you may create rules to:

♦ Block certain types of traffic, such as IRC (Internet Relay Chat), from the LAN to the Internet.

♦ Allow certain types of traffic, such as Lotus Notes database synchronization, from specific hosts on the Internet to specific hosts on the LAN.

♦ Allow everyone except your competitors to access a Web server.

♦ Restrict use of certain protocols, such as Telnet, to authorized users on the LAN.

These custom rules work by comparing the Source IP address, Destination IP address and IP protocol type of network traffic to rules set by the administrator. Your customized rules take precedence and override the Contivity 221’s default rules.

10.3

Rule Logic Overview

Study these points carefully before configuring rules.

1. State the intent of the rule. For example, “This restricts all IRC access from the LAN to the

Internet.” Or, “This allows a remote Lotus Notes server to synchronize over the Internet to an inside Notes server.”

2. Is the intent of the rule to forward or block traffic?

3. What direction of traffic does the rule apply to (refer to 10.2)?

4. What IP services will be affected?

5. What computers on the LAN are to be affected (if any)?

6. What computers on the Internet will be affected? The more specific, the better. For example, if traffic is being allowed from the Internet to the LAN, it is better to allow only certain machines on the Internet to access the LAN.

Once the logic of the rule has been defined, it is critical to consider the security ramifications created by the rule:

1. Does this rule stop LAN users from accessing critical resources on the Internet? For example, if IRC is blocked, are there users that require this service?

317517-A Rev 00

Firewall Screens 10-3

2. Is it possible to modify the rule to be more specific? For example, if IRC is blocked for all users, will a rule that blocks just certain users be more effective?

3. Does a rule that allows Internet users access to resources on the LAN create a security vulnerability? For example, if FTP ports (TCP 20, 21) are allowed from the Internet to the

LAN, Internet users may be able to connect to computers with running FTP servers.

4. Does this rule conflict with any existing rules?

Once these questions have been answered, adding rules is simply a matter of plugging the information into the correct fields in the WebGUI screens.

10.3.3 Key Fields For Configuring Rules

Action

Should the action be to Block or Forward?

“Block” means the firewall silently discards the packet.

Service

Select the service from the Service scrolling list box. If the service is not listed, it is necessary to first define it. See section 10.7 for more information on predefined services.

Source Address

What is the connection’s source address; is it on the LAN or WAN? Is it a single IP, a range of IPs or a subnet?

Destination Address

What is the connection’s destination address; is it on the LAN or WAN? Is it a single IP, a range of

IPs or a subnet?

10.4

Connection Direction Examples

This section describes examples for firewall rules for connections going from LAN to WAN and from WAN to LAN.

LAN to LAN/Contivity 221, WAN and WAN/Contivity 221 rules apply to packets coming in on the associated interface (LAN or WAN respectively). LAN to LAN/Contivity 221 means policies for LAN-to-Contivity 221 (the policies for managing the Contivity 221 through the LAN interface) and policies for LAN-to-LAN (the policies that control routing between two subnets on the LAN).

Similarly, WAN to WAN/Contivity 221 polices apply in the same way to the WAN ports.



10.4.1 LAN to WAN Rules

The default rule for LAN to WAN traffic is that all users on the LAN are allowed non-restricted access to the WAN. When you configure a LAN to WAN rule, you in essence want to limit some or all users from accessing certain services on the WAN. See the following figure.

Figure 10-1 LAN to WAN Traffic

10.4.2 WAN to LAN Rules

The default rule for WAN to LAN traffic blocks all incoming connections (WAN to LAN). If you wish to allow certain WAN users to have access to your LAN, you will need to create custom rules to allow it. See the following figure.

317517-A Rev 00


Figure 10-2 WAN to LAN Traffic

10.5

Configuring Firewall

The ordering of your rules is very important as rules are applied in turn.

Click FIREWALL to open the Summary screen. Enable (or activate) the firewall by selecting the

Enable Firewall check box as seen in the following screen.



Figure 10-3 Enabling the Firewall

Select this check box to enable the firewall.


Table 10-1 Firewall Rules Summary: First Screen


Enable Firewall

Bypass Triangle

Route

Total Configured

Rules

Select this check box to activate the firewall. The Contivity 221 performs access control and protects against Denial of Service (DoS) attacks when the firewall is activated.

Select this check box to have the Contivity 221 firewall ignore the use of triangle route topology on the network. See the Appendices for more on triangle route topology.

This read-only number is the total number of rules that have been configured for the

Contivity 221 (the combined total for all packet directions). The Contivity 221 allows you to configure up to 30 firewall rules total.

317517-A Rev 00




Vacant Rules This read-only number is the number of rules that can still be configured for the

Contivity 221 (the combined total available for all packet directions).

Packet Direction Use the drop-down list box to select a direction of travel of packets (LAN to

LAN/Contivity 221, LAN to WAN, WAN to WAN/Contivity 221 or WAN to LAN for which you want to configure firewall rules.

Block/

Forward

Log

Use the option buttons to select whether to Block (silently discard) or Forward

(allow the passage of) packets that are traveling in the selected direction.

Select the check box to create a log (when the above action is taken) for packets that are traveling in the selected direction and do not match any of the rules below.

The following read-only fields summarize the rules you have created that apply to traffic traveling in the selected packet direction. The firewall rules that you configure (summarized below) take priority over the general firewall action settings above.

#

Status

This is your firewall rule number. The ordering of your rules is important as rules are applied in turn. The Move field below allows you to reorder your rules.

This field displays whether a firewall is turned on (Active) or not (Inactive). Rules that have not been configured display Empty.

Source Address This drop-down list box displays the source addresses or ranges of addresses to which this firewall rule applies. Please note that a blank source or destination address is equivalent to Any.

Destination

Address

This drop-down list box displays the destination addresses or ranges of addresses to which this firewall rule applies. Please note that a blank source or destination address is equivalent to Any.

Service Type

Action

Log

Alert

This drop-down list box displays the services to which this firewall rule applies.

Please note that a blank service type is equivalent to Any. See

Table 10-5

for more information.

This is the specified action for that rule, either Block or Forward. Note that Block means the firewall silently discards the packet.

This field shows you if a log is created for packets that match the rule (Match), don't match the rule (Not Match), both (Both) or no log is created (None).

This field tells you whether this rule generates an alert (Yes) or not (No) when the rule is matched.

Formatted: Font: Italic

Deleted: Table 10-5

Formatted: Font: Italic, D check spelling or grammar






Insert

Move

Rule to (Rule

Number)

Type the index number for where you want to put a rule. For example, if you type “6”, your new rule becomes number 6 and the previous rule 6 (if there is one) becomes rule 7.

Click Insert to display this screen and refer to the following table for information on the fields.

Select a rule’s Index option button and type a number for where you want to put that rule. Click Move to move the rule to the number that you typed. The ordering of your rules is important as they are applied in order of their numbering.

Click a rule's option button and type the number for where you want to put that rule. move up by one when you take this action.

10.5.1 Configuring Firewall Rules

Follow these directions to create a new rule.

Step 1.

In the Summary screen, type the index number for where you want to put the rule. For example, if you type “6”, your new rule becomes number 6 and the previous rule 6 (if there is one) becomes rule 7.

Step 2.

Click Insert to display this screen and refer to the following table for information on the fields.

317517-A Rev 00

Figure 10-4 Creating/Editing A Firewall Rule



Table 10-2 Creating/Editing A Firewall Rule

LABEL

DESCRIPTION

Packet Direction

Source Address unchecked if you do not want the Contivity 221 to use the rule after you apply it

Use the drop-down list box to select the direction of packet travel to which you want to apply this firewall rule.

Click SrcAdd to add a new address, SrcEdit to edit an existing one or SrcDelete to delete one. Please see the next section for more information on adding and editing source addresses.



Table 10-2 Creating/Editing A Firewall Rule

LABEL

Destination

Address

DESCRIPTION

Click DestAdd to add a new address, DestEdit to edit an existing one or

DestDelete to delete one. Please see the following section on adding and editing destination addresses.

Services

Available/ Selected

Services

Please see

Table 10-5

for more information on services available. Highlight a service from the Available Services box on the left, then click >> to add it to the

Selected Services box on the right. To remove a service, highlight it in the

Selected Services box on the right, then click <<.

Custom Port

Add Click this button to bring up the screen that you use to configure a new custom service that is not in the predefined list of services.

Edit Select a custom service (denoted by an “*”) from the Available Services list and click this button to edit the service.

Delete Select a custom service (denoted by an “*”) from the Available Services list and click this button to remove the service.

Action for Matched

Packets

Log

Use the drop down list box to select whether to discard (Block) or allow the passage of (Forward) packets that match this rule.

This field determines if a log is created for packets that match the rule (Match), don't match the rule (Not Match), both (Both) or no log is created (None). Go to the Log Settings page and select the Access Control logs category to have the

Contivity 221 record these logs. rule is matched.

Cancel Click Cancel to exit this screen without saving,

To add a new source or destination address, click SrcAdd or DestAdd from the previous screen.

To edit an existing source or destination address, select it from the box and click SrcEdit or

DestEdit from the previous screen. Either action displays the following screen.

Formatted:

Font: Italic


Formatted:

Font: Italic, Do no spelling or grammar

Formatted:

Font: Italic

317517-A Rev 00

Figure 10-5 Adding/Editing Source and Destination Addresses



Table 10-3 Adding/Editing Source and Destination Addresses

LABEL

DESCRIPTION

Address Type Do you want your rule to apply to packets with a particular (single) IP, a range of IP addresses (e.g., 192.168.1.10 to 192.169.1.50), a subnet or any IP address? Select an option from the drop-down list box that includes: Single Address, Range

Address, Subnet Address and Any Address.

Start IP Address Enter the single IP address or the starting IP address in a range here.

End IP Address Enter the ending IP address in a range here.

Subnet Mask Enter the subnet mask here, if applicable.


10.5.3 Configuring Custom Ports

Configure customized ports for services not predefined by the Contivity 221 (see section 10.7 for a list of predefined services). For a comprehensive list of port numbers and services, visit the IANA

(Internet Assigned Number Authority) web site.

Click the Add button under Custom Port while editing a firewall to configure a custom port. This displays the following screen.



Figure 10-6 Creating/Editing A Custom Port


Table 10-4 Creating/Editing A Custom Port


Service Name

Service Type

Port Configuration

Enter a unique name for your custom port.

Choose the IP port (TCP, UDP or Both) that defines your customized port from the drop down list box. your customized service.

Port Number Enter a single port number or the range of port numbers that define your customized service.


10.6

Example Firewall Rule

The following Internet firewall rule example allows a hypothetical “My Service” connection from the Internet.

Step 1.

Step 2.

Click the Firewall link and then the Summary tab.

In the Summary screen, type the index number for where you want to put the rule. For

Step 3.

example, if you type “6”, your new rule becomes number 6 and the previous rule 6 (if there is one) becomes rule 7.

Click Insert to display the firewall rule configuration screen.

317517-A Rev 00

Figure 10-7 Firewall Edit Rule Screen


Select WAN to LAN from the drop-down list box.

Step 4.

Step 5.

Step 6.

Select Any in the Destination Address box and then click DestDelete.

Click DestAdd under the Source Address box.

Configure the Firewall Rule Edit IP screen as follows and click Apply.



Figure 10-8 Firewall Rule Edit IP Example

Step 7.

In the firewall rule configuration screen, click Add under Custom Port to open the Edit

Custom Port screen. Configure it as follows and click Apply.

Figure 10-9 Edit Custom Port Example

Step 8.

The firewall rule configuration screen displays, use the arrows between Available

Services and Selected Services to configure it as follows. Click Apply when you are done.

317517-A Rev 00


Custom ports show up with an “*” before their names in the Services list box and

the Rule Summary list box. Click Apply after you’ve created your custom port.

Figure 10-10 MyService Rule Configuration

This is the address range of the

“My Service” servers.

Click Apply when finished.

This is your “My Service” custom port.



On completing the configuration procedure for this Internet firewall rule, the Rule Summary screen should look like the following. Remember to click Apply when you have finished configuring your rule(s) to save your settings back to the Contivity 221.

Figure 10-11 My Service Example Rule Summary

Rule 1: Allows a “My Service” connection from the

WAN to IP addresses 10.0.0.10 through 10.0.0.15 on the LAN.

Click Apply to save your settings back to the Contivity 221.

10.7

Predefined Services

The Available Services list box in the Edit Rule screen (see

Figure 10-4

) displays all predefined services that the Contivity 221 already supports. Next to the name of the service, two fields appear

317517-A Rev 00

Formatted:

Font: Italic

Deleted: Figure 10-4

Formatted:


Formatted:

Font: Italic

Firewall Screens 10-17 in brackets. The first field indicates the IP protocol type (TCP, UDP, or ICMP). The second field indicates the IP port number that defines the service. (Note that there may be more than one IP protocol type. For example, look at the default configuration labeled “(DNS)”.

(UDP/TCP:53)

means

UDP port 53 and TCP port 53. Custom services may also be configured using the Custom Ports function discussed later.

Table 10-5 Predefined Services

SERVICE DESCRIPTION

BGP(TCP:179) Border Gateway Protocol.

BOOTP_CLIENT(UDP:68) DHCP Client.

BOOTP_SERVER(UDP:67) DHCP Server.

CU-

SEEME(TCP/UDP:7648,

24032)

DNS(UDP/TCP:53)

A popular videoconferencing solution from White Pines Software.

FINGER(TCP:79)

FTP(TCP:20.21)

Domain Name Server, a service that matches web names (e.g. www.nortelnetworks.com) to IP numbers.

Finger is a UNIX or Internet related command that can be used to find out if a user is logged on.

File Transfer Program, a program to enable fast transfer of files, including large files that may not be possible by e-mail.

HTTP(TCP:80)

HTTPS(TCP:443)

ICQ(UDP:4000)

IKE(UDP:500)

IPSEC_TUNNEL(AH:0)

IPSEC_TUNNEL(ESP:0)

Hyper Text Transfer Protocol - a client/server protocol for the world wide web.

HTTPS is a secured http session often used in e-commerce.

This is a popular Internet chat program.

The Internet Key Exchange algorithm is used for key distribution and management.

The IPSEC AH (Authentication Header) tunneling protocol uses this service.

The IPSEC ESP (Encapsulation Security Protocol) tunneling protocol uses this service.




SERVICE DESCRIPTION

IRC(TCP/UDP:6667)

MSN

Messenger(TCP:1863)

MULTICAST(IGMP:0)

This is another popular Internet chat program.

Microsoft Networks’ messenger service uses this protocol.

Internet Group Multicast Protocol is used when sending packets to a specific group of hosts.

NEW-ICQ(TCP:5190) An program.

NEWS(TCP:144) A protocol for news groups.

NFS(UDP:2049)

NNTP(TCP:119)

PING(ICMP:0)

POP3(TCP:110)

PPTP(TCP:1723)

PPTP_TUNNEL(GRE:0)

SFTP(TCP:115)

SMTP(TCP:25)

Network File System - NFS is a client/server distributed file service that provides transparent file sharing for network environments.

Network News Transport Protocol is the delivery mechanism for the

USENET newsgroup service.

Packet INternet Groper is a protocol that sends out ICMP echo requests to test whether or not a remote host is reachable.

Post Office Protocol version 3 lets a client computer get e-mail from a

POP3 server through a temporary connection (TCP/IP or other).

Point-to-Point Tunneling Protocol enables secure transfer of data over public networks. This is the control channel.

Point-to-Point Tunneling Protocol enables secure transfer of data over public networks. This is the data channel.

Remote Command Service. RCMD(TCP:512)

REAL_AUDIO(TCP:7070) A streaming audio service that enables real time sound over the web.

REXEC(TCP:514) Remote Execution Daemon.

RLOGIN(TCP:513) Remote Login.

RTELNET(TCP:107)

RTSP(TCP/UDP:554)

Remote Telnet.

The Real Time Streaming (media control) Protocol (RTSP) is a remote control for multimedia on the Internet.

Simple File Transfer Protocol.

Simple Mail Transfer Protocol is the message-exchange standard for the

Internet. SMTP enables you to move messages from one e-mail server to another.

317517-A Rev 00



SERVICE

SNMP(TCP/UDP:161)

SNMP-

TRAPS(TCP/UDP:162)

SQL-NET(TCP:1521)

Simple Network Management Program.

Traps for use with the SNMP (RFC:1215).

Structured Query Language is an interface to access data on many different types of database systems, including mainframes, midrange systems, UNIX systems and network servers.

SSH(TCP/UDP:22) Secure Shell Remote Login Program.

STRM WORKS(UDP:1558) Stream Works Protocol.

SYSLOG(UDP:514)

TACACS(UDP:49)

TELNET(TCP:23)

TFTP(UDP:69)

DESCRIPTION

Syslog allows you to send system logs to a UNIX server.

Login Host Protocol used for (Terminal Access Controller Access Control

System).

Telnet is the login and terminal emulation protocol common on the Internet and in UNIX environments. It operates over TCP/IP networks. Its primary function is to allow users to log into remote host systems.

Trivial File Transfer Protocol is an Internet file transfer protocol similar to

FTP, but uses the UDP (User Datagram Protocol) rather than TCP

(Transmission Control Protocol).

VDOLIVE(TCP:7000) Another videoconferencing solution.

10.8

Alerts

Alerts are reports on events, such as attacks, that you may want to know about right away. You can choose to generate an alert when an attack is detected in the Attack Alert screen (

Figure 10-12 -

check the Generate alert when attack detected checkbox) or when a rule is matched in the Rule

Edit screen (see

Figure 10-4 )

.

Configure the Log Settings screen to have the Contivity 221 send an immediate e-mail message to you when an event generates an alert. Refer to the chapter on logs for details.

10.9

Configuring Attack Alert

Attack alerts are the first defense against DOS attacks. In the Attack Alert screen, shown later, you may choose to generate an alert whenever an attack is detected. For DoS attacks, the Contivity 221

Formatted:

Font: Italic


Formatted:

Font: Italic, D check spelling or grammar

Formatted:

Font: Italic


Formatted:

Font: Italic

Formatted:

Font: Italic, D check spelling or grammar

Formatted:

Font: Italic


10-20 Firewall Screens uses thresholds to determine when to drop sessions that do not become fully established. These thresholds apply globally to all sessions.

You can use the default threshold values, or you can change them to values more suitable to your security requirements.

Tune these parameters when something is not working and after you have checked the firewall counters. These default values should work fine for normal small offices with ADSL bandwidth.

Factors influencing choices for threshold values are:

1. The maximum number of opened sessions.

2. The minimum capacity of server backlog in your LAN network.

3. The CPU power of servers in your LAN network.

4. Network bandwidth.

5. Type of traffic for certain servers.

If your network is slower than average for any of these factors (especially if you have servers that are slow or handle many tasks and are often busy), then the default values should be reduced.

You should make any changes to the threshold values before you continue configuring firewall rules.

An unusually high number of half-open sessions (either an absolute number or measured as the arrival rate) could indicate that a Denial of Service attack is occurring. For TCP, "half-open" means that the session has not reached the established state-the TCP three-way handshake has not yet been completed (see

Figure 9-2

). For UDP, "half-open" means that the firewall has detected no return traffic.

The Contivity 221 measures both the total number of existing half-open sessions and the rate of session establishment attempts. Both TCP and UDP half-open sessions are counted in the total number and rate measurements. Measurements are made once a minute.

When the number of existing half-open sessions rises above a threshold (max-incomplete high), the Contivity 221 starts deleting half-open sessions as required to accommodate new connection requests. The Contivity 221 continues to delete half-open requests as necessary, until the number of existing half-open sessions drops below another threshold (max-incomplete low).

When the rate of new connection attempts rises above a threshold (one-minute high), the Contivity

221 starts deleting half-open sessions as required to accommodate new connection requests. The

Contivity 221 continues to delete half-open sessions as necessary, until the rate of new connection attempts drops below another threshold (one-minute low). The rate is the number of new attempts detected in the last one-minute sample period.

317517-A Rev 00

Formatted:

Font: Italic


Formatted:


Formatted:

Font: Italic


TCP Maximum Incomplete and Blocking Period

An unusually high number of half-open sessions with the same destination host address could indicate that a Denial of Service attack is being launched against the host.

Whenever the number of half-open sessions with the same destination host address rises above a threshold (TCP Maximum Incomplete), the Contivity 221 starts deleting half-open sessions according to one of the following methods:

1. If the Blocking Period timeout is 0 (the default), then the Contivity 221 deletes the oldest existing half-open session for the host for every new connection request to the host. This ensures that the number of half-open sessions to a given host will never exceed the threshold.

2. If the Blocking Period timeout is greater than 0, then the Contivity 221 blocks all new connection requests to the host giving the server time to handle the present connections. The

Contivity 221 continues to block all new connection requests until the Blocking Period expires.

The Contivity 221 also sends alerts whenever TCP Maximum Incomplete is exceeded. The global values specified for the threshold and timeout apply to all TCP connections. Click the Attack Alert tab to bring up the next screen.



Figure 10-12 Attack Alert


Table 10-6 Attack Alert

Generate alert when attack detected

A detected attack automatically generates a log entry. Check this box to generate an alert

(as well as a log) whenever an attack is detected. See the chapter on logs for more information on logs and alerts.

Denial of Service Thresholds

317517-A Rev 00



One Minute Low This is the rate of new half-open sessions that causes the firewall to stop deleting half-open sessions. The Contivity 221 continues to delete half-open sessions as necessary, until the rate of new connection attempts drops below this number.

One Minute High This is the rate of new half-open sessions that causes the firewall to start deleting half-open sessions. When the rate of new connection attempts rises above this number, the

Contivity 221 deletes half-open sessions as required to accommodate new connection attempts.

80 existing half-open sessions.

100 half-open sessions per minute. The above numbers cause the Contivity 221 to start deleting half-open sessions when more than 100 session establishment attempts have been detected in the last minute, and to stop deleting half-open sessions when fewer than 80 session establishment attempts have been detected in the last minute.

80 existing half-open sessions. Maximum

Incomplete Low

This is the number of existing half-open sessions that causes the firewall to stop deleting half-open sessions. The Contivity

221 continues to delete half-open requests as necessary, until the number of existing halfopen sessions drops below this number.

Maximum

Incomplete High

This is the number of existing half-open sessions that causes the firewall to start deleting half-open sessions. When the number of existing half-open sessions rises above this number, the Contivity 221 deletes half-open sessions as required to accommodate new connection requests. Do not set Maximum Incomplete High to lower than the current Maximum Incomplete Low number.

100 existing half-open sessions.

The above values causes the

Contivity 221 to start deleting half-open sessions when the number of existing half-open sessions rises above 100, and to stop deleting half-open sessions with the number of existing halfopen sessions drops below 80.




TCP Maximum

Incomplete

This is the number of existing half-open TCP sessions with the same destination host IP address that causes the firewall to start dropping half-open sessions to that same destination host IP address. Enter a number between 1 and 256. As a general rule, you should choose a smaller number for a smaller network, a slower system or limited bandwidth.

Blocking Period When TCP Maximum Incomplete is reached you can choose if the next session should be allowed or blocked. If you check Blocking

Period any new sessions will be blocked for the length of time you specify in the next field

(min) and all old incomplete sessions will be cleared during this period. If you want strong security, it is better to block the traffic for a short time, as it will give the server some time to digest the loading.

(min) Enter the length of Blocking Period in minutes.

10 existing half-open TCP sessions.

Select this check box to specify a number in minutes (min) text box.

0

317517-A Rev 00

11-1

Chapter 11

Content Filtering Screens

This chapter provides a brief overview of content filtering using the web embedded configurator.

11.1

Introduction to Content Filtering

Internet content filtering allows you to create and enforce Internet access policies tailored to their needs. Content filtering is the ability to block certain web features or specific URL keywords and should not be confused with packet filtering via

SMT menu 21.1. To access these functions, from the Main Menu, click Content

Filter to expand the Content Filter menus.

11.2

Restrict Web Features

The Contivity 221 can block web features such as ActiveX controls, Java applets, cookies and disable web proxies.

11.3

Days and Times

The Contivity 221 also allows you to define time periods and days during which the Contivity 221 performs content filtering.

11.4

Configure Content Filtering

Click Content Filter on the navigation panel, to open the following screen.


11-2 Content Filtering Screens

Figure 11-1 Content Filter

Table 11-1 Content Filter


Restrict Web Features

Select the box(es) to restrict a feature. When you download a page containing a restricted feature, that part of the web page will appear blank or grayed out.

ActiveX

Java

A tool for building dynamic and active Web pages and distributed object applications. When you visit an ActiveX Web site, ActiveX controls are downloaded to your browser, where they remain in case you visit the site again.

A programming language and development environment for building downloadable Web components or Internet and intranet business applications of all kinds.

317517-A Rev 00

Content Filtering Screens 11-3

Table 11-1 Content Filter

LABEL

Cookies

DESCRIPTION

Used by Web servers to track usage and provide service based on ID.

Web Proxy

Enable URL

Keyword

Blocking

A server that acts as an intermediary between a user and the Internet to provide security, administrative control, and caching service. When a proxy server is located on the WAN it is possible for LAN users to circumvent content filtering by pointing to this proxy server.

The Contivity 221 can be configured to block Web sites containing keywords. For example, if the keyword "bad" was enabled, all sites containing this keyword will be blocked, e.g., URL http://www.website.com/bad.html would be blocked. Select this check box to enable this feature.

Domain Name

Add

Type a keyword in this field. You may use any character (up to 64 characters). Wildcards are not allowed.

Click Add after you have typed a keyword.

Repeat this procedure to add other keywords. Up to 64 keywords are allowed.

When you try to access a web page containing a keyword, you will get a message telling you that the content filter is blocking this request.

Delete

Clear All

Day to Block

Highlight a keyword in the lower box and click Delete to remove it. The keyword disappears from the text box after you click Apply.

Click this button to remove all of the listed keywords.

Select check boxes for the days that you want the Contivity 221 to perform content filtering.

Select the Everyday check box to have content filtering turned on all days of the week.

Time of Day to Block

Time of Day to Block allows the administrator to define during which time periods content filtering is enabled.

Time of Day to Block restrictions only apply to the keywords (see above). Restrict web server data, such as

ActiveX, Java, Cookies and Web Proxy are not affected.

Time of Day to

Block

Enter the time period, in 24-hour format, during which content filtering will be enforced. Select the All Day check box to have content filtering always active on the days selected in Day to

Block with time of day limitations not enforced.

Click Apply to save your changes. Click Reset to begin configuring this screen afresh


VPN/IPSec

Part VI:

VPN/IPSec

This part provides information on how to configure VPN/IPSec.

VI

12-1

Chapter 12

Introduction to IPSec

This chapter introduces the basics of IPSec VPNs.

12.1

VPN Overview

A VPN (Virtual Private Network) provides secure communications between sites without the expense of leased site-to-site lines. A secure VPN is a combination of tunneling, encryption, authentication, access control and auditing technologies/services used to transport traffic over the

Internet or any insecure network that uses the TCP/IP protocol suite for communication.

12.1.1 IPSec

Internet Protocol Security (IPSec) is a standards-based VPN that offers flexible solutions for secure data communications across a public network like the Internet. IPSec is built around a number of standardized cryptographic techniques to provide confidentiality, data integrity and authentication at the IP layer.

A Security Association (SA) is a contract between two parties indicating what security parameters, such as keys and algorithms they will use.

¾ Encryption

Encryption is a mathematical operation that transforms data from "plaintext" (readable) to

"ciphertext" (scrambled text) using a "key". The key and clear text are processed by the encryption operation, which leads to the data scrambling that makes encryption secure.

Decryption is the opposite of encryption: it is a mathematical operation that transforms

“ciphertext” to plaintext. Decryption also requires a key.


12-2 Introduction to IPSec

Figure 12-1 Encryption and Decryption

¾ Data Confidentiality

The IPSec sender can encrypt packets before transmitting them across a network.

¾ Data Integrity

The IPSec receiver can validate packets sent by the IPSec sender to ensure that the data has not been altered during transmission.

¾ Data Origin Authentication

The IPSec receiver can verify the source of IPSec packets. This service depends on the data integrity service.

The Contivity 221 supports the following VPN applications.

¾ Linking Two or More Private Networks Together

Connect branch offices and business partners over the Internet with significant cost savings and improved performance when compared to leased lines between sites.

¾ Accessing Network Resources When NAT Is Enabled

When NAT is enabled, remote users are not able to access hosts on the LAN unless the host is designated a public LAN server for that specific protocol. Since the VPN tunnel terminates inside the LAN, remote users will be able to access all computers that use private IP addresses on the LAN.

¾ Unsupported IP Applications

A VPN tunnel may be created to add support for unsupported emerging IP applications.

317517-A Rev 00

12.2

IPSec Architecture

The overall IPSec architecture is shown as follows.

Figure 12-2 IPSec Architecture

Introduction to IPSec 12-3

The ESP (Encapsulating Security Payload) Protocol (RFC 2406) and AH (Authentication Header) protocol (RFC 2402) describe the packet formats and the default standards for packet structure

(including implementation algorithms).

The Encryption Algorithm describes the use of encryption techniques such as DES (Data

Encryption Standard), AES (Advanced Encryption Standard) and Triple DES algorithms.

The Authentication Algorithms, HMAC-MD5 (RFC 2403) and HMAC-SHA-1 (RFC 2404, provide an authentication mechanism for the AH and ESP protocols. Please see 13.2 for more information.

Your Contivity 221 uses IKE (ISAKMP) key management in order to set up a VPN.


12-4 Introduction to IPSec

12.3

Encapsulation

The two modes of operation for IPSec VPNs are Transport mode and Tunnel mode.

Figure 12-3 Transport and Tunnel Mode IPSec Encapsulation

Transport mode is used to protect upper layer protocols and only affects the data in the IP packet.

In Transport mode, the IP packet contains the security protocol (AH or ESP) located after the original IP header and options, but before any upper layer protocols contained in the packet (such as TCP and UDP).

With ESP, protection is applied only to the upper layer protocols contained in the packet. The IP header information and options are not used in the authentication process. Therefore, the originating IP address cannot be verified for integrity against the data.

With the use of AH as the security protocol, protection is extended forward into the IP header to verify the integrity of the entire packet by use of portions of the original IP header in the hashing process.

Tunnel mode encapsulates the entire IP packet to transmit it securely. A Tunnel mode is required for gateway services to provide access to internal systems. Tunnel mode is fundamentally an IP tunnel with authentication and encryption. This is the most common mode of operation. Tunnel mode is required for VPN switch to VPN switch and host to VPN switch communications. Tunnel mode communications have two sets of IP headers:

¾ Outside header: The outside IP header contains the destination IP address of the VPN switch.

¾ Inside header: The inside IP header contains the destination IP address of the final system behind the VPN switch. The security protocol appears after the outer IP header and before the inside IP header.

317517-A Rev 00

Introduction to IPSec 12-5

12.4

IPSec and NAT

Read this section if you are running IPSec on a host computer behind the Contivity 221.

NAT is incompatible with the AH protocol in both Transport and Tunnel mode. An IPSec VPN using the AH protocol digitally signs the outbound packet, both data payload and headers, with a hash value appended to the packet. When using AH protocol, packet contents (the data payload) are not encrypted.

A NAT device in between the IPSec endpoints will rewrite either the source or destination address with one of its own choosing. The VPN device at the receiving end will verify the integrity of the incoming packet by computing its own hash value, and complain that the hash value appended to the received packet doesn't match. The VPN device at the receiving end doesn't know about the

NAT in the middle, so it assumes that the data has been maliciously altered.

IPSec using ESP in Tunnel mode encapsulates the entire original packet (including headers) in a new IP packet. The new IP packet's source address is the outbound address of the sending VPN switch, and its destination address is the inbound address of the VPN device at the receiving end.

When using ESP protocol with authentication, the packet contents (in this case, the entire original packet) are encrypted. The encrypted contents, but not the new headers, are signed with a hash value appended to the packet.

Tunnel mode ESP with authentication is compatible with NAT because integrity checks are performed over the combination of the "original header plus original payload," which is unchanged by a NAT device. Transport mode ESP with authentication is not compatible with NAT, although

NAT traversal provides a way to use Transport mode ESP when there is a NAT router between the IPSec endpoints (see section 13.7 for details).

Table 12-1 VPN and NAT

SECURITY PROTOCOL MODE NAT


13-1

Chapter 13

VPN Screens

This chapter introduces the VPN WebGUI. See the Logs chapter for information on viewing logs and the appendices for IPSec log descriptions.

13.1

VPN/IPSec Overview

Use the screens documented in this chapter to configure rules for VPN connections and manage

VPN connections.

13.2

IPSec Algorithms

The ESP and AH protocols are necessary to create a Security Association (SA), the foundation of an IPSec VPN. An SA is built from the authentication provided by the AH and ESP protocols. The primary function of key management is to establish and maintain the SA between systems. Once the SA is established, the transport of data may commence.

AH protocol (RFC 2402) was designed for integrity, authentication, sequence integrity (replay resistance), and non-repudiation but not for confidentiality, for which the ESP was designed.

In applications where confidentiality is not required or not sanctioned by government encryption restrictions, an AH can be employed to ensure integrity. This type of implementation does not protect the information from dissemination but will allow for verification of the integrity of the information and authentication of the originator.

The ESP protocol (RFC 2406) provides encryption as well as some of the services offered by AH.

ESP authenticating properties are limited compared to the AH due to the non-inclusion of the IP header information during the authentication process. However, ESP is sufficient if only the upper layer protocols need to be authenticated.

An added feature of the ESP is payload padding, which further protects communications by concealing the size of the packet being transmitted.


13-2 VPN Screens

Table 13-1 AH and ESP

ESP AH

DES (default)

Data Encryption Standard (DES) is a widely used method of data encryption using a secret key. DES applies a 56-bit key to each 64-bit block of data.

MD5 (default)

MD5 (Message Digest 5) produces a 128-bit digest to authenticate packet data.

3DES

Triple DES (3DES) is a variant of DES, which iterates three times with three separate keys (3 x 56 = 168 bits), effectively doubling the strength of DES.

SHA1

SHA1 (Secure Hash Algorithm) produces a

160-bit digest to authenticate packet data.

AES

Advanced Encryption Standard is a newer method of data encryption that also uses a secret key. This implementation of AES applies a 128-bit key to 128-bit blocks of data. AES is faster than 3DES.

Select DES for minimal security and 3DES or AES for maximum. Select NULL to set up a tunnel without encryption.

Select MD5 for minimal security and SHA-1 for maximum security.

13.3

My IP Address

My IP Address is the WAN IP address of the Contivity 221. If this field is configured as 0.0.0.0, then the Contivity 221 will use the current Contivity 221 WAN IP address (static or dynamic) to set up the VPN tunnel. The Contivity 221 has to rebuild the VPN tunnel if the My IP Address changes after setup.

13.4

Secure Gateway Address

Secure Gateway Address is the WAN IP address or domain name of the remote VPN switch

(secure gateway).

If the remote VPN switch has a static WAN IP address, enter it in the Secure Gateway Address field. You may alternatively enter the remote VPN switch’s domain name (if it has one) in the

Secure Gateway Address field.

You can also enter a remote VPN switch’s domain name in the Secure Gateway Address field if the remote VPN switch has a dynamic WAN IP address and is using DDNS. The Contivity 221 has to rebuild the VPN tunnel each time the remote VPN switch’s WAN IP address changes (there may

317517-A Rev 00

VPN Screens 13-3 be a delay until the DDNS servers are updated with the remote VPN switch’s new WAN IP address).

If the remote VPN switch has a dynamic WAN IP address and does not use DDNS, enter 0.0.0.0 as the remote VPN switch’s address. In this case only the remote VPN switch can initiate SAs. This may be useful for telecommuters initiating a VPN tunnel to the company network.

13.5

Summary Screen

The following figure helps explain the main fields in the WebGUI.

Figure 13-1 IPSec Summary Fields

Local and remote IP addresses must be static.

Click VPN to open the Summary screen. This is a read-only menu of your IPSec rules (tunnels).

Edit or create an IPSec rule by selecting an index number and then clicking Edit to configure the associated submenus.



Figure 13-2 Summary

IP Policies


Table 13-2 Summary


Contivity VPN

Client

Connect

The Contivity VPN Client is a simple VPN rule that lets you define and store connection information for accessing your corporate network through a Contivity VPN switch. The

Contivity VPN Client uses the IPSec protocol to establish a secure end-to-end connection. If you want to set the Contivity Client rule to active, you must set all other

VPN rules to inactive.

Create a VPN connection to remote Contivity switch.

317517-A Rev 00

VPN Screens 13-5



Disconnect

Go to Page

#

Active

Private /Local

/ Remote

Policy IP

Address

Private Policy

IP Address

Drop the Contivity VPN connection.

This displays when the total number of the VPN rules’ IP policies is more than ten.

There can be a total of five VPN rules. The VPN rules can have a combined total of total of 60 IP policies.

Each page can display up to ten IP policies. Therefore, it may take more than one page to display one VPN rule’s IP policies. Each page always displays all of the configured

VPN rules, although the rule’s IP policies may not all display. You may need to select another page number from this Go to Page drop-down list box to view other IP policies.

This is the VPN rule index number.

This field displays whether the VPN rule is active or not. A Yes signifies that this VPN rule is active. No signifies that this VPN rule is not active.

This field displays private, local and remote IP addresses when you configure the VPN rule’s IP policy to use branch tunnel NAT address mapping.

This field displays only local and remote IP addresses when you configure the VPN rule’s policy to not use branch tunnel NAT address mapping.

See the following descriptions for more details about the private, local and remote IP addresses.

The Private Policy IP Address or Local Policy IP Address field displays the IP address

(or range of IP addresses) of the computer (or computers) on your Contivity 221's local network, for which you have configured this VPN rule IP policy.

A Private Policy IP Address displays in blue, this applies when you configure the IP policy to use branch tunnel NAT address mapping.

The Private Policy IP Address field displays a single (static) IP address when the IP policy's Branch Tunnel NAT Address Mapping Rule Type field is configured to One-to-One in the IP Policy screen.

The Private Policy IP Address field displays the beginning and ending (static) IP addresses of a range of computers when the IP policy's Branch Tunnel NAT

Address Mapping Rule Type field is configured to Many One-to-one or Many-

to-One in the IP Policy screen.





Local Policy

IP address

The Local Policy IP Address field displays the IP policy's virtual IP address (or range of addresses) when you enable branch tunnel NAT address mapping in the IP Policy screen.

The Local Policy IP Address field displays a single (static) IP address when the

IP policy's Branch Tunnel NAT Address Mapping Rule Type field is configured to One-to-one or Many-to-One in the IP Policy screen.

The Local Policy IP Address field displays the beginning and ending (static) IP addresses of a range of computers when the policy's Branch Tunnel NAT

Address Mapping Rule Type field is configured to Many One-to-one in the IP

Policy screen.

The Local Policy IP Address field displays the policy's local IP address (or range of addresses) when you disable branch tunnel NAT address mapping in the IP Policy screen.

The Local Policy IP Address field displays a single (static) IP address when the

IP policy's Local Address Type field is configured to Single Address in the IP

Policy screen.

The Local Policy IP Address field displays the beginning and ending (static) IP addresses of a range of computers when the policy's Local Address Type field is configured to Range Address in the IP Policy screen.

The Local Policy IP Address field displays a (static) IP address and a subnet mask when the policy's Local Address Type field is configured to Subnet

Address in the IP Policy screen.

317517-A Rev 00




Remote Policy

IP Address

The Remote Policy IP Address field displays the IP address(es) of computer(s) on the remote network behind the remote VPN switch.

A single (static) IP address displays for the Remote Policy IP Address when the IP policy's Remote Address Type field is configured to Single Address in the IP Policy screen.

The beginning and ending (static) IP addresses of a range of computers display for the

Remote Policy IP Address when the IP policy's Remote Address Type field is configured to Range Address in the IP Policy screen.

A (static) IP address and a subnet mask display for the Remote Policy IP Address when the IP policy's Remote Address Type field is configured to Subnet Address in the

IP Policy screen.

The Remote Policy IP Address displays ALL whenever the Secure Gateway Address field is set to 0.0.0.0.

The Remote Policy IP Address also displays ALL whenever the IP policy's Remote

Starting IP Address field is set to 0.0.0.0 in the IP Policy screen.

When ALL displays, only the remote VPN switch can initiate the VPN.

Encap

IPSec

Algorithm

Secure

Gateway

Address

Edit

Delete

This field displays Tunnel or Transport mode. You need to finish configuring the VPN policy if ??? is displayed.

This field displays the security protocols used for an SA.

Both AH and ESP increase Contivity 221 processing requirements and communications latency (delay).

This is the static WAN IP address or URL of the remote VPN switch. This field displays

0.0.0.0 when you configure the Secure Gateway Address field in the VPN Branch

Office screen to 0.0.0.0.

Click the radio button next to a VPN index number and then click Edit to edit a specific

VPN policy.

Click the radio button next to an empty VPN policy index number and then Edit to add a new VPN policy.

Click the radio button next to a VPN policy number you want to delete and then click

Delete. When a VPN policy is deleted, subsequent policies do not move up in the page list.



13.6

Keep Alive

When you initiate an IPSec tunnel with keep alive enabled, the Contivity 221 automatically renegotiates the tunnel when the IPSec SA lifetime period expires (see section 13.14 for more on the IPSec SA lifetime). In effect, the IPSec tunnel becomes an “always on” connection after you initiate it. Both VPN switches must have a Contivity 221-compatible keep alive feature enabled in order for this feature to work.

If the Contivity 221 has its maximum number of simultaneous IPSec tunnels connected to it and they all have keep alive enabled, then no other tunnels can take a turn connecting to the Contivity

221 because the Contivity 221 never drops the tunnels that are already connected. Your Contivity

221 model can support 5 simultaneous IPSec SAs.

No matter whether or not keep alive is set, when there is outbound traffic with no inbound traffic, the Contivity 221 automatically drops the tunnel after two minutes.

13.7

NAT Traversal

NAT traversal allows you to set up a VPN connection when there are NAT routers between the two

VPN switches.

Figure 13-3 NAT Router Between VPN Switches

Normally you cannot set up a VPN connection with a NAT router between the two VPN switches because the NAT router changes the header of the IPSec packet. In the previous figure, VPN switch A sends an IPSec packet in an attempt to initiate a VPN. The NAT router changes the IPSec packet’s header so it does not match the header for which VPN switch B is checking. Therefore,

VPN switch B does not respond and the VPN connection cannot be built.

NAT traversal solves the problem by adding a UDP port 500 header to the IPSec packet. The NAT router forwards the IPSec packet with the UDP port 500 header unchanged. VPN switch B checks the UDP port 500 header and responds. VPN switches A and B build a VPN connection.

317517-A Rev 00


13.7.1 NAT Traversal Configuration

For NAT traversal to work you must:

¾ Use ESP security protocol (in either transport or tunnel mode).

¾ Use IKE keying mode.

¾ Enable NAT traversal on both IPSec endpoints.

In order for VPN switch A (see the figure) to receive an initiating IPSec packet from VPN switch

B, set the NAT router to forward UDP port 500 to VPN switch A.

13.8

ID Type and Content

With aggressive negotiation mode (see section 13.13.1), the Contivity 221 identifies incoming SAs by ID type and content since this identifying information is not encrypted. This enables the

Contivity 221 to distinguish between multiple rules for SAs that connect from remote VPN switches that have dynamic WAN IP addresses. Telecommuters can use separate passwords to simultaneously connect to the Contivity 221 from VPN switches with dynamic IP addresses.

Regardless of the ID type and content configuration, the Contivity 221 does not allow you to save multiple active rules with overlapping local and remote IP addresses.

With main mode (see section 13.13.1), the ID type and content are encrypted to provide identity protection. In this case the Contivity 221 can only distinguish between up to eight different incoming SAs that connect from remote VPN switches that have dynamic WAN IP addresses. The

Contivity 221 can distinguish up to eight incoming SAs because you can select between two encryption algorithms (DES and 3DES), two authentication algorithms (MD5 and SHA1) and two key groups (DH1 and DH2) when you configure a VPN rule (see section 13.14). The ID type and content act as an extra level of identification for incoming SAs.

The type of ID can be a domain name, an IP address or an e-mail address. The content is the IP address, domain name, or e-mail address.



Table 13-3 Local ID Type and Content Fields

LOCAL ID TYPE= CONTENT=

IP Type the IP address of your computer or leave the field blank to have the Contivity 221 automatically use its own IP address.

DNS

E-mail

Type a domain name (up to 31 characters) by which to identify this Contivity 221.

Type an e-mail address (up to 31 characters) by which to identify this Contivity 221.

The domain name or e-mail address that you use in the Content field is used for identification purposes only and does not need to be a real domain name or e-mail address.

Table 13-4 Peer ID Type and Content Fields

PEER ID TYPE= CONTENT=

IP

DNS

Type the IP address of the computer with which you will make the VPN connection or leave the field blank to have the Contivity 221 automatically use the address in the

Secure Gateway field.

Type a domain name (up to 31 characters) by which to identify the remote VPN switch.

E-mail Type an e-mail address (up to 31 characters) by which to identify the remote VPN switch.

The domain name or e-mail address that you use in the Content field is used for identification purposes only and does not need to be a real domain name or e-mail address. The domain name also does not have to match the remote VPN switch’s IP address or what you configure in the Secure Gateway Address field below.

Two VPN switches must have matching ID type and content configuration in order to set up a VPN tunnel.

The two Contivity 221s in this example can complete negotiation and establish a VPN tunnel.

Table 13-5 Matching ID Type and Content Configuration Example

CONTIVITY 221 A CONTIVITY 221 B

Local ID type: E-mail Local ID type: IP

317517-A Rev 00


Table 13-5 Matching ID Type and Content Configuration Example

CONTIVITY 221 A CONTIVITY 221 B

Local ID content: [email protected]

Peer ID type: IP

Local ID content: 1.1.1.2

Peer ID type: E-mail

Peer ID content: 1.1.1.2 Peer ID content: [email protected]

The two Contivity 221s in this example cannot complete their negotiation because Contivity 221

B’s Local ID type is IP, but Contivity 221 A’s Peer ID type is set to E-mail. An “ID mismatched” message displays in the IPSEC LOG.

Table 13-6 Mismatching ID Type and Content Configuration Example

CONTIVITY 221 A

Local ID type: IP


Peer ID type: E-mail

Peer ID content: [email protected]

CONTIVITY 221 B

Local ID type: IP


Peer ID type: IP

Peer ID content: N/A

13.9

Pre-Shared Key

A pre-shared key identifies a communicating party during a phase 1 IKE negotiation (see section

13.12 for more on IKE phases). It is called “pre-shared” because you have to share it with another party before you can communicate with them over a secure connection.

13.10

Configuring Contivity Client VPN Rule Setup

Select one of the VPN rules in the VPN Summary screen and click Edit to configure the rule’s settings. If the Branch Office screen is displayed, select Contivity Client from the Connection

Type list box. The VPN Contivity Client Rule Setup screen is shown next.



Figure 13-4 VPN Contivity Client Rule Setup

Table 13-7 VPN Contivity Client Rule Setup

LABEL

Connection Type

DESCRIPTION

Select Branch Office to manually configure a VPN rule.

Select Contivity Client to use a simple VPN rule that lets you define and store connection information for accessing your corporate network through a Contivity VPN switch. You can only have one Contivity client rule.

Active

Keep Alive

Description

User Name

Password

Destination

Select this check box to turn on this rule. Clear this check box if you do not want to use this rule after you apply it. If you want to set the Contivity Client rule to active, you must set all other VPN rules to inactive.

Select this check box to turn on the Keep Alive feature for this SA.

Turn on Keep Alive to have the Contivity 221 automatically reinitiate the SA after the

SA lifetime times out, even if there is no traffic. The remote VPN switch must also have keep alive enabled in order for this feature to work.

Enter a brief description about this rule for identification purposes.

Enter the user name exactly as the Contivity VPN switch administrator gives you.

Enter the password exactly as the Contivity VPN switch administrator gives you.

This field specifies the IP address of the Contivity VPN switch.

317517-A Rev 00


Table 13-7 VPN Contivity Client Rule Setup


Cancel Click Cancel to return to the VPN Summary screen without saving your changes.

13.11

Configuring Branch Office VPN Rule Setup

Select one of the VPN rules in the VPN Summary screen and click Edit to configure the rule’s settings. The VPN Branch Office Rule Setup screen is shown next.



Figure 13-5 VPN Branch Office Rule Setup

317517-A Rev 00



Table 13-8 VPN Branch Office Rule Setup


Connection Type

Active

Select Branch Office to manually configure a VPN rule.

Select Contivity Client to use a simple VPN rule that lets you define and store connection information for accessing your corporate network through a Contivity VPN switch. You can only have one Contivity client rule.

If you want to set the Contivity Client rule to active, you must set all other VPN rules to inactive.

Select this check box to activate this VPN tunnel. This option determines whether a

VPN rule is applied.

Keep Alive

IP Policy

NAT Traversal

Name

Key Management

Negotiation Mode

Select this check box to turn on the Keep Alive feature for this SA.

Turn on Keep Alive to have the Contivity 221 automatically reinitiate the SA after the

SA lifetime times out, even if there is no traffic. The remote VPN switch must also have keep alive enabled in order for this feature to work.

Select this check box to enable NAT traversal. NAT traversal allows you to set up a

VPN connection when there are NAT routers between the two VPN switches.

The remote VPN switch must also have NAT traversal enabled.

You can use NAT traversal with ESP protocol using Transport or Tunnel mode, but not with AH protocol. In order for a VPN switch behind a NAT router to receive an initiating IPSec packet, set the NAT router to forward UDP port 500 to the VPN switch behind the NAT router.

Type a name to identify this VPN policy. You may use any character, including spaces, but the Contivity 221 drops trailing spaces.

Your Contivity 221 uses IKE (ISAKMP) key management in order to set up a VPN.

Select Main or Aggressive from the drop-down list box. Multiple SAs connecting through a VPN switch must have the same negotiation mode.

This field allows you to specify network routes that use the VPN tunnel after you enable it.




LABEL

Go to Page

Private IP Address

DESCRIPTION

This displays when the total number of the VPN rules’ IP policies is more than ten.

There can be a total of five VPN rules. The VPN rules can have a combined total of total of 60 IP policies.

Each page can display up to ten IP policies. Therefore, it may take more than one page to display one VPN rule’s IP policies. Select another page number from this Go

to Page drop-down list box to view more IP policies.

This field displays the IP address of the computer (or a range of computers) on your

Contivity 221's local network, for which you have configured this VPN rule.

This field applies when you configure the IP policy to use a branch tunnel NAT address mapping rule in the IP Policy screen.

This field displays a single (static) IP address when the IP policy's Branch Tunnel

NAT Address Mapping Rule Type field is configured to One-to-One in the IP Policy screen.

This field displays the beginning and ending (static) IP addresses of a range of computers when the IP policy's Branch Tunnel NAT Address Mapping Rule Type field is configured to Many-to-One or Many One-to-one in the IP Policy screen.

317517-A Rev 00



LABEL

Local IP Address

DESCRIPTION

This field displays the IP address (or range of IP addresses) of the computer (or computers) on your Contivity 221's local network, for which you have configured this IP policy.

This field displays the IP policy's virtual IP address (or range of addresses) when you enable branch tunnel NAT address mapping in the IP Policy screen.

This field displays a single (static) IP address when the IP policy's Branch

Tunnel NAT Address Mapping Rule Type field is configured to One-to-one or Many-to-One in the IP Policy screen.

This field displays the beginning and ending (static) IP addresses of a range of computers when the policy's Branch Tunnel NAT Address Mapping Rule

Type field is configured to Many One-to-one in the IP Policy screen.

This field displays the policy's local IP address (or range of addresses) when you disable branch tunnel NAT address mapping in the IP Policy screen.

This field displays a single (static) IP address when the IP policy's Local

Address Type field is configured to Single Address in the IP Policy screen.

This field displays the beginning and ending (static) IP addresses of a range of computers when the IP policy's Local Address Type field is configured to

Range Address in the IP Policy screen.

This field displays a (static) IP address and a subnet mask when the IP policy's Local Address Type field is configured to Subnet Address in the IP

Policy screen.





Remote IP Address

This field displays the IP address(es) of computer(s) on the remote network behind the remote VPN switch.

This field displays a single (static) IP address when the IP policy's Remote Address

Type field is configured to Single Address in the IP Policy screen.

This field displays the beginning and ending (static) IP addresses of a range of computers when the IP policy's Remote Address Type field is configured to Range

Address in the IP Policy screen.

This field displays a (static) IP address and a subnet mask when the IP policy's

Remote Address Type field is configured to Subnet Address in the IP Policy screen.

This field displays ALL whenever the Secure Gateway Address field is set to 0.0.0.0.

This field also displays ALL whenever the IP policy's Remote Starting IP Address field is set to 0.0.0.0 in the IP Policy screen.

When ALL displays, only the remote VPN switch can initiate the VPN.

Edit

Delete

Local ID Type

Local Content

Select the radio button next to an IP policy and then click Edit to edit that IP policy.

Select the radio button next to an IP policy that you want to remove and then click

Delete.

Select IP to identify this Contivity 221 by its IP address.

Select DNS to identify this Contivity 221 by a domain name.

Select E-mail to identify this Contivity 221 by an e-mail address.

When you select IP in the Local ID Type field, type an IP address or leave the field blank to have the Contivity 221 automatically use its own IP address.

When you select DNS in the Local ID Type field, type a domain name (up to 31 characters) by which to identify this Contivity 221.

When you select E-mail in the Local ID Type field, type an e-mail address (up to 31 characters) by which to identify this Contivity 221.

The IP address, domain name or e-mail address that you use in the Content field is used for identification purposes only and does not need to be a real domain name or e-mail address.

317517-A Rev 00



LABEL

My IP Address

Peer ID Type

DESCRIPTION

Enter the WAN IP address of your Contivity 221. The Contivity 221 uses its current

WAN IP address (static or dynamic) in setting up the VPN tunnel if you leave this field as 0.0.0.0.

The VPN tunnel has to be rebuilt if this IP address changes.

Select IP to identify the remote VPN switch by its IP address.

Select DNS to identify the remote VPN switch by a domain name.

Select E-mail to identify the remote VPN switch by an e-mail address.

Peer Content

Secure Gateway

Address

When you select IP in the Peer ID Type field, type the IP address of the computer with which you will make the VPN connection or leave the field blank to have the Contivity

221 automatically use the address in the Secure Gateway Address field.

When you select DNS in the Peer ID Type field, type a domain name (up to 31 characters) by which to identify the remote VPN switch.

When you select E-mail in the Peer ID Type field, type an e-mail address (up to 31 characters) by which to identify the remote VPN switch.

The domain name or e-mail address that you use in the Content field is used for identification purposes only and does not need to be a real domain name or e-mail address. The domain name also does not have to match the remote router's IP address or what you configure in the Secure Gateway Address field.

Regardless of how you configure the ID Type and Content fields, two active SAs cannot have both the local and remote IP address ranges overlap between rules.

Type the WAN IP address or the domain name (up to 31 characters) of the VPN switch with which you're making the VPN connection. Set this field to 0.0.0.0 if the remote

VPN switch has a dynamic WAN IP address (the Key Management field must be set to IKE). The remote address fields do not apply when the Secure Gateway Address field is configured to 0.0.0.0. In this case only the remote VPN switch can initiate the

VPN.

In order to have more than one active rule with the Secure Gateway Address field set to 0.0.0.0, the ranges of the local IP addresses cannot overlap between rules.

If you configure an active rule with 0.0.0.0 in the Secure Gateway Address field and the LAN’s full IP address range as the local IP address, then you cannot configure any other active rules with the Secure Gateway Address field set to 0.0.0.0.

Encapsulation Mode Select Tunnel mode or Transport mode from the drop-down list box.




LABEL

ESP

DESCRIPTION

Select ESP if you want to use ESP (Encapsulation Security Payload). The ESP protocol (RFC 2406) provides encryption as well as some of the services offered by

AH. If you select ESP here, you must select options from the Encryption Algorithm and Authentication Algorithm fields (described next).

AH

Select AH if you want to use AH (Authentication Header Protocol). The AH protocol

(RFC 2402) was designed for integrity, authentication, sequence integrity (replay resistance), and non-repudiation but not for confidentiality, for which the ESP was designed. If you select AH here, you must select options from the Authentication

Algorithm field.

Select DES, 3DES, AES or NULL from the drop-down list box.

Encryption Algorithm

When you use one of these encryption algorithms for data communications, both the sending device and the receiving device must use the same secret key, which can be used to encrypt and decrypt the message or to generate and verify a message authentication code. The DES encryption algorithm uses a 56-bit key. Triple DES

(3DES) is a variation on DES that uses a 168-bit key. As a result, 3DES is more secure than DES. It also requires more processing power, resulting in increased latency and decreased throughput. This implementation of AES uses a 128-bit key.

AES is faster than 3DES.

Select NULL to set up a tunnel without encryption. When you select NULL, you do not enter an encryption key.

Authentication

Algorithm

Pre-shared Key

Retype to Confirm

Select SHA1 or MD5 from the drop-down list box. MD5 (Message Digest 5) and SHA1

(Secure Hash Algorithm) are hash algorithms used to authenticate packet data. The

SHA1 algorithm is generally considered stronger than MD5, but is slower. Select MD5 for minimal security and SHA-1 for maximum security.

Type your pre-shared key in this field. A pre-shared key identifies a communicating party during a phase 1 IKE negotiation. It is called "pre-shared" because you have to share it with another party before you can communicate with them over a secure connection. Multiple SAs connecting through a VPN switch must have the same preshared key.

Type your pre-shared key again in this field.

317517-A Rev 00


13.12

Configuring an IP Policy

Select one of the IP Policies in the VPN Branch Office screen and click Edit to configure the policies settings. The Branch Office – IP Policy setup screen is shown next.

Figure 13-6 VPN Branch Office - IP Policy




Table 13-9 VPN Branch Office - IP Policy


Protocol

Branch Tunnel NAT

Address Mapping

Rule

Enter 1 for ICMP, 6 for TCP, 17 for UDP, etc. 0 is the default and signifies any protocol.

Active

Type

Enable this feature to have the Contivity 221 use a different (virtual) IP address for the

VPN connection. When you enable branch tunnel NAT address mapping, you do not configure the local section.

Select one of the following port mapping types.

1. One-to-One: One-to-one mode maps one private IP address to one virtual IP address. Port numbers do not change with one-to-one NAT mapping.

2. Many-to-One: Many-to-One mode maps multiple private IP addresses to one virtual

IP address. This is equivalent to SUA (i.e., PAT, port address translation), Contivity

221's Single User Account feature.

3. Many One-to-one: Many One-to-one mode maps each private IP address to a unique virtual IP address. Port numbers do not change with many one-to-one NAT mapping.

Private Start IP

Address

Private End IP

Address

When the Type field is configured to One-to-one, enter the (static) IP address of the computer on your Contivity 221's LAN that is to use the VPN tunnel.

When the Type field is configured to Many-to-One or Many One-to-one, enter the beginning (static) IP address of the range of computers on your Contivity 221's LAN that are to use the VPN tunnel.

When the Type field is configured to One-to-one, this field is N/A.

When the Type field is configured to Many-to-One or Many One-to-one, enter the ending (static) IP address of the range of computers on your Contivity 221's LAN that are to use the VPN tunnel.

317517-A Rev 00



LABEL

Virtual Start IP

Address

Virtual End IP

Address

Local

DESCRIPTION

Virtual addresses must be static and correspond to the remote VPN switch's configured remote IP addresses.

The computers on the Contivity 221's LAN and the remote network can function as if they were on the same subnet when the virtual IP address(es) is on the same subnet as the remote IP address(es).

Two active SAs can have the same virtual or remote IP address, but not both. You can configure multiple SAs between the same virtual and remote IP addresses, as long as only one is active at any time.

When the Type field is configured to One-to-one or Many-to-One, enter the (static) IP address that you want to use for the VPN tunnel.

When the Type field is configured to Many One-to-one, enter the beginning (static) IP address of the range of IP addresses that you want to use for the VPN tunnel.

When the Type field is configured to One-to-one or Many-to-One, this field is N/A.

When the Type field is configured to Many One-to-one, enter the ending (static) IP address of the range of IP addresses that you want to use for the VPN tunnel.

Local IP addresses must be static and correspond to the remote VPN switch's configured remote IP addresses.

Two active SAs can have the same local or remote IP address, but not both. You can configure multiple SAs between the same local and remote IP addresses, as long as only one is active at any time.

Two IP policies can have the same local or remote IP address, but not both.

In order to have more than one active rule with the Secure Gateway Address field set to 0.0.0.0, the ranges of the local IP addresses cannot overlap between rules.

If you configure an active rule with 0.0.0.0 in the Secure Gateway Address field and the LAN’s full IP address range as the local IP address, then you cannot configure any other active rules with the Secure Gateway Address field set to 0.0.0.0.

Use the drop-down menu to choose Single Address, Range Address, or Subnet

Address Type

Address. Select Single Address for a single IP address. Select Range Address for a specific range of IP addresses. Select Subnet Address to specify IP addresses on a network by their subnet mask.




LABEL

Remote

DESCRIPTION

When the Address Type field is configured to Single Address, enter a (static) IP address on the LAN behind your Contivity 221. When the Address Type field is

Starting IP Address configured to Range Address, enter the beginning (static) IP address, in a range of computers on your LAN behind your Contivity 221. When the Address Type field is configured to Subnet Address, this is a (static) IP address on the LAN behind your

Contivity 221.

Ending IP Address /

Subnet Mask

When the Address Type field is configured to Single Address, this field is N/A. When the Address Type field is configured to Range Address, enter the end (static) IP address, in a range of computers on the LAN behind your Contivity 221. When the

Address Type field is configured to Subnet Address, this is a subnet mask on the

LAN behind your Contivity 221.

Port

0 is the default and signifies any port. Type a port number from 0 to 65535. Some of the most common IP ports are: 21, FTP; 53, DNS; 23, Telnet; 80, HTTP; 25, SMTP;

110, POP3

Remote IP addresses must be static and correspond to the remote VPN switch's configured local IP addresses. The remote fields do not apply when the Secure

Gateway Address field is configured to 0.0.0.0. In this case only the remote VPN switch can initiate the VPN.

Two active SAs cannot have the local and remote IP address(es) both the same. Two active SAs can have the same local or remote IP address, but not both. You can configure multiple SAs between the same local and remote IP addresses, as long as only one is active at any time.

Two IP policies can have the same local or remote IP address, but not both.

Address Type

Use the drop-down menu to choose Single Address, Range Address, or Subnet

Address. Select Single Address for a single IP address. Select Range Address for a specific range of IP addresses. Select Subnet Address to specify IP addresses on a network by their subnet mask.

When the Address Type field is configured to Single Address, enter a (static) IP

Starting IP Address address on the LAN behind your Contivity 221. When the Address Type field is configured to Range Address, enter the beginning (static) IP address, in a range of computers on your LAN behind your Contivity 221. When the Address Type field is configured to Subnet Address, this is a (static) IP address on the LAN behind your

Contivity 221.

317517-A Rev 00




Ending IP Address /

Subnet Mask

When the Address Type field is configured to Single Address, this field is N/A. When the Address Type field is configured to Range Address, enter the end (static) IP address, in a range of computers on the LAN behind your Contivity 221. When the

Address Type field is configured to Subnet Address, this is a subnet mask on the

LAN behind your Contivity 221.

Apply

Cancel

Port

0 is the default and signifies any port. Type a port number from 0 to 65535. Some of the most common IP ports are: 21, FTP; 53, DNS; 23, Telnet; 80, HTTP; 25, SMTP;

110, POP3.

Click Apply to save your changes.

Click Cancel to return to the VPN Branch Office screen without saving your changes.

13.13

IKE Phases

There are two phases to every IKE (Internet Key Exchange) negotiation – phase 1 (Authentication) and phase 2 (Key Exchange). A phase 1 exchange establishes an IKE SA and the second one uses that SA to negotiate SAs for IPSec.

Figure 13-7 Two Phases to Set Up the IPSec SA

In phase 1 you must:

¾ Choose a negotiation mode.

¾ Authenticate the connection by entering a pre-shared key.



¾ Choose an encryption algorithm.

¾ Choose an authentication algorithm.

¾ Choose a Diffie-Hellman public-key cryptography key group (DH1 or DH2).

¾ Set the IKE SA lifetime. This field allows you to determine how long an IKE SA should stay up before it times out. An IKE SA times out when the IKE SA lifetime period expires. If an IKE

SA times out when an IPSec SA is already established, the IPSec SA stays connected.

In phase 2 you must:

¾ Choose which protocol to use (ESP or AH) for the IKE key exchange.

¾ Choose an encryption algorithm.

¾ Choose an authentication algorithm

¾ Choose whether to enable Perfect Forward Secrecy (PFS) using Diffie-Hellman public-key cryptography – see section 13.13.4. Select None (the default) to disable PFS.

¾ Choose Tunnel mode or Transport mode.

¾ Set the IPSec SA lifetime. This field allows you to determine how long the IPSec SA should stay up before it times out. The Contivity 221 automatically renegotiates the IPSec SA if there is traffic when the IPSec SA lifetime period expires. The Contivity 221 also automatically renegotiates the IPSec SA if both VPN switches have keep alive enabled, even if there is no traffic. If an IPSec SA times out, then the VPN switch must renegotiate the SA the next time someone attempts to send traffic.

13.13.1 Negotiation Mode

The phase 1 Negotiation Mode you select determines how the Security Association (SA) will be established for each connection through IKE negotiations.

¾ Main Mode ensures the highest level of security when the communicating parties are negotiating authentication (phase 1). It uses 6 messages in three round trips: SA negotiation,

Diffie-Hellman exchange and an exchange of nonces (a nonce is a random number). This mode features identity protection (your identity is not revealed in the negotiation).

¾ Aggressive Mode is quicker than Main Mode because it eliminates several steps when the communicating parties are negotiating authentication (phase 1). However the trade-off is that faster speed limits its negotiating power and it also does not provide identity protection. It is useful in remote access situations where the address of the initiator is not know by the responder and both parties want to use pre-shared key authentication.

13.13.2 Pre-Shared Key

A pre-shared key identifies a communicating party during a phase 1 IKE negotiation. It is called

“pre-shared” because you have to share it with another party before you can communicate with them over a secure connection.

317517-A Rev 00


13.13.3 Diffie-Hellman (DH) Key Groups

Diffie-Hellman (DH) is a public-key cryptography protocol that allows two parties to establish a shared secret over an unsecured communications channel. Diffie-Hellman is used within IKE SA setup to establish session keys. 768-bit (Group 1 - DH1) and 1024-bit (Group 2 – DH2) Diffie-

Hellman groups are supported. Upon completion of the Diffie-Hellman exchange, the two peers have a shared secret, but the IKE SA is not authenticated. For authentication, use pre-shared keys.

13.13.4 Perfect Forward Secrecy (PFS)

Enabling PFS means that the key is transient. The key is thrown away and replaced by a brand new key using a new Diffie-Hellman exchange for each new IPSec SA setup. With PFS enabled, if one key is compromised, previous and subsequent keys are not compromised, because subsequent keys are not derived from previous keys. The (time-consuming) Diffie-Hellman exchange is the tradeoff for this extra security.

This may be unnecessary for data that does not require such security, so PFS is disabled (None) by default in the Contivity 221. Disabling PFS means new authentication and encryption keys are derived from the same root secret (which may have security implications in the long run) but allows faster SA setup (by bypassing the Diffie-Hellman key exchange).

13.14

Configuring Advanced Branch Office Setup

Select one of the VPN rules in the VPN Summary screen and click Edit to configure the rule’s settings. The basic IKE rule setup screen opens

In the VPN Branch Office Rule Setup screen, click the Advanced button to display the VPN

Branch Office Advanced Rule Setup screen.



Figure 13-8 VPN Branch Office Advanced Rule Setup


Table 13-10 VPN Branch Office Advanced Rule Setup


Enable Replay

Detection

As a VPN setup is processing intensive, the system is vulnerable to Denial of Service (DOS) attacks The IPSec receiver can detect and reject old or duplicate packets to protect against replay attacks. Enable replay detection by setting this field to YES.

IKE Phase 1 A phase 1 exchange establishes an IKE SA (Security Association).

Negotiation Mode

Select Main or Aggressive from the drop-down list box. The Contivity 221's negotiation mode should be identical to that on the remote VPN switch.

317517-A Rev 00




Pre-Shared Key

Type your pre-shared key in this field. A pre-shared key identifies a communicating party during a phase 1 IKE negotiation. It is called "pre-shared" because you have to share it with another party before you can communicate with them over a secure connection.

Retype to

Confirm

Type your pre-shared key again in this field.

Encryption

Algorithm

Authentication

Algorithm

SA Life Time

Key Group

IKE Phase 2

Select DES, 3DES or AES from the drop-down list box.

When you use one of these encryption algorithms for data communications, both the sending device and the receiving device must use the same secret key, which can be used to encrypt and decrypt the message or to generate and verify a message authentication code. The DES encryption algorithm uses a 56-bit key. Triple DES (3DES) is a variation on DES that uses a

168-bit key. As a result, 3DES is more secure than DES. It also requires more processing power, resulting in increased latency and decreased throughput. This implementation of AES uses a 128-bit key. AES is faster than 3DES.

Select SHA1 or MD5 from the drop-down list box. The Contivity 221's authentication algorithm should be identical to the remote VPN switch. MD5 (Message Digest 5) and SHA1

(Secure Hash Algorithm) are hash algorithms used to authenticate the source and integrity of packet data. The SHA1 algorithm is generally considered stronger than MD5, but is slower.

Select SHA-1 for maximum security.

Define the length of time before an IKE SA automatically renegotiates in this field. It may range from 60 to 3,000,000 seconds (almost 35 days). A short SA life time increases security by forcing the two VPN switches to update the encryption and authentication keys. However, every time the VPN tunnel renegotiates, all users accessing remote resources are temporarily disconnected.

You must choose a key group for phase 1 IKE setup. DH1 (default) refers to Diffie-Hellman

Group 1 a 768 bit random number. DH2 refers to Diffie-Hellman Group 2 a 1024 bit (1Kb) random number.

A phase 2 exchange uses the IKE SA established in phase 1 to negotiate the SA for IPSec.





Active Protocol

Select ESP or AH from the drop-down list box. The Contivity 221's IPSec Protocol should be identical to the remote VPN switch. The ESP (Encapsulation Security Payload) protocol

(RFC 2406) provides encryption as well as the authentication offered by AH. If you select

ESP here, you must select options from the Encryption Algorithm and Authentication

Algorithm fields (described below). The AH protocol (Authentication Header Protocol) (RFC

2402) was designed for integrity, authentication, sequence integrity (replay resistance), and non-repudiation but not for confidentiality, for which the ESP was designed. If you select AH here, you must select options from the Authentication Algorithm field.

Encryption

Algorithm

Authentication

Algorithm

Select DES, 3DES, AES or NULL from the drop-down list box.

When you use one of these encryption algorithms for data communications, both the sending device and the receiving device must use the same secret key, which can be used to encrypt and decrypt the message or to generate and verify a message authentication code. The DES encryption algorithm uses a 56-bit key. Triple DES (3DES) is a variation on DES that uses a

168-bit key. As a result, 3DES is more secure than DES. It also requires more processing power, resulting in increased latency and decreased throughput. This implementation of AES uses a 128-bit key. AES is faster than 3DES.

Select NULL to set up a tunnel without encryption. When you select NULL, you do not enter an encryption key.

Select SHA1 or MD5 from the drop-down list box. MD5 (Message Digest 5) and SHA1

(Secure Hash Algorithm) are hash algorithms used to authenticate packet data. The SHA1 algorithm is generally considered stronger than MD5, but is slower. Select MD5 for minimal security and SHA-1 for maximum security.

SA Life Time

Encapsulation

Define the length of time before an IKE SA automatically renegotiates in this field. It may range from 60 to 3,000,000 seconds (almost 35 days). A short SA life time increases security by forcing the two VPN switches to update the encryption and authentication keys. However, every time the VPN tunnel renegotiates, all users accessing remote resources are temporarily disconnected.

Select Tunnel mode or Transport mode from the drop down list-box. The Contivity 221's encapsulation mode should be identical to the remote VPN switch.

Perfect Forward

Secrecy (PFS)

Perfect Forward Secrecy (PFS) is disabled (None) by default in phase 2 IPSec SA setup.

This allows faster IPSec setup, but is not so secure. Choose from DH1 or DH2 to enable

PFS. DH1 refers to Diffie-Hellman Group 1, a 768 bit random number. DH2 refers to Diffie-

Hellman Group 2, a 1024 bit (1Kb) random number (more secure, yet slower).

317517-A Rev 00




13.15

SA Monitor

In the WebGUI, click VPN and the SA Monitor tab. Use this screen to display and manage active

VPN connections.

A Security Association (SA) is the group of security settings related to a specific VPN tunnel. This screen displays active VPN connections. Use Refresh to display active VPN connections. This screen is read-only. The following table describes the fields in this tab.

When there is outbound traffic but no inbound traffic, the SA times out automatically after two minutes. A tunnel with no outbound or inbound traffic is

"idle" and does not timeout until the SA lifetime period expires. See the section on keep alive to have the Contivity 221 renegotiate an IPSec SA when the SA lifetime expires, even if there is no traffic.

Figure 13-9 VPN SA Monitor




Table 13-11 VPN SA Monitor

LABEL

#

Name

DESCRIPTION

This is the security association index number.

This field displays the identification name for this VPN policy.

Local IP Address

This field displays the IP address of the computer using the VPN IPSec feature of your

Contivity 221.

Remote IP

Address

Encapsulation

IPSec Algorithm

Refresh

This field displays IP address (in a range) of computers on the remote network behind the remote VPN switch.

This field displays Tunnel or Transport mode.

This field displays the security protocols used for an SA.

Both AH and ESP increase Contivity 221 processing requirements and communications latency (delay).

Click Refresh to display the current active VPN connection(s). This button is available when you have active VPN connections.

Disconnect

Next Page

(if applicable)

Select a security association index number that you want to disconnect and then click

Disconnect. This button is available when you have active VPN connections.

Click Next Page to view more items in the summary (if you have a summary list that exceeds this page)

13.16

Global Settings

In the WebGUI, click VPN on the navigation panel and the Global Setting tab. Use this screen to allow or block NetBIOS packets in the IPSec tunnels.

317517-A Rev 00


Figure 13-10 VPN Global Setting

Table 13-12 VPN Global Setting


Windows Networking (NetBIOS over TCP/IP)

NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN. It may sometimes be necessary to allow NetBIOS packets to pass through VPN tunnels in order to allow local computers to find computers on the remote network and vice versa.

Allow Through IPSec Tunnel Select this check box to send NetBIOS packets through the VPN connection.

Click Apply to save your changes back to the Contivity 221. Click Reset to begin configuring this screen afresh


Remote Management and UPnP

Part VII:

Remote Management and UPnP

This part provides information and configuration instructions for remote management and

Universal Plug and Play.

VII

14-1

Chapter 14

Remote Management Screens

This chapter provides information on the Remote Management screens.

14.1

Remote Management Overview

Remote management allows you to determine which services/protocols can access which Contivity

221 interface (if any) from which computers.

When you configure remote management to allow management from the WAN, you still need to configure a firewall rule to allow access. See the firewall chapters for details on configuring firewall rules.

You may manage your Contivity 221 from a remote location via:

¾ Internet (WAN ¾ ALL (LAN and WAN) only)

¾ LAN only, ¾ Neither (Disable).

When you Choose WAN only or ALL (LAN & WAN), you still need to configure a

firewall rule to allow access.

To disable remote management of a service, select Disable in the corresponding Server Access field.

Remote management over LAN or WAN will not work when:

1. A filter in SMT menu 3.1 (LAN) or in menu 11.5 (WAN) is applied to block a Telnet, FTP or Web service.

2. You have disabled that service in one of the remote management screens.


14-2 Remote Management Screens

3. The IP address in the Secured Client IP field does not match the client IP address. If it does not match, the Contivity 221 will disconnect the session immediately.

4. There is an SMT console session running.

5. There is already another remote management session of the same type (web, FTP or

Telnet) running. You may only have one remote management session of the same type running at one time.

6. There is a web remote management session running with a Telnet session. A web session will be disconnected if you begin a Telnet session; it will not begin if there already is a

Telnet session.

7. There is a firewall rule that blocks it.

14.1.2 Remote Management and NAT

When NAT is enabled:

¾ Use the Contivity 221’s WAN IP address when configuring from the WAN.

¾ Use the Contivity 221’s LAN IP address when configuring from the LAN.

There is a system timeout of five minutes (three hundred seconds) for either the console port or telnet/web/FTP connections. Your Contivity 221 automatically logs you out if you do nothing in this timeout period, except when it is continuously updating the status in menu 24.1 or when sys stdio

has been changed on the command line. See the System screen to change the timeout period in the Administrator Inactivity Timer field.

14.2

Telnet

You can configure your Contivity 221 for remote Telnet access as shown next.

317517-A Rev 00

Figure 14-1 Telnet Configuration on a TCP/IP Network

Remote Management Screens 14-3

14.3

Configuring TELNET

Click REMOTE MANAGEMENT to open the TELNET screen.

Figure 14-2 Telnet




Table 14-1 Telnet


Server Port

Server Access

Secured Client

IP Address

You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.

Select the interface(s) through which a computer may access the Contivity 221 using this service.

A secured client is a “trusted” computer that is allowed to communicate with the

Contivity 221 using this service.

Apply

Reset

Select All to allow any computer to access the Contivity 221 using this service.

Choose Selected to just allow the computer with the IP address that you specify to access the Contivity 221 using this service.

Click Apply to save your customized settings and exit this screen.


14.4

Configuring FTP

You can upload and download the Contivity 221’s firmware and configuration files using FTP, please see the chapter on firmware and configuration file maintenance for details. To use this feature, your computer must have an FTP client.

To change your Contivity 221’s FTP settings, click REMOTE MANAGEMENT, then the FTP tab. The screen appears as shown.

317517-A Rev 00


Figure 14-3 FTP


Table 14-2 FTP


Server Port

Server Access



Secured Client

IP Address

Apply

Reset







14.5

Configuring WWW

To change your Contivity 221’s World Wide Web settings, click REMOTE MANAGEMENT, then the WWW tab. The screen appears as shown.



Figure 14-4 WWW


Table 14-3 WWW


Server Port

Server Access



Secured Client

IP Address

Apply

Reset







14.6

Configuring SNMP

Simple Network Management Protocol is a protocol used for exchanging management information between network devices. SNMP is a member of the TCP/IP protocol suite. Your Contivity 221 supports SNMP agent functionality, which allows a manager station to manage and monitor the

317517-A Rev 00


Contivity 221 through the network. The Contivity 221 supports SNMP version one (SNMPv1). The next figure illustrates an SNMP management operation. SNMP is only available if TCP/IP is configured. The default get and set communities are “public”.

SNMP is only available if TCP/IP is configured.

Figure 14-5 SNMP Management Model

An SNMP managed network consists of two main types of component: agents and a manager.

An agent is a management software module that resides in a managed device (the Contivity 221).

An agent translates the local management information from the managed device into a form compatible with SNMP. The manager is the console through which network administrators perform network management functions. It executes applications that control and monitor managed devices.

The managed devices contain object variables/managed objects that define each piece of information to be collected about a device. Examples of variables include such as number of packets received, node port status etc. A Management Information Base (MIB) is a collection of


14-8 Remote Management Screens managed objects. SNMP allows a manager and agents to communicate for the purpose of accessing these objects.

SNMP itself is a simple request/response protocol based on the manager/agent model. The manager issues a request and the agent returns responses using the following protocol operations:

• Get - Allows the manager to retrieve an object variable from the agent.

• GetNext - Allows the manager to retrieve the next object variable from a table or list within an agent. In SNMPv1, when a manager wants to retrieve all elements of a table from an agent, it initiates a Get operation, followed by a series of GetNext operations.

• Set - Allows the manager to set values for object variables within an agent.

• Trap - Used by the agent to inform the manager of some events.

The Contivity 221 supports MIB II that is defined in RFC-1213 and RFC-1215. The focus of the

MIBs is to let administrators collect statistical data and monitor status and performance.

The Contivity 221 will send traps to the SNMP manager when any one of the following events occurs:

Table 14-4 SNMP Traps

TRAP # TRAP NAME DESCRIPTION

0 coldStart RFC-1215) A trap is sent after booting (power on).

1 warmStart RFC-1215) A trap is sent after booting (software reboot).

4 authenticationFailure A trap is sent to the manager when receiving any SNMP

RFC-1215) get or set requirements with the wrong community

(password).

6 whyReboot (defined in MIB) A trap is sent with the reason of restart before rebooting when the system is going to restart (warm start).

6a For intentional reboot : A trap is sent with the message "System reboot by user!" if reboot is done intentionally, (for example, download new files, CI command "sys reboot", etc.).

317517-A Rev 00


TRAP # TRAP NAME

6b For fatal error :


DESCRIPTION

A trap is sent with the message of the fatal code if the system reboots because of fatal errors.

To change your Contivity 221’s SNMP settings, click REMOTE MANAGEMENT, then the

SNMP tab. The screen appears as shown.

Figure 14-6 SNMP




Table 14-5 SNMP


SNMP

Configuration

Get Community Enter the Get Community, which is the password for the incoming Get and GetNext requests from the management station. The default is public and allows all requests.

Set Community Enter the Set community, which is the password for incoming Set requests from the management station. The default is public and allows all requests.

Trusted Host If you enter a trusted host, your Contivity 221 will only respond to SNMP messages from this address. 0.0.0.0 (default) means your Contivity 221 will respond to all SNMP messages it receives, regardless of source.

Trap

Community Type the trap community, which is the password sent with each trap to the SNMP manager. The default is public and allows all requests.

Destination Type the IP address of the station to send your SNMP traps to.

SNMP

Service Port You may change the server port number for a service if needed, however you must use the same port number in order to use that service for remote management.

Service Access Select the interface(s) through which a computer may access the Contivity 221 using this service.

Secured Client

IP Address




Apply

Reset




14.7

Configuring DNS

Use DNS (Domain Name System) to map a domain name to its corresponding IP address and vice versa, for example, the IP address of www.nortelnetworks.com is 47.249.48.20. Refer to the

Internet Access chapter for more information.

317517-A Rev 00


To change your Contivity 221’s DNS settings, click REMOTE MANAGEMENT, then the DNS tab. The screen appears as shown.

Figure 14-7 DNS


Table 14-6 DNS


Server Port

Server Access

Secured Client

IP Address

The DNS service port number is 53 and cannot be changed here.

Select the interface(s) through which a computer may send DNS queries to the

Contivity 221.

A secured client is a “trusted” computer that is allowed to send DNS queries to the

Contivity 221.

Apply

Reset

Select All to allow any computer to send DNS queries to the Contivity 221.

Choose Selected to just allow the computer with the IP address that you specify to send DNS queries to the Contivity 221.





14.8

Configuring Security

To change your Contivity 221’s Security settings, click REMOTE MANAGEMENT, then the

Security tab. The screen appears as shown.

If an outside user attempts to probe an unsupported port on your Contivity 221, an ICMP response packet is automatically returned. This allows the outside user to know the Contivity 221 exists.

The Contivity 221 series support anti-probing, which prevents the ICMP response packet from being sent. This keeps outsiders from discovering your Contivity 221 when unsupported ports are probed.

Figure 14-8 Security


Table 14-7 Security


ICMP

Respond to Ping on

Internet Control Message Protocol is a message control and error-reporting protocol between a host server and a gateway to the Internet. ICMP uses Internet Protocol (IP) datagrams, but the messages are processed by the TCP/IP software and directly apparent to the application user.

The Contivity 221 will not respond to any incoming Ping requests when Disable is selected. Select LAN to reply to incoming LAN Ping requests. Select WAN to reply to incoming WAN Ping requests. Otherwise select LAN & WAN to reply to both incoming

LAN and WAN Ping requests.

317517-A Rev 00


Table 14-7 Security


Do not respond to requests for unauthorized services

Select this option to prevent hackers from finding the Contivity 221 by probing for unused ports. If you select this option, the Contivity 221 will not send ICMP response packets to port request(s) for unused ports, thus leaving the unused ports and the

Contivity 221 unseen.

Apply

Reset

If the firewall blocks a packet from the WAN, the Contivity 221 sends a TCP reset packet. Use the "sys firewall tcprst rst off" command in the command interpreter if you want to stop the Contivity 221 from sending TCP reset packets.




15-1

Chapter 15

UPnP

This chapter introduces the Universal Plug and Play feature.

15.1

Universal Plug and Play Overview

Universal Plug and Play (UPnP) is a distributed, open networking standard that uses TCP/IP for simple peer-to-peer network connectivity between devices. A UPnP device can dynamically join a network, obtain an IP address, convey its capabilities and learn about other devices on the network. In turn, a device can leave a network smoothly and automatically when it is no longer in use.

15.1.1 How Do I Know If I'm Using UPnP?

UPnP hardware is identified as an icon in the Network Connections folder (Windows XP). Each

UPnP compatible device installed on your network will appear as a separate icon. Selecting the icon of a UPnP device will allow you to access the information and properties of that device.

UPnP NAT traversal automates the process of allowing an application to operate through NAT.

UPnP network devices can automatically configure network addressing, announce their presence in the network to other UPnP devices and enable exchange of simple product and service descriptions. NAT traversal allows the following:

¾ Dynamic port mapping

¾ Learning public IP addresses

¾ Assigning lease times to mappings

Windows Messenger is an example of an application that supports NAT traversal and UPnP.

See the SUA/NAT chapter for further information about NAT.


15-2 UPnP

The automated nature of NAT traversal applications in establishing their own services and opening firewall ports may present network security issues. Network information and configuration may also be obtained and modified by users in some network environments.

All UPnP-enabled devices may communicate freely with each other without additional configuration. Disable UPnP if this is not your intention.

15.2

UPnP Implementation

The device has UPnP certification from the Universal Plug and Play Forum Creates UPnP™

Implementers Corp. (UIC). This UPnP implementation supports IGD 1.0 (Internet Gateway

Device). At the time of writing the UPnP implementation supports Windows Messenger 4.6 and

4.7 while Windows Messenger 5.0 and Xbox are still being tested.

UPnP broadcasts are only allowed on the LAN.

Please see later in this User’s Guide for examples of installing UPnP in Windows XP and

Windows Me as well as an example of using UPnP in Windows.

15.3

Configuring UPnP

Click UPnP to display the screen shown next.

317517-A Rev 00

UPnP 15-3

Figure 15-1 Configuring UPnP


Table 15-1 Configuring UPnP

FIELD

Enable the Universal Plug and Play (UPnP) feature

DESCRIPTION

Select this checkbox to activate UPnP. Be aware that anyone could use a

UPnP application to open the WebGUI's login screen without entering the

Contivity 221's IP address (although you must still enter the password to access the WebGUI).

Allow users to make configuration changes through UPnP

Allow UPnP to pass through firewall

Select this check box to allow UPnP-enabled applications to automatically configure the Contivity 221 so that they can communicate through the

Contivity 221, for example by using NAT traversal, UPnP applications automatically reserve a NAT forwarding port in order to communicate with another UPnP enabled device; this eliminates the need to manually configure port forwarding for the UPnP enabled application.

Select this check box to allow traffic from UPnP-enabled applications to bypass the firewall.

Clear this check box to have the firewall block all UPnP application packets

(for example, MSN packets).


15-4 UPnP

Table 15-1 Configuring UPnP

FIELD

Device Name

DESCRIPTION

This identifies the device in UPnP applications.

Click Apply to save your changes back to the Contivity 221.


15.4

Installing UPnP in Windows Example

This section shows how to install UPnP in Windows Me and Windows XP.

15.4.1 Installing UPnP in Windows Me

Follow the steps below to install UPnP in Windows Me.

Step 1.

Click Start and Control Panel. Double-click

Add/Remove Programs.

Step 2.

Click on the Windows Setup tab and select

Communication in the Components selection box. Click

Details.

317517-A Rev 00

Step 3.

In the Communications window, select the Universal

Plug and Play check box in the Components selection box.

Step 4.

Click OK to go back to the Add/Remove Programs

Properties window and click Next.

Step 5.

Restart the computer when prompted.

Step 6.

15.4.2 Installing UPnP in Windows XP

Follow the steps below to install UPnP in Windows XP.

Step 1.

Click start and Control Panel.

Step 2.

Double-click Network Connections.

Step 3.

In the Network Connections window, click Advanced in the main menu and select Optional Networking

Components ….

The Windows Optional Networking

Components Wizard window displays.

UPnP 15-5


15-6 UPnP

Step 4.

Select Networking Service in the

Components selection box and click

Details.

Step 5.

Step 6.

In the Networking Services window, select the Universal Plug and Play check box.

Step 7.

Click OK to go back to the Windows

Optional Networking Component

Wizard window and click Next.

Step 8.

15.5

Using UPnP in Windows XP Example

This section shows you how to use the UPnP feature in Windows XP. You must already have

UPnP installed in Windows XP and UPnP activated on the device.

Make sure the computer is connected to a LAN port of the device. Turn on your computer and the

Contivity 221.

317517-A Rev 00

UPnP 15-7

15.5.1 Auto-discover Your UPnP-enabled Network Device

Step 1.

Click start and Control Panel. Double-click

Network Connections. An icon displays under Internet Gateway.

Step 2.

Right-click the icon and select Properties.

Step 3.

In the Internet Connection Properties window, click Settings to see the port mappings that were automatically created.

Step 4.

You may edit or delete the port mappings or click Add to manually add port mappings.


15-8 UPnP

When the UPnP-enabled device is disconnected from your computer, all port mappings will be deleted automatically.

Step 5.

Select the Show icon in notification area

when connected check box and click OK. An icon displays in the system tray

Step 6.

Double-click the icon to display your current

Internet connection status.

317517-A Rev 00

UPnP 15-9

With UPnP, you can access the web-based configurator without first finding out its IP address.

This is helpful if you do not know the IP address of your Contivity 221.

Follow the steps below to access the WebGUI.

Step 1.

Click start and then Control Panel.

Step 2.

Double-click Network

Connections.

Step 3.

Select My Network Places under

Other Places.

Step 4.

An icon with the description for each

UPnP-enabled device displays under

Local Network.

Step 5.

Right-click the icon for your

Contivity 221 and select Invoke.

The WebGUI login screen displays.

Right click and select Invoke


Logs

Part VIII:

Logs

This part provides information and instructions for the logs and reports.

VIII

16-1

Chapter 16

Logs Screens

This chapter contains information about configuring general log settings and viewing the

Contivity 221’s logs. Refer to the Appendices for example log message explanations.

16.1

Configuring View Log

The WebGUI allows you to look at all of the Contivity 221’s logs in one location.

Click LOGS to open the View Log screen. Use the View Log screen to see the logs for the categories that you selected in the Log Settings screen (see section 16.2). Options include logs about system maintenance, system errors, access control, allowed or blocked web sites, blocked web features (such as ActiveX controls, java and cookies), attacks (such as DoS) and IPSec.

Log entries in red indicate system error logs. The log wraps around and deletes the old entries after it fills. Click a column heading to sort the entries. A triangle indicates ascending or descending sort order.


16-2 Log Screens

Figure 16-1 View Log


Table 16-1 View Log


Display The categories that you select in the Log Settings page (see section 16.2) display in the drop-down list box.

Time

Select a category of logs to view; select All Logs to view logs from all of the log categories that you selected in the Log Settings page.

This field displays the time the log was recorded. See the chapter on system maintenance and information to configure the Contivity 221’s time and date.

317517-A Rev 00

Log Screens 16-3

Table 16-1 View Log


Message This field states the reason for the log.

Source

Destination

Note

This field lists the source IP address and the port number of the incoming packet.

This field lists the destination IP address and the port number of the incoming packet.

This field displays additional information about the log entry.

Email Log Now Click Email Log Now to send the log screen to the e-mail address specified in the

Log Settings page (make sure that you have first filled in the Address Info fields in

Log Settings, see section 16.2).

Refresh Click Refresh to renew the log screen.

Clear Log Click Clear Log to delete all the logs.

16.2

Configuring Log Settings

To change your Contivity 221’s log settings, click Logs, then the Log Settings tab. The screen appears as shown.

Use the Log Settings screen to configure to where the Contivity 221 is to send logs; the schedule for when the Contivity 221 is to send the logs and which logs and/or immediate alerts the

Contivity 221 is to send.

An alert is a type of log that warrants more serious attention. They include system errors, attacks

(access control) and attempted access to blocked web sites or web sites with restricted web features such as cookies, active X and so on. Some categories such as System Errors consist of both logs and alerts. You may differentiate them by their color in the View Log screen. Alerts display in red and logs display in black.

Alerts are e-mailed as soon as they happen. Logs may be e-mailed as soon as the

log is full (see Log Schedule). Selecting many alert and/or log categories (especially

Access Control) may result in many e-mails being sent.



Figure 16-2 Log Settings

317517-A Rev 00

Log Screens 16-5


Table 16-2 Log Settings Screen


Address Info

Mail Server Enter the server name or the IP address of the mail server for the e-mail addresses specified below. If this field is left blank, logs and alert messages will not be sent via e-mail.

Mail Subject Type a title that you want to be in the subject line of the log e-mail message that the Contivity 221 sends.

Send Log To Logs are sent to the e-mail address specified in this field. If this field is left blank, logs will not be sent via e-mail.

Send Alerts To Alerts are sent to the e-mail address specified in this field. If this field is left blank, alerts will not be sent via e-mail.

Syslog Logging Syslog logging sends a log to an external syslog server used to store logs.

Active Click Active to enable syslog logging.

Syslog Server IP

Address

Enter the server name or IP address of the syslog server that will log the selected categories of logs.

Log Facility Select a location from the drop down list box. The log facility allows you to log the messages to different files in the syslog server. Refer to the documentation of your syslog program for more details.

Send Log

Log Schedule This drop-down menu is used to configure the frequency of log messages being sent as E-mail:

•

Daily

•

Weekly

•

Hourly

•

When the Log is Full

•

None.

If you select Weekly or Daily, specify a time of day when the E-mail should be sent. If you select Weekly, then also specify which day of the week the E-mail should be sent. If you select When Log is Full, an alert is sent when the log fills up. If you select None, no log messages are sent

Day for Sending Log Use the drop down list box to select which day of the week to send the logs.

Time for Sending Log Enter the time of the day in 24-hour format (for example 23:00 equals 11:00 pm) to send the logs.



Table 16-2 Log Settings Screen

Log


Select the categories of logs that you want to record. Logs include alerts.

Send Immediate Alert Select the categories of alerts for which you want the Contivity 221 to instantly email alerts to the e-mail address specified in the Send Alerts To field.

Apply

Reset



16.3

Configuring Reports

To change your Contivity 221’s log reports, click Logs, then the Reports tab. The screen appears as shown.

The Reports page displays which computers on the LAN send and receive the most traffic, what kinds of traffic are used the most and which web sites are visited the most often. Use the Reports screen to have the Contivity 221 record and display the following network usage details:

¾ Web sites visited the most often

¾ Number of times the most visited web sites were visited

¾ The most-used protocols or service ports

¾ The amount of traffic for the most used protocols or service ports

¾ The LAN IP addresses to and/or from which the most traffic has been sent

¾ How much traffic has been sent to and from the LAN IP addresses to and/or from which the most traffic has been sent

The web site hit count may not be 100% accurate because sometimes when an individual web page loads, it may contain references to other web sites that also get counted as hits.

The Contivity 221 records web site hits by counting the HTTP GET packets. Many web sites include HTTP GET references to other web sites and the Contivity 221 may count these as hits, thus the web hit count is not (yet) 100% accurate.

317517-A Rev 00

Log Screens 16-7

Figure 16-3 Reports

Enabling the Contivity 221’s reporting function decreases the overall throughput by about 1 Mbps.


Table 16-3 Reports


Report Type Use the drop-down list box to select the type of reports to display.

Web Site Hits displays the web sites that have been visited the most often from the

LAN and how many times they have been visited.

Protocol/Port displays the protocols or service ports that have been used the most and the amount of traffic for the most used protocols or service ports.

LAN IP Address displays the LAN IP addresses to and /or from which the most traffic has been sent and how much traffic has been sent to and from those IP addresses.

Start Collection/

Stop Collection

The button text shows Start Collection when the Contivity 221 is not recording report data and Stop Collection when the Contivity 221 is recording report data.

Click Start Collection to have the Contivity 221 record report data.

Refresh

Click Stop Collection to halt the Contivity 221 from recording more data.

Click Refresh to update the report display. The report also refreshes automatically when you close and reopen the screen.



All of the recorded reports data is erased when you turn off the Contivity 221.

16.3.1 Viewing Web Site Hits

In the Reports screen, select Web Site Hits from the Report Type drop-down list box to have the

Contivity 221 record and display which web sites have been visited the most often and how many times they have been visited.

Figure 16-4 Web Site Hits Report Example


Table 16-4 Web Site Hits Report

Hits


Web Site This column lists the domain names of the web sites visited most often from computers on the LAN. The names are ranked by the number of visits to each web site and listed in descending order with the most visited web site listed first. The

Contivity 221 counts each page viewed in a web site as another hit on the web site.

This column lists how many times each web site has been visited. The count starts over at 0 if a web site passes the hit count limit (see

Table 16-7 Report

Specifications

).


Formatted: Font: Italic, Do no spelling or grammar


Deleted: Table 16-7 Report

Specifications

317517-A Rev 00

Log Screens 16-9

In the Reports screen, select Protocol/Port from the Report Type drop-down list box to have the

Contivity 221 record and display which protocols or service ports have been used the most and the amount of traffic for the most used protocols or service ports.

Figure 16-5 Protocol/Port Report Example


Table 16-5 Protocol/ Port Report


Protocol/Port

Direction

This column lists the protocols or service ports for which the most traffic has gone through the Contivity 221. The protocols or service ports are listed in descending order with the most used protocol or service port listed first.

This column lists the direction of travel of the traffic belonging to each protocol or service port listed. Incoming refers to traffic that is coming into the Contivity 221’s

LAN from the WAN. Outgoing refers to traffic that is going out from the Contivity

221’s LAN to the WAN.

Amount This column lists how much traffic has been sent and/or received for each protocol or service port. The measurement unit shown (bytes, Kbytes, Mbytes or Gbytes) varies with the amount of traffic for the particular protocol or service port. The count starts over at 0 if a protocol or port passes the bytes count limit (see

Table 16-7 Report

Specifications

).




Deleted: Table 16-7 Repo

Specifications



In the Reports screen, select LAN IP Address from the Report Type drop-down list box to have the Contivity 221 record and display the LAN IP addresses that the most traffic has been sent to and/or from and how much traffic has been sent to and/or from those IP addresses.

Computers take turns using dynamically assigned LAN IP addresses. The

Contivity 221 continues recording the bytes sent to or from a LAN IP address when it is assigned to a different computer.

Figure 16-6 LAN IP Address Report Example


Table 16-6 LAN IP Address Report


IP Address This column lists the LAN IP addresses to and/or from which the most traffic has been sent. The LAN IP addresses are listed in descending order with the LAN IP address to and/or from which the most traffic was sent listed first.

317517-A Rev 00

Log Screens 16-11

Table 16-6 LAN IP Address Report


Amount This column displays how much traffic has gone to and from the listed LAN IP addresses. The measurement unit shown (bytes, Kbytes, Mbytes or Gbytes) varies with the amount of traffic sent to and from the LAN IP address. The count starts over at 0 if the total traffic sent to and from a LAN IP passes the bytes count limit (see

Table 16-7 Report Specifications

).


Deleted: Table 16-7 Repo

Specifications



The following table lists detailed specifications on the reports feature.

Table 16-7 Report Specifications


Number of web sites/protocols or ports/IP addresses listed:

20

Hit count limit:

Bytes count limit:

Up to 2

32

hits can be counted per web site. The count starts over at 0 if it passes four billion.

Up to 2

64

bytes can be counted per protocol/port or LAN IP address. The count starts over at 0 if it passes 2

64

bytes.


Maintenance

Part IX:

Maintenance

This part covers the maintenance screens.


17-1

Chapter 17

Maintenance

This chapter displays system information such as firmware, port IP addresses and port traffic statistics.

17.1

Maintenance Overview

The maintenance screens can help you view system information, upload new firmware, manage configuration and restart your Contivity 221.

17.2

Status Screen

Click MAINTENANCE to open the Status screen, where you can use to monitor your Contivity

221. Note that these fields are READ-ONLY and only used for diagnostic purposes.

Figure 17-1 System Status



17-2 Maintenance

Table 17-1 System Status

LABEL

System Name

DESCRIPTION

This is the System Name you chose in the first Internet Access Wizard screen. It is for identification purposes

This is the Nortel Networks Firmware version and the date created. Nortel Firmware

Version:

Routing Protocols This shows the routing protocol - IP for which the Contivity 221 is configured.

WAN Port

IP Address This is the WAN port IP address.

IP Subnet Mask This is the WAN port subnet mask.

DHCP This is the WAN port DHCP role - Client or None.

LAN Port

IP Address This is the LAN port IP address.

IP Subnet Mask This is the LAN port subnet mask.

DHCP This is the LAN port DHCP role – Server or None.

Read-only information here includes port status and packet specific statistics. Also provided are

"system up time" and "poll interval(s)". The Poll Interval(s) field is configurable.

Figure 17-2 System Status: Show Statistics


317517-A Rev 00

Maintenance 17-3

Table 17-2 System Status: Show Statistics

Port

LABEL

Status

This is the WAN or LAN port.

DESCRIPTION

TxPkts

This displays the port speed and duplex setting if you're using Ethernet encapsulation and down (line is down), idle (line (ppp) idle), dial (starting to trigger a call) and drop

(dropping a call) if you're using PPPoE encapsulation.

This is the number of transmitted packets on this port.

RxPkts

Collisions

Tx B/s

Rx B/s

This is the number of received packets on this port.

This is the number of collisions on this port.

This displays the transmission speed in bytes per second on this port.

This displays the reception speed in bytes per second on this port.

Up Time This is the total amount of time the line has been up.

System Up Time This is the total time the Contivity 221 has been on.

Poll Interval(s) Enter the time interval for refreshing statistics in this field.

Set Interval Click this button to apply the new poll interval you entered in the Poll Interval(s) field.

17.3

DHCP Table Screen

DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual clients to obtain TCP/IP configuration at start-up from a server. You can configure the Contivity 221 as a

DHCP server or disable it. When configured as a server, the Contivity 221 provides the TCP/IP configuration for the clients. If set to None, DHCP service will be disabled and you must have another DHCP server on your LAN, or else the computer must be manually configured.

Click MAINTENANCE, and then the DHCP Table tab. Read-only information here relates to your DHCP status. The DHCP table shows current DHCP Client information (including IP

Address, Host Name and MAC Address) of all network clients using the DHCP server.



Figure 17-3 DHCP Table


Table 17-3 DHCP Table

#


This is the index number of the host computer.

IP Address This field displays the IP address relative to the # field listed above.

Host Name

MAC Address

This field displays the computer host name.

This field shows the MAC address of the computer with the name in the Host Name field.

Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address is assigned at the factory and consists of six pairs of hexadecimal characters, for example, 00:A0:C5:00:00:02.

17.4

F/W Upload Screen

Find firmware at http://www.nortelnetworks.com/index.html

in a file that (usually) uses the system model name with a "*.bin" extension, e.g., "contivity221.bin". The upload process uses FTP (File

Transfer Protocol) and may take up to two minutes. After a successful upload, the system will reboot. See the Firmware and Configuration File Maintenance chapter in the SMT User’s Guide for upgrading firmware using FTP/TFTP commands.

Click MAINTENANCE, and then the F/W UPLOAD tab. Follow the instructions in this screen to upload firmware to your Contivity 221.

317517-A Rev 00

Maintenance 17-5

Figure 17-4 Firmware Upload


Figure 17-5 Firmware Upload


File Path Type in the location of the file you want to upload in this field or click Browse ... to find it.

Browse... Click Browse... to find the .bin file you want to upload. Remember that you must decompress compressed (.zip) files before you can upload them.

Upload Click Upload to begin the upload process. This process may take up to two minutes.

Do not turn off the device while firmware upload is in progress!

After you see the Firmware Upload in Process screen, wait two minutes before logging into the device again.



Figure 17-6 Firmware Upload In Process

The device automatically restarts in this time causing a temporary network disconnect. In some operating systems, you may see the following icon on your desktop.

Figure 17-7 Network Temporarily Disconnected

After two minutes, log in again and check your new firmware version in the System Status screen.

If the upload was not successful, the following screen will appear. Click Return to go back to the

F/W Upload screen.

317517-A Rev 00

Maintenance 17-7

Figure 17-8 Firmware Upload Error

17.5

Configuration Screen

See the Firmware and Configuration File Maintenance chapter in the SMT User’s Guide for transferring configuration files using FTP/TFTP commands.

Click MAINTENANCE, and then the Configuration tab. Information related to factory defaults, backup configuration, and restoring configuration appears as shown next.



Figure 17-9 Configuration

17.5.1 Back to Factory Defaults

Pressing the Reset button in this section clears all user-entered configuration information and returns the Contivity 221 to its factory defaults as shown on the screen. The following warning screen will appear.

317517-A Rev 00

Maintenance 17-9

Figure 17-10 Reset Warning Message

You can also press the RESET button on the rear panel to reset the factory defaults of your

Contivity 221. Refer to the Hardware Installation chapter for more information on the RESET button.

Backup Configuration allows you to back up (save) the device’s current configuration to a 104KB file on your computer. Once your device is configured and functioning properly, it is highly recommended that you back up your configuration file before making configuration changes. The backup configuration file will be useful in case you need to return to your previous settings.

Click Backup to save the device’s current configuration to your computer.

17.5.3 Restore Configuration

Restore Configuration allows you to upload a new or previously saved configuration file from your computer to your Contivity 221.

Table 17-4 Restore Configuration

LABEL

File Path

DESCRIPTION

Type in the location of the file you want to upload in this field or click Browse ... to find it.

Browse...

Upload

Click Browse... to find the file you want to upload. Remember that you must decompress compressed (.ZIP) files before you can upload them.

Click Upload to begin the upload process.

Do not turn off the device while configuration file upload is in progress.

After you see a “configuration upload successful” screen, you must then wait one minute before logging into the device again.



Figure 17-11 Configuration Upload Successful

The device automatically restarts in this time causing a temporary network disconnect. In some operating systems, you may see the following icon on your desktop.

Figure 17-12 Network Temporarily Disconnected

If you uploaded the default configuration file you may need to change the IP address of your computer to be in the same subnet as that of the default device IP address (192.168.1.1). See your

Quick Start Guide for details on how to set up your computer’s IP address.

If the upload was not successful, click Return to go back to the Configuration screen.

317517-A Rev 00

SMT General Configuration

Part X:

SMT General Configuration

This part introduces the System Management Terminal and covers the General setup menu, WAN and dial backup setup, LAN, and Internet access.

See the WebGUI parts of this guide for background information on features configurable by WebGUI and SMT.

X

18-1

Chapter 18

Introducing the SMT

This chapter explains how to access the System Management Terminal and gives an overview of its menus.

18.1

Introduction to the SMT

The Contivity 221’s SMT (System Management Terminal) is a menu-driven interface that you can access from a terminal emulator through the console port or over a telnet connection. This chapter shows you how to access the SMT (System Management Terminal) menus via console port, how to navigate the SMT and how to configure SMT menus.

18.2

Accessing the SMT via the Console Port

Make sure you have the physical connection properly set up as described in the hardware installation chapter.

When configuring using the console port, you need a computer equipped with communications software configured to the following parameters:

♦ VT100 terminal emulation.

♦ 9600 Baud.

♦ No parity, 8 data bits, 1 stop bit, flow control set to none.

When you turn on your Contivity 221, it performs several internal tests as well as line initialization.

After the tests, the Contivity 221 asks you to press

[ENTER]

to continue, as shown next.


18-2 Introducing the SMT

Figure 18-1 Initial Screen

Copyright (c) 1994 - 2002 Nortel Networks. initialize ch =0, ethernet address: 00:a0:c5:41:51:61 initialize ch =1, ethernet address: 00:a0:c5:41:51:62

Press ENTER to continue...

18.2.2 Entering the Password

The login screen appears after you press [ENTER], prompting you to enter the password, as shown below.

For your first login, enter the default password “setup”. As you type the password, the screen displays an “X” for each character you type.

Please note that if there is no activity for longer than five minutes after you log in, your Contivity

221 will automatically log you out and display a blank screen. If you see a blank screen, press

[ENTER] to bring up the login screen again.

Figure 18-2 Password Screen

Enter Password : XXXX

18.3

Navigating the SMT Interface

The SMT is an interface that you use to configure your Contivity 221.

Several operations that you should be familiar with before you attempt to modify the configuration are listed in the table below.

Table 18-1 Main Menu Commands

OPERATION KEYSTROKES

Move down to another menu

[ENTER]

Move up to a previous menu

[ESC]

DESCRIPTION

To move forward to a submenu, type in the number of the desired submenu and press [ENTER].

Press the [ESC] key to move back to the previous menu.

317517-A Rev 00

Introducing the SMT

18-3

Table 18-1 Main Menu Commands

OPERATION KEYSTROKES DESCRIPTION

Move to a

“hidden” menu

Press [SPACE BAR] to change No to Yes then press [ENTER].

Fields beginning with “Edit” lead to hidden menus and have a default setting of No. Press [SPACE BAR] to change No to Yes, and then press [ENTER] to go to a “hidden” menu.

Move the cursor [ENTER] or

[UP]/[DOWN] arrow keys

Within a menu, press [ENTER] to move to the next field. You can also use the [UP]/[DOWN] arrow keys to move to the previous and the next field, respectively.

Entering information

Fill in, or press

[SPACE BAR], then press [ENTER] to select from choices.

You need to fill in two types of fields. The first requires you to type in the appropriate information. The second allows you to cycle through the available choices by pressing [SPACE BAR].

Required fields <? > All fields with the symbol <?> must be filled in order be able to save the new configuration.

N/A fields

Save your configuration

<N/A>

[ENTER]

Some of the fields in the SMT will show a <N/A>. This symbol refers to an option that is Not Applicable.

Save your configuration by pressing [ENTER] at the message

“Press ENTER to confirm or ESC to cancel”. Saving the data on the screen will take you, in most cases to the previous menu.

Exit the SMT Type 99, then press

[ENTER].

Type 99 at the main menu prompt and press [ENTER] to exit the

SMT interface.

After you enter the password, the SMT displays the Contivity 221 Main Menu, as shown next.

Not all models have all the features shown.



Figure 18-3 Main Menu

Contivity 221 Main Menu

Getting Started Advanced Management

2. WAN Setup 22. SNMP Configuration

4. Internet Access Setup

Advanced Applications

24. System Maintenance

26. Schedule Setup

11. Remote Node Setup

12. Static Routing Setup

15. NAT Setup

99. Exit

Enter Menu Selection Number:


Table 18-2 Main Menu Summary

1

NO. Menu Title

General Setup

FUNCTION

Use this menu to set up dynamic DNS and administrative information.

2

3

4

11

WAN Setup

LAN Setup

Internet Access Setup

Remote Node Setup

Use this menu to clone a MAC address from a computer on your LAN and configure the backup WAN dial-up connection.

Use this menu to apply LAN filters, configure LAN DHCP and TCP/IP settings.

Configure your Internet Access setup (Internet address, gateway IP address, login, etc.) with this menu.

Use this menu to configure detailed remote node settings (your ISP is also a remote node) as well as apply WAN filters.

12 Static Routing Setup

15 NAT Setup

Configure IP static routes in this menu.

Use this menu to configure Network Address Translation.

21 Filter and Firewall Setup Configure filters, activate/deactivate the firewall and view the firewall log.

22 SNMP Configuration Use this menu to configure SNMP-related parameters.

317517-A Rev 00

Introducing the SMT

18-5

Table 18-2 Main Menu Summary

NO. Menu Title

24 System Maintenance

FUNCTION

From displaying system status to uploading firmware, this menu provides comprehensive system maintenance.

26 Schedule Setup

99 Exit

Use this menu to schedule outgoing calls.

Use this menu to exit (necessary for remote configuration).



18.3.2 SMT Menus at a Glance

Figure 18-4 Getting Started and Advanced Applications SMT Menus

317517-A Rev 00

Figure 18-5 Advanced Management SMT Menus

Introducing the SMT

18-7



Figure 18-6 Schedule Setup Menu

18.4

Changing the System Password

Change the system password by following the steps shown next.

Step 1.

Enter 23 in the main menu to open Menu 23 - System Password as shown next.

Figure 18-7 Menu 23: System Password

Menu 23 - System Password

Old Password= ?

New Password= ?

Retype to confirm= ?

Enter here to CONFIRM or ESC to CANCEL:

Step 2.

Step 3.

Type your existing password and press [ENTER].

Type your new system password and press [ENTER].

Step 4.

Re-type your new system password for confirmation and press [ENTER].

Note that as you type a password, the screen displays an “X” for each character you type.

18.5

Resetting the Contivity 221

See the chapter that introduces the WebGUI for directions on resetting the Contivity 221.

317517-A Rev 00

19-1

Chapter 19

SMT Menu 1 - General Setup

Menu 1 - General Setup contains administrative and system-related information.

19.1

Introduction to General Setup

Menu 1 - General Setup contains administrative and system-related information.

19.2

Configuring General Setup

Step 1.

Step 2.

Enter 1 in the main menu to open Menu 1: General Setup.

The Menu 1 - General Setup screen appears, as shown next. Fill in the required fields.

Figure 19-1 Menu 1: General Setup

Menu 1 - General Setup

System Name= Contivity

Domain Name= www.nortelnetworks.com

First System DNS Server= From ISP

IP Address= N/A

Second System DNS Server= From ISP

Third System DNS Server= From ISP

IP Address= N/A

Edit Dynamic DNS= No

Press ENTER to Confirm or ESC to Cancel:



19-2 SMT Menu 1 – General Setup

Table 19-1 General Setup Menu Field

FIELD

System Name

Domain Name

DESCRIPTION

Choose a descriptive name for identification purposes. It is recommended you enter your computer’s “Computer name” in this field. This name can be up to 30 alphanumeric characters long.

Spaces are not allowed, but dashes “-” and underscores "_" are accepted.

EXAMPLE

Contivity 221

Enter the domain name (if you know it) here. If you leave this field blank, the ISP may assign a domain name via DHCP. You can go to menu 24.8 and type "sys domain name" to see the current domain name used by your router. nortelnetworks.com

The domain name entered by you is given priority over the ISP assigned domain name. If you want to clear this field just press

[SPACE BAR] and then [ENTER].

First System DNS

Server

Second System

DNS Server

DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa. The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it. The Contivity C221 uses a system DNS server (in the order you specify here) to resolve domain names for VPN, DDNS and the time server.

Third System DNS

Server

Press [SPACE BAR] and then [ENTER] to select an option. Select

From ISP if your ISP dynamically assigns DNS server information

(and the Contivity C221's WAN IP address). The IP Address field below displays the (read-only) DNS server IP address that the ISP assigns. If you chose From ISP, but the Contivity C221 has a fixed

WAN IP address, From ISP changes to None after you save your changes. If you select From ISP for the second or third DNS server, but the ISP does not provide a second or third IP address, From ISP changes to None after you save your changes.

Select User-Defined if you have the IP address of a DNS server.

Enter the DNS server's IP address in the field to the right. If you select User-Defined, but leave the IP address set to 0.0.0.0, User-

Defined changes to None after you save your changes. If you set a second choice to User-Defined, and enter the same IP address, the second User-Defined changes to None after you save your changes.

Select None if you do not want to configure DNS servers. If you do not configure a system DNS server, you must use IP addresses when configuring VPN, DDNS and the time server.

317517-A Rev 00

SMT Menu 1 – General Setup

19-3

Table 19-1 General Setup Menu Field

FIELD DESCRIPTION

Edit Dynamic DNS Press [SPACE BAR] and then [ENTER] to select Yes or No (default).

Select Yes to configure Menu 1.1: Configure Dynamic DNS discussed next.

EXAMPLE

No

(default)

When you have completed this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.

19.2.1 Configuring Dynamic DNS

To configure Dynamic DNS, go to Menu 1: General Setup and press [SPACE BAR] to select

Yes in the Edit Dynamic DNS field. Press [ENTER] to display Menu 1.1— Configure Dynamic

DNS (shown next). Not all models have every field shown.

Figure 19-2 Configure Dynamic DNS

Menu 1.1 - Configure Dynamic DNS

Service Provider= WWW.DynDNS.ORG

Active= Yes

DDNSType= DynamicDNS

Host1=

Host2=

Host3=

EMAIL=

USER=

Password= ********

Enable Wildcard= No

Offline= N/A


Use Server Detected IP= Yes

User Specified IP Address=No

IP Address=N/A

Press ENTER to confirm or ESC to cancel:

Follow the instructions in the next table to configure Dynamic DNS parameters.

Table 19-2 Configure Dynamic DNS Menu Fields


Service Provider This is the name of your Dynamic DNS service provider.

EXAMPLE

WWW .DynDNS.ORG

(default)


19-4 SMT Menu 1 – General Setup



Active

DDNS Type

Host1-3

EMAIL

USER

Press [SPACE BAR] to select Yes and then press [ENTER] to make dynamic DNS active.

Press [SPACE BAR] and then [ENTER] to select DynamicDNS if you have a dynamic IP address(es). Select StaticDNS if you have a static IP address(s).

Select CustomDNS to have dyns.org provide DNS service for a domain name that you already have from a source other than dyndns.org.

Enter your host name(s) in the fields provided. You can specify up to two host names separated by a comma in each field.

Enter your e-mail address.

Enter your user name.

EXAMPLE

Yes

DynamicDNS

(default) me.dyndns.org

Password Enter the password assigned to you.

Enable Wildcard Your Contivity 221 supports DYNDNS Wildcard. Press [SPACE

BAR] and then [ENTER] to select Yes or No This field is N/A when you choose DDNS client as your service provider.

Offline This field is only available when CustomDNS is selected in the

DDNS Type field. Press [SPACE BAR] and then [ENTER] to select Yes. When Yes is selected, http://www.dyndns.org/ traffic is redirected to a URL that you have previously specified (see www.dyndns.org

for details). mail@mailserver

No

Yes


You can select Yes in either the Use Server Detected IP field (recommended) or the User Specified IP

Addr field, but not both.

With the Use Server Detected IP and User Specified IP Addr fields both set to No, the DDNS server automatically updates the IP address of the host name(s) with the Contivity 221’s WAN IP address.

DDNS does not work with a private IP address. When both fields are set to No, the Contivity 221 must have a public WAN IP address in order for DDNS to work.

317517-A Rev 00

SMT Menu 1 – General Setup

19-5



Use Server

Detected IP

Press [SPACE BAR] to select Yes and then press [ENTER] to have the DDNS server automatically update the IP address of the host name(s) with the public IP address that the Contivity

221 uses or is behind.

You can set this field to Yes whether the IP address is public or private, static or dynamic.

User Specified IP

Address

Press [SPACE BAR] to select Yes and then press [ENTER] to update the IP address of the host name(s) to the IP address specified below.

Only select Yes if the Contivity 221 uses or is behind a static public IP address.

IP Address

Enter the static public IP address if you select Yes in the User

Specified IP Addr field.

EXAMPLE

Yes

No

N/A


The IP address updates when you reconfigure menu 1 or perform DHCP client renewal.


WAN and Dial Backup Setup 20-1

Chapter 20

WAN and Dial Backup Setup

This chapter describes how to configure the WAN using menu 2 and dial-backup using menus 2.1 and 11.1.

20.1

Introduction to WAN and Dial Backup Setup

This chapter explains how to configure settings for your WAN port and how to configure the

Contivity 221 for a dial backup connection.

20.2

WAN Setup

From the main menu, enter 2 to open menu 2.

Figure 20-1 MAC Address Cloning in WAN Setup

Menu 2 - WAN Setup

MAC Address:

Assigned By= Factory default

IP Address= N/A

Dial-Backup:

Active= No

Phone Number=

Port Speed= 115200

AT Command String:

Init= at&fs0=0

Edit Advanced Setup= No


Table 20-1 MAC Address Cloning in WAN Setup


MAC Address

EXAMPLE


20-2 WAN and Dial Backup Setup

Table 20-1 MAC Address Cloning in WAN Setup


Assigned By Press [SPACE BAR] and then [ENTER] to choose one of two methods to assign a MAC Address. Choose Factory Default to select the factory assigned default MAC Address. Choose IP address attached on LAN to use the MAC Address of that workstation whose IP you give in the following field.

IP Address This field is applicable only if you choose the IP address attached on

LAN method in the Assigned By field. Enter the IP address of the computer on the LAN whose MAC you are cloning.

EXAMPLE

IP address attached on

LAN

192.168.1.35


20.3

Dial Backup

The Dial Backup port or CON/AUX port can be used in reserve, as a traditional dial-up connection should the broadband connection to the WAN port fail. This feature is not available on all models.

To set up the auxiliary port (Dial Backup or CON/AUX) for use in the event that the regular WAN connection is dropped, first make sure you have set up the switch and port connection (see the

Hardware Installation chapter), then configure

1.

2.

3.

Menu 2 - WAN Setup,

Menu 2.1 - Advanced WAN Setup and

Menu 11.1 - Remote Node Profile (Backup ISP) as shown next

Refer also to the traffic redirect section for information on an alternate backup WAN connection.

20.4

Configuring Dial Backup in Menu 2

From the main menu, enter 2 to open menu 2.

317517-A Rev 00


Figure 20-2 Menu 2: Dial Backup Setup

Menu 2 - WAN Setup

MAC Address:

Assigned By= Factory default

IP Address= N/A

Dial-Backup:

Active= No

Phone Number=

Port Speed= 115200

AT Command String:

Init= at&fs0=0

Edit Advanced Setup= No



Table 20-2 Menu 2: Dial Backup Setup


Dial-Backup:

Active Use this field to turn the dial-backup feature on (Yes) or off (No).

Phone

Number

Enter the telephone number assigned to your line by your telephone company. This field only accepts digits; do not include dashes and spaces.

Port Speed Press [SPACE BAR] and then press [ENTER] to select the speed of the connection between the Dial Backup port and the external device.

Available speeds are:

9600, 19200, 38400, 57600, 115200 or 230400 bps.

AT Command

String:

Init Enter the AT command string to initialize the WAN device. Consult the manual of your WAN device connected to your Dial Backup port for specific AT commands.

EXAMPLE

No

1234567

115200

at&fs0=0



Table 20-2 Menu 2: Dial Backup Setup

FIELD

Edit Advanced

Setup

DESCRIPTION

To edit the advanced setup for the Dial Backup port, move the cursor to this field; press the [SPACE BAR] to select Yes and then press

[ENTER] to go to Menu 2.1: Advanced Setup.

EXAMPLE

Yes


20.5

Advanced WAN Setup

Consult the manual of your WAN device connected to your Dial Backup port for specific AT commands.

To edit the advanced setup for the Dial Backup port, move the cursor to the Edit Advanced Setup field in

Menu 2 - WAN Setup, press the [SPACE BAR] to select Yes and then press [ENTER].

Figure 20-3 Menu 2.1 Advanced WAN Setup

Menu 2.1 - Advanced WAN Setup

AT Command Strings: Call Control:

Dial= atdt Dial Timeout(sec)= 60

Drop= ~~+++~~ath Retry Count= 0

Answer= ata Retry Interval(sec)= N/A

Drop Timeout(sec)= 20

Drop DTR When Hang Up= Yes Call Back Delay(sec)= 15

AT Response Strings:

CLID= NMBR =

Called Id=

Speed= CONNECT

The following table describes fields in this menu.

317517-A Rev 00


Table 20-3 Advanced WAN Port Setup: AT Commands Fields


AT Command

Strings:

Dial Enter the AT Command string to make a call.

Drop Enter the AT Command string to drop a call. “~” represents a one second wait, e.g., “~~~+++~~ath” can be used if your modem has a slow response time.

DEFAULT

atdt

+++ath

Answer Enter the AT Command string to answer a call.

Drop DTR When

Hang Up

Press the [SPACE BAR] to choose either

Yes or No. When

Yes is selected (the default), the DTR (Data Terminal Ready) signal is dropped after the “AT Command String: Drop” is sent out. ata

Yes

AT Response String:

CLID (Calling Line

Identification)

Enter the keyword that precedes the CLID (Calling Line Identification) in the AT response string. This lets the Contivity 221 capture the

CLID in the AT response string that comes from the WAN device.

CLID is required for CLID authentication.

NMBR =

Called Id Enter the keyword preceding the dialed number. TO

Speed Enter the keyword preceding the connection speed. CONNECT

Table 20-4 Advanced WAN Port Setup: Call Control Parameters

FIELD

Call Control

DESCRIPTION

Dial Timeout (sec) Enter a number of seconds for the Contivity 221 to keep trying to set up an outgoing call before timing out (stopping). The Contivity

221 times out and stops if it cannot set up an outgoing call within the timeout value.

Retry Count Enter a number of times for the Contivity 221 to retry a busy or noanswer phone number before blacklisting the number.

DEFAULT

60 seconds

0 to disable the blacklist control



Table 20-4 Advanced WAN Port Setup: Call Control Parameters


Retry Interval

(sec)

Enter a number of seconds for the Contivity 221 to wait before trying another call after a call has failed. This applies before a phone number is blacklisted.

Drop Timeout

(sec)

Enter a number of seconds for the Contivity 221 to wait before dropping the DTR signal if it does not receive a positive disconnect confirmation.

Call Back Delay

(sec)

Enter a number of seconds for the Contivity 221 to wait between dropping a callback request call and dialing the co-responding callback call.

DEFAULT

20 seconds

15 seconds

20.6

Remote Node Profile (Backup ISP)

Enter 2 in Menu 11 Remote Node Setup to open Menu 11.1 Remote Node Profile (Backup ISP)

(shown below) and configure the setup for your Dial Backup port connection. This feature is not available on all models.

Figure 20-4 Menu 11.1 Remote Node Profile (Backup ISP)

Menu 11.1 - Remote Node Profile (Backup ISP)

Rem Node Name= ? Edit PPP Options= No

Active= Yes Rem IP Addr= 0.0.0.0

Edit IP= No

Outgoing: Edit Script Options= No

My Login=

My Password= ******** Telco Option:

Authen= CHAP/PAP Allocated Budget(min)= 0

Pri Phone #= ? Period(hr)= 0

Sec Phone #= Nailed-Up Connection= No

Session Options:

Edit Filter Sets= No

Idle Timeout(sec)= 100



317517-A Rev 00


Table 20-5 Fields in Menu 11.1 Remote Node Profile (Backup ISP)


Rem Node

Name

Active

Enter a descriptive name for the remote node. This field can be up to eight characters.

Press [SPACE BAR] and then [ENTER] to select Yes to enable the remote node or No to disable the remote node.

Outgoing

My Login Enter the login name assigned by your ISP for this remote node.

My Password Enter the password assigned by your ISP for this remote node.

Authen This field sets the authentication protocol used for outgoing calls.

Options for this field are:

CHAP/PAP - Your Contivity 221 will accept either CHAP or PAP when requested by this remote node.

CHAP - accept CHAP only.

PAP - accept PAP only.

Pri Phone #

Sec Phone #

Enter the first (primary) phone number from the ISP for this remote node. If the Primary Phone number is busy or does not answer, your

Contivity 221 dials the Secondary Phone number if available. Some areas require dialing the pound sign # before the phone number for local calls. Include a # symbol at the beginning of the phone numbers as required.

EXAMPLE

LAoffice

Yes

jim

*****

CHAP/PAP

Edit PPP

Options

Rem IP Addr

Edit IP

Edit Script

Options

Telco Option

Move the cursor to this field and use the space bar to select [Yes] and press [Enter] to edit the PPP options for this remote node. This brings you to Menu 11.2 - Remote Node PPP Options (see section 20.7).

Leave the field set to 0.0.0.0 (default) if the remote gateway has a dynamic IP address. Enter the remote gateway’s IP address here if it is static.

This field leads to a “hidden” menu. Press [SPACE BAR] to select Yes and press [ENTER] to go to Menu 11.3 - Remote Node Network

Layer Options. See section 20.8 for more information.

Press [SPACE BAR] to select Yes and press [ENTER] to edit the AT script for the dial backup remote node (Menu 11.4 - Remote Node

Script). See section 20.9 for more information.

No

(default)

0.0.0.0

(default)

No

(default)

No

(default)



Table 20-5 Fields in Menu 11.1 Remote Node Profile (Backup ISP)


Allocated

Budget

Enter the maximum number of minutes that this remote node may be called within the time period configured in the Period field. The default for this field is 0 meaning there is no budget control and no time limit for accessing this remote node.

Period(hr) Enter the time period (in hours) for how often the budget should be reset. For example, to allow calls to this remote node for a maximum of 10 minutes every hour, set the Allocated Budget to 10 (minutes) and the Period to 1 (hour).

Nailed-Up

Connection

Press [SPACE BAR] to select Yes to set this connection to always be on, regardless of whether or not there is any traffic. Select No to have this connection act as a dial-up connection.

Session

Options

Edit Filter sets This field leads to another “hidden” menu. Use [SPACE BAR] to select

Yes and press [ENTER] to open menu 11.5 to edit the filter sets. See

section 20.10 for more details.

EXAMPLE

0

(default)

0

(default)

No

(default)

No

(default)

Idle Timeout Enter the number of seconds of idle time (when there is no traffic from the Contivity 221 to the remote node) that can elapse before the

Contivity 221 automatically disconnects the PPP connection. This option only applies when the Contivity 221 initiates the call.

100 seconds

(default)

Once you have configured this menu, press [ENTER] at the message “Press ENTER to Confirm...” to save your configuration, or press [ESC] at any time to cancel.

20.7

Editing PPP Options

The Contivity 221’s dial back-up feature uses PPP. To edit the remote node PPP Options, move the cursor to the [Edit PPP Options] field in Menu 11.1 - Remote Node Profile, and use the space bar to select [Yes]. Press [Enter] to open Menu 11.2 as shown next.

317517-A Rev 00


Figure 20-5 Menu 11.2: Remote Node PPP Options

Menu 11.2 - Remote Node PPP Options

Encapsulation= Standard PPP

Compression= No


Press Space Bar to Toggle.

This table describes the Remote Node PPP Options Menu, and contains instructions on how to configure the PPP options fields.

Table 20-6 Remote Node PPP Options Menu Fields


Encapsulation

Compression

Press [SPACE BAR] and then [ENTER] to select CISCO PPP if your Dial Backup WAN device uses Cisco PPP encapsulation, otherwise select Standard PPP.

Press [SPACE BAR] and then [ENTER] to select Yes to enable or

No to disable Stac compression.

EXAMPLE

Standard PPP

(default)

No

(default)



20.8

Editing TCP/IP Options

Move the cursor to the Edit IP field in menu 11.1, then press [SPACE BAR] to select Yes. Press

[ENTER] to open Menu 11.3 - Network Layer Options.

Figure 20-6 Menu 11.3: Remote Node Network Layer Options

Menu 11.3 - Remote Node Network Layer Options

IP Address Assignment= Dynamic

Rem IP Addr= 0.0.0.0

Rem Subnet Mask= 0.0.0.0

My WAN Addr= 0.0.0.0

Network Address Translation= None

Metric= 15

Private= No

RIP Direction= Both

Version= RIP-2B

Multicast= None



Table 20-7 Remote Node Network Layer Options Menu Fields


IP Address

Assignment

Rem IP

Address

Rem Subnet

Mask

If your ISP did not assign you an explicit IP address, press [SPACE

BAR] and then [ENTER] to select Dynamic; otherwise select Static and enter the IP address & subnet mask in the following fields.

Leave this field set to 0.0.0.0 to have the ISP or other remote router dynamically (automatically) send its IP address if you do not know it.

Enter the remote gateway’s IP address here if you know it (static).

Leave this field set to 0.0.0.0 to have the ISP or other remote router dynamically send its subnet mask if you do not know it. Enter the remote gateway’s subnet mask here if you know it (static).

EXAMPLE

Dynamic

(default)

0.0.0.0

(default)

0.0.0.0

(default)

317517-A Rev 00




My WAN

Addr

Network

Address

Translation

Leave the field set to 0.0.0.0 to have the ISP or other remote router dynamically (automatically) assign your WAN IP address if you do not know it. Enter your WAN IP address here if you know it (static).

This is the address assigned to your local Contivity 221, not the remote router.


Press [SPACE BAR] and then [ENTER] to select either Full Feature,

None or SUA Only.


Choose SUA Only if you have a single public IP address. SUA (Single

User Account) is a subset of NAT that supports two types of mapping:

Many-to-One and Server.

Choose Full Feature if you have multiple public IP addresses. Full

Feature mapping types include: One-to-One, Many-to-One (SUA/PAT),

Many-to-Many Overload, Many- One-to-One and Server. When you select Full Feature you must configure at least one address mapping set!

See the Network Address Translation (NAT) chapter for a full discussion on this feature.

Metric

Private

Enter a number from 1 to 15 to set this route’s priority among the

Contivity 221’s routes. The smaller the number, the higher priority the route has.

This parameter determines if the Contivity 221 will include the route to this remote node in its RIP broadcasts. If set to Yes, this route is kept private and not included in RIP broadcasts. If No, the route to this remote node will be propagated to other hosts through RIP broadcasts.

RIP

Direction

Press [SPACE BAR] and then [ENTER] to select the RIP direction from

Both/ None/In Only/Out Only and None.

Version Press [SPACE BAR] and then [ENTER] to select the RIP version from

RIP-1/RIP-2B/RIP-2M.

EXAMPLE

0.0.0.0

(default)

None

(default)

15

(default)

No

(default)

Both

(default)

RIP-1




FIELD

Multicast

DESCRIPTION

IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group. The Contivity 221 supports both IGMP version 1 (IGMP-v1) and version 2 (IGMP-v2).

Press the [SPACE BAR] to enable IP Multicasting or select None to disable it. See the LAN Setup chapter for more information on this feature.

EXAMPLE

None

(default)

Once you have completed filling in Menu 11.3 Remote Node Network Layer Options, press [ENTER] at the message “Press ENTER to Confirm...” to save your configuration and return to menu 11, or press

[ESC] at any time to cancel.

20.9

Editing Login Script

For some remote gateways, text login is required before PPP negotiation is started. The Contivity

221 provides a script facility for this purpose. The script has six programmable sets; each set is composed of an ‘Expect’ string and a ‘Send’ string. After matching a message from the server to the ‘Expect’ field, the Contivity 221 returns the set’s ‘Send’ string to the server.

For instance, a typical login sequence starts with the server printing a banner, a login prompt for you to enter the user name and a password prompt to enter the password:

Welcome to Acme, Inc.

Password:

To handle the first prompt, you specify “ogin: ” as the ‘Expect’ string and “myLogin” as the

‘Send’ string in set 1. The reason for leaving out the leading “L” is to avoid having to know exactly whether it is upper or lower case. Similarly, you specify “word: ” as the ‘Expect’ string and your password as the ‘Send’ string for the second prompt in set 2.

You can use two variables, $USERNAME and $PASSWORD (all UPPER case), to represent the actual user name and password in the script, so they will not show in the clear. They are replaced with the outgoing login name and password in the remote node when the Contivity 221 sees them in a ‘Send’ string. Please note that both variables must been entered exactly as shown. No other characters may appear before or after, either, i.e., they must be used alone in response to login and password prompts.

Please note that the ordering of the sets is significant, i.e., starting from set 1, the Contivity 221 will wait until the ‘Expect’ string is matched before it proceeds to set 2, and so on for the rest of the script. When both the ‘Expect’ and the ‘Send’ fields of the current set are empty, the Contivity 221 will terminate the script processing and start PPP negotiation. This implies two things: first, the sets

317517-A Rev 00

WAN and Dial Backup Setup 20-13 must be contiguous; the sets after an empty one are ignored. Second, the last set should match the final message sent by the server. For instance, if the server prints: after you enter the password, then you should create a third set to match the final “PPP...” but without a “Send” string. Otherwise, the Contivity 221 will start PPP prematurely right after sending your password to the server.

If there are errors in the script and it gets stuck at a set for longer than the “Dial Timeout” in menu

2 (default 60 seconds), the Contivity 221 will timeout and drop the line. To debug a script, go to

Menu 24.4 to initiate a manual call and watch the trace display to see if the sequence of messages

Menu 11.4 - Remote Node Script

Active= No

Set 1: Set 5:

Expect= Expect=

Send= Send=

Set 2: Set 6:

Expect= Expect=

Send= Send=

Set 3:

Expect=

Send=

Set 4:

Expect=

Send=

Enter here to CONFIRM or ESC to CANCEL: and prompts from the server differs from what you expect.

Figure 20-7 Menu 11.4: Remote Node Setup Script


Table 20-8 Menu 11.4: Remote Node Script Menu Fields

FIELD

Active

Set 1-6:

Expect

DESCRIPTION

Press [SPACE BAR] and then [ENTER] to select either Yes to enable the AT strings or No to disable them.

Enter an Expect string to match. After matching the Expect string, the

Contivity 221 returns the string in the Send field.

EXAMPLE

No

(default)



Table 20-8 Menu 11.4: Remote Node Script Menu Fields

Set 1-6:

Send

Enter a string to send out after the Expect string is matched. 0.0.0.0

20.10

Remote Node Filter

Move the cursor to the field Edit Filter Sets in menu 11.1, and then press [SPACE BAR] to set the value to Yes. Press [ENTER] to open

Menu 11.5 - Remote Node Filter

.

Use menu 11.5 to specify the filter set(s) to apply to the incoming and outgoing traffic between this remote node and the Contivity 221 to prevent certain packets from triggering calls. You can specify up to four filter sets separated by commas, for example, 1, 5, 9, 12, in each filter field. Note that spaces are accepted in this field. Please refer to the Filters chapter for more information on defining the filters.

Figure 20-8 Menu 11.5: Dial Backup Remote Node Filter

Menu 11.5 - Remote Node Filter

Input Filter Sets:

protocol filters=

device filters=

Output Filter Sets:

protocol filters=

device filters=

Call Filter Sets:

protocol filters=

device filters=


317517-A Rev 00

21-1

Chapter 21

LAN Setup

This chapter describes how to configure the LAN using Menu 3: LAN Setup.

21.1

Introduction to LAN Setup

This chapter describes how to configure the Contivity 221 for LAN connections.

21.2

Accessing the LAN Menus

From the main menu, enter 3 to open Menu 3 – LAN Setup.

Figure 21-1 Menu 3: LAN Setup

Menu 3 - LAN Setup

1. LAN Port Filter Setup

2. TCP/IP and DHCP Setup


21.3

LAN Port Filter Setup

This menu allows you to specify the filter sets that you wish to apply to the LAN traffic. You seldom need to filter the LAN traffic, however, the filter sets may be useful to block certain packets, reduce traffic and prevent security breaches.


21-2 LAN Setup

Figure 21-2 Menu 3.1: LAN Port Filter Setup

Menu 3.1 – LAN Port Filter Setup

Input Filter Sets:

protocol filters=

device filters=

Output Filter Sets:

protocol filters=

device filters=


TCP/IP and DHCP Ethernet Setup Menu

From the main menu, enter 3 to open Menu 3 - LAN Setup to configure TCP/IP (RFC 1155) and

DHCP Ethernet setup.

Figure 21-3 Menu 3: TCP/IP and DHCP Setup

Menu 3 - LAN Setup

1. LAN Port Filter Setup

2. TCP/IP and DHCP Setup


From menu 3, select the submenu option TCP/IP and DHCP Setup and press [ENTER]. The screen now displays

Menu 3.2: TCP/IP and DHCP Ethernet Setup

, as shown next.

317517-A Rev 00

LAN Setup 21-3

Figure 21-4 Menu 3.2: TCP/IP and DHCP Ethernet Setup

Menu 3.2 - TCP/IP and DHCP Ethernet Setup

DHCP= Server TCP/IP Setup:

Client IP Pool:

Starting Address= 192.168.1.33 IP Address= 192.168.1.1

Size of Client IP Pool= 32 IP Subnet Mask= 255.255.255.0

First DNS Server= From ISP RIP Direction= Both

IP Address= N/A Version= RIP-1

Second DNS Server= From ISP Multicast= None

IP Address= N/A Edit IP Alias= No

Third DNS Server= From ISP

IP Address= N/A



Follow the instructions in the next table on how to configure the DHCP fields.

Table 21-1 DHCP Ethernet Setup Menu Fields


First address in the IP Pool

Size of the IP

Pool

IP addresses of the DNS servers

EXAMPLE

Server

If set to Server, your Contivity 221 will act as a DHCP server.

If set to None, the DHCP server will be disabled.

When set to Server, the following items need to be set:

Configuration:

Client IP Pool

Starting Address

This field specifies the first of the contiguous addresses in the IP address pool.

Size of Client IP

Pool

This field specifies the size, or count of the IP address pool.

192.168.1.33

32


21-4 LAN Setup

Table 21-1 DHCP Ethernet Setup Menu Fields


The Contivity C221 passes a DNS (Domain Name System) server IP address (in the order you specify here) to the DHCP clients.

Select From ISP if your ISP dynamically assigns DNS server information (and the Contivity C221's WAN IP address). The IP

Address field below displays the (read-only) DNS server IP address that the ISP assigns. If you chose From ISP, but the Contivity C221 has a fixed WAN IP address, From ISP changes to None after you save your changes. If you chose From ISP for the second or third DNS server, but the ISP does not provide a second or third IP address,

From ISP changes to None after save your changes.

Select User-Defined if you have the IP address of a DNS server.

Enter the DNS server's IP address in the IP Address field below. If you chose User-Defined, but leave the IP address set to 0.0.0.0,

User-Defined changes to None after you save your changes. If you

First DNS Server

Second DNS Server

Third DNS Server set a second choice to User-Defined, and enter the same IP address, the second User-Defined changes to None after you save your changes.

EXAMPLE

Select DNS Relay to have the Contivity C221 act as a DNS proxy. The

Contivity C221's LAN IP address displays in the IP Address field below (read-only). The Contivity C221 tells the DHCP clients on the

LAN that the Contivity C221 itself is the DNS server. When a computer on the LAN sends a DNS query to the Contivity C221, the Contivity

C221 forwards the query to the Contivity C221's system DNS server

(configured in the SYSTEM General screen) and relays the response back to the computer. You can only select DNS Relay for one of the three servers; if you select DNS Relay for a second or third DNS server, that choice changes to None after you save your changes.

Select None if you do not want to configure DNS servers. If you do not configure a DNS server, you must know the IP address of a machine in order to access it

Use the instructions in the following table to configure TCP/IP parameters for the LAN port.

Table 21-2 LAN TCP/IP Setup Menu Fields

FIELD DESCRIPTION EXAMPLE

TCP/IP Setup:

317517-A Rev 00

LAN Setup 21-5

Table 21-2 LAN TCP/IP Setup Menu Fields


IP Address Enter the IP address of your Contivity 221 in dotted decimal notation

IP Subnet Mask Your Contivity 221 will automatically calculate the subnet mask based on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the

Contivity 221.

RIP Direction Press [SPACE BAR] and then [ENTER] to select the RIP direction.

Options are: Both, In Only, Out Only or None.

EXAMPLE

192.168.1.1

(default)

255.255.255.0

Version Press [SPACE BAR] and then [ENTER] to select the RIP version.

Options are:

RIP-1, RIP-2B or RIP-2M.

Multicast IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group. The

Contivity 221 supports both IGMP version 1 (IGMP-v1) and version 2 (IGMP-v2). Press [SPACE BAR] and then [ENTER] to enable IP Multicasting or select None (default) to disable it.

Both

(default)

RIP-1

(default)

None

Edit IP Alias The Contivity 221 supports three logical LAN interfaces via its single physical Ethernet interface with the Contivity 221 itself as the gateway for each LAN network. Press [SPACE BAR] to select

Yes and then press [ENTER] to display menu 3.2.1

Yes

When you have completed this menu, press [ENTER] at the prompt [Press ENTER to Confirm…] to save your configuration, or press [ESC] at any time to cancel.

You must use menu 3.2 to configure the first network. Move the cursor to the Edit IP Alias field, press [SPACE BAR] to choose Yes and press [ENTER] to configure the second and third network.

Press [ENTER] to open Menu 3.2.1 - IP Alias Setup, as shown next.


21-6 LAN Setup

Figure 21-5 Menu 3.2.1: IP Alias Setup

Menu 3.2.1 - IP Alias Setup

IP Alias 1= No

IP Address= N/A

IP Subnet Mask= N/A

RIP Direction= N/A

Version= N/A

Incoming protocol filters= N/A

Outgoing protocol filters= N/A

IP Alias 2= No

IP Address= N/A

IP Subnet Mask= N/A

RIP Direction= N/A

Version= N/A

Incoming protocol filters= N/A

Outgoing protocol filters= N/A



Use the instructions in the following table to configure IP Alias parameters.

Table 21-3 IP Alias Setup Menu Fields


IP Alias

IP Address

Choose Yes to configure the LAN network for the Contivity 221.

Enter the IP address of your Contivity 221 in dotted decimal notation.

IP Subnet Mask Your Contivity 221 will automatically calculate the subnet mask based on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the

Contivity 221.

RIP Direction Press [SPACE BAR] and then [ENTER] to select the RIP direction. Options are

Both, In Only, Out Only or None.

Version Press [SPACE BAR] and then [ENTER] to select the RIP version.

Options are

RIP-1, RIP-2B or RIP-2M.

Incoming

Protocol Filters

Enter the filter set(s) you wish to apply to the incoming traffic between this node and the Contivity 221.

EXAMPLE

Yes

192.168.1.1

255.255.255.0

None

RIP-1

1

317517-A Rev 00

LAN Setup 21-7

Table 21-3 IP Alias Setup Menu Fields

FIELD

Outgoing

Protocol Filters

DESCRIPTION

Enter the filter set(s) you wish to apply to the outgoing traffic between this node and the Contivity 221.

EXAMPLE

2

When you have completed this menu, press [ENTER] at the prompt [Press ENTER to Confirm…] to save your configuration, or press [ESC] at any time to cancel.


22-1

Chapter 22

Internet Access

This chapter shows you how to configure your Contivity 221 for Internet access.

22.1

Introduction to Internet Access Setup

Use information from your ISP along with the instructions in this chapter to set up your Contivity

221 to access the Internet. There are three different menu 4 screens depending on whether you chose Ethernet, PPTP or PPPoE Encapsulation. Contact your ISP to determine what encapsulation type you should use.

22.2

Ethernet Encapsulation

If you choose Ethernet in menu 4 you will see the next screen.

Figure 22-1 Menu 4: Internet Access Setup (Ethernet)

Menu 4 - Internet Access Setup

ISP's Name= ChangeMe

Encapsulation= Ethernet

Service Type= Standard

My Login= N/A

My Password= N/A

Retype to Confirm= N/A

Login Server IP= N/A


IP Address= N/A

IP Subnet Mask= N/A

Gateway IP Address= N/A

Network Address Translation= SUA Only



22-2 Internet Access


Table 22-1 Menu 4: Internet Access Setup Menu Fields


ISP’s Name

Encapsulation

Enter the name of your Internet Service Provider, e.g., myISP. This information is for identification purposes only.

Press [SPACE BAR] and then press [ENTER] to choose Ethernet. The encapsulation method influences your choices for the IP Address field.

Service Type Press [SPACE BAR] and then [ENTER] to select Standard, RR-Toshiba

(RoadRunner Toshiba authentication method), RR-Manager (RoadRunner

Manager authentication method) or RR-Telstra. Choose a RoadRunner flavor if your ISP is Time Warner's RoadRunner; otherwise choose Standard.

Note: DSL users must choose the Standard option only. The My Login, My Password and Login Server fields are not applicable in this case.

My Login Enter the login name given to you by your ISP.

My Password Enter the password associated with the login name above.

Retype to Confirm Enter the password again to make sure that you have entered it correctly.

Login Server The Contivity 221 will find the RoadRunner Server IP if this field is left blank. If it does not, then you must enter the authentication server IP address.

IP Address

Assignment

If your ISP did not assign you a fixed IP address, press [SPACE BAR] and then

[ENTER] to select Dynamic, otherwise select Static and enter the IP address and subnet mask in the following fields.

IP Address Enter the (fixed) IP address assigned to you by your ISP (static IP address

Assignment is selected in the previous field).

IP Subnet Mask Enter the subnet mask associated with your static IP.

Gateway IP Address Enter the gateway IP address associated with your static IP.

317517-A Rev 00

Internet Access 22-3

Table 22-1 Menu 4: Internet Access Setup Menu Fields


Network Address

Translation



Choose SUA Only if you have a single public IP address. SUA (Single User

Account) is a subset of NAT that supports two types of mapping: Many-to-One and Server.

Choose Full Feature if you have multiple public IP addresses. Full Feature mapping types include: One-to-One, Many-to-One (SUA/PAT), Many-to-Many

Overload, Many- One-to-One and Server. When you select Full Feature you must configure at least one address mapping set!

Please see the NAT chapter for a more detailed discussion on the Network

Address Translation feature.


22.3

Configuring the PPTP Client

The Contivity 221 supports only one PPTP server connection at any given time.

To configure a PPTP client, you must configure the My Login and Password fields for a PPP connection and the PPTP parameters for a PPTP connection.

After configuring My Login and Password for PPP connection, press [SPACE BAR] and then

[ENTER] in the Encapsulation field in Menu 4 -Internet Access Setup to choose PPTP as your encapsulation option. This brings up the following screen.


22-4 Internet Access

Figure 22-2 Internet Access Setup (PPTP)



Encapsulation= PPTP

Service Type= N/A

My Login= username

My Password= ******

Retype to Confirm= ******

Idle Timeout= 100


IP Address= N/A

IP Subnet Mask= N/A

Gateway IP Address=N/A



The following table contains instructions about the new fields when you choose PPTP in the

Encapsulation field in menu 4.

Table 22-2 New Fields in Menu 4 (PPTP) Screen


Encapsulation Press [SPACE BAR] and then press [ENTER] to choose PPTP. The encapsulation method influences your choices for the IP Address field.

Idle Timeout This value specifies the time, in seconds, that elapses before the

Contivity 221 automatically disconnects from the PPTP server.

PPTP

100

(default)

22.4

Configuring the PPPoE Client

If you enable PPPoE in menu 4, you will see the next screen. For more information on PPPoE, please see the Appendix.

317517-A Rev 00

Internet Access 22-5

Figure 22-3 Internet Access Setup (PPPoE)



Service Type= N/A

My Login=

My Password= ********

Retype to Confirm= ******

Idle Timeout= 100


IP Address= N/A

IP Subnet Mask= N/A


Network Address Translation= Full Feature


Table 22-3 New Fields in Menu 4 (PPPoE) screen


Encapsulation Press [SPACE BAR] and then press [ENTER] to choose PPPoE.

The encapsulation method influences your choices in the IP

Address field.

EXAMPLE

PPPoE

Idle Timeout This value specifies the time in seconds that elapses before the

Contivity 221 automatically disconnects from the PPPoE server.

100

(default)

If you need a PPPoE service name to identify and reach the PPPoE server, please go to menu 11 and enter the PPPoE service name provided to you in the Service Name field.

22.5

Basic Setup Complete

Well done! You have successfully connected, installed and set up your Contivity 221 to operate on your network as well as access the Internet.

When the firewall is activated, the default policy allows all communications to the

Internet that originate from the LAN, and blocks all traffic to the LAN that originates from the Internet.

You may deactivate the firewall in menu 21.2 or via the Contivity 221 embedded WebGUI. You may also define additional firewall rules or modify existing ones but please exercise extreme caution in doing so. See the firewall chapters for more information on the firewall.


SMT Advanced Applications

Part XI:

SMT Advanced Applications

This part covers setting up remote nodes, IP static routes and Network Address Translation. It also covers the SMT firewall menu, filters and SNMP.


XI

23-1

Chapter 23

Remote Node Setup

This chapter shows you how to configure a remote node.

23.1

Introduction to Remote Node Setup

A remote node is required for placing calls to a remote gateway. A remote node represents both the remote gateway and the network behind it across a WAN connection. Note that when you use menu 4 to set up Internet access, you are actually configuring a remote node. The following describes how to configure Menu 11.1 Remote Node Profile, Menu 11.3 - Remote Node

Network Layer Options and Menu 11.5 - Remote Node Filter.

23.2

Remote Node Setup

From the main menu, select menu option 11 to open Menu 11 Remote Node Setup (shown below).

Then enter 1 to open Menu 11.1 Remote Node Profile and configure the setup for your regular

ISP. Enter 2 to open Menu 11.1 Remote Node Profile (Backup ISP) and configure the setup for your Dial Backup port connection (see the chapter on WAN).


23-2 Remote Node Setup

Figure 23-1 Menu 11 Remote Node Setup

Menu 11 - Remote Node Setup

1. ChangeMe (ISP, SUA)

2. -GUI (BACKUP_ISP, SUA)

Enter Node # to Edit:

23.3

Remote Node Profile Setup

The following explains how to configure the remote node profile menu.

There are two variations of menu 11.1 depending on whether you choose Ethernet

Encapsulation or PPPoE Encapsulation. You must choose the Ethernet option when the

WAN port is used as a regular Ethernet. The first menu 11.1 screen you see is for Ethernet encapsulation shown next.

317517-A Rev 00

Remote Node Setup 23-3

Figure 23-2 Menu 11.1: Remote Node Profile for Ethernet Encapsulation

Menu 11.1 - Remote Node Profile

Rem Node Name= ChangeMe Route= IP

Active= Yes

Encapsulation= Ethernet Edit IP= No

Service Type= Standard Session Options:

Service Name= N/A Edit Filter Sets= No

Outgoing:

My Login= N/A

My Password= N/A Edit Traffic Redirect= No


Server IP= N/A



Table 23-1 Fields in Menu 11.1

FIELD

Rem Node

Name

Active

Encapsulation

Service Type

DESCRIPTION

Enter a descriptive name for the remote node. This field can be up to eight characters.

Press [SPACE BAR] and then [ENTER] to select Yes (activate remote node) or No (deactivate remote node).

Ethernet is the default encapsulation. Press [SPACE BAR] and then

[ENTER] to change to PPPoE or PPTP encapsulation.

Press [SPACE BAR] and then [ENTER] to select from Standard,

RR-Toshiba (RoadRunner Toshiba authentication method) or RR-

Manager (RoadRunner Manager authentication method). Choose one of the RoadRunner methods if your ISP is Time Warner's

RoadRunner; otherwise choose Standard.

Service Name

Outgoing

My Login

If you are using PPPoE encapsulation, then type the name of your

PPPoE service here. Only valid with PPPoE encapsulation.

This field is applicable for PPPoE encapsulation only. Enter the login name assigned by your ISP when the Contivity 221 calls this remote node. Some ISPs append this field to the Service Name field above (e.g., jim@poellc) to access the PPPoE server.

EXAMPLE

LAoffice

Yes

Ethernet

Standard

poellc jim



Table 23-1 Fields in Menu 11.1


My Password Enter the password assigned by your ISP when the Contivity 221 calls this remote node. Valid for PPPoE encapsulation only.

EXAMPLE

*****

Route

Edit IP

Retype to

Confirm

Type your password again to make sure that you have entered it correctly.

Server IP This field is valid only when RoadRunner is selected in the Service

Type field. The Contivity 221 will find the RoadRunner Server IP automatically if this field is left blank. If it does not, then you must enter the authentication server IP address here.

This field refers to the protocol that will be routed by your Contivity

221.

This field leads to a “hidden” menu. Press [SPACE BAR] to select

Yes and press [ENTER] to go to Menu 11.3 - Remote Node

Network Layer Options.

*****

IP

No

(default)

Session Options

Edit Filter sets

This field leads to another “hidden” menu. Use [SPACE BAR] to select Yes and press [ENTER] to open menu 11.5 to edit the filter sets. See the Remote Node Filter section for more details.

No

(default)

Once you have configured this menu, press [ENTER] at the message “Press ENTER to Confirm...” to save your configuration, or press [ESC] at any time to cancel.

The Contivity 221 supports PPPoE (Point-to-Point Protocol over Ethernet). You can only use

PPPoE encapsulation when you’re using the Contivity 221 with a DSL modem as the WAN device. If you change the Encapsulation to PPPoE, then you will see the next screen. Please see the Appendices for more information on PPPoE.

Figure 23-3 Menu 11.1: Remote Node Profile for PPPoE Encapsulation

317517-A Rev 00




Active= Yes

Encapsulation= PPPoE Edit IP= No

Service Type= Standard Telco Option:

Service Name= Allocated Budget(min)= 0

Outgoing: Period(hr)= 0

My Login=


Schedules=

Nailed-Up Connection= No

Retype to Confirm= ********

Authen= CHAP/PAP

Session Options:



Edit Traffic Redirect= No



Outgoing Authentication Protocol

Generally speaking, you should employ the strongest authentication protocol possible, for obvious reasons. However, some vendor’s implementation includes a specific authentication protocol in the user profile. It will disconnect if the negotiated protocol is different from that in the user profile, even when the negotiated protocol is stronger than specified. If you encounter a case where the peer disconnects right after a successful authentication, please make sure that you specify the correct authentication protocol when connecting to such an implementation.

Nailed-Up Connection

A nailed-up connection is a dial-up line where the connection is always up regardless of traffic demand. The Contivity 221 does two things when you specify a nailed-up connection. The first is that idle timeout is disabled. The second is that the Contivity 221 will try to bring up the connection when turned on and whenever the connection is down. A nailed-up connection can be very expensive for obvious reasons.

Do not specify a nailed-up connection unless your telephone company offers flat-rate service or you need a constant connection and the cost is of no concern.



The following table describes the fields not already described in

Table 23-1

.

Metric

See the Metric section in the WAN and Dial Backup Setup chapter for details on the Metric field.

Table 23-2 Fields in Menu 11.1 (PPPoE Encapsulation Specific)


CHAP/PAP Authen This field sets the authentication protocol used for outgoing calls.

Options for this field are:

CHAP/PAP - Your Contivity 221 will accept either CHAP or PAP when requested by this remote node.

CHAP - accept CHAP only.

PAP - accept PAP only.

Telco Option

Allocated

Budget

The field sets a ceiling for outgoing call time for this remote node. The default for this field is 0 meaning no budget control.

Period(hr) This field is the time period that the budget should be reset. For example, if we are allowed to call this remote node for a maximum of 10 minutes every hour, then the Allocated Budget is (10 minutes) and the

Period(hr) is 1 (hour).

Schedules You can apply up to four schedule sets here. For more details please refer to the Call Schedule Setup chapter.

Nailed-Up

Connection

This field specifies if you want to make the connection to this remote node a nailed-up connection. More details are given earlier in this section.

Session

Options

Idle Timeout

Type the length of idle time (when there is no traffic from the Contivity

221 to the remote node) in seconds that can elapse before the Contivity

221 automatically disconnects the PPPoE connection. This option only applies when the Contivity 221 initiates the call.

0

(default)

0

(default)

No

(default)

100 seconds

(default)





If you change the Encapsulation to PPTP in menu 11.1, then you will see the next screen. Please see the Appendix for information on PPTP.

317517-A Rev 00


Figure 23-4 Menu 11.1: Remote Node Profile for PPTP Encapsulation



Active= Yes

Encapsulation= PPTP Edit IP= No


Service Name=N/A Allocated Budget(min)= 0

Outgoing= Period(hr)= 0

My Login=


Schedules=

Nailed-up Connections=


Authen= CHAP/PAP

PPTP : Session Options:

My IP Addr= Edit Filter Sets= No

My IP Mask= Idle Timeout(sec)= 100

Server IP Addr=

Connection ID/Name= Edit Traffic Redirect= No



The next table shows how to configure fields in menu 11.1 not previously discussed.

Table 23-3 Fields in Menu 11.1 (PPTP Encapsulation)


Encapsulation Press [SPACE BAR] and then [ENTER] to select PPTP. You must also go to menu 11.3 to check the IP Address setting once you have selected the encapsulation method.

My IP Addr Enter the IP address of the WAN Ethernet port.

My IP Mask Enter the subnet mask of the WAN Ethernet port.

My Server IP Addr Enter the IP address of the ANT modem.

Connection

ID/Name

Enter the connection ID or connection name in the ANT. It must follow the “c:id” and “n:name” format.

Schedules

This field is optional and depends on the requirements of your DSL modem.

You can apply up to four schedule sets here. For more details refer to the Call Schedule Setup chapter.

EXAMPLE

PPTP

10.0.0.140

255.255.255.0

10.0.0.138

N:My ISP



Table 23-3 Fields in Menu 11.1 (PPTP Encapsulation)


Nailed-Up

Connections

Press [SPACE BAR] and then [ENTER] to select Yes if you want to make the connection to this remote node a nailed-up connection.

EXAMPLE

No

23.4

Edit IP

Move the cursor to the Edit IP field in menu 11.1, then press [SPACE BAR] to select Yes. Press

[ENTER] to open Menu 11.3 - Network Layer Options.

Figure 23-5 Menu 11.3: Remote Node Network Layer Options for Ethernet Encapsulation



IP Address= N/A

IP Subnet Mask= N/A

Gateway IP Addr= N/A


Metric= N/A

Private= N/A

RIP Direction= None

Version= N/A

Multicast= None


This menu displays the My WAN Addr field for PPPoE and PPTP encapsulations and

Gateway IP Addr field for Ethernet encapsulation. The following table describes the fields in

this screen.



IP Address

Assignment

If your ISP did not assign you an explicit IP address, press [SPACE

BAR] and then [ENTER] to select Dynamic; otherwise select Static and enter the IP address & subnet mask in the following fields.

Dynamic

(default)

317517-A Rev 00




(Rem) IP

Address

If you have a Static IP Assignment, enter the IP address assigned to you by your ISP.

(Rem) IP

Subnet Mask

Gateway IP

Addr

My WAN

Addr

Network

Address

Translation

Metric

If you have a Static IP Assignment, enter the subnet mask assigned to you.

This field is applicable to Ethernet encapsulation only. Enter the gateway IP address assigned to you if you are using a static IP address.

This field is applicable to PPPoE and PPTP encapsulations only. Some implementations, especially the UNIX derivatives, require the WAN link to have a separate IP network number from the LAN and each end must have a unique address within the WAN network number. If this is the case, enter the IP address assigned to the WAN port of your

Contivity 221.

Note that this is the address assigned to your local Contivity 221, not the remote router.



Choose SUA Only if you have a single public IP address. SUA (Single

User Account) is a subset of NAT that supports two types of mapping:

Many-to-One and Server.

Choose Full Feature if you have multiple public IP addresses. Full

Feature mapping types include: One-to-One, Many-to-One

(SUA/PAT), Many-to-Many Overload, Many- One-to-One and Server.

When you select Full Feature you must configure at least one address mapping set!

See the NAT chapter for a full discussion on this feature.

Enter a number from 1 to 15 to set this route’s priority among the

Contivity 221’s routes (see the Metric section in the WAN and Dial

Backup Setup chapter) The smaller the number, the higher priority the route has.

EXAMPLE

SUA Only

(default)

1





Private This field is valid only for PPTP/PPPoE encapsulation. This parameter determines if the Contivity 221 will include the route to this remote node in its RIP broadcasts. If set to Yes, this route is kept private and not included in RIP broadcast. If No, the route to this remote node will be propagated to other hosts through RIP broadcasts.

EXAMPLE

No

RIP Direction Press [SPACE BAR] and then [ENTER] to select the RIP direction from

Both/ None/In Only/Out Only. See the LAN Setup chapter for more information on RIP. The default for RIP on the WAN side is None. It is recommended that you do not change this setting.

None

(default)

Version Press [SPACE BAR] and then [ENTER] to select the RIP version from

RIP-1/RIP-2B/RIP-2M or None.

Multicast IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group. The Contivity 221 supports both IGMP version 1 (IGMP-v1) and version 2 (IGMP-v2).

Press [SPACE BAR] to enable IP Multicasting or select None to disable it. See the LAN Setup chapter for more information on this feature.

N/A

None

(default)

Once you have completed filling in Menu 11.3 Remote Node Network Layer Options, press [ENTER] at the message “Press ENTER to Confirm...” to save your configuration and return to menu 11, or press

[ESC] at any time to cancel.

23.5

Remote Node Filter

Move the cursor to the field Edit Filter Sets in menu 11.1, and then press [SPACE BAR] to set the value to Yes. Press [ENTER] to open

Menu 11.5 - Remote Node Filter

.

Use menu 11.5 to specify the filter set(s) to apply to the incoming and outgoing traffic between this remote node and the Contivity 221 to prevent certain packets from triggering calls. You can specify up to 4 filter sets separated by commas, for example, 1, 5, 9, 12, in each filter field. Note that spaces are accepted in this field. For more information on defining the filters, please refer to the Filters chapter. For PPPoE or PPTP encapsulation, you have the additional option of specifying remote node call filter sets.

317517-A Rev 00


Figure 23-6 Menu 11.5: Remote Node Filter (Ethernet Encapsulation)


Input Filter Sets:

protocol filters=

device filters=

Output Filter Sets:

protocol filters=

device filters=


Figure 23-7 Menu 11.5: Remote Node Filter (PPPoE or PPTP Encapsulation)


Input Filter Sets:

protocol filters=

Device filters=

Output Filter Sets:

protocol filters=

device filters=

Call Filter Sets:

protocol filters=

Device filters=


To configure the parameters for traffic redirect, enter 11 from the main menu to display Menu

11.1—Remote Node Profile as shown next.



Figure 23-8 Menu 11.1: Remote Node Profile


Rem Node Name= ?

Active= Yes

Route= IP

Encapsulation= Ethernet Edit IP= No

Service Type= Standard Session Options:

Service Name= N/A Edit Filter Sets= No

Outgoing:

My Login= N/A

Edit Traffic Redirect= Yes My Password= N/A


Server IP= N/A

Press ENTER to Confirm or ESC to Cancel.

To configure traffic redirect properties, press [SPACE BAR] to select Yes in the Edit Traffic

Redirect field and then press [ENTER].

Table 23-5 Menu 11.1: Remote Node Profile (Traffic Redirect Field)


Edit

Traffic

Redirect

Press [SPACE BAR] to select Yes or No.

Select No (default) if you do not want to configure this feature.

Select Yes and press [ENTER] to configure Menu 11.6 — Traffic Redirect

Setup.

EXAMPLE

Yes

Press [ENTER] at the message “Press ENTER to Confirm...” to save your configuration, or press [ESC] at any time to cancel.

Configure parameters that determine when the Contivity 221 will forward WAN traffic to the backup gateway using Menu 11.6 — Traffic Redirect Setup.

317517-A Rev 00


Figure 23-9 Menu 11.6: Traffic Redirect Setup

Menu 11.6 - Traffic Redirect Setup

Configuration:

Backup Gateway IP Address= 0.0.0.0

Metric= 15

Check WAN IP Address= 0.0.0.0

Fail Tolerance= 2

Period (sec)= 5

Timeout (sec)= 3



Table 23-6 Menu 11.6: Traffic Redirect Setup


Active Press [SPACE BAR] and select Yes (to enable) or No (to disable) traffic redirect setup. The default is No.

Configuration:

Backup

Gateway IP

Address

Enter the IP address of your backup gateway in dotted decimal notation.

The Contivity 221 automatically forwards traffic to this IP address if the

Contivity 221’s Internet connection terminates.

Metric Enter a number from 1 to 15 to set this route’s priority among the Contivity

221’s routes (see the Metric section in the WAN and Dial Backup Setup chapter) The smaller the number, the higher priority the route has.

Check WAN

IP Address

Enter the IP address of a reliable nearby computer (for example, your

ISP’s DNS server address) to test your Contivity 221’s WAN accessibility.

The Contivity 221 uses the default gateway IP address if you do not enter an IP address here.

If you are using PPTP or PPPoE Encapsulation, enter “0.0.0.0” to configure the Contivity 221 to check the PVC (Permanent Virtual Circuit) or PPTP tunnel.

Fail Tolerance Enter the number of times your Contivity 221 may attempt and fail to connect to the Internet before traffic is forwarded to the backup gateway.

Two to five is usually a good number.

EXAMPLE

Yes

0.0.0.0

15

(default)

0.0.0.0

2



Table 23-6 Menu 11.6: Traffic Redirect Setup


Period (sec) Enter the time interval (in seconds) between WAN connection checks.

Five to 60 is usually a good number.

EXAMPLE

5

Timeout (sec) Enter the number of seconds the Contivity 221 waits for a ping response from the IP Address in the Check WAN IP Address field before it times out. The number in this field should be less than the number in the Period field. Three to 50 is usually a good number.

The WAN connection is considered “down” after the Contivity 221 times out the number of times specified in the Fail Tolerance field.

3

When you have completed this menu, press [ENTER] at the prompt “Press [ENTER] to confirm or [ESC] to cancel” to save your configuration or press [ESC] to cancel and go back to the previous screen.

317517-A Rev 00

24-1

Chapter 24

IP Static Route Setup

This chapter shows you how to configure static routes with your Contivity 221.

24.1

IP Static Route Setup

Enter 12 from the main menu. Select one of the IP static routes as shown next to configure IP static routes in menu 12. 1.

Figure 24-1 Menu 12: IP Static Route Setup

Menu 12 - IP Static Route Setup

1. ________

2. ________

3. ________

4. ________

5. ________

6. ________

7. ________

8. ________

9. ________

10. ________

11. ________

12. ________

Enter selection number:

Now, enter the index number of the static route that you want to configure.


24-2 IP Static Route Setup

Figure 24-2 Menu 12. 1: Edit IP Static Route

Menu 12.1 - Edit IP Static Route

Route #: 1

Route Name= ?

Active= No

Destination IP Address= ?

IP Subnet Mask= ?

Gateway IP Address= ?

Metric= 2

Private= No

Press ENTER to CONFIRM or ESC to CANCEL:

`The following table describes the IP Static Route Menu fields.

Table 24-1 IP Static Route Menu Fields

FIELD

Route #

Route Name

Active

Destination IP

Address

DESCRIPTION

This is the index number of the static route that you chose in menu 12.

Enter a descriptive name for this route. This is for identification purposes only.

This field allows you to activate/deactivate this static route.

This parameter specifies the IP network address of the final destination. Routing is always based on network number. If you need to specify a route to a single host, use a subnet mask of 255.255.255.255 in the subnet mask field to force the network number to be identical to the host ID.

Enter the IP subnet mask for this destination. IP Subnet

Mask

Gateway IP

Address

Metric

Enter the IP address of the gateway. The gateway is an immediate neighbor of your

Contivity 221 that will forward the packet to the destination. On the LAN, the gateway must be a router on the same segment as your Contivity 221; over the WAN, the gateway must be the IP address of one of the remote nodes.

Enter a number from 1 to 15 to set this route’s priority among the Contivity 221’s routes (see the Metric section in the WAN and Dial Backup Setup chapter). The smaller the number, the higher priority the route has.

317517-A Rev 00

IP Static Route Setup 24-3

Table 24-1 IP Static Route Menu Fields

FIELD

Private

DESCRIPTION

This parameter determines if the Contivity 221 will include the route to this remote node in its RIP broadcasts. If set to Yes, this route is kept private and not included in

RIP broadcast. If No, the route to this remote node will be propagated to other hosts through RIP broadcasts.

Once you have completed filling in this menu, press [ENTER] at the message “Press ENTER to

Confirm…” to save your configuration, or press [ESC] to cancel.


25-1

Chapter 25

Network Address Translation (NAT)

This chapter discusses how to configure NAT on the Contivity 221.

25.1

Using NAT

You must create a firewall rule in addition to setting up SUA/NAT, to allow traffic from the WAN to be forwarded through the Contivity 221.

25.1.1 SUA (Single User Account) Versus NAT

SUA (Single User Account) is an implementation of a subset of NAT that supports two types of mapping, Many-to-One and Server. See section 25.2.1 for a detailed description of the NAT set for SUA. The Contivity 221 also supports Full Feature NAT to map multiple global IP addresses to multiple private LAN IP addresses of clients or servers using mapping types as outlined in the WebGUI User’s Guide.

1. Choose SUA Only if you have just one public WAN IP address for your Contivity 221.

2. Choose Full Feature if you have multiple public WAN IP addresses for your Contivity

221.

You apply NAT via menus 4 or 11.3 as displayed next. The next figure shows you how to apply

NAT for Internet access in menu 4. Enter 4 from the main menu to go to Menu 4 - Internet

Access Setup.


25-2 NAT

Figure 25-1 Menu 4: Applying NAT for Internet Access


ISP's Name= myISP



My Login= N/A

My Password= N/A



IP Address= N/A

IP Subnet Mask= N/A




The following figure shows how you apply NAT to the remote node in menu 11.1.

Step 1.

Enter 11 from the main menu.

Step 2.

Move the cursor to the Edit IP field, press [SPACE BAR] to select Yes and then press

[ENTER] to bring up Menu 11.3 - Remote Node Network Layer Options.

317517-A Rev 00

NAT 25-3

Figure 25-2 Menu 11.3: Applying NAT to the Remote Node



IP Address= N/A

IP Subnet Mask= N/A



Metric= N/A

Private= N/A

RIP Direction= None

Version= N/A

Multicast= None




Table 25-1 Applying NAT in Menus 4 & 11.3

FIELD

Network

Address

Translation

DESCRIPTION

When you select this option the SMT will use Address Mapping Set 1

(menu 15.1 - see section 25.2.1 for further discussion). You can configure any of the mapping types described in the WebGUI User’s

Guide. Choose Full Feature if you have multiple public WAN IP addresses for your Contivity 221.

When you select Full Feature you must configure at least one address mapping set!

NAT is disabled when you select this option.

When you select this option the SMT will use Address Mapping Set

255 (menu 15.1 - see section 25.2.1). Choose SUA Only if you have just one public WAN IP address for your Contivity 221.

OPTIONS

Full Feature

None

SUA Only


25-4 NAT

25.2

NAT Setup

Use the address mapping sets menus and submenus to create the mapping table used to assign global addresses to computers on the LAN. You can see two NAT address mapping sets in menu

15.1. You can only configure Set 1. Set 255 is used for SUA. When you select Full Feature in menu 4 or 11.3, the SMT will use Set 1. When you select SUA Only, the SMT will use the preconfigured Set 255 (read only).

The server set is a list of LAN servers mapped to external ports. To use this set, a server rule must be set up inside the NAT address mapping set. Please see the section on port forwarding in the chapter on NAT WebGUI screens for further information on these menus. To configure NAT, enter 15 from the main menu to bring up the following screen.

Figure 25-3 Menu 15: NAT Setup

Menu 15 — NAT Setup

1. Address Mapping Sets

2.

Port Forwarding Setup

3.

Trigger Port Setup


Configure LAN IP addresses in NAT menus 15.1 and 15.2.

25.2.1 Address Mapping Sets

Enter 1 to bring up Menu 15.1 — Address Mapping Sets.

317517-A Rev 00

NAT 25-5

Figure 25-4 Menu 15.1: Address Mapping Sets

Menu 15.1 — Address Mapping Sets

1. NAT_SET

255. SUA (read only)


SUA Address Mapping Set

Enter 255 to display the next screen (see also section 25.1.1). The fields in this menu cannot be changed.

Figure 25-5 Menu 15.1.255: SUA Address Mapping Rules

Menu 15.1.255 - Address Mapping Rules

Set Name= SUA

Idx Local Start IP Local End IP Global Start IP Global End IP Type

--- --------------- --------------- --------------- --------------- ------

1. 0.0.0.0 255.255.255.255 0.0.0.0 M-1

2. 0.0.0.0 Server

3.

4.

5.

6.

7.

8.

9.

10.


The following table explains the fields in this screen.


25-6 NAT

Menu 15.1.255 is read-only.

Table 25-2 SUA Address Mapping Rules


Set Name This is the name of the set you selected in menu 15.1 or enter the name of a new set you want to create.

Idx This is the index or rule number.

Local Start IP Local Start IP is the starting local IP address (ILA).

EXAMPLE

SUA

1

0.0.0.0

Local End IP Local End IP is the ending local IP address (ILA). If the rule is for all local IPs, then the start IP is 0.0.0.0 and the end IP is 255.255.255.255.

255.255.255.255

Global Start

IP

This is the starting global IP address (IGA). If you have a dynamic IP, enter 0.0.0.0 as the Global Start IP.

Global End IP This is the ending global IP address (IGA).

Type These are the mapping types discussed above. Server allows us to specify multiple servers of different types behind NAT to this machine.

See later for some examples.

0.0.0.0

Server

Once you have finished configuring a rule in this menu, press [ENTER] at the message “Press ENTER to


User-Defined Address Mapping Sets

Now look at option 1 in menu 15.1. Enter 1 to bring up this menu. Look at the differences from the previous menu. Note the extra Action and Select Rule fields mean you can configure rules in this screen. Note also that the [?] in the Set Name field means that this is a required field and you must enter a name for the set.

The entire set will be deleted if you leave the Set Name field blank and press

[ENTER] at the bottom of the screen.

317517-A Rev 00

NAT 25-7

Figure 25-6 Menu 15.1.1: First Set


Set Name= NAT_SET


--- --------------- --------------- --------------- --------------- ------

1.

2

3.

4.

5.

6.

7.

8.

9.

10.

Action= Edit Select Rule=


The Type, Local and Global Start/End IPs are configured in menu 15.1.1.1

(described later) and the values are displayed here.

Ordering Your Rules

Ordering your rules is important because the Contivity 221 applies the rules in the order that you specify. When a rule matches the current packet, the Contivity 221 takes the corresponding action and the remaining rules are ignored. If there are any empty rules before your new configured rule, your configured rule will be pushed up by that number of empty rules. For example, if you have already configured rules 1 to 6 in your current set and now you configure rule number 9. In the set summary screen, the new rule will be rule 7, not 9.

Now if you delete rule 4, rules 5 to 7 will be pushed up by 1 rule, so as old rule 5 becomes rule 4, old rule 6 becomes rule 5 and old rule 7 becomes rule 6.


25-8 NAT

Table 25-3 Fields in Menu 15.1.1


Set Name Enter a name for this set of rules. This is a required field. If this field is left blank, the entire set will be deleted.

Action

Select

Rule

The default is Edit. Edit means you want to edit a selected rule (see following field). Insert Before means to insert a rule before the rule selected.

The rules after the selected rule will then be moved down by one rule. Delete means to delete the selected rule and then all the rules after the selected one will be advanced one rule. None disables the Select Rule item.

When you choose Edit, Insert Before or Delete in the previous field the cursor jumps to this field to allow you to select the rule to apply the action in question.

EXAMPLE

NAT_SET

Edit

1

You must press [ENTER] at the bottom of the screen to save the whole set. You must do this again if you make any changes to the set – including deleting a rule.

No changes to the set take place until this action is taken.

Selecting Edit in the Action field and then selecting a rule brings up the following menu, Menu

15.1.1.1

- Address Mapping Rule in which you can edit an individual rule and configure the

Type, Local and Global Start/End IPs.

An IP End address must be numerically greater than its corresponding IP Start address.

Figure 25-7 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set

Menu 15.1.1.1 Address Mapping Rule

Type= One-to-One

Local IP:

Start=

End = N/A

Global IP:

Start=

End = N/A


317517-A Rev 00

NAT 25-9


Table 25-4 Menu 15.1.1.1: Editing/Configuring an Individual Rule in a Set


Type Press [SPACE BAR] and then [ENTER] to select from a total of five types.

These are the mapping types discussed in the WebGUI User’s Guide. Server allows you to specify multiple servers of different types behind NAT to this computer. See section 25.4.3 for an example.

Local IP Only local IP fields are N/A for server; Global IP fields MUST be set for

Server.

Start Enter the starting local IP address (ILA).

EXAMPLE

One-to-

One

End Enter the ending local IP address (ILA). If the rule is for all local IPs, then put the Start IP as 0.0.0.0 and the End IP as 255.255.255.255. This field is N/A for One-to-One and Server types.

Global IP

Start Enter the starting global IP address (IGA). If you have a dynamic IP, enter

0.0.0.0 as the Global IP Start. Note that Global IP Start can be set to 0.0.0.0 only if the types are Many-to-One or Server.

0.0.0.0

N/A

0.0.0.0

End Enter the ending global IP address (IGA). This field is N/A for One-to-One,

Many-to-One and Server types.

N/A

Once you have finished configuring a rule in this menu, press [ENTER] at the message “Press ENTER to


25.3

Configuring a Server behind NAT

Follow these steps to configure a server behind NAT:

Step 1.

Enter 15 in the main menu to go to Menu 15 - NAT Setup.

Step 2.

Enter 2 to go to Menu 15.2 - NAT Server Setup.

Step 3.

Enter a port number in an unused Start Port No field. To forward only one port, enter it again in the End Port No field. To specify a range of ports, enter the last port to be forwarded in the

End Port No field.


25-10 NAT

Step 4.

Enter the inside IP address of the server in the IP Address field. In the following figure, you have a computer acting as an FTP, Telnet and SMTP server (ports 21, 23 and 25) at

192.168.1.33.

Step 5.

Press [ENTER] at the “Press ENTER to confirm …” prompt to save your configuration after you define all the servers or press [ESC] at any time to cancel.

Figure 25-8 Menu 15.2: NAT Server Setup

Menu 15.2 - NAT Server Setup

Rule Start Port No. End Port No. IP Address

---------------------------------------------------

1. Default Default 0.0.0.0

2. 21 25 192.168.1.33

3. 0 0 0.0.0.0

4. 0 0 0.0.0.0

5. 0 0 0.0.0.0

6. 0 0 0.0.0.0

7. 0 0 0.0.0.0

8. 0 0 0.0.0.0

9. 0 0 0.0.0.0

10. 0 0 0.0.0.0

11. 0 0 0.0.0.0

12. 1026 1026 RR Reserved


317517-A Rev 00

Figure 25-9 Multiple Servers Behind NAT Example

NAT 25-11

25.4

General NAT Examples

The following are some examples of NAT configuration.

In the following Internet access example, you only need one rule where all your ILAs (Inside

Local addresses) map to one dynamic IGA (Inside Global Address) assigned by your ISP.


25-12 NAT

Figure 25-10 NAT Example 1

Figure 25-11 Menu 4: Internet Access & NAT Example





My Login= N/A

My Password= N/A



IP Address= N/A

IP Subnet Mask= N/A




From menu 4 shown above, simply choose the SUA Only option from the Network Address

Translation field. This is the Many-to-One mapping discussed in section 25.4. The SUA Only

read-only option from the Network Address Translation field in menus 4 and 11.3 is specifically pre-configured to handle this case.

317517-A Rev 00

NAT 25-13

25.4.2 Example 2: Internet Access with an Inside Server


In this case, you do exactly as above (use the convenient pre-configured SUA Only set) and also go to menu 15.2 to specify the Inside Server behind the NAT as shown in the next figure.

Figure 25-13 Menu 15.2: Specifying an Inside Server



---------------------------------------------------


2. 0 0 0.0.0.0

3. 0 0 0.0.0.0

4. 0 0 0.0.0.0

5. 0 0 0.0.0.0

6. 0 0 0.0.0.0

7. 0 0 0.0.0.0

8. 0 0 0.0.0.0

9. 0 0 0.0.0.0

10. 0 0 0.0.0.0

11. 0 0 0.0.0.0



25.4.3 Example 3: Multiple Public IP Addresses With Inside


25-14 NAT

Servers

In this example, there are 3 IGAs from our ISP. There are many departments but two have their own FTP server. All departments share the same router. The example will reserve one IGA for each department with an FTP server and all departments use the other IGA. Map the FTP servers to the first two IGAs and the other LAN traffic to the remaining IGA. Map the third IGA to an inside web server and mail server. Four rules need to be configured, two bi-directional and two uni-directional as follows.

Rule 1.

Map the first IGA to the first inside FTP server for FTP traffic in both directions (1 : 1

Rule 2.

Rule 3.

Rule 4.

mapping, giving both local and global IP addresses).

Map the second IGA to our second inside FTP server for FTP traffic in both directions

(1 : 1 mapping, giving both local and global IP addresses).

Map the other outgoing LAN traffic to IGA3 (Many : 1 mapping).

You also map your third IGA to the web server and mail server on the LAN. Type

Server allows you to specify multiple servers, of different types, to other computers

behind NAT on the LAN.

The example situation looks somewhat like this:

317517-A Rev 00

NAT 25-15


Step 1.

Step 2.

Step 3.

Step 4.

Step 5.

Step 6.

Step 7.

In this case you need to configure Address Mapping Set 1 from Menu 15.1 - Address

Mapping Sets. Therefore you must choose the Full Feature option from the Network

Address Translation field (in menu 4 or menu 11.3) in

Figure 25-15

.

Then enter 15 from the main menu.

Enter 1 to configure the Address Mapping Sets.

Enter 1 to begin configuring this new set. Enter a Set Name, choose the Edit Action and then enter 1 for the Select Rule field. Press [ENTER] to confirm.

Select Type as One-to-One (direct mapping for packets going both ways), and enter the local Start IP as 192.168.1.10 (the IP address of FTP Server 1), the global Start IP as 10.132.50.1 (our first IGA). (See

Figure 25-16

).

Repeat the previous step for rules 2 to 4 as outlined above.

When finished, menu 15.1.1 should look like as shown in

Figure 25-17 .














25-16 NAT

Figure 25-15 Example 3: Menu 11.3



IP Address= N/A

IP Subnet Mask= N/A



Metric= N/A

Private= N/A

RIP Direction= None

Version= N/A


The following figure shows how to configure the first rule.

Figure 25-16 Example 3: Menu 15.1.1.1


Type= One-to-One

Local IP:

Start= 192.168.1.10

End = N/A

Global IP:

Start= 10.132.50.1

End = N/A



317517-A Rev 00

Figure 25-17 Example 3: Final Menu 15.1.1


Set Name= Example3


--- --------------- --------------- --------------- --------------- ------

1. 192.168.1.10 10.132.50.1 1-1

2 192.168.1.11 10.132.50.2 1-1

3. 0.0.0.0 255.255.255.255 10.132.50.3 M-1

4. 10.132.50.3 Server

5.

6.

7.

8.

9.

10.



Now configure the IGA3 to map to our web server and mail server on the LAN.

Step 8.

Step 9.

Enter 15 from the main menu.

Now enter 2 from this menu and configure it as shown in

Figure 25-18

.

Figure 25-18 Example 3: Menu 15.2



---------------------------------------------------


2. 80 80 192.168.1.21

3. 25 25 192.168.1.20

4. 0 0 0.0.0.0

5. 0 0 0.0.0.0

6. 0 0 0.0.0.0

7. 0 0 0.0.0.0

8. 0 0 0.0.0.0

9. 0 0 0.0.0.0

10. 0 0 0.0.0.0

11. 0 0 0.0.0.0



NAT 25-17






25-18 NAT

25.4.4 Example 4: NAT Unfriendly Application Programs

Some applications do not support NAT Mapping using TCP or UDP port address translation. In this case it is better to use Many-One-to-One mapping as port numbers do not change for

Many-One-to-One (and One-to-One) NAT mapping types. The following figure illustrates

this.


Other applications such as some gaming programs are NAT unfriendly because they embed addressing information in the data stream. These applications won’t

work through NAT even when using One-to-One and Many-One-to-One mapping

types.

Follow the steps outlined in example 3 above to configure these two menus as follows.

317517-A Rev 00

NAT 25-19

Figure 25-20 Example 4: Menu 15.1.1.1: Address Mapping Rule


Type= Many-One-to-One

Local IP:

Start= 192.168.1.10

End = 192.168.1.12

Global IP:

Start= 10.132.50.1

End = 10.132.50.3


After you’ve configured your rule, you should be able to check the settings in menu 15.1.1 as shown next.

Figure 25-21 Example 4: Menu 15.1.1: Address Mapping Rules


Set Name= Example4


--- --------------- --------------- --------------- --------------- ------

1. 192.168.1.10 192.168.1.12 10.132.50.1 10.132.50.3 M-1-1

2.

3.

4.

5.

6.

7.

8.

9.

10.




25-20 NAT

25.5

Configuring Trigger Port Forwarding

Only one LAN computer can use a trigger port (range) at a time.

Enter 3 in menu 15 to display Menu 15.3 — Trigger Port Setup, shown next.

Figure 25-22 Menu 15.3: Trigger Port Setup

Menu 15.3 - Trigger Port Setup

Incoming Trigger

Rule Name Start Port End Port Start Port End Port

----------------------------------------------------------------------

1. Real Audio 6970 7170 7070 7070

2.

3.

0

0

0

0

0

0

0

0

4.

5.

6.

7.

8.

9.

10.

11.

12.

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0



Table 25-5 Menu 15.3: Trigger Port Setup Description

FIELD

Rule

Name

DESCRIPTION

This is the rule index number.

Enter a unique name for identification purposes. You may enter up to 15 characters in this field. All characters are permitted - including spaces.

EXAMPLE

1

Real Audio

Incoming Incoming is a port (or a range of ports) that a server on the WAN uses when it sends out a particular service. The Contivity 221 forwards the traffic with this port (or range of ports) to the client computer on the LAN that requested the service.

Start Port Enter a port number or the starting port number in a range of port numbers. 6970

317517-A Rev 00

NAT 25-21

Table 25-5 Menu 15.3: Trigger Port Setup Description


End Port Enter a port number or the ending port number in a range of port numbers.

Trigger

EXAMPLE

7170

The trigger port is a port (or a range of ports) that causes (or triggers) the Contivity 221 to record the IP address of the LAN computer that sent the traffic to a server on the WAN.

Start Port Enter a port number or the starting port number in a range of port numbers.

End Port Enter a port number or the ending port number in a range of port numbers.

7070

7070

Press [ENTER] at the message “Press ENTER to Confirm...” to save your configuration, or press [ESC] at any time to cancel.


xxii NAT

26-1

Chapter 26

Introducing the Firewall

This chapter shows you how to get started with the firewall.

26.1

Using SMT Menus

From the main menu enter 21 to go to Menu 21 - Filter Set and Firewall Configuration to display the screen shown next.

Figure 26-1 Menu 21: Filter and Firewall Setup

Menu 21 - Filter and Firewall Setup

1. Filter Setup

2. Firewall Setup


26-2 Introducing the Firewall

26.1.1 Activating Firewall

Enter option 2 in this menu to bring up the following screen. Press [SPACE BAR] and then

[ENTER] to select Yes in the Active field to activate the firewall. The firewall must be active to protect against Denial of Service (DoS) attacks. Use the WebGUI to configure firewall rules.

Figure 26-2 Menu 21.2: Firewall Setup

Menu 21.2 - Firewall Setup

The firewall protects against Denial of Service (DoS) attacks when

it is active.

Your network is vulnerable to attacks when the firewall is turned off.

Refer to the User’s Guide for details about the firewall default

policies.

You may define additional policy rules or modify existing ones but

please exercise extreme caution in doing so.

Active: Yes

You can use the WebGUI to configure the firewall.


Configure the firewall rules using the WebGUI or CLI commands.

3317517-A Rev 00

27-1

Chapter 27

Filter Configuration

This chapter shows you how to create and apply filters.

27.1

Introduction to Filters

Your Contivity 221 uses filters to decide whether to allow passage of a data packet and/or to make a call. There are two types of filter applications: data filtering and call filtering. Filters are subdivided into device and protocol filters, which are discussed later.

Data filtering screens the data to determine if the packet should be allowed to pass. Data filters are divided into incoming and outgoing filters, depending on the direction of the packet relative to a port. Data filtering can be applied on either the WAN side or the LAN side. Call filtering is used to determine if a packet should be allowed to trigger a call. Remote node call filtering is only applicable when using PPPoE encapsulation. Outgoing packets must undergo data filtering before they encounter call filtering as shown in the following figure.


27-2 Filter Configuration

Figure 27-1 Outgoing Packet Filtering Process

Outgoing

Packet

No

Data Filtering match

Match

Built-in default

Call Filters

Match

Call Filtering

No match

User-defined

Call Filters

(if applicable)

Match

No match

Active Data

Initiate call if line not up

Send packet and reset

Idle Timer

Drop packet

Drop packet if line not up

Or

Drop packet if line not up

Or

Send packet but do not reset

Idle Timer

Send packet but do not reset

Idle Timer

For incoming packets, your Contivity 221 applies data filters only. Packets are processed depending upon whether a match is found. The following sections describe how to configure filter sets.

27.1.1 Filter

A filter set consists of one or more filter rules. Usually, you would group related rules, e.g., all the rules for NetBIOS, into a single set and give it a descriptive name. The Contivity 221 allows you to configure up to twelve filter sets with six rules in each set, for a total of 72 filter rules in the system. You cannot mix device filter rules and protocol filter rules within the same set. You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24 rules active for a single port.

Sets of factory default filter rules have been configured in menu 21 to prevent NetBIOS traffic from triggering calls and to prevent incoming telnet sessions. A summary of their filter rules is shown in the figures that follow.

The following figure illustrates the logic flow when executing a filter rule. See also

Figure 27-7

for the logic flow when executing an IP filter.

3317517-A Rev 00





Filter Configuration 27-3

Figure 27-2 Filter Rule Process

Fetch Next

Filter Set

Yes

Next Filter Set

Available?

No

Drop Packet

No

Filter Set

Start

Packet into filter

Fetch First

Filter Set

Fetch First

Filter Rule

Fetch Next

Filter Rule

Yes

Next filter

Rule

Available?

Check

Next

Rule

No Active?

Yes

Execute

Filter Rule

Drop

Forward

Accept Packet



You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24 rules active for a single port.

27.2

Configuring a Filter Set

The Contivity 221 includes filtering for NetBIOS over TCP/IP packets by default. To configure another filter set, follow the procedure below.

Step 1.

Enter 21 in the main menu to open menu 21.

Figure 27-4 Menu 21: Filter and Firewall Setup

Menu 21 - Filter and Firewall Setup

1. Filter Setup

2. Firewall Setup


Step 2.

Enter 1 to bring up the following menu.

Figure 27-5 Menu 21.1: Filter Set Configuration

Menu 21.1 - Filter Set Configuration

Filter Filter

Set # Comments Set # Comments

------ ----------------- ------ -----------------

1 _______________ 7 _______________

2 _______________ 8 _______________

3 _______________ 9 _______________

4 _______________ 10 _______________

5 _______________ 11 _______________

6 _______________ 12 _______________

Enter Filter Set Number to Configure= 0

Edit Comments= N/A


Step 3.

Step 4.

Select the filter set you wish to configure (1-12) and press [ENTER]

.

Enter a descriptive name or comment in the Edit Comments field and press [ENTER].

3317517-A Rev 00


Step 5.

Press [ENTER] at the message [Press ENTER to confirm] to open Menu 21.1.1 -

Filter Rules Summary.

This screen shows the summary of the existing rules in the filter set. The following tables contain a brief description of the abbreviations used in the previous menus.

Table 27-1 Abbreviations Used in the Filter Rules Summary Menu


#

A

The filter rule number: 1 to 6.

Active: “Y” means the rule is active. “N” means the rule is inactive.

Type

Filter

Rules

The type of filter rule: “GEN” for Generic, “IP” for TCP/IP.

These parameters are displayed here.

M More.

“Y” means there are more rules to check which form a rule chain with the present rule. An action cannot be taken until the rule chain is complete.

“N” means there are no more rules to check. You can specify an action to be taken i.e., forward the packet, drop the packet or check the next rule. For the latter, the next rule is independent of the rule just checked.

“F” means to forward the packet immediately and skip checking the remaining rules.

“D” means to drop the packet.

“N“ means to check the next rule.

“F” means to forward the packet immediately and skip checking the remaining rules.

“D” means to drop the packet.

“N” means to check the next rule.

The protocol dependent filter rules abbreviation are listed as follows:



Table 27-2 Rule Abbreviations Used

ABBREVIATION DESCRIPTION

IP

Pr Protocol

GEN

Off Offset

Len Length

Refer to the next section for information on configuring the filter rules.

27.2.1 Configuring a Filter Rule

To configure a filter rule, type its number in Menu 21.1.1 - Filter Rules Summary and press

[ENTER] to open menu 21.1.1.1 for the rule.

To speed up filtering, all rules in a filter set must be of the same class, i.e., protocol filters or generic filters. The class of a filter set is determined by the first rule that you create. When applying the filter sets to a port, separate menu fields are provided for protocol and device filter sets. If you include a protocol filter set in a device filter field or vice versa, the Contivity 221 will warn you and will not allow you to save.

27.2.2 Configuring a TCP/IP Filter Rule

This section shows you how to configure a TCP/IP filter rule. TCP/IP rules allow you to base the rule on the fields in the IP and the upper layer protocol, for example, UDP and TCP headers.

3317517-A Rev 00


To configure TCP/IP rules, select TCP/IP Filter Rule from the Filter Type field and press

[ENTER] to open Menu 21.1.1.1 - TCP/IP Filter Rule, as shown next.

Figure 27-6 Menu 21.1.1.1: TCP/IP Filter Rule

Menu 21.1.1.1 - TCP/IP Filter Rule

Filter #: 1,1

Filter Type= TCP/IP Filter Rule

Active= Yes

IP Protocol= 0 IP Source Route= No

Destination: IP Addr= 0.0.0.0

IP Mask= 0.0.0.0

Port #= 137

Port # Comp= Equal

Source: IP Addr= 0.0.0.0

IP Mask= 0.0.0.0

Port #=

Port # Comp= None

TCP Estab= No

More= N/A Log= None

Action Matched= Drop

Action Not Matched= Check Next Rule



The following table describes how to configure your TCP/IP filter rule.

Table 27-3 TCP/IP Filter Rule Menu Fields

Active

IP Protocol

Press [SPACE BAR] and then [ENTER] to select Yes to activate the filter rule or No to deactivate it.

Protocol refers to the upper layer protocol, e.g., TCP is 6, UDP is 17 and ICMP is 1. Type a value between 0 and 255. A value of 0 matches ANY protocol.

Yes

No

0-255

IP Source Route Press [SPACE BAR] and then [ENTER] to select Yes to apply the rule to packets with an IP source route option. Otherwise the packets must not have a source route option. The majority of IP packets do not have source route.

Yes

No

Destination

IP Address Enter the destination IP Address of the packet you wish to filter. This field is ignored if it is 0.0.0.0.

0.0.0.0

IP Mask Enter the IP mask to apply to the Destination: IP Addr. 0.0.0.0




Port # Enter the destination port of the packets that you wish to filter.

The range of this field is 0 to 65535. This field is ignored if it is

0.

Port # Comp Press [SPACE BAR] and then [ENTER] to select the comparison to apply to the destination port in the packet against the value given in Destination: Port #.

Source

0-65535

None

Less

Greater

Equal

Not Equal

IP Address Enter the source IP Address of the packet you wish to filter.

This field is ignored if it is 0.0.0.0.

Port # Comp Press [SPACE BAR] and then [ENTER] to select the comparison to apply to the source port in the packet against the value given in Source: Port #.

TCP Estab

0.0.0.0

IP Mask Enter the IP mask to apply to the Source: IP Addr. 0.0.0.0

Port # Enter the source port of the packets that you wish to filter. The range of this field is 0 to 65535. This field is ignored if it is 0.

0-65535

None

Less

Greater

Equal

Not Equal

Yes

No

More

This field is applicable only when the IP Protocol field is 6,

TCP. Press [SPACE BAR] and then [ENTER] to select Yes, to have the rule match packets that want to establish a TCP connection (SYN=1 and ACK=0); if No, it is ignored.

Press [SPACE BAR] and then [ENTER] to select Yes or No. If

Yes, a matching packet is passed to the next filter rule before an action is taken; if No, the packet is disposed of according to the action fields.

If More is Yes, then Action Matched and Action Not

Matched will be N/A.

Yes

No

3317517-A Rev 00



Log

Action Matched

Press [SPACE BAR] and then [ENTER] to select a logging option from the following:

None – No packets will be logged.

Action Matched - Only packets that match the rule parameters will be logged.

Action Not Matched - Only packets that do not match the rule parameters will be logged.

Both – All packets will be logged.

Press [SPACE BAR] and then [ENTER] to select the action for a matching packet.

None

Action

Matched

Action Not

Matched

Both

Check Next

Rule

Forward

Drop

Action Not Matched Press [SPACE BAR] and then [ENTER] to select the action for a packet not matching the rule.

Check Next

Rule

Forward

Drop

When you have Menu 21.1.1.1 - TCP/IP Filter Rule configured, press [ENTER] at the message “Press

ENTER to Confirm” to save your configuration, or press [ESC] to cancel. This data will now be displayed on Menu 21.1.1 - Filter Rules Summary.

The following figure illustrates the logic flow of an IP filter.



Figure 27-7 Executing an IP Filter

Packet into IP Filter

Filter Active?

Yes

Apply SrcAddrMask to Src Addr

No

Check Src

IP Addr

Matched

Apply DestAddrMask to Dest Addr

Not Matched

Check Dest

IP Addr

Matched

Check

IP Protocol

Matched

Check Src &

Dest Port

Matched

Not Matched

Not Matched

Not Matched

More?

No

Action Matched

Yes

Check Next Rule

Check Next Rule

Action Not Matched

Drop Forward

Drop

Drop Packet

Forward

Check Next Rule Accept Packet

3317517-A Rev 00


This section shows you how to configure a generic filter rule. The purpose of generic rules is to allow you to filter non-IP packets. For IP, it is generally easier to use the IP rules directly.

For generic rules, the Contivity 221 treats a packet as a byte stream as opposed to an IP or IPX packet. You specify the portion of the packet to check with the Offset (from 0) and the Length fields, both in bytes. The Contivity 221 applies the Mask (bit-wise ANDing) to the data portion before comparing the result against the Value to determine a match. The Mask and Value are specified in hexadecimal numbers. Note that it takes two hexadecimal digits to represent a byte, so if the length is 4, the value in either field will take 8 digits, for example, FFFFFFFF.

To configure a generic rule, select Generic Filter Rule in the Filter Type field in menu

21.1.4.1 and press [ENTER] to open Generic Filter Rule, as shown below.

Figure 27-8 Menu 21.1.1.1: Generic Filter Rule

Menu 21.1.1.1 - Generic Filter Rule

Filter #: 1,1

Filter Type= Generic Filter Rule

Active= No

Offset= 0

Length= 0

Mask= N/A

Value= N/A

More= No Log= None

Action Matched= Check Next Rule

Action Not Matched= Check Next Rule



The following table describes the fields in the Generic Filter Rule menu.

Table 27-4 Generic Filter Rule Menu Fields

FIELD DESCRIPTION OPTIONS

Filter # This is the filter set, filter rule co-ordinates, i.e., 2,3 refers to the second filter set and the third rule of that set.



Table 27-4 Generic Filter Rule Menu Fields


Filter

Type

Use [SPACE BAR] and then [ENTER] to select a rule type. Parameters displayed below each type will be different. TCP/IP filter rules are used to filter IP packets while generic filter rules allow filtering of non-IP packets.

Generic Filter

Rule

TCP/IP Filter

Rule

Offset

Length Enter the byte count of the data portion in the packet that you wish to compare. The range for this field is 0 to 8.

Mask

Enter the starting byte of the data portion in the packet that you wish to compare. The range for this field is from 0 to 255.

Value

Enter the mask (in Hexadecimal notation) to apply to the data portion before comparison.

Enter the value (in Hexadecimal notation) to compare with the data portion.

Yes / No

0-255

0-8

Yes

No taken; else the packet is disposed of according to the action fields.

If More is Yes, then Action Matched and Action Not Matched will be No.

Log Select the logging option from the following:

None - No packets will be logged.

Action Matched - Only packets that match the rule parameters will be logged.

Action Not Matched - Only packets that do not match the rule parameters will be logged.

Both – All packets will be logged.

None

Action

Matched

Action Not

Matched

Both

Action

Matched

Action

Not

Matched

Select the action for a packet matching the rule.

Select the action for a packet not matching the rule.

Check Next

Rule

Forward

Drop

Check Next

Rule

Forward

Drop

Once you have completed filling in Menu 21.1.1.1 - Generic Filter Rule, press [ENTER] at the message

“Press ENTER to Confirm” to save your configuration, or press [ESC] to cancel. This data will now be displayed on Menu 21.1.1 - Filter Rules Summary.

3317517-A Rev 00


27.3

Example Filter

Let’s look at an example to block outside users from accessing the Contivity 221 via telnet. Please see our included disk for more example filters.

Figure 27-9 Telnet Filter Example

Step 1.

Step 2.

Step 3.

Step 4.

Step 5.

Enter 21 from the main menu to open Menu 21 - Filter and Firewall Setup.

Enter 1 to open Menu 21.1 - Filter Set Configuration.

Enter the index of the filter set you wish to configure (say 3) and press [ENTER]

.

Enter a descriptive name or comment in the Edit Comments field and press [ENTER].

Press [ENTER] at the message [Press ENTER to confirm] to open Menu 21.1.3 -

Filter Rules Summary.



Step 6.

Enter 1 to configure the first filter rule (the only filter rule of this set). Make the entries in this menu as shown in the following figure.

Figure 27-10 Example Filter: Menu 21.1.3.1

Menu 21.1.3.1 - TCP/IP Filter Rule

Filter #: 3,1

Filter Type= TCP/IP Filter Rule

Active= Yes

IP Protocol= 6 IP Source Route= No

Destination: IP Addr= 0.0.0.0

IP Mask= 0.0.0.0

Port #= 23

Port # Comp= Equal

Source: IP Addr= 0.0.0.0

IP Mask= 0.0.0.0

Port #= 0

Port # Comp= None

TCP Estab= No

More= No Log= None

Action Matched= Drop

Action Not Matched= Forward



Press [SPACE BAR] and then

[ENTER] to choose this filter rule type. The first filter rule type determines all subsequent filter types within a set.

Select Yes to make the rule active.

6 is the TCP protocol.

There are no more rules to check.

Select Equal here as you are looking for packets going to port 23 only.

The port number for the telnet service (TCP protocol) is 23. See

RFC 1060 for port numbers of wellknown services.

Select Drop here so that the packet will be dropped if its destination is the telnet port.

Select Forward here so that the packet will be forwarded if its destination is not the telnet port.

When you press [ENTER] to confirm, you will see the following screen. Note that there is only one filter rule in this set.

3317517-A Rev 00


Figure 27-11 Example Filter Rules Summary: Menu 21.1.3

Menu 21.1.3 - Filter Rules Summary

# A Type Filter Rules M m n

- - ---- --------------------------------------------------------------- - - -

1 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=23 N D F

2 N

3 N

4 N

5 N

6 N

This shows you that you have configured and activated (A = Y) a

TCP/IP filter rule (Type = IP, Pr = 6) for destination telnet ports (DP =

23).

M = N means an action can be taken immediately.

The action is to drop the packet (m = D) if the action is matched and to forward the packet immediately (n = F) if the action is not matched no matter whether there are more rules to be checked (there aren’t in this example).

After you’ve created the filter set, you must apply it.

Step 1.

Step 2.

Enter 11 from the main menu to go to menu 11.

Go to the Edit Filter Sets field, press [SPACE BAR] to select Yes and press

[ENTER].

Step 3.

Step 4.

This brings you to menu 11.5. Apply a filter set (our example filter set 3) as shown in

Figure 27-14

.

Press [ENTER] to confirm after you enter the set numbers and to leave menu 11.5.

27.4

Filter Types and NAT

There are two classes of filter rules, Generic Filter (Device) rules and protocol filter (TCP/IP) rules. Generic filter rules act on the raw data from/to LAN and WAN. Protocol filter rules act on






27-16 Filter Configuration the IP packets. Generic and TCP/IP filter rules are discussed in more detail in the next section.

When NAT (Network Address Translation) is enabled, the inside IP address and port number are replaced on a connection-by-connection basis, which makes it impossible to know the exact address and port on the wire. Therefore, the Contivity 221 applies the protocol filters to the

“native” IP address and port number before NAT for outgoing packets and after NAT for incoming packets. On the other hand, the generic, or device filters are applied to the raw packets that appear on the wire. They are applied at the point when the Contivity 221 is receiving and sending the packets; i.e. the interface. The interface can be an Ethernet port or any other hardware port. The following diagram illustrates this.

Figure 27-12 Protocol and Device Filter Sets

27.5

Firewall Versus Filters

Firewall configuration is discussed in the firewall chapters of this manual. Further comparisons are also made between filtering, NAT and the firewall.

27.6

Applying a Filter

This section shows you where to apply the filter(s) after you design it (them). The Contivity 221 already has filters to prevent NetBIOS traffic from triggering calls, and block incoming telnet,

FTP and HTTP connections.

If you do not activate the firewall, it is advisable to apply filters.

3317517-A Rev 00


27.6.1 Applying LAN Filters

LAN traffic filter sets may be useful to block certain packets, reduce traffic and prevent security breaches. Go to menu 3.1 (shown next) and enter the number(s) of the filter set(s) that you want to apply as appropriate. You can choose up to four filter sets (from twelve) by entering their numbers separated by commas, e.g., 3, 4, 6, 11. Input filter sets filter incoming traffic to the

Contivity 221 and output filter sets filter outgoing traffic from the Contivity 221. For PPPoE or

PPTP encapsulation, you have the additional option of specifying remote node call filter sets.

Figure 27-13 Filtering LAN Traffic

Menu 3.1 – LAN Port Filter Setup

Input Filter Sets:

protocol filters=

device filters=

Output Filter Sets:

protocol filters=

device filters=


27.6.2 Applying Remote Node Filters

Go to menu 11.5 (shown below – note that call filter sets are only present for PPPoE encapsulation) and enter the number(s) of the filter set(s) as appropriate. You can cascade up to four filter sets by entering their numbers separated by commas. The Contivity 221 already has filters to prevent NetBIOS traffic from triggering calls, and block incoming telnet, FTP and HTTP connections.



Figure 27-14 Filtering Remote Node Traffic

Menu 11.5 – Remote Node Filter Setup

Input Filter Sets:

protocol filters=

device filters=

Output Filter Sets:

protocol filters=

device filters=


3317517-A Rev 00

28-1

Chapter 28

SNMP Configuration

This chapter explains SNMP configuration menu 22.

SNMP is only available if TCP/IP is configured.

28.1

SNMP Configuration

To configure SNMP, enter 22 from the main menu to display Menu 22 - SNMP Configuration as shown next. The “community” for Get, Set and Trap fields is SNMP terminology for password.

Figure 28-1 Menu 22: SNMP Configuration

Menu 22 - SNMP Configuration

SNMP:

Get Community= public

Set Community= public

Trusted Host= 0.0.0.0

Trap:

Community= public

Destination= 0.0.0.0


The following table describes the SNMP configuration parameters.

Table 28-1 SNMP Configuration Menu Fields


Get Community Type the Get community, which is the password for the incoming

Get- and GetNext requests from the management station.

Set Community Type the Set community, which is the password for incoming Set requests from the management station.

EXAMPLE

Public

(default)

Public

(default)


28-2 SNMP Configuration

Table 28-1 SNMP Configuration Menu Fields

FIELD

Trusted Host

DESCRIPTION

If you enter a trusted host, your Contivity 221 will only respond to

SNMP messages from this address. A blank (default) field means your Contivity 221 will respond to all SNMP messages it receives, regardless of source.

Type the Trap community, which is the password sent with each trap to the SNMP manager.

EXAMPLE

0.0.0.0

Trap

Community

Public

Destination Type the IP address of the station to send your SNMP traps to. 0.0.0.0

When you have completed this menu, press [ENTER] at the prompt “Press [ENTER] to confirm or [ESC] to cancel” to save your configuration or press [ESC] to cancel and go back to the previous screen.

28.2

SNMP Traps

The Contivity 221 will send traps to the SNMP manager when any one of the following events occurs:


TRAP # TRAP NAME DESCRIPTION

0 coldStart RFC-1215) A trap is sent after booting (power on).

1 warmStart (defined in RFC-1215) A trap is sent after booting (software reboot).

4 authenticationFailure A trap is sent to the manager when receiving any SNMP

RFC-1215) get or set requirements with the wrong community

(password).

6 whyReboot (defined in MIB) A trap is sent with the reason of restart before rebooting when the system is going to restart (warm start).

6a For intentional reboot: A trap is sent with the message "System reboot by user!" if reboot is done intentionally, (for example, download new files, CI command "sys reboot", etc.).

6b For fatal error: A trap is sent with the message of the fatal code if the system reboots because of fatal errors.

3317517-A Rev 00

SMT System Maintenance

Part XII:

SMT System Maintenance

This part covers system information and diagnosis; firmware and configuration file maintenance, as well as providing information on the system maintenance and information functions and how to configure remote management.


XII

29-1

Chapter 29

System Information & Diagnosis

This chapter covers SMT menus 24.1 to 24.4.

29.1

Introduction to System Status

This chapter covers the diagnostic tools that help you to maintain your Contivity 221. These tools include updates on system status, port status and log and trace capabilities.

Select menu 24 in the main menu to open Menu 24 - System Maintenance, as shown below.

Figure 29-1 Menu 24: System Maintenance

Menu 24 - System Maintenance

1. System Status

2. System Information and Console Port Speed

3. Log and Trace

4. Diagnostic

5. Backup Configuration

6. Restore Configuration

7. Upload Firmware

8. Command Interpreter Mode

9. Call Control

10. Time and Date Setting

11. Remote Management Setup


29.2

System Status

The first selection, System Status, gives you information on the version of your system firmware and the status and statistics of the ports, as shown in the next figure. System Status is a tool that can be used to monitor your Contivity 221. Specifically, it gives you information on your system firmware version, number of packets sent and number of packets received.

To get to the System Status:


29-2 System Information and Diagnosis

Step 1.

Enter number 24 to go to Menu 24 - System Maintenance.

Step 2.

In this menu, enter 1 to open System Maintenance - Status.

Step 3.

There are three commands in Menu 24.1 - System Maintenance - Status. Entering 1 drops the

WAN connection, 9 resets the counters and [ESC] takes you back to the previous screen.

Figure 29-2 Menu 24.1: System Maintenance: Status

Menu 24.1 - System Maintenance - Status 03:06:17

Sat. Jan. 01, 2000

Port Status TxPkts RxPkts Cols Tx B/s Rx B/s Up Time

WAN Down 0 0 0 0 0 0:00:00

LAN Down 463 792 0 0 0 0:00:00

Port Ethernet Address IP Address IP Mask DHCP

WAN 00:a0:c5:01:23:46 0.0.0.0 0.0.0.0 Client

LAN 00:a0:c5:01:23:45 192.168.1.1 255.255.255.0 Server

System up Time: 3:06:20

Name:

Routing: IP

RAS F/W Version: V02.001 | 08/01/2003

Press Command:

COMMANDS: 1-Drop WAN 9-Reset Counters ESC-Exit

The following table describes the fields present in Menu 24.1 - System Maintenance - Status.

These fields are READ-ONLY and meant for diagnostic purposes. The upper right corner of the screen shows the time and date according to the format you set in menu 24.10.

Table 29-1 System Maintenance: Status Menu Fields

Port


Identifies a port (WAN, or LAN) on the Contivity 221.

Status

TxPkts

Shows the port speed and duplex setting if you’re using Ethernet Encapsulation and Down (line is down), idle (line (ppp) idle), dial (starting to trigger a call) and

drop (dropping a call) if you’re using PPPoE Encapsulation.

The number of transmitted packets on this port.

317517-A Rev 00

System Information and Diagnosis 29-3

Table 29-1 System Maintenance: Status Menu Fields


RxPkts

Cols

The number of received packets on this port.

The number of collisions on this port.

Tx B/s

Rx B/s

Shows the transmission speed in Bytes per second on this port.

Shows the reception speed in Bytes per second on this port.

Up Time Total amount of time the line has been up.

Ethernet Address The Ethernet address of the port listed on the left.

IP Address

IP Mask

DHCP

System up Time

The IP address of the port listed on the left.

The IP mask of the port listed on the left.

The DHCP setting of the port listed on the left.

The total time the Contivity 221 has been on.

RAS F/W Version The Nortel Networks firmware version and the date created.

Name This is the Contivity 221’s system name + domain name assigned in menu 1. For example, System Name= xxx; Domain Name= baboo.mickey.com

Routing

Name= xxx.baboo.mickey.com

Refers to the routing protocol used.

You may enter 1 to drop the WAN connection, 9 to reset the counters or [ESC] to return to menu 24.

29.3

System Information and Console Port Speed

This section describes your system and allows you to choose different console port speeds. To get to the System Information and Console Port Speed:

Step 1.

Enter 24 to go to Menu 24 – System Maintenance.

Step 4.

Enter 2 to open Menu 24.2 - System Information and Console Port Speed.

Step 5.

From this menu you have two choices as shown in the next figure:



Figure 29-3 Menu 24.2: System Information and Console Port Speed

Menu 24.2 - System Information and Console Port Speed

2. Console Port Speed

Please enter selection:

System Information gives you information about your system as shown below. More specifically, it gives you information on your routing protocol, Ethernet address, IP address, etc.

Figure 29-4 Menu 24.2.1: System Maintenance: Information

Menu 24.2.1 - System Maintenance - Information

Name:

Routing: IP

RAS F/W Version: VE221_2.0.0.0.011_1123 | 11/23/2003

Country Code: 255

LAN

Ethernet Address: 00:A0:C5:00:00:01

IP Address: 192.168.1.1

IP Mask: 255.255.255.0

DHCP: Server

Press ESC or RETURN to Exit:

317517-A Rev 00


Table 29-2 Fields in System Maintenance: Information


Name This is the Contivity 221’s system name + domain name assigned in menu 1. For example, System Name= xxx; Domain Name= baboo.mickey.com

Name= xxx.baboo.mickey.com

Routing

RAS F/W Version

Ethernet Address

IP Address

IP Mask

DHCP

Refers to the routing protocol used.

Refers to the version of Nortel Networks’ Network Operating System software.

Refers to the Ethernet MAC (Media Access Control) address of your

Contivity 221.

This is the IP address of the Contivity 221 in dotted decimal notation.

This shows the IP mask of the Contivity 221.

This field shows the DHCP setting of the Contivity 221.

When finished viewing, press [ESC] or [ENTER] to exit.

You can change the speed of the console port through Menu 24.2.2 – Console Port Speed. Your

Contivity 221 supports 9600 (default), 19200, 38400, 57600, and 115200 bps for the console port.

Press [SPACE BAR] and then [ENTER] to select the desired speed in menu 24.2.2, as shown next.

Figure 29-5 Menu 24.2.2: System Maintenance: Change Console Port Speed

Menu 24.2.2 – System Maintenance – Change Console Port Speed

Console Port Speed: 115200





29.4

Log and Trace

The Contivity 221 has a syslog facility for message logging, and a trace function for viewing calltriggering packets.

Figure 29-6 Menu 24.3: System Maintenance: Log and Trace

Menu 24.3 - System Maintenance - Log and Trace

2. Syslog Logging

4. Call-Triggering Packet

Press ENTER to Confirm or ESC to Cancel

The Contivity 221 uses the syslog facility to log the CDR (Call Detail Record) and system messages to a syslog server. Syslog and accounting can be configured in Menu 24.3.2 - System

Maintenance - Syslog Logging, as shown next.

Figure 29-7 Menu 24.3.2: System Maintenance: Syslog Logging

Menu 24.3.2 - System Maintenance - Syslog Logging

Syslog:

Active= No

Syslog Server IP Address= ?

Log Facility= Local 1

Press ENTER to Confirm or ESC to Cancel

You need to configure the syslog parameters described in the following table to activate syslog then choose what you want to log.

317517-A Rev 00


Table 29-3 System Maintenance Menu Syslog Parameters

PARAMETER DESCRIPTION

Syslog:

Active Press [SPACE BAR] and then [ENTER] to turn syslog on or off.

Syslog Server IP

Address

Enter the IP Address of the server that will log the CDR (Call Detail Record) and system messages i.e., the syslog server.

Log Facility Press [SPACE BAR] and then [ENTER] to select a Local option. The log facility allows you to log the message to different files in the server. Please refer to the documentation of your syslog program for more details.

When finished configuring this screen, press [ENTER] to confirm or [ESC] to cancel.

Your Contivity 221 sends five types of syslog messages. Some examples of these syslog messages with their message formats are shown next:

1.

CDR

CDR Message Format

SdcmdSyslogSend( SYSLOG_CDR, SYSLOG_INFO, String );

String = board xx line xx channel xx, call xx, str board = the hardware board ID line = the WAN ID in a board

Channel = channel ID within the WAN call = the call reference number which starts from 1 and increments by 1 for each new call str = C01 Outgoing Call dev xx ch xx (dev:device No. ch:channel No.)

Tunnel Connected(L2TP)

C02 OutCall Connected xxxx (means connected speed) xxxxx (means Remote Call Number)

L02 Call Terminated

C02 Call Terminated

Jul 19 11:19:27 192.168.102.2 RAS: board 0 line 0 channel 0, call 1, C01 Outgoing Call dev=2 ch=0 40002

Jul 19 11:19:32 192.168.102.2 RAS: board 0 line 0 channel 0, call 1, C02 OutCall Connected 64000

40002

Jul 19 11:20:06 192.168.102.2 RAS: board 0 line 0 channel 0, call 1, C02 Call Terminated

2.

Packet triggered

Packet triggered Message Format

SdcmdSyslogSend( SYSLOG_PKTTRI, SYSLOG_NOTICE, String );

String = Packet trigger: Protocol=xx Data=xxxxxxxxxx…..x

Protocol: (1:IP 2:IPX 3:IPXHC 4:BPDU 5:ATALK 6:IPNG)

Data: We will send forty-eight Hex characters to the server

Jul 19 11:28:39 192.168.102.2 RAS: Packet Trigger: Protocol=1,

Data=4500003c100100001f010004c0a86614ca849a7b08004a5c020001006162636465666768696a6b6c6d6e6f707172

7374


Data=4500002c1b0140001f06b50ec0a86614ca849a7b0427001700195b3e00000000600220008cd40000020405b4


Data=45000028240140001f06ac12c0a86614ca849a7b0427001700195b451d1430135004000077600000



3.

Filter log

Filter log Message Format

SdcmdSyslogSend(SYSLOG_FILLOG, SYSLOG_NOTICE, String );

String = IP[Src=xx.xx.xx.xx Dst=xx.xx.xx.xx prot spo=xxxx dpo=xxxx] S04>R01mD

IP[…] is the packet header and S04>R01mD means filter set 4 (S) and rule 1 (R), match (m) drop

(D).

Dst: Destination Address prot: Protocol (“TCP”,”UDP”,”ICMP”) spo: Source port dpo: Destination port

Mar 03 10:39:43 202.132.155.97 RAS:

GEN[fffffffffffnordff0080] }S05>R01mF

Mar 03 10:41:29 202.132.155.97 RAS:

GEN[00a0c5f502fnord010080] }S05>R01mF

Mar 03 10:41:34 202.132.155.97 RAS:

IP[Src=192.168.1.33 Dst=202.132.155.93 ICMP]}S04>R01mF

Mar 03 11:59:20 202.132.155.97 RAS:

GEN[00a0c5f502fnord010080] }S05>R01mF

Mar 03 12:00:52 202.132.155.97 RAS:

GEN[ffffffffffff0080] }S05>R01mF

Mar 03 12:00:57 202.132.155.97 RAS:

GEN[00a0c5f502010080] }S05>R01mF

Mar 03 12:01:06 202.132.155.97 RAS:

IP[Src=192.168.1.33 Dst=202.132.155.93 TCP spo=01170 dpo=00021]}S04>R01mF

4.

PPP log

PPP Log Message Format

SdcmdSyslogSend( SYSLOG_PPPLOG, SYSLOG_NOTICE, String );

String = ppp:Proto Starting / ppp:Proto Opening / ppp:Proto Closing / ppp:Proto Shutdown

Proto = LCP / ATCP / BACP / BCP / CBCP / CCP / CHAP/ PAP / IPCP /

IPXCP

Jul 19 11:42:44 192.168.102.2 RAS: ppp:LCP Closing

Jul 19 11:42:49 192.168.102.2 RAS: ppp:IPCP Closing

Jul 19 11:42:54 192.168.102.2 RAS: ppp:CCP Closing

317517-A Rev 00


5.

Firewall log

Firewall Log Message Format

SdcmdSyslogSend(SYSLOG_FIREWALL, SYSLOG_NOTICE, buf); buf = IP[Src=xx.xx.xx.xx : spo=xxxx Dst=xx.xx.xx.xx : dpo=xxxx | prot | rule | action]

Src: Source Address spo: Source port (empty means no source port information)

Dst: Destination Address dpo: Destination port (empty means no destination port information) prot: Protocol (“TCP”,”UDP”,”ICMP”, ”IGMP”, ”GRE”, ”ESP”) rule: <a,b> where a means "set" number; b means "rule" number.

Action: nothing(N) block (B) forward (F)

RAS: FW 172.21.1.80 :137 192.168.10.10

>172.21.1.80 :137 |UDP|default permit:<2,0>|B

192.168.10.10

>192.168.77.88 :520 |UDP|default permit:<2,0>|B

192.168.10.10

RAS: FW 192.168.77.88 :520 -

RAS: FW 172.21.1.50 ->172.21.1.50

|IGMP<2>|default permit:<2,0>|B

192.168.10.10 RAS: FW 172.21.1.25 ->172.21.1.25

|IGMP<2>|default permit:<2,0>|B

Call-Triggering Packet displays information about the packet that triggered a dial-out call in an easy readable format. Equivalent information is available in menu 24.1 in hex format. An example is shown next.



Figure 29-8 Call-Triggering Packet Example

IP Frame: ENET0-RECV Size: 44/ 44 Time: 17:02:44.262

Frame Type:

IP Header:

IP Version = 4

Header Length = 20

Type of Service = 0x00 (0)

Total Length = 0x002C (44)

Identification = 0x0002 (2)

Flags = 0x00

Fragment Offset = 0x00

Time to Live = 0xFE (254)

Protocol = 0x06 (TCP)

Header Checksum = 0xFB20 (64288)

Source IP = 0xC0A80101 (192.168.1.1)

Destination IP = 0x00000000 (0.0.0.0)

TCP Header:

Source Port = 0x0401 (1025)

Destination Port = 0x000D (13)

Sequence Number = 0x05B8D000 (95997952)

Ack Number = 0x00000000 (0)

Header Length = 24

Flags = 0x02 (....S.)

Window Size = 0x2000 (8192)

Checksum = 0xE06A (57450)

Urgent Ptr = 0x0000 (0)

Options =

0000: 02 04 02 00

RAW DATA:

0000: 45 00 00 2C 00 02 00 00-FE 06 FB 20 C0 A8 01 01 E......... ....

0010: 00 00 00 00 04 01 00 0D-05 B8 D0 00 00 00 00 00 ................

0020: 60 02 20 00 E0 6A 00 00-02 04 02 00

Press any key to continue...

Diagnostic

The diagnostic facility allows you to test the different aspects of your Contivity 221 to determine if it is working properly. Menu 24.4 allows you to choose among various types of diagnostic tests to evaluate your system, as shown next.

Follow the procedure below to get to Menu 24.4 - System Maintenance – Diagnostic.

Step 1.

From the main menu, select option 24 to open Menu 24 - System Maintenance.

317517-A Rev 00


Step 2.

From this menu, select option 4. Diagnostic. This will open Menu 24.4 - System

Maintenance - Diagnostic.

Figure 29-9 Menu 24.4: System Maintenance: Diagnostic

Menu 24.4 - System Maintenance - Diagnostic

TCP/IP

1.

Ping Host

2.

WAN DHCP Release

3.

WAN DHCP Renewal

4. Internet Setup Test

System

11. Reboot System


Host IP Address= N/A

DHCP functionality can be enabled on the LAN or WAN as shown in

Figure 29-10

. LAN DHCP has already been discussed. The Contivity 221 can act either as a WAN DHCP client (IP Address

Assignment field in menu 4 or menu 11.3 is Dynamic and the Encapsulation field in menu 4 or

menu 11 is Ethernet) or None, (when you have a static IP). The WAN Release and Renewal fields in menu 24.4 conveniently allow you to release and/or renew the assigned WAN IP address, subnet mask and default gateway in a fashion similar to winipcfg.







Figure 29-10 WAN & LAN DHCP

The following table describes the diagnostic tests available in menu 24.4 for your Contivity 221 and associated connections.

Table 29-4 System Maintenance Menu Diagnostic


Ping Host

WAN DHCP Release

WAN DHCP Renewal

Internet Setup Test

Enter 1 to ping any machine (with an IP address) on your LAN or WAN.

Enter its IP address in the Host IP Address field below.

Enter 2 to release your WAN DHCP settings.

Enter 3 to renew your WAN DHCP settings.

Enter 4 to test the Internet setup. You can also test the Internet setup in

Menu 4 - Internet Access. Please refer to the Internet Access chapter for more details. This feature is only available for dial-up connections using

PPPoE or PPTP encapsulation.

Reboot System

Host IP Address=

Enter 11 to reboot the Contivity 221.

If you entered 1 in Ping Host, then enter the IP address of the computer you want to ping in this field.

Enter the number of the selection you would like to perform or press [ESC] to cancel.

317517-A Rev 00

30-1

Chapter 30

Firmware and Configuration File Maintenance

This chapter tells you how to back up and restore your configuration file as well as upload new firmware and a new configuration file.

30.1

Introduction

Use the instructions in this chapter to change the Contivity 221’s configuration file or upgrade its firmware. After you configure your Contivity 221, you can backup the configuration file to a computer. That way if you later misconfigure the Contivity 221, you can upload the backed up configuration file to return to your previous settings. You can alternately upload the factory default configuration file if you want to return the Contivity 221 to the original default settings.

The firmware determines the Contivity 221’savailable features and functionality. You can download new firmware releases from http://www.nortelnetworks.com/index.html

to use to upgrade your Contivity 221’s performance.

30.2

Filename Conventions

The configuration file (often called the romfile or rom-0) contains the factory default settings in the menus such as password, DHCP Setup, TCP/IP Setup, etc. It arrives from Nortel Networks with a “rom” filename extension. Once you have customized the Contivity 221’ssettings, they can be saved back to your computer under a filename of your choosing.

The “ras” file is the system firmware and has a “bin” filename extension. With many FTP and

TFTP clients, the filenames are similar to those seen next. ftp> put firmware.bin ras

This is a sample FTP session showing the transfer of the computer file " firmware.bin" to the

Contivity 221.


30-2 Firmware and Configuration File Maintenance ftp> get rom-0 config.cfg

This is a sample FTP session saving the current configuration to the computer file “config.cfg”.

If your (T)FTP client does not allow you to have a destination filename different than the source, you will need to rename them as the Contivity 221 only recognizes “rom-0” and “ras”. Be sure you keep unaltered copies of both files for later use.

The following table is a summary. Please note that the internal filename refers to the filename on the Contivity 221 and the external filename refers to the filename not on the Contivity 221, that is, on your computer, local network or FTP site and so the name (but not the extension) may vary.

After uploading new firmware, see the RAS F/W Version field in Menu 24.2.1 - System

Maintenance - Information to confirm that you have uploaded the correct firmware version. The

AT command is the command you enter after you press “y” when prompted in the SMT menu to go into debug mode.

Table 30-1 Filename Conventions

FILE TYPE INTERNAL

NAME

Configuration

File

Rom-0

Firmware Ras

EXTERNAL NAME

This is the configuration filename on the Contivity

221. Uploading the rom-0 file replaces the entire

ROM file system, including your Contivity

221configurations, system-related data (including the default password), the error log and the trace log.

This is the generic name for the Nortel Networks firmware on the Contivity 221.

DESCRIPTION

*.rom

*.bin

33.1 Backup Configuration

The Contivity 221 displays different messages explaining different ways to backup, restore and upload files in menus 24.5, 24.6, 24. 7.1 and 24.7.2 depending on whether you use the console port or Telnet.

Option 5 from Menu 24 - System Maintenance allows you to backup the current Contivity 221 configuration to your computer. Backup is highly recommended once your Contivity 221 is functioning properly. FTP is the preferred method for backing up your current configuration to

317517-A Rev 00

Firmware and Configuration File Maintenance 30-3 your computer since it is faster. You can also perform backup and restore using menu 24 through the console port. Any serial communications program should work fine; however, you must use

Xmodem protocol to perform the download/upload and you don’t have to rename the files.

Please note that terms “download” and “upload” are relative to the computer. Download means to transfer from the Contivity 221 to the computer, while upload means from your computer to the

Contivity 221.

Follow the instructions as shown in the next screen.

Figure 30-1 Telnet into Menu 24.5

Menu 24.5 - System Maintenance - Backup Configuration

To transfer the configuration file to your workstation, follow the procedure below:

1. Launch the FTP client on your workstation.

2. Type "open" and the IP address of your router. Then type "root" and

SMT password as requested.

3. Locate the 'rom-0' file.

4. Type 'get rom-0' to back up the current router configuration to

your workstation.

For details on FTP commands, please consult the documentation of your FTP client program. For details on backup using TFTP (note that you must remain in this menu to back up using TFTP), please see your router manual.

Press ENTER to Exit:

30.2.2 Using the FTP Command from the Command Line

Step 1.

Step 2.

Step 3.

Step 4.

Step 5.

Step 6.

Launch the FTP client on your computer.

Enter “open”, followed by a space and the IP address of your Contivity 221.

Press [ENTER] when prompted for a username.

Enter your password as requested (the default is “setup”).

Enter “bin” to set transfer mode to binary.

Use “get” to transfer files from the Contivity 221 to the computer, for example, “get


30-4 Firmware and Configuration File Maintenance rom-0 config.rom” transfers the configuration file on the Contivity 221 to your computer and renames it “config.rom”. See earlier in this chapter for more information on filename conventions.

Step 7.

Enter “quit” to exit the ftp prompt.

30.2.3 Example of FTP Commands from the Command Line

Figure 30-2 FTP Session Example

331 Enter PASS command

Password:

230 Logged in ftp> bin

200 Type I OK ftp> get rom-0 Nortel.rom

200 Port command okay

150 Opening data connection for STOR ras

226 File received OK ftp: 16384 bytes sent in 1.10Seconds 297.89Kbytes/sec. ftp> quit

30.2.4 GUI-based FTP Clients

The following table describes some of the commands that you may see in GUI-based FTP clients.

Table 30-2 General Commands for GUI-based FTP Clients

COMMAND DESCRIPTION

Host Address Enter the address of the host server.

Login Type Anonymous.

This is when a user I.D. and password is automatically supplied to the server for anonymous access. Anonymous logins will work only if your ISP or service administrator has enabled this option.

Normal.

The server requires a unique User ID and Password to login.

317517-A Rev 00

Firmware and Configuration File Maintenance 30-5

Table 30-2 General Commands for GUI-based FTP Clients


Transfer Type Transfer files in either ASCII (plain text format) or in binary mode.

Configuration and firmware files should be transferred in binary mode.

Initial Remote Directory

Initial Local Directory

Specify the default remote directory (path).

Specify the default local directory (path).

TFTP, FTP and Telnet over the WAN will not work when:

1. The firewall is active (turn the firewall off in menu 21.2 or create a firewall rule to allow access from the WAN).

2. You have disabled Telnet service in menu 24.11.

3. You have applied a filter in menu 3.1 (LAN) or in menu 11.5 (WAN) to block Telnet service.

4. The IP you entered in the Secured Client IP field in menu 24.11 does not match the client IP.

If it does not match, the Contivity 221 will disconnect the Telnet session immediately.

5. You have an SMT console session running.

30.2.6 Backup Configuration Using TFTP

The Contivity 221 supports the up/downloading of the firmware and the configuration file using

TFTP (Trivial File Transfer Protocol) over LAN. Although TFTP should work over WAN as well, it is not recommended.

To use TFTP, your computer must have both telnet and TFTP clients. To backup the configuration file, follow the procedure shown next.

Step 1.

Use telnet from your computer to connect to the Contivity 221 and log in. Because TFTP does not have any security checks, the Contivity 221 records the IP address of the telnet client and accepts TFTP requests only from this address.

Step 2.

Put the SMT in command interpreter (CI) mode by entering 8 in Menu 24 – System

Maintenance.


30-6 Firmware and Configuration File Maintenance

Step 3.

Enter command “sys stdio 0” to disable the SMT timeout, so the TFTP transfer will not be interrupted. Enter command “sys stdio 5” to restore the five-minute SMT timeout (default) when the file transfer is complete.

Step 4.

Launch the TFTP client on your computer and connect to the Contivity 221. Set the transfer mode to binary before starting data transfer.

Step 5.

Use the TFTP client (see the example below) to transfer files between the Contivity 221 and the computer. The file name for the configuration file is “rom-0” (rom-zero, not capital o).

Note that the telnet connection must be active and the SMT in CI mode before and during the

TFTP transfer. For details on TFTP commands (see following example), please consult the documentation of your TFTP client program. For UNIX, use “get” to transfer from the Contivity

221 to the computer and “binary” to set binary transfer mode.

The following is an example TFTP command: tftp [-i] host get rom-0 config.rom

Where “i” specifies binary image transfer mode (use this mode when transferring binary files),

“host” is the Contivity 221 IP address, “get” transfers the file source on the Contivity 221 (rom-0, name of the configuration file on the Contivity 221) to the file destination on the computer and renames it config.rom.

30.2.8 GUI-based TFTP Clients

The following table describes some of the fields that you may see in GUI-based TFTP clients.

Table 30-3 General Commands for GUI-based TFTP Clients


Host Enter the IP address of the Contivity 221. 192.168.1.1 is the Contivity 221’s default IP address when shipped.

Send/Fetch Use “Send” to upload the file to the Contivity 221 and “Fetch” to back up the file on your computer.

317517-A Rev 00


Table 30-3 General Commands for GUI-based TFTP Clients

Local File Enter the path and name of the firmware file (*.bin extension) or configuration file (*.rom extension) on your computer.

Remote File This is the filename on the Contivity 221. The filename for the firmware is “ras” and for the configuration file, is “rom-0”.

Binary Transfer the file in binary mode.

Abort Stop transfer of the file.

Refer to section 30.2.5 to read about configurations that disallow TFTP and FTP over WAN.

30.2.9 Backup Via Console Port

Back up configuration via console port by following the HyperTerminal procedure shown next.

Procedures using other serial communications programs should be similar.

Step 1.

Display menu 24.5 and enter “y” at the following screen.

Figure 30-3 System Maintenance: Backup Configuration

Ready to backup Configuration via Xmodem.

Do you want to continue (y/n):

Step 2.

The following screen indicates that the Xmodem download has started.

Figure 30-4 System Maintenance: Starting Xmodem Download Screen

You can enter ctrl-x to terminate operation any time.

Starting XMODEM download...

Step 3.

Run the HyperTerminal program by clicking Transfer, then Receive File as shown in the following screen.



Figure 30-5 Backup Configuration Example

Type a location for storing the configuration file or click Browse to look for one.


Then click Receive.

Step 4.

After a successful backup you will see the following screen. Press any key to return to the SMT menu.

Figure 30-6 Successful Backup Confirmation Screen

** Backup Configuration completed. OK.

### Hit any key to continue.###

33.2 Restore Configuration

This section shows you how to restore a previously saved configuration. Note that this function erases the current configuration before restoring a previous back up configuration; please do not attempt to restore unless you have a backup configuration file stored on disk.

FTP is the preferred method for restoring your current computer configuration to your Contivity

221 since FTP is faster. Please note that you must wait for the system to automatically restart after the file transfer is complete.

317517-A Rev 00


WARNING!

Do not interrupt the file transfer process as this may PERMANENTLY DAMAGE

YOUR Contivity 221. When the Restore Configuration process is complete, the

Contivity 221 will automatically restart.

30.2.10 Restore Using FTP

For details about backup using (T)FTP please refer to earlier sections on FTP and TFTP file upload in this chapter.

Figure 30-7 Telnet into Menu 24.6

Menu 24.6 -- System Maintenance - Restore Configuration

To transfer the firmware and configuration file to your workstation, follow the procedure below:


2. Type "open" and the IP address of your router. Then type "root" and


3. Type "put backupfilename rom-0" where backupfilename is the name of

your backup configuration file on your workstation and rom-0 is the

remote file name on the router. This restores the configuration to

your router.

4. The system reboots automatically after a successful file transfer

For details on FTP commands, please consult the documentation of your FTP client program. For details on backup using TFTP (note that you must remain in this menu to back up using TFTP), please see your router manual.


Step 1.

Step 2.

Step 3.

Step 4.

Step 5.

Step 6.






Find the “rom” file (on your computer) that you want to restore to your Contivity 221.



Step 7.

Step 8.

Use “put” to transfer files from the Contivity 221 to the computer, for example, “put config.rom rom-0” transfers the configuration file “config.rom” on your computer to the Contivity 221. See earlier in this chapter for more information on filename conventions.

Enter “quit” to exit the ftp prompt. The Contivity 221 will automatically restart after a successful restore process.

30.2.11 Restore Using FTP Session Example

Figure 30-8 Restore Using FTP Session Example

ftp> put config.rom rom-0


150 Opening data connection for STOR rom-0

226 File received OK

221 Goodbye for writing flash ftp: 16384 bytes sent in 0.06Seconds 273.07Kbytes/sec. ftp>quit


30.2.12 Restore Via Console Port

Restore configuration via console port by following the HyperTerminal procedure shown next.

Procedures using other serial communications programs should be similar.

Step 1.

Display menu 24.6 and enter “y” at the following screen.

Figure 30-9 System Maintenance: Restore Configuration

Ready to restore Configuration via Xmodem.

Do you want to continue (y/n):

Step 2.

The following screen indicates that the Xmodem download has started.

317517-A Rev 00


Starting XMODEM download (CRC mode) ...

CCCCCCCCC

Figure 30-10 System Maintenance: Starting Xmodem Download Screen

Step 3.

Run the HyperTerminal program by clicking Transfer, then Send File as shown in the following screen.

Figure 30-11 Restore Configuration Example




Step 4.

After a successful restoration you will see the following screen. Press any key to restart the Contivity 221 and return to the SMT menu.

Figure 30-12 Successful Restoration Confirmation Screen

Save to ROM

Hit any key to start system reboot.

33.3 Uploading Firmware and Configuration Files

This section shows you how to upload firmware and configuration files. You can upload configuration files by following the procedure in the previous Restore Configuration section or by


30-12 Firmware and Configuration File Maintenance following the instructions in Menu 24.7.2 - System Maintenance - Upload System

Configuration File (for console port).

WARNING!

Do not interrupt the file transfer process as this may PERMANENTLY DAMAGE

YOUR Contivity 221.

FTP is the preferred method for uploading the firmware and configuration. To use this feature, your computer must have an FTP client.

When you telnet into the Contivity 221, you will see the following screens for uploading firmware and the configuration file using FTP.

Figure 30-13 Telnet Into Menu 24.7.1: Upload System Firmware

Menu 24.7.1 - System Maintenance - Upload System Firmware

To upload the system firmware, follow the procedure below:


2. Type "open" and the IP address of your system. Then type "root" and


3. Type "put firmwarefilename ras" where "firmwarefilename" is the name

of your firmware upgrade file on your workstation and "ras" is the

remote file name on the system.

4. The system reboots automatically after a successful firmware upload.

For details on FTP commands, please consult the documentation of your FTP client program. For details on uploading system firmware using TFTP (note that you must remain on this menu to upload system firmware using TFTP), please see your manual.


317517-A Rev 00


30.2.14 Configuration File Upload

You see the following screen when you telnet into menu 24.7.2.

Figure 30-14 Telnet Into Menu 24.7.2: System Maintenance

Menu 24.7.2 - System Maintenance - Upload System Configuration File

To upload the system configuration file, follow the procedure below:


2. Type "open" and the IP address of your system. Then type "root" and


3. Type "put configurationfilename rom-0" where "configurationfilename"

is the name of your system configuration file on your workstation, which

will be transferred to the "rom-0" file on the system.

4. The system reboots automatically after the upload system configuration

file process is complete.

For details on FTP commands, please consult the documentation of your FTP client program. For details on uploading configuration file using TFTP (note that you must remain on this menu to upload configuration file using TFTP), please see your manual.


To upload the firmware and the configuration file, follow these examples

30.2.15 FTP File Upload Command from the DOS Prompt

Example

Step 1.

Step 2.

Step 3.

Step 4.

Step 5.

Step 6.






Use “put” to transfer files from the computer to the Contivity 221, for example, “put firmware.bin ras” transfers the firmware on your computer (firmware.bin) to the



Step 7.

Contivity 221 and renames it “ras”. Similarly, “put config.rom rom-0” transfers the configuration file on your computer (config.rom) to the Contivity 221 and renames it

“rom-0”. Likewise “get rom-0 config.rom” transfers the configuration file on the

Contivity 221 to your computer and renames it “config.rom.” See earlier in this chapter for more information on filename conventions.

Enter “quit” to exit the ftp prompt.

30.2.16 FTP Session Example of Firmware File Upload

Figure 30-15 FTP Session Example of Firmware File Upload

331 Enter PASS command

Password:

230 Logged in ftp> bin

200 Type I OK ftp> put firmware.bin ras


150 Opening data connection for STOR ras

226 File received OK ftp: 1103936 bytes sent in 1.10Seconds 297.89Kbytes/sec. ftp> quit

More commands (found in GUI-based FTP clients) are listed earlier in this chapter.


The Contivity 221 also supports the uploading of firmware files using TFTP (Trivial File Transfer

Protocol) over LAN. Although TFTP should work over WAN as well, it is not recommended.

To use TFTP, your computer must have both telnet and TFTP clients. To transfer the firmware and the configuration file, follow the procedure shown next.

Step 1.

Use telnet from your computer to connect to the Contivity 221 and log in. Because

TFTP does not have any security checks, the Contivity 221 records the IP address of the telnet client and accepts TFTP requests only from this address.

317517-A Rev 00


Step 2.

Step 3.

Step 4.

Step 5.

Put the SMT in command interpreter (CI) mode by entering 8 in Menu 24 – System

Maintenance.

Enter the command “sys stdio 0” to disable the console timeout, so the TFTP transfer will not be interrupted. Enter “command sys stdio 5” to restore the five-minute console timeout (default) when the file transfer is complete.

Launch the TFTP client on your computer and connect to the Contivity 221. Set the transfer mode to binary before starting data transfer.

Use the TFTP client (see the example below) to transfer files between the Contivity 221 and the computer. The file name for the firmware is “ras”.

Note that the telnet connection must be active and the Contivity 221 in CI mode before and during the TFTP transfer. For details on TFTP commands (see following example), please consult the documentation of your TFTP client program. For UNIX, use “get” to transfer from the Contivity

221 to the computer, “put” the other way around, and “binary” to set binary transfer mode.

30.2.18 TFTP Upload Command Example

The following is an example TFTP command: tftp [-i] host put firmware.bin ras

Where “i” specifies binary image transfer mode (use this mode when transferring binary files),

“host” is the Contivity 221’s IP address, “put” transfers the file source on the computer

(firmware.bin – name of the firmware on the computer) to the file destination on the remote host

(ras - name of the firmware on the Contivity 221).

Commands that you may see in GUI-based TFTP clients are listed earlier in this chapter.

30.2.19 Uploading Via Console Port

FTP or TFTP are the preferred methods for uploading firmware to your Contivity 221. However, in the event of your network being down, uploading files is only possible with a direct connection to your Contivity 221 via the console port. Uploading files via the console port under normal conditions is not recommended since FTP or TFTP is faster. Any serial communications program should work fine; however, you must use the Xmodem protocol to perform the download/upload.



30.2.20 Uploading Firmware File Via Console Port

Step 1.

Select 1 from Menu 24.7 – System Maintenance – Upload Firmware to display

Menu 24.7.1 - System Maintenance - Upload System Firmware, and then follow the

instructions as shown in the following screen.

Figure 30-16 Menu 24.7.1 As Seen Using the Console Port

Menu 24.7.1 - System Maintenance - Upload System Firmware

To upload system firmware:

1. Enter "y" at the prompt below to go into debug mode.

2. Enter "atur" after "Enter Debug Mode" message.

3. Wait for "Starting XMODEM upload" message before activating

Xmodem upload on your terminal.

4. After successful firmware upload, enter "atgo" to restart the

router.

Warning: Proceeding with the upload will erase the current system

firmware.

Do You Wish To Proceed:(Y/N)

Step 2.

After the "Starting Xmodem upload" message appears, activate the Xmodem protocol on your computer. Follow the procedure as shown previously for the HyperTerminal program. The procedure for other serial communications programs should be similar.

317517-A Rev 00


30.2.21 Example Xmodem Firmware Upload Using

HyperTerminal



Type the firmware file’s location, or click Browse to look for it.



After the firmware upload process has completed, the Contivity 221 will automatically restart.

30.2.22 Uploading Configuration File Via Console Port

Step 1.

Select 2 from Menu 24.7 – System Maintenance – Upload Firmware to display

Menu 24.7.2 - System Maintenance - Upload System Configuration File. Follow the

instructions as shown in the next screen.



Figure 30-18 Menu 24.7.2 As Seen Using the Console Port

Menu 24.7.2 - System Maintenance - Upload System Configuration File

To upload system configuration file:

1. Enter "y" at the prompt below to go into debug mode.

2. Enter "atlc" after "Enter Debug Mode" message.

3. Wait for "Starting XMODEM upload" message before activating

Xmodem upload on your terminal.

4. After successful firmware upload, enter "atgo" to restart the

system.

Warning:

1. Proceeding with the upload will erase the current

configuration file.

2. The system’s console port speed (Menu 24.2.2) may change

when it is restarted; please adjust your terminal's speed

accordingly. The password may change (menu 23), also.

3. When uploading the DEFAULT configuration file, the console

port speed will be reset to 9600 bps and the password to

"setup".

Do You Wish To Proceed:(Y/N)

Step 2.

Step 3.

After the "Starting Xmodem upload" message appears, activate the Xmodem protocol on your computer. Follow the procedure as shown previously for the HyperTerminal program. The procedure for other serial communications programs should be similar.

Enter “atgo” to restart the Contivity 221.

30.2.23 Example Xmodem Configuration Upload Using

HyperTerminal


317517-A Rev 00






After the configuration upload process has completed, restart the Contivity 221 by entering

“atgo”.


31-1

Chapter 31

System Maintenance Menus 8 to 10

This chapter leads you through SMT menus 24.8 to 24.10.

31.1

Command Interpreter Mode

The Command Interpreter (CI) is a part of the main router firmware. The CI provides much of the same functionality as the SMT, while adding some low-level setup and diagnostic functions.

Enter the CI from the SMT by selecting menu 24.8. Access can be by Telnet or by a serial connection to the console port, although some commands are only available with a serial connection. See the included disk or nortelnetworks.com for more detailed information on CI commands. Enter 8 from Menu 24 - System Maintenance.

Use of undocumented commands or misconfiguration can damage the unit and possibly render it unusable.

Figure 31-1 Command Mode in Menu 24


1. System Status

2. System Information and Console Port Speed

3. Log and Trace

4. Diagnostic

5. Backup Configuration

6. Restore Configuration

7. Firmware Update

8. Command Interpreter Mode

9. Call Control

10. Time and Date Setting

11. Remote Management Setup



31-2 System Maintenance Menus 8 to 10

The command keywords are in courier new font.

Enter the command keywords exactly as shown, do not abbreviate.

The required fields in a command are enclosed in angle brackets <>.

The optional fields in a command are enclosed in square brackets [].

The |symbol means “or”.

For example, sys filter netbios config <type> <on|off> means that you must specify the type of netbios filter and whether to turn it on or off.

A list of commands can be found by typing help or ? at the command prompt. Always type the full command. Type exit to return to the SMT main menu when finished.

Figure 31-2 Valid Commands

ras> ?

Valid commands are: sys exit ether ip ipsec

Table 31-1 Valid Commands

COMMAND

sys exit ether ip ipsec

DESCRIPTION

The system commands display device information and configure device settings.

This command returns you to the SMT main menu.

These commands display Ethernet information and configure Ethernet settings.

These commands display IP information and configure IP settings.

These commands display IPSec information and configure IPSec settings.

317517-A Rev 00

System Maintenance Menus 8 to 10 31-3

31.2

Call Control Support

The Contivity 221 provides two call control functions: budget management and call history.

Please note that this menu is only applicable when Encapsulation is set to PPPoE or PPTP in menu 4 or menu 11.1.

The budget management function allows you to set a limit on the total outgoing call time of the

Contivity 221 within certain times. When the total outgoing call time exceeds the limit, the current call will be dropped and any future outgoing calls will be blocked.

Call history chronicles preceding incoming and outgoing calls.

To access the call control menu, select option 9 in menu 24 to go to Menu 24.9 - System

Maintenance - Call Control, as shown in the next table.

Figure 31-3 Call Control

Menu 24.9 - System Maintenance - Call Control

1.Budget Management

2.Call History


Menu 24.9.1 shows the budget management statistics for outgoing calls. Enter 1 from Menu 24.9

- System Maintenance - Call Control to bring up the following menu.



Figure 31-4 Budget Management

Remote Node

1.ChangeMe

2.GUI

Menu 24.9.1 - Budget Management

Connection Time/Total Budget

No Budget

No Budget

Elapsed Time/Total Period

No Budget

No Budget

Reset Node (0 to update screen):

The total budget is the time limit on the accumulated time for outgoing calls to a remote node.

When this limit is reached, the call will be dropped and further outgoing calls to that remote node will be blocked. After each period, the total budget is reset. The default for the total budget is 0 minutes and the period is 0 hours, meaning no budget control. You can reset the accumulated connection time in this menu by entering the index of a remote node. Enter 0 to update the screen.

The budget and the reset period can be configured in menu 11.1 for the remote node.

Table 31-2 Budget Management

FIELD

Remote Node

DESCRIPTION

Enter the index number of the remote node you want to reset (just one in this case)

EXAMPLE

1

Connection

Time/Total Budget

Elapsed Time/Total

Period

This is the total connection time that has gone by

(within the allocated budget that you set in menu

11.1).

The period is the time cycle in hours that the allocation budget is reset (see menu 11.1.) The elapsed time is the time used up within this period.

5/10 means that 5 minutes out of a total allocation of 10 minutes have lapsed.

0.5/1 means that 30 minutes out of the 1hour time period has lapsed.

Enter “0” to update the screen or press [ESC] to return to the previous screen.

317517-A Rev 00


This is the second option in Menu 24.9 - System Maintenance - Call Control. It displays information about past incoming and outgoing calls. Enter 2 from Menu 24.9 - System

Maintenance - Call Control to bring up the following menu.

Figure 31-5 Call History

Menu 24.9.2 - Call History

Phone Number

1.

2.

3.

4.

5.

6.

7.

8.

9.

10.

Dir Rate #call Max

Enter Entry to Delete(0 to exit):

Min


Table 31-3 Call History Fields


Total

Phone Number The PPPoE service names are shown here.

Dir This shows whether the call was incoming or outgoing.

Rate

#call

This is the transfer rate of the call.

This is the number of calls made to or received from that telephone number.

Max

Min

This is the length of time of the longest telephone call.

This is the length of time of the shortest telephone call.

Total This is the total length of time of all the telephone calls to/from that telephone number.

You may enter an entry number to delete it or ‘”0” to exit.



31.3

Time and Date Setting

There is a software mechanism to set the time manually or get the current time and date from an external server when you turn on your Contivity 221. Menu 24.10 allows you to update the time and date settings of your Contivity 221. The real time is then displayed in the Contivity 221 error logs and firewall logs.

Select menu 24 in the main menu to open Menu 24 - System Maintenance, as shown next.

Figure 31-6 Menu 24: System Maintenance


1. System Status

2.

System Information and Console Port Speed

3.

Log and Trace

4.

Diagnostic

5.

Backup Configuration

6.

Restore Configuration

7.

Upload Firmware

8.

Command Interpreter Mode

9.

Call Control

10.

Time and Date Setting

11.

Remote Management Setup


Enter 10 to go to Menu 24.10 - System Maintenance - Time and Date Setting to update the time and date settings of your Contivity 221 as shown in the following screen.

317517-A Rev 00


Figure 31-7 Menu 24.10 System Maintenance: Time and Date Setting

Menu 24.10 - System Maintenance - Time and Date Setting

Use Time Server when Bootup= NTP (RFC-1305)

Time Server Address= time-b.nist.gov

Current Time: 00 : 00 : 00

New Time (hh:mm:ss): 11 : 23 : 16

Current Date: 2000 - 01 - 01

New Date (yyyy-mm-dd): 2001 - 03 - 01

Time Zone= GMT+0800

Daylight Saving= No

Start Date (mm-dd): 01 – 01

End Date (mm_dd): 01 – 01



Table 31-4 Time and Date Setting Fields


Use Time Server when Bootup

Time Server

Address

Current Time

New Time

Current Date

New Date

Enter the time service protocol that your timeserver sends when you turn on the

Contivity 221. Not all timeservers support all protocols, so you may have to check with your ISP/network administrator or use trial and error to find a protocol that works. The main differences between them are the format.

Daytime (RFC 867) format is day/month/year/time zone of the server.

Time (RFC-868) format displays a 4-byte integer giving the total number of seconds since 1970/1/1 at 0:0:0.

NTP (RFC-1305) the default, is similar to Time (RFC-868).

None enter the time manually.

Enter the IP address or domain name of your timeserver. Check with your

ISP/network administrator if you are unsure of this information. The default is timeb.nist.gov

This field displays an updated time only when you reenter this menu.

Enter the new time in hour, minute and second format.

This field displays an updated date only when you reenter this menu.

Enter the new date in year, month and day format.



Table 31-4 Time and Date Setting Fields


Time Zone Press [SPACE BAR] and then [ENTER] to set the time difference between your time zone and Greenwich Mean Time (GMT).

Daylight Saving Daylight Saving Time is a period from late spring to early fall when many countries set their clocks ahead of normal local time by one hour to give more daylight time in the evenings. If you use daylight savings time, then choose Yes.

Start Date Enter the month and day that your daylight-savings time starts on if you selected

Yes in the Daylight Saving field.

End Date Enter the month and day that your daylight-savings time ends on if you selected

Yes in the Daylight Saving field.

Once you have filled in this menu, press [ENTER] at the message “Press ENTER to Confirm or ESC to

Cancel“ to save your configuration, or press [ESC] to cancel.

31.3.1 Resetting the Time

The Contivity 221 resets the time in three instances: i. On leaving menu 24.10 after making changes. ii. When the Contivity 221 starts up, if there is a timeserver configured in menu 24.10. iii. 24-hour intervals after starting.

317517-A Rev 00

32-1

Chapter 32

Remote Management

This chapter covers remote management found in SMT menu 24.11.

32.1

Remote Management

Remote management allows you to determine which services/protocols can access which

Contivity 221 interface (if any) from which computers.

You may manage your Contivity 221 from a remote location via:

¾ Internet (WAN only)

¾ Neither (Disable).

When you Choose WAN only or ALL (LAN & WAN), you still need to configure a

firewall rule to allow access.

To disable remote management of a service, select Disable in the corresponding Server Access field.

Enter 11 from menu 24 to bring up Menu 24.11 – Remote Management Control.


32-2 Remote Management

Figure 32-1 Menu 24.11 – Remote Management Control

Menu 24.11 - Remote Management Control

TELNET Server: Port = 23 Access = LAN only

Secured Client IP = 0.0.0.0

FTP Server: Port = 21 Access = LAN only


Web Server: Port = 80 Access = LAN only


SNMP Service: Port = 161 Access = LAN only


DNS Service: Port = 53 Access = LAN only




Table 32-1 Menu 24.11 – Remote Management Control


Telnet Server

FTP Server

Web Server

SNMP Service

DNS Service

Server Port

Each of these read-only labels denotes a service or protocol.

This field shows the port number for the service or protocol. You may change the port number if needed, but you must use the same port number to access the Contivity 221.

23

Server Access Select the access interface (if any) by pressing [SPACE BAR], then

[ENTER] to choose from: LAN only, WAN only, ALL or Disable.

Secured Client

IP

The default 0.0.0.0 allows any client to use this service or protocol to remotely access the Contivity 221. Enter an IP address to restrict access to a client with a matching IP address.

LAN Only

(default)

0.0.0.0

Once you have filled in this menu, press [ENTER] at the message "Press ENTER to Confirm or ESC to

Cancel" to save your configuration, or press [ESC] to cancel.

317517-A Rev 00

Remote Management 32-3

32.1.1 Remote Management Limitations

Remote management over LAN or WAN will not work when:

1. A filter in menu 3.1 (LAN) or in menu 11.5 (WAN) is applied to block a Telnet, FTP or

Web service.

2. You have disabled that service in menu 24.11.

3. The IP address in the Secured Client IP field (menu 24.11) does not match the client IP address. If it does not match, the Contivity 221 will disconnect the session immediately.

4. There is an SMT console session running.

5. There is already another remote management session of the same type (web, FTP or

Telnet) running. You may only have one remote management session of the same type running at one time.

6. There is a web remote management session running with a Telnet session. A Telnet session will be disconnected if you begin a web session; it will not begin if there already is a web session.


iv Remote Management

SMT Advanced Management

Part XIII:

SMT Advanced Management

This part provides information on how to configure call scheduling.


XIII

33-1

Chapter 33

Call Scheduling

Call scheduling allows you to dictate when a remote node should be called and for how long.

33.1

Introduction to Call Scheduling

The call scheduling feature allows the Contivity 221 to manage a remote node and dictate when a remote node should be called and for how long. This feature is similar to the scheduler in a videocassette recorder (you can specify a time period for the VCR to record). You can apply up to

4 schedule sets in Menu 11.1 - Remote Node Profile. From the main menu, enter 26 to access

Menu 26 - Schedule Setup as shown next.

Figure 33-1 Schedule Setup

Schedule

Set #

------

1

2

3

4

5

6

Menu 26 - Schedule Setup

Name

------------------

______________

______________

______________

______________

______________

______________

Schedule

Set #

------

7

8

9

10

11

12

Name

------------------

______________

______________

______________

______________

______________

______________

Enter Schedule Set Number to Configure=

Edit Name=


Lower numbered sets take precedence over higher numbered sets thereby avoiding scheduling conflicts. For example, if sets 1, 2, 3 and 4 are applied in the remote node, then set 1 will take precedence over set 2, 3 and 4 as the Contivity 221, by default, applies the lowest numbered set first. Set 2 will take precedence over set 3 and 4, and so on.

You can design up to 12 schedule sets but you can only apply up to four schedule sets for a remote node.


33-2 Call Scheduling

To delete a schedule set, enter the set number and press [SPACE BAR] and then

[ENTER] or [DEL] in the Edit Name field.

To set up a schedule set, select the schedule set you want to setup from menu 26 (1-12) and press

[ENTER] to see Menu 26.1 - Schedule Set Setup as shown next.

Figure 33-2 Schedule Set Setup

Menu 26.1 - Schedule Set Setup

Active= Yes

Start Date(yyyy/mm/dd) = 2000 – 01 - 01

How Often= Once

Once:

Date(yyyy/mm/dd)= 2000 – 01 - 01

Weekdays:

Sunday= N/A

Monday= N/A

Tuesday= N/A

Wednesday= N/A

Thursday= N/A

Friday= N/A

Saturday= N/A

Start Time (hh:mm)= 00 : 00

Duration (hh:mm)= 00 : 00

Action= Forced On


Press Space Bar to Toggle

If a connection has been already established, your Contivity 221 will not drop it. Once the connection is dropped manually or it times out, then that remote node can't be triggered up until the end of the Duration.

Table 33-1Schedule Set Setup Fields


Active Press [SPACE BAR] to select Yes or No. Choose Yes and press [ENTER] to activate the schedule set.

OPTIONS

Yes

No

Start

Date

How

Often

Enter the start date when you wish the set to take effect in year -monthdate format. Valid dates are from the present to 2036-February-5.

Should this schedule set recur weekly or be used just once only? Press

[SPACE BAR] and then [ENTER] to select Once or Weekly. Both these options are mutually exclusive. If Once is selected, then all weekday settings are N/A. When Once is selected, the schedule rule deletes automatically after the scheduled time elapses.

Once

Weekly

317517-A Rev 00

Call Scheduling 33-3

Table 33-1Schedule Set Setup Fields


Once:

Date

If you selected Once in the How Often field above, then enter the date the set should activate here in year-month-date format.

Weekday:

Day

If you selected Weekly in the How Often field above, then select the day(s) when the set should activate (and recur) by going to that day(s) and pressing [SPACE BAR] to select Yes, then press [ENTER].

Yes

No

N/A

Start

Time

Duration Enter the maximum length of time this connection is allowed in hour-minute format.

Action

Enter the start time when you wish the schedule set to take effect in hourminute format.

Forced On means that the connection is maintained whether or not there is a demand call on the line and will persist for the time period specified in the Duration field.

Forced On

Forced

Down

Forced Down means that the connection is blocked whether or not there is a demand call on the line.

Enable Dial-On-Demand means that this schedule permits a demand call on the line.

Disable Dial-On-Demand means that this schedule prevents a demand call on the line.

Enable Dial-

On-Demand

Disable

Dial-On-

Demand


Once your schedule sets are configured, you must then apply them to the desired remote node(s).

Enter 11 from the Main Menu and then enter the target remote node index. Press [SPACE BAR] and then [ENTER] to select PPPoE in the Encapsulation field to make the schedule sets field available as shown next.


33-4 Call Scheduling

Figure 33-3 Applying Schedule Set(s) to a Remote Node (PPPoE)



Active= Yes

Encapsulation= PPPoE Edit IP= No


Service Name= Allocated Budget(min)= 0


My Login=


Schedules= 1,2,3,4

Nailed-Up Connection= No


Authen= CHAP/PAP Session Options:



Apply your schedule sets here.



You can apply up to four schedule sets, separated by commas, for one remote node. Change the schedule set numbers to your preference(s).

317517-A Rev 00

Call Scheduling 33-5

Figure 33-4 Applying Schedule Set(s) to a Remote Node (PPTP)



Active= Yes

Encapsulation= PPTP Edit IP= No


Service Name=N/A Allocated Budget(min)= 0


My Login= Schedules= 1,2,3,4



Nailed-up Connections=

Authen= CHAP/PAP Session Options:

PPTP : Edit Filter Sets= No

My IP Addr= Idle Timeout(sec)= 100

Server IP Addr=

Connection ID/Name=

Apply your schedule sets here.




General Appendices

Part XIV:

General Appendices

This part provides background information about setting up your computer’s IP address, antennas, triangle route, how functions are related, PPPoE, PPTP, hardware specifications, Universal Plug and Play, IP subnetting and safety warnings.

XIV

A-1

Appendix A

Setting up Your Computer’s IP Address

All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed.

Windows 95/98/Me/NT/2000/XP, Macintosh OS 7 and later operating systems and all versions of

UNIX/LINUX include the software components you need to install and use TCP/IP on your computer. Windows 3.1 requires the purchase of a third-party TCP/IP application package.

TCP/IP should already be installed on computers using Windows NT/2000/XP, Macintosh OS 7 and later operating systems.

After the appropriate TCP/IP components are installed, configure the TCP/IP settings in order to

"communicate" with your network.

If you manually assign IP information instead of using dynamic assignment, make sure that your computers have IP addresses that place them in the same subnet (192.168.1.2 to 192.168.1.254 range with a subnet mask of 255.255.255.0.) as the default Contivity 221’s LAN port IP address

(192.168.1.1).


A-2 Setting Up Your Computer’s IP Address

Windows 95/98/Me

1. Click Start, Settings, Control Panel and double-click the Network icon to open the Network window.

2. The Network window Configuration tab displays a list of installed components. You need a network adapter, the TCP/IP protocol and Client for

Microsoft Networks.

If you need the adapter: a. In the Network window, click Add. b. Select Adapter and then click Add. c. Select the manufacturer and model of your network adapter and then click OK.

If you need TCP/IP: a. In the Network window, click Add. b. Select Protocol and then click Add. c. Select Microsoft from the list of manufacturers. d. Select TCP/IP from the list of network protocols and then click OK.

If you need Client for Microsoft Networks: a. Click Add. b. Select Client and then click Add. c. d. e.

Select Microsoft from the list of manufacturers.

Select Client for Microsoft Networks from the list of network clients and then click OK.

Restart your computer so the changes you made take effect.

317517-A Rev 00

Setting Up Your Computer’s IP Address A-3

1.

In the Network window Configuration tab, select your network adapter's TCP/IP entry and click Properties.

Click the IP Address tab.

-To have your computer assigned a dynamic IP address, select Obtain an IP address

automatically.

-To give your computer a static IP address, select Specify an IP address and type your information into the IP Address and Subnet

Mask fields.



2. Click the DNS Configuration tab.

-If you do not know your DNS information, select

Disable DNS.

-If you know your DNS information, select

Enable DNS and type the information in the fields below (you may not need to fill them all in).

3. Click the Gateway tab.

-If you do not know your gateway’s IP address, remove previously installed gateways.

-If you have a gateway IP address, type it in the

New gateway field and click Add.

4. Click OK to save and close the TCP/IP Properties window.

317517-A Rev 00


5.

6.

Click OK to close the Network window. Insert the Windows CD if prompted.

Turn on your Contivity 221 and restart your computer when prompted.

Checking/Modifying Your Computer’s IP Address

1.

2.

3.

Click Start and then Run.

In the Run window, type "winipcfg" and then click OK to open the IP Configuration window.

Select your network adapter. You should see your computer's (static) IP address, subnet mask and default gateway in this screen. Verify that your computer’s static IP address is in the correct subnet (192.168.1.2 to 192.168.1.254 if using the default Contivity 221 LAN IP address).

Alternatively, to have the Contivity 221 assign your computer a new IP address (from the IP pool), make sure your Contivity 221 is turned on and click Renew in this screen.

Your computer can now communicate with the

Contivity 221 using the LAN port.

Verify your IP address is in the same subnet as the Contivity 221.



Windows 2000/NT/XP

1. In Windows XP, click start, Control Panel.

In Windows 2000/NT, click Start, Settings,

Control Panel.

2. In Windows XP, click Network Connections.

In Windows 2000/NT, click Network and

Dial-up Connections.

3. Right-click Local Area Connection and then click Properties.

317517-A Rev 00

4. Select Internet Protocol (TCP/IP) (under the

General tab in Win XP) and click Properties.




5. The Internet Protocol TCP/IP Properties window opens (the General tab in Windows XP).

- To have your computer assigned a dynamic IP address, click Obtain an IP address

automatically.

-If you have a static IP address click Use the

following IP Address and fill in the IP address,

Subnet mask, and Default gateway fields.

Click Advanced to go to the Advanced TCP/IP

Settings screen shown next.

317517-A Rev 00


6. -If you do not know your gateway's IP address, remove any previously installed gateways in the

IP Settings tab and click OK.

Do one or more of the following if you want to configure additional IP addresses:

-In the IP Settings tab, in IP addresses, click

Add.

-In TCP/IP Address, type an IP address in IP

address and a subnet mask in Subnet mask, and then click Add.

-Repeat the above two steps for each IP address you want to add.

-Configure additional default gateways in the IP

Settings tab by clicking Add in Default

gateways.

-In TCP/IP Gateway Address, type the IP address of the default gateway in Gateway. To manually configure a default metric (the number of transmission hops), clear the Automatic

metric check box and type a metric in Metric.

-Click Add.

-Repeat the previous three steps for each default gateway you want to add.

-Click OK when finished.



7. In the Internet Protocol TCP/IP Properties window (the General tab in Windows XP):

-Click Obtain DNS server address

automatically if you do not know your DNS server IP address(es).

-If you know your DNS server IP address(es), click Use the following DNS server addresses, and type them in the Preferred DNS server and

Alternate DNS server fields.

If you wish to have more than two DNS servers, click Advanced, the DNS tab and then configure them using Add.

8. Click OK to close the Internet Protocol (TCP/IP) Properties window.

9. Click OK to close the Local Area Connection Properties window.

10. Turn on your Contivity 221 and restart your computer (if prompted).

Checking/Modifying Your Computer’s IP Address

1. Click Start, All Programs, Accessories and then Command Prompt.

2. In the Command Prompt window, type "ipconfig" and then press ENTER to verify that your computer’s static IP address is in the correct subnet (192.168.1.2 to 192.168.1.254 if using the default

Contivity 221 LAN IP address). Alternatively, to have the Contivity 221 assign your computer a new IP address (from the IP pool), make sure your Contivity 221 is turned on, type "ipconfig/renew" and then press ENTER.

Your computer can now communicate with the Contivity 221 using the LAN port.

317517-A Rev 00


Macintosh OS 8/9

1. Click the Apple menu, Control Panel and double-click

TCP/IP to open the TCP/IP Control Panel.

2. Select Ethernet built-in from the Connect via list.



3. For dynamically assigned settings, select Using DHCP Server from the Configure: list.

4. For statically assigned settings, do the following:

-From the Configure box, select Manually.

-Type your IP address in the IP Address box.

-Type your subnet mask in the Subnet mask box.

-Type the IP address of your Contivity 221 in the Router address box.

5. Close the TCP/IP Control Panel.

6. Click Save if prompted, to save changes to your configuration.


Verifying Your Computer’s IP Address

Check your TCP/IP properties in the TCP/IP Control Panel window.

Macintosh OS X

1.

Click the Apple menu, and click System Preferences to open the System Preferences window.

317517-A Rev 00

2.

Click Network in the icon bar.

- Select Automatic from the Location list.

- Select Built-in Ethernet from the Show list.

- Click the TCP/IP tab.


3.

For dynamically assigned settings, select Using DHCP from the Configure list.

4. For statically assigned settings, do the following:

-From the Configure box, select Manually.

-Type your IP address in the IP Address box.

-Type your subnet mask in the Subnet mask box.

-Type the IP address of your Contivity 221 in the Router address box.

5. Click Apply Now and close the window.


Verifying Your Computer’s IP Address

Check your TCP/IP properties in the Network window.


Appendix B

Triangle Route

The Ideal Setup

When the firewall is on, your Contivity 221 acts as a secure gateway between your LAN and the

Internet. In an ideal network topology, all incoming and outgoing network traffic passes through the Contivity 221 to protect your LAN against attacks.

Diagram B-1 Ideal Setup

B-1

The “Triangle Route” Problem

A traffic route is a path for sending or receiving data packets between two Ethernet devices. Some companies have more than one alternate route to one or more ISPs. If the LAN and ISP(s) are in the same subnet, the “triangle route” problem may occur. The steps below describe the “triangle route” problem.

Step 1.

A computer on the LAN initiates a connection by sending out a SYN packet to a receiving server on the WAN.

Step 2.

The Contivity 221 reroutes the SYN packet through Gateway B on the LAN to the WAN.

Step 3.

The reply from the WAN goes directly to the computer on the LAN without going through the Contivity 221.

As a result, the Contivity 221 resets the connection, as the connection has not been acknowledged.


B-2 Triangle Route

Diagram B-2 “Triangle Route” Problem

The “Triangle Route” Solutions

This section presents you two solutions to the “triangle route” problem.

IP Aliasing

IP alias allows you to partition your network into logical sections over the same

Ethernet interface. Your Contivity 221 supports up to three logical LAN interfaces with the Contivity 221 being the gateway for each logical network. By putting your LAN and Gateway B in different subnets, all returning network traffic must pass through the Contivity 221 to your LAN. The following steps describe such a scenario.

Step 1.

A computer on the LAN initiates a connection by sending a SYN packet to a receiving server on the WAN.

Step 4.

The Contivity 221 reroutes the packet to Gateway B, which is in Subnet 2.

Step 5.

The reply from WAN goes through the Contivity 221 to the computer on the

LAN in Subnet 1.

317517-A Rev 00

Triangle Route B-3

Diagram B-3 IP Alias

Gateways on the WAN Side

A second solution to the “triangle route” problem is to put all of your network gateways on the

WAN side as the following figure shows. This ensures that all incoming network traffic passes through your Contivity 221 to your LAN. Therefore your LAN is protected.

Diagram B-4 Gateways on the WAN Side


Appendix C

The Big Picture

The following figure gives an overview of how filtering, the firewall, VPN and NAT are related.

Diagram C-1 Big Picture— Filtering, Firewall, VPN and NAT

C-1


D-1

Appendix D

PPPoE

PPPoE in Action

An ADSL modem bridges a PPP session over Ethernet (PPP over Ethernet, RFC 2516) from your

PC to an ATM PVC (Permanent Virtual Circuit), which connects to a DSL Access Concentrator where the PPP session terminates (see the next figure). One PVC can support any number of PPP sessions from your LAN. PPPoE provides access control and billing functionality in a manner similar to dial-up services using PPP.

Benefits of PPPoE

PPPoE offers the following benefits:

1. It provides you with a familiar dial-up networking (DUN) user interface.

2. It lessens the burden on the carriers of provisioning virtual circuits all the way to the ISP on multiple switches for thousands of users. For GSTN (PSTN & ISDN), the switching fabric is already in place.

3. It allows the ISP to use the existing dial-up model to authenticate and (optionally) to provide differentiated services.

Traditional Dial-up Scenario

The following diagram depicts a typical hardware configuration where the PCs use traditional dialup networking.


D-2 PPPoE

Diagram D-1 Single-PC per Modem Hardware Configuration

How PPPoE Works

The PPPoE driver makes the Ethernet appear as a serial link to the PC and the PC runs PPP over it, while the modem bridges the Ethernet frames to the Access Concentrator (AC). Between the AC and an ISP, the AC is acting as a L2TP (Layer 2 Tunneling Protocol) LAC (L2TP Access

Concentrator) and tunnels the PPP frames to the ISP. The L2TP tunnel is capable of carrying multiple PPP sessions.

With PPPoE, the VC (Virtual Circuit) is equivalent to the dial-up connection and is between the modem and the AC, as opposed to all the way to the ISP. However, the PPP negotiation is between the PC and the ISP.

Contivity 221 as a PPPoE Client

When using the Contivity 221 as a PPPoE client, the PCs on the LAN see only Ethernet and are not aware of PPPoE. This alleviates the administrator from having to manage the PPPoE clients on the individual PCs.

317517-A Rev 00

Diagram D-2 Contivity 221 as a PPPoE Client

PPPoE D-3


E-1

Appendix E

PPTP

What is PPTP?

PPTP (Point-to-Point Tunneling Protocol) is a Microsoft proprietary protocol (RFC 2637 for PPTP is informational only) to tunnel PPP frames.

How can we transport PPP frames from a PC to a broadband modem over Ethernet?

A solution is to build PPTP into the ANT (ADSL Network Termination) where PPTP is used only over the short haul between the PC and the modem over Ethernet. For the rest of the connection, the PPP frames are transported with PPP over AAL5 (RFC 2364). The PPP connection, however, is still between the PC and the ISP. The various connections in this setup are depicted in the following diagram. The drawback of this solution is that it requires one separate ATM VC per destination.

Diagram E-1 Transport PPP frames over Ethernet

PPTP and the Contivity 221

When the Contivity 221 is deployed in such a setup, it appears as a PC to the ANT.

In Windows VPN or PPTP Pass-Through feature, the PPTP tunneling is created from Windows 95,

98 and NT clients to an NT server in a remote location. The pass-through feature allows users on the network to access a different remote server using the Contivity 221's Internet connection. In

SUA/NAT mode, the Contivity 221 is able to pass the PPTP packets to the internal PPTP server

(i.e. NT server) behind the NAT. You need to configure port forwarding for port 1723 to have the

Contivity 221 forward PPTP packets to the server. In the case above as the remote PPTP Client initializes the PPTP connection, the user must configure the PPTP clients. The Contivity 221 initializes the PPTP connection hence; there is no need to configure the remote PPTP clients.

PPTP Protocol Overview


E-2 PPTP

PPTP is very similar to L2TP, since L2TP is based on both PPTP and L2F (Cisco’s Layer 2

Forwarding). Conceptually, there are three parties in PPTP, namely the PNS (PPTP Network

Server), the PAC (PPTP Access Concentrator) and the PPTP user. The PNS is the box that hosts both the PPP and the PPTP stacks and forms one end of the PPTP tunnel. The PAC is the box that dials/answers the phone calls and relays the PPP frames to the PNS. The PPTP user is not necessarily a PPP client (can be a PPP server too). Both the PNS and the PAC must have IP connectivity; however, the PAC must in addition have dial-up capability. The phone call is between the user and the PAC and the PAC tunnels the PPP frames to the PNS. The PPTP user is unaware of the tunnel between the PAC and the PNS.

Diagram E-2 PPTP Protocol Overview

Microsoft includes PPTP as a part of the Windows OS. In Microsoft’s implementation, the PC, and hence the Contivity 221, is the PNS that requests the PAC (the ANT) to place an outgoing call over

AAL5 to an RFC 2364 server.

Control & PPP connections

Each PPTP session has distinct control connection and PPP data connection.

Call Connection

The control connection runs over TCP. Similar to L2TP, a tunnel control connection is first established before call control messages can be exchanged. Please note that a tunnel control connection supports multiple call sessions.

The following diagram depicts the message exchange of a successful call setup between a PC and an ANT.

317517-A Rev 00

Diagram E-3 Example Message Exchange between PC and an ANT

PPTP E-3

PPP Data Connection

The PPP frames are tunneled between the PNS and PAC over GRE (General Routing

Encapsulation, RFC 1701, 1702). The individual calls within a tunnel are distinguished using the

Call ID field in the GRE header.


F-1

Appendix F

Hardware Specifications

Chart F-1 General Specifications

Power Specification

MTBF

Operation Temperature

Ethernet Specification for

WAN

I/P AC 120V / 60Hz; O/P DC 12V 1200 mA

100000 hrs (Mean Time Between Failures)

0º C ~ 40º C

10/100Mbps Half / Full Auto-negotiation

Ethernet Specification for

LAN/ VPN Ports

Cable Pin Assignments

10/100Mbps Half / Full Auto-negotiation, Auto-sensing

In a serial communications connection, generally a computer is DTE (Data Terminal Equipment) and a modem is DCE (Data Circuit-terminating Equipment). The Contivity 221 is DCE when you connect a computer to the console port. The Contivity 221 is DTE when you connect a modem to the dial backup port.

Diagram F-1 Console/Dial Backup Port Pin Layouts

1

Pin 5 Pin 1

Pin 9 Pin 6

1

Products without flow control only use pins 2,3 and 5.


F-2 Hardware Specifications

Chart F-2 Console/Dial Backup Port Pin Assignments

CONSOLE Port RS – 232 (Female) DB-9F

Pin 1 = NON

Pin 2 = DCE-TXD

Pin 3 = DCE –RXD

Pin 4 = DCE –DSR

Pin 5 = GND

Pin 6 = DCE –DTR

Pin 7 = DCE –CTS

Pin 8 = DCE –RTS

PIN 9 = NON

The CON/AUX port also has these pin assignments. The CON/AUX switch changes the setting in the firmware only and does not change the CON/AUX port’s pin assignments.

DIAL BACKUP RS – 232 (Male) DB-9M

Pin 1 = NON

Pin 2 = DTE-RXD

Pin 3 = DTE-TXD

Pin 4 = DTE-DTR

Pin 5 = GND

Pin 6 = DTE-DSR

Pin 7 = DTE-RTS

Pin 8 = DTE-CTS

PIN 9 = NON.

Contivity 221s with a CON/AUX port also have a 9pin adaptor for the console cable with these pin assignments on the male end.

Chart F-3 Ethernet Cable Pin Assignments

WAN/LAN Ethernet Cable Pin Layout:

Straight-Through

(Switch) (Adapter)

1 IRD +

2 IRD -

3 OTD +

6 OTD -

1 OTD +

2 OTD -

3 IRD +

6 IRD -

Crossover

(Switch)

1 IRD +

2 IRD -

3 OTD +

6 OTD -

(Switch)

1 IRD +

2 IRD -

3 OTD +

6 OTD -

317517-A Rev 00

Hardware Specifications F-3

Power Adaptor Specifications

Chart F-4 North American AC Power Adaptor Specifications

AC Power Adapter model AD48-1201200DUY

Input power: AC120Volts/60Hz/0.25A

Output power: DC12Volts/1.2A

Power consumption: 10 W

Plug: North American standards

Safety standards: UL, CUL (UL 1950, CSA C22.2 No.234-M90)

AC Power Adapter model AD48-1201200DUY

Input power: AC120Volts/60Hz



Plug: North American standards

Safety standards: UL, CUL (UL1950, CSA C22.2 NO. 234-M90)

Chart F-5 European Union AC Power Adaptor Specifications

AC Power Adapter model AD-1201200DV




Plug: European Union standards

Safety standards: TUV, CE (EN 60950)

AC Power Adapter model JAD-121200E

Input power: AC230Volts/50Hz,



Plug: European Union standards

Safety standards: TUV, CE (EN 60950)


F-4 Hardware Specifications

Chart F-6 UK AC Power Adaptor Specifications

AC Power Adapter model AD-1201200DK




Plug: United Kingdom standards

Safety standards: TUV, CE (EN 60950, BS7002)

Chart F-7 Japan AC Power Adaptor Specifications

AC Power Adapter model JOD-48-1124

Input power: AC100Volts/ 50/60Hz/ 27VA



Plug: Japan standards

Safety standards: T-Mark

Chart F-8 Australia and New Zealand AC Power Adaptor Specifications

AC Power Adapter model AD-1201200Ds or AD-121200DS




Plug: Australia and New Zealand standards

Safety standards: NATA (AS 3260)

317517-A Rev 00

G-1

Appendix G

IP Subnetting

IP Addressing

Routers “route” based on the network number. The router that delivers the data packet to the correct destination host uses the host ID.

IP Classes

An IP address is made up of four octets (eight bits), written in dotted decimal notation, for example, 192.168.1.1. IP addresses are categorized into different classes. The class of an address depends on the value of its first octet.

¾ Class “A” addresses have a 0 in the left most bit. In a class “A” address the first octet is the network number and the remaining three octets make up the host ID.

¾ Class “B” addresses have a 1 in the left most bit and a 0 in the next left most bit. In a class “B” address the first two octets make up the network number and the two remaining octets make up the host ID.

¾ Class “C” addresses begin (starting from the left) with 1 1 0. In a class “C” address the first three octets make up the network number and the last octet is the host ID.

¾ Class “D” addresses begin with 1 1 1 0. Class “D” addresses are used for multicasting. (There is also a class “E” address. It is reserved for future use.)

Chart G-1 Classes of IP Addresses

IP ADDRESS: OCTET 1

Class A 0 Network number

OCTET 2

Host ID

OCTET 3

Host ID

OCTET 4

Host ID

Class B

Class C

10

110

Network number

Network number

Network number

Network number

Host ID

Network number

Host ID

Host ID

Host IDs of all zeros or all ones are not allowed.

Therefore:

¾ A class “C” network (8 host bits) can have 2 8

–2 or 254 hosts.

¾ A class “B” address (16 host bits) can have 2 16

–2 or 65534 hosts.

A class “A” address (24 host bits) can have 2

24

–2 hosts (approximately 16 million hosts).

Since the first octet of a class “A” IP address must contain a “0”, the first octet of a class “A” address can have a value of 0 to 127.


G-2 IP Subnetting

Similarly the first octet of a class “B” must begin with “10”, therefore the first octet of a class “B” address has a valid range of 128 to 191. The first octet of a class “C” address begins with “110”, and therefore has a range of 192 to 223.

Chart G-2 Allowed IP Address Range By Class

CLASS

Class A

Class B

Class C

ALLOWED RANGE OF FIRST OCTET

(BINARY)

00000000 to 01111111

10000000 to 10111111

11000000 to 11011111

ALLOWED RANGE OF FIRST OCTET

(DECIMAL)

0 to 127

128 to 191

192 to 223

Class D 11100000 to 11101111 224 to 239

Subnet Masks

A subnet mask is used to determine which bits are part of the network number, and which bits are parts of the host ID (using a logical AND operation). A subnet mask has 32 bits; each bit of the mask corresponds to a bit of the IP address. If a bit in the subnet mask is a “1” then the corresponding bit in the IP address is part of the network number. If a bit in the subnet mask is “0” then the corresponding bit in the IP address is part of the host ID.

Subnet masks are expressed in dotted decimal notation just as IP addresses are. The “natural” masks for class A, B and C IP addresses are as follows.

Chart G-3 “Natural” Masks

A 255.0.0.0

B 255.255.0.0

C 255.255.255.0

Subnetting

With subnetting, the class arrangement of an IP address is ignored. For example, a class C address no longer has to have 24 bits of network number and 8 bits of host ID. With subnetting, some of the host ID bits are converted into network number bits. By convention, subnet masks always consist of a continuous sequence of ones beginning from the left most bit of the mask, followed by a continuous sequence of zeros, for a total number of 32 bits.

317517-A Rev 00

IP Subnetting G-3

Since the mask is always a continuous number of ones beginning from the left, followed by a continuous number of zeros for the remainder of the 32 bit mask, you can simply specify the number of ones instead of writing the value of each octet. This is usually specified by writing a “/” followed by the number of bits in the mask after the address.

For example, 192.1.1.0 /25 is equivalent to saying 192.1.1.0 with mask 255.255.255.128.

The following table shows all possible subnet masks for a class “C” address using both notations.

Chart G-4 Alternative Subnet Mask Notation

SUBNET MASK IP ADDRESS SUBNET MASK “1” BITS

255.255.255.0 /24

LAST OCTET BIT VALUE

255.255.255.128 /25

255.255.255.192 /26

255.255.255.224 /27

255.255.255.240 /28

255.255.255.248 /29

255.255.255.252 /30

The first mask shown is the class “C” natural mask. Normally if no mask is specified it is understood that the natural mask is being used.

Example: Two Subnets

As an example, you have a class “C” address 192.168.1.0 with subnet mask of 255.255.255.0.

NETWORK NUMBER HOST ID

IP Address 192.168.1. 0

IP Address (Binary)

Subnet Mask

11000000.10101000.00000001. 00000000

255.255.255. 0

Subnet Mask (Binary) 11111111.11111111.11111111. 00000000

The first three octets of the address make up the network number (class “C”). You want to have two separate networks.

Divide the network 192.168.1.0 into two separate subnets by converting one of the host ID bits of the IP address to a network number bit. The “borrowed” host ID bit can be either “0” or “1” thus giving two subnets; 192.168.1.0 with mask 255.255.255.128 and 192.168.1.128 with mask

255.255.255.128.

In the following charts, shaded/bolded last octet bit values indicate host ID bits

“borrowed” to form network ID bits. The number of “borrowed” host ID bits



determines the number of subnets you can have. The remaining number of host ID bits (after “borrowing”) determines the number of hosts you can have on each subnet.

Chart G-5 Subnet 1

NETWORK NUMBER LAST OCTET BIT VALUE

IP Address

IP Address (Binary)

Subnet Mask

Subnet Mask (Binary)

Subnet Address: 192.168.1.0

Broadcast Address: 192.168.1.127

192.168.1.

11000000.10101000.00000001.

255.255.255.

11111111.11111111.11111111.

0

00000000

128

10000000

Lowest Host ID: 192.168.1.1

Highest Host ID: 192.168.1.126


IP Address

IP Address (Binary)

Subnet Mask


NETWORK NUMBER

192.168.1.

11000000.10101000.00000001.

255.255.255.

11111111.11111111.11111111.


128

10000000

128

10000000

Broadcast Address: 192.168.1.255 Highest Host ID: 192.168.1.254

The remaining 7 bits determine the number of hosts each subnet can have. Host IDs of all zeros represent the subnet itself and host IDs of all ones are the broadcast address for that subnet, so the actual number of hosts available on each subnet in the example above is 2

7

– 2 or 126 hosts for each subnet.

192.168.1.0 with mask 255.255.255.128 is the subnet itself, and 192.168.1.127 with mask

255.255.255.128 is the directed broadcast address for the first subnet. Therefore, the lowest IP address that can be assigned to an actual host for the first subnet is 192.168.1.1 and the highest is

192.168.1.126. Similarly the host ID range for the second subnet is 192.168.1.129 to

192.168.1.254.

Example: Four Subnets

The above example illustrated using a 25-bit subnet mask to divide a class “C” address space into two subnets. Similarly to divide a class “C” address into four subnets, you need to “borrow” two

317517-A Rev 00

IP Subnetting G-5 host ID bits to give four possible combinations of 00, 01, 10 and 11. The subnet mask is 26 bits

(11111111.11111111.11111111.11000000) or 255.255.255.192. Each subnet contains 6 host ID bits, giving 2

6

-2 or 62 hosts for each subnet (all 0’s is the subnet itself, all 1’s is the broadcast address on the subnet).


IP Address

NETWORK NUMBER

192.168.1.


0

IP Address (Binary)




11000000.10101000.00000001.

11111111.11111111.11111111.

00000000

11000000




IP Address

NETWORK NUMBER

192.168.1.


64

IP Address (Binary)




11000000.10101000.00000001.

11111111.11111111.11111111.

01000000

11000000




IP Address

IP Address (Binary)


NETWORK NUMBER

192.168.1.

11000000.10101000.00000001.

11111111.11111111.11111111.


128

10000000

11000000





IP Address

IP Address (Binary)


NETWORK NUMBER

192.168.1.

11000000.10101000.00000001.

11111111.11111111.11111111.


192

11000000

11000000


Example Eight Subnets

Similarly use a 27-bit mask to create 8 subnets (001, 010, 011, 100, 101, 110).

The following table shows class C IP address last octet values for each subnet.

Chart G-11 Eight Subnets

SUBNET SUBNET ADDRESS FIRST ADDRESS LAST ADDRESS BROADCAST ADDRESS

1 0

2 32

3 64

4 96

1

33

65

97

30

62

94

126

31

63

95

127

5 128

6 160

7 192

129

161

193

158

190

222

159

191

223

255 8 224 223 254

The following table is a summary for class “C” subnet planning.

Chart G-12 Class C Subnet Planning

NO. “BORROWED” HOST BITS SUBNET MASK NO. SUBNETS NO. HOSTS PER SUBNET

1 255.255.255.128 126

2 255.255.255.192 62

3 255.255.255.224 30

317517-A Rev 00

IP Subnetting G-7

Chart G-12 Class C Subnet Planning


4 255.255.255.240 14

5 255.255.255.248 6

6 255.255.255.252 2

7 255.255.255.254 1

Subnetting With Class A and Class B Networks.

For class “A” and class “B” addresses the subnet mask also determines which bits are part of the network number and which are part of the host ID.

A class “B” address has two host ID octets available for subnetting and a class “A” address has three host ID octets (see Chart G-1) available for subnetting.

The following table is a summary for class “B” subnet planning.

Chart G-13 Class B Subnet Planning


1 255.255.128.0 32766

2 255.255.192.0 16382

3 255.255.224.0 8190

4 255.255.240.0 4094

5 255.255.248.0 2046

6 255.255.252.0 1022

7 255.255.254.0 510

8 255.255.255.0 254

(/25)

(/26)

(/27)



Chart G-13 Class B Subnet Planning


(/28)

(/29)

(/30)

(/31)

317517-A Rev 00

H-1

Appendix H

Safety Warnings and Instructions

1. Be sure to read and follow all warning notices and instructions.

2. The maximum recommended ambient temperature for the Contivity 221 is 40º

Celsius (104º Fahrenheit). Care must be taken to allow sufficient air circulation or space between units when the Contivity 221 is installed inside a closed rack assembly. The operating ambient temperature of the rack environment might be greater than room temperature.

3. Installation in a rack without sufficient airflow can be unsafe.

4. Racks should safely support the combined weight of all equipment.

5. The connections and equipment that supply power to the Contivity 221 should be capable of operating safely with the maximum power requirements of the

Contivity 221. In case of a power overload, the supply circuits and supply wiring should not become hazardous. The input rating of the Contivity 221 is printed on the nameplate.

6. The power cord or power adaptor must plug in to the right supply voltage, i.e.

110VAC for North America and 230VAC for Europe. Make sure that the supplied AC voltage is correct and stable.

7. Installation in restricted access areas must comply with Articles 110-16, 110-

17, and 110-18 of the National Electrical Code, ANSI/NFPA 70.

8. Do not allow anything to rest on the power cord and do not locate the product where anyone can walk on the power cord.

9. Do not service the product by yourself. Opening or removing covers can expose you to dangerous high voltage points or other risks. Refer all servicing to qualified service personnel.

10. Generally, when installed after the final configuration, the product must comply with the applicable safety standards and regulatory requirements of the country in which it is installed. If necessary, consult the appropriate regulatory agencies and inspection authorities to ensure compliance.

11. A rare condition can create a voltage potential between the earth grounds of two or more buildings. If products installed in separate building are interconnected, the voltage potential can cause a hazardous condition. Consult a qualified electrical consultant to determine whether or not this phenomenon exists and, if necessary, implement corrective action before interconnecting the products.


Command and Log Appendices

Part XV:


This part provides information on the command line interface, firewall and NetBIOS commands, logs and password protection.

XV

I-1

Appendix I

Command Interpreter

The following describes how to use the command interpreter. Enter 24 in the main menu to bring up the system maintenance menu. Enter 8 to go to Menu 24.8 -

Command Interpreter Mode. See the included disk or nortelnetworks.com for

more detailed information on these commands.


Command Syntax







Command Usage

A list of valid commands can be found by typing help or ? at the command prompt. Always type the full command. Type exit to return to the SMT main menu when finished.

Sys Commands


I-2 Command Interpreter

The following chart lists and describes the sys commands. Each of these commands must be preceded by sys when you use them. For example, type sys stdio 60

to set the management session inactivity timeout to 60 minutes.

Chart I-1

Sys Commands adjtime atsh callhist

display countryc ode

Displays the call history.

Removes an entry from the call history.

[countrycode] Sets or displays the country code. date [year month date]

Retrieves the date and time from the time server specified in the WebGUI. domainna me edit extraphn um

<filename> add <set 1-3> <1 st

phone num>

[2 nd

phone num]

display

Sets or displays the system’s current date.

Displays the domain name that the device sends to the LAN DHCP clients.

Edits the system preset text file such as autoexec.net.

Maintains extra phone numbers for outgoing (dial backup) calls.

Add extra phone numbers.

Display the extra phone numbers. remove feature

<set 1-3>

reset

Sets all extend phone numbers to remote node <num>.

Remove extra phone numbers.

Resets node and mask.

Displays a list of the device’s major features.

317517-A Rev 00

Command Interpreter I-3

Chart I-1

Sys Commands hostname logs

[hostname]

category access

[0:none/1:log/2:alert/3:b oth] attack

[0:none/1:log/2:alert/3:b oth]

Sets or displays the system name.

Records and/or sends alerts for access control logs.

Records and/or sends alerts for firewall attack logs. cdr Records Call Detail Record logs. display

Displays the category settings. error


Records and/or sends alerts for system error logs. icmp Records ICMP logs. ipsec


Records the access control logs ike

[0:none/1:log/2:alert/3:b oth] javablocked

[0:none/1:log]


Records the java etc. blocked logs. mten Records the system maintenance logs. packetfilter

[0:none/1:log]

Records the packet filter logs. ppp Records the PPP logs. remote

Records the remote management logs. tcpreset

Records the TCP reset logs.



Chart I-1

Sys Commands upnp Records the UPnP logs. urlblocked


Records and/or sends alerts for web access blocked logs. urlforward Records web access forward logs.

clear Clears the log. c|ike|javablocked|mten|ur lblocked|urlfor

Displays all logs or specified categories of logs. ward]

load

Loads the log settings buffer. Use this command before you configure the log settings. Use sys logs save after you configure the log settings.

mail alertAddr [mail address]

Send alerts to this e-mail address. clearlog display Displays the logs and alerts mail settings. logAddr [mail address] Send logs to this e-mail address. schedule Displays the mail schedule. schedule hour [0-23] Sets the hour to send logs. schedule minute [0-59] Sets the minute to send the logs.

Sets the mail schedule policy. schedule policy

[0:full/1:hourly/2:daily/

3:weekly/4:none] schedule week

[0:sun/1:mon/2:tue/3:wed/

4:thu/5:fri/6:sat]

Sets the day of the wee for sending weekly logs.

317517-A Rev 00


Chart I-1

Sys Commands server Sets the domain name or IP address of the mail server to which to send the logs. subject [mail subject] Sets the log e-mail’s subject.

save

syslog

Save the log settings from the buffer. active Enables/disables syslog logging. display Displays the syslog settings. facility [Local ID(1-7)] Specifies the file to which the device logs the syslog messages. server Specifies the domain name or IP address of the syslog server to which to send the syslogs.

Sets how often to resolve the mail and/or syslog server domain name to an IP address. pwderrtm [minute]

Sets or displays the password error blocking timeout value. rn

accessblock Blocks access to a remote node.

Loads remote node information.

Displays remote node information. disp <entry no.>(0:working buffer)

nat Configure remote node NAT.

Configure a remote node connection to be nailed up (always on).

mtu <value> Sets the remote node Maximum

Transmission Unit.

Save remote node information.



Chart I-1

Sys Commands stdio time trcdisp version

[minute]

[hour [min [sec]]] parse, brief, disp

Sets or displays the management terminal idle timeout value.

Sets or displays the system time.

Sets the level of detail that should be displayed. Use “parse” to display the most detail and “disp” to display the least.

Displays the RAS code and driver versions. view wdog

cnt [value] romreset socket filter

<filename>

netbios

Displays the specified text file.

Turns the watchdog firmware protection feature on or off.

Sets (0-34463) or displays the current watchdog count (in 1.6 sec units).

Restores the factory default configuration file.

Displays the system socket’s ID #, type, control block address (PCB),

IP address and port number of peer device connected to the socket

(Remote Socket) and task control block (Owner). disp Displays the current NetBIOS filter modes. config <0:Between LAN and

WAN/ 3: IPSec Pass through/4: Trigger Dial>

<on|off>

Sets NetBIOS filters.

317517-A Rev 00


Chart I-1

Sys Commands roadrunn er ddns

debug

display

Enables/disables roadrunner service.

0: disable (default)

1: enable

Displays roadrunner information iface-name: enif0, wanif0

Restarts roadrunner.

Turns on/off the displaying of DDNS debug messages.

Displays DDNS information.

restart

logout cpu

Restarts DDNS.

This command has no effect.

Displays the CPU’s utilization.

display upnp

Activates or deactivates the saved

UPnP settings.

config Allow users to make configuration changes through UPnP.

display Displays UPnP information.

firewall

Allow UPnP to pass through

Firewall.

load

reserve

save

Saves UPnP information.




Exit Command

Chart I-2

Exit Command exit


Ends the command interpreter session.

Ethernet Commands

The following chart lists and describes the ether commands. Each of these commands must be preceded by ether when you use them. For example, type ether config

to display information on the LAN configuration.

Chart I-3

Ether Commands


Displays LAN configuration information. config driver

cnt

Displays the Ethernet driver counters. version edit

[arguments]

mtu <value> currently.

Shows the LAN status.

Displays the Ethernet device type.

Loads Ethernet (1:LAN) data from the

System Parameters Table.

Sets the Ethernet data Maximum

Transmission Unit.

save Saves Ethernet data to the System

Parameters Table.

317517-A Rev 00


IP Commands

The following chart lists and describes the ip commands. Each of these commands must be preceded by ip when you use them. For example, type ip address

to display the host IP address.

Chart I-4

IP Commands


address alias aliasdis arp

[addr]

<iface>

<0|1>

Displays the host IP address.

Sets an alias for the specified interface.

Disables/enables the alias for the specified interface.

status Displays an interface’s IP Address

Resolution Protocol status. dhcp <iface>

client release Releases the DHCP client IP address. renew Renews the DHCP client IP address.

status Displays the DHCP status. dns

query

stats clear Clears DNS statistics. httpd icmp disp Displays DNS statistics. debug Enables or disables the HTTP debug flag. This command does not work currently.

status

Displays the ICMP statistics counter.



Chart I-4

IP Commands ifconfig ping rip route


Configures a network interface.

[broadcast <addr>

|mtu

<value>|dynamic]

<hostid>

add <dest_addr|default

>[/<bits>]

<gateway>

[<metric>]

Pings a remote host.

Displays the routing table.

Adds a route.

Adds an entry to the routing table for the specified interface. >[/<bits>]

<gateway>

[<metric>]

Adds a private route.

>[/<bits>]

<gateway>

[<metric>] rpt

[/<bits>]

start

stop

url

ip

srv smtp status

Start recording reports data.

Stop recording reports data.

Record the most visited web sites.

Record the LAN IP addresses that sent and received the most traffic.

Record the most heavily used protocols or service ports.

Displays IP statistic counters.

317517-A Rev 00


Chart I-4

IP Commands stroute


display [rule # | buf] Displays the list of static routes or detailed information on a specified rule.

load <rule Load the specified static route rule into the buffer.

save Saves a rule from the buffer to the


config name <site name> Sets the name for a static route. addr>[/<bits>]

<gateway>

[<metric>] mask <IP subnet mask> address and gateway.

Sets a static route’s subnet mask. address> metric <metric #> Sets a static route’s metric number. tcp status tftp telnet <host> tracerout e udp

status urlfilter

[wait] [queries]

Displays the TCP statistic counters.

Telnets to the specified host. of a remote host.

Displays the UDP status.



Chart I-4

IP Commands


exemptZone

Display

Displays content filtering exempt zone information. actionFlags

[type(1-

3)][enable/disable

]

Enables/disables content filtering exempt zone action flags that determine to which IP addresses to apply content filtering. add [ip1] [ip2] Sets a range of IP addresses to be in the exempt zone. delete [ip1] [ip2] Removes a range of IP addresses from the exempt zone. reset

customize

Returns the exempt zone settings to the previous configuration.

Use the customize commands to configure content filtering for trusted web sites, forbidden web sites and keyword blocking. display

Displays the content filtering customize action flags.

[act(1-7)]

[enable/disable] action flags.

3)][enable/disabl e]

Sets the content filtering customize log flags.

[trust/untrust/key word] site or keyword blocking string.

[trust/untrust/key word] reset web site or keyword blocking string.

Return to the default configuration.

317517-A Rev 00


Chart I-4

IP Commands tredir


failcount Sets the number of times that the device may ping the target without a response before forwarding traffic to the backup gateway.

partner Sets the traffic redirect backup gateway

IP address.

target Sets the IP address that the device uses to test WAN accessibility.

timeout Sets the number of seconds the device waits for a response from the target.

checktime

Sets the number of seconds the device waits between attempts to connect to the target.

active Enables/disables traffic redirect.

save

disp

Saves traffic redirect configuration.

Displays the traffic redirect configuration.

debug <value> Sets the traffic redirect debug value. igmp

debug [level] Sets IGMP debug level.

forwardall

Activates/deactivates IGMP forwarding to all interfaces flag.

querier Turns on/off IGMP stop query flag.

iface

<timeout> specified interface.

<interval> specified interface.

<group>



Chart I-4

IP Commands


<group> interface.

[time] interface. interface.

<threshold>

[on|off]

status compatibility on the specified interface.

Sets the IGMP robustness variable.

Displays the IGMP status.

IPSec Commands

The following chart lists and describes the ipsec commands. Each of these commands must be preceded by ipsec when you use them. For example, type ipsec display 3

to display the third IPSec rule if you have it configured.

Chart I-5

IPSec Commands


adjTcpMss <off|auto|user defined value>

Sets the adjust TCP Maximum Segment Size. contivityDial contivityDrop

Initiates the Contivity Client VPN connection.

Ends the Contivity Client VPN connection. contivityState

VPN connection.

317517-A Rev 00


Chart I-5

IPSec Commands contivitySplit


Sets the time count between NAT states. ContivityTime

CntbtNatState debug <on|off> Turns the trace for IPsec debug information on|off. exemptHost display

Use the exemptHost commands to configure specific IP addresses that are not to be part of a

VPN tunnel.

Displays the exempt host settings. load active sourceStart sourceEnd destStart destEnd

<index>

<Yes|No>

<IP address>

<IP address>

<IP address>

<IP address>

Loads an exempt host.

Enables/disables an exempt host.

Sets the exempt host’s source start IP address.

Sets the exempt host’s source end IP address.

Sets the exempt host’s destination start IP address.

Sets the exempt host’s destination end IP address.

Saves an exempt host. ipPolicy save activeNAT add delete

<Yes|No> Enables/disables NAT for an IP policy.

Adds an IP policy.

Removes an IP policy. display

internal list load <policy Index>

Displays the IP policies.


Loads an IP policy.

local type Sets an IP policy’s local address type.

2:subnet>



Chart I-5

IPSec Commands


addrStart <IP address> Sets an IP policy’s starting local IP address. endMask <IP address> Sets an IP policy’s ending local IP address or subnet mask. port <port number> Sets an IP policy’s local port number.

Sets an IP policy’s protocol number.

:UDP>

remote type Sets an IP policy’s remote address type.

2:subnet> addrStart <IP address> Sets an IP policy’s starting remote IP address. endMask <IP address> port <port number>

Sets an IP policy’s ending remote IP address or subnet mask.

Sets an IP policy’s remote port number. rawDebug route save

<on|off> lan wan

<on|off>

<on|off>

Saves an IP policy.

Turns the IPSec raw debug feature on/off.

After IPSec has processed a packet and sent it to the LAN side, this switch controls whether or not IPSec can be applied to the packet again.

After IPSec has processed a packet and sent it to the WAN side, this switch controls whether or not IPSec can be applied to the packet again. show_runtime sa switch spd

<on|off> information.

When a dynamic rule accepts a request and a tunnel is established, a runtime SPD is created according to the peer’s local IP address. This command displays these runtime SPDs.

As long as there is one active IPSec rule, all packets will go into the IPSec process to check against the SPD. When this switch is turned on packets will not be put through the IPSec process, even if there are active IPSec rules.

317517-A Rev 00


Chart I-5

IPSec Commands


swSkipOverlap <on|off> Turn this on to have the device allow rules with overlapping source and destination IP addresses. timer

chk_input chk_my_ip chk_conn.

update_peer updatePeerIp dial display load

<rule #>

<rule #>

<rule #>

Sets the timer for checking if the WAN IP in the menu has changed. The interval is in seconds (10 default) and 0 is not a valid value.

Sets the idle timeout for IPSec connections. The system disconnects an IPSec connection with no traffic for the timeout period. The interval is in minutes (2 default) and 0 means the connection never times out.

Sets the auto-timer for updating IPSec rules that use a domain name as the secure gateway IP address. The interval is in minutes (30 default) and 0 means it never updates.

Forces the system to immediately update IPSec rules which use a domain name as the secure gateway IP address.

Initiates a VPN connection attempt using the specified rule.

Displays the specified IPSec rule.

Loads an IPSec rule. save config netbios name keepAlive lcIdType active <on|off> group <group index1, group index2…>

<string>

<Yes| No>

Saves IPSec rules.

Sets the NetBIOS active flag.

Sets the NetBIOS group.

Sets a rule’s name.

Enables/disables keep alive.

<0:IP | 1:DNS | 2:Email> Sets the local ID type.



Chart I-5

IPSec Commands


lcIdContent <string> Sets the local ID content. myIpAddr <IP address> Sets the my IP address. peerIdType peerIdContent secureGwAddr

<0:IP | 1:DNS | 2:Email>

<string>

<IP address | Domain name>

Sets the peer ID type.

Sets the peer ID content.

Sets the secure gateway IP address or domain name.

<0:Main | 1:Aggressive> preShareKey <string> p1AuthAlgo <0:MD5 |

1:SHA1>

Sets the IKE phase 1 pre-shared key. p1EncryAlgo

1:3DES>

Sets the IKE phase 1 authentication algorithm. p1SaLifeTime

<seconds> p1KeyGroup

1:DH2> activeProtocol

1:ESP> p2EncryAlgo

1:DES | 2:3DES> p2AuthAlgo <0:MD5 |

1:SHA1>


<seconds>

Sets the IKE phase 2 encapsulation. encap <0:Tunnel |

1:Transport> pfs <0:None | 1:DH1 |

2:DH2>

Sets the IKE phase 2 perfect forward secret.

317517-A Rev 00


Sys Firewall Commands

The following chart lists and describes the sys firewall commands. Each of these commands must be preceded by sys firewall when you use them. For example, type sys firewall active yes to turn on the firewall.

Chart I-6

Sys Firewall

Commands


acl

disp active <yes|no> cnt

disp

Displays ACLs or a specific ACL set # and rule #.

Active firewall or deactivate firewall

Enables/disables the firewall.

Displays the firewall log type and count.

clear dynamicrule tcprst

rst

rst113

Clears the firewall log count.

Displays the temporary firewall rules that the device dynamically created.

Turns TCP reset sending on/off.

Turns TCP reset sending for port 113 on/off.

display dos

smtp

display

ignore ignore

dos

triangle

Displays the TCP reset sending settings.

Enables/disables the SMTP DoS defender.

Displays the SMTP DoS defender setting.

Sets if the firewall will ignore DoS attacks on the lan/wan/dmz/wlan.


Sets if the firewall will ignore triangle route packets on the lan/wan/dmz/wlan.



317517-A Rev 00

J-1

Appendix J

NetBIOS Filter Commands

The following describes the NetBIOS packet filter commands. See the Command

Interpreter appendix for information on the command structure.

Introduction

NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN.

For some dial-up services such as PPPoE or PPTP, NetBIOS packets cause unwanted calls.

You can configure NetBIOS filters to do the following:

• Allow or disallow the sending of NetBIOS packets from the LAN to the WAN and from the WAN to the LAN.

• Allow or disallow the sending of NetBIOS packets through VPN connections.

• Allow or disallow NetBIOS packets to initiate calls.

Display NetBIOS Filter Settings

Diagram J-1 NetBIOS Display Filter Settings Command Example

=============== NetBIOS Filter Status ===============

Between LAN and WAN: Block

IPSec Packets: Forward

Trigger Dial: Disabled

Syntax: sys filter netbios disp

This command gives a read-only list of the current NetBIOS filter modes.

The filter types and their default settings are as follows.


J-2 NetBIOS Filter Commands

Chart J-1 NetBIOS Filter Default Settings

Between LAN and WAN

IPSec Packets This field displays whether NetBIOS packets sent through a VPN connection are blocked or forwarded.

Trigger dial

This field displays whether NetBIOS packets are blocked or forwarded from the LAN to the WAN or from the WAN to the LAN.

This field displays whether NetBIOS packets are allowed to initiate calls. Disabled means that NetBIOS packets are blocked from initiating calls.

Forward

Forward

Disabled

NetBIOS Filter Configuration

Syntax: sys filter netbios config <type> <on|off> where

<type>

=

Identify which NetBIOS filter (numbered 0-3) to configure.

0

= LAN to WAN and WAN to LAN

<on|off>

=

3 = IPSec packet pass through

4 = Trigger Dial

For type 0, use on to enable the filter and block NetBIOS packets. Use off to disable the filter and forward NetBIOS packets.

For type 3, use on to block NetBIOS packets from being sent through a VPN connection. Use off to allow NetBIOS packets to be sent through a VPN connection.

For type 4, use on to allow NetBIOS packets to initiate dial backup calls. Use off

to block NetBIOS packets from initiating dial backup calls.

Example commands

Command: sys filter netbios config 0 on

This command blocks LAN to WAN and WAN to LAN NetBIOS packets

Command: sys filter netbios config 1 off

317517-A Rev 00

NetBIOS Filter Commands J-3

This command forwards WAN to LAN and WAN to LAN NetBIOS packets


This command blocks IPSec NetBIOS packets


This command stops NetBIOS commands from initiating calls.


K-1

Appendix K

Boot Commands

The BootModule AT commands execute from within the router’s bootup software, when debug mode is selected before the main router firmware is started. When you start up your Contivity 221, you are given a choice to go into debug mode by pressing a key at the prompt shown in the following screen. In debug mode you have access to a series of boot module commands, for example

ATUR

(for uploading firmware) and

ATLC

(for uploading the configuration file). These are already discussed in the Firmware and Configuration File Maintenance chapter.

Diagram K-1 Option to Enter Debug Mode

Bootbase Version: V1.02 | 08/08/2001 15:40:50

RAM: Size = 16384 Kbytes

DRAM Post: Testing: 16384K OK

FLASH: Intel 16M

RAS Version: V3.50(WB.0)b3 | 08/08/2001 16:21:27

Press any key to enter debug mode within 3 seconds.

Enter

ATHE

to view all available Contivity 221 boot module commands as shown in the next screen.

ATBAx

allows you to change the console port speed. The x denotes the number preceding the colon to give the console port speed following the colon in the list of numbers that follows; for example

ATBA3

will give a console port speed of 9.6 Kbps.

ATSE

displays the seed that is used to generate a password to turn on the debug flag in the firmware. The

ATSH

command shows product related information such as boot module version, vendor name, product model, RAS code revision, etc.

ATGO

allows you to continue booting the system.

Most other commands aid in advanced troubleshooting and should only be used by qualified engineers.


K-2 Boot Commands

Diagram K-2 Boot Module Commands

AT just answer OK

ATHE print help

ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k

ATENx,(y) set BootExtension Debug Flag (y=password)

ATSE show the seed of password generator

ATTI(h,m,s) change system time to hour:min:sec or show current time

ATDA(y,m,d) change system date to year/month/day or show current date

ATDS dump RAS stack

ATDT dump Boot Module Common Area

ATDUx,y dump memory contents from address x for length y

ATRBx display the 8-bit value of address x

ATRWx display the 16-bit value of address x

ATRLx display the 32-bit value of address x

ATGO(x) run program at addr x or boot router

ATGR boot router

ATGT run Hardware Test Program

ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations)

ATSH dump manufacturer related data in ROM

ATDOx,y download from address x for length y to PC via XMODEM

ATTD download router configuration to PC via XMODEM

ATUR upload router firmware to flash ROM

ATLC upload router configuration file to flash ROM

ATXSx xmodem select: x=0: CRC mode(default); x=1: checksum mode

ATSR system reboot

317517-A Rev 00

Appendix L

Log Descriptions

Chart L-1 System Error Logs

LOG MESSAGE

%s exceeds the max. number of session per host!

DESCRIPTION

This attempt to create a SUA/NAT session exceeds the maximum number of SUA/NAT session table entries allowed to be created per host.

Chart L-2 System Maintenance Logs

LOG MESSAGE

Time calibration is successful

DESCRIPTION

The router has adjusted its time based on information from the time server.

Time calibration failed

The router failed to get information from the time server.

DHCP client gets %s

A DHCP client got a new IP address from the DHCP server.

DHCP client IP expired

A DHCP client's IP address has expired.

DHCP server assigns

%s

The DHCP server assigned an IP address to a client.

SMT Login

Successfully

Someone has logged on to the router's SMT interface.

Someone has failed to log on to the router's SMT interface.

SMT Login Fail

WEB Login

Successfully

WEB Login Fail

Someone has logged on to the router's WebGUI interface.

Someone has failed to log on to the router's WebGUI interface.

L-1


L-2 Log Descriptions


Someone has logged on to the router via telnet.

TELNET Login

Successfully

TELNET Login Fail

FTP Login

Successfully

FTP Login Fail

NAT Session Table is Full!

Someone has failed to log on to the router via telnet.

Someone has logged on to the router via ftp.

Someone has failed to log on to the router via ftp.

The maximum number of SUA/NAT session table entries has been exceeded and the table is full.

Chart L-3 UPnP Logs

LOG MESSAGE

UPnP pass through

Firewall

Chart L-4 Content Filtering Logs

DESCRIPTION

UPnP packets can pass through the firewall.

URLFOR

URLBLK

JAVBLK

IP/Domain

Name

IP/Domain

Name

IP/Domain

Name

DESCRIPTION

The Contivity 221 allows access to this IP address or domain name and forwarded traffic addressed to the IP address or domain name.

The Contivity 221 blocked access to this IP address or domain name due to a forbidden keyword. All web traffic is disabled except for trusted domains, untrusted domains, or the cybernot list.

The Contivity 221 blocked access to this IP address or domain name because of a forbidden service such as:

ActiveX, a Java applet, a cookie, or a proxy.

317517-A Rev 00

Log Descriptions L-3

Chart L-5 Attack Logs

LOG MESSAGE

attack TCP attack UDP

DESCRIPTION

The firewall detected a TCP attack.

The firewall detected an UDP attack. attack IGMP attack ESP

The firewall detected an IGMP attack.

The firewall detected an ESP attack. attack GRE attack OSPF ip spoofing - WAN

ESP

The firewall detected a GRE attack.

The firewall detected an OSPF attack. attack ICMP

(type:%d, code:%d) ip spoofing - WAN

IGMP

The firewall detected an ICMP attack; see the section on ICMP messages for type and code details. land TCP land UDP ip spoofing - WAN

UDP

The firewall detected a TCP land attack.

The firewall detected an UDP land attack. land IGMP land ESP

The firewall detected an IGMP land attack.

The firewall detected an ESP land attack. land GRE

The firewall detected a GRE land attack. land OSPF

The firewall detected an OSPF land attack. land ICMP (type:%d, code:%d)

The firewall detected an ICMP land attack; see the section on ICMP messages for type and code details. ip spoofing - WAN

TCP

The firewall detected a TCP IP spoofing attack on the WAN port.

The firewall detected an UDP IP spoofing attack on the WAN port.

The firewall detected an IGMP IP spoofing attack on the WAN port.

The firewall detected an ESP IP spoofing attack on the WAN port.




LOG MESSAGE

ip spoofing - WAN

GRE ip spoofing - WAN

OSPF ip spoofing - WAN

ICMP (type:%d, code:%d) icmp echo ICMP

(type:%d, code:%d) syn flood TCP

DESCRIPTION

The firewall detected a GRE IP spoofing attack on the WAN port.

The firewall detected an OSPF IP spoofing attack on the WAN port.

The firewall detected an ICMP IP spoofing attack on the WAN port.

See the section on ICMP messages for type and code details.

The firewall detected an ICMP echo attack. See the section on ICMP messages for type and code details.

The firewall detected a TCP syn flood attack. ports scan TCP teardrop TCP

The firewall detected a TCP port scan attack.

The firewall detected a TCP teardrop attack. teardrop UDP The firewall detected an UDP teardrop attack. teardrop ICMP

(type:%d, code:%d)

The firewall detected an ICMP teardrop attack; see the section on

ICMP messages for type and code details. illegal command TCP

The firewall detected a TCP illegal command attack.

The firewall detected a TCP NetBIOS attack.

NetBIOS TCP ip spoofing - no routing entry TCP

The firewall detected a TCP IP spoofing attack while the Contivity 221 did not have a default route. ip spoofing - no routing entry UDP ip spoofing - no routing entry IGMP

The firewall detected an UDP IP spoofing attack while the Contivity

221 did not have a default route.

The firewall detected an IGMP IP spoofing attack while the Contivity

221 did not have a default route. ip spoofing - no routing entry ESP ip spoofing - no routing entry GRE

The firewall detected an ESP IP spoofing attack while the Contivity


The firewall detected a GRE IP spoofing attack while the Contivity 221 did not have a default route.

317517-A Rev 00



LOG MESSAGE

ip spoofing - no routing entry OSPF ip spoofing - no routing entry ICMP

(type:%d, code:%d) vulnerability ICMP

(type:%d, code:%d) traceroute ICMP

(type:%d, code:%d)

DESCRIPTION

The firewall detected an OSPF IP spoofing attack while the Contivity


The firewall detected an ICMP IP spoofing attack while the Contivity

221 did not have a default route; see the section on ICMP messages for type and code details.

The firewall detected an ICMP vulnerability attack; see the section on

ICMP messages for type and code details.

The firewall detected an ICMP traceroute attack; see the section on


Chart L-6 Access Logs

LOG MESSAGE

Firewall default policy: TCP

(set:%d)

Firewall default policy: UDP

(set:%d)

Firewall default policy: ICMP

(set:%d, type:%d, code:%d)

Firewall default policy: IGMP

(set:%d)

Firewall default policy: ESP

(set:%d)

DESCRIPTION

TCP access matched the default policy of the listed ACL set and the

Contivity 221 blocked or forwarded it according to the ACL set’s configuration.

UDP access matched the default policy of the listed ACL set and the


ICMP access matched the default policy of the listed ACL set and the

Contivity 221 blocked or forwarded it according to the ACL set’s configuration. See the section on ICMP messages for type and code details.

IGMP access matched the default policy of the listed ACL set and the


ESP access matched the default policy of the listed ACL set and the





LOG MESSAGE

Firewall default policy: GRE

(set:%d)

DESCRIPTION

GRE access matched the default policy of the listed ACL set and the


Firewall default policy: OSPF

(set:%d)

OSPF access matched the default policy of the listed ACL set and the


Firewall default policy: (set:%d)

Firewall rule match: TCP (set:%d, rule:%d)

Access matched the default policy of the listed ACL set and the


TCP access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

Firewall rule match: UDP (set:%d, rule:%d)

UDP access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

Firewall rule match: ICMP

(set:%d, rule:%d, type:%d, code:%d)

Firewall rule match: IGMP

(set:%d, rule:%d)

ICMP access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration. See the section on ICMP messages for type and code details.

IGMP access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

Firewall rule match: ESP (set:%d, rule:%d)

ESP access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

Firewall rule match: GRE (set:%d, rule:%d)

GRE access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

317517-A Rev 00



LOG MESSAGE

Firewall rule match: OSPF

(set:%d, rule:%d)

DESCRIPTION

OSPF access matched the listed a firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

Firewall rule match: (set:%d, rule:%d)

Access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

Firewall rule NOT match: TCP

(set:%d, rule:%d)

Firewall rule NOT match: UDP (set:%d, rule:%d)

TCP access did not match the listed firewall rule and the Contivity 221 logged it.

UDP access did not match the listed firewall rule and the Contivity

221 logged it.

Firewall rule NOT match: ICMP


ICMP access did not match the listed firewall rule and the Contivity

221 logged it.

Firewall rule NOT match: IGMP

(set:%d, rule:%d)

IGMP access did not match the listed firewall rule and the Contivity

221 logged it.

Firewall rule NOT match: ESP (set:%d, rule:%d)

ESP access did not match the listed firewall rule and the Contivity 221 logged it.

Firewall rule NOT match: GRE (set:%d, rule:%d)

GRE ac access did not match the listed firewall rule and the Contivity

221 logged it.

Firewall rule NOT match: OSPF

(set:%d, rule:%d)

OSPF access did not match the listed firewall rule and the Contivity

221 logged it.




LOG MESSAGE

Firewall rule NOT match: (set:%d, rule:%d)

Filter default policy DROP!





Filter default policy FORWARD!





Filter match DROP

<set %d/rule %d>

Filter match DROP

<set %d/rule %d>

DESCRIPTION

Access did not match the listed firewall rule and the Contivity 221 logged it.

TCP access matched a default filter policy and the Contivity 221 dropped the packet to block access.

UDP access matched a default filter policy and the Contivity 221 dropped the packet to block access.

ICMP access matched a default filter policy and the Contivity 221 dropped the packet to block access.

Access matched a default filter policy and the Contivity 221 dropped the packet to block access.

Access matched a default filter policy (denied LAN IP) and the

Contivity 221 dropped the packet to block access.

TCP access matched a default filter policy. Access was allowed and the router forwarded the packet.

UDP access matched a default filter policy. Access was allowed and the router forwarded the packet.

ICMP access matched a default filter policy. Access was allowed and the router forwarded the packet.

Access matched a default filter policy. Access was allowed and the router forwarded the packet.

Access matched a default filter policy (denied LAN IP). Access was allowed and the router forwarded the packet.

TCP access matched the listed filter rule and the Contivity 221 dropped the packet to block access.

UDP access matched the listed filter rule and the Contivity 221 dropped the packet to block access.

317517-A Rev 00



LOG MESSAGE

Filter match DROP

<set %d/rule %d>

Filter match DROP

<set %d/rule %d>

Filter match DROP

<set %d/rule %d>

Filter match

FORWARD <set

%d/rule %d>

Filter match

FORWARD <set

%d/rule %d>

Filter match

FORWARD <set

%d/rule %d>

Filter match

FORWARD <set

%d/rule %d>

Filter match

FORWARD <set

%d/rule %d>

(set:%d)

(rule:%d)

DESCRIPTION

ICMP access matched the listed filter rule and the Contivity 221 dropped the packet to block access.

Access matched the listed filter rule and the Contivity 221 dropped the packet to block access.

Access matched the listed filter rule (denied LAN IP) and the Contivity

221 dropped the packet to block access.

TCP access matched the listed filter rule. Access was allowed and the router forwarded the packet.

UDP access matched the listed filter rule. Access was allowed and the router forwarded the packet.

ICMP access matched the listed filter rule. Access was allowed and the router forwarded the packet.

Access matched the listed filter rule. Access was allowed and the router forwarded the packet.

Access matched the listed filter rule (denied LAN IP). Access was allowed and the router forwarded the packet.

With firewall messages, this is the number of the ACL policy set and denotes the packet's direction (see Chart L-7).

With filter messages, this is the number of the filter set.

With firewall messages, the firewall rule number denotes the number of a firewall rule within an ACL policy set.

With filter messages, this is the number of an individual filter rule.




LOG MESSAGE

Router sent blocked web site message

DESCRIPTION

A message was sent to notify a user that the router blocked access to a requested web site

Triangle route packet forwarded

The firewall allowed a triangle route session to pass through.

Firewall sent TCP packet in response to DoS attack

The firewall detected a DoS attack and sent a TCP packet(s) in response.

Firewall sent TCP reset packets

The firewall sent out TCP reset packets.

Packet without a

NAT table entry blocked

The router blocked a packet that did not have a corresponding

SUA/NAT table entry.

The router blocked a TCP handshake packet that came out of the proper order

Out of order TCP handshake packet blocked

Drop unsupported/out-oforder ICMP

Router sent ICMP response packet

(type:%d, code:%d)

The Contivity 221 generates this log after it drops an ICMP packet due to one of the following two reasons:

1. The Contivity 221 does not support the ICMP packet's protocol.

2. The ICMP packet is an echo reply for which there was no corresponding echo request.

The router sent an ICMP response packet. This packet automatically bypasses the firewall. See the section on ICMP messages for type and code details.

Chart L-7 ACL Setting Notes

1

ACL SET

NUMBER

DIRECTION DESCRIPTION

LAN to WAN ACL set 1 for packets traveling from the LAN to the WAN.

317517-A Rev 00



2

ACL SET

NUMBER

7

8


WAN to LAN ACL set 2 for packets traveling from the WAN to the LAN.

LAN to

LAN/Contivity 221

WAN to

WAN/Contivity

221

ACL set 7 for packets traveling from the LAN to the LAN or the

Contivity 221.

ACL set 8 for packets traveling from the WAN to the WAN or the

Contivity 221.

Chart L-8 ICMP Notes

TYPE CODE DESCRIPTION

Fragment (DF) needed to queue the datagrams for output to the next network on the route to the destination network.





317517-A Rev 00


Chart L-9 Sys log

LOG MESSAGE DESCRIPTION

Mon dd hr:mm:ss hostname src="<srcIP:srcPort>" dst="<dstIP:dstPort>" msg="<msg>" note="<note>"

This message is sent by the "RAS" when this syslog is generated. The messages and notes are defined in this appendix’s other charts.

VPN/IPSec logs

To view the IPSec and IKE connection log, type 3 in menu 27 and press [ENTER] to display the IPSec log as shown next. The following figure shows a typical log from the initiator of a VPN connection.

Diagram L-1 Example VPN Initiator IPSec Log

Index: Date/Time: Log:

------------------------------------------------------------

001 01 Jan 08:02:22 Send Main Mode request to <192.168.100.101>

002 01 Jan 08:02:22 Send:<SA>

003 01 Jan 08:02:22 Recv:<SA>

004 01 Jan 08:02:24 Send:<KE><NONCE>

005 01 Jan 08:02:24 Recv:<KE><NONCE>

006 01 Jan 08:02:26 Send:<ID><HASH>

007 01 Jan 08:02:26 Recv:<ID><HASH>

008 01 Jan 08:02:26 Phase 1 IKE SA process done

009 01 Jan 08:02:26 Start Phase 2: Quick Mode

010 01 Jan 08:02:26 Send:<HASH><SA><NONCE><ID><ID>

011 01 Jan 08:02:26 Recv:<HASH><SA><NONCE><ID><ID>

012 01 Jan 08:02:26 Send:<HASH>

Clear IPSec Log (y/n):



VPN Responder IPSec Log

The following figure shows a typical log from the VPN connection peer.

Diagram L-2 Example VPN Responder IPSec Log


------------------------------------------------------------

001 01 Jan 08:08:07 Recv Main Mode request from <192.168.100.100>

002 01 Jan 08:08:07 Recv:<SA>

003 01 Jan 08:08:08 Send:<SA>

004 01 Jan 08:08:08 Recv:<KE><NONCE>

005 01 Jan 08:08:10 Send:<KE><NONCE>

006 01 Jan 08:08:10 Recv:<ID><HASH>

007 01 Jan 08:08:10 Send:<ID><HASH>





012 01 Jan 08:08:10 Recv:<HASH>


This menu is useful for troubleshooting. A log index number, the date and time the log was created and a log message are displayed.

Double exclamation marks (!!) denote an error or warning message.

The following table shows sample log messages during IKE key exchange.

A PYLD_MALFORMED packet usually means that the two ends of the

VPN tunnel are not using the same pre-shared key.

Chart L-10 Sample IKE Key Exchange Logs


Send <Symbol> Mode request to <IP>


Recv <Symbol> Mode request from <IP>


The Contivity 221 has started negotiation with the peer.

The Contivity 221 has received an IKE negotiation request from the peer.

317517-A Rev 00



LOG MESSAGE

Recv:<Symbol>

Phase 1 IKE SA process done

Start Phase 2: Quick Mode

DESCRIPTION

IKE uses the ISAKMP protocol (refer to RFC2408 –

ISAKMP) to transmit data. Each ISAKMP packet contains payloads of different types that show in the log - see Chart L-12.

Phase 1 negotiation is finished.

Phase 2 negotiation is beginning using Quick Mode.

!! IKE Negotiation is in process

!! Duplicate requests with the same cookie

!! No proposal chosen

!! Verifying Local ID failed

!! Verifying Remote ID failed

!! Local / remote IPs of incoming request conflict with rule <#d>

!! Invalid IP <IP start>/<IP end>

!! Remote IP <IP start> / <IP end> conflicts

!! Active connection allowed exceeded

The Contivity 221 has begun negotiation with the peer for the connection already, but the IKE key exchange has not finished yet.

The Contivity 221 has received multiple requests from the same peer but it is still processing the first IKE packet from that peer.

The parameters configured for Phase 1 or Phase 2 negotiations don’t match. Please check all protocols and settings for these phases. For example, one party may be using 3DES encryption, but the other party is using DES encryption, so the connection will fail.

During IKE Phase 2 negotiation, both parties exchange policy details, including local and remote IP address ranges. If these ranges differ, then the connection fails.

If the security gateway is “0.0.0.0”, the Contivity 221 will use the peer’s “Local Addr” as its “Remote Addr”. If this IP (range) conflicts with a previously configured rule then the connection is not allowed.

The peer’s “Local IP Addr” range is invalid.

If the security gateway is “0.0.0.0”, the Contivity 221 will use the peer’s “Local Addr” as its “Remote Addr”. If a peer’s “Local Addr” range conflicts with other connections, then the Contivity 221 will not accept

VPN connection requests from this peer.

The Contivity 221 limits the number of simultaneous

Phase 2 SA negotiations. The IKE key exchange process fails if this limit is exceeded.





!! IKE Packet Retransmit

!! Failed to send IKE Packet

!! Too many errors! Deleting SA

!! Phase 1 ID type mismatch

!! Phase 1 ID content mismatch

!! No known phase 1 ID type found

Peer ID: IP address type <IP address>

The Contivity 221 did not receive a response from the peer and so retransmits the last packet sent.

The Contivity 221 cannot send IKE packets due to a network error.

The Contivity 221 deletes an SA when too many errors occur.

The ID type of an incoming packet does not match the local's peer ID type.

The ID content of an incoming packet does not match the local's peer ID content.

The ID type of an incoming packet does not match any known ID type. vs. My Remote <IP address> vs. My Local <IP address>

-> <symbol>

Error ID Info

The IP address type or IP address of an incoming packet does not match the peer IP address type or IP address configured on the local router. The log displays the IP address type and IP address of the incoming packet.

The IP address type or IP address of an incoming packet does not match the peer IP address type or IP address configured on the local router. The log displays this router’s configured remote IP address type or IP address that the incoming packet did not match.

The IP address type or IP address of an incoming packet does not match the peer IP address type or IP address configured on the local router. The log displays this router’s configured local IP address type or IP address that the incoming packet did not match.

The router sent a payload type of IKE packet.

The parameters configured for Phase 1 ID content do not match or the parameters configured for the Phase

2 ID (IP address of single, range or subnet) do not match. Please check all protocols and settings for these phases.

317517-A Rev 00


The following table shows sample log messages during packet transmission.

Chart L-11 Sample IPSec Logs During Packet Transmission


!! WAN IP changed to <IP> If the Contivity 221’s WAN IP changes, all configured “My IP Addr” are changed to b “0.0.0.0”. If this field is configured as 0.0.0.0, then the Contivity 221 will use the current Contivity 221 WAN IP address

(static or dynamic) to set up the VPN tunnel.

!! Cannot find IPSec SA The Contivity 221 cannot find a phase 2 SA that corresponds with the SPI of an inbound packet (from the peer); the packet is dropped.

!! Cannot find outbound SA for rule <%d>

The packet matches the rule index number (#d), but Phase 1 or

Phase 2 negotiation for outbound (from the VPN initiator) traffic is not finished yet.

!! Discard REPLAY packet

!! Inbound packet authentication failed

If the Contivity 221 receives a packet with the wrong sequence number it will discard it.

The authentication configuration settings are incorrect. Please check them.

!! Inbound packet decryption failed

Rule <#d> idle time out, disconnect

The decryption configuration settings are incorrect. Please check them.

If an SA has no packets transmitted for a period of time

(configurable via CI command), the Contivity 221 drops the connection.

The following table shows RFC-2408 ISAKMP payload types that the log displays. Please refer to the RFC for detailed information on each type.

Chart L-12 RFC-2408 ISAKMP Payload Types

LOG DISPLAY

SA

PROP

TRANS

KE

ID

PAYLOAD TYPE

Security Association

Proposal

Transform

Key Exchange

Identification




CER

LOG DISPLAY

CER_REQ

HASH

SIG

NONCE

NOTFY

DEL

VID

PAYLOAD TYPE

Certificate

Certificate Request

Hash

Signature

Nonce

Notification

Delete

Vendor ID

Log Commands

Go to the command interpreter interface (the Command Interpreter Appendix explains how to access and use the commands).

Configuring What You Want the Contivity 221 to Log

Use the sys logs load command to load the log setting buffer that allows you to configure which logs the Contivity 221 is to record.

Use sys logs category followed by a log category and a parameter to decide what to record

Chart L-13 Log Categories and Available Settings

LOG CATEGORIES

access attack error ike ipsec javablocked

AVAILABLE PARAMETERS

0, 1, 2, 3

0, 1, 2, 3

0, 1, 2, 3

0, 1, 2, 3

0, 1, 2, 3

0, 1, 2, 3

317517-A Rev 00



LOG CATEGORIES AVAILABLE PARAMETERS

urlblocked 0, 1, 2, 3

Use 0 to not record logs for that category, 1 to record only logs for that category, 2 to record only alerts for that category, and

3

to record both logs and alerts for that category.

Use the sys logs save command to store the settings in the Contivity 221

(you must do this in order to record logs).

Displaying Logs

Use the sys logs display command to show all of the logs in the Contivity

221’s log.

Use the sys logs category display command to show the log settings for all of the log categories.

Use the sys logs display [log category] command to show the logs in an individual Contivity 221 log category.

Use the sys logs clear command to erase all of the Contivity 221’s logs.

Log Command Example

This example shows how to set the Contivity 221 to record the access logs and alerts and then view the results. ras> sys logs load ras> sys logs category access 3 ras> sys logs save ras> sys logs display access



# .time source destination notes

message

0|11/11/2002 15:10:12 |172.22.3.80:137 |172.22.255.255:137

|ACCESS BLOCK

Firewall default policy: UDP(set:8)

1|11/11/2002 15:10:12 |172.21.4.17:138 |172.21.255.255:138

|ACCESS BLOCK


2|11/11/2002 15:10:11 |172.17.2.1 |224.0.1.60

|ACCESS BLOCK

Firewall default policy: IGMP(set:8)

3|11/11/2002 15:10:11 |172.22.3.80:137 |172.22.255.255:137

|ACCESS BLOCK


4|11/11/2002 15:10:10 |192.168.10.1:520 |192.168.10.255:520

|ACCESS BLOCK


5|11/11/2002 15:10:10 |172.21.4.67:137 |172.21.255.255:137

|ACCESS BLOCK

317517-A Rev 00

M-1

Appendix M


The following describes the commands for enabling, disabling and configuring the brute-force password guessing protection mechanism for the password. See the

Error! Reference source not found. appendix for information on the command

structure.

Chart M-1 Brute-Force Password Guessing Protection Commands

COMMAND

sys pwderrtm sys pwderrtm 0 sys pwderrtm N

Example sys pwderrtm 5

DESCRIPTION

This command displays the brute-force guessing password protection settings.

This command turns off the password’s protection from brute-force guessing.

The brute-force password guessing protection is turned off by default.

This command sets the password protection to block all access attempts for N

(a number from 1 to 60) minutes after the third time an incorrect password is entered.

This command sets the password protection to block all access attempts for five minutes after the third time an incorrect password is entered.



Part XV:


This part provides information on the command line interface, firewall and NetBIOS commands, logs and password protection.

XV

I-1

Appendix I

Command Interpreter

The following describes how to use the command interpreter. Enter 24 in the main menu to bring up the system maintenance menu. Enter 8 to go to Menu 24.8 -

Command Interpreter Mode. See the included disk or nortelnetworks.com for

more detailed information on these commands.


Command Syntax







Command Usage

A list of valid commands can be found by typing help or ? at the command prompt. Always type the full command. Type exit to return to the SMT main menu when finished.

Sys Commands



The following chart lists and describes the sys commands. Each of these commands must be preceded by sys when you use them. For example, type sys stdio 60

to set the management session inactivity timeout to 60 minutes.

Chart I-1

Sys Commands adjtime atsh callhist

display countryc ode

Displays the call history.

Removes an entry from the call history.

[countrycode] Sets or displays the country code. date [year month date]

Retrieves the date and time from the time server specified in the WebGUI. domainna me edit extraphn um

<filename> add <set 1-3> <1 st

phone num>

[2 nd

phone num]

display

Sets or displays the system’s current date.

Displays the domain name that the device sends to the LAN DHCP clients.

Edits the system preset text file such as autoexec.net.

Maintains extra phone numbers for outgoing (dial backup) calls.

Add extra phone numbers.

Display the extra phone numbers. remove feature

<set 1-3>

reset

Sets all extend phone numbers to remote node <num>.

Remove extra phone numbers.

Resets node and mask.

Displays a list of the device’s major features.

317517-A Rev 00


Chart I-1

Sys Commands hostname logs

[hostname]

category access

[0:none/1:log/2:alert/3:b oth] attack


Sets or displays the system name.


Records and/or sends alerts for firewall attack logs. cdr Records Call Detail Record logs. display

Displays the category settings. error


Records and/or sends alerts for system error logs. icmp Records ICMP logs. ipsec


Records the access control logs ike

[0:none/1:log/2:alert/3:b oth] javablocked

[0:none/1:log]


Records the java etc. blocked logs. mten Records the system maintenance logs. packetfilter

[0:none/1:log]

Records the packet filter logs. ppp Records the PPP logs. remote

Records the remote management logs. tcpreset

Records the TCP reset logs.



Chart I-1

Sys Commands upnp Records the UPnP logs. urlblocked


Records and/or sends alerts for web access blocked logs. urlforward Records web access forward logs.

clear Clears the log. c|ike|javablocked|mten|ur lblocked|urlfor

Displays all logs or specified categories of logs. ward]

load

Loads the log settings buffer. Use this command before you configure the log settings. Use sys logs save after you configure the log settings.

mail alertAddr [mail address]

Send alerts to this e-mail address. clearlog display Displays the logs and alerts mail settings. logAddr [mail address] Send logs to this e-mail address. schedule Displays the mail schedule. schedule hour [0-23] Sets the hour to send logs. schedule minute [0-59] Sets the minute to send the logs.

Sets the mail schedule policy. schedule policy

[0:full/1:hourly/2:daily/

3:weekly/4:none] schedule week

[0:sun/1:mon/2:tue/3:wed/

4:thu/5:fri/6:sat]

Sets the day of the wee for sending weekly logs.

317517-A Rev 00


Chart I-1

Sys Commands server Sets the domain name or IP address of the mail server to which to send the logs. subject [mail subject] Sets the log e-mail’s subject.

save

syslog

Save the log settings from the buffer. active Enables/disables syslog logging. display Displays the syslog settings. facility [Local ID(1-7)] Specifies the file to which the device logs the syslog messages. server Specifies the domain name or IP address of the syslog server to which to send the syslogs.

Sets how often to resolve the mail and/or syslog server domain name to an IP address. pwderrtm [minute]

Sets or displays the password error blocking timeout value. rn

accessblock Blocks access to a remote node.

Loads remote node information.

Displays remote node information. disp <entry no.>(0:working buffer)

nat Configure remote node NAT.

Configure a remote node connection to be nailed up (always on).

mtu <value> Sets the remote node Maximum

Transmission Unit.

Save remote node information.



Chart I-1

Sys Commands stdio time trcdisp version

[minute]

[hour [min [sec]]] parse, brief, disp

Sets or displays the management terminal idle timeout value.

Sets or displays the system time.

Sets the level of detail that should be displayed. Use “parse” to display the most detail and “disp” to display the least.

Displays the RAS code and driver versions. view wdog

cnt [value] romreset socket filter

<filename>

netbios

Displays the specified text file.

Turns the watchdog firmware protection feature on or off.

Sets (0-34463) or displays the current watchdog count (in 1.6 sec units).

Restores the factory default configuration file.

Displays the system socket’s ID #, type, control block address (PCB),

IP address and port number of peer device connected to the socket

(Remote Socket) and task control block (Owner). disp Displays the current NetBIOS filter modes. config <0:Between LAN and

WAN/ 3: IPSec Pass through/4: Trigger Dial>

<on|off>

Sets NetBIOS filters.

317517-A Rev 00


Chart I-1

Sys Commands roadrunn er ddns

debug

display

Enables/disables roadrunner service.

0: disable (default)

1: enable

Displays roadrunner information iface-name: enif0, wanif0

Restarts roadrunner.

Turns on/off the displaying of DDNS debug messages.

Displays DDNS information.

restart

logout cpu

Restarts DDNS.

This command has no effect.

Displays the CPU’s utilization.

display upnp

Activates or deactivates the saved

UPnP settings.

config Allow users to make configuration changes through UPnP.

display Displays UPnP information.

firewall

Allow UPnP to pass through

Firewall.

load

reserve

save





Exit Command

Chart I-2

Exit Command exit


Ends the command interpreter session.

Ethernet Commands

The following chart lists and describes the ether commands. Each of these commands must be preceded by ether when you use them. For example, type ether config

to display information on the LAN configuration.

Chart I-3

Ether Commands


Displays LAN configuration information. config driver

cnt

Displays the Ethernet driver counters. version edit

[arguments]

mtu <value> currently.

Shows the LAN status.

Displays the Ethernet device type.

Loads Ethernet (1:LAN) data from the


Sets the Ethernet data Maximum

Transmission Unit.

save Saves Ethernet data to the System

Parameters Table.

317517-A Rev 00


IP Commands

The following chart lists and describes the ip commands. Each of these commands must be preceded by ip when you use them. For example, type ip address

to display the host IP address.

Chart I-4

IP Commands


address alias aliasdis arp

[addr]

<iface>

<0|1>

Displays the host IP address.

Sets an alias for the specified interface.

Disables/enables the alias for the specified interface.

status Displays an interface’s IP Address

Resolution Protocol status. dhcp <iface>

client release Releases the DHCP client IP address. renew Renews the DHCP client IP address.

status Displays the DHCP status. dns

query

stats clear Clears DNS statistics. httpd icmp disp Displays DNS statistics. debug Enables or disables the HTTP debug flag. This command does not work currently.

status

Displays the ICMP statistics counter.



Chart I-4

IP Commands ifconfig ping rip route


Configures a network interface.

[broadcast <addr>

|mtu

<value>|dynamic]

<hostid>

add <dest_addr|default

>[/<bits>]

<gateway>

[<metric>]

Pings a remote host.

Displays the routing table.

Adds a route.

Adds an entry to the routing table for the specified interface. >[/<bits>]

<gateway>

[<metric>]

Adds a private route.

>[/<bits>]

<gateway>

[<metric>] rpt

[/<bits>]

start

stop

url

ip

srv smtp status

Start recording reports data.

Stop recording reports data.

Record the most visited web sites.

Record the LAN IP addresses that sent and received the most traffic.

Record the most heavily used protocols or service ports.

Displays IP statistic counters.

317517-A Rev 00


Chart I-4

IP Commands stroute


display [rule # | buf] Displays the list of static routes or detailed information on a specified rule.

load <rule Load the specified static route rule into the buffer.

save Saves a rule from the buffer to the


config name <site name> Sets the name for a static route. addr>[/<bits>]

<gateway>

[<metric>] mask <IP subnet mask> address and gateway.

Sets a static route’s subnet mask. address> metric <metric #> Sets a static route’s metric number. tcp status tftp telnet <host> tracerout e udp

status urlfilter

[wait] [queries]

Displays the TCP statistic counters.

Telnets to the specified host. of a remote host.

Displays the UDP status.



Chart I-4

IP Commands


exemptZone

Display

Displays content filtering exempt zone information. actionFlags

[type(1-

3)][enable/disable

]

Enables/disables content filtering exempt zone action flags that determine to which IP addresses to apply content filtering. add [ip1] [ip2] Sets a range of IP addresses to be in the exempt zone. delete [ip1] [ip2] Removes a range of IP addresses from the exempt zone. reset

customize

Returns the exempt zone settings to the previous configuration.

Use the customize commands to configure content filtering for trusted web sites, forbidden web sites and keyword blocking. display

Displays the content filtering customize action flags.

[act(1-7)]

[enable/disable] action flags.

3)][enable/disabl e]

Sets the content filtering customize log flags.

[trust/untrust/key word] site or keyword blocking string.

[trust/untrust/key word] reset web site or keyword blocking string.

Return to the default configuration.

317517-A Rev 00


Chart I-4

IP Commands tredir


failcount Sets the number of times that the device may ping the target without a response before forwarding traffic to the backup gateway.

partner Sets the traffic redirect backup gateway

IP address.

target Sets the IP address that the device uses to test WAN accessibility.

timeout Sets the number of seconds the device waits for a response from the target.

checktime

Sets the number of seconds the device waits between attempts to connect to the target.

active Enables/disables traffic redirect.

save

disp

Saves traffic redirect configuration.

Displays the traffic redirect configuration.

debug <value> Sets the traffic redirect debug value. igmp

debug [level] Sets IGMP debug level.

forwardall

Activates/deactivates IGMP forwarding to all interfaces flag.

querier Turns on/off IGMP stop query flag.

iface

<timeout> specified interface.

<interval> specified interface.

<group>



Chart I-4

IP Commands


<group> interface.

[time] interface. interface.

<threshold>

[on|off]

status compatibility on the specified interface.

Sets the IGMP robustness variable.

Displays the IGMP status.

IPSec Commands

The following chart lists and describes the ipsec commands. Each of these commands must be preceded by ipsec when you use them. For example, type ipsec display 3

to display the third IPSec rule if you have it configured.

Chart I-5

IPSec Commands


adjTcpMss <off|auto|user defined value>

Sets the adjust TCP Maximum Segment Size. contivityDial contivityDrop

Initiates the Contivity Client VPN connection.

Ends the Contivity Client VPN connection. contivityState

VPN connection.

317517-A Rev 00


Chart I-5

IPSec Commands contivitySplit


Sets the time count between NAT states. ContivityTime

CntbtNatState debug <on|off> Turns the trace for IPsec debug information on|off. exemptHost display

Use the exemptHost commands to configure specific IP addresses that are not to be part of a

VPN tunnel.

Displays the exempt host settings. load active sourceStart sourceEnd destStart destEnd

<index>

<Yes|No>

<IP address>

<IP address>

<IP address>

<IP address>

Loads an exempt host.

Enables/disables an exempt host.

Sets the exempt host’s source start IP address.

Sets the exempt host’s source end IP address.

Sets the exempt host’s destination start IP address.

Sets the exempt host’s destination end IP address.

Saves an exempt host. ipPolicy save activeNAT add delete

<Yes|No> Enables/disables NAT for an IP policy.

Adds an IP policy.

Removes an IP policy. display

internal list load <policy Index>



Loads an IP policy.

local type Sets an IP policy’s local address type.

2:subnet>



Chart I-5

IPSec Commands


addrStart <IP address> Sets an IP policy’s starting local IP address. endMask <IP address> Sets an IP policy’s ending local IP address or subnet mask. port <port number> Sets an IP policy’s local port number.

Sets an IP policy’s protocol number.

:UDP>

remote type Sets an IP policy’s remote address type.

2:subnet> addrStart <IP address> Sets an IP policy’s starting remote IP address. endMask <IP address> port <port number>

Sets an IP policy’s ending remote IP address or subnet mask.

Sets an IP policy’s remote port number. rawDebug route save

<on|off> lan wan

<on|off>

<on|off>

Saves an IP policy.

Turns the IPSec raw debug feature on/off.

After IPSec has processed a packet and sent it to the LAN side, this switch controls whether or not IPSec can be applied to the packet again.

After IPSec has processed a packet and sent it to the WAN side, this switch controls whether or not IPSec can be applied to the packet again. show_runtime sa switch spd

<on|off> information.

When a dynamic rule accepts a request and a tunnel is established, a runtime SPD is created according to the peer’s local IP address. This command displays these runtime SPDs.

As long as there is one active IPSec rule, all packets will go into the IPSec process to check against the SPD. When this switch is turned on packets will not be put through the IPSec process, even if there are active IPSec rules.

317517-A Rev 00


Chart I-5

IPSec Commands


swSkipOverlap <on|off> Turn this on to have the device allow rules with overlapping source and destination IP addresses. timer

chk_input chk_my_ip chk_conn.

update_peer updatePeerIp dial display load

<rule #>

<rule #>

<rule #>

Sets the timer for checking if the WAN IP in the menu has changed. The interval is in seconds (10 default) and 0 is not a valid value.

Sets the idle timeout for IPSec connections. The system disconnects an IPSec connection with no traffic for the timeout period. The interval is in minutes (2 default) and 0 means the connection never times out.

Sets the auto-timer for updating IPSec rules that use a domain name as the secure gateway IP address. The interval is in minutes (30 default) and 0 means it never updates.

Forces the system to immediately update IPSec rules which use a domain name as the secure gateway IP address.

Initiates a VPN connection attempt using the specified rule.

Displays the specified IPSec rule.

Loads an IPSec rule. save config netbios name keepAlive lcIdType active <on|off> group <group index1, group index2…>

<string>

<Yes| No>

Saves IPSec rules.

Sets the NetBIOS active flag.

Sets the NetBIOS group.

Sets a rule’s name.

Enables/disables keep alive.

<0:IP | 1:DNS | 2:Email> Sets the local ID type.



Chart I-5

IPSec Commands


lcIdContent <string> Sets the local ID content. myIpAddr <IP address> Sets the my IP address. peerIdType peerIdContent secureGwAddr

<0:IP | 1:DNS | 2:Email>

<string>

<IP address | Domain name>

Sets the peer ID type.

Sets the peer ID content.

Sets the secure gateway IP address or domain name.

<0:Main | 1:Aggressive> preShareKey <string> p1AuthAlgo <0:MD5 |

1:SHA1>

Sets the IKE phase 1 pre-shared key. p1EncryAlgo

1:3DES>


<seconds> p1KeyGroup

1:DH2> activeProtocol

1:ESP> p2EncryAlgo

1:DES | 2:3DES> p2AuthAlgo <0:MD5 |

1:SHA1>


<seconds>

Sets the IKE phase 2 encapsulation. encap <0:Tunnel |

1:Transport> pfs <0:None | 1:DH1 |

2:DH2>

Sets the IKE phase 2 perfect forward secret.

317517-A Rev 00


Sys Firewall Commands

The following chart lists and describes the sys firewall commands. Each of these commands must be preceded by sys firewall when you use them. For example, type sys firewall active yes to turn on the firewall.

Chart I-6

Sys Firewall

Commands


acl

disp active <yes|no> cnt

disp

Displays ACLs or a specific ACL set # and rule #.

Active firewall or deactivate firewall

Enables/disables the firewall.

Displays the firewall log type and count.

clear dynamicrule tcprst

rst

rst113

Clears the firewall log count.

Displays the temporary firewall rules that the device dynamically created.

Turns TCP reset sending on/off.

Turns TCP reset sending for port 113 on/off.

display dos

smtp

display

ignore ignore

dos

triangle

Displays the TCP reset sending settings.

Enables/disables the SMTP DoS defender.

Displays the SMTP DoS defender setting.



Sets if the firewall will ignore triangle route packets on the lan/wan/dmz/wlan.



317517-A Rev 00

J-1

Appendix J

NetBIOS Filter Commands

The following describes the NetBIOS packet filter commands. See the Command

Interpreter appendix for information on the command structure.

Introduction

NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a computer to connect to and communicate with a LAN.

For some dial-up services such as PPPoE or PPTP, NetBIOS packets cause unwanted calls.

You can configure NetBIOS filters to do the following:

• Allow or disallow the sending of NetBIOS packets from the LAN to the WAN and from the WAN to the LAN.

• Allow or disallow the sending of NetBIOS packets through VPN connections.

• Allow or disallow NetBIOS packets to initiate calls.

Display NetBIOS Filter Settings

Diagram J-1 NetBIOS Display Filter Settings Command Example

=============== NetBIOS Filter Status ===============

Between LAN and WAN: Block

IPSec Packets: Forward

Trigger Dial: Disabled

Syntax: sys filter netbios disp

This command gives a read-only list of the current NetBIOS filter modes.

The filter types and their default settings are as follows.


J-2 NetBIOS Filter Commands

Chart J-1 NetBIOS Filter Default Settings

Between LAN and WAN

IPSec Packets This field displays whether NetBIOS packets sent through a VPN connection are blocked or forwarded.

Trigger dial

This field displays whether NetBIOS packets are blocked or forwarded from the LAN to the WAN or from the WAN to the LAN.

This field displays whether NetBIOS packets are allowed to initiate calls. Disabled means that NetBIOS packets are blocked from initiating calls.

Forward

Forward

Disabled

NetBIOS Filter Configuration

Syntax: sys filter netbios config <type> <on|off> where

<type>

=

Identify which NetBIOS filter (numbered 0-3) to configure.

0

= LAN to WAN and WAN to LAN

<on|off>

=

3 = IPSec packet pass through

4 = Trigger Dial

For type 0, use on to enable the filter and block NetBIOS packets. Use off to disable the filter and forward NetBIOS packets.

For type 3, use on to block NetBIOS packets from being sent through a VPN connection. Use off to allow NetBIOS packets to be sent through a VPN connection.

For type 4, use on to allow NetBIOS packets to initiate dial backup calls. Use off

to block NetBIOS packets from initiating dial backup calls.

Example commands


This command blocks LAN to WAN and WAN to LAN NetBIOS packets


317517-A Rev 00

NetBIOS Filter Commands J-3

This command forwards WAN to LAN and WAN to LAN NetBIOS packets


This command blocks IPSec NetBIOS packets


This command stops NetBIOS commands from initiating calls.


K-1

Appendix K

Boot Commands

The BootModule AT commands execute from within the router’s bootup software, when debug mode is selected before the main router firmware is started. When you start up your Contivity 221, you are given a choice to go into debug mode by pressing a key at the prompt shown in the following screen. In debug mode you have access to a series of boot module commands, for example

ATUR

(for uploading firmware) and

ATLC

(for uploading the configuration file). These are already discussed in the Firmware and Configuration File Maintenance chapter.

Diagram K-1 Option to Enter Debug Mode

Bootbase Version: V1.02 | 08/08/2001 15:40:50

RAM: Size = 16384 Kbytes

DRAM Post: Testing: 16384K OK

FLASH: Intel 16M

RAS Version: V3.50(WB.0)b3 | 08/08/2001 16:21:27

Press any key to enter debug mode within 3 seconds.

Enter

ATHE

to view all available Contivity 221 boot module commands as shown in the next screen.

ATBAx

allows you to change the console port speed. The x denotes the number preceding the colon to give the console port speed following the colon in the list of numbers that follows; for example

ATBA3

will give a console port speed of 9.6 Kbps.

ATSE

displays the seed that is used to generate a password to turn on the debug flag in the firmware. The

ATSH

command shows product related information such as boot module version, vendor name, product model, RAS code revision, etc.

ATGO

allows you to continue booting the system.

Most other commands aid in advanced troubleshooting and should only be used by qualified engineers.


K-2 Boot Commands

Diagram K-2 Boot Module Commands

AT just answer OK

ATHE print help

ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k

ATENx,(y) set BootExtension Debug Flag (y=password)

ATSE show the seed of password generator

ATTI(h,m,s) change system time to hour:min:sec or show current time

ATDA(y,m,d) change system date to year/month/day or show current date

ATDS dump RAS stack

ATDT dump Boot Module Common Area

ATDUx,y dump memory contents from address x for length y

ATRBx display the 8-bit value of address x

ATRWx display the 16-bit value of address x

ATRLx display the 32-bit value of address x

ATGO(x) run program at addr x or boot router

ATGR boot router

ATGT run Hardware Test Program

ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations)

ATSH dump manufacturer related data in ROM

ATDOx,y download from address x for length y to PC via XMODEM

ATTD download router configuration to PC via XMODEM

ATUR upload router firmware to flash ROM

ATLC upload router configuration file to flash ROM

ATXSx xmodem select: x=0: CRC mode(default); x=1: checksum mode

ATSR system reboot

317517-A Rev 00

Appendix L

Log Descriptions

Chart L-1 System Error Logs

LOG MESSAGE

%s exceeds the max. number of session per host!

DESCRIPTION

This attempt to create a SUA/NAT session exceeds the maximum number of SUA/NAT session table entries allowed to be created per host.


LOG MESSAGE

Time calibration is successful

DESCRIPTION

The router has adjusted its time based on information from the time server.

Time calibration failed

The router failed to get information from the time server.

DHCP client gets %s

A DHCP client got a new IP address from the DHCP server.

DHCP client IP expired

A DHCP client's IP address has expired.

DHCP server assigns

%s

The DHCP server assigned an IP address to a client.

SMT Login

Successfully

Someone has logged on to the router's SMT interface.

Someone has failed to log on to the router's SMT interface.

SMT Login Fail

WEB Login

Successfully

WEB Login Fail

Someone has logged on to the router's WebGUI interface.

Someone has failed to log on to the router's WebGUI interface.

L-1




Someone has logged on to the router via telnet.

TELNET Login

Successfully

TELNET Login Fail

FTP Login

Successfully

FTP Login Fail

NAT Session Table is Full!

Someone has failed to log on to the router via telnet.

Someone has logged on to the router via ftp.

Someone has failed to log on to the router via ftp.

The maximum number of SUA/NAT session table entries has been exceeded and the table is full.

Chart L-3 UPnP Logs

LOG MESSAGE

UPnP pass through

Firewall

Chart L-4 Content Filtering Logs

DESCRIPTION

UPnP packets can pass through the firewall.

URLFOR

URLBLK

JAVBLK

IP/Domain

Name

IP/Domain

Name

IP/Domain

Name

DESCRIPTION

The Contivity 221 allows access to this IP address or domain name and forwarded traffic addressed to the IP address or domain name.

The Contivity 221 blocked access to this IP address or domain name due to a forbidden keyword. All web traffic is disabled except for trusted domains, untrusted domains, or the cybernot list.

The Contivity 221 blocked access to this IP address or domain name because of a forbidden service such as:

ActiveX, a Java applet, a cookie, or a proxy.

317517-A Rev 00



LOG MESSAGE

attack TCP attack UDP

DESCRIPTION

The firewall detected a TCP attack.

The firewall detected an UDP attack. attack IGMP attack ESP

The firewall detected an IGMP attack.

The firewall detected an ESP attack. attack GRE attack OSPF ip spoofing - WAN

ESP

The firewall detected a GRE attack.

The firewall detected an OSPF attack. attack ICMP

(type:%d, code:%d) ip spoofing - WAN

IGMP

The firewall detected an ICMP attack; see the section on ICMP messages for type and code details. land TCP land UDP ip spoofing - WAN

UDP

The firewall detected a TCP land attack.

The firewall detected an UDP land attack. land IGMP land ESP

The firewall detected an IGMP land attack.

The firewall detected an ESP land attack. land GRE

The firewall detected a GRE land attack. land OSPF

The firewall detected an OSPF land attack. land ICMP (type:%d, code:%d)

The firewall detected an ICMP land attack; see the section on ICMP messages for type and code details. ip spoofing - WAN

TCP

The firewall detected a TCP IP spoofing attack on the WAN port.

The firewall detected an UDP IP spoofing attack on the WAN port.

The firewall detected an IGMP IP spoofing attack on the WAN port.

The firewall detected an ESP IP spoofing attack on the WAN port.




LOG MESSAGE

ip spoofing - WAN

GRE ip spoofing - WAN

OSPF ip spoofing - WAN

ICMP (type:%d, code:%d) icmp echo ICMP

(type:%d, code:%d) syn flood TCP

DESCRIPTION

The firewall detected a GRE IP spoofing attack on the WAN port.

The firewall detected an OSPF IP spoofing attack on the WAN port.

The firewall detected an ICMP IP spoofing attack on the WAN port.

See the section on ICMP messages for type and code details.

The firewall detected an ICMP echo attack. See the section on ICMP messages for type and code details.

The firewall detected a TCP syn flood attack. ports scan TCP teardrop TCP

The firewall detected a TCP port scan attack.

The firewall detected a TCP teardrop attack. teardrop UDP The firewall detected an UDP teardrop attack. teardrop ICMP

(type:%d, code:%d)

The firewall detected an ICMP teardrop attack; see the section on

ICMP messages for type and code details. illegal command TCP

The firewall detected a TCP illegal command attack.

The firewall detected a TCP NetBIOS attack.

NetBIOS TCP ip spoofing - no routing entry TCP

The firewall detected a TCP IP spoofing attack while the Contivity 221 did not have a default route. ip spoofing - no routing entry UDP ip spoofing - no routing entry IGMP

The firewall detected an UDP IP spoofing attack while the Contivity


The firewall detected an IGMP IP spoofing attack while the Contivity

221 did not have a default route. ip spoofing - no routing entry ESP ip spoofing - no routing entry GRE

The firewall detected an ESP IP spoofing attack while the Contivity


The firewall detected a GRE IP spoofing attack while the Contivity 221 did not have a default route.

317517-A Rev 00



LOG MESSAGE

ip spoofing - no routing entry OSPF ip spoofing - no routing entry ICMP

(type:%d, code:%d) vulnerability ICMP

(type:%d, code:%d) traceroute ICMP

(type:%d, code:%d)

DESCRIPTION

The firewall detected an OSPF IP spoofing attack while the Contivity


The firewall detected an ICMP IP spoofing attack while the Contivity

221 did not have a default route; see the section on ICMP messages for type and code details.

The firewall detected an ICMP vulnerability attack; see the section on


The firewall detected an ICMP traceroute attack; see the section on



LOG MESSAGE

Firewall default policy: TCP

(set:%d)

Firewall default policy: UDP

(set:%d)

Firewall default policy: ICMP

(set:%d, type:%d, code:%d)

Firewall default policy: IGMP

(set:%d)

Firewall default policy: ESP

(set:%d)

DESCRIPTION

TCP access matched the default policy of the listed ACL set and the


UDP access matched the default policy of the listed ACL set and the


ICMP access matched the default policy of the listed ACL set and the

Contivity 221 blocked or forwarded it according to the ACL set’s configuration. See the section on ICMP messages for type and code details.

IGMP access matched the default policy of the listed ACL set and the


ESP access matched the default policy of the listed ACL set and the





LOG MESSAGE

Firewall default policy: GRE

(set:%d)

DESCRIPTION

GRE access matched the default policy of the listed ACL set and the


Firewall default policy: OSPF

(set:%d)

OSPF access matched the default policy of the listed ACL set and the


Firewall default policy: (set:%d)

Firewall rule match: TCP (set:%d, rule:%d)

Access matched the default policy of the listed ACL set and the


TCP access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

Firewall rule match: UDP (set:%d, rule:%d)

UDP access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

Firewall rule match: ICMP


Firewall rule match: IGMP

(set:%d, rule:%d)

ICMP access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration. See the section on ICMP messages for type and code details.

IGMP access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

Firewall rule match: ESP (set:%d, rule:%d)

ESP access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

Firewall rule match: GRE (set:%d, rule:%d)

GRE access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

317517-A Rev 00



LOG MESSAGE

Firewall rule match: OSPF

(set:%d, rule:%d)

DESCRIPTION

OSPF access matched the listed a firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

Firewall rule match: (set:%d, rule:%d)

Access matched the listed firewall rule and the Contivity 221 blocked or forwarded it according to the rule’s configuration.

Firewall rule NOT match: TCP

(set:%d, rule:%d)

Firewall rule NOT match: UDP (set:%d, rule:%d)

TCP access did not match the listed firewall rule and the Contivity 221 logged it.

UDP access did not match the listed firewall rule and the Contivity

221 logged it.

Firewall rule NOT match: ICMP


ICMP access did not match the listed firewall rule and the Contivity

221 logged it.

Firewall rule NOT match: IGMP

(set:%d, rule:%d)

IGMP access did not match the listed firewall rule and the Contivity

221 logged it.

Firewall rule NOT match: ESP (set:%d, rule:%d)

ESP access did not match the listed firewall rule and the Contivity 221 logged it.

Firewall rule NOT match: GRE (set:%d, rule:%d)

GRE ac access did not match the listed firewall rule and the Contivity

221 logged it.

Firewall rule NOT match: OSPF

(set:%d, rule:%d)

OSPF access did not match the listed firewall rule and the Contivity

221 logged it.




LOG MESSAGE

Firewall rule NOT match: (set:%d, rule:%d)











Filter match DROP

<set %d/rule %d>

Filter match DROP

<set %d/rule %d>

DESCRIPTION

Access did not match the listed firewall rule and the Contivity 221 logged it.

TCP access matched a default filter policy and the Contivity 221 dropped the packet to block access.

UDP access matched a default filter policy and the Contivity 221 dropped the packet to block access.

ICMP access matched a default filter policy and the Contivity 221 dropped the packet to block access.

Access matched a default filter policy and the Contivity 221 dropped the packet to block access.

Access matched a default filter policy (denied LAN IP) and the

Contivity 221 dropped the packet to block access.

TCP access matched a default filter policy. Access was allowed and the router forwarded the packet.

UDP access matched a default filter policy. Access was allowed and the router forwarded the packet.

ICMP access matched a default filter policy. Access was allowed and the router forwarded the packet.

Access matched a default filter policy. Access was allowed and the router forwarded the packet.

Access matched a default filter policy (denied LAN IP). Access was allowed and the router forwarded the packet.

TCP access matched the listed filter rule and the Contivity 221 dropped the packet to block access.

UDP access matched the listed filter rule and the Contivity 221 dropped the packet to block access.

317517-A Rev 00



LOG MESSAGE

Filter match DROP

<set %d/rule %d>

Filter match DROP

<set %d/rule %d>

Filter match DROP

<set %d/rule %d>

Filter match

FORWARD <set

%d/rule %d>

Filter match

FORWARD <set

%d/rule %d>

Filter match

FORWARD <set

%d/rule %d>

Filter match

FORWARD <set

%d/rule %d>

Filter match

FORWARD <set

%d/rule %d>

(set:%d)

(rule:%d)

DESCRIPTION

ICMP access matched the listed filter rule and the Contivity 221 dropped the packet to block access.

Access matched the listed filter rule and the Contivity 221 dropped the packet to block access.

Access matched the listed filter rule (denied LAN IP) and the Contivity

221 dropped the packet to block access.

TCP access matched the listed filter rule. Access was allowed and the router forwarded the packet.

UDP access matched the listed filter rule. Access was allowed and the router forwarded the packet.

ICMP access matched the listed filter rule. Access was allowed and the router forwarded the packet.

Access matched the listed filter rule. Access was allowed and the router forwarded the packet.

Access matched the listed filter rule (denied LAN IP). Access was allowed and the router forwarded the packet.

With firewall messages, this is the number of the ACL policy set and denotes the packet's direction (see Chart L-7).

With filter messages, this is the number of the filter set.

With firewall messages, the firewall rule number denotes the number of a firewall rule within an ACL policy set.

With filter messages, this is the number of an individual filter rule.




LOG MESSAGE

Router sent blocked web site message

DESCRIPTION

A message was sent to notify a user that the router blocked access to a requested web site

Triangle route packet forwarded

The firewall allowed a triangle route session to pass through.

Firewall sent TCP packet in response to DoS attack

The firewall detected a DoS attack and sent a TCP packet(s) in response.

Firewall sent TCP reset packets

The firewall sent out TCP reset packets.

Packet without a

NAT table entry blocked

The router blocked a packet that did not have a corresponding

SUA/NAT table entry.

The router blocked a TCP handshake packet that came out of the proper order

Out of order TCP handshake packet blocked

Drop unsupported/out-oforder ICMP

Router sent ICMP response packet

(type:%d, code:%d)

The Contivity 221 generates this log after it drops an ICMP packet due to one of the following two reasons:

1. The Contivity 221 does not support the ICMP packet's protocol.

2. The ICMP packet is an echo reply for which there was no corresponding echo request.

The router sent an ICMP response packet. This packet automatically bypasses the firewall. See the section on ICMP messages for type and code details.


1

ACL SET

NUMBER


LAN to WAN ACL set 1 for packets traveling from the LAN to the WAN.

317517-A Rev 00



2

ACL SET

NUMBER

7

8


WAN to LAN ACL set 2 for packets traveling from the WAN to the LAN.

LAN to

LAN/Contivity 221

WAN to

WAN/Contivity

221

ACL set 7 for packets traveling from the LAN to the LAN or the

Contivity 221.

ACL set 8 for packets traveling from the WAN to the WAN or the

Contivity 221.



Fragment (DF) needed to queue the datagrams for output to the next network on the route to the destination network.





317517-A Rev 00


Chart L-9 Sys log


Mon dd hr:mm:ss hostname src="<srcIP:srcPort>" dst="<dstIP:dstPort>" msg="<msg>" note="<note>"

This message is sent by the "RAS" when this syslog is generated. The messages and notes are defined in this appendix’s other charts.

VPN/IPSec logs

To view the IPSec and IKE connection log, type 3 in menu 27 and press [ENTER] to display the IPSec log as shown next. The following figure shows a typical log from the initiator of a VPN connection.

Diagram L-1 Example VPN Initiator IPSec Log


------------------------------------------------------------

001 01 Jan 08:02:22 Send Main Mode request to <192.168.100.101>

002 01 Jan 08:02:22 Send:<SA>

003 01 Jan 08:02:22 Recv:<SA>

004 01 Jan 08:02:24 Send:<KE><NONCE>

005 01 Jan 08:02:24 Recv:<KE><NONCE>

006 01 Jan 08:02:26 Send:<ID><HASH>

007 01 Jan 08:02:26 Recv:<ID><HASH>





012 01 Jan 08:02:26 Send:<HASH>




VPN Responder IPSec Log

The following figure shows a typical log from the VPN connection peer.

Diagram L-2 Example VPN Responder IPSec Log


------------------------------------------------------------

001 01 Jan 08:08:07 Recv Main Mode request from <192.168.100.100>

002 01 Jan 08:08:07 Recv:<SA>

003 01 Jan 08:08:08 Send:<SA>

004 01 Jan 08:08:08 Recv:<KE><NONCE>

005 01 Jan 08:08:10 Send:<KE><NONCE>

006 01 Jan 08:08:10 Recv:<ID><HASH>

007 01 Jan 08:08:10 Send:<ID><HASH>





012 01 Jan 08:08:10 Recv:<HASH>


This menu is useful for troubleshooting. A log index number, the date and time the log was created and a log message are displayed.

Double exclamation marks (!!) denote an error or warning message.

The following table shows sample log messages during IKE key exchange.

A PYLD_MALFORMED packet usually means that the two ends of the

VPN tunnel are not using the same pre-shared key.







The Contivity 221 has started negotiation with the peer.

The Contivity 221 has received an IKE negotiation request from the peer.

317517-A Rev 00



LOG MESSAGE

Recv:<Symbol>

Phase 1 IKE SA process done

Start Phase 2: Quick Mode

DESCRIPTION

IKE uses the ISAKMP protocol (refer to RFC2408 –

ISAKMP) to transmit data. Each ISAKMP packet contains payloads of different types that show in the log - see Chart L-12.

Phase 1 negotiation is finished.

Phase 2 negotiation is beginning using Quick Mode.

!! IKE Negotiation is in process

!! Duplicate requests with the same cookie

!! No proposal chosen

!! Verifying Local ID failed

!! Verifying Remote ID failed

!! Local / remote IPs of incoming request conflict with rule <#d>

!! Invalid IP <IP start>/<IP end>

!! Remote IP <IP start> / <IP end> conflicts

!! Active connection allowed exceeded

The Contivity 221 has begun negotiation with the peer for the connection already, but the IKE key exchange has not finished yet.

The Contivity 221 has received multiple requests from the same peer but it is still processing the first IKE packet from that peer.

The parameters configured for Phase 1 or Phase 2 negotiations don’t match. Please check all protocols and settings for these phases. For example, one party may be using 3DES encryption, but the other party is using DES encryption, so the connection will fail.

During IKE Phase 2 negotiation, both parties exchange policy details, including local and remote IP address ranges. If these ranges differ, then the connection fails.

If the security gateway is “0.0.0.0”, the Contivity 221 will use the peer’s “Local Addr” as its “Remote Addr”. If this IP (range) conflicts with a previously configured rule then the connection is not allowed.

The peer’s “Local IP Addr” range is invalid.

If the security gateway is “0.0.0.0”, the Contivity 221 will use the peer’s “Local Addr” as its “Remote Addr”. If a peer’s “Local Addr” range conflicts with other connections, then the Contivity 221 will not accept

VPN connection requests from this peer.

The Contivity 221 limits the number of simultaneous

Phase 2 SA negotiations. The IKE key exchange process fails if this limit is exceeded.





!! IKE Packet Retransmit

!! Failed to send IKE Packet

!! Too many errors! Deleting SA

!! Phase 1 ID type mismatch

!! Phase 1 ID content mismatch

!! No known phase 1 ID type found

Peer ID: IP address type <IP address>

The Contivity 221 did not receive a response from the peer and so retransmits the last packet sent.

The Contivity 221 cannot send IKE packets due to a network error.

The Contivity 221 deletes an SA when too many errors occur.

The ID type of an incoming packet does not match the local's peer ID type.

The ID content of an incoming packet does not match the local's peer ID content.

The ID type of an incoming packet does not match any known ID type. vs. My Remote <IP address> vs. My Local <IP address>

-> <symbol>

Error ID Info

The IP address type or IP address of an incoming packet does not match the peer IP address type or IP address configured on the local router. The log displays the IP address type and IP address of the incoming packet.

The IP address type or IP address of an incoming packet does not match the peer IP address type or IP address configured on the local router. The log displays this router’s configured remote IP address type or IP address that the incoming packet did not match.

The IP address type or IP address of an incoming packet does not match the peer IP address type or IP address configured on the local router. The log displays this router’s configured local IP address type or IP address that the incoming packet did not match.

The router sent a payload type of IKE packet.

The parameters configured for Phase 1 ID content do not match or the parameters configured for the Phase

2 ID (IP address of single, range or subnet) do not match. Please check all protocols and settings for these phases.

317517-A Rev 00


The following table shows sample log messages during packet transmission.

Chart L-11 Sample IPSec Logs During Packet Transmission


!! WAN IP changed to <IP> If the Contivity 221’s WAN IP changes, all configured “My IP Addr” are changed to b “0.0.0.0”. If this field is configured as 0.0.0.0, then the Contivity 221 will use the current Contivity 221 WAN IP address

(static or dynamic) to set up the VPN tunnel.

!! Cannot find IPSec SA The Contivity 221 cannot find a phase 2 SA that corresponds with the SPI of an inbound packet (from the peer); the packet is dropped.

!! Cannot find outbound SA for rule <%d>

The packet matches the rule index number (#d), but Phase 1 or

Phase 2 negotiation for outbound (from the VPN initiator) traffic is not finished yet.

!! Discard REPLAY packet

!! Inbound packet authentication failed

If the Contivity 221 receives a packet with the wrong sequence number it will discard it.

The authentication configuration settings are incorrect. Please check them.

!! Inbound packet decryption failed

Rule <#d> idle time out, disconnect

The decryption configuration settings are incorrect. Please check them.

If an SA has no packets transmitted for a period of time

(configurable via CI command), the Contivity 221 drops the connection.

The following table shows RFC-2408 ISAKMP payload types that the log displays. Please refer to the RFC for detailed information on each type.


LOG DISPLAY

SA

PROP

TRANS

KE

ID

PAYLOAD TYPE

Security Association

Proposal

Transform

Key Exchange

Identification




CER

LOG DISPLAY

CER_REQ

HASH

SIG

NONCE

NOTFY

DEL

VID

PAYLOAD TYPE

Certificate

Certificate Request

Hash

Signature

Nonce

Notification

Delete

Vendor ID

Log Commands

Go to the command interpreter interface (the Command Interpreter Appendix explains how to access and use the commands).

Configuring What You Want the Contivity 221 to Log

Use the sys logs load command to load the log setting buffer that allows you to configure which logs the Contivity 221 is to record.

Use sys logs category followed by a log category and a parameter to decide what to record


LOG CATEGORIES

access attack error ike ipsec javablocked

AVAILABLE PARAMETERS

0, 1, 2, 3

0, 1, 2, 3

0, 1, 2, 3

0, 1, 2, 3

0, 1, 2, 3

0, 1, 2, 3

317517-A Rev 00



LOG CATEGORIES AVAILABLE PARAMETERS

urlblocked 0, 1, 2, 3

Use 0 to not record logs for that category, 1 to record only logs for that category, 2 to record only alerts for that category, and

3

to record both logs and alerts for that category.

Use the sys logs save command to store the settings in the Contivity 221

(you must do this in order to record logs).

Displaying Logs

Use the sys logs display command to show all of the logs in the Contivity

221’s log.

Use the sys logs category display command to show the log settings for all of the log categories.

Use the sys logs display [log category] command to show the logs in an individual Contivity 221 log category.

Use the sys logs clear command to erase all of the Contivity 221’s logs.

Log Command Example

This example shows how to set the Contivity 221 to record the access logs and alerts and then view the results. ras> sys logs load ras> sys logs category access 3 ras> sys logs save ras> sys logs display access



# .time source destination notes

message

0|11/11/2002 15:10:12 |172.22.3.80:137 |172.22.255.255:137

|ACCESS BLOCK


1|11/11/2002 15:10:12 |172.21.4.17:138 |172.21.255.255:138

|ACCESS BLOCK


2|11/11/2002 15:10:11 |172.17.2.1 |224.0.1.60

|ACCESS BLOCK

Firewall default policy: IGMP(set:8)

3|11/11/2002 15:10:11 |172.22.3.80:137 |172.22.255.255:137

|ACCESS BLOCK


4|11/11/2002 15:10:10 |192.168.10.1:520 |192.168.10.255:520

|ACCESS BLOCK


5|11/11/2002 15:10:10 |172.21.4.67:137 |172.21.255.255:137

|ACCESS BLOCK

317517-A Rev 00

M-1

Appendix M


The following describes the commands for enabling, disabling and configuring the brute-force password guessing protection mechanism for the password. See the

Error! Reference source not found. appendix for information on the command

structure.

Chart M-1 Brute-Force Password Guessing Protection Commands

COMMAND

sys pwderrtm sys pwderrtm 0 sys pwderrtm N

Example sys pwderrtm 5

DESCRIPTION

This command displays the brute-force guessing password protection settings.

This command turns off the password’s protection from brute-force guessing.

The brute-force password guessing protection is turned off by default.

This command sets the password protection to block all access attempts for N

(a number from 1 to 60) minutes after the third time an incorrect password is entered.

This command sets the password protection to block all access attempts for five minutes after the third time an incorrect password is entered.


Nortel Contivity 221 User manual

Contivity 221 VPN Switch

User’s Guide

ii

Copyright © 2003 Nortel Networks.

Trademarks

Restricted rights legend

Statement of conditions

iii

Nortel Networks Inc. software license agreement

iv

v

Federal Communications Commission (FCC) Interference

Statement

Notice 1

Certifications

www.nortelnetworks.com

vi

Information for Canadian Users

Caution

Note

vii

Table of Contents

viii Table of Contents

x Table of Contents

xii Table of Contents

xiv Table of Contents

xvii

List of Figures

xviii List of Figures

xx List of Figures

xxii List of Figures

xxiv List of Figures

xxvii

List of Tables

xxviii List of Tables

xxx List of Tables

xxxiii

Preface

About This User's Manual

You may use the System Management Terminal (SMT), WebGUI or command interpreter interface to configure your Contivity 221.

Not all features can be configured through all interfaces. This

User's Guide primarily shows SMT configuration but includes the other interfaces where appropriate.

Related Publications

Syntax Conventions

xxxiv Preface

How to get help

www.nortelnetworks.com/help/contact/global

http://www.nortelnetworks.com/help/contact/erc/index.html

Part I:

Overview

I

1-1

Chapter 1

Getting to Know Your Contivity 221

1.1

Introducing the Contivity 221

1.2

Features

1.2.1 Physical Features

4-Port Switch

Auto-negotiating 10/100 Mbps Ethernet LAN

Auto-sensing 10/100 Mbps Ethernet LAN

1-2 Getting to Know Your Contivity 221

Auto-negotiating 10/100 Mbps Ethernet WAN

Auxiliary Port

Time and Date

Reset Button

1.2.2 Non-Physical Features

IPSec VPN Capability

The Contivity 221 supports five simultaneous VPN connections.

Firewall

1-3

Brute-Force Password Guessing Protection

Content Filtering

Packet Filtering

Universal Plug and Play (UPnP)

Call Scheduling

PPPoE

PPTP Encapsulation