Nortel 252 Configuration

PDF

ドキュメント

Nortel Business Secure Router 252 Configuration —

Advanced

BSR252

Business Secure Router

Document Number: NN47923-501

Document Version: 1.1

Date: March 2007

The information in this document is subject to change without notice. The statements, configurations, technical data, and recommendations in this document are believed to be accurate and reliable, but are presented without express or implied warranty. The information in this document is proprietary to Nortel.

Trademarks

Nortel, Nortel (Logo), the Globemark, and This is the way, This is Nortel (Design mark) are trademarks of Nortel.

Microsoft, MS, MS-DOS, Windows, and Windows NT are registered trademarks of Microsoft Corporation.

All other trademarks and registered trademarks are the property of their respective owners.

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Text conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Related publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Hard-copy technical manuals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

How to get help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

USA and Canada Authorized Distributors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Technical Support - GNTS/GNPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Presales Support (CSAN) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

EMEA (Europe, Middle East, Africa) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Technical Support - CTAS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

CALA (Caribbean & Latin America) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Technical Support - CTAS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

APAC (Asia Pacific) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Technical Support - GNTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Chapter 1

Getting to know your Nortel Business Secure Router 252 . . . . . . . . . . . . 31

Introducing the Nortel Business Secure Router 252 . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Physical features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

High-speed Internet access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

ADSL standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Networking compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Multiplexing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Encapsulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Four-Port switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Autonegotiating 10/100 Mb/s Ethernet LAN . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Nortel Business Secure Router 252 Configuration — Advanced

4 Contents

Autosensing 10/100 Mb/s Ethernet LAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Auxiliary port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Time and date . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Reset button . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Nonphysical features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

IPSec VPN capability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Nortel Contivity Client Termination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

HTTPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

IEEE 802.1x for network security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Brute force password guessing protection . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Content filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Packet filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Universal Plug and Play (UPnP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Call scheduling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

PPPoE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Dynamic DNS support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

IP Multicast . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

IP Alias . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Central Network Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Network Address Translation (NAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Traffic Redirect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Port Forwarding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

DHCP (Dynamic Host Configuration Protocol) . . . . . . . . . . . . . . . . . . . . . . . . 38

Full network management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

Logging and tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Upgrade Business Secure Router Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Embedded FTP and TFTP Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Applications for the Nortel Business Secure Router 252 . . . . . . . . . . . . . . . . . . . . . . . 39

Secure broadband internet access and VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Hardware Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

NN47923-501

Contents 5

Chapter 2

Introducing the SMT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Introduction to the SMT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Accessing the SMT via the console port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Initial screen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

Logging on to the SMT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Navigating the SMT interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Main menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Changing the system password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

SMT menus at a glance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

SMT menu 1 - general setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Introduction to general setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Configuring general setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Configuring dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Chapter 3

WAN and Dial Backup Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Introduction to WAN and dial backup setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

WAN setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Traffic redirect setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

Dial backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Advanced WAN setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

Remote node profile (Backup ISP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Editing PPP options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

Editing TCP/IP options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Editing logon script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

Remote node filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Chapter 4

LAN setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Introduction to LAN setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Accessing the LAN menus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

LAN port filter setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

TCP/IP and DHCP ethernet setup menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

Nortel Business Secure Router 252 Configuration — Advanced

6 Contents

IP Alias Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

Chapter 5

Internet access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Internet access configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Basic setup complete . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

Chapter 6

Remote Node setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Introduction to Remote Node setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Outgoing Authentication Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Nailed-Up Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Remote Node setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Remote Node profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Encapsulation and Multiplexing scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Edit IP/Bridge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

Remote Node filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Editing ATM Layer Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

VC-based Multiplexing (non-PPP Encapsulation) . . . . . . . . . . . . . . . . . . . . . . . . . 95

LLC-based Multiplexing or PPP Encapsulation . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

Advance Setup Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

Chapter 7

IP Static Route Setup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

IP Static Route Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

Chapter 8

Dial-in User Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Dial-in User Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Chapter 9

Network Address Translation (NAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

Using NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

SUA (Single User Account) Versus NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

Applying NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

NN47923-501

Contents 7

NAT setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

Address Mapping Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

SUA Address Mapping Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

User-Defined Address Mapping Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

Ordering your rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

Configuring a server behind NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

General NAT examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

Internet access only . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

Example 2: Internet access with an inside server . . . . . . . . . . . . . . . . . . . . . . . . 121

Example 3: Multiple public IP addresses with inside servers . . . . . . . . . . . . . . . 122

Configuring Trigger Port forwarding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

Chapter 10

Introducing the firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

Using SMT menus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

Activating the firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

Chapter 11

Filter configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

Introduction to filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

Filter Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

Configuring a Filter Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

Configuring a Filter Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Configuring a TCP/IP Filter Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Configuring a Generic Filter Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

Example Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146

Filter Types and NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

Firewall Versus Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Applying a Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Applying LAN Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

Applying Remote Node Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

Chapter 12

SNMP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153

SNMP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153

Nortel Business Secure Router 252 Configuration — Advanced

8 Contents

SNMP Traps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

Chapter 13

System security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

System security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

System password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

Configuring external RADIUS server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

IEEE 802.1x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

Chapter 14

System information and diagnosis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

Introduction to System Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

System Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164

System information and console port speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

System Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

Console port speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

Log and trace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

Syslog logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

CDR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

Packet triggered . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

Filter log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

PPP log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

Firewall log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

Call-Triggering packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

WAN DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

Chapter 15

Firmware and configuration file maintenance . . . . . . . . . . . . . . . . . . . . . 179

Filename conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

Backup configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

Backup configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181

Using the FTP command from the command line . . . . . . . . . . . . . . . . . . . . . . . . 181

Example of FTP commands from the command line . . . . . . . . . . . . . . . . . . . . . . 182

GUI-based FTP clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182

TFTP and FTP over WAN Management Limitations . . . . . . . . . . . . . . . . . . . . . . 183

NN47923-501

Contents 9

Backup configuration using TFTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

TFTP command example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184

GUI-based TFTP clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184

Back up via console port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

Restore configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Restore Using FTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

Restore using FTP session example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Restore via console port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Uploading Firmware and Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

Firmware file upload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

Configuration file upload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

FTP file upload command from the DOS prompt example . . . . . . . . . . . . . . . . . 191

FTP Session Example of Firmware File Upload . . . . . . . . . . . . . . . . . . . . . . . . . 192

TFTP file upload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

TFTP upload command example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

Uploading via console port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Uploading Firmware File Via Console Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

Uploading Xmodem firmware using HyperTerminal . . . . . . . . . . . . . . . . . . . . . . 195

Uploading configuration file via console port . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Uploading Xmodem configuration file using HyperTerminal . . . . . . . . . . . . . . . . 197

Chapter 16

System Maintenance menus 8 to 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

Command Interpreter mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

Command syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

Command usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

Call control support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

Budget management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202

Call History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204

Time and Date setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Resetting the Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208

Chapter 17

Remote Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

Remote Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

Nortel Business Secure Router 252 Configuration — Advanced

10 Contents

Remote Management Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211

Chapter 18

Call scheduling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

Appendix A

Setting up your computer IP address . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

Windows 95/98/Me . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

Installing components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

Configuring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

Verifying Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

Windows 2000/NT/XP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

Verifying Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

Macintosh OS 8/9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

Verifying Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226

Macintosh OS X . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

Verifying settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228

Appendix B

Triangle Route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229

The Ideal Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229

The Triangle Route Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229

The Triangle Route Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

IP aliasing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

Appendix C

Importing certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

Import Business Secure Router certificates into Netscape Navigator . . . . . . . . . . . . 233

Importing the Business Secure Router Certificate into Internet Explorer . . . . . . . . . . 234

Enrolling and Importing SSL Client Certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239

Using a certificate when accessing the Business Secure Router example . . . . . . . . 247

Appendix D

NN47923-501

Contents 11

PPPoE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

PPPoE in action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

Benefits of PPPoE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

Traditional dial-up scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

How PPPoE works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Business Secure Router as a PPPoE client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

Appendix E

Hardware specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Cable pin assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

AC Power Adapter Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255

Appendix F

IP subnetting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

IP addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

IP classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

Subnet masks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

Subnetting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

Example: two subnets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260

Example: four subnets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262

Example: eight subnets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263

Subnetting with Class A and Class B networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264

Appendix G

Command Interpreter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

Command Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

Command usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

Sys commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

Exit Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276

Ethernet Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276

IP commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

IPSec commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283

WAN Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292

Sys firewall commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294

Bandwidth management commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295

Nortel Business Secure Router 252 Configuration — Advanced

12 Contents

Certificates commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298

IEEE 802.1X commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304

RADIUS commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304

Appendix H

NetBIOS filter commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305

Display NetBIOS filter settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306

NetBIOS filter configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306

Example commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307

Appendix I

Boot Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309

Appendix J

Log descriptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311

VPN/IPSec logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

VPN responder IPSec log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321

Log commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328

Configuring what you want the Business Secure Router to log . . . . . . . . . . . . . . 329

Displaying logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329

Log command example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330

Appendix K

Brute force password guessing protection. . . . . . . . . . . . . . . . . . . . . . . . 331

Appendix L

SIP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333

SIP Identities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333

SIP Number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333

SIP Service Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334

SIP Call Progression . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334

SIP Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335

SIP User Agent Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335

SIP Proxy Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335

SIP Redirect Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336

NN47923-501

Contents 13

SIP Register Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337

RTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341

Nortel Business Secure Router 252 Configuration — Advanced

14 Contents

NN47923-501

Figures

Figure 1 Secure Internet Access and VPN Application . . . . . . . . . . . . . . . . . . . . . 40

Figure 2 Initial screen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Figure 3 SMT Login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Figure 4 Main menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Figure 5 Menu 23.1 – System Security – Change Password . . . . . . . . . . . . . . . . . 47

Figure 6 SMT overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Figure 7 Menu 1 – General Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Figure 8 Menu 1.1 – Configure Dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Figure 9 Menu 2 – WAN Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Figure 10 Menu 2.2 – Traffic Redirect Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Figure 11 Menu 2.1 – Advanced WAN Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

Figure 12 Menu 11.2 – Remote Node Profile (Backup ISP) . . . . . . . . . . . . . . . . . . . 62

Figure 13 Menu 11.2.1 – Remote node PPP options . . . . . . . . . . . . . . . . . . . . . . . . 65

Figure 14 Menu 11.3 – Remote Node Network Layer Options . . . . . . . . . . . . . . . . . 66

Figure 15 Menu 11.2.3 – Remote Node Setup Script . . . . . . . . . . . . . . . . . . . . . . . . 70

Figure 16 Menu 11.2.4: dial backup remote node filter . . . . . . . . . . . . . . . . . . . . . . 71

Figure 17 Menu 3 – LAN setup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Figure 18 Menu 3.1 – LAN Port Filter Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

Figure 19 Menu 3 – LAN Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

Figure 20 Menu 3.2 – TCP/IP and DHCP Ethernet setup . . . . . . . . . . . . . . . . . . . . 75

Figure 21 Menu 3.2.1 – IP Alias setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

Figure 22 Menu 4 – Internet Access Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

Figure 23 Menu 11 – Remote Node Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Figure 24 Menu 11.1 – Remote Node Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

Figure 25 Menu 11.3 – Remote Node Network Layer Options . . . . . . . . . . . . . . . . . 91

Figure 26 Menu 11.1.4 – Remote Node Filter (Ethernet Encapsulation) . . . . . . . . . 94

Figure 27 Menu 11.1.4 – Remote Node Filter (PPPoE or PPPoA Encapsulation) . . 94

Figure 28 Menu 11.6 for VC-based Multiplexing . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

Figure 29 Menu 11.6 for LLC-based Multiplexing or PPP Encapsulation . . . . . . . . . 96

Nortel Business Secure Router 252 Configuration — Advanced

16 Figures

Figure 30 Menu 11.1 – Remote Node Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

Figure 31 Menu 11.8 – Advance Setup Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Figure 32 Menu 12 – IP Static Route Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

Figure 33 Menu 12.1 – Edit IP Static Route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

Figure 34 Menu 14 – Dial-in User Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Figure 35 Menu 14.1 – Edit Dial-in User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Figure 36 Menu 4 – Applying NAT for Internet Access . . . . . . . . . . . . . . . . . . . . . . 106

Figure 37 Menu 11.3 – Applying NAT to the Remote Node . . . . . . . . . . . . . . . . . . 107

Figure 38 Menu 15 – NAT Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

Figure 39 Menu 15.1 – Address Mapping Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

Figure 40 Menu 15.1.255 – SUA Address Mapping Rules . . . . . . . . . . . . . . . . . . . 110

Figure 41 Menu 15.1.1: First Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

Figure 42 Menu 15.1.1.1: Editing or configuring an individual rule in a set . . . . . . 114

Figure 43 Menu 15.2 – NAT Server Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

Figure 44 15.2.1 – NAT Server Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

Figure 45 Menu 15.2 – NAT Server Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

Figure 46 Multiple servers behind NAT example . . . . . . . . . . . . . . . . . . . . . . . . . . 119

Figure 47 NAT Example 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

Figure 48 Menu 4: Internet access & NAT example . . . . . . . . . . . . . . . . . . . . . . . . 120

Figure 49 NAT Example 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

Figure 50 Menu 15.2: Specifying an inside server . . . . . . . . . . . . . . . . . . . . . . . . . 122

Figure 51 NAT example 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Figure 52 Example 3: Menu 11.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

Figure 53 Example 3: Menu 15.1.1.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

Figure 54 Example 3: Final Menu 15.1.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

Figure 55 Example 3: Menu 15.2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

Figure 56 Menu 15.3 – Trigger Port Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

Figure 57 Menu 21– Filter and Firewall Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

Figure 58 Menu 21.2 – Firewall Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

Figure 59 Outgoing packet filtering process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

Figure 60 Filter rule process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

Figure 61 Menu 21 – Filter and Firewall Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

Figure 62 Menu 21.1– Filter Set Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

Figure 63 Menu 21.1.1.1 – TCP/IP Filter Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

Figure 64 Executing an IP filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

NN47923-501

Figures 17

Figure 65 Menu 21.1.1.1 – Generic Filter Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

Figure 66 Telnet filter Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

Figure 67 Example Filter: Menu 21.1.3.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148

Figure 68 Example Filter Rules Summary: Menu 21.1.3 . . . . . . . . . . . . . . . . . . . . 149

Figure 69 Protocol and Device Filter Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Figure 70 Filtering LAN Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

Figure 71 Filtering Remote Node Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

Figure 72 Menu 22 – SNMP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

Figure 73 Menu 23 – System security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

Figure 74 Menu 23 – System Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

Figure 75 Menu 23.2 – System Security – RADIUS server . . . . . . . . . . . . . . . . . . 158

Figure 76 Menu 23 – System Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

Figure 77 Menu 23.4 – System Security – IEEE802.1x . . . . . . . . . . . . . . . . . . . . . 160

Figure 78 Menu 24 – System Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164

Figure 79 Menu 24.1 – System Maintenance – Status . . . . . . . . . . . . . . . . . . . . . . 165

Figure 80 System Information and Console Port Speed . . . . . . . . . . . . . . . . . . . . 167

Figure 81 Menu 24.2.1 – System Maintenance – Information . . . . . . . . . . . . . . . 168

Figure 82 Menu 24.2.2 – System Maintenance – Change Console Port Speed . . 169

Figure 83 Menu 24.3 – System Maintenance: Log and Trace . . . . . . . . . . . . . . . . 170

Figure 84 Menu 24.3.2 – System Maintenance: Syslog Logging . . . . . . . . . . . . . . 170

Figure 85 Call-Triggering packet example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

Figure 86 Menu 24.4 – System Maintenance: Diagnostic . . . . . . . . . . . . . . . . . . . 176

Figure 87 WAN & LAN DHCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

Figure 88 Menu 24.5 – System Maintenance – Backup Configuration . . . . . . . . . . 181

Figure 89 FTP Session Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182

Figure 90 Menu 24.5 – System Maintenance – Backup Configuration . . . . . . . . . . 185

Figure 91 Menu 24.5 System Maintenance: Starting Xmodem Download Screen . 185

Figure 92 Backup Configuration Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186

Figure 93 Successful Backup Confirmation Screen . . . . . . . . . . . . . . . . . . . . . . . . 186

Figure 94 Telnet into Menu 24.6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

Figure 95 Restore using FTP session example . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Figure 96 System Maintenance: Restore Configuration . . . . . . . . . . . . . . . . . . . . . 188

Figure 97 System Maintenance: Starting Xmodem Download Screen . . . . . . . . . . 189

Figure 98 Successful Restoration Confirmation Screen . . . . . . . . . . . . . . . . . . . . . 189

Figure 99 Telnet Into Menu 24.7.1 Upload System Firmware . . . . . . . . . . . . . . . . 190

Nortel Business Secure Router 252 Configuration — Advanced

18 Figures

Figure 100 Telnet Into Menu 24.7.2 System Maintenance . . . . . . . . . . . . . . . . . . . 191

Figure 101 FTP Session Example of Firmware File Upload . . . . . . . . . . . . . . . . . . . 192

Figure 102 Menu 24.7.1 as seen using the Console Port . . . . . . . . . . . . . . . . . . . . . 194

Figure 103 Example Xmodem Upload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

Figure 104 Menu 24.7.2 as seen using the Console Port . . . . . . . . . . . . . . . . . . . . 196

Figure 105 Example Xmodem Upload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

Figure 106 Command mode in Menu 24 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

Figure 107 Call Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202

Figure 108 Budget Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

Figure 109 Call History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204

Figure 110 Menu 24 – System Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Figure 111 Menu 24.10 System Maintenance: Time and Date Setting . . . . . . . . . . 206

Figure 112 Menu 24.11 – Remote Management Control . . . . . . . . . . . . . . . . . . . . . 210

Figure 113 Menu 26 – Schedule Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

Figure 114 Menu 26.1 – Schedule Set Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

Figure 115 Applying Schedule Sets to a Remote Node (PPPoE) . . . . . . . . . . . . . . . 216

Figure 116 WIndows 95/98/Me: network: configuration . . . . . . . . . . . . . . . . . . . . . . 218

Figure 117 Windows 95/98/Me: TCP/IP properties: IP address . . . . . . . . . . . . . . . . 219

Figure 118 Windows 95/98/Me: TCP/IP Properties: DNS configuration . . . . . . . . . . 220

Figure 119 Windows XP: Start menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

Figure 120 Windows XP: Control Panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

Figure 121 Windows XP: Control Panel: Network Connections: Properties . . . . . . . 222

Figure 122 Windows XP: Local Area Connection Properties . . . . . . . . . . . . . . . . . . 222

Figure 123 Windows XP: Advanced TCP/IP settings . . . . . . . . . . . . . . . . . . . . . . . . 223

Figure 124 Windows XP: Internet Protocol (TCP/IP) properties . . . . . . . . . . . . . . . . 224

Figure 125 Macintosh OS 8/9: Apple Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

Figure 126 Macintosh OS 8/9: TCP/IP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226

Figure 127 Macintosh OS X: Apple menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

Figure 128 Macintosh OS X: Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

Figure 129 Ideal Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229

Figure 130 Triangle Route Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

Figure 131 IP Alias . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231

Figure 132 Security Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

Figure 133 Login Screen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

Figure 134 Certificate General Information before Import . . . . . . . . . . . . . . . . . . . . 235

NN47923-501

Figures 19

Figure 135 Certificate Import Wizard 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236

Figure 136 Certificate Import Wizard 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

Figure 137 Certificate Import Wizard 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

Figure 138 Root Certificate Store . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

Figure 139 Certificate General Information after Import . . . . . . . . . . . . . . . . . . . . . . 239

Figure 140 Business Secure Router Trusted CA screen . . . . . . . . . . . . . . . . . . . . . 240

Figure 141 CA certificate example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241

Figure 142 Personal certificate import wizard 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

Figure 143 Personal certificate import wizard 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

Figure 144 Personal certificate import wizard 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

Figure 145 Personal certificate import wizard 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

Figure 146 Personal certificate import wizard 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

Figure 147 Personal certificate import wizard 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

Figure 148 Access the Business Secure Router via HTTPS . . . . . . . . . . . . . . . . . . 247

Figure 149 SSL client authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247

Figure 150 Business Secure Router secure login screen . . . . . . . . . . . . . . . . . . . . . 248

Figure 151 Single-PC per router hardware configuration . . . . . . . . . . . . . . . . . . . . . 250

Figure 152 Business Secure Router as a PPPoE Client . . . . . . . . . . . . . . . . . . . . . 251

Figure 153 Console or dial backup port pin layouts . . . . . . . . . . . . . . . . . . . . . . . . 254

Figure 154 Ethernet cable pin assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255

Figure 155 NetBIOS Display Filter Settings Command Example . . . . . . . . . . . . . . . 306

Figure 156 Option to Enter Debug Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309

Figure 157 Boot Module Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310

Figure 158 Example VPN initiator IPSec log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320

Figure 159 Example VPN responder IPSec log . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321

Figure 160 SIP User Agent Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335

Figure 161 SIP Proxy Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336

Figure 162 SIP Redirect Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337

Figure 163 Business Secure Router SIP ALG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339

Nortel Business Secure Router 252 Configuration — Advanced

20 Figures

NN47923-501

Tables

Table 1

Table 2

Table 3

Table 4

Table 5

Table 6

Table 7

Table 8

Feature specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

Main menu commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Main menu summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

General setup menu fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Configure dynamic DNS menu fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

Menu 2 WAN setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Menu 2.2 Traffic Redirect Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Advanced WAN port setup: AT commands fields . . . . . . . . . . . . . . . . . . . 60

Table 9 Advanced WAN port setup: call control parameters . . . . . . . . . . . . . . . . . 61

Table 10 Fields in Menu 11.2 Remote Node Profile (Backup ISP) . . . . . . . . . . . . . 62

Table 11 Remote node PPP options menu fields . . . . . . . . . . . . . . . . . . . . . . . . . . 65

Table 12 Remote Node Network Layer Options Menu Fields . . . . . . . . . . . . . . . . . 66

Table 13 Menu 11.2.3: remote node script menu fields . . . . . . . . . . . . . . . . . . . . . 70

Table 14 DHCP Ethernet setup menu fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Table 15 LAN TCP/IP setup menu fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

Table 16 IP Alias setup menu field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

Table 17 Menu 4 Internet access setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

Table 18 Menu 11.1 Remote Node Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

Table 19 Menu 11.3 Remote Node Network Layer Options . . . . . . . . . . . . . . . . . . 91

Table 20 Menu 11.8 Advance Setup Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

Table 21 IP Static Route Menu Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

Table 22 Menu 14.1- Edit Dial-in User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Table 23 Applying NAT in Menus 4 & 11.3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Table 24 SUA Address Mapping Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

Table 25 Fields in menu 15.1.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Table 26 Menu 15.1.1.1: Editing or configuring an individual rule in a set . . . . . . 114

Table 27 15.2.1: NAT Server Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

Table 28 Menu 15.3: Trigger Port setup description . . . . . . . . . . . . . . . . . . . . . . . 128

Table 29 Abbreviations used in the Filter Rules Summary Menu . . . . . . . . . . . . . 138

Nortel Business Secure Router 252 Configuration — Advanced

22 Tables

Table 30 Rule abbreviations used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

Table 31 TCP/IP Filter Rule Menu fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

Table 32 Generic Filter Rule Menu fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

Table 33 SNMP Configuration Menu Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

Table 34 SNMP Traps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

Table 35 Menu 23.2 System Security: RADIUS Server . . . . . . . . . . . . . . . . . . . . . 159

Table 36 Menu 23.4 System Security: IEEE802.1x . . . . . . . . . . . . . . . . . . . . . . . . 161

Table 37 Menu 24.1 System Maintenance: Status . . . . . . . . . . . . . . . . . . . . . . . . 165

Table 38 Menu 24.2.1 System Maintenance: Information . . . . . . . . . . . . . . . . . . . 168

Table 39 System Maintenance Menu Syslog Parameters . . . . . . . . . . . . . . . . . . . 170

Table 40 System Maintenance menu diagnostic . . . . . . . . . . . . . . . . . . . . . . . . . . 177

Table 41 Filename Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

Table 42 General commands for GUI-based FTP clients . . . . . . . . . . . . . . . . . . . 182

Table 43 General commands for GUI-based TFTP clients . . . . . . . . . . . . . . . . . . 184

Table 44 Budget management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

Table 45 Call History Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204

Table 46 Time and Date Setting Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

Table 47 Menu 24.11 – Remote Management control . . . . . . . . . . . . . . . . . . . . . 210

Table 48 Menu 26.1 Schedule Set Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

Table 49 General specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Table 50 Console or dial backup port pin assignments . . . . . . . . . . . . . . . . . . . . . 254

Table 52 Allowed IP address range By class . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

Table 51 Classes of IP addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

Table 53 Natural Masks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

Table 54 Alternative Subnet Mask Notation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260

Table 55 Subnet 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

Table 56 Subnet 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

Table 57 Subnet 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262

Table 58 Subnet 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262

Table 61 Eight subnets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263

Table 59 Subnet 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263

Table 60 Subnet 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263

Table 62 Class C subnet planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264

Table 63 Class B subnet planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264

Table 64 Sys commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

NN47923-501

Tables 23

Table 65 Exit Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276

Table 66 Ether Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276

Table 67 IP commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

Table 68 IPSec commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283

Table 69 WAN Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292

Table 70 Sys firewall commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294

Table 71 Bandwidth management commands . . . . . . . . . . . . . . . . . . . . . . . . . . . 295

Table 72 Certificates commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298

Table 73 IEEE 802.1X commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304

Table 74 RADIUS commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304

Table 75 NetBIOS filter default settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306

Table 76 System error logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311

Table 77 System maintenance logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311

Table 78 UPnP logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312

Table 79 Content filtering logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312

Table 80 Attack logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313

Table 81 Access logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315

Table 82 ACL setting notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318

Table 83 ICMP notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318

Table 84 Sys log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

Table 85 Sample IKE key exchange logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322

Table 86 Sample IPSec logs during packet transmission . . . . . . . . . . . . . . . . . . . 324

Table 87 RFC-2408 ISAKMP payload types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324

Table 88 PKI logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325

Table 89 Certificate path verification failure reason codes . . . . . . . . . . . . . . . . . . 326

Table 90 IEEE 802.1X logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327

Table 91 Log categories and available settings . . . . . . . . . . . . . . . . . . . . . . . . . . 329

Table 92 Brute force password guessing protection commands . . . . . . . . . . . . . . 331

Table 93 SIP Call Progression . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334

Nortel Business Secure Router 252 Configuration — Advanced

24 Tables

NN47923-501

Preface

Before you begin

This guide is designed to assist you with advanced configuration of your Business

Secure Router for its various applications.

Note: This guide explains how to use the System Management Terminal

(SMT) or the command interpreter interface to configure your Business

Secure Router. See the basic manual for how to use the WebGUI to configure your Business Secure Router. Not all features can be configured through all interfaces.

The SMT parts of this manual contain background information solely on features not configurable by the WebGUI. The WebGUI parts of the basic manual contain background information on features configurable by the WebGUI and the SMT.

Text conventions

This guide uses the following text conventions:

Enter means for you to type one or more characters and press the [ENTER] key.

Select or Choose means for you to use one of the predefined choices.

The SMT menu titles and labels are written in Bold Times New Roman font.

Menu choices are written in Bold Arial font.

Nortel Business Secure Router 252 Configuration — Advanced

26 Preface

A single keystroke is written in Arial font and enclosed in square brackets, for instance, [ENTER] means the Enter key; [ESC] means the escape key and

[SPACE BAR] means the space bar. [UP] and [DOWN] are the up and down arrow keys.

Mouse action sequences are denoted using a comma. For example, “click the

Apple icon, Control Panels and then Modem ” means first click the Apple icon, then point your mouse pointer to Control Panels and then click Modem .

Related publications

For more information about using the Business Secure Router, refer to the following publications:

• Nortel Business Secure Router 252 Configuration — Basics (NN47923-500)

The basic manual covers how to use the WebGUI to configure your Business

Secure Router.

• WebGUI Online Help

Embedded WebGUI help for descriptions of individual screens and supplementary information

Hard-copy technical manuals

You can print selected technical manuals and release notes free, directly from the

Internet. Go to www.nortel.com/documentation . Find the product for which you need documentation. Then locate the specific category and model or version for your hardware or software product. Use Adobe Reader to open the manuals and release notes, search for the sections you need, and print them on most standard printers. Go to Adobe Systems at www.adobe.com to download a free copy of the

Adobe Reader.

How to get help

If you do not see an appropriate number in this list, go to www.nortel.com/cs.

NN47923-501

Preface 27

USA and Canada Authorized Distributors

Technical Support - GNTS/GNPS

Telephone:

1-800-4NORTEL (1-800-466-7835)

If you already have a PIN Code, you can enter Express Routing Code (ERC) 196#. If you do not yet have a PIN Code, or for general questions and first line support, you can enter

ERC 338#.

Web Site: www.nortel.com/cs

Presales Support (CSAN)

Telephone:

1-800-4NORTEL (1-800-466-7835)

Use Express Routing Code (ERC) 1063#

EMEA (Europe, Middle East, Africa)

Technical Support - CTAS

Telephone:

*European Free phone 00800 800 89009

European Alternative:

United Kingdom

Africa

Israel

+44 (0)870-907-9009

+27-11-808-4000

800-945-9779

Calls are not free from all countries in Europe, Middle East, or Africa.

Fax:

44-191-555-7980

E-mail: [email protected]

Nortel Business Secure Router 252 Configuration — Advanced

28 Preface

CALA (Caribbean & Latin America)

Technical Support - CTAS

Telephone:

1-954-858-7777

E-mail: [email protected]

APAC (Asia Pacific)

Service Business Centre & Pre-Sales Help Desk:

+61-2-8870-5511 (Sydney)

Technical Support - GNTS

Telephone:

+612 8870 8800

Fax:

+612 8870 5569

E-mail: [email protected]

Australia

China

India

Indonesia

1-800-NORTEL (1-800-667-835)

010-6510-7770

011-5154-2210

0018-036-1004

Japan 0120-332-533

Malaysia 1800-805-380

New Zealand

Philippines

0800-449-716

1800-1611-0063

Singapore 800-616-2004

South Korea

Taiwan

0079-8611-2001

0800-810-500

NN47923-501

Thailand 001-800-611-3007

Service Business Centre &

Pre-Sales Help Desk

+61-2-8870-5511

Preface 29

Nortel Business Secure Router 252 Configuration — Advanced

30 Preface

NN47923-501

Chapter 1 Getting to know your Nortel Business Secure

Router 252

This chapter introduces the main features and applications of the Business Secure

Router.

Introducing the Nortel Business Secure Router 252

The Business Secure Router is an ideal secure gateway for all data passing between the Internet and the Local Area Network (LAN).

Your Business Secure Router integrates high-speed 10/100 Megabits per second

(Mb/s) autonegotiating LAN interfaces and a high-speed Asymmetrical Digital

Subscriber Line Plus (ADSL2+) port into a single package. The Business Secure

Router is ideal for high-speed Internet browsing and making LAN-to-LAN connections to remote networks. By integrating Digital Subscriber Line (DSL) and Network Address Translation (NAT), the Business Secure Router provides easy installation and Internet access. By integrating firewall and Virtual Private

Network (VPN) capabilities, the Business Secure Router is a complete security solution that protects your Intranet and efficiently manages data traffic on your network.

Using the embedded WebGUI, you can easily set up and manage the Business

Secure Router using an Internet browser.

Nortel Business Secure Router 252 Configuration — Advanced

32 Chapter 1 Getting to know your Nortel Business Secure Router 252

Features

This section lists the key features of the Business Secure Router.

Table 1 Feature specifications

Feature Specification

Number of static routes

Number of NAT sessions

Number of SUA (Single User Account) servers

Number of address mapping rules

Maximum number of VPN IP Policies

Maximum number of VPN Tunnels (Client and/or Branch Office)

Maximum number of concurrent VPN IPSec Connections

Number of IP pools that can be used to assign IP addresses to remote users for VPN client termination

Number of configurable split networks for VPN client termination 16

Number of configurable inverse split networks for VPN client termination 16

Number of configurable subnets per split network for VPN client termination

4096

Physical features

High-speed Internet access

Your Business Secure Router supports ADSL2+ (Asymmetrical Digital

Subscriber Line) for high transmission speeds and long connection distances.

ADSL standards

• Multimode standard (ANSI (American National Standards Institute) T1.413,

Issue 2; G.dmt (G.992.1 Discrete Multitone Modulation)

• EOC (Embedded Operations Channel) specified in ITU-T

(Telecommunication Standardization Sector of the International

Telecommunications Union) G.992.1

• ADSL2 G.dmt.bis (G.992.3)

• ADSL2+ (G.992.5)

NN47923-501

Chapter 1 Getting to know your Nortel Business Secure Router 252 33

• Extended-reach ADSL (ER ADSL)

• SRA (Seamless Rate Adaptation)

• Autonegotiating rate adaptation

• ADSL physical connection ATM (Asynchronous Transfer Mode) AAL5

(Adaptation Layer type 5)·

• Multiprotocol over AAL5 (Request For Comments (RFC) 2684/1483)

• Support Point-to-Point-Protocol over ATM AAL5 (PPPoA) (RFC 2364)

• PPP over Ethernet support for DSL (Digital Subscriber Line) connection

(RFC 2516)

• Support Virtual Circuit (VC) based and LLC (Logical Link Control) based multiplexing

• Support OAM (Operational, Administration and Maintenance) VC Hunt

• I.610 F4/F5 OAM

Networking compatibility

Your Business Secure Router is compatible with the major ADSL Digital

Subscriber Line Access Multiplexer (DSLAM) providers, making configuration as simple as possible.

Multiplexing

The Business Secure Router supports VC-based and LLC-based multiplexing.

Encapsulation

The Business Secure Router supports PPPoA (RFC 2364 - PPP over ATM

Adaptation Layer 5), RFC 1483 encapsulation over ATM, MAC (Media Access

Control) encapsulated routing (ENET encapsulation) as well as PPP over Ethernet

(RFC 2516).

Four-Port switch

A combination of switch and router makes your Nortel Business Secure Router

252 a cost-effective and viable network solution. You can connect up to four computers or phones to the Business Secure Router without the cost of a switch.

Use a switch to add more than four computers or phones to your LAN.

Nortel Business Secure Router 252 Configuration — Advanced

34 Chapter 1 Getting to know your Nortel Business Secure Router 252

Autonegotiating 10/100 Mb/s Ethernet LAN

The LAN interfaces automatically detect if they are on a 10 or a 100 Mb/s

Ethernet.

Autosensing 10/100 Mb/s Ethernet LAN

The LAN interfaces automatically adjust to either a crossover or straight through

Ethernet cable.

Auxiliary port

The Business Secure Router uses the same port for console management and for an auxiliary WAN backup. The AUX port can be used in reserve as a traditional dial-up connection when or if ever the broadband connection to the WAN port fails.

Time and date

Using the Business Secure Router, you can get the current time and date from an external server when you turn on your Business Secure Router. You can also set the time manually.

Reset button

The Business Secure Router reset button is built into the rear panel. Use this button to restart the Business Secure Router or restore the factory default password to setup, IP address to 192.168.1.1, subnet mask to 255.255.255.0, and

DHCP server enabled with a pool of 126 IP addresses starting at 192.168.1.2.

Nonphysical features

IPSec VPN capability

Establish Virtual Private Network (VPN) tunnels to connect home or office computers to your company network using data encryption and the Internet; thus providing secure communications without the expense of leased site-to-site lines.

VPN is based on the IPSec standard and is fully interoperable with other

IPSec-based VPN products.

NN47923-501

Chapter 1 Getting to know your Nortel Business Secure Router 252 35

Nortel Contivity Client Termination

The Business Secure Router supports VPN connections from computers using

Nortel Contivity VPN Client 3.0, 5.01, 5.11, 6.01, 6.02, or 7.01 software.

Certificates

The Business Secure Router can use certificates (also called digital IDs) to authenticate users. Certificates are based on public-private key pairs. Certificates provide a way to exchange public keys for use in authentication.

SSH

The Business Secure Router uses the SSH (Secure Shell) secure communication protocol to provide secure encrypted communication between two hosts over an unsecured network.

HTTPS

HyperText Transfer Protocol over Secure Socket Layer, or HTTP over SSL is a web protocol that encrypts and decrypts web sessions. Use HTTPS for secure

WebGUI access to the Business Secure Router.

IEEE 802.1x for network security

The Business Secure Router supports the IEEE 802.1x standard for user authentication. With the local user profile in the Business Secure Router, you can configure up to 32 user profiles without a network authentication server. In addition, centralized user and accounting management is possible on an optional network authentication server.

Firewall

The Business Secure Router has a stateful inspection firewall with DoS (Denial of

Service) protection. By default, when the firewall is activated, all incoming traffic from the WAN (Wide Area Network) to the LAN is blocked unless it is initiated from the LAN. The Business Secure Router firewall supports TCP/UDP inspection, DoS detection and protection, real time alerts, reports and logs.

Nortel Business Secure Router 252 Configuration — Advanced

36 Chapter 1 Getting to know your Nortel Business Secure Router 252

Brute force password guessing protection

The Business Secure Router has a special protection mechanism to discourage brute force password guessing attacks on the Business Secure Router management interfaces. You can specify a wait time that must expire before you can enter a fourth password after entering three incorrect passwords.

Content filtering

The Business Secure Router can block web features such as ActiveX controls,

Java applets, and cookies, as well as disable web proxies. The Business Secure

Router can block specific URLs by using the keyword feature. The administrator can also define time periods and days during which content filtering is enabled.

Packet filtering

The packet filtering mechanism blocks unwanted traffic from entering or leaving your network.

Universal Plug and Play (UPnP)

Using the standard TCP/IP protocol, the Business Secure Router and other

UPnP-enabled devices can dynamically join a network, obtain an IP address, and convey its capabilities to other devices on the network.

Call scheduling

Configure call time periods to restrict and allow access for users on remote nodes.

PPPoE

PPPoE facilitates the interaction of a host with an Internet modem to achieve access to high-speed data networks through a familiar dial-up networking user interface.

NN47923-501

Chapter 1 Getting to know your Nortel Business Secure Router 252 37

Dynamic DNS support

With Dynamic DNS (Domain Name System) support, you can have a static host name alias for a dynamic IP address, so the host is more easily accessible from various locations on the Internet. You must register for this service with a

Dynamic DNS service provider.

IP Multicast

The Business Secure Router can use IP multicast to deliver IP packets to a specific group of hosts. IGMP (Internet Group Management Protocol) is the protocol used to support multicast groups. The Business Secure Router supports versions 1 and

IP Alias

Using IP Alias, you can partition a physical network into logical networks over the same Ethernet interface. The Business Secure Router supports three logical

LAN interfaces through its single physical Ethernet LAN interface with the

Business Secure Router itself as the gateway for each LAN network.

Central Network Management

With Central Network Management (CNM), an enterprise or service provider network administrator can manage your Business Secure Router. The enterprise or service provider network administrator can configure your Business Secure

Router, perform firmware upgrades, and do troubleshooting for you.

SNMP

SNMP (Simple Network Management Protocol) is a protocol used for exchanging management information between network devices. SNMP is a member of the

TCP/IP protocol suite. Your Business Secure Router supports SNMP agent functionality, which means that a manager station can manage and monitor the

Business Secure Router through the network. The Business Secure Router supports SNMP versions 1 and 2 (SNMPv1 and SNMPv2).

Nortel Business Secure Router 252 Configuration — Advanced

38 Chapter 1 Getting to know your Nortel Business Secure Router 252

Network Address Translation (NAT)

NAT (Network Address Translation — NAT, RFC 1631) translate multiple IP addresses used within one network to different IP addresses known within another network.

Traffic Redirect

Traffic Redirect forwards WAN traffic to a backup gateway when the Business

Secure Router cannot connect to the Internet, thus acting as an auxiliary backup when your regular WAN connection fails.

Port Forwarding

Use this feature to forward incoming service requests to a server on your local network. You can enter a single port number or a range of port numbers to be forwarded, and the local IP address of the desired server.

DHCP (Dynamic Host Configuration Protocol)

With DHCP (Dynamic Host Configuration Protocol), individual client computers can obtain the TCP/IP configuration at start-up from a centralized DHCP server.

The Business Secure Router has built in DHCP server capability, enabled by default, which means it can assign IP addresses, an IP default gateway, and DNS servers to all systems that support the DHCP client. The Business Secure Router can also act as a surrogate DHCP server, where it relays IP address assignment from another DHCP server to the clients.

Full network management

The embedded web configurator is an all platform, web based utility that you can use to easily manage and configure the Business Secure Router. Most functions of the Business Secure Router are also software configurable through the SMT

(System Management Terminal) interface. The SMT is a menu driven interface that you can access from a terminal emulator through the console port or over a

Telnet connection.

NN47923-501

Chapter 1 Getting to know your Nortel Business Secure Router 252 39

Logging and tracing

The Business Secure Router supports the following logging and tracing functions to help with management:

• Built in message logging and packet tracing

• Unix syslog facility support

Upgrade Business Secure Router Firmware

The firmware of the Business Secure Router can be upgraded through the console port or the LAN.

Embedded FTP and TFTP Servers

The embedded FTP and TFTP servers enable fast firmware upgrades, as well as configuration file backups and restoration.

Applications for the Nortel Business Secure Router 252

Secure broadband internet access and VPN

The Nortel Business Secure Router 252 provides broadband Internet access through ADSL. The Business Secure Router also provides IP address sharing and a firewall protected local network with traffic management.

The Business Secure Router VPN is an ideal, cost effective way to connect branch offices and business partners over the Internet without the need (and expense) of leased lines between sites. The LAN computers can share the VPN tunnels for secure connections to remote computers.

Nortel Business Secure Router 252 Configuration — Advanced

40 Chapter 1 Getting to know your Nortel Business Secure Router 252

Figure 1 Secure Internet Access and VPN Application

Business Secure Router

Hardware Setup

Refer to Nortel Business Secure Router 252 — Fundamentals (NN47923-301) for hardware connection instructions.

Note: To keep the Business Secure Router operating at optimal internal temperature, keep the bottom, sides, and rear clear of obstructions and away from the exhaust of other equipment.

After installing your Nortel Business Secure Router 252, continue with the rest of this guide for configuration instructions.

Caution: Electro-static Discharge can disrupt the router. Use appropriate handling precautions to avoid ESD. Avoid touching the connectors on the router, particularly when it is in use.

NN47923-501

Chapter 1 Getting to know your Nortel Business Secure Router 252 41

Note: Please use only No. 26 AWG (American Wire Gauge) or larger telecommunication line cord.

Nortel Business Secure Router 252 Configuration — Advanced

42 Chapter 1 Getting to know your Nortel Business Secure Router 252

NN47923-501

Chapter 2 Introducing the SMT

This chapter explains how to access the System Management Terminal and gives an overview of its menus.

Introduction to the SMT

T he Business Secure Router SMT (System Management Terminal) is a menu-driven interface that you can access from a terminal emulator through the console port or over a Telnet connection. This chapter shows you how to access the SMT (System Management Terminal) menus via the console port, how to navigate the SMT, and how to configure SMT menus.

Accessing the SMT via the console port

Make sure you have the physical connection properly set up as described in the hardware installation chapter.

When configuring using the console port, you need a computer equipped with communications software configured to the following parameters:

• VT100 terminal emulation

• 9 600 baud

• No parity, 8 data bits, 1 stop bit, flow control set to none

Initial screen

When you turn on your Business Secure Router, it performs several internal tests as well as line initialization.

Nortel Business Secure Router 252 Configuration — Advanced

44 Chapter 2 Introducing the SMT

After the tests, the Business Secure Router asks you to press [ENTER] to continue, as shown in Figure 2 .

Figure 2 Initial screen initialize ch =0, ethernet address: 00:A0:C5:22:1A:03 initialize ch =1, ethernet address: 00:A0:C5:22:1A:04

Press ENTER to continue...

Logging on to the SMT

The logon screen appears after you press [ENTER] , prompting you to enter the username, as shown in Figure 3 .

Type the username (“nnadmin “is the default) and press [ENTER] .

The logon screen prompts you to enter the password.

Figure 3 SMT Login

Enter Username : XXXX

Enter Password : XXXX

Type the password (“PlsChgMe!” is the default) and press [ENTER] . As you type the password, the screen displays an X for each character you type.

Note that if there is no activity for longer than five minutes after you log on, your

Business Secure Router will automatically log you off and display a blank screen.

If you see a blank screen, press [ENTER] to bring up the logon screen again.

Navigating the SMT interface

The SMT is an interface that you use to configure your Business Secure Router.

NN47923-501

Chapter 2 Introducing the SMT 45

Table 2 lists several operations you must be familiar with before attempting to modify the configuration.

Table 2 Main menu commands

Operations Keystrokes Descriptions

Move down to another menu

Move up to a previous menu

Move to a

“hidden” menu

Move the cursor

[ENTER]

[ESC]

To move forward to a submenu, type in the number of the desired submenu and press

[ENTER].

Press the [ESC] key to move back to the previous menu.

Press [SPACE BAR] to change No to Yes then press [ENTER].

Fields beginning with “Edit” lead to hidden menus and have a default setting of No . Press

[SPACE BAR] to change No to Yes , and then press [ENTER] to go to a “hidden” menu.

[ENTER] or [UP] or

[DOWN] arrow keys

Within a menu, press [ENTER] to move to the next field. You can also use the [UP] or [DOWN] arrow keys to move to the previous or the next fields, respectively.

When you are at the top of a menu, press the

[UP] arrow key to move to the bottom of a menu.

Entering information

Fill in, or press

[SPACE BAR], then press [ENTER] to select from choices.

Required fields <? >

N/A fields

Save your configuration

Exit the SMT

<N/A>

[ENTER]

Type 99, then press

[ENTER].

There are two types of fields. The first requires you to type in the appropriate information. The second allows you to cycle through the available choices by pressing [SPACE BAR].

All fields with the symbol <?> must be filled in order be able to save the new configuration.

Some of the fields in the SMT will show a <N/A>.

This symbol refers to an option that is Not

Applicable.

Save your configuration by pressing [ENTER] at the message “Press ENTER to confirm or ESC to cancel”. Saving the data on the screen will take you, in most cases, to the previous menu.

Make sure you save your settings in each screen that you configure.

Type 99 at the main menu prompt and press

[ENTER] to exit the SMT interface.

Main menu

After you enter the password, the SMT displays the Business Secure Router Main

Menu , as shown in Figure 4 . Not all models have all the features shown.

Nortel Business Secure Router 252 Configuration — Advanced

46 Chapter 2 Introducing the SMT

Figure 4 Main menu

Business Secure Router Main Menu

Getting Started

1. General Setup

2. WAN Setup

3. LAN Setup

4. Internet Access Setup

Advanced Management

21. Filter and Firewall Setup

22. SNMP Configuration

23. System Security

24. System Maintenance

26. Schedule Setup

Advanced Applications

11. Remote Node Setup

12. Static Routing Setup

14. Dial-in User Setup

15. NAT Setup

Enter Menu Selection Number:

99.Exit

Table 3 describes the fields in Figure 4 .

Table 3 Main menu summary

No.

Menu Title

General Setup

WAN Setup

LAN Setup

Internet Access Setup

Function

Use this menu to set up dynamic DNS and administrative information.

Use this menu to configure the backup WAN connection.

Use this menu to apply LAN filters, configure LAN

DHCP and TCP/IP settings.

Configure your Internet Access setup (Internet address, gateway IP address, and logon) with this menu.

Remote Node Setup

Static Routing Setup

Dial-in User Setup

Use this menu to configure detailed remote node settings (your ISP is also a remote node) as well as apply WAN filters.

Configure IP static routes in this menu.

Use this menu to configure the Dial-in User information.

NAT Setup Use this menu to configure Network Address

Translation.

Filter and Firewall Setup Configure filters, activate or deactivate the firewall, and view the firewall log.

SNMP Configuration Use this menu to configure SNMP-related parameters.

NN47923-501

Chapter 2 Introducing the SMT 47

Table 3 Main menu summary

No.

Menu Title

23 System Security

System Maintenance

Schedule Setup

Exit

Function

Use this menu to change your password and enable network user authentication.

From displaying system status to uploading firmware, this menu provides comprehensive system maintenance.

Use this menu to schedule outgoing calls.

Use this menu to exit (necessary for remote configuration).

Changing the system password

To change the Business Secure Router administrator password:.

1 From the main menu, enter 23 to display Menu 23 – System Security .

2 Enter 1 to display Menu 23.1 – System Security – Change Password .

Figure 5 Menu 23.1 – System Security – Change Password

Menu 23.1 – System Security – Change Password

Old Password= ****

New Password= ?

Retype to confirm= ?

Enter here to CONFIRM or ESC to CANCEL:

3 Type your existing system password in the Old Password field, and press

[ENTER] .

4 Type your new system password in the New Password field (up to 30 characters), and press [ENTER] .

5 Retype your new system password in the Retype to confirm field for confirmation and press [ENTER] .

Note that as you type a password, the screen displays an asterisk * for each character you type.

Nortel Business Secure Router 252 Configuration — Advanced

48 Chapter 2 Introducing the SMT

SMT menus at a glance

Figure 6 SMT overview

NN47923-501

SMT menu 1 - general setup

Introduction to general setup

Menu 1 - general setup contains administrative and system-related information.

Configuring general setup

Enter 1 in the main menu to open Menu 1: general setup .

The Menu 1 - General Setup screen appears, as shown in Figure 7 . Fill in the required fields.

Figure 7 Menu 1 – General Setup

Menu 1 - General Setup

System Name= ?

Domain Name=

First System DNS Server= From ISP

IP Address= N/A

Second System DNS Server= From ISP

IP Address= N/A

Third System DNS Server= From ISP

IP Address= N/A

Edit Dynamic DNS= No

Route IP= Yes

Bridge= No

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

Nortel Business Secure Router 252 Configuration — Advanced

50 Chapter 2 SMT menu 1 - general setup

Table 4 describes the fields in Figure 7 .

Table 4 General setup menu fields

Field Description Example

System name Choose a descriptive name for identification purposes.

Nortel recommends you enter your computer name in this field. This name can be up to 30 alphanumeric characters long. Spaces, dashes (-) and underscores (_) are accepted.

Business

Secure Router

Domain name Enter the domain name (if you know it) here. If you leave this field blank, the ISP assigns a domain name via

DHCP. You can go to menu 24.8 and type sys domain name to see the current domain name used by your router.

The domain name entered by you is given priority over the ISP-assigned domain name. If you want to clear this field just press [SPACE BAR] and then [ENTER]. nortel.com

NN47923-501

Chapter 2 SMT menu 1 - general setup 51

Table 4 General setup menu fields

Field

First system

DNS server

Second system DNS server

Third system

DNS server

Description

DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa.

The DNS server is extremely important because without it, you must know the IP address of a machine before you can access it. The Business Secure Router uses a system DNS server (in the order you specify here) to resolve domain names for VPN, DDNS and the time server.

Press [SPACE BAR] and then [ENTER] to select an option. Select From ISP if your ISP dynamically assigns

DNS server information (and the Business Secure

Router's WAN IP address). The IP Address field below displays the (read-only) DNS server IP address that the

ISP assigns. If you chose From ISP , but the Business

Secure Router has a fixed WAN IP address, From ISP changes to None after you save your changes. If you select From ISP for the second or third DNS server, but the ISP does not provide a second or third IP address,

From ISP changes to None after you save your changes.

Select User-Defined if you have the IP address of a

DNS server. The IP address can be public or a private address on your local LAN. Enter the DNS server's IP address in the field to the right.

A User-Defined entry with the IP address set to 0.0.0.0 changes to None after you save your changes. A duplicate User-Defined entry changes to None after you save your changes.

Select None if you do not want to configure DNS servers. If you do not configure a system DNS server, you must use IP addresses when configuring VPN,

DDNS and the time server.

Select Private DNS if the DNS server has a private IP address and is located behind a VPN peer. Enter the

DNS server IP address in the field to the right.

With a private DNS server, you must also configure the first DNS server entry in SMT menu 3.1 to use DNS

Relay .

Example

Nortel Business Secure Router 252 Configuration — Advanced

52 Chapter 2 SMT menu 1 - general setup

Table 4 General setup menu fields

Field

Edit dynamic

DNS

Description Example

You must also configure a VPN branch office rule since the Business Secure Router uses a VPN tunnel when it relays DNS queries to the private DNS server. One of the rule’s IP policies must include the LAN IP address of the

Business Secure Router as a local IP address and the IP address of the DNS server as a remote IP address.

A Private DNS entry with the IP address set to 0.0.0.0 changes to None after you click Apply . A duplicate

Private DNS entry changes to None after you save your changes.

Press [SPACE BAR] and then [ENTER] to select Yes or

No (default). Select Yes to configure Menu 1.1:

Configure Dynamic DNS, discussed next.

(default)

After you complete this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.

Configuring dynamic DNS

To configure Dynamic DNS, go to Menu 1: General Setup and press

[SPACE BAR] to select Yes in the Edit Dynamic DNS field. Press [ENTER] to display Menu 1.1— Configure Dynamic DNS ( Figure 8 ). Not all models have every field shown.

Figure 8 Menu 1.1 – Configure Dynamic DNS

Menu 1.1 - Configure Dynamic DNS

Service Provider= WWW.DynDNS.ORG

Active= No

DDNS Type= DynamicDNS

Host Name 1=

Host Name 2=

Host Name 3=

Username=

Password= ********

Enable Wildcard Option= No

Enable Off Line Option= N/A

IP Address Update Policy:

DDNS Server Auto Detect IP Address= No

Use Specified IP Address= No

Use IP Address= N/A

Press ENTER to confirm or ESC to cancel:

NN47923-501

Chapter 2 SMT menu 1 - general setup 53

Follow the instructions in Table 5 to configure Dynamic DNS parameters.

Table 5 Configure dynamic DNS menu fields

Field Description Example

Service Provider This is the name of your Dynamic DNS service provider.

Active Press [SPACE BAR] to select Yes and then press

[ENTER] to make dynamic DNS active.

DDNS Type

Host1-3 www.dyndns.org

(default)

Yes

Press [SPACE BAR] and then [ENTER] to select

DynamicDNS if you have a dynamic IP addresses.

Select StaticDNS if you have a static IP addresses.

Select CustomDNS to have dyns.org provide DNS service for a domain name that you already have from a source other than dyndns.org.

Enter your host names in the fields provided. You can specify up to two host names separated by a comma in each field.

DynamicDNS

(default) me.dyndns.org

User

Enter your e-mail address.

Enter your username.

mail@mailserver

Password Enter the password assigned to you.

Enable Wildcard Your Business Secure Router supports DYNDNS

Wildcard. Press [SPACE BAR] and then [ENTER] to select Yes or No This field is N/A when you choose DDNS client as your service provider.

Offline This field is only available when CustomDNS is selected in the DDNS Type field. Press

[SPACE BAR] and then [ENTER] to select Yes .

When Yes is selected, http://www.dyndns.org/ traffic is redirected to a URL that you have previously specified (see www.dyndns.org

for details).

IP Address

Update Policy:

You can select Yes in either the DDNS Server

Auto Detect IP Address field (recommended) or the Use Specified IP Address field, but not both.

With the DDNS Server Auto Detect IP Address and Use Specified IP Address fields both set to

No , the DDNS server automatically updates the IP address of the host names with the Business

Secure Router’s WAN IP address.

DDNS does not work with a private IP address.

When both fields are set to No , the Business

Secure Router must have a public WAN IP address in order for DDNS to work.

Nortel Business Secure Router 252 Configuration — Advanced

54 Chapter 2 SMT menu 1 - general setup

Table 5 Configure dynamic DNS menu fields

Field Description Example

DDNS Server

Auto Detect IP

Address

Press [SPACE BAR] to select Yes and then press

[ENTER] to have the DDNS server automatically update the IP address of the host names with the public IP address that the Business Secure Router uses or is behind.

You can set this field to Yes whether the IP address is public or private, static or dynamic.

Yes

Use Specified IP

Address

Press [SPACE BAR] to select Yes and then press

[ENTER] to update the IP address of the host names to the IP address specified below.

Only select Yes if the Business Secure Router uses or is behind a static public IP address.

Use IP Address Enter the static public IP address if you select Yes in the Use Specified IP Address field.

N/A

After you complete this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.

The IP address updates when you reconfigure menu 1 or perform DHCP client renewal.

NN47923-501

Chapter 3 WAN and Dial Backup Setup

This chapter describes how to configure the WAN using Menu 2 and dial-backup using menus 2.1 and 11.1.

Introduction to WAN and dial backup setup

This chapter explains how to configure the settings for your WAN port and how to configure the Business Secure Router for a dial backup connection.

WAN setup

From the main menu, enter 2 to open Menu 2.

Nortel Business Secure Router 252 Configuration — Advanced

56 Chapter 3 WAN and Dial Backup Setup

Figure 9 Menu 2 – WAN Setup

Menu 2 - WAN Setup

Route Selection:

WAN Metric= 1

Traffic Redirect Metric= 14

Dial Backup Metric= N/A

Edit Traffic Redirect= No

Dial-Backup:

Active= N/A

Port Speed= N/A

AT Command String:

Init= N/A

Edit Advanced Setup= N/A

Press ENTER to Confirm or ESC to Cancel:

Table 6 describes the fields in Figure 9 .

Table 6 Menu 2 WAN setup

Field

Route

Selection:

WAN Metric

Traffic Redirect

Metric

Dial Backup

Metric

Description Example

The Business Secure Router uses the connection with the lowest metric value first.

The default WAN connection is 1 as your broadband connection through the WAN port must always be your preferred method of accessing the WAN.

The default priority of the routes is WAN , Traffic

Redirect and then Dial Backup (dial backup does not apply to all Business Secure Router models):

You have two choices for an auxiliary connection, in the event that your regular WAN connection goes down. If Dial Backup is preferred to Traffic Redirect , then type 14 in the Dial Backup Metric field (and leave the Traffic Redirect Metric at the default of 15).

NN47923-501

Chapter 3 WAN and Dial Backup Setup 57

Table 6 Menu 2 WAN setup

Field

Edit Traffic

Redirect

Dial-Backup:

Active

Port Speed

Description Example

Press [SPACE BAR] to select Yes or No .

Select No (default) if you do not want to configure this feature.

Select Yes and press [ENTER] to configure Menu 2.2

— Traffic Redirect Setup .

Dial backup does not apply to all Business Secure

Router models.

Use this field to turn the dial-backup feature on ( Yes ) or off ( No ).

Press [SPACE BAR] and then press [ENTER] to select the speed of the connection between the dial backup port and the external device.

Available speeds are:

9600 , 19200 , 38400 , 57600 , 115200 or 230400 b/s.

115200

AT Command

String:

Init

Edit Advanced

Setup

Enter the AT command string to initialize the WAN device. Consult the manual of the WAN device connected to your Dial Backup port for specific AT commands.

To edit the advanced setup for the Dial Backup port, move the cursor to this field; press the [SPACE BAR] to select Yes and then press [ENTER] to go to Menu

2.1 — Advanced Setup .

After you complete this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.

at&fs0=0

Yes

Traffic redirect setup

Configure parameters that determine when the Business Secure Router forwards

WAN traffic to the backup gateway using Menu 2.2 - Traffic Redirect Setup .

Nortel Business Secure Router 252 Configuration — Advanced

58 Chapter 3 WAN and Dial Backup Setup

Figure 10 Menu 2.2 – Traffic Redirect Setup

Menu 2.2 - Traffic Redirect Setup

Active= No

Configuration:

Backup Gateway IP Address= 0.0.0.0

Metric= 15

Press ENTER to Confirm or ESC to Cancel:

Table 7 describes the fields in Figure 10 .

Table 7 Menu 2.2 Traffic Redirect Setup

Field Description

Active Press [SPACE BAR] and select Yes (to enable) or No (to disable) traffic redirect setup. The default is No .

If the Active field is Yes , you must configure every field in this screen unless you are using PPPoE encapsulation (except Check WAN IP

Address and Timeout ).

If you do not configure these fields and are using PPPoE encapsulation, the Business Secure Router checks the PPPoE channel to determine if the WAN connection is down.

Configuration:

Backup

Gateway IP

Address

Metric

Enter the IP address of your backup gateway in dotted decimal notation.

The Business Secure Router automatically forwards traffic to this IP address if the Internet connection of the Business Secure Router terminates.

This field sets the priority for this route among the routes the Business

Secure Router uses.

The metric represents the cost of transmission. A router determines the best route for transmission by choosing a path with the lowest cost. RIP routing uses hop count as the measurement of cost, with a minimum of

1 for directly connected networks. The number must be between 1 and

15; a number greater than 15 means the link is down. The smaller the number, the lower the cost.

After you complete this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.

NN47923-501

Chapter 3 WAN and Dial Backup Setup 59

Dial backup

The Dial Backup port or CON/AUX port can be used in reserve as a traditional dial-up connection if the broadband connection to the WAN port fail. This feature is not available on all models. To set up the auxiliary port (Dial Backup or CON/

AUX) for use in the event that the regular WAN connection is dropped, first make sure you have set up the switch and port connection (see the Hardware Installation chapter), then configure:

• Menu 2 - WAN Setup

• Menu 2.1 - Advanced WAN Setup

• Menu 11.2 - Remote Node Profile (Backup ISP), as shown in Figure 12 on page 62

Refer also to the traffic redirect section for information on an alternate backup

WAN connection.

Advanced WAN setup

Note: Consult the manual of your WAN device connected to your Dial

Backup port for specific AT commands

To edit the advanced setup for the Dial Backup port, move the cursor to the Edit

Advanced Setup field in Menu 2 - WAN Setup , press the [SPACE BAR] to select Yes, and then press [ENTER].

Nortel Business Secure Router 252 Configuration — Advanced

60 Chapter 3 WAN and Dial Backup Setup

Figure 11 Menu 2.1 – Advanced WAN Setup

Menu 2.1 - Advanced WAN Setup

AT Command Strings: Call Control:

Dial= atdt Dial Timeout(sec)= 60

Drop= ~~+++~~ath Retry Count= 0

Answer= ata Retry Interval(sec)= N/A

Drop Timeout(sec)= 20

Drop DTR When Hang Up= Yes Call Back Delay(sec)= 15

AT Response Strings:

CLID= NMBR =

Called Id=

Speed= CONNECT

Press ENTER to Confirm or ESC to Cancel:

Table 8 describes the fields in Figure 11 .

Table 8 Advanced WAN port setup: AT commands fields

Field Description Default

AT Command Strings:

Dial

Drop

Answer

Drop DTR When

Hang Up

Enter the AT Command string to make a call.

Enter the AT Command string to drop a call. ~ represents a one second wait. For example,

~~~+++~~ath can be used if your modem has a slow response time.

Enter the AT Command string to answer a call.

atdt

+++ath ata

Press the [SPACE BAR] to choose either Yes or No .

When Yes is selected (the default), the DTR (Data

Terminal Ready) signal is dropped after the “AT

Command String: Drop” is sent out.

Yes

AT Response String:

CLID (Calling Line

Identification)

Enter the keyword that precedes the CLID (Calling

Line Identification) in the AT response string. This lets the Business Secure Router capture the CLID in the AT response string that comes from the WAN device. CLID is required for CLID authentication.

NMBR =

NN47923-501

Chapter 3 WAN and Dial Backup Setup 61

Table 8 Advanced WAN port setup: AT commands fields

Field

Called Id

Speed

Description Default

Enter the keyword preceding the dialed number.

Enter the keyword preceding the connection speed.

CONNECT

Table 9 Advanced WAN port setup: call control parameters

Field Description Default

Call Control

Dial Timeout (sec) Enter a number of seconds for the Business

Secure Router to keep trying to set up an outgoing call before timing out (stopping). The

Business Secure Router times out and stops if it cannot set up an outgoing call within the timeout value.

Retry Count Enter a number of times for the Business Secure

Router to retry a busy or no-answer phone number before blacklisting the number.

60 seconds

0 to disable the blacklist control

Retry Interval (sec) Enter a number of seconds for the Business

Secure Router to wait before trying another call after a call has failed. This applies before a phone number is blacklisted.

Drop Timeout (sec) Enter a number of seconds for the Business

Secure Router to wait before dropping the DTR signal if it does not receive a positive disconnect confirmation.

Call Back Delay

(sec)

Enter a number of seconds for the Business

Secure Router to wait between dropping a callback request call and dialing the corresponding callback call.

20 seconds

15 seconds

Remote node profile (Backup ISP)

Enter 2 in Menu 11 Remote Node Setup to open Menu 11.2 Remote Node

Profile (Backup ISP) ( Figure 12 ) and configure the setup for your Dial Backup port connection. This feature is not available on all models.

Nortel Business Secure Router 252 Configuration — Advanced

62 Chapter 3 WAN and Dial Backup Setup

Figure 12 Menu 11.2 – Remote Node Profile (Backup ISP)

Menu 11.2 - Remote Node Profile (Backup ISP)

Rem Node Name= GUI Edit PPP Options= No

Active= No Rem IP Addr= 0.0.0.0

Edit IP= No

Outgoing: Edit Script Options= No

My Login=

My Password= ******** Telco Option:

Retype to Confirm= ******** Allocated Budget(min)= 0

Authen= CHAP/PAP Period(hr)= 0

Pri Phone #= ? Schedules=

Sec Phone #= Nailed-Up Connection= No

Session Options:

Edit Filter Sets= No

Idle Timeout(sec)= 100

Press ENTER to Confirm or ESC to Cancel:

Table 11 describes the fields in Figure 12 .

Table 10 Fields in Menu 11.2 Remote Node Profile (Backup ISP)

Field Description Example

Rem Node

Name

Active

Enter a descriptive name for the remote node. This field can be up to eight characters.

LAoffice

Press [SPACE BAR] and then [ENTER] to select Yes to enable the remote node or No to disable the remote node.

Yes

Outgoing

My Login Enter the login name assigned by your ISP for this remote node.

My Password Enter the password assigned by your ISP for this remote node.

jim

*****

NN47923-501

Chapter 3 WAN and Dial Backup Setup 63

Table 10 Fields in Menu 11.2 Remote Node Profile (Backup ISP)

Field

Authen

Pri Phone #

Sec Phone #

Edit PPP

Options

Rem IP Addr

Edit IP

Edit Script

Options

Description Example

This field sets the authentication protocol used for outgoing calls.

Options for this field are:

CHAP / PAP - Your Business Secure Router will accept either CHAP or PAP when requested by this remote node.

CHAP - accept CHAP only.

PAP - accept PAP only.

Enter the first (primary) phone number from the ISP for this remote node. If the Primary Phone number is busy or does not answer, your Business Secure Router dials the Secondary Phone number if available. Some areas require dialing the pound sign # before the phone number for local calls. Include a # symbol at the beginning of the phone numbers as required.

CHAP/PAP

Move the cursor to this field and use the space bar to select [Yes] and press [Enter] to edit the PPP options for this remote node. This brings you to Menu 11.2.1 -

Remote Node PPP Options ( see “Editing PPP options” ).

(default)

Leave the field set to 0.0.0.0 (default) if the remote gateway has a dynamic IP address. Enter the remote gateway’s IP address here if it is static.

This field leads to a “hidden” menu. Press [SPACE BAR] to select Yes and press [ENTER] to go to Menu 11.2.2 -

Remote Node Network Layer Options . Please see

“Editing TCP/IP options” for more information.

0.0.0.0

(default)

Press [SPACE BAR] to select Yes and press [ENTER] to edit the AT script for the dial backup remote node

( Menu 11.2.3 - Remote Node Script ). Please see

“Editing logon script” for more information.

(default)

Telco Option

Allocated

Budget

Period(hr)

Enter the maximum number of minutes that this remote node may be called within the time period configured in the Period field. The default for this field is 0 meaning there is no budget control and no time limit for accessing this remote node.

(default)

Enter the time period (in hours) for how often the budget should be reset. For example, to allow calls to this remote node for a maximum of 10 minutes every hour, set the Allocated Budget to 10 (minutes) and the

Period to 1 (hour).

(default)

Nortel Business Secure Router 252 Configuration — Advanced

64 Chapter 3 WAN and Dial Backup Setup

Table 10 Fields in Menu 11.2 Remote Node Profile (Backup ISP)

Field Description Example

Schedules

Nailed-Up

Connection

You can apply up to four schedule sets here. For more details please refer to Chapter 18 Call scheduling .

Press [SPACE BAR] to select Yes to set this connection to always be on, regardless of whether or not there is any traffic. Select No to have this connection act as a dial-up connection.

1,3,5

(default)

Session Options

Edit Filter sets This field leads to another “hidden” menu. Use [SPACE

BAR] to select Yes and press [ENTER] to open menu

11.2.4 to edit the filter sets. See “Remote node filter for more details.

Idle Timeout Enter the number of seconds of idle time (when there is no traffic from the Business Secure Router to the remote node) that can elapse before the Business Secure

Router automatically disconnects the PPP connection.

This option only applies when the Business Secure

Router initiates the call.

Once you have configured this menu, press [ENTER] at the message “Press ENTER to Confirm...” to save your configuration, or press [ESC] at any time to cancel.

(default)

100 seconds

(default)

Editing PPP options

The Business Secure Router dial back-up feature uses PPP. To edit the remote node PPP options, move the cursor to the [Edit PPP Options] field in Menu 11.2

- Remote Node Profile , and use the space bar to select [Yes].

Press [Enter] to open Menu 11.2.1

as shown in Figure 13 .

NN47923-501

Chapter 3 WAN and Dial Backup Setup 65

Figure 13 Menu 11.2.1 – Remote node PPP options

Menu 11.2.1 - Remote Node PPP Options

Encapsulation= Standard PPP

Compression= No

Enter here to CONFIRM or ESC to CANCEL:

Press Space Bar to Toggle.

Table 11 describes the Remote Node PPP Options Menu, and contains instructions about how to configure the PPP options fields.

Table 11 Remote node PPP options menu fields

FIELD

Encapsulation

Compression

DESCRIPTION EXAMPLE

Press [SPACE BAR] and then [ENTER] to select

CISCO PPP if your Dial Backup WAN device uses

Cisco PPP encapsulation, otherwise select

Standard PPP .

Press [SPACE BAR] and then [ENTER] to select

Yes to enable or No to disable Stac compression.

Standard PPP

(default)

Editing TCP/IP options

Move the cursor to the Edit IP field in menu 11.2, then press [SPACE BAR] to select Yes . Press [ENTER] to open Menu 11.3 - Network Layer Options .

Nortel Business Secure Router 252 Configuration — Advanced

66 Chapter 3 WAN and Dial Backup Setup

Figure 14 Menu 11.3 – Remote Node Network Layer Options

Menu 11.3 - Remote Node Network Layer Options

IP Options: Bridge Options:

IP Address Assignment = Dynamic Ethernet Addr Timeout(min)=

N/A

Rem IP Addr = 0.0.0.0

Rem Subnet Mask= 0.0.0.0

My WAN Addr= 0.0.0.0

NAT= SUA Only

Address Mapping Set= N/A

Metric= 15

Private= No

RIP Direction= None

Version= RIP-1

Multicast= None

Enter here to CONFIRM or ESC to CANCEL:

Press Space Bar to Toggle.

Table 12 describes the fields in Figure 14 .

Table 12 Remote Node Network Layer Options Menu Fields

Field

IP Address

Assignment

Rem IP

Address

Rem Subnet

Mask

Description Example

If your ISP did not assign you an explicit IP address, press

[SPACE BAR] and then [ENTER] to select Dynamic ; otherwise select Static and enter the IP address & subnet mask in the following fields.

Dynamic

(default)

Leave this field set to 0.0.0.0 to have the ISP or other remote router dynamically (automatically) send its IP address if you do not know it. Enter the remote gateway’s

IP address here if you know it (static).

Leave this field set to 0.0.0.0 to have the ISP or other remote router dynamically send its subnet mask if you do not know it. Enter the remote gateway’s subnet mask here if you know it (static).

0.0.0.0

(default)

0.0.0.0

(default)

NN47923-501

Chapter 3 WAN and Dial Backup Setup 67

Table 12 Remote Node Network Layer Options Menu Fields

Field Description Example

My WAN Addr Leave the field set to 0.0.0.0 to have the ISP or other remote router dynamically (automatically) assign your

WAN IP address if you do not know it. Enter your WAN IP address here if you know it (static).

This is the address assigned to your local Business

Secure Router, not the remote router.

NAT Network Address Translation (NAT) allows the translation of an Internet protocol address used within one network

(for example a private IP address used in a local network) to a different IP address known within another network (for example a public IP address used on the Internet).

Press [SPACE BAR] and then [ENTER] to select either

Full Feature, None or SUA Only.

Choose None to disable NAT .

Choose SUA Only if you have a single public IP address.

SUA (Single User Account) is a subset of NAT that supports two types of mapping: Many-to-One and Server .

Choose Full Feature if you have multiple public IP addresses. Full Feature mapping types include:

One-to-One , Many-to-One (SUA/PAT), Many-to-Many

Overload , Many- One-to-One and Server . When you select Full Feature you must configure at least one address mapping set!

See the Network Address Translation (NAT) chapter for a full discussion on this feature.

0.0.0.0

(default)

None

(default)

Address

Mapping Set

Metric

Private

Enter a number from 1 to 15 to set this route’s priority among the Business Secure Router’s routes. The smaller the number, the higher priority the route has.

This parameter determines if the Business Secure Router will include the route to this remote node in its RIP broadcasts. If set to Yes , this route is kept private and not included in RIP broadcasts. If No , the route to this remote node will be propagated to other hosts through RIP broadcasts.

RIP Direction Press [SPACE BAR] and then [ENTER] to select the RIP direction from Both/ None / In Only / Out Only and None .

Version Press [SPACE BAR] and then [ENTER] to select the RIP version from RIP-1/RIP-2B/RIP-2M.

(default)

Both

(default)

RIP-1

Nortel Business Secure Router 252 Configuration — Advanced

68 Chapter 3 WAN and Dial Backup Setup

Table 12 Remote Node Network Layer Options Menu Fields

Field Description Example

Multicast IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a

Multicast group. The Business Secure Router supports both IGMP version 1 ( IGMP-v1 ) and version 2 ( IGMP-v2 ).

Press the [SPACE BAR] to enable IP Multicasting or select

None to disable it. See the LAN Setup chapter for more information on this feature.

None

(default)

Ethernet Addr

Timeout

Type the time (in minutes) for the Business Secure Router to retain the Ethernet Address information in its internal tables while the line is down. If this information is retained, your Business Secure Router will not have to recompile the tables when the line comes back up.

Once you have completed filling in Menu 11.2.2 Remote

Node Network Layer Options , press [ENTER] at the message “Press ENTER to Confirm...” to save your configuration and return to menu 11.2, or press [ESC] at any time to cancel.

Editing logon script

For some remote gateways, text logon is required before PPP negotiation is started. The Business Secure Router provides a script facility for this purpose. The script has six programmable sets; each set is composed of an Expect string and a

‘Send’ string. After matching a message from the server to the ‘Expect’ field, the

Business Secure Router returns the set’s Send string to the server.

For instance, a typical logon sequence starts with the server printing a banner, a logon prompt for you to enter the username and a password prompt to enter the password:

Welcome to Acme, Inc.

Password:

To handle the first prompt, you specify ogin: as the Expect string and myLogin as the Send string in set 1. The reason for leaving out the leading L is to avoid having to know exactly whether it is upper or lower case. Similarly, you specify word: as the Expect string and your password as the Send string for the second prompt in set 2.

NN47923-501

Chapter 3 WAN and Dial Backup Setup 69

You can use two variables, $USERNAME and $PASSWORD (all upper case), to represent the actual username and password in the script, so they do not show in clear text. They are replaced with the outgoing login name and password in the remote node when the Business Secure Router sees them in a ‘Send’ string. Note that both variables must be entered exactly as shown. No other characters can appear before or after, either, i.e., they must be used alone in response to logon and password prompts.

Note that the ordering of the sets is significant, i.e., starting from set 1, the

Business Secure Router waits until the ‘Expect’ string is matched before it proceeds to set 2, and so on for the rest of the script. When both the ‘Expect’ and the ‘Send’ fields of the current set are empty, the Business Secure Router terminates the script processing and start PPP negotiation. This implies two things: first, the sets must be contiguous; the sets after an empty one are ignored.

Second, the last set must match the final message sent by the server. For instance, if the server prints: login successful.

Starting PPP...

after you enter the password, then you must create a third set to match the final

“PPP...” but without a “Send” string. Otherwise, the Business Secure Router starts

PPP prematurely right after sending your password to the server.

If there are errors in the script and it gets stuck at a set for longer than the “Dial

Timeout” in menu 2 (default 60 seconds), the Business Secure Router times out and drops the line. To debug a script, go to Menu 24.4 to initiate a manual call and watch the trace display to see if the sequence of messages and prompts from the server differs from what you expect.

Nortel Business Secure Router 252 Configuration — Advanced

70 Chapter 3 WAN and Dial Backup Setup

Figure 15 Menu 11.2.3 – Remote Node Setup Script

Menu 11.2.3 - Remote Node Script

Active= No

Set 1: Set 5:

Expect= Expect=

Send= Send=

Set 2: Set 6:

Expect= Expect=

Send= Send=

Set 3:

Expect=

Send=

Set 4:

Expect=

Send=

Enter here to CONFIRM or ESC to CANCEL:

Press Space Bar to Toggle.

Table 13 describes the fields in Figure 15 .

Table 13 Menu 11.2.3: remote node script menu fields

Field Description Example

Active Press [SPACE BAR] and then [ENTER] to select either

Yes to enable the AT strings or No to disable them.

(default)

Set 1-6:

Expect

Enter an Expect string to match. After matching the

Expect string, the Business Secure Router returns the string in the Send field.

Set 1-6: Send Enter a string to send out after the Expect string is matched.

0.0.0.0

NN47923-501

Chapter 3 WAN and Dial Backup Setup 71

Remote node filter

Move the cursor to the field Edit Filter Sets in menu 11.2, and then press

[SPACE BAR] to set the value to Yes . Press [ENTER] to open Menu 11.2.4 -

Remote Node Filter .

Use menu 11.2.4 to specify the filter sets to apply to the incoming and outgoing traffic between this remote node and the Business Secure Router to prevent certain packets from triggering calls. You can specify up to four filter sets separated by commas, for example, 1, 5, 9, 12, in each filter field. Note that spaces are accepted in this field. Refer to Chapter 11, “Filter configuration,” on page 133 for more information about defining the filters.

Figure 16 Menu 11.2.4: dial backup remote node filter

Menu 11.2.4 - Remote Node Filter

Input Filter Sets:

protocol filters=

device filters=

Output Filter Sets:

protocol filters=

device filters=

Call Filter Sets:

protocol filters=

device filters=

Enter here to CONFIRM or ESC to CANCEL:

Nortel Business Secure Router 252 Configuration — Advanced

72 Chapter 3 WAN and Dial Backup Setup

NN47923-501

Chapter 4 LAN setup

This chapter describes how to configure the LAN using Menu 3: LAN Setup .

Introduction to LAN setup

This section describes how to configure the Business Secure Router for LAN connections.

Accessing the LAN menus

From the main menu, enter 3 to open Menu 3 – LAN setup

Figure 17 Menu 3 – LAN setup.

Menu 3 - LAN Setup

1. LAN Port Filter Setup

2. TCP/IP and DHCP Setup

Enter Menu Selection Number:

LAN port filter setup

With Menu 3, you can specify the filter sets that you wish to apply to the LAN traffic. You seldom need to filter the LAN traffic, however, the filter sets are useful to block certain packets, reduce traffic, and prevent security breaches.

Nortel Business Secure Router 252 Configuration — Advanced

74 Chapter 4 LAN setup

Figure 18 Menu 3.1 – LAN Port Filter Setup

Menu 3.1 – LAN Port Filter Setup

Input Filter Sets:

protocol filters=

device filters=

Output Filter Sets:

protocol filters=

device filters=

Press ENTER to Confirm or ESC to Cancel:

TCP/IP and DHCP ethernet setup menu

From the main menu, enter 3 to open Menu 3 - LAN Setup to configure TCP/IP

(RFC 1155) and DHCP Ethernet setup.

Figure 19 Menu 3 – LAN Setup

Menu 3 - LAN Setup

1. LAN Port Filter Setup

2. TCP/IP and DHCP Setup

Enter Menu Selection Number:

From menu 3, select the submenu option TCP/IP and DHCP Setup and press

[ ENTER ]. The screen now displays Menu 3.2: TCP/IP and DHCP Ethernet

Setup , as shown in Figure 20 .

NN47923-501

Chapter 4 LAN setup 75

Figure 20 Menu 3.2 – TCP/IP and DHCP Ethernet setup

Menu 3.2 - TCP/IP and DHCP Ethernet Setup

DHCP= Server TCP/IP Setup:

Client IP Pool:

Starting Address= 192.168.1.2 IP Address= 192.168.1.1

Size of Client IP Pool= 126 IP Subnet Mask= 255.255.255.0

First DNS Server= From ISP RIP Direction= None

IP Address= N/A Version= N/A

Second DNS Server= From ISP Multicast= None

IP Address= N/A Edit IP Alias= No

Third DNS Server= From ISP

IP Address= N/A

DHCP Server Address= N/A

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

Follow the instructions in Table 14 to configure the DHCP fields.

Table 14 DHCP Ethernet setup menu fields

Field

DHCP

Description

This field enables and disables the DHCP server.

If set to Server , your Business Secure Router will act as a DHCP server.

If set to None , the DHCP server will be disabled.

Configuration:

Client IP Pool

Starting Address

This field specifies the first of the contiguous addresses in the IP address pool.

Example

Server

192.168.1.2

Nortel Business Secure Router 252 Configuration — Advanced

76 Chapter 4 LAN setup

Table 14 DHCP Ethernet setup menu fields

Field

Size of Client IP

Pool

First DNS Server

Second DNS

Server

Third DNS Server

Description Example

This field specifies the size or count of the IP address pool.

The Business Secure Router passes a DNS

(Domain Name System) server IP address (in the order you specify here) to the DHCP clients.

Select From ISP if your ISP dynamically assigns

DNS server information (and the Business Secure

Router's WAN IP address). The IP Address field below displays the (read-only) DNS server IP address that the ISP assigns. If you chose From

ISP , but the Business Secure Router has a fixed

WAN IP address, From ISP changes to None after you save your changes. If you chose From ISP for the second or third DNS server, but the ISP does not provide a second or third IP address, From ISP changes to None after you save your changes.

Select User-Defined if you have the IP address of a

DNS server. Enter the DNS server's IP address in the IP Address field below. If you chose

User-Defined , but leave the IP address set to

0.0.0.0, User-Defined changes to None after you save your changes. If you set a second choice to

User-Defined , and enter the same IP address, the second User-Defined changes to None after you save your changes.

Select DNS Relay to have the Business Secure

Router act as a DNS proxy. The Business Secure

Router's LAN IP address displays in the IP Address field below (read-only). The Business Secure Router tells the DHCP clients on the LAN that the Business

Secure Router itself is the DNS server. When a computer on the LAN sends a DNS query to the

Business Secure Router, the Business Secure

Router forwards the query to the Business Secure

Router's system DNS server (configured in the

SYSTEM General screen) and relays the response back to the computer. You can only select DNS

Relay for one of the three servers; if you select DNS

Relay for a second or third DNS server, that choice changes to None after you save your changes.

Select None if you do not want to configure DNS servers. If you do not configure a DNS server, you must know the IP address of a machine in order to access it.

126

NN47923-501

Chapter 4 LAN setup 77

Use the instructions in Table 15 to configure TCP/IP parameters for the LAN port.

Table 15 LAN TCP/IP setup menu fields

Field

TCP/IP Setup:

IP Address

Description

IP Subnet Mask

RIP Direction

Version

Multicast

Edit IP Alias

Example

Enter the IP address of your Business Secure

Router in dotted decimal notation.

Your Business Secure Router automatically calculates the subnet mask based on the IP address that you assign. Unless you are implementing subnetting, use the subnet mask computed by the Business Secure Router.

192.168.1.1

(default)

255.255.255.0

Press [SPACE BAR] and then [ENTER] to select the RIP direction. Options are: Both , In Only ,

Out Only or None .

Press [SPACE BAR] and then [ENTER] to select the RIP version. Options are:

RIP-1 , RIP-2B or RIP-2M .

Both

(default)

RIP-1

(default)

IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish membership in a Multicast group. The Business

Secure Router supports both IGMP version 1

( IGMP-v1 ) and version 2 ( IGMP-v2 ). Press

[SPACE BAR] and then [ENTER] to enable IP

Multicasting or select None (default) to disable it.

None

The Business Secure Router supports three logical LAN interfaces via its single physical

Ethernet interface with the Business Secure

Router itself as the gateway for each LAN network. Press [SPACE BAR] to select Yes and then press [ENTER] to display menu 3.2.1.

Yes

IP Alias Setup

You must use menu 3.2 to configure the first network. Move the cursor to the Edit

IP Alias field, press [SPACE BAR] to choose Yes and press [ENTER] to configure the second and third network.

Press [ENTER] to open Menu 3.2.1 - IP Alias Setup , as shown in Figure 21 .

Nortel Business Secure Router 252 Configuration — Advanced

78 Chapter 4 LAN setup

Figure 21 Menu 3.2.1 – IP Alias setup

Menu 3.2.1 - IP Alias Setup

IP Alias 1= No

IP Address= N/A

IP Subnet Mask= N/A

RIP Direction= N/A

Version= N/A

Incoming protocol filters= N/A

Outgoing protocol filters= N/A

IP Alias 2= No

IP Address= N/A

IP Subnet Mask= N/A

RIP Direction= N/A

Version= N/A

Incoming protocol filters= N/A

Outgoing protocol filters= N/A

Enter here to CONFIRM or ESC to CANCEL:

Press Space Bar to Toggle.

Use the instructions in Table 16 to configure IP Alias parameters.s

Table 16 IP Alias setup menu field

Field

IP Alias

IP Address

IP Subnet Mask

Description

Choose Yes to configure the LAN network for the Business Secure Router.

Enter the IP address of your Business Secure

Router in dotted decimal notation.

Example

Yes

192.168.1.1

255.255.255.0

NN47923-501

Chapter 4 LAN setup 79

Table 16 IP Alias setup menu field

Field

RIP Direction

Version

Incoming Protocol

Filters

Outgoing Protocol

Filters

Description

Press [SPACE BAR] and then [ENTER] to select the RIP direction. Options are

Both , In Only, Out Only or None .

Press [SPACE BAR] and then [ENTER] to select the RIP version. Options are

RIP-1 , RIP-2B or RIP-2M .

Enter the filter sets you wish to apply to the incoming traffic between this node and the

Business Secure Router.

Enter the filter sets you wish to apply to the outgoing traffic between this node and the

Business Secure Router.

Example

None

RIP-1

Nortel Business Secure Router 252 Configuration — Advanced

80 Chapter 4 LAN setup

NN47923-501

Chapter 5 Internet access

This chapter shows you how to configure your Business Secure Router for

Internet access.

Internet access configuration

Using Menu 4 you can enter the Internet Access information in one screen. Menu

4 is actually a simplified setup for one of the remote nodes that you can access in

Menu 11. Before you configure your Business Secure Router for Internet access, you must collect your Internet account information.

Use your Internet account information from your ISP to fill in this menu. Note that if you are using PPPoA or PPPoE encapsulation, the only ISP information you need is a logon name and password. You only need to know the Ethernet

Encapsulation Gateway IP address if you are using ENET ENCAP encapsulation.

From the main menu, type 4 to display Menu 4 — Internet Access Setup , as shown in the following figure.

Nortel Business Secure Router 252 Configuration — Advanced

82 Chapter 5 Internet access

Figure 22 Menu 4 – Internet Access Setup

Menu 4 - Internet Access Setup

ISP's Name= ChangeMe

Encapsulation= ENET ENCAP

Multiplexing= LLC-based

VPI #= 8

VCI #= 35

My Login= N/A

My Password= N/A

ENET ENCAP Gateway= N/A

IP Address Assignment= Dynamic

IP Address= N/A

Network Address Translation= SUA Only

Address Mapping Set= N/A

Press ENTER to Confirm or ESC to Cancel:

Table 17 describes the fields in Figure 22 .

Table 17 Menu 4 Internet access setup

Field Description Example

ISP’s Name Enter the name of your Internet Service Provider.

This information is for identification purposes only.

Encapsulation Press [ SPACE BAR ] to select the method of encapsulation used by your ISP. Choices are

PPPoE , PPPoA , RFC 1483 , or ENET ENCAP .

Multiplexing Press [ SPACE BAR ] to select the method of multiplexing used by your ISP. Choices are

VC-based or LLC-based .

VPI #

VCI #

My Login

ChangeMe

ENET ENCAP

LLC-based

Enter the Virtual Path Identifier (VPI) that the telephone company gives you.

Enter the Virtual Channel Identifier (VCI) that the telephone company gives you.

Configure the My Login and My Password fields for

PPPoA and PPPoE encapsulation only. Enter the username exactly as your ISP assigned.

N/A

My Password N/A

ENET ENCAP

Gateway

Enter the password associated with the logon name above.

Enter the gateway IP address supplied by your ISP when you are using ENET ENCAP encapsulation.

N/A

NN47923-501

Chapter 5 Internet access 83

Table 17 Menu 4 Internet access setup (continued)

Field Description Example

Idle Timeout

IP Address

Assignment

IP Address

Network

Address

Translation

This value specifies the number of idle seconds that elapse before the Business Secure Router automatically disconnects the PPPoE session.

Press [ SPACE BAR address assignment.

] to select Static or Dynamic

Enter the IP address supplied by your ISP, if applicable.

Press [ SPACE BAR ] to select None , SUA Only account (SUA) feature, see “SUA (Single User

Account) Versus NAT” on page 105 .

Full Feature . For more details about the single user

Dynamic

N/A

SUA Only

Address

Mapping Set

Type the numbers of mapping sets (1-8) to use with

NAT. See the Chapter 9, “Network Address

Translation (NAT),” on page 105 for details.

N/A

After you complete this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.

Basic setup complete

You have successfully connected, installed, and set up your Business Secure

Router to operate on your network, as well as access the Internet.

If all your settings are correct, your Business Secure Router can connect automatically to the Internet. If the connection fails, note the error message that you receive on the screen and take the appropriate troubleshooting steps.

Note: If the firewall is activated, the default policy can communicate with the Internet if the communication originates from the LAN, and blocks all traffic to the LAN that originates from the Internet.

You can deactivate the firewall in menu 21.2 or using the embedded WebGUI in the Business Secure Router. You can also define additional firewall rules or modify existing ones, but exercise extreme caution in doing so. For more information about the firewall, see Nortel Business Secure Router 252

Configuration — Basics (NN47923-500).

Nortel Business Secure Router 252 Configuration — Advanced

84 Chapter 5 Internet access

NN47923-501

Chapter 6 Remote Node setup

This chapter shows you how to configure a remote node.

Introduction to Remote Node setup

This section describes the protocol-independent parameters for a remote node. A remote node is required for placing calls to a remote gateway. A remote node represents both the remote gateway and the network behind it across a WAN connection. When you use menu 4 to set up Internet access, you are configuring one of the remote nodes.

You first choose a remote node in Menu 11- Remote Node Setup . You can then edit that node’s profile in menu 11.1, as well as configure specific settings in three submenus: edit IP and bridge options in menu 11.3; edit ATM options in menu

11.6; and edit filter sets in menu 11.5.

Outgoing Authentication Protocol

Generally speaking, you should employ the strongest authentication protocol possible, for obvious reasons. However, some vendor’s implementation includes a specific authentication protocol in the user profile. It will disconnect if the negotiated protocol is different from that in the user profile, even when the negotiated protocol is stronger than specified. If you encounter a case where the peer disconnects right after a successful authentication, please make sure that you specify the correct authentication protocol when connecting to such an implementation.

Nortel Business Secure Router 252 Configuration — Advanced

86 Chapter 6 Remote Node setup

Nailed-Up Connection

A nailed-up connection is a dial-up line where the connection is always up regardless of traffic demand. The Business Secure Router does two things when you specify a nailed-up connection. The first is that idle timeout is disabled. The second is that the Business Secure Router will try to bring up the connection when turned on and whenever the connection is down. A nailed-up connection can be very expensive for obvious reasons.

Do not specify a nailed-up connection unless your telephone company offers flat-rate service or you need a constant connection and the cost is of no concern.

The following table describes the fields specific to PPPoE encapsulation.

Remote Node setup

This section describes the protocol-independent parameters for a remote node.

Remote Node profile

To configure a remote node, follow these steps:

1 From the main menu, enter 11 to display Menu 11 - Remote Node Setup.

2 When menu 11 appears, as shown in the following figure, type the number of the remote node that you want to configure.

NN47923-501

Chapter 6 Remote Node setup 87

Figure 23 Menu 11 – Remote Node Setup

Menu 11 - Remote Node Setup

1. ChangeMe (ISP, SUA)

2. -GUI (BACKUP_ISP, SUA)

Enter Node # to Edit:

Encapsulation and Multiplexing scenarios

For Internet access you should use the encapsulation and multiplexing methods used by your ISP. Consult your telephone company for information on encapsulation and multiplexing methods for LAN-to-LAN applications, for example between a branch office and corporate headquarters. There must be prior agreement on encapsulation and multiplexing methods because they cannot be automatically determined. What methods you use also depends on how many VCs you have and how many different network protocols you need. The extra overhead that ENET ENCAP encapsulation entails makes it a poor choice in a

LAN-to-LAN application. Here are some examples of more suitable combinations in such an application.

• Scenario 1. One VC, Multiple Protocols

PPPoA (RFC-2364) encapsulation with VC-based multiplexing is the best combination because no extra protocol identifying headers are needed. The

PPP protocol already contains this information.

• Scenario 2. One VC, One Protocol (IP)

Nortel Business Secure Router 252 Configuration — Advanced

88 Chapter 6 Remote Node setup

Selecting RFC-1483 encapsulation with VC-based multiplexing requires the least amount of overhead (0 octets). However, if there is a potential need for multiple protocol support in the future, it may be safer to select PPPoA encapsulation instead of RFC-1483 , so you do not need to reconfigure either computer later.

• Scenario 3.Multiple VCs

If you have an equal number (or more) of VCs than the number of protocols, then select RFC-1483 encapsulation and VC-based multiplexing.

Figure 24 Menu 11.1 – Remote Node Profile

Menu 11.1 - Remote Node Profile

Rem Node Name= ChangeMe Route= IP

Active= Yes Bridge= No

Encapsulation= ENET ENCAP Edit IP/Bridge= No

Multiplexing= LLC-based Edit ATM Options= No

Service Name= N/A Edit Advance Options= N/A

Incoming: Telco Option:

Rem Login= N/A Allocated Budget(min)= N/A

Rem Password= N/A Period(hr)= N/A

Outgoing: Schedule Sets= N/A

My Login= N/A Nailed-Up Connection= N/A

My Password= N/A Session Options:

Authen= N/A Edit Filter Sets= No

Idle Timeout(sec)= N/A

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

Table 18 describes fields in Figure 24 .

Table 18 Menu 11.1 Remote Node Profile

Field

Rem Node

Name

Active

Description

Type a unique, descriptive name of up to eight characters for this node.

Press [SPACE BAR] and then [ENTER] to select Yes to activate or No to deactivate this node. Inactive nodes are displayed with a minus sign “–“ in SMT menu 11.

Example myISP

Yes

NN47923-501

Chapter 6 Remote Node setup 89

Table 18 Menu 11.1 Remote Node Profile (continued)

Field Description Example

Encapsulation PPPoA refers to RFC-2364 (PPP Encapsulation over ATM

Adaptation Layer 5).

If RFC-1483 (Multiprotocol Encapsulation over ATM

Adaptation Layer 5) of ENET ENCAP are selected, then the

Rem Login , Rem Password , My Login , My Password and Authen fields are not applicable ( N/A ).

ENET

ENCAP

Multiplexing Press [SPACE BAR] and then [ENTER] to select the method of multiplexing that your ISP uses, either VC-based or LLC-based .

Service Name When using PPPoE encapsulation, type the name of your

PPPoE service here.

LLC-based

N/A

Incoming:

Rem Login

Rem

Password

Type the login name that this remote node will use to call your Business Secure Router. The login name and the Rem

Password will be used to authenticate this node.

Type the password used when this remote node calls your

Business Secure Router.

Outgoing:

My Login Type the login name assigned by your ISP when the

Business Secure Router calls this remote node.

My Password Type the password assigned by your ISP when the

Business Secure Router calls this remote node.

Authen This field sets the authentication protocol used for outgoing calls. Options for this field are:

CHAP / PAP – Your Business Secure Router will accept either CHAP or PAP when requested by this remote node.

CHAP – accept CHAP (Challenge Handshake

Authentication Protocol) only.

Route

Bridge

PAP – accept PAP (Password Authentication Protocol) only.

This field determines the protocol used in routing. Options are IP and None.

When bridging is enabled, your Business Secure Router will forward any packet that it does not route to this remote node; otherwise, the packets are discarded. Select Yes to enable and No to disable.

Edit IP/Bridge Press [SPACE BAR] to select Yes and press [ENTER] to display Menu 11.3 – Remote Node Network Layer

Options .

Nortel Business Secure Router 252 Configuration — Advanced

90 Chapter 6 Remote Node setup

Table 18 Menu 11.1 Remote Node Profile (continued)

Field Description Example

Edit ATM

Options

Edit Advance

Options

Press [SPACE BAR] to select Yes and press [ENTER] to display Menu 11.6 – Remote Node ATM Layer Options .

This field is only available when you select PPPoE in the

Encapsulation field.

Press [SPACE BAR] to select Yes and press [ENTER] to display Menu 11.8 – Advance Setup Options . This field is not available on all models.

Telco Option

Allocated

Budget (min)

Period (hr)

This sets a ceiling for outgoing call time for this remote node. The default for this field is 0 meaning no budget control.

This field is the time period that the budget should be reset.

For example, if we are allowed to call this remote node for a maximum of 10 minutes every hour, then the Allocated

Budget is (10 minutes) and the Period (hr) is 1 (hour).

Schedule Sets This field is only applicable for PPPoE and PPPoA encapsulation. You can apply up to four schedule sets here.

For more details please refer to the Call scheduling chapter.

Nailed up

Connection

This field is only applicable for PPPoE and PPPoA encapsulation. This field specifies if you want to make the connection to this remote node a nailed-up connection.

More details are given earlier in this section.

Session

Options

Edit Filter

Sets

Use [SPACE BAR] to choose open menu 11.5 to edit the filter sets. See the filter section for more details.

Yes and press [ENTER] to

Remote Node

(default)

Idle Timeout

(sec)

Type the number of seconds (0-9999) that can elapse when the Business Secure Router is idle (there is no traffic going to the remote node), before the Business Secure Router automatically disconnects the remote node. 0 means that the session will not timeout.

After you complete this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.

Edit IP/Bridge

1 For the TCP/IP parameters, perform the following steps to edit Menu 11.3 –

Remote Node Network Layer Options as shown next.

NN47923-501

Chapter 6 Remote Node setup 91

2 In menu 11.1, make sure IP is among the protocols in the Route field.

3 Move the cursor to the Edit IP/Bridge field, press [ SPACE BAR ] to select

Yes, then press [ENTER] to display Menu 11.3 – Remote Node Network

Layer Options.

Figure 25 Menu 11.3 – Remote Node Network Layer Options

Menu 11.3 - Remote Node Network Layer Options

IP Options: Bridge Options:

IP Address Assignment = Dynamic Ethernet Addr Timeout(min)=

Rem IP Addr = 0.0.0.0

Rem Subnet Mask= 0.0.0.0

My WAN Addr= N/A

NAT= SUA Only

Address Mapping Set= N/A

Metric= 2

Private= No

RIP Direction= None

Version= RIP-1

Multicast= None

Enter here to CONFIRM or ESC to CANCEL:

Table 19 explains fields in Figure 25 .

Table 19 Menu 11.3 Remote Node Network Layer Options

Field Description Example

IP Address

Assignment

Press [SPACE BAR] and then [ENTER] to select

Dynamic if the remote node is using a dynamically assigned IP address or Static if it is using a static (fixed)

IP address. You will only be able to configure this in the

ISP node (also the one you configure in menu 4),all other nodes are set to Static .

Rem IP Addr This is the IP address you entered in the previous menu.

Dynamic

Rem Subnet

Mask

Type the subnet mask assigned to the remote node.

Nortel Business Secure Router 252 Configuration — Advanced

92 Chapter 6 Remote Node setup

Table 19 Menu 11.3 Remote Node Network Layer Options (continued)

Field Description Example

My WAN Addr Some implementations, especially UNIX derivatives, require separate IP network numbers for the WAN and

LAN links and each end to have a unique address within the WAN network number. In that case, type the IP address assigned to the WAN port of your Business

Secure Router.

NOTE: Refers to local Business Secure Router address, not the remote router address.

NAT Press [SPACE BAR] and then [ENTER] to select Full

Feature if you have multiple public WAN IP addresses for your Business Secure Router.

SUA Only

Address

Mapping Set

Select SUA Only if you have just one public WAN IP address for your Business Secure Router. The SMT uses

Address Mapping Set 255 (menu 15.1.255 - see

Figure 40 ).

Select None to disable NAT.

When Full Feature is selected in the NAT field, configure address mapping sets in menu 15.1. Select one of the

NAT server sets (2-10) in menu 15.2 (see Chapter 9,

“Network Address Translation (NAT),” on page 105 for details) and type that number here.

When SUA Only is selected in the NAT field, the SMT uses NAT server set 1 in menu 15.2 (see Chapter 9,

“Network Address Translation (NAT),” on page 105 for details).

Metric

Private

The metric represents the “cost” of transmission for routing purposes. IP routing uses hop count as the cost measurement, with a minimum of 1 for directly connected networks. Type a number that approximates the cost for this link. The number need not be precise, but it must be between 1 and 15. In practice, 2 or 3 is usually a good number.

This determines if the Business Secure Router will include the route to this remote node in its RIP broadcasts. If set to Yes , this route is kept private and not included in RIP broadcast. If No , the route to this remote node will be propagated to other hosts through RIP broadcasts.

None RIP Direction Press [SPACE BAR] and then [ENTER] to select the RIP

Direction. Options are Both , In Only , Out Only or None .

Version Press [SPACE BAR] and then [ENTER] to select the RIP version. Options are RIP-1 , RIP-2B or RIP-2M .

Multicast IGMP-v1 sets IGMP to version 1, IGMP-v2 sets IGMP to version 2 and None disables IGMP.

RIP-1

None

NN47923-501

Chapter 6 Remote Node setup 93

Table 19 Menu 11.3 Remote Node Network Layer Options (continued)

Field Description Example

After you complete this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.

Remote Node filter

Move the cursor to the field Edit Filter Sets in menu 11.1, and then press

[SPACE BAR] to set the value to Yes . Press [ENTER] to open Menu 11.1.4-

Remote Node Filter .

Use menu 11.1.4 to specify the filter sets to apply to the incoming and outgoing traffic between this remote node and the Business Secure Router to prevent certain packets from triggering calls. You can specify up to 4 filter sets separated by commas, for example, 1, 5, 9, 12, in each filter field. Note that spaces are accepted in this field. For more information on defining the filters, please refer to

Chapter 11, “Filter configuration . For PPPoE or PPPoA encapsulation, you have the additional option of specifying remote node call filter sets.

Nortel Business Secure Router 252 Configuration — Advanced

94 Chapter 6 Remote Node setup

Figure 26 Menu 11.1.4 – Remote Node Filter (Ethernet Encapsulation)

Menu 11.1.4 - Remote Node Filter

Input Filter Sets:

protocol filters=

device filters=

Output Filter Sets:

protocol filters=

device filters=

Enter here to CONFIRM or ESC to CANCEL:

Figure 27 Menu 11.1.4 – Remote Node Filter (PPPoE or PPPoA Encapsulation)

Menu 11.1.4 - Remote Node Filter

Input Filter Sets:

protocol filters=

Device filters=

Output Filter Sets:

protocol filters=

device filters=

Call Filter Sets:

protocol filters=

Device filters=

Enter here to CONFIRM or ESC to CANCEL:

To configure the parameters for traffic redirect, see “Traffic redirect setup” on page 57 .

NN47923-501

Chapter 6 Remote Node setup 95

Editing ATM Layer Options

Follow the steps shown next to edit Menu 11.6 – Remote Node ATM Layer

Options .

In menu 11.1, move the cursor to the Edit ATM Options field and then press

[SPACE BAR] to select Yes . Press [ENTER] to display Menu 11.6 – Remote

Node ATM Layer Options .

There are two versions of menu 11.6 for the Contivity 251, depending on whether you chose VC-based / LLC-based multiplexing and PPP encapsulation in menu

11.1.

VC-based Multiplexing (non-PPP Encapsulation)

For VC-based multiplexing, by prior agreement, a protocol is assigned a specific virtual circuit, for example, VC1 will carry IP. Separate VPI and VCI numbers must be specified for each protocol.

Figure 28 Menu 11.6 for VC-based Multiplexing

Menu 11.6 - Remote Node ATM Layer Options

VPI/VCI (VC-Multiplexing)

VC Options for IP:

VPI #= 8

VCI #= 35

VC Options for Bridge:

VPI #= 1

VCI #= 36

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

LLC-based Multiplexing or PPP Encapsulation

For LLC-based multiplexing or PPP encapsulation, one VC carries multiple protocols with protocol identifying information being contained in each packet header.

Nortel Business Secure Router 252 Configuration — Advanced

96 Chapter 6 Remote Node setup

Figure 29 Menu 11.6 for LLC-based Multiplexing or PPP Encapsulation

Menu 11.6 - Remote Node ATM Layer Options

VPI/VCI (LLC-Multiplexing or PPP-Encapsulation)

VPI #= 8

VCI #= 35

ATM QoS Type= UBR

ENTER here to CONFIRM or ESC to CANCEL:

In this case, only one set of VPI and VCI numbers need be specified for all protocols. The valid range for the VPI is 0 to 255 and for the VCI is 32 to 65535

(1 to 31 is reserved for local management of ATM traffic).

Advance Setup Options

In menu 11.1, select PPPoE in the Encapsulation field.

Figure 30 Menu 11.1 – Remote Node Profile

Menu 11.1 - Remote Node Profile

Rem Node Name= MyISP Route= IP

Active= Yes Bridge= No

Encapsulation= PPPoE Edit IP/Bridge= No

Multiplexing= LLC-based Edit ATM Options= No

Service Name= Edit Advance Options= Yes

Incoming: Telco Option:

Rem Login= Allocated Budget(min)= 0

Rem Password= ******** Period(hr)= 0

Outgoing: Schedule Sets=

My Login= ChangeMe Nailed-Up Connection= No

My Password= ******** Session Options:

Authen= CHAP/PAP Edit Filter Sets= No

Idle Timeout(sec)= 0

Press ENTER to Confirm or ESC to Cancel:

NN47923-501

Chapter 6 Remote Node setup 97

Move the cursor to the Edit Advance Options field, press [SPACE BAR] to select Yes , then press [ENTER] to display Menu 11.8 – Advance Setup

Options .

Figure 31 Menu 11.8 – Advance Setup Options

Menu 11.8 - Advance Setup Options

PPPoE pass-through = No

Press ENTER to Confirm or ESC to Cancel:

Table 20 describes the fields in Figure 31 .

Table 20 Menu 11.8 Advance Setup Options

Field Description

PPPoE pass-through Press [SPACE BAR] to select Yes and press [ENTER] to enable

PPPoE pass through. In addition to the Contivity 251's built-in

PPPoE client, you can enable PPPoE pass through to allow up to ten hosts on the LAN to use PPPoE client software on their computers to connect to the ISP via the Contivity 251. Each host can have a separate account and a public WAN IP address.

PPPoE pass through is an alternative to NAT for application where

NAT is not appropriate.

Press [SPACE BAR] to select No and press [ENTER] to disable

PPPoE pass through if you do not need to allow hosts on the LAN to use PPPoE client software on their computers to connect to the

ISP.

After you complete this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.

Nortel Business Secure Router 252 Configuration — Advanced

98 Chapter 6 Remote Node setup

NN47923-501

Chapter 7 IP Static Route Setup

This chapter shows you how to configure static routes with your Business Secure

Router.

IP Static Route Setup

Enter 12 from the main menu. Select one of the IP static routes as shown in

Figure 32 to configure IP static routes in menu 12. 1.

Nortel Business Secure Router 252 Configuration — Advanced

100 Chapter 7 IP Static Route Setup

Figure 32 Menu 12 – IP Static Route Setup

Menu 12 - IP Static Route Setup

1. ________

2. ________

3. ________

4. ________

5. ________

6. ________

7. ________

8. ________

9. ________

10. ________

11. ________

12. ________

Enter selection number:

Now, enter the index number of the static route that you want to configure.

NN47923-501

Chapter 7 IP Static Route Setup 101

Figure 33 Menu 12.1 – Edit IP Static Route

Menu 12.1 - Edit IP Static Route

Route #: 1

Route Name= ?

Active= No

Destination IP Address= ?

IP Subnet Mask= ?

Gateway IP Address= ?

Metric= 2

Private= No

Press ENTER to CONFIRM or ESC to CANCEL:

Table 21 describes the fields in Figure 33 .

Table 21 IP Static Route Menu Fields

Field Description

Route #

Route Name

Active

Destination IP

Address

This is the index number of the static route that you chose in menu 12.

Enter a descriptive name for this route. This is for identification purposes only.

This field allows you to activate or deactivate this static route.

This parameter specifies the IP network address of the final destination. Routing is always based on network number. If you need to specify a route to a single host, use a subnet mask of 255.255.255.255 in the subnet mask field to force the network number to be identical to the host ID.

IP Subnet Mask Enter the IP subnet mask for this destination.

Gateway IP

Address

Enter the IP address of the gateway. The gateway is an immediate neighbor of your Business Secure Router that forwards the packet to the destination. On the LAN, the gateway must be a router on the same segment as your Business Secure Router; over the WAN, the gateway must be the IP address of one of the remote nodes.

Metric

Private

Enter a number from 1 to 15 to set the priority for the route among the

Business Secure Router routes. The smaller the number, the higher priority the route has.

This parameter determines if the Business Secure Router includes the route to this remote node in its RIP broadcasts. If set to Yes , this route is kept private and not included in RIP broadcast. If No , the route to this remote node is propagated to other hosts through RIP broadcasts.

After you complete filling in this menu, press [ENTER] at the message

“Press ENTER to Confirm…” to save your configuration, or press [ESC] to cancel.

Nortel Business Secure Router 252 Configuration — Advanced

102 Chapter 7 IP Static Route Setup

NN47923-501

Chapter 8 Dial-in User Setup

This chapter shows you how to create user accounts on the Business Secure

Router.

103

Dial-in User Setup

By storing user profiles locally, your Business Secure Router can authenticate users without interacting with a network RADIUS server.

Follow the steps below to set up user profiles on your Business Secure Router.

From the main menu, enter 14 to display Menu 14 - Dial-in User Setup .

Figure 34 Menu 14 – Dial-in User Setup

Menu 14 - Dial-in User Setup

1. ________ 9. ________ 17. ________ 25. ________

2. ________ 10. ________ 18. ________ 26. ________

3. ________ 11. ________ 19. ________ 27. ________

4. ________ 12. ________ 20. ________ 28. ________

5. ________ 13. ________ 21. ________ 29. ________

6. ________ 14. ________ 22. ________ 30. ________

7. ________ 15. ________ 23. ________ 31. ________

8. ________ 16. ________ 24. ________ 32. ________

Enter Menu Selection Number:

Type a number and press [ENTER] to edit the user profile.

Nortel Business Secure Router 252 Configuration — Advanced

104 Chapter 8 Dial-in User Setup

Figure 35 Menu 14.1 – Edit Dial-in User

Menu 14.1 - Edit Dial-in User

User Name= test

Active= Yes

Password= ********

Press ENTER to Confirm or ESC to Cancel:

Leave name field blank to delete profile

Table 22 describes the fields in Figure 35 .

Table 22 Menu 14.1- Edit Dial-in User

Field

User Name

Active

Password

Description

Enter a username up to 31 alphanumeric characters long for this user profile.

This field is case sensitive.

Press [SPACE BAR] to select Yes and press [ENTER] to enable the user profile.

Enter a password up to 31 characters long for this user profile.

After you complete this menu, press [ENTER] at the prompt “Press

ENTER to confirm or ESC to cancel” to save your configuration or press [ESC] to cancel and go back to the previous screen.

NN47923-501

Chapter 9 Network Address Translation (NAT)

This chapter discusses how to configure NAT on the Business Secure Router.

105

Using NAT

Note: You must create a firewall rule in addition to setting up SUA/

NAT, to allow traffic from the WAN to be forwarded through the

Business Secure Router.

SUA (Single User Account) Versus NAT

SUA (Single User Account) is an implementation of a subset of NAT that supports two types of mapping, Many-to-One and Server . For a detailed description of NAT set for SUA, see “Address Mapping Sets” on page 108 . The

Business Secure Router also supports Full Feature NAT to map multiple global

IP addresses to multiple private LAN IP addresses of clients or servers using mapping types .

Note: Choose SUA Only if you have just one public WAN IP address for your Business Secure Router.

Choose Full Feature if you have multiple public WAN IP addresses for your Business Secure Router.

Applying NAT

You apply NAT via menus 4 or 11.3 ( Figure 37 on page 107 ). Figure 36 shows you how to apply NAT for Internet access in menu 4. Enter 4 from the main menu to go to Menu 4 - Internet Access Setup.

Nortel Business Secure Router 252 Configuration — Advanced

106 Chapter 9 Network Address Translation (NAT)

Figure 36 Menu 4 – Applying NAT for Internet Access

Menu 4 - Internet Access Setup

ISP's Name= ChangeMe

Encapsulation= ENET ENCAP

Multiplexing= LLC-based

VPI #= 8

VCI #= 35

My Login= N/A

My Password= N/A

ENET ENCAP Gateway= N/A

IP Address Assignment= Dynamic

IP Address= N/A

Network Address Translation= SUA Only

Address Mapping Set= N/A

Press ENTER to Confirm or ESC to Cancel:

Figure 37 shows how you apply NAT to the remote node in menu 11.1.

Enter 11 from the main menu.

Move the cursor to the Edit IP/Bridge field, press [SPACE BAR] to select Yes and then press [ENTER] to bring up Menu 11.3 - Remote Node Network Layer

Options.

NN47923-501

Chapter 9 Network Address Translation (NAT) 107

Figure 37 Menu 11.3 – Applying NAT to the Remote Node

Menu 11.3 - Remote Node Network Layer Options

IP Options: Bridge Options:

IP Address Assignment = Dynamic Ethernet Addr Timeout(min)= N/A

Rem IP Addr = 0.0.0.0

Rem Subnet Mask= 0.0.0.0

My WAN Addr= 0.0.0.0

NAT= SUA Only

Address Mapping Set= N/A

Metric= 15

Private= No

RIP Direction= None

Version= RIP-1

Multicast= None

Enter here to CONFIRM or ESC to CANCEL:

Press Space Bar to Toggle.

Table 23 describes the fields in Figure 37 .

Table 23 Applying NAT in Menus 4 & 11.3

Field

Network

Address

Translation

Description Options

When you select this option the SMT uses Address

Mapping Set 1 (menu 15.1 - “Address Mapping Sets” on page 108 for further discussion). Choose Full Feature if you have multiple public WAN IP addresses for your

Business Secure Router.

When you select Full Feature you must configure at least one address mapping set!

NAT is disabled when you select this option.

When you select this option the SMT uses Address

Mapping Set 255 (menu 15.1 - “Address Mapping Sets” on page 108 ). Choose SUA Only if you have just one public

WAN IP address for your Business Secure Router.

Full Feature

None

SUA Only

Nortel Business Secure Router 252 Configuration — Advanced

108 Chapter 9 Network Address Translation (NAT)

NAT setup

Use the address mapping sets menus and submenus to create the mapping table used to assign global addresses to computers on the LAN. You can see two NAT address mapping sets in menu 15.1. You can only configure Set 1 . Set 255 is used for SUA. When you select Full Feature in menu 4 or 11.3, the SMT uses Set 1 .

When you select SUA Only , the SMT uses the pre-configured Set 255 (read only).

The server set is a list of LAN servers mapped to external ports. To use this set, a server rule must be set up inside the NAT address mapping set. To configure

NAT, enter 15 from the main menu to bring up the screen shown in Figure 38 .

Figure 38 Menu 15 – NAT Setup

Menu 15 — NAT Setup

1. Address Mapping Sets

2. Port Forwarding Setup

3. Trigger Port Setup

Enter Menu Selection Number:

Note: Configure LAN IP addresses in NAT menus 15.1 and 15.2.

Address Mapping Sets

Enter 1 to bring up Menu 15.1—Address Mapping Sets .

NN47923-501

Chapter 9 Network Address Translation (NAT) 109

Figure 39 Menu 15.1 – Address Mapping Sets

Menu 15.1 — Address Mapping Sets

1. NAT_SET

255. SUA (read only)

Enter Menu Selection Number:

SUA Address Mapping Set

Enter 255 to display the screen shown in Figure 40 (see “SUA (Single User

Account) Versus NAT” on page 105 ) . The fields in this menu cannot be changed.

Nortel Business Secure Router 252 Configuration — Advanced

110 Chapter 9 Network Address Translation (NAT)

Figure 40 Menu 15.1.255 – SUA Address Mapping Rules

Menu 15.1.255 - Address Mapping Rules

Set Name= SUA

10.

Idx Local Start IP Local End IP Global Start IP Global End IP Type

--- --------------- --------------- --------------- --------------- ------

1. 0.0.0.0 255.255.255.255 0.0.0.0 M-1

2. 0.0.0.0 Server

Press ENTER to Confirm or ESC to Cancel:

Table 24 explains the fields in Figure 40 .

Note: Menu 15.1.255 is read-only.

Table 24 SUA Address Mapping Rules

Field Description Example

Set Name This is the name of the set you selected in menu

15.1 or enter the name of a new set you want to create.

SUA

Idx This is the index or rule number.

Local Start IP Local Start IP is the starting local IP address (ILA).

0.0.0.0

NN47923-501

Chapter 9 Network Address Translation (NAT) 111

Table 24 SUA Address Mapping Rules

Field Description Example

Local End IP Local End IP is the ending local IP address (ILA). If the rule is for all local IPs, then the start IP is 0.0.0.0 and the end IP is 255.255.255.255.

Global Start IP This is the starting global IP address (IGA). If you have a dynamic IP, enter 0.0.0.0 as the Global Start

IP .

255.255.255.255

0.0.0.0

Global End IP This is the ending global IP address (IGA).

Type These are the mapping types discussed above. With

Server, you can specify multiple servers of different types behind NAT to this machine. Examples is found in the section “General NAT examples” on page 119 .

After you configure a rule in this menu, press

[ENTER] at the message “Press ENTER to

Confirm…” to save your configuration, or press

[ESC] to cancel.

Server

User-Defined Address Mapping Sets

Go to menu 15.1. Enter 1 to bring up the menu shown in figure below. Look at the differences from the previous menu. Note the extra Action and Select Rule fields means you can configure rules in this screen. Note also that the [?] in the Set

Name field means that this is a required field and you must enter a name for the set.

Note: The entire set is deleted if you leave the Set Name field blank and press [ENTER] at the bottom of the screen.

Nortel Business Secure Router 252 Configuration — Advanced

112 Chapter 9 Network Address Translation (NAT)

Figure 41 Menu 15.1.1: First Set

Menu 15.1.1 - Address Mapping Rules

Set Name= NAT_SET

10.

Idx Local Start IP Local End IP Global Start IP Global End IP Type

--- --------------- --------------- --------------- --------------- ------

Action= Edit Select Rule=

Press ENTER to Confirm or ESC to Cancel:

Note: The Type , Local and Global Start/End IP s are configured in menu 15.1.1.1 (described later) and the values are displayed on the screen shown in Figure 42 .

Ordering your rules

Ordering your rules is important because the Business Secure Router applies the rules in the order that you specify. When a rule matches the current packet, the

Business Secure Router takes the corresponding action and the remaining rules are ignored. If there are any empty rules before your new configured rule, your configured rule is pushed up by that number of empty rules. For example, if you have already configured rules 1 to 6 in your current set and now you configure rule number 9. In the set summary screen, the new rule will be rule 7, not 9.

NN47923-501

Chapter 9 Network Address Translation (NAT) 113

If you delete rule 4, rules 5 to 7 will be pushed up by 1 rule, so as old rule 5 becomes rule 4, old rule 6 becomes rule 5 and old rule 7 becomes rule 6.

Table 25 Fields in menu 15.1.1

Field Description Example

Set Name Enter a name for this set of rules. This is a required field. If this field is left blank, the entire set is deleted.

Action The default is Edit . Edit means you want to edit a selected rule (see following field). Insert Before means to insert a rule before the rule selected. The rules after the selected rule are then moved down by one rule. Delete means to delete the selected rule and all the rules after the selected one advance one rule. None disables the Select Rule item.

Select Rule When you choose Edit , Insert Before or Delete in the previous field, the cursor jumps to this field so you can select the rule to apply the action in question.

NAT_SET

Edit

Note: You must press [ENTER] at the bottom of the screen to save the whole set. You must do this again if you make any changes to the set – including deleting a rule. No changes to the set take place until this action is taken.

Selecting Edit in the Action field and then selecting a rule brings up the menu shown in Figure 42 , Menu 15.1.1.1

- Address Mapping Rule in which you can edit an individual rule and configure the Type , Local and Global Start/End IPs .

Note: An IP End address must be numerically greater than its corresponding IP Start address.

Nortel Business Secure Router 252 Configuration — Advanced

114 Chapter 9 Network Address Translation (NAT)

Figure 42 Menu 15.1.1.1: Editing or configuring an individual rule in a set

Menu 15.1.1.1 Address Mapping Rule

Type= One-to-One

Local IP:

Start=

End = N/A

Global IP:

Start=

End = N/A

Press ENTER to Confirm or ESC to Cancel:

Table 26 describes the fields in Figure 42 .

Table 26 Menu 15.1.1.1: Editing or configuring an individual rule in a set

Field

Type

Local IP

Start

End

Description Example

Press [SPACE BAR] and then [ENTER] to select from a total of five types. If you choose Server , you can specify multiple servers of different types behind NAT to this computer. See

“Example 3: Multiple public IP addresses with inside servers” on page 122 for an example.

Only local IP fields are N/A for server; Global IP fields must be set for Server .

Enter the starting local IP address (ILA).

Enter the ending local IP address (ILA). If the rule is for all local IPs, then put the Start IP as 0.0.0.0 and the End IP as

255.255.255.255. This field is N/A for One-to-One and Server types.

One-to-On e

0.0.0.0

N/A

NN47923-501

Chapter 9 Network Address Translation (NAT) 115

Table 26 Menu 15.1.1.1: Editing or configuring an individual rule in a set

Field

Global IP

Start

Description Example

End

Enter the starting global IP address (IGA). If you have a dynamic IP, enter 0.0.0.0 as the Global IP Start . Note that

Global IP Start can be set to 0.0.0.0 only if the types are

Many-to-One or Server .

0.0.0.0

Enter the ending global IP address (IGA). This field is N/A for

One-to-One , Many-to-One and Server types .

N/A

After you finish configuring a rule in this menu, press [ENTER] at the message “Press ENTER to Confirm…” to save your configuration, or press [ESC] to cancel.

Configuring a server behind NAT

Note: If you do not assign a Default Server IP address, the Business Secure Router discards all packets received for ports that are not specified here or in the remote management setup.

Follow these steps to configure a server behind NAT:

1 Enter 15 in the main menu to go to Menu 15 - NAT Setup.

2 Enter 2 to go to Menu 15.2 - NAT Server Setup .

Nortel Business Secure Router 252 Configuration — Advanced

116 Chapter 9 Network Address Translation (NAT)

Figure 43 Menu 15.2 – NAT Server Sets

Menu 15.2 - NAT Server Setup

Default Server: 0.0.0.0

Rule Act. Start Port End Port IP Address

------------------------------------------------------

001 No 0 0 0.0.0.0

002 No 0 0 0.0.0.0

003 No 0 0 0.0.0.0

004 No 0 0 0.0.0.0

005 No 0 0 0.0.0.0

006 No 0 0 0.0.0.0

007 No 0 0 0.0.0.0

008 No 0 0 0.0.0.0

009 No 0 0 0.0.0.0

010 No 0 0 0.0.0.0

Select Command= None Select Rule= N/A

Press ENTER to Confirm or ESC to Cancel:

3 Select Edit Rule in the Select Command field; type the index number of the

NAT server you want to configure in the Select Rule field and press

[ENTER] to open Menu 15.2.1 - NAT Server Configuration (see the next figure).

NN47923-501

Chapter 9 Network Address Translation (NAT) 117

Figure 44 15.2.1 – NAT Server Configuration

15.2.1 - NAT Server Configuration

Index= 1

-----------------------------------------------------------------

Name=

Active= No

Start port= 0 End port= 0

IP Address= 0.0.0.0

Press ENTER to Confirm or ESC to Cancel:

The following table describes the fields in this screen.

Table 27 15.2.1: NAT Server Configuration

Field Description

Index

Name

Active

This is the index number of an individual port forwarding server entry.

Enter a name to identify this port-forwarding rule.

Press [SPACE BAR] and then [ENTER] to select Yes to enable the NAT server entry.

Start Port

End Port

Enter a port number in the Start Port field. To forward only one port, enter it again in the End Port field. To specify a range of ports, enter the last port to be forwarded in the End Port field.

IP Address Enter the inside IP address of the server.

After you complete this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.

4 Enter a port number in the Start Port field. To forward only one port, enter it again in the End Port field. To specify a range of ports, enter the last port to be forwarded in the End Port field.

Nortel Business Secure Router 252 Configuration — Advanced

118 Chapter 9 Network Address Translation (NAT)

5 Enter the inside IP address of the server in the IP Address field. In the following figure, you have a computer acting as an FTP, Telnet and SMTP server (ports 21, 23 and 25) at 192.168.1.33.

6 Press [ENTER] at the “Press ENTER to confirm …” prompt to save your configuration after you define all the servers or press [ESC] at any time to cancel.

Figure 45 Menu 15.2 – NAT Server Setup

Menu 15.2 - NAT Server Setup

Default Server: 0.0.0.0

Rule Act. Start Port End Port IP Address

------------------------------------------------------

001 No 0 0 0.0.0.0

002 Yes 21 25 192.168.1.33

003 No 0 0 0.0.0.0

004 No 0 0 0.0.0.0

005 No 0 0 0.0.0.0

006 No 0 0 0.0.0.0

007 No 0 0 0.0.0.0

008 No 0 0 0.0.0.0

009 No 0 0 0.0.0.0

010 No 0 0 0.0.0.0

Select Command= None Select Rule= N/A

Press ENTER to Confirm or ESC to Cancel:

You assign the private network IP addresses. The NAT network appears as a single host on the Internet. A is the FTP/Telnet/SMTP server.

NN47923-501

Chapter 9 Network Address Translation (NAT) 119

Figure 46 Multiple servers behind NAT example

Business Secure Router

General NAT examples

The following are some examples of NAT configuration.

Internet access only

In the Internet access example shown in Figure 47 , you only need one rule where all your ILAs (Inside Local addresses) map to one dynamic IGA (Inside Global

Address) assigned by your ISP.

Nortel Business Secure Router 252 Configuration — Advanced

120 Chapter 9 Network Address Translation (NAT)

Figure 47 NAT Example 1

Business Secure Router

Figure 48 Menu 4: Internet access & NAT example

Menu 4 - Internet Access Setup

ISP's Name= ChangeMe

Encapsulation= ENET ENCAP

Multiplexing= LLC-based

VPI #= 8

VCI #= 35

My Login= N/A

My Password= N/A

ENET ENCAP Gateway= N/A

IP Address Assignment= Dynamic

IP Address= N/A

Network Address Translation= SUA Only

Address Mapping Set= N/A

Press ENTER to Confirm or ESC to Cancel:

From menu 4 shown above, simply choose the SUA Only option from the

Network Address Translation field. This is the Many-to-One mapping discussed in section “General NAT examples” on page 119 . The SUA Only read-only option from the Network Address Translation field in menus 4 and

11.3 is specifically preconfigured to handle this case.

NN47923-501

Chapter 9 Network Address Translation (NAT) 121

Example 2: Internet access with an inside server

Figure 49 NAT Example 2

Business Secure Router

In this case, you do exactly as shown in Figure 49 (use the convenient pre-configured SUA Only set), and also go to menu 15.2 to specify the Inside

Server behind the NAT as shown in Figure 50 .

Nortel Business Secure Router 252 Configuration — Advanced

122 Chapter 9 Network Address Translation (NAT)

Figure 50 Menu 15.2: Specifying an inside server

Menu 15.2 - NAT Server Setup

Default Server: 192.168.1.10

Rule Act. Start Port End Port IP Address

------------------------------------------------------

001 No 0 0 0.0.0.0

002 No 0 0 0.0.0.0

003 No 0 0 0.0.0.0

004 No 0 0 0.0.0.0

005 No 0 0 0.0.0.0

006 No 0 0 0.0.0.0

007 No 0 0 0.0.0.0

008 No 0 0 0.0.0.0

009 No 0 0 0.0.0.0

010 No 0 0 0.0.0.0

Select Command= None Select Rule= N/A

Press ENTER to Confirm or ESC to Cancel:

Example 3: Multiple public IP addresses with inside servers

In this example, there are 3 IGAs from our ISP. There are many departments but two have their own FTP server. All departments share the same router. The example reserves one IGA for each department with an FTP server and all departments use the other IGA. Map the FTP servers to the first two IGAs and the other LAN traffic to the remaining IGA. Map the third IGA to an inside web server and mail server. Four rules need to be configured, two bi-directional and two uni-directional, as follows.

1 Map the first IGA to the first inside FTP server for FTP traffic in both directions ( 1 : 1 mapping, giving both local and global IP addresses).

2 Map the second IGA to the second internal FTP server for FTP traffic in both directions ( 1 : 1 mapping, giving both local and global IP addresses).

3 Map the other outgoing LAN traffic to IGA3 ( Many : 1 mapping).

4 You also map your third IGA to the web server and mail server on the LAN. If you choose type Server , you can specify multiple servers, of different types, to other computers behind NAT on the LAN.

NN47923-501

Chapter 9 Network Address Translation (NAT) 123

The example situation looks like this:

Figure 51 NAT example 3

Business Secure Router

1 In this case you must configure Address Mapping Set 1 from Menu 15.1 -

Address Mapping Sets. Therefore, you must choose the Full Feature option from the Network Address Translation field (in menu 4 or menu

11.3) (see Figure 52 ).

2 Enter 15 from the main menu.

3 Enter 1 to configure the Address Mapping Sets.

4 Enter 1 to begin configuring this new set. Enter a Set Name, choose the Edit

Action and then enter 1 for the Select Rule field. Press [ENTER] to confirm.

5 Select Type as One-to-One (direct mapping for packets going both ways) , and enter the local Start IP as 192.168.1.10 (the IP address of FTP Server 1), the global Start IP as 10.132.50.1 (our first IGA). (see Figure 53 ).

6 Repeat the previous step for rules 2 to 4 as outlined above.

7 When finished, menu 15.1.1 looks like as shown in Figure 54 .

Nortel Business Secure Router 252 Configuration — Advanced

124 Chapter 9 Network Address Translation (NAT)

Figure 52 Example 3: Menu 11.3

Menu 11.3 - Remote Node Network Layer Options

IP Options: Bridge Options:

IP Address Assignment = Dynamic Ethernet Addr Timeout(min)= N/A

Rem IP Addr = 0.0.0.0

Rem Subnet Mask= 0.0.0.0

My WAN Addr= 0.0.0.0

NAT= Full Feature

Address Mapping Set= 1

Metric= 15

Private= No

RIP Direction= None

Version= RIP-1

Multicast= None

Enter here to CONFIRM or ESC to CANCEL:

Press Space Bar to Toggle.

Figure 53 shows how to configure the first rule.

NN47923-501

Chapter 9 Network Address Translation (NAT) 125

Figure 53 Example 3: Menu 15.1.1.1

Menu 15.1.1.1 Address Mapping Rule

Type= One-to-One

Local IP:

Start= 192.168.1.10

End = N/A

Global IP:

Start= 10.132.50.1

End = N/A

Press ENTER to Confirm or ESC to Cancel:

Nortel Business Secure Router 252 Configuration — Advanced

126 Chapter 9 Network Address Translation (NAT)

Figure 54 Example 3: Final Menu 15.1.1

Menu 15.1.1 - Address Mapping Rules

Set Name= Example3

10.

Idx Local Start IP Local End IP Global Start IP Global End IP Type

--- --------------- --------------- --------------- --------------- ------

1. 192.168.1.10 10.132.50.1 1-1

2 192.168.1.11 10.132.50.2 1-1

3. 0.0.0.0 255.255.255.255 10.132.50.3 M-1

4. 10.132.50.3 Server

Action= Edit Select Rule=

Now configure the IGA3 to map to our web server and mail server on the LAN.

8 Enter 15 from the main menu.

9 Now enter 2 from this menu and configure it as shown in Example 3: Menu

15.2.

NN47923-501

Chapter 9 Network Address Translation (NAT) 127

Figure 55 Example 3: Menu 15.2

Menu 15.2 - NAT Server Setup

Default Server: 0.0.0.0

Rule Act. Start Port End Port IP Address

------------------------------------------------------

001 Yes 80 80 192.168.1.21

002 Yes 25 25 192.168.1.20

003 No 0 0 0.0.0.0

004 No 0 0 0.0.0.0

005 No 0 0 0.0.0.0

006 No 0 0 0.0.0.0

007 No 0 0 0.0.0.0

008 No 0 0 0.0.0.0

009 No 0 0 0.0.0.0

010 No 0 0 0.0.0.0

Select Command= None Select Rule= N/A

Press ENTER to Confirm or ESC to Cancel:

Configuring Trigger Port forwarding

Note: Only one LAN computer can use a trigger port (range) at a time.

Enter 3 in menu 15 to display Menu 15.3 — Trigger Port Setup , shown in

Figure 56 .

Nortel Business Secure Router 252 Configuration — Advanced

128 Chapter 9 Network Address Translation (NAT)

Figure 56 Menu 15.3 – Trigger Port Setup

Menu 15.3 - Trigger Port Setup

10.

11.

12.

Incoming Trigger

Rule Name Start Port End Port Start Port End Port

----------------------------------------------------------------------

Real Audio

6970

7170

7070

Press ENTER to Confirm or ESC to Cancel:

Table 28 describes the fields in Figure 56 .

Table 28 Menu 15.3: Trigger Port setup description

Field Description Example

Rule

Name

This is the rule index number.

Enter a unique name for identification purposes. You can enter up to 15 characters in this field. All characters are permitted - including spaces.

Real

Audio

Incoming Incoming is a port (or a range of ports) that a server on the WAN uses when it sends out a particular service. The Business Secure Router forwards the traffic with this port (or range of ports) to the client computer on the LAN that requested the service.

Start Port Enter a port number or the starting port number in a range of port numbers.

End Port Enter a port number or the ending port number in a range of port numbers.

6970

7170

NN47923-501

Chapter 9 Network Address Translation (NAT) 129

Table 28 Menu 15.3: Trigger Port setup description

Field Description Example

Trigger The trigger port is a port (or a range of ports) that causes (or triggers) the Business Secure Router to record the IP address of the LAN computer that sent the traffic to a server on the WAN.

Start Port Enter a port number or the starting port number in a range of port numbers.

End Port Enter a port number or the ending port number in a range of port numbers.

7070

Press [ENTER] at the message “Press ENTER to Confirm...” to save your configuration, or press [ESC] at any time to cancel.

Nortel Business Secure Router 252 Configuration — Advanced

130 Chapter 9 Network Address Translation (NAT)

NN47923-501

Chapter 10 Introducing the firewall

This chapter shows you how to get started with the firewall.

Using SMT menus

From the main menu enter 21 to go to Menu 21 - Filter Set and Firewall

Configuration to display the screen shown in Figure 57 .

Figure 57 Menu 21– Filter and Firewall Setup

Menu 21 - Filter and Firewall Setup

1. Filter Setup

2. Firewall Setup

131

Enter Menu Selection Number:

Activating the firewall

Enter option 2 in this menu to bring up the screen shown in Figure 58 . Press

[SPACE BAR] and then [ENTER] to select Yes in the Active field to activate the firewall. The firewall must be active to protect against Denial of Service (DoS) attacks. Use the WebGUI to configure firewall rules.

Nortel Business Secure Router 252 Configuration — Advanced

132 Chapter 10 Introducing the firewall

Figure 58 Menu 21.2 – Firewall Setup

Menu 21.2 - Firewall Setup

The firewall protects against Denial of Service (DoS) attacks when

it is active.

Your network is vulnerable to attacks when the firewall is turned off.

Refer to the User’s Guide for details about the firewall default

policies.

You may define additional policy rules or modify existing ones but

please exercise extreme caution in doing so.

Active: Yes

You can use the WebGUI to configure the firewall.

Press ENTER to Confirm or ESC to Cancel:

Note: Configure the firewall rules using the WebGUI or CLI commands.

NN47923-501

133

Chapter 11 Filter configuration

This chapter shows you how to create and apply filters.

Introduction to filters

Your Business Secure Router uses filters to decide whether to allow passage of a data packet, make a call, or both. There are two types of filter applications: data filtering and call filtering. Filters are subdivided into device and protocol filters.

Data filtering screens the data to determine if the packet is allowed to pass. Data filters are divided into incoming and outgoing filters, depending on the direction of the packet relative to a port. Data filtering can be applied on either the WAN side or the LAN side. Call filtering is used to determine if a packet is allowed to trigger a call. Remote node call filtering is only applicable when using PPPoE encapsulation.

Outgoing packets must undergo data filtering before they encounter call filtering as shown in Figure 59 .

Nortel Business Secure Router 252 Configuration — Advanced

134 Chapter 11 Filter configuration

Figure 59 Outgoing packet filtering process

Packet

Data

Filtering

Built-in default ser-defined

Call Filters

(if applicable)

Active Data

Initiate call if line not up

Send packet and reset rop packet

Drop packet if line not up rop packet if line not up

Send packet but do not reset

For incoming packets, your Business Secure Router applies data filters only.

Packets are processed depending upon whether a match is found. The following sections describe how to configure filter sets.

Filter Structure

A filter set consists of one or more filter rules. Usually, you group related rules, for example, all the rules for NetBIOS, into a single set and give it a descriptive name. With the Business Secure Router, you can configure up to twelve filter sets with six rules in each set, for a total of 72 filter rules in the system. You cannot mix device filter rules and protocol filter rules within the same set. You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24 rules active for a single port.

Sets of factory default filter rules are configured in menu 21 to prevent NetBIOS traffic from triggering calls and to prevent incoming Telnet sessions. A summary of their filter rules is shown in the figures that follow.

Figure 60 illustrates the logic flow when executing a filter rule. Also see

Figure 64 for the logic flow when executing an IP filter.

NN47923-501

Chapter 11 Filter configuration 135

Figure 60 Filter rule process

Filter Set

Start

Packet into filter

Fetch First

Filter Set

Fetch First

Filter Rule

Fetch Next

Filter Set

Yes

Fetch Next

Filter Rule

Yes

Next filter

Rule

Available?

Next Filter Set

Available?

No No Active?

Yes

Execute

Filter Rule

Check

Next

Rule

Forward

Drop

Drop Packet Accept Packet

You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24 rules active for a single port.

Nortel Business Secure Router 252 Configuration — Advanced

136 Chapter 11 Filter configuration

Configuring a Filter Set

The Business Secure Router includes filtering for NetBIOS over TCP/IP packets by default. To configure another filter set, follow the procedure below.

1 Enter 21 in the main menu to open menu 21.

Figure 61 Menu 21 – Filter and Firewall Setup

Menu 21 - Filter and Firewall Setup

1. Filter Setup

2. Firewall Setup

Enter Menu Selection Number:

2 Enter 1 to bring up the menu 21.1.

NN47923-501

Chapter 11 Filter configuration 137

Figure 62 Menu 21.1– Filter Set Configuration

Menu 21.1 - Filter Set Configuration

Filter Filter

Set # Comments Set # Comments

------ ----------------- ------ -----------------

1 _______________ 7 _______________

2 _______________ 8 _______________

3 _______________ 9 _______________

4 _______________ 10 _______________

5 _______________ 11 _______________

6 _______________ 12 _______________

Enter Filter Set Number to Configure= 0

Edit Comments= N/A

Press ENTER to Confirm or ESC to Cancel:

3 Select the filter set you wish to configure (1-12) and press [ENTER] .

4 Enter a descriptive name or comment in the Edit Comments field and press

[ENTER] .

5 Press [ENTER] at the message “Press ENTER to confirm” to open Menu

21.1.1 - Filter Rules Summary .

The screen shown in Figure 63 shows the summary of the existing rules in the filter set. Table 29 and Table 30 contain a brief description of the abbreviations used in the previous menus.

Nortel Business Secure Router 252 Configuration — Advanced

138 Chapter 11 Filter configuration

Table 29 Abbreviations used in the Filter Rules Summary Menu

Field Description

The filter rule number: 1 to 6.

Active: “Y” means the rule is active. “N” means the rule is inactive.

Type The type of filter rule: “GEN” for Generic, “IP” for TCP/IP.

Filter Rules These parameters are displayed here.

M More:

“Y” means there are more rules to check which form a rule chain with the present rule. An action cannot be taken until the rule chain is complete.

“N” means there are no more rules to check. You can specify an action to be taken for example, forward the packet, drop the packet or check the next rule. For the latter, the next rule is independent of the rule just checked.

m n

Action Matched:

“F” means to forward the packet immediately and skip checking the remaining rules.

“D” means to drop the packet.

“N“ means to check the next rule.

Action Not Matched:

“F” means to forward the packet immediately and skip checking the remaining rules.

“D” means to drop the packet.

“N” means to check the next rule.

Table 30 Rule abbreviations used

Abbreviation

Description

Pr Protocol

SA Source Address

SP Source Port number

DA Destination Address

DP Destination Port number

GEN

Off Offset

Len Length

The next section provides information on configuring the filter rules.

NN47923-501

Chapter 11 Filter configuration 139

Configuring a Filter Rule

To configure a filter rule, type its number in Menu 21.1.1 - Filter Rules

Summary and press [ENTER] to open menu 21.1.1.1 for the rule.

To speed up filtering, all rules in a filter set must be of the same class, for example, protocol filters or generic filters. The class of a filter set is determined by the first rule that you create. When applying the filter sets to a port, separate menu fields are provided for protocol and device filter sets. If you include a protocol filter set in a device filter field or vice versa, the Business Secure Router warns you and prevents you from saving.

Configuring a TCP/IP Filter Rule

This section shows you how to configure a TCP/IP filter rule. Using TCP/IP rules, you can base the rule on the fields in the IP and the upper layer protocol, for example, UDP and TCP headers.

To configure TCP/IP rules, select TCP/IP Filter Rule from the Filter Type field and press [ENTER] to open Menu 21.1.1.1 - TCP/IP Filter Rule , as shown in

Figure 63 .

Nortel Business Secure Router 252 Configuration — Advanced

140 Chapter 11 Filter configuration

Figure 63 Menu 21.1.1.1 – TCP/IP Filter Rule

Menu 21.1.1.1 - TCP/IP Filter Rule

Filter #: 1,1

Filter Type= TCP/IP Filter Rule

Active= Yes

IP Protocol= 0 IP Source Route= No

Destination: IP Addr=

IP Mask=

Port #=

Port # Comp= None

Source: IP Addr=

IP Mask=

Port #=

Port # Comp= None

TCP Estab= N/A

More= No Log= None

Action Matched= Check Next Rule

Action Not Matched= Check Next Rule

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

Table 31 describes how to configure your TCP/IP filter rule.

Table 31 TCP/IP Filter Rule Menu fields

Field

Active

IP Protocol

IP Source Route

Description Options

Press [SPACE BAR] and then [ENTER] to select

Yes to activate the filter rule or No to deactivate it.

Yes

Protocol refers to the upper layer protocol, for example, TCP is 6, UDP is 17 and ICMP is 1. Type a value between 0 and 255. A value of 0 matches ANY protocol.

0-255

Press [SPACE BAR] and then [ENTER] to select

Yes to apply the rule to packets with an IP source route option. Otherwise the packets must not have a source route option. The majority of IP packets do not have source route.

Yes

Destination

IP Address Enter the destination IP Address of the packet you wish to filter. This field is ignored if it is 0.0.0.0.

0.0.0.0

NN47923-501

Chapter 11 Filter configuration 141

Table 31 TCP/IP Filter Rule Menu fields

Field

IP Mask

Port #

Port # Comp

Description Options

Enter the IP mask to apply to the Destination: IP

Addr .

Enter the destination port of the packets that you wish to filter. The range of this field is 0 to 65 535.

This field is ignored if it is 0.

0.0.0.0

0-65535

Press [SPACE BAR] and then [ENTER] to select the comparison to apply to the destination port in the packet against the value given in Destination: Port

# .

None

Less

Greater

Equal

Not Equal

Source

IP Address

IP Mask

Port #

Port # Comp

TCP Estab

Log

Enter the source IP Address of the packet you wish to filter. This field is ignored if it is 0.0.0.0.

0.0.0.0

Enter the IP mask to apply to the Source: IP Addr .

0.0.0.0

Enter the source port of the packets that you wish to filter. The range of this field is 0 to 65 535. This field is ignored if it is 0.

0-65535

Press [SPACE BAR] and then [ENTER] to select the comparison to apply to the source port in the packet against the value given in Source: Port # .

This field is applicable only when the IP Protocol field is 6, TCP. Press [SPACE BAR] and then [ENTER] to select Yes to have the rule match packets that want to establish a TCP connection (SYN=1 and ACK=0); if No , it is ignored.

None

Less

Greater

Equal

Not Equal

Yes

Press [SPACE BAR] and then [ENTER] to select

Yes or No . If Yes , a matching packet is passed to the next filter rule before an action is taken; if No , the packet is disposed of according to the action fields.

If More is Yes , then Action Matched and Action

Not Matched will be N/A .

Yes

Press [SPACE BAR] and then [ENTER] to select a logging option from the following:

None – No packets are logged.

Action Matched - Only packets that match the rule parameters are logged.

Action Not Matched - Only packets that do not match the rule parameters are logged.

Both – All packets are logged.

None

Action

Matched

Action Not

Matched

Both

Nortel Business Secure Router 252 Configuration — Advanced

142 Chapter 11 Filter configuration

Table 31 TCP/IP Filter Rule Menu fields

Field Description Options

Action Matched Press [SPACE BAR] and then [ENTER] to select the action for a matching packet.

Check Next

Rule

Forward

Drop

Action Not Matched Press [SPACE BAR] and then [ENTER] to select the action for a packet not matching the rule.

Check Next

Rule

Forward

Drop

After you configure Menu 21.1.1.1 - TCP/IP Filter Rule , press [ENTER] at the message “Press ENTER to Confirm” to save your configuration, or press [ESC] to cancel. This data is displayed on Menu 21.1.1 - Filter Rules Summary .

Figure 64 illustrates the logic flow of an IP filter.

NN47923-501

Chapter 11 Filter configuration 143

Figure 64 Executing an IP filter

Packet into IP Filter

Filter Active?

Yes

Apply SrcAddrMask to Src Addr

Check Src

IP Addr

Matched

Apply DestAddrMask to Dest Addr

Not Matched

Check Dest

IP Addr

Matched

Check

IP Protocol

Matched

Check Src &

Dest Port

Matched

Not Matched

More?

Action Matched

Yes

Check Next Rule

Action Not Matched

Drop Forward

Drop

Drop Packet

Forward

Check Next Rule Accept Packet

Nortel Business Secure Router 252 Configuration — Advanced

144 Chapter 11 Filter configuration

Configuring a Generic Filter Rule

This section shows you how to configure a generic filter rule. With generic rules you can filter non-IP packets. For IP packets, it is generally easier to use the IP rules directly.

For generic rules, the Business Secure Router treats a packet as a byte stream as opposed to an IP or IPX packet. You specify the portion of the packet to check with the Offset (from 0) and the Length fields, both in bytes. The Business

Secure Router applies the Mask (using the bit-wise-AND action) to the data portion before comparing the result against the Value to determine a match. The

Mask and Value are specified in hexadecimal numbers. Note that it takes two hexadecimal digits to represent a byte, so if the length is 4, the value in either field will take 8 digits, for example, FFFFFFFF .

To configure a generic rule, select Generic Filter Rule in the Filter Type field in menu 21.1.1.1 and press [ENTER] to open Generic Filter Rule , as shown in

Figure 65 .

NN47923-501

Chapter 11 Filter configuration 145

Figure 65 Menu 21.1.1.1 – Generic Filter Rule

Menu 21.1.1.1 - Generic Filter Rule

Filter #: 2,3

Filter Type= Generic Filter Rule

Active= No

Offset= 0

Length= 0

Mask= N/A

Value= N/A

More= No Log= None

Action Matched= Check Next Rule

Action Not Matched= Check Next Rule

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

Table 32 describes the fields in the Generic Filter Rule menu.

Table 32 Generic Filter Rule Menu fields

Field

Filter #

Filter

Type

Active

Offset

Length

Mask

Description Options

This is the filter set, filter rule coordinates, for example, 2,3 refers to the second filter set and the third rule of that set.

Use [SPACE BAR] and then [ENTER] to select a rule type.

Parameters displayed below each type will be different.

TCP/

IP filter rules are used to filter IP packets while generic filter rules allow filtering of non-IP packets.

Select Yes to turn on the filter rule or No to turn it off.

Generic Filter

Rule

TCP/IP Filter

Rule

Yes / No

Enter the starting byte of the data portion in the packet that you wish to compare. The range for this field is from 0 to

255.

0-255

Enter the byte count of the data portion in the packet that you wish to compare. The range for this field is 0 to 8.

0-8

Enter the mask (in Hexadecimal notation) to apply to the data portion before comparison.

Nortel Business Secure Router 252 Configuration — Advanced

146 Chapter 11 Filter configuration

Table 32 Generic Filter Rule Menu fields

Field

Value

Log

Action

Matched

Action

Not

Matched

Description Options

Enter the value (in Hexadecimal notation) to compare with the data portion.

If Yes , a matching packet is passed to the next filter rule before an action is taken; or the packet is disposed of according to the action fields.

If More is Yes , then Action Matched and Action Not Matched are No .

Yes

Select the logging option from the following:

None - No packets are logged.

Action Matched - Only packets that match the rule parameters are logged.

Action Not Matched - Only packets that do not match the rule parameters are logged.

Both – All packets are logged.

Select the action for a packet matching the rule.

None

Action

Matched

Action Not

Matched

Both

Select the action for a packet not matching the rule.

Check Next

Rule

Forward

Drop

Check Next

Rule

Forward

Drop

After you complete filling in Menu 21.1.1.1 - Generic Filter

Rule , press [ENTER] at the message “Press ENTER to

Confirm” to save your configuration, or press [ESC] to cancel. This data is now be displayed on Menu 21.1.1 -

Filter Rules Summary .

Example Filter

The example shown in Figure 66 is set to block outside users from accessing the

Business Secure Router via Telnet. See the included disk for more Filter Rules example.

NN47923-501

Figure 66 Telnet filter Example

Chapter 11 Filter configuration 147

Business Secure Router

1 Enter 21 from the main menu to open Menu 21 - Filter and Firewall Setup .

2 Enter 1 to open Menu 21.1 - Filter Set Configuration .

3 Enter the index of the filter set you wish to configure (for example 3) and press [ENTER] .

4 Enter a descriptive name or comment in the Edit Comments field and press

[ENTER].

5 Press [ENTER] at the message [Press ENTER to confirm] to open Menu

21.1.3 - Filter Rules Summary .

6 Enter 1 to configure the first filter rule (the only filter rule of this set). Make the entries in this menu as shown in Figure 67 .

Nortel Business Secure Router 252 Configuration — Advanced

148 Chapter 11 Filter configuration

Figure 67 Example Filter: Menu 21.1.3.1

Menu 21.1.3.1 - TCP/IP Filter Rule

Filter #: 3,1

Filter Type= TCP/IP Filter Rule

Active= Yes

IP Protocol= 6 IP Source Route= No

Destination: IP Addr= 0.0.0.0

IP Mask= 0.0.0.0

Port #= 23

Port # Comp= Equal

Source: IP Addr= 0.0.0.0

IP Mask= 0.0.0.0

Port #= 0

Port # Comp= None

TCP Estab= No

More= No Log= None

Action Matched= Drop

Action Not Matched= Forward

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

When you press [ENTER] to confirm, the screen shown in Figure 68 is displayed.

Note that there is only one filter rule in this set. The screen shows you that you have configured and activated ( A = Y ) a TCP/IP filter rule ( Type = IP , Pr = 6 ) for destination Telnet ports ( DP = 23 ).

M = N means an action can be taken immediately. The action is to drop the packet ( m = D ) if the action is matched and to forward the packet immediately ( n = F ) if the action is not matched, whether or not there are more rules to be checked (there are none in this example).

NN47923-501

Chapter 11 Filter configuration 149

Figure 68 Example Filter Rules Summary: Menu 21.1.3

Menu 21.1.3 - Filter Rules Summary

# A Type Filter Rules M m n

- - ---- --------------------------------------------------------------- - - -

1 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=23 N D F

2 N

3 N

4 N

5 N

6 N

Enter Filter Rule Number (1-6) to Configure: 1

After you have created the filter set, you must apply it.

1 Enter 11 from the main menu to go to menu 11.

2 Then enter 1 to open Menu 11.1 Remote Node Profile .

3 Go to the Edit Filter Sets field, press [SPACE BAR] to select Yes and press

[ENTER] .

4 This brings you to menu 11.1.4. Apply a filter set (our example is filter set 3) as shown in Figure 71 .

5 After you enter the set numbers, press [ENTER ] to confirm and leave menu

11.1.4.

Filter Types and NAT

There are two classes of filter rules, Generic Filter (Device) rules and protocol filter ( TCP/IP ) rules. Generic filter rules act on the raw data that’s going through between LAN and WAN. Protocol filter rules act on the IP packets. Generic and

TCP/IP filter rules are discussed in more detail in the next section. When NAT

(Network Address Translation) is enabled, the inside IP address and port number

Nortel Business Secure Router 252 Configuration — Advanced

150 Chapter 11 Filter configuration are replaced on a connection-by-connection basis, which makes it impossible to know the exact address and port on the wire. Therefore, the Business Secure

Router applies the protocol filters to the native IP address and port number before

NAT for outgoing packets and after NAT for incoming packets. On the other hand, the generic, or device filters are applied to the raw packets that appear on the wire. They are applied at the point when the Business Secure Router is receiving and sending the packets; for example. the interface. The interface can be an Ethernet port or any other hardware port, as illustrated in Figure 69 .

Figure 69 Protocol and Device Filter Sets

Firewall Versus Filters

Firewall configuration is discussed in Chapter 10, “Introducing the firewall,” on page 131 chapters of this manual. Further comparisons are also made between filtering, NAT and the firewall.

Applying a Filter

This section shows you where to apply the filters after you design them. The

Business Secure Router already has filters to prevent NetBIOS traffic from triggering calls, and block incoming Telnet, FTP and HTTP connections.

Note: Nortel recommends that you apply filters if you do not activate the firewall.

NN47923-501

Chapter 11 Filter configuration 151

Applying LAN Filters

LAN traffic filter sets are useful to block certain packets, reduce traffic and prevent security breaches. Go to menu 3.1 (shown next) and enter the numbers of the filter sets that you want to apply, as appropriate. You can choose up to four filter sets (from twelve) by entering their numbers separated by commas, for example., 3, 4, 6, 11. Input filter sets filter incoming traffic to the Business Secure

Router and output filter sets filter outgoing traffic from the Business Secure

Router.

Figure 70 Filtering LAN Traffic

Menu 3.1 – LAN Port Filter Setup

Input Filter Sets:

protocol filters=

device filters=

Output Filter Sets:

protocol filters=

device filters=

Press ENTER to Confirm or ESC to Cancel:

Applying Remote Node Filters

Go to menu 11.1.4 (shown in Figure 71 – note that call filter sets are only present for PPPoE encapsulation) and enter the numbers of the filter sets, as appropriate.

You can cascade up to four filter sets by entering their numbers separated by commas. The Business Secure Router already has filters to prevent NetBIOS traffic from triggering calls, and to block incoming Telnet, FTP and HTTP connections. For PPPoE or PPPoA encapsulation, you have the additional option of specifying remote node call filter sets.

Nortel Business Secure Router 252 Configuration — Advanced

152 Chapter 11 Filter configuration

Figure 71 Filtering Remote Node Traffic

Menu 11.1.4 - Remote Node Filter

Input Filter Sets:

protocol filters=

device filters=

Output Filter Sets:

protocol filters=

device filters=

Call Filter Sets:

protocol filters=

device filters=

Enter here to CONFIRM or ESC to CANCEL:

NN47923-501

153

Chapter 12 SNMP Configuration

This chapter explains SNMP configuration menu 22.

Note: SNMP is only available if TCP/IP is configured.

SNMP Configuration

To configure SNMP, enter 22 from the main menu to display Menu 22 - SNMP

Configuration as shown next. The community for Get , Set and Trap fields is

SNMP terminology for password.

Nortel Business Secure Router 252 Configuration — Advanced

154 Chapter 12 SNMP Configuration

Figure 72 Menu 22 – SNMP Configuration

Menu 22 - SNMP Configuration

SNMP:

Get Community= PlsChgMe!RO

Set Community= PlsChgMe!RW

Trusted Host= 0.0.0.0

Trap:

Community=

Destination= 0.0.0.0

Press ENTER to Confirm or ESC to Cancel:

Table 33 describes the SNMP configuration parameters.

Table 33 SNMP Configuration Menu Fields

Field Description Example

Get Community Type the Get community, which is the password for the incoming Get- and GetNext requests from the management station.

Set Community Type the Set community, which is the password for incoming Set requests from the management station.

Trusted Host If you enter a trusted host, your Business Secure

Router will only respond to SNMP messages from this address. A blank (default) field means your

Business Secure Router will respond to all SNMP messages it receives, regardless of source.

Trap

Community

Destination

Type the Trap community, which is the password sent with each trap to the SNMP manager.

Type the IP address of the station to send your

SNMP traps to.

After you complete this menu, press [ENTER] at the prompt “Press [ENTER] to confirm or [ESC] to cancel” to save your configuration or press [ESC] to cancel and go back to the previous screen.

PlsChgMe!R

(default)

PlsChgMe!R

(default)

0.0.0.0

Public

0.0.0.0

NN47923-501

Chapter 12 SNMP Configuration 155

SNMP Traps

The Business Secure Router will sends traps to the SNMP manager when any one of the following events occurs:

Table 34 SNMP Traps

Trap #

Trap Name Description coldStart (defined in

RFC-1215 ) warmStart (defined in

RFC-1215 )

A trap is sent after booting (power on).

A trap is sent after booting (software reboot).

authenticationFailure (defined in RFC-1215 )

A trap is sent to the manager when receiving any SNMP get or set requirements with the wrong community (password).

whyReboot (defined in MIB) A trap is sent with the reason of restart before rebooting when the system is going to restart (warm start).

For intentional reboot: A trap is sent with the message "System reboot by user!" if reboot is done intentionally, (for example, download new files, CI command sys reboot, and others).

For fatal error: A trap is sent with the message of the fatal code if the system reboots because of fatal errors.

Nortel Business Secure Router 252 Configuration — Advanced

156 Chapter 12 SNMP Configuration

NN47923-501

Chapter 13 System security

This chapter describes how to configure the system security on the Business

Secure Router.

157

System security

You can configure the system password, an external RADIUS server and 802.1x in this menu.

System password

Figure 73 Menu 23 – System security

Menu 23 - System Security

1. Change Password

2. RADIUS Server

4. IEEE802.1x

Enter Menu Selection Number:

Nortel recommends you change the default password. If you forget your password, you have to restore the default configuration file. For more information, see “Restoring the factory-default configuration settings” in Nortel

Business Secure Router 252 Configuration — Basics (NN47923-500).

Nortel Business Secure Router 252 Configuration — Advanced

158 Chapter 13 System security

Configuring external RADIUS server

Enter 23 in the main menu to display Menu 23 – System security .

Figure 74 Menu 23 – System Security

Menu 23 - System Security

1. Change Password

2. RADIUS Server

4. IEEE802.1x

Enter Menu Selection Number:

From Menu 23- System Security , enter 2 to display Menu 23.2 – System

Security – RADIUS Server, as shown in Figure 75 .

Figure 75 Menu 23.2 – System Security – RADIUS server

Menu 23.2 - System Security - RADIUS Server

Authentication Server:

Active= No

Server Address= 0.0.0.0

Port #= 1812

Shared Secret= ********

Accounting Server:

Active= No

Server Address= 0.0.0.0

Port #= 1813

Shared Secret= ********

Press ENTER to Confirm or ESC to Cancel:

NN47923-501

Chapter 13 System security 159

Table 35 describes the fields in Figure 75 .

Table 35 Menu 23.2 System Security: RADIUS Server

Field Description

Authentication

Server

Active

Server Address

Port #

Shared Secret

Press [SPACE BAR] to select Yes and press [ENTER] to enable user authentication through an external authentication server.

Enter the IP address of the external authentication server in dotted decimal notation.

The default port of the RADIUS server for authentication is 1812 .

You need not change this value unless your network administrator instructs you to do so with additional information.

Specify a password (up to 31 alphanumeric characters) as the key to be shared between the external authentication server and the

Business Secure Router.

The key is not sent over the network. This key must be the same on the external authentication server and Business Secure Router.

Accounting Server

Active

Server Address

Port #

Press [SPACE BAR] to select Yes and press [ENTER] to enable user authentication through an external accounting server.

Enter the IP address of the external accounting server in dotted decimal notation.

The default port of the RADIUS server for accounting is 1813 .

You need not change this value unless your network administrator instructs you to do so with additional information.

Shared Secret Specify a password (up to 31 alphanumeric characters) as the key to be shared between the external accounting server and the

Business Secure Router.

The key is not sent over the network. This key must be the same on the external accounting server and Business Secure Router.

After you complete this menu, press [ENTER] at the prompt “Press ENTER to confirm or

ESC to cancel” to save your configuration or press [ESC] to cancel and go back to the previous screen.

Nortel Business Secure Router 252 Configuration — Advanced

160 Chapter 13 System security

IEEE 802.1x

The IEEE 802.1x standards outline enhanced security methods for both the authentication of users and encryption key management.

Follow the steps below to enable EAP authentication on your Business Secure

Router.

1 From the main menu, enter 23 to display Menu23 – System Security .

Figure 76 Menu 23 – System Security

Menu 23 - System Security

1. Change Password

2. RADIUS Server

4. IEEE802.1x

Enter Menu Selection Number:

2 Enter 4 to display Menu 23.4 – System Security – IEEE802.1x

Figure 77 Menu 23.4 – System Security – IEEE802.1x

Menu 23.4 - System Security - IEEE802.1x

Port Control= Authentication Required

ReAuthentication Timer (in second)= 1800

Idle Timeout (in second)= 3600

Authentication Databases= Local User Database Only

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

NN47923-501

Chapter 13 System security 161

Table 36 describes the fields in Figure 77 .

Table 36 Menu 23.4 System Security: IEEE802.1x

Field

Port Control

ReAuthentication

Timer (in second)

Idle Timeout (in second)

Description

Press [SPACE BAR] and select a security mode.

Select No Authentication Required to allow any computer access to your network without entering usernames and passwords. This is the default setting.

Selecting Authentication Required means computers have to enter usernames and passwords before access to the network is allowed.

Select No Access Allowed to block all computers from accessing the network.

The following fields are not available when you select No

Authentication Required or No Access Allowed .

Specify how often a client has to reenter the username and password to stay connected to the network.

This field is activated only when you select Authentication

Required in the Port Control field. Enter a time interval between 10 and 9 999 (in seconds). The default time interval is 1 800 seconds (or

30 minutes).

The Business Secure Router automatically disconnects a client from the network after a period of inactivity. The client needs to enter the username and password again before access to the network is allowed.

This field is activated only when you select Authentication

Required in the Port Control field. The default time interval is 3 600 seconds (or 1 hour).

Nortel Business Secure Router 252 Configuration — Advanced

162 Chapter 13 System security

Table 36 Menu 23.4 System Security: IEEE802.1x

Field Description

Authentication

Databases

The authentication database contains user login information. The local user database is the built-in database on the Business Secure

Router. The RADIUS is an external server. Use this field to decide which database the Business Secure Router should use (first) to authenticate a user.

Before you specify the priority, make sure you have set up the corresponding database correctly first.

Select Local User Database Only to have the Business Secure

Router just check the built-in user database on the Business Secure

Router for a user's username and password.

Select RADIUS Only to have the Business Secure Router just check the user database on the specified RADIUS server for a user's username and password.

Select Local first, then RADIUS to have the Business Secure

Router first check the user database on the Business Secure Router for a user's username and password. If the user name is not found, the Business Secure Router then checks the user database on the specified RADIUS server.

Select RADIUS first, then Local to have the Business Secure

Router first check the user database on the specified RADIUS server for a user's username and password. If the Business Secure Router cannot reach the RADIUS server, the Business Secure Router then checks the local user database on the Business Secure Router. If the username is not found or the password does not match in the

RADIUS server, the Business Secure Router does not check the local user database and the authentication fails.

After you complete this menu, press [ENTER] at the prompt “Press ENTER to confirm or

ESC to cancel” to save your configuration or press [ESC] to cancel and go back to the previous screen.

After you enable user authentication, you need to specify an external RADIUS server or create local user accounts on the Business Secure Router for authentication.

NN47923-501

163

Chapter 14 System information and diagnosis

This chapter covers SMT menus 24.1 to 24.4.

Introduction to System Status

This chapter covers the diagnostic tools that help you to maintain your Business

Secure Router. These tools include updates on system status, port status and log and trace capabilities.

Select menu 24 in the main menu to open Menu 24 - System Maintenance , as shown in Figure 78 .

Nortel Business Secure Router 252 Configuration — Advanced

164 Chapter 14 System information and diagnosis

Figure 78 Menu 24 – System Maintenance

Menu 24 - System Maintenance

1. System Status

2. System Information and Console Port Speed

3. Log and Trace

4. Diagnostic

5. Backup Configuration

6. Restore Configuration

7. Upload Firmware

8. Command Interpreter Mode

9. Call Control

10. Time and Date Setting

11. Remote Management Setup

Enter Menu Selection Number:

System Status

The first selection, System Status, gives you information on the version of your system firmware and the status and statistics of the ports, as shown in the next figure. System Status is a tool that can be used to monitor your Business Secure

Router. Specifically, it gives you information on your system firmware version, number of packets sent, and number of packets received.

To get to the System Status:

1 Enter number 24 to go to Menu 24 - System Maintenance .

2 In this menu, enter 1 to open System Maintenance - Status.

NN47923-501

Chapter 14 System information and diagnosis 165

3 There are three commands in Menu 24.1 - System Maintenance - Status .

Entering 1 drops the WAN connection, 9 resets the counters and [ESC] takes you back to the previous screen.

Figure 79 Menu 24.1 – System Maintenance – Status

Menu 24.1 - System Maintenance - Status 11:48:18

Tue. Jun. 06, 2006

Node-Lnk Status TxPkts RxPkts Errors Tx B/s Rx B/s Up Time

1-ENET N/A 0 0 0 0 0 0:00:00

My WAN IP (from ISP): 0.0.0.0

Ethernet: WAN:

Status: 100M/Full Duplex Tx Pkts: 608 Line Status: Initializing

Collisions: 0 Rx Pkts: 821 Upstream Speed: 0 kbps

CPU Load = 1.19% Downstream Speed: 0 kbps

Press Command:

COMMANDS: 1-Reset Counters ESC-Exit

Table 37 describes the fields present in Menu 24.1 - System Maintenance -

Status . These fields are read-only and meant for diagnostic purposes. The upper right corner of the screen shows the time and date according to the format you set in menu 24.10.

Table 37 Menu 24.1 System Maintenance: Status

Field

Node-Lnk

Status

TxPkts

RxPkts

Errors

Tx B/s

Rx B/s

Description

This is the node index number and link type. Link types are: PPP, ENET,

1483.

This shows the status of the remote node.

The number of transmitted packets to this remote node.

The number of received packets from this remote node.

The number of error packets on this connection.

This shows the transmission rate in bytes per second.

This shows the receiving rate in bytes per second.

Nortel Business Secure Router 252 Configuration — Advanced

166 Chapter 14 System information and diagnosis

Table 37 Menu 24.1 System Maintenance: Status (continued)

Field Description

Up Time This is the time this channel has been connected to the current remote node.

This is the IP address of the ISP remote node.

My WAN IP

(from ISP)

Ethernet

Status

Tx Pkts

Rx Pkts

Collision

This shows statistics for the LAN.

This shows the current status of the LAN.

This is the number of transmitted packets to the LAN.

This is the number of received packets from the LAN.

This is the number of collisions.

WAN This shows statistics for the WAN.

Line Status This shows the current status of the xDSL line which can be Up or Down.

Upstream

Speed

This shows the upstream transfer rate in kbps.

This shows the downstream transfer rate in kbps.

Downstream

Speed

CPU Load This specifies the percentage of CPU utilization.

System information and console port speed

With your system you can choose different console port speeds. To get to the

System Information and Console Port Speed.

1 Enter 24 to go to Menu 24 – System Maintenance .

2 Enter 2 to open Menu 24.2 - System Information and Console Port Speed .

3 From this menu you have two choices, as shown in Figure 80 :

NN47923-501

Chapter 14 System information and diagnosis 167

Figure 80 System Information and Console Port Speed

Menu 24.2 - System Information and Console Port Speed

1. System Information

2. Console Port Speed

Please enter selection:

System Information

System Information gives you information about your system, as shown in

Figure 81 . More specifically, it gives you information on your routing protocol,

Ethernet address and IP address.

Nortel Business Secure Router 252 Configuration — Advanced

168 Chapter 14 System information and diagnosis

Figure 81 Menu 24.2.1 – System Maintenance – Information

Menu 24.2.1 - System Maintenance - Information

Name:

Routing: IP

RAS F/W Version: VBSR252_2.6.0.0.001b3 | 06/29/2006

Country Code: 255

ADSL Chipset Vendor: STMI 2.6.4

Standard: Multi-Mode

LAN

Ethernet Address: 00:13:49:00:00:01

IP Address: 192.168.1.1

IP Mask: 255.255.255.0

DHCP: Server

Press ESC or RETURN to Exit:

NN47923-501

Table 38 Menu 24.2.1 System Maintenance: Information

Field Description

Name

Routing

Firmware Version

ADSL Chipset Vendor

Displays the system name of your Business Secure Router. This information can be changed in Menu 1 – General Setup .

Refers to the routing protocol used.

Refers to the system firmware version.

Standard

Displays the vendor of the ADSL chipset and DSL version.

This refers to the operational protocol the Business Secure

Router and the DSLAM (Digital Subscriber Line Access

Multiplexer) are using.

LAN

Ethernet Address

IP Address

Refers to the Ethernet MAC (Media Access Control) of your

Business Secure Router.

This is the IP address of the Business Secure Router in dotted decimal notation.

IP Mask This shows the subnet mask of the Business Secure Router.

Chapter 14 System information and diagnosis 169

Table 38 Menu 24.2.1 System Maintenance: Information (continued)

Field Description

DHCP This field shows the DHCP setting (None, Relay or Server) of the

Business Secure Router.

After you complete this menu, press [ENTER] at the prompt “Press ENTER to

Confirm…” to save your configuration, or press [ESC] at any time to cancel.

Console port speed

You can change the speed of the console port through Menu 24.2.2 – Console

Port Speed . Your Business Secure Router supports 9 600 (default), 19 200,

38 400, 57 600, and 115 200 b/s for the console port. Press [SPACE BAR] and then [ENTER] to select the desired speed in menu 24.2.2, as shown in Figure 82 .

Figure 82 Menu 24.2.2 – System Maintenance – Change Console Port Speed

Menu 24.2.2 – System Maintenance – Change Console Port Speed

Console Port Speed: 115200

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

Log and trace

The Business Secure Router has a syslog facility for message logging, and a trace function for viewing call-triggering packets.

Nortel Business Secure Router 252 Configuration — Advanced

170 Chapter 14 System information and diagnosis

Figure 83 Menu 24.3 – System Maintenance: Log and Trace

Menu 24.3 - System Maintenance - Log and Trace

2. Syslog Logging

4. Call-Triggering Packet

Press ENTER to Confirm or ESC to Cancel

Syslog logging

The Business Secure Router uses the syslog facility to log the CDR (Call Detail

Record) and system messages to a syslog server. Syslog and accounting can be configured in Menu 24.3.2 - System Maintenance - Syslog Logging , as shown in Figure 84 .

Figure 84 Menu 24.3.2 – System Maintenance: Syslog Logging

Menu 24.3.2 - System Maintenance - Syslog Logging

Syslog:

Active= No

Syslog Server IP Address= ?

Log Facility= Local 1

NN47923-501

Press ENTER to Confirm or ESC to Cancel

Configure the syslog parameters described in Table 39 to activate syslog, and then choose what you want to log.

Table 39 System Maintenance Menu Syslog Parameters

Description Parameter

Syslog:

Active Press [SPACE BAR] and then [ENTER] to turn syslog on or off.

Chapter 14 System information and diagnosis 171

Table 39 System Maintenance Menu Syslog Parameters

Parameter Description

Syslog Server IP

Address

Log Facility

Enter the IP Address of the server that logs the CDR (Call Detail

Record) and system messages. For example, the syslog server.

Press [SPACE BAR] and then [ENTER] to select a Local option.

Using the log facility, you can log the message to different files in the server. Refer to the documentation of your syslog program for more details.

After you finish configuring this screen, press [ENTER] to confirm or [ESC] to cancel.

Your Business Secure Router sends five types of syslog messages. Some examples of these syslog messages with their message formats are shown next:

CDR

CDR Message Format

SdcmdSyslogSend( SYSLOG_CDR, SYSLOG_INFO, String );

String = board xx line xx channel xx, call xx, str

board = the hardware board ID

line = the WAN ID in a board

Channel = channel ID within the WAN

call = the call reference number which starts from 1 and increments by 1 for each new call

str = C01 Outgoing Call dev xx ch xx (dev:device No. ch:channel No.)

L02 Tunnel Connected(L2TP)

C02 OutCall Connected xxxx (means connected speed) xxxxx (means Remote

Call Number)

L02 Call Terminated

C02 Call Terminated

Jul 19 11:19:27 192.168.102.2 RAS : board 0 line 0 channel 0, call 1, C01 Outgoing Call dev=2 ch=0

40002

Jul 19 11:19:32 192.168.102.2 RAS: board 0 line 0 channel 0, call 1, C02

OutCall Connected 64000 40002

Jul 19 11:20:06 192.168.102.2 RAS : board 0 line 0 channel 0, call 1, C02 Call Terminated

Nortel Business Secure Router 252 Configuration — Advanced

172 Chapter 14 System information and diagnosis

Packet triggered

Packet triggered Message Format

SdcmdSyslogSend( SYSLOG_PKTTRI, SYSLOG_NOTICE, String );

String = Packet trigger: Protocol=xx Data=xxxxxxxxxx…..x

Protocol: (1:IP 2:IPX 3:IPXHC 4:BPDU 5:ATALK 6:IPNG)

Data: We will send forty-eight Hex characters to the server

Jul 19 11:28:39 192.168.102.2 RAS: Packet Trigger: Protocol=1,

Data=4500003c100100001f010004c0a86614ca849a7b08004a5c0200010061626364656

66768696a6b6c6d6e6f7071727374

Jul 19 11:28:56 192.168.102.2 RAS: Packet Trigger: Protocol=1,

Data=4500002c1b0140001f06b50ec0a86614ca849a7b0427001700195b3e00000000600

220008cd40000020405b4

Jul 19 11:29:06 192.168.102.2 RAS: Packet Trigger: Protocol=1,

Data=45000028240140001f06ac12c0a86614ca849a7b0427001700195b451d143013500

4000077600000

Filter log

Filter log Message Format

SdcmdSyslogSend(SYSLOG_FILLOG, SYSLOG_NOTICE, String );

String = IP[Src=xx.xx.xx.xx Dst=xx.xx.xx.xx prot spo=xxxx dpo=xxxx]

S04>R01mD

IP[…] is the packet header and S04>R01mD means filter set 4 (S) and rule

1 (R), match (m) drop (D).

Src: Source Address

Dst: Destination Address

prot: Protocol (“TCP”,”UDP”,”ICMP”)

NN47923-501

Chapter 14 System information and diagnosis 173 spo: Source port dpo: Destination port

Mar 03 10:39:43 202.132.155.97 RAS:

GEN[fffffffffffnordff0080] }S05>R01mF

Mar 03 10:41:29 202.132.155.97 RAS:

GEN[00a0c5f502fnord010080] }S05>R01mF

Mar 03 10:41:34 202.132.155.97 RAS:

IP[Src=192.168.1.33 Dst=202.132.155.93 ICMP]}S04>R01mF

Mar 03 11:59:20 202.132.155.97 RAS:

GEN[00a0c5f502fnord010080] }S05>R01mF

Mar 03 12:00:52 202.132.155.97 RAS:

GEN[ffffffffffff0080] }S05>R01mF

Mar 03 12:00:57 202.132.155.97 RAS:

GEN[00a0c5f502010080] }S05>R01mF

Mar 03 12:01:06 202.132.155.97 RAS:

IP[Src=192.168.1.33 Dst=202.132.155.93 TCP spo=01170 dpo=00021]}S04>R01mF

PPP log

PPP Log Message Format

SdcmdSyslogSend( SYSLOG_PPPLOG, SYSLOG_NOTICE, String );

String = ppp:Proto Starting / ppp:Proto Opening / ppp:Proto Closing / ppp:Proto Shutdown

Proto = LCP / ATCP / BACP / BCP / CBCP / CCP / CHAP/ PAP / IPCP /

IPXCP

Jul 19 11:42:44 192.168.102.2 RAS: ppp:LCP Closing

Jul 19 11:42:49 192.168.102.2 RAS: ppp:IPCP Closing

Jul 19 11:42:54 192.168.102.2 RAS: ppp:CCP Closing

Nortel Business Secure Router 252 Configuration — Advanced

174 Chapter 14 System information and diagnosis

Firewall log

Firewall Log Message Format

SdcmdSyslogSend(SYSLOG_FIREWALL, SYSLOG_NOTICE, buf); buf = IP[Src=xx.xx.xx.xx : spo=xxxx Dst=xx.xx.xx.xx : dpo=xxxx | prot | rule | action]

Src: Source Address spo: Source port (empty means no source port information)

Dst: Destination Address dpo: Destination port (empty means no destination port information) prot: Protocol (“TCP”,”UDP”,”ICMP”, ”IGMP”, ”GRE”, ”ESP”) rule: <a,b> where a means "set" number; b means "rule" number.

Action: nothing(N) block (B) forward (F)

08-01-2000 11:48:41 Local1.Notice 192.168.10.10 RAS: FW 172.21.1.80 :137

->172.21.1.80 :137 |UDP|default permit:<2,0>|B

08-01-2000 11:48:41 Local1.Notice 192.168.10.10 RAS: FW 192.168.77.88

:520 ->192.168.77.88 :520 |UDP|default permit:<2,0>|B

08-01-2000 11:48:39 Local1.Notice 192.168.10.10 RAS: FW 172.21.1.50

->172.21.1.50 |IGMP<2>|default permit:<2,0>|B

08-01-2000 11:48:39 Local1.Notice 192.168.10.10 RAS: FW 172.21.1.25

->172.21.1.25 |IGMP<2>|default permit:<2,0>|B

Call-Triggering packet

Call-Triggering Packet displays information about the packet that triggered a dial-out call in an easily readable format. Equivalent information is available in menu 24.1 in hex format. An example is shown in Figure 85 .

Figure 85 Call-Triggering packet example

IP Frame: ENET0-RECV Size: 44/ 44 Time: 17:02:44.262

Frame Type:

IP Header:

IP Version = 4

Header Length = 20

Type of Service = 0x00 (0)

Total Length = 0x002C (44)

Identification = 0x0002 (2)

NN47923-501

Chapter 14 System information and diagnosis 175

Flags = 0x00

Fragment Offset = 0x00

Time to Live = 0xFE (254)

Protocol = 0x06 (TCP)

Header Checksum = 0xFB20 (64288)

Source IP = 0xC0A80101 (192.168.1.1)

Destination IP = 0x00000000 (0.0.0.0)

TCP Header:

Source Port = 0x0401 (1025)

Destination Port = 0x000D (13)

Sequence Number = 0x05B8D000 (95997952)

Ack Number = 0x00000000 (0)

Header Length = 24

Flags = 0x02 (....S.)

Window Size = 0x2000 (8192)

Checksum = 0xE06A (57450)

Urgent Ptr = 0x0000 (0)

Options =

0000: 02 04 02 00

RAW DATA:

0000: 45 00 00 2C 00 02 00 00-FE 06 FB 20 C0 A8 01 01 E......... ....

0010: 00 00 00 00 04 01 00 0D-05 B8 D0 00 00 00 00 00 ................

0020: 60 02 20 00 E0 6A 00 00-02 04 02 00

Press any key to continue...

With the diagnostic facility, you can test the different aspects of your Business

Secure Router to determine if it is working properly. In Menu 24.4, you can choose among various types of diagnostic tests to evaluate your system, as shown in Figure 86 .

Nortel Business Secure Router 252 Configuration — Advanced

176 Chapter 14 System information and diagnosis

Follow the procedure below to get to Menu 24.4 - System Maintenance –

Diagnostic.

1 From the main menu, select option 24 to open Menu 24 - System

Maintenance .

2 From this menu, select option 4. Diagnostic. This opens Menu 24.4 - System

Maintenance - Diagnostic .

Figure 86 Menu 24.4 – System Maintenance: Diagnostic

Menu 24.4 - System Maintenance - Diagnostic

TCP/IP

1. Ping Host

2. WAN DHCP Release

3. WAN DHCP Renewal

4. PPPoE/PPPoA Setup Test

System

11. Reboot System

Enter Menu Selection Number:

Host IP Address= N/A

WAN DHCP

DHCP functionality can be enabled on the LAN or WAN as shown in WAN &

LAN DHCP. LAN DHCP is discussed in Nortel Business Secure Router 252

Configuration — Basics (NN47923-500). The Business Secure Router can act either as a WAN DHCP client (IP Address Assignment field in menu 4 or menu

11.3 is Dynamic and the Encapsulation field in menu 4 or menu 11 is Ethernet) or

None, (when you have a static IP). Using the WAN Release and Renewal fields in menu 24.4, you can release or renew the assigned WAN IP address, subnet mask and default gateway, or do both. This is similar to using the file winipcfg.

NN47923-501

Chapter 14 System information and diagnosis 177

Figure 87 WAN & LAN DHCP

Business Secure Router

Table 40 describes the diagnostic tests available in menu 24.4

for your Business

Secure Router and associated connections.

Table 40 System Maintenance menu diagnostic

Field Description

Ping Host

Reboot System

Host IP Address=

Enter 1 to ping any machine (with an IP address) on your

LAN or WAN. Enter its IP address in the Host IP Address field below.

WAN DHCP Release

WAN DHCP Renewal

Enter 2 to release your WAN DHCP settings.

Enter 3 to renew your WAN DHCP settings.

PPPoE/PPPoA Setup Test This feature is only available for dial-up connections using

PPPoE or PPPoA encapsulation. Enter 4 to test the

Internet setup. You can also test the Internet setup in

Menu 4 - Internet Access . Refer to Chapter 5, “Internet access,” on page 81 for more details.

Enter 11 to reboot the Business Secure Router.

If you entered 1 in Ping Host , enter the IP address of the computer you want to ping in this field.

Enter the number of the selection you want to perform or press [ESC] to cancel.

Nortel Business Secure Router 252 Configuration — Advanced

178 Chapter 14 System information and diagnosis

NN47923-501

179

Chapter 15 Firmware and configuration file maintenance

This chapter tells you how to backup and restore your configuration file, as well as upload new firmware and configuration files.

Filename conventions

The configuration file (often called the romfile or rom-0) contains the factory default settings in the menus such as password, DHCP Setup and TCP/IP Setup. It comes with a rom filename extension. Once you have customized the Business

Secure Router settings, they can be saved back to your computer under a filename of your choosing.

The system firmware (sometimes referred to as the ras file) has a bin filename extension. With many FTP and TFTP clients, the filenames are similar to those seen next.

Note: Only use firmware for your Business Secure Router specific model. Refer to the label on the bottom of your Business Secure Router.

ftp> put firmware.bin ras

This is a sample FTP session showing the transfer of the computer file firmware.bin to the Business Secure Router.

ftp> get rom-0 config.cfg

This is a sample FTP session saving the current configuration to the computer file config.cfg.

Nortel Business Secure Router 252 Configuration — Advanced

180 Chapter 15 Firmware and configuration file maintenance

If your (T)FTP client does not allow you to have a destination filename different than the source, you must rename the firmware and config file names as the

Business Secure Router only recognizes rom-0 and ras. Be sure you keep unaltered copies of both files for later use.

Table 41 is a summary. Note that the internal filename refers to the filename on the Business Secure Router and the external filename refers to the filename not on the Business Secure Router, that is, on your computer, local network or FTP site and so the name (but not the extension) can vary. After uploading new firmware, see the F/W version field in Menu 24.2.1 – System Maintenance – Information to confirm that you have uploaded the correct firmware version. The AT command is the command you enter after you press y when prompted in the SMT menu to go into debug mode.

Table 41 Filename Conventions

File Type

Configuration

File

Rom-0

Firmware

Internal Name External Name

Ras

This is the configuration filename on the Business Secure Router.

Uploading the rom-0 file replaces the entire ROM file system, including your

Business Secure Router configurations, system-related data

(including the default password), the error log and the trace log.

This is the name for the firmware on the Contivity.

Description

*.rom

*.bin

Backup configuration

Note: The Business Secure Router displays different messages explaining different ways to backup, restore and upload files in menus

24.5, 24.6, 24. 7.1 and 24.7.2; depending on whether you use the console port or Telnet.

Using Option 5 from Menu 24 – System Maintenance, you can back up the current Business Secure Router configuration to your computer. Backup is highly recommended once your Business Secure Router is functioning properly. FTP is the preferred method for backing up your current configuration to your computer

NN47923-501

Chapter 15 Firmware and configuration file maintenance 181 since it is faster. You can also perform backup and restore using menu 24 through the console port. Any serial communications program should work fine; however, you must use Xmodem protocol to perform the download or upload and you do not have to rename the files.

Note that terms download and upload are relative to the computer. Download means to transfer from the Business Secure Router to the computer, while upload is a transfer from your computer to the Business Secure Router.

Backup configuration

Follow the instructions as shown in Menu 24.5

( Figure 88 ).

Figure 88 Menu 24.5 – System Maintenance – Backup Configuration

Menu 24.5 - System Maintenance - Backup Configuration

To transfer the configuration file to your workstation, follow the procedure

below:

1. Launch the FTP client on your workstation.

2. Type "open" and the IP address of your router. Then type "nnadmin" and SMT password as requested.

3. Locate the 'rom-0' file.

4. Type 'get rom-0' to back up the current router configuration to

your workstation.

For details on FTP commands, please consult the documentation of your FTP

client program. For details on backup using TFTP (note that you must remain

in this menu to back up using TFTP), please see your router manual.

Press ENTER to Exit:

Using the FTP command from the command line

1 Launch the FTP client on your computer.

2 Enter open, followed by a space and the IP address of your Business Secure

Router.

3 Press [ENTER] when prompted for a username.

4 Enter your password as requested (the default password is PlsChgMe!).

Nortel Business Secure Router 252 Configuration — Advanced

182 Chapter 15 Firmware and configuration file maintenance

5 Enter bin to set transfer mode to binary.

6 Use get to transfer files from the Business Secure Router to the computer, for example, get rom-0 config.rom

transfers the configuration file on the

Business Secure Router to your computer and renames it config.rom

. See earlier in this chapter for more information on filename conventions.

7 Enter quit to exit the ftp prompt.

Example of FTP commands from the command line

Figure 89 FTP Session Example

331 Enter PASS command

Password:

230 Logged in ftp> bin

200 Type I OK ftp> get rom-0 config.rom

200 Port command okay

150 Opening data connection for STOR ras

226 File received OK ftp: 16384 bytes sent in 1.10Seconds 297.89Kbytes/sec.

ftp> quit

GUI-based FTP clients

Table 42 describes some of the commands that you can see in GUI-based FTP clients.

Table 42 General commands for GUI-based FTP clients

Command

Host Address

Logon Type

Transfer Type

Description

Enter the address of the host server.

Anonymous.

This is when a user ID and password is automatically supplied to the server for anonymous access. Anonymous logons will work only if your ISP or service administrator has enabled this option.

Normal.

The server requires a unique User ID and Password to log on.

Transfer files in either ASCII (plain text format) or in binary mode.

NN47923-501

Chapter 15 Firmware and configuration file maintenance 183

Table 42 General commands for GUI-based FTP clients

Command Description

Initial Remote Directory Specify the default remote directory (path).

Initial Local Directory Specify the default local directory (path).

TFTP and FTP over WAN Management Limitations

TFTP, FTP and Telnet over WAN do not work when:

• You disable Telnet service in menu 24.11.

• You apply a filter in menu 3.1 (LAN) or in menu 11.1.4 (WAN) to block

Telnet service.

• The IP address in the Secured Client IP field in menu 24.11 does not match the client IP. If it does not match, the Business Secure Router disconnects the

Telnet session immediately.

• You are running an SMT console session.

Backup configuration using TFTP

The Business Secure Router supports the uploading and downloading of the firmware and the configuration file using TFTP (Trivial File Transfer Protocol) over LAN. Nortel does not recommend using TFTP over WAN, although it can work.

To use TFTP, your computer must have both Telnet and TFTP clients. To back up the configuration file, follow the procedure shown next.

1 Use Telnet from your computer to connect to the Business Secure Router and log on. Because TFTP does not have any security checks, the Business Secure

Router records the IP address of the Telnet client and accepts TFTP requests only from this address.

2 Put the SMT in command interpreter (CI) mode by entering 8 in Menu 24 –

System Maintenance .

3 Enter command “sys stdio 0” to disable the SMT timeout, so the TFTP transfer is not interrupted. Enter command “sys stdio 5” to restore the five-minute SMT timeout (default) after the file transfer is complete.

Nortel Business Secure Router 252 Configuration — Advanced

184 Chapter 15 Firmware and configuration file maintenance

4 Launch the TFTP client on your computer and connect to the Business Secure

Router. Set the transfer mode to binary before starting data transfer.

5 Use the TFTP client (see the example below) to transfer files between the

Business Secure Router and the computer. The file name for the configuration file is “rom-0” (rom-zero, not capital o).

Note: Telnet connection must be active and the SMT must be in CI mode before and during the TFTP transfer. For details on TFTP commands (see “TFTP command example” on page 184 ), consult the documentation of your TFTP client program. For UNIX, use “get” to transfer from the Business Secure Router to the computer and “binary” to set binary transfer mode.

TFTP command example

The following is an example TFTP command: tftp [-i] host get rom-0 config.rom

where “i” specifies binary image transfer mode (use this mode when transferring binary files), “host” is the Business Secure Router IP address, “get” transfers the file source on the Business Secure Router (rom-0, name of the configuration file on the Business Secure Router) to the file destination on the computer and renames it config.rom.

GUI-based TFTP clients

Table 43 describes some of the fields that appear in GUI-based TFTP clients.

Table 43 General commands for GUI-based TFTP clients

Command Description

Host Enter the IP address of the Business Secure Router. 192.168.1.1 is the

Business Secure Router’s default IP address when shipped.

Send/Fetch Use Send to upload the file to the Business Secure Router and Fetch to back up the file on your computer.

Local File Enter the path and name of the firmware file (*.bin extension) or configuration file (*.rom extension) on your computer.

NN47923-501

Chapter 15 Firmware and configuration file maintenance 185

Table 43 General commands for GUI-based TFTP clients

Command Description

Remote File This is the filename on the Business Secure Router. The filename for the firmware is “ras” and for the configuration file, is “rom-0”.

Binary

Abort

Transfer the file in binary mode.

Stop transfer of the file.

Refer to Chapter 17, “Remote Management,” on page 209 for information about configurations that disallow TFTP and FTP over WAN.

Back up via console port

Back up configuration via the console port by following the HyperTerminal procedure. Procedures using other serial communications programs are similar.

Display menu 24.5 and enter “y” at the screen shown in Figure 90 .

Figure 90 Menu 24.5 – System Maintenance – Backup Configuration

Ready to backup Configuration via Xmodem.

Do you want to continue (y/n):

Figure 91 shows the screen which indicates that the Xmodem download has started.

Figure 91 Menu 24.5 System Maintenance: Starting Xmodem Download Screen

You can enter ctrl-x to terminate operation any time.

Starting XMODEM download...

Run the HyperTerminal program by clicking Transfer , then Receive File as shown in Figure 92 .

Nortel Business Secure Router 252 Configuration — Advanced

186 Chapter 15 Firmware and configuration file maintenance

Figure 92 Backup Configuration Example

Type a location for storing the configuration file or click Browse to look for one.

Choose the Xmodem protocol.

Click Receive .

After a successful backup, the screen shown in Figure 93 appears. Press any key to return to the SMT menu.

Figure 93 Successful Backup Confirmation Screen

** Backup Configuration completed. OK.

### Hit any key to continue.###

Restore configuration

This section shows you how to restore a previously saved configuration. Note that this function erases the current configuration before restoring a previous back up configuration; do not attempt to restore unless you have a backup configuration file stored on disk.

FTP is the preferred method for restoring your current computer configuration to your Business Secure Router since FTP is faster. note that you must wait for the system to automatically restart after the file transfer is complete.

Warning: Do not interrupt the file transfer process as this can permanently damage your Business Secure Router.

NN47923-501

Restore Using FTP

Chapter 15 Firmware and configuration file maintenance 187

For details about back up using FTP and TFTP, refer to “Backup configuration” on page 180 .

Figure 94 Telnet into Menu 24.6

Menu 24.6 -- System Maintenance - Restore Configuration

To transfer the firmware and the configuration file, follow the procedure

below:

1. Launch the FTP client on your workstation.

2. Type "open" and the IP address of your router. Then type "nnadmin" and SMT password as requested.

3. Type "put backupfilename rom-0" where backupfilename is the name of

your backup configuration file on your workstation and rom-spt is the

remote file name on the router. This restores the configuration to

your router.

4. The system reboots automatically after a successful file transfer.

For details on FTP commands, please consult the documentation of your FTP

client program. For details on restoring using TFTP (note that you must

remain on this menu to restore using TFTP), please see your router

manual.

Press ENTER to Exit:

1 Launch the FTP client on your computer.

2 Enter open , followed by a space and the IP address of your Business Secure

Router.

3 Press [ENTER] when prompted for a username.

4 Enter your password as requested (the default is “PlsChgMe!”).

5 Enter bin to set transfer mode to binary.

6 Find the rom file (on your computer) that you want to restore to your Business

Secure Router.

7 Use put to transfer files from the Business Secure Router to the computer, for example, “put config.rom rom-0” transfers the configuration file config.rom on your computer to the Business Secure Router. See “Filename conventions” on page 179 for more information about filename conventions.

Nortel Business Secure Router 252 Configuration — Advanced

188 Chapter 15 Firmware and configuration file maintenance

8 Enter quit to exit the ftp prompt. The Business Secure Router automatically restarts after a successful restore process.

Restore using FTP session example

Figure 95 Restore using FTP session example ftp> put config.rom rom-0

200 Port command okay

150 Opening data connection for STOR rom-0

226 File received OK

221 Goodbye for writing flash ftp: 16384 bytes sent in 0.06Seconds 273.07Kbytes/sec.

ftp>quit

Refer to Chapter 17, “Remote Management,” on page 209 to read about configurations that disallow TFTP and FTP over WAN.

Restore via console port

Restore configuration via console port by following the HyperTerminal procedure. Procedures using other serial communications programs are similar.

Display menu 24.6 and enter y at the prompt.

Figure 96 System Maintenance: Restore Configuration

Ready to restore Configuration via Xmodem.

Do you want to continue (y/n):

Figure 97 indicates that the Xmodem download has started.

NN47923-501

Chapter 15 Firmware and configuration file maintenance 189

Figure 97 System Maintenance: Starting Xmodem Download Screen

Type the configuration file’s location, or click

Browse to search for it.

Choose the Xmodem protocol.

Click Send .

Run the HyperTerminal program by clicking Transfer , then Send File .

Starting XMODEM download (CRC mode) ...

CCCCCCCCC

After a successful restoration, the screen shown in Figure 98 appears. Press any key to restart the Business Secure Router and return to the SMT menu.

Figure 98 Successful Restoration Confirmation Screen

Save to ROM

Hit any key to start system reboot.

Uploading Firmware and Configuration Files

This section shows you how to upload firmware and configuration files. You can upload configuration files by following the procedure “Restore configuration” on page 186 , or by following the instructions in Menu 24.7.2 – System

Maintenance – Upload System Configuration File .

Warning: Do not interrupt the file transfer process as this can permanently damage your Business Secure Router.

Nortel Business Secure Router 252 Configuration — Advanced

190 Chapter 15 Firmware and configuration file maintenance

Firmware file upload

FTP is the preferred method for uploading the firmware and configuration. To use this feature, your computer must have an FTP client.

When you use Telnet to access the Business Secure Router, the screens for uploading firmware and the configuration file using FTP appear.

Figure 99 Telnet Into Menu 24.7.1 Upload System Firmware

Menu 24.7.1 - System Maintenance - Upload System Firmware

To upload the system firmware, follow the procedure below:

1. Launch the FTP client on your workstation.

2. Type "open" and the IP address of your system. Then type "nnadmin" and

SMT password as requested.

3. Type "put firmwarefilename ras" where "firmwarefilename" is the name

of your firmware upgrade file on your workstation and "ras" is the

remote file name on the system.

4. The system reboots automatically after a successful firmware upload.

For details on FTP commands, please consult the documentation of your FTP client program. For details on uploading system firmware using TFTP (note that you must remain on this menu to upload system firmware using TFTP), please see your manual.

Press ENTER to Exit:

NN47923-501

Chapter 15 Firmware and configuration file maintenance 191

Configuration file upload

The screen shown in Figure 100 appears when you access menu 24.7.2 via Telnet.

Figure 100 Telnet Into Menu 24.7.2 System Maintenance

Menu 24.7.2 - System Maintenance - Upload System Configuration File

To upload the system configuration file, follow the procedure below:

1. Launch the FTP client on your workstation.

2. Type "open" and the IP address of your system. Then type "nnadmin" and

SMT password as requested.

3. Type "put configurationfilename rom-0" where "configurationfilename"

is the name of your system configuration file on your workstation, which

will be transferred to the "rom-0" file on the system.

4. The system reboots automatically after the upload system configuration

file process is complete.

Press ENTER to Exit:

To upload the firmware and the configuration files, follow the examples in the rest of this chapter:

FTP file upload command from the DOS prompt example

1 Launch the FTP client on your computer.

2 Enter “open”, followed by a space and the IP address of your Business Secure

Router.

3 Press [ENTER] when prompted for a username.

4 Enter your password as requested (the default is “PlsChgMe!”).

5 Enter “bin” to set transfer mode to binary.

6 Use “put” to transfer files from the computer to the Business Secure Router, for example, “put firmware.bin ras” transfers the firmware on your computer

(firmware.bin) to the Business Secure Router and renames it “ras”. Similarly,

“put config.rom rom-0” transfers the configuration file on your computer

Nortel Business Secure Router 252 Configuration — Advanced

192 Chapter 15 Firmware and configuration file maintenance

(config.rom) to the Business Secure Router and renames it rom-0. Likewise get rom-0 config.rom transfers the configuration file on the Business Secure

Router to your computer and renames it “config.rom.” See “Filename conventions” on page 179 for more information about filename conventions.

7 Enter “quit” to exit the ftp prompt.

Note: The Business Secure Router automatically restarts after a successful file upload.

FTP Session Example of Firmware File Upload

Figure 101 FTP Session Example of Firmware File Upload

331 Enter PASS command

Password:

230 Logged in ftp> bin

200 Type I OK ftp> put firmware.bin ras

200 Port command okay

150 Opening data connection for STOR ras

226 File received OK ftp: 1103936 bytes sent in 1.10Seconds 297.89Kbytes/sec.

ftp> quit

More commands (found in GUI-based FTP clients) are listed earlier in this chapter.

Refer to the “Remote Management” on page 209 section to read about configurations that disallow TFTP and FTP over WAN.

TFTP file upload

The Business Secure Router also supports the uploading of firmware files using

TFTP (Trivial File Transfer Protocol) over LAN. Although TFTP also works over

WAN, Nortel does not recommend doing this.

1 To use TFTP, your computer must have both Telnet and TFTP clients. To transfer the firmware and the configuration file, follow the procedure shown next.

NN47923-501

Chapter 15 Firmware and configuration file maintenance 193

2 Use Telnet from your computer to connect to the Business Secure Router and log on. Because TFTP does not have any security checks, the Business Secure

Router records the IP address of the Telnet client and accepts TFTP requests only from this address.

3 Put the SMT in command interpreter (CI) mode by entering 8 in Menu 24 –

System Maintenance .

4 Enter the command sys stdio 0 to disable the management timeout, so the

TFTP transfer is not interrupted. Enter command sys stdio 5 to restore the five-minute management timeout (default) when the file transfer is complete.

5 Launch the TFTP client on your computer and connect to the Business Secure

Router. Set the transfer mode to binary before starting data transfer.

6 Use the TFTP client (see the example below) to transfer files between the

Business Secure Router and the computer. The file name for the firmware is ras.

Note that the telnet connection must be active and the Business Secure Router must be in CI mode before and during the TFTP transfer. For details about TFTP commands (see “TFTP upload command example” on page 193 ), consult the documentation of your TFTP client program. For UNIX, use get to transfer from the Business Secure Router to the computer, put to transfer from the computer to the Business Secure Router, and binary to set binary transfer mode.

TFTP upload command example

The following is an example TFTP command: tftp [-i] host put firmware.bin ras where “i” specifies binary image transfer mode (use this mode when transferring binary files), “host” is the Business Secure Router’s IP address and “put” transfers the file source on the computer (firmware.bin – name of the firmware on the computer) to the file destination on the remote host (ras - name of the firmware on the Business Secure Router).

Commands that appear in GUI-based TFTP clients are listed earlier in this chapter.

Nortel Business Secure Router 252 Configuration — Advanced

194 Chapter 15 Firmware and configuration file maintenance

Uploading via console port

FTP or TFTP are the preferred methods for uploading firmware to your Business

Secure Router. However, in the event of your network being down, uploading files is only possible with a direct connection to your Business Secure Router via the console port. Under normal conditions, Nortel does not recommend uploading files via the console port, as FTP or TFTP are faster. Any serial communications program should work fine; however, you must use the Xmodem protocol to perform the download or upload.

Uploading Firmware File Via Console Port

Select 1 from Menu 24.7 – System Maintenance – Upload Firmware to display

Menu 24.7.1 – System Maintenance – Upload System Firmware , then follow the instructions as shown in Figure 102 .

Figure 102 Menu 24.7.1 as seen using the Console Port

Menu 24.7.1 - System Maintenance - Upload System Firmware

To upload system firmware:

1. Enter "y" at the prompt below to go into debug mode.

2. Enter "atur" after "Enter Debug Mode" message.

3. Wait for "Starting XMODEM upload" message before activating

Xmodem upload on your terminal.

4. After successful firmware upload, enter "atgo" to restart the

Business Secure Router.

Warning: Proceeding with the upload will erase the current system

firmware.

Do You Wish To Proceed:(Y/N)

After the "Starting Xmodem upload" message appears, activate the Xmodem protocol on your computer. Follow the procedure as shown previously for the

HyperTerminal program. The procedure for other serial communications programs is similar.

NN47923-501

Chapter 15 Firmware and configuration file maintenance 195

Uploading Xmodem firmware using HyperTerminal

1 Click Transfer , and then Send File to display the screen in Figure 103 .

Figure 103 Example Xmodem Upload

Type the configuration file’s location, or click

Browse to search for it.

Choose the Xmodem protocol

Click Send .

2 After the configuration upload process is complete, restart the Business

Secure Router by entering atgo .

Uploading configuration file via console port

1 Select 2 from Menu 24.7 – System Maintenance – Upload Firmware to display Menu 24.7.2 – System Maintenance – Upload System

Configuration File . Follow the instructions as shown in Figure 104 .

Nortel Business Secure Router 252 Configuration — Advanced

196 Chapter 15 Firmware and configuration file maintenance

Figure 104 Menu 24.7.2 as seen using the Console Port

Menu 24.7.2 - System Maintenance - Upload System Configuration File

To upload system configuration file:

1. Enter "y" at the prompt below to go into debug mode.

2. Enter "atlc" after "Enter Debug Mode" message.

3. Wait for "Starting XMODEM upload" message before activating

Xmodem upload on your terminal.

4. After successful firmware upload, enter "atgo" to restart the

system.

Warning:

1. Proceeding with the upload will erase the current

configuration file.

2. The system’s console port speed (Menu 24.2.2) may change

when it is restarted; please adjust your terminal's speed

accordingly. The password may change (menu 23), also.

3. When uploading the DEFAULT configuration file, the console

port speed will be reset to 9600 bps and the password to

"PlsChgMe!".

Do You Wish To Proceed:(Y/N)

2 After the "Starting Xmodem upload" message appears, activate the Xmodem protocol on your computer. Follow the procedure in “Uploading Xmodem firmware using HyperTerminal” on page 195 . The procedure for other serial communications programs is similar.

3 Enter atgo to restart the Business Secure Router.

NN47923-501

Chapter 15 Firmware and configuration file maintenance 197

Uploading Xmodem configuration file using HyperTerminal

1 Click Transfer , then Send File to display the screen shown in Figure 105 .

Figure 105 Example Xmodem Upload

Type the configuration file’s location, or click

Browse to search for it.

Choose the Xmodem protocol.

Click Send .

2 After the configuration upload process is complete, restart the Business

Secure Router by entering atgo .

Nortel Business Secure Router 252 Configuration — Advanced

198 Chapter 15 Firmware and configuration file maintenance

NN47923-501

199

Chapter 16 System Maintenance menus 8 to 10

This chapter leads you through SMT menus 24.8 to 24.10.

Command Interpreter mode

The Command Interpreter (CI) is a part of the main router firmware. The CI provides much of the same functionality as the SMT, while adding some low-level setup and diagnostic functions. Enter the CI from the SMT by selecting menu 24.8. Access can be by Telnet or by a serial connection to the console port, although some commands are only available with a serial connection. See the included disk or www.nortel.com for more detailed information about CI commands. Enter 8 from Menu 24 - System Maintenance .

Note: Use of undocumented commands or misconfiguration can damage the unit and possibly render it unusable.

Nortel Business Secure Router 252 Configuration — Advanced

200 Chapter 16 System Maintenance menus 8 to 10

Figure 106 Command mode in Menu 24

Menu 24 - System Maintenance

1. System Status

2. System Information and Console Port Speed

3. Log and Trace

4. Diagnostic

5. Backup Configuration

6. Restore Configuration

7. Firmware Update

8. Command Interpreter Mode

9. Call Control

10. Time and Date Setting

11. Remote Management Setup

Enter Menu Selection Number:

Command syntax

The command keywords are in Courier New font.

Enter the command keywords exactly as shown, do not abbreviate.

The required fields in a command are enclosed in angle brackets <>.

The optional fields in a command are enclosed in square brackets [].

The | symbol means “or”.

For example, sys filter netbios config <type> <on|off>

NN47923-501

Chapter 16 System Maintenance menus 8 to 10 201 means that you must specify the type of netbios filter and whether to turn it on or off.

Command usage

A list of commands can be found by typing “help” or “?” at the command prompt.

Always type the full command. Type “exit” to return to the SMT main menu when finished. See Appendix G, “Command Interpreter,” on page 267 for details on the commands.

Call control support

The Business Secure Router provides two call control functions: budget management and call history. Note that this menu is only applicable when

Encapsulation is set to PPPoE or PPPoA in menu 4 or menu 11.1.

With the budget management function, you can set a limit on the total outgoing call time of the Business Secure Router within certain times. When the total outgoing call time exceeds the limit, the current call is dropped and any future outgoing calls are blocked.

Call history chronicles preceding incoming and outgoing calls.

To access the call control menu, select option 9 in menu 24 to go to Menu 24.9 -

System Maintenance - Call Control , as shown in Figure 107 .

Nortel Business Secure Router 252 Configuration — Advanced

202 Chapter 16 System Maintenance menus 8 to 10

Figure 107 Call Control

Menu 24.9 - System Maintenance - Call Control

1.Budget Management

2.Call History

Enter Menu Selection Number:

Budget management

Menu 24.9.1 shows the budget management statistics for outgoing calls. Enter 1 from Menu 24.9 - System Maintenance - Call Control to bring up the Budget

Management menu ( Figure 108 ).

NN47923-501

Chapter 16 System Maintenance menus 8 to 10 203

Figure 108 Budget Management

Remote Node

1.ChangeMe

2.GUI

Menu 24.9.1 - Budget Management

Connection Time/Total Budget

No Budget

Elapsed Time/Total Period

No Budget

No Budget No Budget

Reset Node (0 to update screen):

The total budget is the time limit on the accumulated time for outgoing calls to a remote node. When this limit is reached, the call is dropped and further outgoing calls to that remote node is blocked. After each period, the total budget is reset.

The default for the total budget is 0 minutes and the period is 0 hours, meaning no budget control. You can reset the accumulated connection time in this menu by entering the index of a remote node. Enter 0 to update the screen. The budget and the reset period can be configured in menu 11.1 for the remote node.

Table 44 Budget management

Field

Remote Node

Connection Time/

Total Budget

Elapsed Time/Total

Period

Description Example

Enter the index number of the remote node you want to reset (just one in this case)

This is the total connection time that has gone by (within the allocated budget that you set in menu 11.1).

The period is the time cycle in hours that the allocation budget is reset (see menu 11.1.) The elapsed time is the time used up within this period.

Enter “0” to update the screen or press

[ESC] to return to the previous screen.

5/10 means that 5 minutes out of a total allocation of 10 minutes have lapsed.

0.5/1 means that 30 minutes out of the

1-hour time period has lapsed.

Nortel Business Secure Router 252 Configuration — Advanced

204 Chapter 16 System Maintenance menus 8 to 10

Call History

This is the second option in Menu 24.9 - System Maintenance - Call Control . It displays information about past incoming and outgoing calls. Enter 2 from Menu

24.9 - System Maintenance - Call Control .

Figure 109 Call History

Menu 24.9.2 - Call History

Phone Number

10.

Dir Rate #call

Enter Entry to Delete(0 to exit):

Max Min Total

Table 45 describes the fields in Figure 109 .

Table 45 Call History Fields

Field Description

Phone Number The PPPoE service names are shown here.

Dir This shows whether the call is incoming or outgoing.

Rate

#call

Max

Min

Total

This is the transfer rate of the call.

This is the number of calls made to or received from that telephone number.

This is the length of time of the longest telephone call.

This is the length of time of the shortest telephone call.

This is the total length of time of all the telephone calls to and from that telephone number.

Enter an entry number to delete it or 0 to exit.

NN47923-501

Chapter 16 System Maintenance menus 8 to 10 205

Time and Date setting

There is a software mechanism to set the time manually or get the current time and date from an external server when you turn on your Business Secure Router.

With Menu 24.10, you can update the time and date settings of your Business

Secure Router.

The real time is then displayed in the Business Secure Router error logs and firewall logs.

Select menu 24 in the main menu to open Menu 24 - System Maintenance .

Figure 110 Menu 24 – System Maintenance

Menu 24 - System Maintenance

1. System Status

2. System Information and Console Port Speed

3. Log and Trace

4. Diagnostic

5. Backup Configuration

6. Restore Configuration

7. Upload Firmware

8. Command Interpreter Mode

9. Call Control

10. Time and Date Setting

11. Remote Management Setup

Enter Menu Selection Number:

Enter 10 to go to Menu 24.10 - System Maintenance - Time and Date Setting to update the time and date settings of your Business Secure Router, as shown in

Figure 111 .

Nortel Business Secure Router 252 Configuration — Advanced

206 Chapter 16 System Maintenance menus 8 to 10

Figure 111 Menu 24.10 System Maintenance: Time and Date Setting

Menu 24.10 - System Maintenance - Time and Date Setting

Time Protocol= NTP (RFC-1305)

Time Server Address= a.ntp.alphazed.net

Current Time: 01 : 07 : 41

New Time (hh:mm:ss): N/A N/A N/A

Current Date: 2000 - 01 - 01

New Date (yyyy-mm-dd): N/A N/A N/A

Time Zone= GMT

Daylight Saving= No

Start Date (mm-nth-week-hr): Jan. - 1st - Sat. - 00

End Date (mm-nth-week-hr): Jan. - 1st - Sat. - 00

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

Table 46 describes the fields in Figure 111 .

Table 46 Time and Date Setting Fields

Field

Time Protocol

Time Server

Address

Current Time

New Time

Description

Enter the time service protocol that your time server uses. Not all time servers support all protocols, so check with your ISP or network administrator or use trial and error to find a protocol that works. The main differences between the time protocols are the format.

Daytime (RFC 867) format is the day/month/year/time zone of the server.

Time (RFC-868) format displays a 4-byte integer giving the total number of seconds since 1970/1/1 at 0:0:0.

The default, NTP (RFC-1305) , is similar to Time (RFC-868) .

Select Manual to enter the new time and new date manually.

Enter the IP address or domain name of your timeserver. Check with your ISP or network administrator if you are unsure of this information. The default is a.ntp.alphazed.net.

This field displays an updated time only when you reenter this menu.

Enter the new time in hour, minute and second format. This field is available when you select Manual in the Time Protocol field.

NN47923-501

Chapter 16 System Maintenance menus 8 to 10 207

Table 46 Time and Date Setting Fields

Field Description

Current Date

New Date

Time Zone

Daylight Saving

Time

Start Date

(mm-nth-week-hr)

This field displays an updated date only when you reenter this menu.

Enter the new date in year, month and day format. This field is available when you select Manual in the Time Protocol field.

Press [SPACE BAR] and then [ENTER] to set the time difference between your time zone and Greenwich Mean Time (GMT).

Daylight Saving Time is a period from late spring to early fall when many countries set their clocks ahead of normal local time by one hour to give more daylight time in the evenings. If you use daylight savings time, then choose Yes .

Configure the day and time when Daylight Saving Time starts if you select Yes in the Daylight Saving field. The hr field uses the

24-hour format. Here are a couple of examples:

Daylight Saving Time starts in most parts of the United States on the first Sunday of April. Each time zone in the United States starts using Daylight Saving Time at 2 a.m. local time. So, in the United

States, select Apr.

, 1st , Sun.

and type 02 in the hr field.

Daylight Saving Time starts in the European Union on the last

Sunday of March. All of the time zones in the European Union start using Daylight Saving Time at the same moment (1 a.m. GMT or

UTC). So, in the European Union, select Mar.

, Last , Sun.

The time you type in the hr field depends on your time zone. In Germany, for instance, type 02 because Germany's time zone is one hour ahead of GMT or UTC (GMT+1).

End Date

(mm-nth-week-hr)

Configure the day and time when Daylight Saving Time ends if you select Yes in the Daylight Saving field. The hr field uses the 24 hour format. Here are a couple of examples:

Daylight Saving Time ends in the United States on the last Sunday of October. Each time zone in the United States stops using Daylight

Saving Time at 2 a.m. local time. So, in the United States, select

Oct.

, Last , Sun. and type 02 in the hr field.

Daylight Saving Time ends in the European Union on the last

Sunday of October. All of the time zones in the European Union stop using Daylight Saving Time at the same moment (1 a.m. GMT or

UTC). So, in the European Union, select Oct.

, Last , Sun.

The time you type in the hr field depends on your time zone. In Germany, for instance, type 02 because Germany's time zone is one hour ahead of GMT or UTC (GMT+1).

After you fill in this menu, press [ENTER] at the message “Press ENTER to Confirm or

ESC to Cancel“ to save your configuration, or press [ESC] to cancel.

Nortel Business Secure Router 252 Configuration — Advanced

208 Chapter 16 System Maintenance menus 8 to 10

Resetting the Time

The Business Secure Router resets the time in three instances:

• After you make changes to and leave menu 24.10

• After starting up the Business Secure Router starts up, if a time server configured in menu 24.10

• After starting the Business Secure Router, in 24-hour intervals

NN47923-501

209

Chapter 17 Remote Management

This chapter covers remote management found in SMT menu 24.11.

Remote Management

With remote management, you can determine which services and protocols can access which Business Secure Router interface (if any) from which computers.

You can manage your Business Secure Router from a remote location via:

• Internet (WAN only)

• ALL (LAN and WAN)

• LAN only

• Neither (Disable)

Note: When you Choose WAN only or ALL (LAN & WAN), you still need to configure a firewall rule to allow access.

To disable remote management of a service, select Disable in the corresponding

Server Access field.

Enter 11 from menu 24 to bring up Menu 24.11 – Remote Management

Control .

Nortel Business Secure Router 252 Configuration — Advanced

210 Chapter 17 Remote Management

Figure 112 Menu 24.11 – Remote Management Control

Menu 24.11 - Remote Management Control

TELNET Server: Port = 23 Access = Disable

Secure Client IP = 0.0.0.0

FTP Server: Port = 21 Access = Disable

Secure Client IP = 0.0.0.0

SSH Server: Certificate = auto_generated_self_signed_cert

Port = 22 Access = Disable

Secure Client IP = 0.0.0.0

HTTPS Server: Certificate = auto_generated_self_signed_cert

Authenticate Client Certificates = No

Port = 443 Access = Disable

Secure Client IP = 0.0.0.0

HTTP Server: Port = 80 Access = LAN only

Secure Client IP = 0.0.0.0

SNMP Service: Port = 161 Access = Disable

Secure Client IP = 0.0.0.0

DNS Service: Port = 53 Access = LAN only

Secure Client IP = 0.0.0.0

Press ENTER to Confirm or ESC to Cancel:

Table 47 describes the fields in Figure 112 .

Table 47 Menu 24.11 – Remote Management control

Field

Telnet Server

FTP Server SSH

Server

HTTPS Server

HTTP Server

SNMP Service

DNS Service

Port

Description

Each of these read-only labels denotes a service that you can use to remotely manage the Business Secure Router.

Access

Secure Client IP

This field shows the port number for the service or protocol. You can change the port number if needed, but you must use the same port number to access the Business Secure Router.

Select the access interface (if any) by pressing [SPACE BAR], then

[ENTER] to choose from: LAN only , WAN only , ALL or Disable .

The default 0.0.0.0 allows any client to use this service to remotely manage the Business Secure Router. Enter an IP address to restrict access to a client with a matching IP address.

NN47923-501

Chapter 17 Remote Management 211

Table 47 Menu 24.11 – Remote Management control

Field Description

Certificate

Authenticate Client

Certificates

Press [SPACE BAR] and then [ENTER] to select the certificate that the Business Secure Router uses to identify itself. The Business

Secure Router is the SSL server and must always authenticate itself to the SSL client (the computer that requests the HTTPS connection with the Business Secure Router).

Select Yes by pressing [SPACE BAR], then [ENTER] to require the

SSL client to authenticate itself to the Business Secure Router by sending the Business Secure Router a certificate. To do that, the

SSL client must have a CA-signed certificate from a CA that has been imported as a trusted CA on the Business Secure Router (see

Appendix C, “Importing certificates,” on page 233 for details).

After you fill this menu, press [ENTER] at the message "Press ENTER to Confirm or ESC to Cancel" to save your configuration, or press [ESC] to cancel.

Remote Management Limitations

Remote management over LAN or WAN does not work when:

1 A filter in menu 3.1 (LAN) or in menu 11.1.4 (WAN) is applied to block a

Telnet, FTP, or Web service.

2 You disable that service in menu 24.11.

3 The IP address in the Secured Client IP field (menu 24.11) does not match the client IP address. If it does not match, the Business Secure Router disconnects the session immediately.

4 There is an SMT console session running.

5 There is already another remote management session of the same type (web,

FTP or Telnet) running. Only one remote management session of the same type can run at one time.

6 There is a web remote management session running with a Telnet session. A

Telnet session is disconnected if you begin a web session; it does not begin if a Web session is already running.

7 There is a firewall rule that blocks remote management.

Nortel Business Secure Router 252 Configuration — Advanced

212 Chapter 17 Remote Management

NN47923-501

213

Chapter 18 Call scheduling

Using call scheduling (applicable only for PPPoA or PPPoE encapsulation), you can dictate when a remote node is called and for how long.

Introduction

Using the call scheduling feature, the Business Secure Router can manage a remote node and dictate when a remote node is called and for how long. This feature is similar to the scheduler in a video cassette recorder (you can specify a time period for the VCR to record). You can apply up to 4 schedule sets in Menu

11.1 — Remote Node Profile . From the main menu, enter 26 to access Menu 26

— Schedule Setup as shown in Figure 113 .

Figure 113 Menu 26 – Schedule Setup

Menu 26 - Schedule Setup

Schedule Schedule

Set # Name Set # Name

------ ----------------- ------ -----------------

1 AlwaysOn 7 _______________

2 _______________ 8 _______________

3 _______________ 9 _______________

4 _______________ 10 _______________

5 _______________ 11 _______________

6 _______________ 12 _______________

Enter Schedule Set Number to Configure= 0

Edit Name= N/A

Press ENTER to Confirm or ESC to Cancel:

Nortel Business Secure Router 252 Configuration — Advanced

214 Chapter 18 Call scheduling

Lower numbered sets take precedence over higher numbered sets, thereby avoiding scheduling conflicts. For example, if sets 1, 2, 3, and 4 are applied in the remote node then set 1 takes precedence over sets 2, 3, and 4 as the Business

Secure Router, by default, applies the lowest numbered set first. Set 2 takes precedence over sets 3 and 4, and so on.

You can design up to 12 schedule sets, but you can only apply up to four schedule sets for a remote node.

Note: To delete a schedule set, enter the set number and press

[SPACE BAR] and then [ENTER] (or delete) in the Edit Name field.

To set up a schedule set, select the schedule set you want to setup from menu 26

(1-12) and press [ENTER] to see Menu 26.1 — Schedule Set Setup as shown in

Figure 114 .

Figure 114 Menu 26.1 – Schedule Set Setup

Menu 26.1 - Schedule Set Setup

Active= Yes

Start Date(yyyy/mm/dd) = 2000 – 01 - 01

How Often= Once

Once:

Date(yyyy/mm/dd)= 2000 – 01 - 01

Weekdays:

Sunday= N/A

Monday= N/A

Tuesday= N/A

Wednesday= N/A

Thursday= N/A

Friday= N/A

Saturday= N/A

Start Time (hh:mm)= 00 : 00

Duration (hh:mm)= 00 : 00

Action= Forced On

Press ENTER to Confirm or ESC to Cancel

NN47923-501

Chapter 18 Call scheduling 215

If a connection is already established, your Business Secure Router does not drop it. After the connection is dropped manually or it times out, then that remote node cannot be triggered until the end of the Duration .

Table 48 Menu 26.1 Schedule Set Setup

Field Description Example

Active Press [SPACE BAR] to select Yes or No . Choose Yes and press [ENTER] to activate the schedule set.

Yes

Start Date Enter the start date when you wish the set to take effect in year-month-date format. Valid dates are from the present to

2036-February-5.

2000-01-01

How Often Press the [SPACE BAR] and then [ENTER] to select Once or Weekly . Both these options are mutually exclusive. If

Once is selected, then all weekday settings are N/A . After

Once is selected, the schedule rule deletes automatically after the scheduled time elapses.

Once

Once:

Date

Weekday:

Day

If you selected Once in the How Often field above, enter the date the set should activate here in year-month-date format.

If you selected Weekly in the How Often field above, select the days when the set should activate (and recur) by going to that days and pressing [SPACE BAR] to select Yes .

After you complete this menu, press [ENTER] to exit.

2000-01-01

Yes

N/A

Start Time Enter the start time when you wish the schedule set to take effect in hour-minute format.

Duration Enter the maximum length of time this connection is allowed, in hour-minute format.

09:00

08:00

Action Forced On means that the connection is maintained whether or not there is a demand call on the line and persists for the time period specified in the Duration field.

Forced Down means that the connection is blocked whether or not there is a demand call on the line.

Enable Dial-On-Demand means that this schedule permits a demand call on the line. Disable Dial-On-Demand means that this schedule prevents a demand call on the line.

Forced On

After you complete this menu, press [ENTER] at the prompt “Press ENTER to Confirm…” to save your configuration, or press [ESC] at any time to cancel.

Nortel Business Secure Router 252 Configuration — Advanced

216 Chapter 18 Call scheduling

After you configure your schedule sets, you must apply them to the desired remote nodes. Enter 11 from the Main Menu and then enter the target remote node index. Using [SPACE BAR] , select PPPoE or PPPoA in the

Encapsulation field and then press [ENTER] to make the schedule sets field available, as shown in Figure 115 .

Figure 115 Applying Schedule Sets to a Remote Node (PPPoE)

Menu 11.1 - Remote Node Profile

Rem Node Name= ChangeMe Route= IP

Active= Yes Bridge= No

Encapsulation= PPPoA Edit IP/Bridge= No

Multiplexing= LLC-based Edit ATM Options= No

Service Name= N/A Edit Advance Options= N/A

Incoming: Telco Option:

Rem Login= Allocated Budget(min)= 0

Rem Password= ******** Period(hr)= 0

Outgoing: Schedule Sets =

My Login= Nailed-Up Connection= No

My Password= ******** Session Options:

Authen= CHAP/PAP Edit Filter Sets= No

Idle Timeout(sec)= 100

Press ENTER to Confirm or ESC to Cancel:

You can apply up to four schedule sets, separated by commas, for one remote node. Change the schedule set numbers to your preferences.

NN47923-501

217

Appendix A

Setting up your computer IP address

All computers must have a 10M or 100M Ethernet adapter card and TCP/IP installed.

Windows 95/98/Me/NT/2000/XP, and Macintosh OS 7 and later operating systems and all versions of UNIX/LINUX include the software components you need to install and use TCP/IP on your computer. Windows 3.1 requires the purchase of a third-party TCP/IP application package.

TCP/IP is already installed on computers using Windows NT/2000/XP, or

Macintosh OS 7 and later operating systems.

After the appropriate TCP/IP components are installed, configure the TCP/IP settings in order to communicate with your network.

If you manually assign IP information instead of using dynamic assignment, make sure that your computers have IP addresses that place them in the same subnet as the Business Secure Router LAN port.

Windows 95/98/Me

Click Start , Settings , Control Panel and double-click the Network icon to open the Network window

Nortel Business Secure Router 252 Configuration — Advanced

218 Appendix A Setting up your computer IP address

Figure 116 WIndows 95/98/Me: network: configuration

NN47923-501

Installing components

The Network window Configuration tab displays a list of installed components.

You need a network adapter, the TCP/IP protocol and Client for Microsoft

Networks.

If you need the adapter: a In the Network window, click Add .

b Select Adapter and click Add .

c Select the manufacturer and model of your network adapter and click

OK .

If you need TCP/IP: a In the Network window, click Add .

b Select Protocol and click Add .

c Select Microsoft from the list of manufacturers .

d Select TCP/IP from the list of network protocols and click OK .

If you need Client for Microsoft Networks:

Appendix A Setting up your computer IP address 219 a Click Add .

b Select Client and click Add .

c Select Microsoft from the list of manufacturers.

d Select Client for Microsoft Networks from the list of network clients and click OK .

e Restart your computer so your changes take effect.

Configuring

1 In the Network window Configuration tab, select your network adapter's

TCP/IP entry and click Properties

2 Click the IP Address tab.

— If your IP address is dynamic, select Obtain an IP address automatically .

— If you have a static IP address, select Specify an IP address and type your information into the IP Address and Subnet Mask fields.

Figure 117 Windows 95/98/Me: TCP/IP properties: IP address

3 Click the DNS Configuration tab.

— If you do not know your DNS information, select Disable DNS .

Nortel Business Secure Router 252 Configuration — Advanced

220 Appendix A Setting up your computer IP address

— If you know your DNS information, select Enable DNS and type the information in the fields below (you do not need to fill them all in).

Figure 118 Windows 95/98/Me: TCP/IP Properties: DNS configuration

NN47923-501

4 Click the Gateway tab.

— If you do not know your gateway’s IP address, remove previously installed gateways.

— If you have a gateway IP address, type it in the New gateway field and click Add .

5 Click OK to save and close the TCP/IP Properties window.

6 Click OK to close the Network window. Insert the Windows CD if prompted.

7 Turn on your Business Secure Router and restart your computer when prompted.

Verifying Settings

1 Click Start and then Run .

2 In the Run window, type winipcfg and click OK to open the IP

Configuration window.

3 Select your network adapter. Your computer IP address, subnet mask, and default gateway will be displayed.

Appendix A Setting up your computer IP address 221

Windows 2000/NT/XP

1 For Windows XP, click Start , Control Panel . In Windows 2000/NT, click

Start , Settings , Control Panel .

Figure 119 Windows XP: Start menu

2 For Windows XP, click Network Connections . For Windows 2000/NT, click

Network and Dial-up Connections .

Figure 120 Windows XP: Control Panel

Nortel Business Secure Router 252 Configuration — Advanced

222 Appendix A Setting up your computer IP address

3 Right-click Local Area Connection and then click Properties .

Figure 121 Windows XP: Control Panel: Network Connections: Properties

4 Select Internet Protocol (TCP/IP) (under the General tab in Win XP) and click Properties .

Figure 122 Windows XP: Local Area Connection Properties

NN47923-501

Appendix A Setting up your computer IP address 223

5 The Internet Protocol TCP/IP Properties window appears (the General tab in Windows XP).

— If you have a dynamic IP address, click Obtain an IP address automatically .

— If you have a static IP address, click Use the following IP Address and fill in the IP address , Subnet mask , and Default gateway fields. Click

Advanced .

Figure 123 Windows XP: Advanced TCP/IP settings

6 If you do not know your gateway IP address, remove any previously installed gateways in the IP Settin gs tab and click OK .

Ë Do one or more of the following if you want to configure additional IP addresses:

— In the IP Settings tab, in IP addresses, click Add .

— In TCP/IP Address , type an IP address in IP address and a subnet mask in Subnet mask , and then click Add .

— Repeat the above two steps for each IP address you want to add.

— Configure additional default gateways in the IP Settings tab by clicking

Add in Default gateways .

Nortel Business Secure Router 252 Configuration — Advanced

224 Appendix A Setting up your computer IP address

— In TCP/IP Gateway Address , type the IP address of the default gateway in Gateway . To manually configure a default metric (the number of transmission hops), clear the Automatic metric check box and type a metric in Metric .

— Click Add .

— Repeat the previous three steps for each default gateway you want to add.

— Click OK when finished.

7 In the Internet Protocol TCP/IP Properties window (the General tab in

Windows XP):

— Click Obtain DNS server address automatically if you do not know your DNS server IP addresses.

— If you know your DNS server IP addresses, click Use the following DNS server addresses , and type them in the Preferred DNS server and

Alternate DNS server fields.

If you have previously configured DNS servers, click Advanced and then the DNS tab to order them.

Figure 124 Windows XP: Internet Protocol (TCP/IP) properties

NN47923-501

8 Click OK to close the Internet Protocol (TCP/IP) Properties window.

9 Click OK to close the Local Area Connection Properties window.

Appendix A Setting up your computer IP address 225

10 Turn on your Business Secure Router and restart your computer (if prompted).

Verifying Settings

1 Click Start , All Programs , Accessories and then Command Prompt .

2 In the Command Prompt window, type ipconfig and press [ENTER]. You can also open Network Connections , right-click a network connection, click

Status and then click the Support tab.

Macintosh OS 8/9

1 Click the Apple menu, Control Panel and double-click TCP/IP to open the

TCP/IP Control Panel .

Figure 125 Macintosh OS 8/9: Apple Menu

Nortel Business Secure Router 252 Configuration — Advanced

226 Appendix A Setting up your computer IP address

2 Select Ethernet built-in from the Connect via list.

Figure 126 Macintosh OS 8/9: TCP/IP

NN47923-501

3 For dynamically assigned settings, select Using DHCP Server from the

Configure: list.

4 For statically assigned settings, do the following:

— From the Configure box, select Manually .

— Type your IP address in the IP Address box.

— Type your subnet mask in the Subnet mask box.

— Type the IP address of your Business Secure Router in the Router address box.

5 Close the TCP/IP Control Panel .

6 Click Save if prompted, to save changes to your configuration.

7 Turn on your Business Secure Router and restart your computer (if prompted).

Verifying Settings

Check your TCP/IP properties in the TCP/IP Control Panel window.

Appendix A Setting up your computer IP address 227

Macintosh OS X

1 Click the Apple menu, and click System Preferences to open the System

Preferences window.

Figure 127 Macintosh OS X: Apple menu

2 Click Network in the icon bar.

— Select Automatic from the Location list.

— Select Built-in Ethernet from the Show list.

— Click the TCP/IP tab.

3 For dynamically assigned settings, select Using DHCP from the Configure list.

Figure 128 Macintosh OS X: Network

Nortel Business Secure Router 252 Configuration — Advanced

228 Appendix A Setting up your computer IP address

4 For statically assigned settings, do the following:

— From the Configure box, select Manually .

— Type your IP address in the IP Address box.

— Type your subnet mask in the Subnet mask box.

— Type the IP address of your Business Secure Router in the Router address box.

5 Click Apply Now and close the window.

6 Turn on your Business Secure Router and restart your computer (if prompted).

Verifying settings

Check your TCP/IP properties in the Network window.

NN47923-501

229

Appendix B

Triangle Route

The Ideal Setup

When the firewall is on, your Business Secure Router acts as a secure gateway between your LAN and the Internet. In an ideal network topology, all incoming and outgoing network traffic passes through the Business Secure Router to protect your LAN against attacks.

Figure 129 Ideal Setup

Business Secure Router

The Triangle Route Problem

You can have more than one connection to the Internet (through one or more

ISPs). If an alternate gateway is on the LAN (and its IP address is in the same subnet as the Business Secure Router LAN IP address), the triangle route (also called asymmetrical route) problem can occur. The steps below describe the triangle route problem.

A traffic route is a path for sending or receiving data packets between two

Ethernet devices. Some companies have more than one alternate route to one or more ISPs. If the LAN and ISPs are in the same subnet, the triangle route problem can occur. The steps below describe the triangle route problem.

Nortel Business Secure Router 252 Configuration — Advanced

230 Appendix B Triangle Route

1 A computer on the LAN initiates a connection by sending out a SYN packet to a receiving server on the WAN.

2 The Business Secure Router reroutes the SYN packet through Gateway B on the LAN to the WAN.

3 The reply from the WAN goes directly to the computer on the LAN without going through the Business Secure Router.

As a result, the Business Secure Router resets the connection, as the connection is not acknowledged.

Figure 130 Triangle Route Problem

Business Secure Router

The Triangle Route Solutions

IP aliasing

Using IP alias, you can partition your network into logical sections over the same

Ethernet interface. Your Business Secure Router supports up to three logical LAN interfaces with the Business Secure Router being the gateway for each logical network. By putting your LAN and Gateway B in different subnets, all returning network traffic must pass through the Business Secure Router to your LAN. The following steps describe such a scenario.

1 A computer on the LAN initiates a connection by sending a SYN packet to a receiving server on the WAN.

NN47923-501

Appendix B Triangle Route 231

2 The Business Secure Router reroutes the packet to Gateway B, which is in

Subnet 2.

3 The reply from WAN goes to the Business Secure Router.

4 The Business Secure Router ends the response to the computer in Subnet 1.

Figure 131 IP Alias

WAN

Business Secure Router

Nortel Business Secure Router 252 Configuration — Advanced

232 Appendix B Triangle Route

NN47923-501

Appendix C

Importing certificates

This appendix shows examples for importing certificates.

Import Business Secure Router certificates into

Netscape Navigator

In Netscape Navigator, you can permanently trust the Business Secure Router server certificate by importing it into your operating system as a trusted certification authority.

Select Accept This Certificate Permanently in Figure 132 to do this.

Figure 132 Security Certificate

233

Nortel Business Secure Router 252 Configuration — Advanced

234 Appendix C Importing certificates

Importing the Business Secure Router Certificate into

Internet Explorer

For Internet Explorer to trust a self-signed certificate from the Business Secure

Router, simply import the self-signed certificate into your operating system as a trusted certification authority.

To have Internet Explorer trust a Business Secure Router certificate issued by a certificate authority, import the certificate authority’s certificate into your operating system as a trusted certification authority.

The following example procedure shows how to import the Business Secure

Router’s (self-signed) server certificate into your operating system as a trusted certification authority .

1 In Internet Explorer, double click the lock shown in Figure 133 .

Figure 133 Login Screen

NN47923-501

Appendix C Importing certificates 235

2 Click Install Certificate to open the Install Certificate wizard.

Figure 134 Certificate General Information before Import

Nortel Business Secure Router 252 Configuration — Advanced

236 Appendix C Importing certificates

3 Click Next to begin the Install Certificate wizard.

Figure 135 Certificate Import Wizard 1

NN47923-501

Appendix C Importing certificates 237

4 Select where you want to store the certificate and click Next .

Figure 136 Certificate Import Wizard 2

Nortel Business Secure Router 252 Configuration — Advanced

238 Appendix C Importing certificates

5 Click Finish to complete the Import Certificate wizard.

Figure 137 Certificate Import Wizard 3

6 Click Yes to add the Business Secure Router certificate to the root store.

Figure 138 Root Certificate Store

NN47923-501

Appendix C Importing certificates 239

Figure 139 Certificate General Information after Import

Enrolling and Importing SSL Client Certificates

The SSL client needs a certificate if Authenticate Client Certificates is selected on the Business Secure Router.

You must have imported at least one trusted CA to the Business Secure Router in order for the Authenticate Client Certificates to be active (see “Certificates” in

Nortel Business Secure Router 252 Configuration — Basics (NN47923-500) for details).

Apply for a certificate from a Certification Authority (CA) that is trusted by the

Business Secure Router (see the Business Secure Router’s Trusted CA WebGUI screen— Figure 140 ).

Nortel Business Secure Router 252 Configuration — Advanced

240 Appendix C Importing certificates

Figure 140 Business Secure Router Trusted CA screen

NN47923-501

The CA sends you a package containing the CA’s trusted certificates, your personal certificates and a password to install the personal certificates.

Appendix C Importing certificates 241

Installing the CA’s certificate

1 Double click the CA’s trusted certificate to produce a screen similar to the one shown in Figure 141 .

Figure 141 CA certificate example

2 Click Install Certificate and follow the wizard as shown earlier in this appendix.

Installing your personal certificates

You need a password in advance. The CA can issue the password or you can specify it during the enrollment. Double-click the personal certificate given to you by the CA to produce a screen similar to Figure 142

Nortel Business Secure Router 252 Configuration — Advanced

242 Appendix C Importing certificates

1 Click Next to begin the wizard.

Figure 142 Personal certificate import wizard 1

NN47923-501

Appendix C Importing certificates 243

2 The file name and path of the certificate you double-clicked automatically appears in the File name text box. Click Browse if you wish to import a different certificate.

Figure 143 Personal certificate import wizard 2

Nortel Business Secure Router 252 Configuration — Advanced

244 Appendix C Importing certificates

3 Enter the password given to you by the CA.

Figure 144 Personal certificate import wizard 3

NN47923-501

Appendix C Importing certificates 245

4 Have the wizard determine where the certificate should be saved on your computer or select Place all certificates in the following store and choose a different location.

Figure 145 Personal certificate import wizard 4

Nortel Business Secure Router 252 Configuration — Advanced

246 Appendix C Importing certificates

5 Click Finish to complete the wizard and begin the import process.

Figure 146 Personal certificate import wizard 5

6 Figure 147 shows the screen that appears when the certificate is correctly installed on your computer.

Figure 147 Personal certificate import wizard 6

NN47923-501

Appendix C Importing certificates 247

Using a certificate when accessing the Business Secure

Router example

Use the following procedure to access the Business Secure Router via HTTPS.

1 Enter https://Business Secure Router IP Address/ in your browser’s web address field.

Figure 148 Access the Business Secure Router via HTTPS

2 When Authenticate Client Certificates is selected on the Business Secure

Router, you are asked to select a personal certificate to send to the Business

Secure Router. This screen displays even if you only have a single certificate, as shown in Figure 149 .

Figure 149 SSL client authentication

Nortel Business Secure Router 252 Configuration — Advanced

248 Appendix C Importing certificates

3 The Business Secure Router login screen appears.

Figure 150 Business Secure Router secure login screen

NN47923-501

249

Appendix D

PPPoE

PPPoE in action

An ADSL modem bridges a PPP session over Ethernet (PPP over Ethernet, RFC

2516) from your PC to an ATM PVC (Permanent Virtual Circuit), which connects to a DSL Access Concentrator where the PPP session terminates (see Figure 151 ).

One PVC can support any number of PPP sessions from your LAN. PPPoE provides access control and billing functionality in a manner similar to dial-up services using PPP.

Benefits of PPPoE

PPPoE offers the following benefits:

• It provides you with a familiar dial-up networking (DUN) user interface.

• It lessens the burden on the carriers of provisioning virtual circuits all the way to the ISP on multiple switches for thousands of users. For GSTN (PSTN and

ISDN), the switching fabric is already in place.

• It allows the ISP to use the existing dial-up model to authenticate and

(optionally) to provide differentiated services.

Traditional dial-up scenario

Figure 151 depicts a typical hardware configuration in which the PCs use traditional dial-up networking.

Nortel Business Secure Router 252 Configuration — Advanced

250 Appendix D PPPoE

Figure 151 Single-PC per router hardware configuration

Business Secure Router

How PPPoE works

The PPPoE driver makes the Ethernet appear as a serial link to the PC and the PC runs PPP over the Ethernet, while the modem bridges the Ethernet frames to the

Access Concentrator (AC). Between the AC and an ISP, the AC acts as an L2TP

(Layer 2 Tunneling Protocol) LAC (L2TP Access Concentrator) and tunnels the

PPP frames to the ISP. The L2TP tunnel is capable of carrying multiple PPP sessions.

With PPPoE, the VC (Virtual Circuit) is equivalent to the dial-up connection and runs between the modem and the AC, as opposed to all the way to the ISP.

However, the PPP negotiation is between the PC and the ISP.

Business Secure Router as a PPPoE client

When using the Business Secure Router as a PPPoE client, the PCs on the LAN see only the Ethernet and are not aware of the PPPoE. This alleviates the administrator from having to manage the PPPoE clients on the individual PCs.

NN47923-501

Figure 152 Business Secure Router as a PPPoE Client

Appendix D PPPoE 251

Business Secure Router

Nortel Business Secure Router 252 Configuration — Advanced

252 Appendix D PPPoE

NN47923-501

Appendix E

Hardware specifications

Table 49 General specifications

Power Specification

MTBF

I/P AC 100~240V 50/60Hz; O/P DC 18V 1.1A

218200 hrs (Mean Time Between Failures)

Operation Temperature 0º C ~ 40º C

ADSL Specification for WAN ADSL/ADSL2/ADSL2+ with TR-067 compliance

Ethernet Specification for

LAN/ VPN Ports

10/100 Mb/s Half / Full autonegotiation, autosensing

253

Cable pin assignments

In a serial communications connection, generally a computer is DTE

(DataTerminal Equipment) and a modem is DCE (Data Circuit-terminating

Equipment). The Business Secure Router is DCE when you connect a computer to the console port. The Business Secure Router is DTE when you connect a modem to the dial backup port.

Nortel Business Secure Router 252 Configuration — Advanced

254 Appendix E Hardware specifications

Figure 153 Console or dial backup port pin layouts 1

P 5

P 9

P 1

P 6

Table 50 Console or dial backup port pin assignments

CONSOLE Port RS – 232 (Female) DB-9F

Pin 1 = NON

Pin 2 = DCE-TXD

Pin 3 = DCE –RXD

Pin 4 = DCE –DSR

Pin 5 = GND

Pin 6 = DCE –DTR

Pin 7 = DCE –CTS

Pin 8 = DCE –RTS

PIN 9 = NON

The CON/AUX port also has these pin assignments. The CON/AUX switch changes the setting in the firmware only and does not change the CON/AUX port’s pin assignments.

DIAL BACKUP RS – 232 (Male)

DB-9M

Pin 1 = NON

Pin 2 = DTE-RXD

Pin 3 = DTE-TXD

Pin 4 = DTE-DTR

Pin 5 = GND

Pin 6 = DTE-DSR

Pin 7 = DTE-RTS

Pin 8 = DTE-CTS

PIN 9 = NON.

Business Secure Routers with a

CON/AUX port also have a 9-pin adapter for the console cable with these pin assignments on the male end.

1 Products without flow control only use pins 2, 3, and 5.

NN47923-501

Appendix E Hardware specifications 255

Figure 154 Ethernet cable pin assignments

WAN/LAN Ethernet Cable Pin Layout:

Straight-Through

(Switch)

1 IRD +

2 IRD -

3 OTD +

6 OTD -

(Adapter)

1 OTD +

2 OTD -

3 IRD +

6 IRD -

Crossover

(Switch)

1 IRD +

2 IRD -

3 OTD +

6 OTD -

(Switch)

1 IRD +

2 IRD -

3 OTD +

6 OTD -

AC Power Adapter Specifications

Use only power supplies listed in the user instructions.

Phihong, Model PSA21R-180

Leader, Model MU18-2180100-XX (XX can be A1, A2, A3, B2 or C5 for the different plugs used)

Nortel Business Secure Router 252 Configuration — Advanced

256 Appendix E Hardware specifications

NN47923-501

257

Appendix F

IP subnetting

IP addressing

Routers route based on the network number. The router that delivers the data packet to the correct destination host uses the host ID.

IP classes

An IP address is made up of four octets (eight bits), written in dotted decimal notation, for example, 192.168.1.1. IP addresses are categorized into different classes. The class of an address depends on the value of its first octet.

• Class A addresses have a 0 in the left-most bit. In a class A address, the first octet is the network number and the remaining three octets make up the host

ID.

• Class B addresses have a 1 in the left-most bit and a 0 in the next left most bit.

In a class B address, the first two octets make up the network number and the two remaining octets make up the host ID.

• Class C addresses begin (starting from the left) with 1 1 0. In a class C address, the first three octets make up the network number and the last octet is the host ID.

• Class D addresses begin with 1 1 1 0. Class D addresses are used for multicasting. (There is also a class “E” address, which is reserved for future use.)

Nortel Business Secure Router 252 Configuration — Advanced

258 Appendix F IP subnetting

IP Address:

Class A

Class B

Class C

Table 51 Classes of IP addresses

110

Octet 1

Network number

Octet 2

Host ID

Network number

Octet 3 Octet 4

Host ID

Network number Host ID

Note: Host IDs of all zeros or all ones are not allowed.

Class

Class A

Class B

Class C

Class D

Therefore:

A class C network (8 host bits) can have 2 8 –2 or 254 hosts.

A class B address (16 host bits) can have 2 16 –2 or 65 534 hosts.

A class A address (24 host bits) can have 2 24 –2 hosts (approximately 16 million hosts).

Since the first octet of a class A IP address must contain a 0, the first octet of a class A address can have a value of 0 to 127.

Similarly the first octet of a class B must begin with 10, therefore the first octet of a class B address has a valid range of 128 to 191. The first octet of a class C address begins with 110, and therefore has a range of 192 to 223.

Table 52 Allowed IP address range By class

Allowed Range of First Octet (Binary) Allowed Range of First Octet (decimal)

0 0000000 to 0 1111111

10 000000 to 10 111111

110 00000 to 110 11111

1110 0000 to 1110 1111

0 to 127

128 to 191

192 to 223

224 to 239

NN47923-501

Appendix F IP subnetting 259

Subnet masks

A subnet mask is used to determine which bits are part of the network number, and which bits are part of the host ID (using a logical AND operation). A subnet mask contains 32 bits. If there is a 1 in the bit, then the corresponding bit of the IP address is part of the network number. If a bit in the subnet mask is 0 then the corresponding bit in the IP address is part of the host ID.

Subnet masks are expressed in dotted decimal notation just as IP addresses are.

The natural masks for class A, B, and C IP addresses are as follows.

Table 53 Natural Masks

Class

Natural mask

255.0.0.0

255.255.0.0

255.255.255.0

Subnetting

With subnetting, the class arrangement of an IP address is ignored. For example, a class C address no longer has to have 24 bits of network number and 8 bits of host

ID. With subnetting, some of the host ID bits are converted into network number bits. By convention, subnet masks always consist of a continuous sequence of ones beginning from the left most bit of the mask, followed by a continuous sequence of zeros, for a total number of 32 bits.

Since the mask is always a continuous number of ones beginning from the left, followed by a continuous number of zeros for the remainder of the 32-bit mask, you can simply specify the number of ones instead of writing the value of each octet. This is usually specified by writing a / followed by the number of bits in the mask after the address.

For example, 192.1.1.0 /25 is equivalent to saying 192.1.1.0 with mask

255.255.255.128.

Nortel Business Secure Router 252 Configuration — Advanced

260 Appendix F IP subnetting

Table 54 shows all possible subnet masks for a class C address using both notations.

Table 54 Alternative Subnet Mask Notation

Subnet mask IP address

255.255.255.0

255.255.255.128

255.255.255.192

255.255.255.224

255.255.255.240

255.255.255.248

255.255.255.252

Subnet mask 1 Bits

/24

/25

/26

/27

/28

/29

/30

Last octet bit value

0000 0000

1000 0000

1100 0000

1110 0000

1111 0000

1111 1000

1111 1100

The first mask shown is the class C natural mask. Normally, if no mask is specified, it is understood that the natural mask is being used.

Example: two subnets

As an example, you have a class C address 192.168.1.0 with subnet mask of

255.255.255.0.

IP Address

IP Address (Binary)

Subnet Mask

Subnet Mask (Binary)

Network number

192.168.1.

11000000.10101000.00000001.

255.255.255.

11111111.11111111.11111111.

Host ID

00000000

The first three octets of the address make up the network number (class C). You want to have two separate networks.

NN47923-501

Appendix F IP subnetting 261

Divide the network 192.168.1.0 into two separate subnets by converting one of the host ID bits of the IP address to a network number bit. The borrowed host ID bit can be either 0 or 1, thus giving two subnets; 192.168.1.0 with mask

255.255.255.128 and 192.168.1.128 with mask 255.255.255.128.

Note: In the following charts, shaded or bolded last-octet bit values indicate host ID bits borrowed to form network ID bits. The number of borrowed host ID bits determines the number of subnets you can have.

The remaining number of host ID bits (after borrowing) determines the number of hosts you can have on each subnet.

Table 55 Subnet 1

IP Address

IP Address (Binary)

Subnet Mask

Subnet Mask (Binary)

Subnet Address: 192.168.1.0

Broadcast Address:

192.168.1.127

Network number

192.168.1.

11000000.10101000.00000001.

255.255.255.

11111111.11111111.11111111.

Lowest Host ID: 192.168.1.1

Highest Host ID: 192.168.1.126

Table 56 Subnet 2

Network number

IP Address

IP Address (Binary)

Subnet Mask

Subnet Mask (Binary)

192.168.1.

11000000.10101000.00000001.

255.255.255.

11111111.11111111.11111111.

Subnet Address: 192.168.1.128

Lowest Host ID: 192.168.1.129

Broadcast Address:

192.168.1.255

Highest Host ID: 192.168.1.254

Last Octet bit value

0 0000000

128

1 0000000

Last octet bit value

128

1 0000000

128

1 0000000

The remaining 7 bits determine the number of hosts each subnet can have. Host

IDs of all zeros represent the subnet itself and host IDs of all ones are the broadcast address for that subnet, so the actual number of hosts available on each subnet in the example above is 2 7 – 2 or 126 hosts for each subnet.

Nortel Business Secure Router 252 Configuration — Advanced

262 Appendix F IP subnetting

192.168.1.0 with mask 255.255.255.128 is the subnet itself, and 192.168.1.127 with mask 255.255.255.128 is the directed broadcast address for the first subnet.

Therefore, the lowest IP address that can be assigned to an actual host for the first subnet is 192.168.1.1 and the highest is 192.168.1.126. Similarly the host ID range for the second subnet is 192.168.1.129 to 192.168.1.254.

Example: four subnets

The above example illustrated using a 25-bit subnet mask to divide a class C address space into two subnets. Similarly to divide a class C address into four subnets, you need to borrow two host ID bits to give four possible combinations of 00, 01, 10 and 11. The subnet mask is 26 bits

(11111111.11111111.11111111.

11 000000) or 255.255.255.192. Each subnet contains 6 host ID bits, giving 2 6 -2 or 62 hosts for each subnet (all 0s is the subnet itself, all 1s is the broadcast address on the subnet).

Table 57 Subnet 1

Network number

IP Address

IP Address (Binary)

192.168.1.

11000000.10101000.00000001.

Subnet Mask (Binary)

Subnet Address: 192.168.1.0

11111111.11111111.11111111.

Lowest Host ID: 192.168.1.1

Broadcast Address: 192.168.1.63 Highest Host ID: 192.168.1.62

Last octet bit value

00 000000

11 000000

Table 58 Subnet 2

IP Address

IP Address (Binary)

Subnet Mask (Binary)

Subnet Address: 192.168.1.64

Broadcast Address:

192.168.1.127

Network number

192.168.1.

11000000.10101000.00000001.

11111111.11111111.11111111.

Lowest Host ID: 192.168.1.65

Highest Host ID: 192.168.1.126

Last octet bit value

01 000000

11 000000

NN47923-501

Appendix F IP subnetting 263

Table 59 Subnet 3

Network number

IP Address

IP Address (Binary)

192.168.1.

11000000.10101000.00000001.

Subnet Mask (Binary) 11111111.11111111.11111111.

Subnet Address: 192.168.1.128

Lowest Host ID: 192.168.1.129

Broadcast Address:

192.168.1.191

Highest Host ID: 192.168.1.190

Last Octet Bit Value

128

10 000000

11 000000

Table 60 Subnet 4

Network number

IP Address

IP Address (Binary)

192.168.1.

11000000.10101000.00000001.

Subnet Mask (Binary)

Subnet Address: 192.168.1.192

11111111.11111111.11111111.

Lowest Host ID: 192.168.1.193

Broadcast Address: 192.168.1.255 Highest Host ID: 192.168.1.254

Last Octet Bit Value

192

11 000000

Example: eight subnets

Subnet

Similarly, use a 27-bit mask to create 8 subnets (001, 010, 011, 100, 101, 110).

Table 61 shows class C IP address last-octet values for each subnet.

Table 61 Eight subnets

Subnet Address

128

160

First Address

129

161

Last Address

126

158

190

Broadcast Address

127

159

191

Nortel Business Secure Router 252 Configuration — Advanced

264 Appendix F IP subnetting

Subnet

Table 61 Eight subnets

Subnet Address

192

224

First Address

193

225

Last Address

222

254

Broadcast Address

223

255

Table 62 is a summary for class C subnet planning.

Table 62 Class C subnet planning

No. Borrowed Host Bits

Subnet Mask No. Subnets

255.255.255.128 (/25) 2

255.255.255.192 (/26) 4

255.255.255.224 (/27) 8

255.255.255.240 (/28) 16

255.255.255.248 (/29) 32

255.255.255.252 (/30) 64

255.255.255.254 (/31) 128

No. Hosts per Subnet

126

Subnetting with Class A and Class B networks.

For class A and class B addresses the subnet mask also determines which bits are part of the network number and which are part of the host ID.

A class B address has two host ID octets available for subnetting and a class A address has three host ID octets (see Table 51 ) available for subnetting.

Table 63 is a summary for class B subnet planning.

Table 63 Class B subnet planning

No. “Borrowed” Host Bits

Subnet Mask

255.255.128.0 (/17)

255.255.192.0 (/18)

255.255.224.0 (/19)

255.255.240.0 (/20)

No. Subnets

No. Hosts per Subnet

32 766

16 382

8 190

4 094

NN47923-501

Table 63 Class B subnet planning

No. “Borrowed” Host Bits

Subnet Mask No. Subnets

255.255.248.0 (/21)

255.255.252.0 (/22)

255.255.254.0 (/23)

255.255.255.0 (/24)

128

256

255.255.255.128 (/25) 512

255.255.255.192 (/26) 1 024

255.255.255.224 (/27) 2 048

255.255.255.240 (/28) 4 096

255.255.255.248 (/29) 8 192

255.255.255.252 (/30) 16 384

255.255.255.254 (/31) 32 768

Appendix F IP subnetting 265

No. Hosts per Subnet

2 046

1 022

510

254

126

Nortel Business Secure Router 252 Configuration — Advanced

266 Appendix F IP subnetting

NN47923-501

267

Appendix G

Command Interpreter

The following describes how to use the command interpreter. Enter 24 in the main menu to bring up the system maintenance menu. Enter 8 to go to Menu 24.8 -

Command Interpreter Mode . See the included disk or www.nortel.com for more detailed information on these commands.

Note: Use of undocumented commands or misconfiguration can damage the unit and possibly render it unusable.

Command Syntax

• The command keywords are in Courier New font.

• Enter the command keywords exactly as shown. Do not abbreviate.

• The required fields in a command are enclosed in angle brackets <> .

• The optional fields in a command are enclosed in square brackets [] .

• The | symbol means or.

For example, sys filter netbios config <type> <on|off> means that you must specify the type of netbios filter and whether to turn it on or off.

Command usage

A list of valid commands can be found by typing help or ?

at the command prompt. Always type the full command. Type exit to return to the SMT main menu when you are finished.

Nortel Business Secure Router 252 Configuration — Advanced

268 Appendix G Command Interpreter

Sys commands

Command atsh callhist

Table 64 lists and describes the system commands. Each of these commands must be preceded by sys . For example, type sys stdio 60 to set the management session inactivity timeout to 60 minutes.

Table 64 Sys commands

Description

Displays the MRD field. display remove <index>

Displays the call history.

Removes an entry from the call history.

client name password

[name]

[password]

Sets or displays the client logon name.

Sets or displays the client logon password.

Sets or displays the country code.

countrycode [countrycode] datetime date [year month date] domainname time period sync display node

[hour [min [sec]]]

[day] edit <filename> extraphnum

[2 nd phone num]

<num>

Sets or displays the system’s current date.

Sets or displays the system time.

Sets how often the Business Secure

Router gets the date and time from the time server.

Gets the date and time from the time server.

Displays the domain name that the device sends to the LAN DHCP clients.

Edits the system preset text files such as autoexec.net.

Maintains extra phone numbers for outgoing (dial backup) calls.

Adds extra phone numbers.

Displays the extra phone numbers.

Sets all extra phone numbers to remote node <num>.

NN47923-501

Appendix G Command Interpreter 269

Table 64 Sys commands

Command feature firmware firewall reset

Description

Removes extra phone numbers.

Resets node and mask.

Displays a list of the device’s major features.

Displays the ISDN firmware type.

See “Sys firewall commands” on page 294 for information about the system firewall commands.

Sets or displays the system name.

hostname [hostname] logs category

8021x access [0:none/1:log/

2:alert/3:both] attack [0:none/1:log/

2:alert/3:both] cdr [0:none/1:log] display error [0:none/1:log/

2:alert/3:both] icmp [0:none/1:log] ike [0:none/1:log/2:alert/

3:both] ipsec [0:none/1:log/

2:alert/3:both] javablocked [0:none/1:log] mten [0:none/1:log] packetfilter [0:none/

1:log] ppp [0:none/1:log] remote [0:none/1:log] tcpreset [0:none/1:log] upnp [0:none/1:log]

Records logs for IEEE 802.1X.

Records, sends alerts, or both for access control logs.

Records, sends alerts, or both for firewall attack logs.

Records Call Detail Record logs.

Displays the category settings.

Records, sends alerts, or both for system error logs.

Records ICMP logs.

Records, sends alerts or both for access control logs.

Records the access control logs

Records the java blocked logs.

Records the system maintenance logs.

Records the packet filter logs.

Records the PPP logs.

Records the remote management logs.

Records the TCP reset logs.

Records the UPnP logs.

Nortel Business Secure Router 252 Configuration — Advanced

270 Appendix G Command Interpreter

Command

Table 64 Sys commands clear display urlblocked [0:none/1:log/

2:alert/3:both] urlforward [0:none/1:log]

Description

Records and/or sends alerts for web access blocked logs.

Records web access forward logs.

Clears the log.

Displays all logs or specifies a category of logs.

errlog load clear disp online

Clears the error log.

Displays the error log.

Turns the error log online display on or off.

Loads the log settings buffer. Use this command before you configure the log settings. Use sys logs save after you configure the log settings.

mail alertAddr [mail address] clearLog [0:no/1:yes] display logAddr [mail address] schedule display schedule hour [0-23] schedule minute [0-59]

Sends alerts to this e-mail address.

Enables the switch to clear the log after sending logs via e-mail.

Displays the logs and alerts mail settings.

Sends logs to this e-mail address.

Displays the mail schedule.

Sets the hour to send logs.

Sets the minute to send the logs.

Sets the mail schedule policy.

schedule policy [0:full/

1:hourly/2:daily/3:weekly/

4:none] schedule week [0:sun/1:mon/

2:tue/3:wed/4:thu/5:fri/

6:sat] server [domainName/IP]

Sets the day of the week to send weekly logs.

Sets the domain name or IP address of the mail server to which the logs are sent.

NN47923-501

Table 64 Sys commands

Command subject [mail subject] auth user passwd save syslog active [0:no/1:yes] display facility [Local ID(1-7)] server [domainName/IP] consolidate switch <0:on|1:off> period

updateSvrIP msglist

Appendix G Command Interpreter 271

Description

Sets the log e-mail’s subject.

Enables or disables SMTP authentication.

Sets the SMTP authentication username.

Sets the SMTP authentication password.

Saves the log settings from the buffer.

Enables or disables syslog logging.

Displays the syslog settings.

Specifies the file to which the device logs the syslog messages.

Specifies the IP address of the syslog server the syslogs are sent.

Turns log consolidation on or off.

Sets the consolidation period (in seconds).

Displays the consolidated messages.

Sets how often to resolve the mail and syslog server domain name to an IP address.

switch reboot stdio tos bmlog <0:no|1:yes> display trilog <0:no|1:yes>

Turns the broadcast or multicast log on or off.

Displays switch settings.

Turns triangle route logging on or off.

[0:cold boot/1: immediate reboot/2: bootModule debug mode]

[minute]

Restarts the device.

Sets or displays the management terminal idle timeout value.

Nortel Business Secure Router 252 Configuration — Advanced

272 Appendix G Command Interpreter

Table 64 Sys commands

Command display trcdisp debug listPerHost sessPerHost timeout display icmp igmp tcpsyn tcp tcpfin udp gre esp ah others parse, brief, disp trclog switch online

[on|off]

NN47923-501

Description

Shows all runtime Temporarily Open

Sessions.

Turns TOS debug message on or off.

Displays all hosts session counts.

Sets the session per host limit.

Displays all TOS (Temporarily Open

Session) timeout information.

Sets the ICMP session idle timeout value.

Sets the IGMP session idle timeout value.

Sets the SYN TCP session idle timeout value.

Sets the TCP session idle timeout value.

Sets the TCP FIN session idle timeout value.

Sets the UDP-session idle-timeout value.

Sets the GRE-session idle-timeout value.

Sets the ESP-session idle-timeout value.

Sets the AH-session idle-timeout value.

Sets the idle-timeout value for other sessions.

Sets the level of detail that should be displayed. “parse” displays the most detail and “disp” displays the least.

Enables or disables the system trace log or displays the current setting.

Enables or disables the trace log onscreen display (for example, in the

Telnet management window).

Command trcpacket

Appendix G Command Interpreter 273

Table 64 Sys commands level [level] type <bitmap> disp clear call encapmask [mask] create destroy string

<entry> <size> outgoing|bothway]

[on|off] switch [on|off] disp udp udp switch [on|off] udp addr udp port

<addr>

<port>

Description

Sets the level (1-10) of trace logs (1 shows the least) to display.

Uses hexadecimal characters to set the type of trace logs to record.

Shows the trace log.

Erases the trace log.

Shows call events.

Shows which type of encapsulation the trace log records, or sets the encapsulation if you specify the encapsulation’s hexadecimal character.

Uses trace packets to capture parts of packets in order to see the packet flow from one interface to another.

Creates a packet trace buffer.

Removes the packet trace buffer.

Sets the packet trace direction for a given channel.

Enables or disables the sending of a log to the trace packet buffer when configuration changes are made or displays the current setting if neither on/off is specified.

Enables or disables packet trace or displays the current setting if neither on nor off is specified.

Displays the trace packets.

Sends the trace packets to another system using UDP.

Enables or disables the sending of the trace packets to another system using

UDP or displays the current setting.

Sets the target IP address for sending trace packets using UDP.

Sets the UDP port (should match that of the target IP address) for sending trace packets using UDP.

Nortel Business Secure Router 252 Configuration — Advanced

274 Appendix G Command Interpreter

Table 64 Sys commands

Command version view wdog romreset pwderrtm upnp brief

Description

Displays detailed packet details of the packet range specified.

Displays a brief listing of packet contents.

Displays the RAS code and driver versions.

Displays the specified text file.

switch cnt

[on|off]

[value] server

Turns the watchdog firmware protection feature on or off.

Sets (0-34 463) or displays the current watchdog count (in 1.6 sec units).

Restores the factory default configuration file.

Use these commands to configure remote server management.

access

Sets the server access type.

disp

Loads server information.

Displays server information.

port <telnet|ftp|web|snmp>

<port>

Sets the server port.

save Saves server information.

Sets server secure IP address.

[minute] Sets or displays the password error blocking timeout value.

active [0:no/1:yes] config [0:deny/1:permit] display firewall [0:deny/1:pass]

Activates or deactivates the saved

UPnP settings.

Allows users to make configuration changes through UPnP.

Displays UPnP information

Allows UPnP to pass through the firewall.

NN47923-501

Appendix G Command Interpreter 275

Command

Table 64 Sys commands load reserve save

[0:deny/1:permit] socket filter ddns cpu

Description

Saves UPnP information.

Displays the system socket’s ID #, type, control block address (PCB), IP address and port number of peer device connected to the socket

(Remote Socket) and task control block

(Owner).

netbios debug display restart logout display disp config <0:Between LAN and

WAN/ 3: IPSec Pass through/

4: Trigger Dial> <on|off>

Displays the current NetBIOS filter modes.

Sets NetBIOS filters.

<level>

Enables or disables DDNS service.

Displays DDNS information.

Restarts DDNS.

This command has no effect.

Displays the CPU utilization.

Nortel Business Secure Router 252 Configuration — Advanced

276 Appendix G Command Interpreter

Exit Command

Table 65 Exit Command

Command exit

Description

Ends the command interpreter session.

Ethernet Commands

Command config driver cnt

Table 66 lists and describes the Ethernet commands. Each of these commands must be preceded by ether . For example, type ether config to display information on the LAN configuration.

Table 66 Ether Commands

Description

Displays LAN configuration information.

version edit status disp <name>

<ch_name>

Displays the Ethernet driver counters.

Shows the LAN status.

Displays the Ethernet device type.

load mtu accessblock speed

<1:LAN>

<value>

<0:disable 1:enable>

<auto|10/half|10/ full|100/half|100/ full>

Loads Ethernet (1:LAN) data from the System

Parameters Table.

Sets the Ethernet data Maximum Transmission

Unit.

Blocks Internet access.

Sets the Ethernet data speed and duplex.

save Saves Ethernet data to the System Parameters

Table.

dynamic

Port dump Displays the relationship between physical port and channel.

NN47923-501

Appendix G Command Interpreter 277

Command set spt

Table 66 Ether Commands

Description

Sets physical port to a specific channel.

Displays channel setting stored in SPT.

IP commands

Command address alias aliasdis

Table 67 lists and describes the IP commands. Each of these commands must be preceded by ip . For example, type ip address to display the host IP address.

Table 67 IP commands

[addr]

<iface>

<0|1>

Description

Displays the host IP address.

Sets an alias for the specified interface.

Disables or enables the alias for the specified interface.

arp dhcp status attpret force

<iface>

<on|off>

<iface>

Displays an interface’s IP Address Resolution

Protocol status.

Allows or disallows the device to receive ARP from a different network or not.

Enables or disables the ARP timeout function.

client status release renew

[option]

Releases the DHCP client IP address.

Renews the DHCP client IP address.

Displays the DHCP status.

dns query system address <ip address> name <host name>

Displays the domain name of an IP address.

display

Displays the IP address of a domain name.

Configures the system DNS server settings.

Shows the system DNS server settings.

Nortel Business Secure Router 252 Configuration — Advanced

278 Appendix G Command Interpreter

Command httpd

Table 67 IP commands lan

Description edit <0: first|1: second|2: third>

<0:from

ISP|1:usr-def|2:n one> [IP addr ess if choosing

1] edit <0: first|1: second|2: third>

<0:from

ISP|1:usr-def|2:D

NS Relay|3: n one> [IP address if choosing 1] display

Configures the system DNS server settings.

Configures the LAN DNS server settings.

debug [on|off]

Shows the LAN DNS server settings.

Enables or disables the HTTP debug flag.

This command currently does not work.

icmp ifconfig ping route status discovery

Displays the ICMP statistics counter.

<iface> [on|off]

[iface] [ipaddr]

[broadcast <addr>

|mtu

<value>|dynamic]

Sets the ICMP router discovery flag.

Configures a network interface.

Pings a remote host.

status add addiface addprivate drop

[if]

<dest_addr|defaul t>[/<bits>]

[<metric>]

<dest_addr|defaul t>[/<bits>]

[<metric>]

<dest_addr|defaul t>[/<bits>]

[<metric>]

<host addr> [/

<bits>]

Displays the routing table.

Adds a route.

Adds an entry to the routing table for the specified interface.

Adds a private route.

Drops a route.

NN47923-501

Appendix G Command Interpreter 279

Table 67 IP commands

Command status udp rip status activate

Description

Displays IP statistic counters.

Displays the UDP status.

These are the Routing Information Protocol commands.

Enables RIP.

Sends a RIP request to the specified address and port.

tcp telnet status trace

Displays RIP statistic counters.

Enables the RIP debug trace.

mode

<iface> in [mode] Sets the Business Secure Router to use the

RIP information it receives.

<iface> out

[mode]

Sets the Business Secure Router to broadcast its routing table.

Shows the dial-in user RIP direction.

dialin_user [show|in|out|both

|none] status

<host> [port]

Displays the TCP statistic counters.

Creates a Telnet connection to the specified host.

tftp support stats traceroute xparent join break

<host> [ttl]

[wait] [queries]

[<iface2>]

<iface>

Displays whether or not TFTP is supported.

Displays the TFTP statistics.

Sends ICMP packets to trace the route of a remote host.

Add iface2 to the iface1’s group.

Remove the specified interface from the ipxparent group.

urlfilter

Nortel Business Secure Router 252 Configuration — Advanced

280 Appendix G Command Interpreter

Table 67 IP commands

Command enable exemptZone

[0:no/1:yes] customize

Description

Enables or disables content filtering.

display actionFlags

[type(1-3)][enabl e/disable] add [ip1] [ip2] delete [ip1]

[ip2] reset display actionFlags

[act(1-7)]

[enable/disable] logFlags

[type(1-3)][enabl e/disable] add [string]

[trust/untrust/ keyword] delete [string]

[trust/untrust/ keyword] reset

Displays content filtering exempt zone information.

Enables or disables content filtering exempt zone action flags that determine to which IP addresses content filtering applies.

Sets a range of IP addresses to be in the exempt zone.

Removes a range of IP addresses from the exempt zone.

Returns the exempt zone settings to the previous configuration.

Uses the customize commands to configure content filtering for trusted Web sites, forbidden Web sites and keyword blocking.

Displays the content filtering customize action flags.

Sets the content filtering customize action flags.

Sets the content filtering customize log flags.

Adds a trusted Web site, forbidden Web site or keyword blocking string.

Deletes a trusted Web site, forbidden Web site or keyword blocking string.

Returns to the default configuration.

tredir failcount partner target

<count>

Sets the number of times that the device can ping the target without a response before forwarding traffic to the backup gateway.

Sets the traffic redirect backup gateway IP address.

Sets the IP address that the device uses to test WAN accessibility.

NN47923-501

Command rpt stroute

Appendix G Command Interpreter 281 active start stop url ip srv

Table 67 IP commands timeout checktime active save disp debug display load save config

<on|off>

<value>

[1:yes|0:no]

[rule # | buf]

Description

Sets the number of seconds the device waits for a response from the target.

Sets the number of seconds the device waits between attempts to connect to the target.

Enables or disables traffic redirect.

Saves traffic redirect configuration.

Displays the traffic redirect configuration.

Sets the traffic redirect debug value.

Enables or disables the reports.

Starts recording reports data.

Stops recording reports data.

Records the most visited Web sites.

Records the LAN IP addresses that sent and received the most traffic.

Records the most heavily used protocols or service ports.

Displays the list of static routes or detailed information on a specified rule.

Loads the specified static route rule into the buffer.

Saves a rule from the buffer to the System

Parameters Table.

name <site name> destination <dest addr>[/<bits>]

[<metric>] mask <IP subnet mask>

Sets the name for a static route.

Sets a static route’s destination IP address and gateway.

Sets a static route’s subnet mask.

Sets a static route’s gateway IP address.

gateway <IP address> metric <metric #> Sets a static route’s metric number.

Nortel Business Secure Router 252 Configuration — Advanced

282 Appendix G Command Interpreter

Command dropIcmp

Table 67 IP commands private <yes|no> active <yes|no>

[0|1]

Description

Turns private mode on or off.

Enables or disables a static route rule.

Sets whether or not the device allows ICMP fragment packets.

igmp debug forwardall querier iface

[level]

[on|off]

Sets IGMP debug level.

Activates or deactivates IGMP forwarding to all interfaces flag.

Turns on or off IGMP stop query flag.

robustness status

<iface> grouptm

<iface> interval

<iface> join

<group>

<iface> leave

<group>

<iface> query

Sets IGMP group timeout for the specified interface.

Sets IGMP query interval for the specified interface.

Adds an interface to a group.

Removes an interface from a group.

Sends an IGMP query on the specified interface.

Sets the IGMP response time.

<iface> rsptime

[time]

<iface> start

<iface> stop

<iface> ttl

<iface> v1compat

[on|off]

<num>

Turns on IGMP on the specified interface.

Turns off IGMP on the specified interface.

Sets the IGMP Time To Live threshold.

Turns on or off IGMP version 1 compatibility on the specified interface.

Sets the IGMP robustness variable.

Displays the IGMP status.

alg display second> or 0 for no timeout

Shows whether the Application Layer

Gateway is enabled or disabled.

Sets the SIP timeout period.

NN47923-501

Command

Appendix G Command Interpreter 283

Table 67 IP commands enable <ALG_FTP|ALG_H323

|ALG_SIP> disable <ALG_FTP|ALG_H323

|ALG_SIP>

Description

Turns on the ALG.

Turns off the ALG.

IPSec commands

Command debug switch

Table 68 lists and describes the IP Sec commands. Each of these commands must be preceded by ipsec . For example, type ipsec display 3 to display the third

IPSec rule, if you have it configured.

Table 68 IPSec commands type level display

<on|off>

Description

<0:Disable |

1:Original on|off | 2:IKE on|off | 3:

IPSec

[SPI]|on|off |

4:XAUTHon|off |

5:CERT on|off |

6: All>

<0:None |

1:User | 2:Low

| 3:High>

Turns the trace for IPsec debug information on or off.

Sets the debug level. The higher the number, the more detailed.

Shows debugging information, including type and level.

As long as there is one active IPSec rule, all packets go into the IPSec process to check against the SPD. When this switch is turned on, packets are not be put through the IPSec process, even if there are active IPSec rules.

timer

Nortel Business Secure Router 252 Configuration — Advanced

284 Appendix G Command Interpreter

Command show_runtime updatePeerIp display policyDisplay dial route

Table 68 IPSec commands chk_conn.

dpdTime update_peer chk_input sa spd

<rule index> lan wan

<0~255>

<0~255>

<on|off>

Description

Sets the idle timeout for IPSec connections. The system disconnects an

IPSec connection with no traffic for the timeout period. The interval is in minutes

(2 default) and 0 means the connection never times out.

Sets the idle timeout for IPSec connections where the Business Secure

Router is waiting for a response from the peer.

Sets the autotimer for updating IPSec rules that use a domain name as the secure gateway IP address. The interval is in minutes (30 default) and 0 means it never updates.

Adjusts autotimer to check if any inbound

IPsec traffic has passed during the specified period. If not, the Business

Secure Router disconnects the tunnel.

Displays runtime phase 1 and phase 2

SA information.

When a dynamic rule accepts a request and a tunnel is established, a runtime

SPD is created according to the peer’s local IP address. This command displays these runtime SPDs.

Forces the system to immediately update

IPSec rules that use a domain name as the secure gateway IP address.

Displays the specified IPSec rule.

Displays the specified IPSec rule’s IP policies.

Triggers the specified phase two connection.

After IPSec processes a packet and sends it to the LAN side, this switch controls whether or not IPSec can be applied to the packet again.

After IPSec processes a packet and sends it to the WAN side, this switch controls whether or not IPSec can be applied to the packet again.

NN47923-501

Command load save config

Appendix G Command Interpreter 285

Table 68 IPSec commands

Description

<rule index> Edit an IPSec branch office rule with the specified rule number.

Saves the IPSec branch office rule.

name <name> active <Yes|No>

Uses these commands to configure the

IPSec rule.

Sets the name of the rule.

Turns the rule on or off.

Sets the negotiation mode.

negotiationMode <0:Main |

1:Aggressive>

<Yes|No> natTraversal p1MultiPro <Yes|No>

Turns NAT traversal on or off.

Turns phase 1 multiple proposal on or off.

lcIdType lcIdContent <content> myIpAddr

<0:IP | 1:DNS |

2:Email>

Sets the local ID type.

Sets the local ID content.

Sets the My IP Address.

peerIdType <0:IP | 1:DNS |

2:Email> peerIdContent <content> secureGwAddr authMethod

Sets the peer ID type.

Sets the peer ID content.

<IP address |

Domain name> name>

Sets the secure gateway address.

<0:PreSharedKey

|1:

RSASignature>

Sets the authentication method.

Specifies the certificate to use for authentication.

preShareKey p1EncryAlgo p1AuthAlgo <0:MD5 |

1:SHA1> p1SaLifeTime <seconds> keyGroup

<0:DES | 1:3DES

| 2:AES>

Types 8 to 32 case-sensitive ASCII characters or 16 to 62 hexadecimal (0-9,

A-F) characters (preceded by 0x (zero x), which is not counted as part of the 16 to

62 characters).

Sets the phase 1 encryption algorithm.

<0:DH1 | 1:DH2>

Sets the phase 1 authentication algorithm.

Sets the phase 1 SA lifetime.

Sets the key group for phase 1 IKE setup.

Nortel Business Secure Router 252 Configuration — Advanced

286 Appendix G Command Interpreter

Command

Table 68 IPSec commands

Description nailUp <Yes|No> activeProtocol p2MultiPro p2EncryAlgo

<0:AH | 1:ESP>

<Yes|No>

<0:Null | 1:DES

| 2:3DES |

3:AES>

Turns nailed up feature on or off.

Sets the protocol.

Turns phase 2 multiple proposal on or off.

Sets the phase 2 encryption algorithm.

p2EncryKeyLen <0:128 | 1:192

| 2:256>

Sets the phase 2 encryption key length

(with AES encryption).

p2AuthAlgo <0:MD5 |

1:SHA1>

Sets the phase 2 authentication algorithm.

p2SaLifeTime <seconds> encap pfs antiReplay

<0:Tunnel |

1:Transport>

Sets the phase 2 SA lifetime.

Sets the encapsulation mode.

<0:None | 1:DH1

| 2:DH2>

Sets Perfect Forward Secrecy.

<Yes | No> Turns replay detection on or off.

connType Specifies whether the rule is for a branch office or Contivity Client VPN connection.

authOptions

<0:Branch

Office |

1:Contivity

Client>

<0:Username

Password |

1:Group ID &

Password onDemand groupID groupPasswd

[none]...

<group password> username <name> password <password>

Sets the Business Secure Router to either send just the username and password to the remote Contivity IPSec router, or a group ID and password as well.

Sets whether or not outgoing packets can automatically trigger a VPN connection to the remote Contivity IPSec router.

Sets which specific services can automatically trigger a VPN connection to the remote Contivity IPSec router.

Sets the Contivity Client tunnel’s user’s group ID.

Sets the Contivity Client tunnel’s user’s group password.

Sets the Contivity Client tunnel’s user’s username.

Sets the Contivity Client tunnel’s user’s password.

NN47923-501

Appendix G Command Interpreter 287

Command ikeList policySave ipsecList policyList policyConfig

Table 68 IPSec commands

Description exUseMode keepAlive

[enable|disable

]

<Yes|No>

Turns the exclusive use mode for the

Contivity Client tunnel on or off.

Specifies which MAC address is allowed to use the Contivity Client tunnel with exclusive use mode.

Sets the Contivity Client fail over IP addresses (of back up remote Contivity

IPSec routers).

Turns the Keep Alive feature on or off.

Displays a summary of the IKE (phase 1) rules.

Deletes the specified IPSec rule.

Edits the specified IP policy.

Saves the IP policy.

Displays a summary of the IPSec (phase

2) rules.

Displays the IP policies.

Deletes the specified IP policy.

Uses these commands to configure an IP policy for an IPSec office tunnel rule.

active <Yes|No> lcAddrStart <IP> protocol controlPing

<1:ICMP | 6:TCP

| 17:UDP>

<Yes|No> controlPingAddr <IP>

Binds the IP policy to an IPSec rule.

Turns the IP policy on or off.

Sets the local starting IP address.

Sets the IP policy’s protocol.

Turns control ping on or off.

Sets the control ping IP address.

Sets the local address type.

1:range |

2:subnet> lcAddrEndMask <IP> lcPortStart <port> lcPortEnd <port>

Sets the local ending IP address or subnet mask.

Sets the local starting port number.

Sets the local ending port number.

Nortel Business Secure Router 252 Configuration — Advanced

288 Appendix G Command Interpreter

Table 68 IPSec commands

Command rmAddrStart

1:range |

2:subnet>

<IP> rmAddrEndMask <IP> rmPortStart <port> rmPortEnd <port> btNatActive <Yes | No> btNatArEnd swSkipOverlapIP <on|off> adjTcpMss contivityDial contivityDrop contivityState

<off|auto|user defined value> contivitySplit contivityTimecnt <0~65535> exemptHost display load <index> active <Yes|No>

Description

Sets the remote address type.

Sets the remote starting IP address.

Sets the remote ending IP address or subnet mask.

Sets the remote starting port number.

Sets the remote ending port number.

Turns branch tunnel NAT address mapping on or off.

Sets the type of NAT address mapping.

1:range |

2:all>

Sets the branch tunnel NAT starting IP address.

Sets the branch tunnel NAT ending IP address or subnet mask.

Turn this option on to have the device allow rules with overlapping source and destination IP addresses.

Sets the adjust TCP Maximum Segment

Size.

Initiates the Contivity Client VPN connection.

Ends the Contivity Client VPN connection.

Displays information about the Contivity

Client VPN connection.

Sets the Contivity Client keep-alive interval (in seconds).

Uses the exemptHost commands to configure specific IP addresses that are not to be part of a VPN tunnel.

Displays the exempt host settings.

Loads an exempt host.

Enables or disables an exempt host.

NN47923-501

Command btNatList clientTerm

Appendix G Command Interpreter 289

Table 68 IPSec commands sourceStart sourceEnd destStart destEnd save load active display save auth

Description

Sets the exempt host’s source start IP address.

Sets the exempt host’s source end IP address.

Sets the exempt host’s destination start

IP address.

Sets the exempt host’s destination end IP address.

Saves an exempt host.

Displays the branch tunnel NAT entries.

[user | cfg]

Loads client termination configuration from ROM to working buffer, you must execute this command before configuring client termination.

Enables or disables client termination.

Displays configuration and/or remote user logon status of client termination, unless a parameter is specified, displays all.

Saves any client termination configuration changes to ROM.

local <on | off> local psk <on | off>

Enables or disables Local User Database authentication method.

Enables or disables the Pre-Shared Key authentication method for the Local User

Database.

radius <on | off> radius groupId radius groupPwd radius psk <on

| off>

Enables or disables the RADIUS Server authentication method.

Configures Group ID fields for RADIUS

Server authentication method.

Configures Group Password fields for

RADIUS Server authentication method.

Enables or disables Pre-Shared Key authentication type for RADIUS Server.

Nortel Business Secure Router 252 Configuration — Advanced

290 Appendix G Command Interpreter

Command

Table 68 IPSec commands encr

DHG

<128AES_SHA1 |

3DES_SHA1 |

3DES_MD5 |

DES_SHA1 |

DES_MD5 |

AH_SHA1 |

AH_MD5> <on | off>

<DES_DH1 |

3DES_DH2 |

128AES_DH5 >

Description

Enables or disables the specified encryption algorithm.

Enables or disables the specified

Diffie-Hellman encryption level.

aci ipPool natt failover static <on | off> ipPool <index> load <index> save active poolName

Enables or disables the Use Static

Address option.

Select which IP pool, index is based on 1, and inactive IP pool cannot be selected.

Before you configure an IP pool for client termination, you must load the specified

IP pool. Currently 3 IP pools are supported, so the valid index is: 1~3

After changing the IP pool configuration, use the save command to save the modification to the ROM.

Enables or disables the loaded IP pool.

Sets the IP pool’s name.

Sets the IP pool’s starting IP address.

startAddr subnet size

Sets the IP pool’s subnet.

Sets the number of IP addresses in the IP pool.

status Displays the current runtime IP pool status of Client Termination.

Enables or disables NAT Traversal.

active <yes | no> portSwitch

<enable | disable> portNum

Enables or disables Client IKE Source

Port Switching.

Sets the NAT Traversal UDP port, valid

UDP port: 1025 ~ 65535.

<1 | 2 | 3> <IP> Sets the client failover IP address.

NN47923-501

Command

Appendix G Command Interpreter 291

Table 68 IPSec commands keepalive pfs idleTo aicp rekeyTo rekeyDc domain dns wins banner password active <yes | no> interval

<hh:mm:ss> maxRetrans

<hh:mm:ss>

<hh:mm:ss>

[banner text] clientStorage

<on | off> manage <on | off>

Description

Enables or disables client failover tuning

(keep-alive).

Sets the keep-alive interval, valid interval

00:00:10 ~ 23:59:59.

Sets the keep-alive max retransmissions, valid range 0~255

Enables or disables Perfect Forward

Secrecy.

Sets the Idle Timeout, the valid value is:

00:00:00~23:59:59, 00:00:00 means no idle timeout.

Enable or disables Accept Initial Contact

Payload.

Sets the lifetime of a single key used for data encryption.

Sets how much data you expect to transmit via the tunnel with a single key.

A setting of 0 kb disables the Rekey Data

Count, rekey data count must be more than 5.

Sets the domain name for client termination.

Sets primary or secondary DNS server IP addresses to be assigned to remote users.

Sets primary or secondary WINS server

IP addresses to be assigned to remote users.

Sets whether or not the banner appears when a remote user logs on to the gateway. Also sets the banner text if specified (up to 256 characters).

Sets whether or not the Contivity VPN clients can save their logon passwords instead of always having to manually enter them.

Enables or disables the password management facilities, including maximum password age, minimum password length, and allow alpha-numeric passwords only.

Nortel Business Secure Router 252 Configuration — Advanced

292 Appendix G Command Interpreter

Command

Table 68 IPSec commands anpr <on | off> age <days> minLen

Description

Enables or disables the requirement of a alpha-numeric password.

Sets the maximum password age after which the login password expires, valid value: 0~180 days, and 0 means no expiration.

Sets the minimum password length.

WAN Commands

The following chart lists and describes the wan commands. Each of these commands must be preceded by wan when you use them.

Table 69 WAN Commands

Command wan adsl bert cellcnt chandata close defbitmap dyinggasp linedata open opencmd opmode perfdata far near

Description

Displays ADSL ber.

Displays the ADSL cell counter.

Displays the ADSL operational mode

(standard) and ADSL channel data, line rate.

Closes the ADSL line.

Displays ADSL defect bitmap status.

Sends ADSL dyinggasp.

Shows ADSL far end noise margin and carrier load information.

Shows ADSL near end noise margin and carrier load information.

Opens the ADSL line.

Opens ADSL line with a specific standard.

Shows the ADSL operational mode

(standard).

Shows performance information such as the

CRC,FEC, error seconds.

NN47923-501

Appendix G Command Interpreter 293

Table 69 WAN Commands (continued)

Command reset status version atm vchunt hwsar

Description

Resets the ADSL modem, and must reload the modem code again.

Displays ADSL status (ex: up, down or wait for init).

Shows the ADSL firmware version.

Add

<vci>

Remove

<vci>

Active

<yes|no> display

Adds an entry to the hunting pool.

<remote node> : input the remote node index

1-8

<vpi> : vpi value

<vci> : vci value

Need to save after this command.

Sets remote node ID and VPI, VCI value to remove the specific entry. System will save automatically.

Enables/disables VC auto hunting feature.

Displays the hunt pool.

Clears the configuration.

Clear

Save timer

Send

Saves current setting to the ROM file.

Sets the waiting time before checking the hunting table result.

Sends VC hunt pattern again.

Displays hwsar packets incoming/outgoing information. driver

Oamloopback

[VPI] [VCI]

[F5]

[endToEnd]

[funcType]

Oam loopback function.

Nortel Business Secure Router 252 Configuration — Advanced

294 Appendix G Command Interpreter

Sys firewall commands

Command acl

Table 70 lists and describes the system firewall commands. Each of these commands must be preceded by sys firewall . For example, type sys firewall active yes to turn on the firewall.

Table 70 Sys firewall commands

Description active disp

<yes|no>

Displays ACLs or a specific ACL set # and rule #.

Activates or deactivates firewall

Enables or disables the firewall.

cnt dynamicrule tcprst disp clear display

Displays the firewall log type and count.

Clears the firewall log count.

Displays the firewall’s dynamic rules.

rst rst113 display

Turns TCP reset sending on or off.

Turns TCP reset sending for port 113 on or off.

Displays the TCP reset sending settings.

dos smtp display ignore

Enables or disables the SMTP DoS defender.

Displays the SMTP DoS defender setting.

Sets if the firewall ignores DoS attacks on the LAN or WAN.

ignore dos logBroadcast triangle

Sets if the firewall ignores DoS attacks on the LAN or WAN.

Displays the status of the broadcast log.

Sets if the firewall ignores triangle route packets on the LAN or WAN.

NN47923-501

Appendix G Command Interpreter 295

Bandwidth management commands

Table 71 lists and describes the bandwidth management commands. Each of these commands must be preceded by bm . For example, type bm show lan to display the LAN port’s bandwidth management settings.

Command interface lan class wan lan

Table 71 Bandwidth management commands enable disable enable disable add #

<wrr|prr>

<wrr|prr>

<efficient> bandwidth xxx <name xxx>

Description

Enables bandwidth management (BWM) for traffic going out the LAN interface.

You can also specify the b/s of bandwidth.

Sets the queueing mechanism to fairness-based (WRR) or priority-based (PRR).

Turns on the work-conserving feature.

Disables bandwidth management for traffic going out the LAN interface.

Enables bandwidth management for traffic going out the WAN interface. You can also specify the b/s of bandwidth.

Sets the queueing mechanism to fairness-based (WRR) or priority-based (PRR).

Turns on the work-conserving feature.

Disables bandwidth management for traffic going out the WAN interface.

Adds a class with bandwidth xxx b/s in LAN. The name is for your information.

Sets the class priority. The range is between 0 (the lowest) to 7 (the highest).

Nortel Business Secure Router 252 Configuration — Advanced

296 Appendix G Command Interpreter

Command wan

Table 71 Bandwidth management commands del # mod # add # del # mod #

<borrow on|off> bandwidth xxx <name xxx>

Description

The class can borrow bandwidth from its parent class when borrowing is turned on, and vice versa.

Deletes the class # and its filter and all its children classes and their filters in LAN.

Modifies the parameters of the class in the LAN. A bandwidth value is optional.

Sets the class name.

Sets the class priority. The range is between 0 (the lowest) to 7 (the highest). The priority is unchanged if you do not set a new value.

The class can borrow bandwidth from its parent class when borrowing is turned on, and vice versa.

Adds a class with bandwidth xxx b/s in WAN. The name is for your information.

Sets the class priority. The range is between 0 (the lowest) to 7 (the highest).

The class can borrow bandwidth from its parent class when borrowing is turned on, and vice versa.

Deletes the class # and its filter and all its children class and their filters in WAN.

Modifies the parameters of the class in the WAN. A bandwidth value is optional.

Sets the class name.

Sets the class priority. The range is between 0 (the lowest) to 7 (the highest).

NN47923-501

Command filter show lan wan

Appendix G Command Interpreter 297

Table 71 Bandwidth management commands interface class filter add # del # add # del # lan wan lan wan lan wan statistics lan wan

Daddr <mask

Dmask> Dport

Saddr <mask

Smask> Sport protocol

Daddr <mask

Dmask> Dport

Saddr <mask

Smask> Sport protocol

Description

The class can borrow bandwidth from its parent class when borrowing is turned on, and vice versa.

Adds a filter for class # in LAN.

The filter contains destination address (netmask), destination port, source address (netmask), source port and protocol. Use 0 for items that you do not want the filter to include.

Deletes the LAN filter that belongs to the specified LAN class.

Adds a filter for class # in

WAN. The filter contains destination address

(netmask), destination port, source address (netmask), source port and protocol. Use

0 for items that you do not want the filter to include.

Deletes the LAN filter that belongs to the specified WAN class.

Displays the LAN interface settings.

Displays the WAN interface settings.

Displays the LAN classes.

Displays the WAN classes.

Displays the LAN filter settings.

Displays the WAN filter settings.

Displays the statistics of the

LAN classes.

Displays the statistics of the

LAN classes.

Nortel Business Secure Router 252 Configuration — Advanced

298 Appendix G Command Interpreter

Command monitor lan

Table 71 Bandwidth management commands

<#> wan <#> moveFilter < channName>

<from> <to> config save load clear

Description

Displays the bandwidth usage of the specified LAN class (or all of the LAN classes if you do not specify one). The first time you use the command turns it on; the second time turns it off, and so on.

Displays the bandwidth usage of the specified WAN class (or all of the WAN classes if you do not specify one). The first time you use the command turns it on; the second time turns it off, and so on.

Changes the filter order.

<channName>: LAN, WAN

<from>: filter index number

<to>: filter index number

Saves the BWM configuration.

Loads the BWM configuration.

Clears the BWM configuration.

Certificates commands

Command my_cert

Table 72 describes the certificate commands. Each of these commands must be preceded by certificates (or cert for short). For example, type cert my_cert list to display all of your certificate names and basic information.

All of these commands start with certificates .

Table 72 Certificates commands

Description create

NN47923-501

Command

Appendix G Command Interpreter 299

Table 72 Certificates commands create create create selfsigned

<name>

[key size] request

<name>

[key size] scep_enroll

[key size]

Description

Creates a self-signed local host certificate.

<name> specifies a descriptive name for the generated certificate.

<subject> specifies a subject name (required) and alternative name (required). The format is

“subject-name-dn;{ip,dns,email}=value". If the name contains spaces, put it in quotes.

[key size] specifies the key size. It has to be an integer from 512 to 2 048. The default is 1 024 bits.

Creates a certificate request and saves it to the router for later manual enrollment.

<name> specifies a descriptive name for the generated certification request.

<subject> specifies a subject name (required) and alternative name (required). The format is

"subject-name-dn;{ip,dns,email}=value". If the name contains spaces, put it in quotes.

[key size] specifies the key size. It has to be an integer from 512 to 2 048. The default is 1 024 bits.

Creates a certificate request and enrolls for a certificate immediately online using SCEP protocol.

<name> specifies a descriptive name for the enrolled certificate.

<CA addr> specifies the CA server address.

<CA cert> specifies the name of the CA certificate.

<auth key> specifies the key used for user authentication. If the key contains spaces, put it in quotes. To leave it blank, type "".

<subject> specifies a subject name (required) and alternative name (required). The format is

"subject-name-dn;{ip,dns,email}=value". If the name contains spaces, put it in quotes.

[key size] specifies the key size. It has to be an integer from 512 to 2 048. The default is 1 024 bits.

Nortel Business Secure Router 252 Configuration — Advanced

300 Appendix G Command Interpreter

Command

Table 72 Certificates commands

Description create import list cmp_enroll

[key size]

[name] delete <name>

Creates a certificate request and enrolls for a certificate immediately online using CMP protocol.

<name> specifies a descriptive name for the enrolled certificate.

<CA addr> specifies the CA server address.

<CA cert> specifies the name of the CA certificate.

<auth key> specifies the id and key used for user authentication. The format is "id:key". To leave the id and key blank, type ":".

<subject> specifies a subject name (required) and alternative name (required). The format is

"subject-name-dn;{ip,dns,email}=value". If the name contains spaces, put it in quotes.

[key size] specifies the key size. It has to be an integer from 512 to 2 048. The default is 1 024 bits.

Imports the PEM-encoded certificate from stdin.

[name] specifies the descriptive name (optional) the imported certificate is saved as. For my certificate importation to be successful, a certification request corresponding to the imported certificate must already exist on Business Secure Router. After the importation, the certification request is automatically deleted. If a descriptive name is not specified for the imported certificate, the certificate adopts the descriptive name of the certification request.

export <name> view <name>

Exports the PEM-encoded certificate to stdout for theuser to copy and paste.

<name> specifies the name of the certificate to be exported.

Views the information of the specified local host certificate.

<name> specifies the name of the certificate to be viewed.

verify <name>

[timeout]

Verifies the certification path of the specified local host certificate.

<name> specifies the name of the certificate to be verified.

[timeout] specifies the timeout value in seconds

(optional). The default timeout value is 20 seconds.

Deletes the specified local host certificate.

<name> specifies the name of the certificate to be deleted.

Lists all my certificate names and basic information.

NN47923-501

Command ca_trusted

Appendix G Command Interpreter 301

Table 72 Certificates commands def_self_sign ed

[name] replace_facto ry

Description

Renames the specified certificate.

<old name> specifies the name of the certificate to be renamed.

<new name> specifies the new name the certificate is saved as.

Sets the specified self-signed certificate as the default self-signed certificate.

[name] specifies the name of the certificate to be set as the default self-signed certificate. If [name] is not specified, the name of the current self-signed certificate is displayed.

Creates a certificate using your device MAC address that is specific to this device. The factory default certificate is a common default certificate for all

Business Secure Router models. import <name> export <name>

Imports the PEM-encoded certificate from stdin.

<name> specifies the name the imported CA certificate is saved as.

Exports the PEM-encoded certificate to stdout for the user to copy and paste.

<name> specifies the name of the certificate to be exported.

view <name> Views the information of the specified trusted CA certificate.

<name> specifies the name of the certificate to be viewed.

verify <name>

[timeout]

Verifies the certification path of the specified trusted

CA certificate.

<name> specifies the name of the certificate to be verified.

[timeout] specifies the timeout value in seconds

(optional). The default timeout value is 20 seconds.

delete <name> list

Deletes the specified trusted CA certificate.

<name> specifies the name of the certificate to be deleted.

Lists all trusted CA certificate names and basic information.

Renames the specified trusted CA certificate.

<old name> specifies the name of the certificate to be renamed.

<new name> specifies the new name the certificate is saved as.

Nortel Business Secure Router 252 Configuration — Advanced

302 Appendix G Command Interpreter

Table 72 Certificates commands

Command crl_issuer <name>

[on|off] remote_trusted import <name> export <name>

Imports the PEM-encoded certificate from stdin.

<name> specifies the name the imported remote host certificate is saved as.

Exports the PEM-encoded certificate to stdout for the user to copy and paste.

<name> specifies the name of the certificate to be exported.

view <name> Views the information of the specified trusted remote host certificate.

<name> specifies the name of the certificate to be viewed.

verify <name>

[timeout]

Verifies the certification path of the specified trusted remote host certificate.

<name> specifies the name of the certificate to be verified.

[timeout] specifies the timeout value in seconds

(optional). The default timeout value is 20 seconds.

delete <name> list

Deletes the specified trusted remote host certificate.

<name> specifies the name of the certificate to be deleted.

Lists all trusted remote host certificate names and basic information.

Renames the specified trusted remote host certificate.

<old name> specifies the name of the certificate to be renamed.

<new name> specifies the new name the certificate is saved as.

dir_server

Description

Specifies whether or not the specified CA issues

CRL.

<name> specifies the name of the CA certificate.

[on|off] specifies whether or not the CA issues CRL.

If [on|off] is not specified, the current crl_issuer status of the CA is used.

NN47923-501

Command

Appendix G Command Interpreter 303

Table 72 Certificates commands

Description

<addr[:port]>

[login:pswd]

Adds a new directory service.

<name> specifies a descriptive name for the directory server.

<addr[:port]> specifies the server address (required) and port (optional). The format is

"server-address[:port]". The default port is 389.

[login:pswd] specifies the logon name and password, if required. The format is "[login:password]".

delete <name> Deletes the specified directory service.

<name> specifies the name of the directory server to be deleted.

view <name> list

Views the specified directory service.

<name> specifies the name of the directory server to be viewed.

Lists all directory service names and basic information.

Renames the specified directory service.

<old name> specifies the name of the directory server to be renamed.

<new name> specifies the new name the directory server is saved as.

<addr[:port]>

[login:pswd]

Edits the specified directory service.

<name> specifies the name of the directory server to be edited.

<addr[:port]> specifies the server address (required) and port (optional). The format is

"server-address[:port]". The default port is 389.

[login:pswd] specifies the logon name and password, if required. The format is "[login:password]".

Nortel Business Secure Router 252 Configuration — Advanced

304 Appendix G Command Interpreter

IEEE 802.1X commands

Command debug

Table 73 lists and describes the IEEE 802.1x commands. Each of these commands must be preceded by 8021x . For example, type 8021x debug level 1 to set the IEEE 802.1X debug messages to the first level.

Table 73 IEEE 802.1X commands

Description level <level> trace user <user>

Sets the IEEE 802.1x debug message level

Displays all supplicants information in the supplicant table.

Displays all supplicants information related to the username.

RADIUS commands

Command auth acct checkRadID debug

Table 74 lists and describes the RADIUS commands. Each of these commands must be preceded by radius . For example, type radius auth to display the authentication server settings.

Table 74 RADIUS commands

Description

Displays the current RADIUS authentication server configuration.

Displays the current RADIUS accounting server configuration.

Checks the RADIUS ID pool.

Enables radius debug messages.

NN47923-501

305

Appendix H

NetBIOS filter commands

The following describes the NetBIOS packet filter commands.

Introduction

NetBIOS (Network Basic Input/Output System) are TCP or UDP packets that enable a computer to connect to and communicate with a LAN.

For some dial-up services, such as PPPoE or PPPoA, NetBIOS packets cause unwanted calls.

You can configure NetBIOS filters to do the following:

• Allow or disallow the sending of NetBIOS packets from the LAN to the

WAN and from the WAN to the LAN.

• Allow or disallow the sending of NetBIOS packets through VPN connections.

• Allow or disallow NetBIOS packets to initiate calls.

Nortel Business Secure Router 252 Configuration — Advanced

306 Appendix H NetBIOS filter commands

Display NetBIOS filter settings

Figure 155 NetBIOS Display Filter Settings Command Example

============== NetBIOS Filter Status ===============

Between LAN and WAN: Block

IPSec Packets: Forward

Trigger Dial: Disabled

Syntax: sys filter netbios disp

This command gives a read-only list of the current NetBIOS filter modes.

The filter types and their default settings are as follows:

Table 75 NetBIOS filter default settings

Name

Between LAN and

WAN

IPSec Packets

Trigger dial

Description

This field displays whether NetBIOS packets are blocked or forwarded from the LAN to the WAN or from the WAN to the LAN.

This field displays whether NetBIOS packets sent through a VPN connection are blocked or forwarded.

This field displays whether NetBIOS packets are allowed to initiate calls. Disabled means that

NetBIOS packets are blocked from initiating calls.

Example

Forward

Disabled

NetBIOS filter configuration

Syntax: sys filter netbios config <type> <on|off> where

<type> identifies which NetBIOS filter (numbered 0-3) to configure.

NN47923-501

Appendix H NetBIOS filter commands 307

• 0 = LAN to WAN and WAN to LAN

• 3 = IPSec packet pass through

• 4 = Trigger Dial

<on|off> is a switch to enable or disable the filter.

• For type 0, use on to enable the filter and block NetBIOS packets. Use off to disable the filter and forward NetBIOS packets.

• For type 3, use on to block NetBIOS packets from being sent through a

VPN connection. Use off to allow NetBIOS packets to be sent through a

VPN connection.

• For type 4, use on to allow NetBIOS packets to initiate dial backup calls.

Use off to block NetBIOS packets from initiating dial backup calls.

Example commands

Command: sys filter netbios config 0 on

This command blocks LAN to WAN and WAN to LAN NetBIOS packets

Command: sys filter netbios config 1 off

This command forwards WAN to LAN and WAN to LAN NetBIOS packets

Command: sys filter netbios config 3 on

This command blocks IPSec NetBIOS packets

Command: sys filter netbios config 4 off

This command stops NetBIOS commands from initiating calls.

Nortel Business Secure Router 252 Configuration — Advanced

308 Appendix H NetBIOS filter commands

NN47923-501

309

Appendix I

Boot Commands

The BootModule AT commands execute from within the router’s bootup software, when debug mode is selected before the main router firmware is started.

After you start up your Business Secure Router, you are given a choice to go into debug mode by pressing a key at the prompt shown in screen shown in

Figure 156 . In debug mode you have access to a series of boot module commands, for example ATUR (for uploading firmware) and ATLC (for uploading the configuration file). These are already discussed in Chapter 15, “Firmware and configuration file maintenance” on page 179 .

Figure 156 Option to Enter Debug Mode

Bootbase Version: V1.02 | 08/08/2001 15:40:50

RAM: Size = 16384 Kbytes

DRAM Post: Testing: 16384K OK

FLASH: Intel 16M

RAS Version: V3.50(WB.0)b3 | 08/08/2001 16:21:27

Press any key to enter debug mode within 3 seconds.

.................................................

Enter ATHE to view all available Business Secure Router boot module commands, as shown in Figure 157 on page 310 . With ATBAx, you can change the console port speed. The x denotes the number preceding the colon to give the console port speed following the colon in the list of numbers that follows; for example ATBA3 will give a console port speed of 9.6 Kb/s. ATSE displays the seed that is used to generate a password to turn on the debug flag in the firmware.

Nortel Business Secure Router 252 Configuration — Advanced

310 Appendix I Boot Commands

The ATSH command shows product related information such as boot module version, vendor name, product model, RAS code revision, and more. With ATGO, you can continue booting the system. Most other commands aid in advanced troubleshooting and must only be used by qualified engineers.

Figure 157 Boot Module Commands

AT just answer OK

ATHE print help

ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k

ATENx,(y) set BootExtension Debug Flag (y=password)

ATSE show the seed of password generator

ATTI(h,m,s) change system time to hour:min:sec or show current time

ATDA(y,m,d) change system date to year/month/day or show current date

ATDS dump RAS stack

ATDT dump Boot Module Common Area

ATDUx,y dump memory contents from address x for length y

ATRBx display the 8-bit value of address x

ATRWx display the 16-bit value of address x

ATRLx display the 32-bit value of address x

ATGO(x) run program at addr x or boot router

ATGR boot router

ATGT run Hardware Test Program

ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations)

ATSH dump manufacturer related data in ROM

ATDOx,y download from address x for length y to PC via XMODEM

ATTD download router configuration to PC via XMODEM

ATUR upload router firmware to flash ROM

ATLC upload router configuration file to flash ROM

ATXSx xmodem select: x=0: CRC mode(default); x=1: checksum mode

ATSR system reboot

NN47923-501

311

Appendix J

Log descriptions

This appendix provides descriptions of log messages.

Table 76 System error logs

Log Message Description

%s exceeds the max. number of session per host!

This attempt to create a SUA/NAT session exceeds the maximum number of SUA/NAT session table entries allowed to be created per host.

Table 77 System maintenance logs

Log Message Description

Time calibration is successful

Time calibration failed

DHCP client gets %s

DHCP client IP expired

DHCP server assigns %s

The router has adjusted its time based on information from the time server.

The router failed to get information from the time server.

A DHCP client got a new IP address from the DHCP server.

A DHCP client's IP address has expired.

The DHCP server assigned an IP address to a client.

SMT Login Successfully

SMT Login Fail

WEB Login Successfully

WEB Login Fail

TELNET Login Successfully

Someone has logged on to the router's SMT interface.

Someone has failed to log on to the router's SMT interface.

Someone has logged on to the router's WebGUI interface.

Someone has failed to log on to the router's

WebGUI interface.

Someone has logged on to the router via Telnet.

Nortel Business Secure Router 252 Configuration — Advanced

312 Appendix J Log descriptions

Table 77 System maintenance logs

Log Message

TELNET Login Fail

FTP Login Successfully

FTP Login Fail

NAT Session Table is Full!

Description

Someone has failed to log on to the router via

Telnet.

Someone has logged on to the router via FTP.

Someone has failed to log on to the router via FTP.

The maximum number of SUA/NAT session table entries has been exceeded and the table is full.

Table 78 UPnP logs

Log Message

UPnP pass through Firewall

Description

UPnP packets can pass through the firewall.

Table 79 Content filtering logs

Category

URLFOR

Log Message

IP/Domain Name

URLBLK

JAVBLK

IP/Domain Name

Description

The Business Secure Router allows access to this IP address or domain name and forwards traffic to the IP address or domain name.

The Business Secure Router blocked access to this IP address or domain name due to a forbidden keyword. All web traffic is disabled except for trusted domains, untrusted domains, or the cybernot list.

The Business Secure Router blocked access to this IP address or domain name because of a forbidden service, such as: ActiveX, a Java applet, a cookie, or a proxy.

NN47923-501

Appendix J Log descriptions 313

Table 80 Attack logs

Log Message Description attack TCP attack UDP attack IGMP attack ESP attack GRE attack OSPF attack ICMP (type:%d, code:%d)

The firewall detected a TCP attack.

The firewall detected an UDP attack.

The firewall detected an IGMP attack.

The firewall detected an ESP attack.

The firewall detected a GRE attack.

The firewall detected an OSPF attack.

The firewall detected an ICMP attack; see the section on

ICMP messages for type and code details.

land TCP land UDP land IGMP land ESP land GRE land OSPF land ICMP (type:%d, code:%d) ip spoofing - WAN TCP ip spoofing - WAN UDP

The firewall detected a TCP land attack.

The firewall detected an UDP land attack.

The firewall detected an IGMP land attack.

The firewall detected an ESP land attack.

The firewall detected a GRE land attack.

The firewall detected an OSPF land attack.

The firewall detected an ICMP land attack; see the section on ICMP messages for type and code details.

The firewall detected a TCP IP spoofing attack on the

WAN port.

The firewall detected an UDP IP spoofing attack on the

WAN port.

ip spoofing - WAN IGMP The firewall detected an IGMP IP spoofing attack on the

WAN port.

ip spoofing - WAN ESP ip spoofing - WAN GRE ip spoofing - WAN OSPF ip spoofing - WAN ICMP

(type:%d, code:%d) icmp echo ICMP (type:%d, code:%d)

The firewall detected an ESP IP spoofing attack on the

WAN port.

The firewall detected a GRE IP spoofing attack on the

WAN port.

The firewall detected an OSPF IP spoofing attack on the

WAN port.

The firewall detected an ICMP IP spoofing attack on the

WAN port.

The firewall detected an ICMP echo attack. syn flood TCP ports scan TCP

The firewall detected a TCP syn flood attack.

The firewall detected a TCP port scan attack.

Nortel Business Secure Router 252 Configuration — Advanced

314 Appendix J Log descriptions

Table 80 Attack logs

Log Message Description teardrop TCP teardrop UDP

The firewall detected a TCP teardrop attack.

The firewall detected an UDP teardrop attack.

The firewall detected an ICMP teardrop attack.

teardrop ICMP (type:%d, code:%d) illegal command TCP The firewall detected a TCP illegal command attack.

NetBIOS TCP ip spoofing - no routing entry TCP

The firewall detected a TCP NetBIOS attack.

The firewall detected a TCP IP spoofing attack while the

Business Secure Router did not have a default route.

ip spoofing - no routing entry UDP ip spoofing - no routing entry IGMP

The firewall detected an UDP IP spoofing attack while the

Business Secure Router did not have a default route.

The firewall detected an IGMP IP spoofing attack while the

Business Secure Router did not have a default route.

ip spoofing - no routing entry ESP ip spoofing - no routing entry GRE

The firewall detected an ESP IP spoofing attack while the

Business Secure Router did not have a default route.

The firewall detected a GRE IP spoofing attack while the

Business Secure Router did not have a default route.

ip spoofing - no routing entry OSPF ip spoofing - no routing entry ICMP (type:%d, code:%d)

The firewall detected an OSPF IP spoofing attack while the

Business Secure Router did not have a default route.

The firewall detected an ICMP IP spoofing attack while the

Business Secure Router did not have a default route.

The firewall detected an ICMP vulnerability attack.

vulnerability ICMP

(type:%d, code:%d) traceroute ICMP

(type:%d, code:%d)

The firewall detected an ICMP traceroute attack.

See Table 83 for type and code details.

NN47923-501

Appendix J Log descriptions 315

Table 81 Access logs

Log Message Description

Firewall default policy: TCP (set:%d)

Firewall default policy: UDP (set:%d)

Firewall default policy: ICMP (set:%d, type:%d, code:%d)

Firewall default policy: IGMP (set:%d)

Firewall default policy: ESP (set:%d)

Firewall default policy: GRE (set:%d)

Firewall default policy: OSPF (set:%d)

Firewall default policy: (set:%d)

Firewall rule match: TCP

(set:%d, rule:%d)

Firewall rule match: UDP

(set:%d, rule:%d)

Firewall rule match:

ICMP (set:%d, rule:%d, type:%d, code:%d)

Firewall rule match:

IGMP (set:%d, rule:%d)

Firewall rule match: ESP

(set:%d, rule:%d)

TCP access matched the default policy of the listed ACL set and the Business Secure Router blocked or forwarded it according to the ACL set’s configuration.

UDP access matched the default policy of the listed ACL set and the Business Secure Router blocked or forwarded it according to the ACL set’s configuration.

ICMP access matched the default policy of the listed ACL set and the Business Secure Router blocked or forwarded it according to the ACL set’s configuration.

IGMP access matched the default policy of the listed ACL set and the Business Secure Router blocked or forwarded it according to the ACL set’s configuration.

ESP access matched the default policy of the listed ACL set and the Business Secure Router blocked or forwarded it according to the ACL set’s configuration.

GRE access matched the default policy of the listed ACL set and the Business Secure Router blocked or forwarded it according to the ACL set’s configuration.

OSPF access matched the default policy of the listed ACL set and the Business Secure Router blocked or forwarded it according to the ACL set’s configuration.

Access matched the default policy of the listed ACL set and the Business Secure Router blocked or forwarded it according to the ACL set’s configuration.

TCP access matched the listed firewall rule and the

Business Secure Router blocked or forwarded it according to the rule’s configuration.

UDP access matched the listed firewall rule and the

Business Secure Router blocked or forwarded it according to the rule’s configuration.

ICMP access matched the listed firewall rule and the

Business Secure Router blocked or forwarded it according to the rule’s configuration.

IGMP access matched the listed firewall rule and the

Business Secure Router blocked or forwarded it according to the rule’s configuration.

ESP access matched the listed firewall rule and the

Business Secure Router blocked or forwarded it according to the rule’s configuration.

Nortel Business Secure Router 252 Configuration — Advanced

316 Appendix J Log descriptions

Table 81 Access logs

Log Message Description

Firewall rule match: GRE

(set:%d, rule:%d)

Firewall rule match:

OSPF (set:%d, rule:%d)

Firewall rule match:

(set:%d, rule:%d)

Firewall rule NOT match:

TCP (set:%d, rule:%d)

Firewall rule NOT match:

UDP (set:%d, rule:%d)

GRE access matched the listed firewall rule and the

Business Secure Router blocked or forwarded it according to the rule’s configuration.

OSPF access matched the listed a firewall rule and the

Business Secure Router blocked or forwarded it according to the rule’s configuration.

Access matched the listed firewall rule and the Business

Secure Router blocked or forwarded it according to the rule’s configuration.

TCP access did not match the listed firewall rule and the

Business Secure Router logged it.

UDP access did not match the listed firewall rule and the

Business Secure Router logged it.

ICMP access did not match the listed firewall rule and the

Business Secure Router logged it.

Firewall rule NOT match:

ICMP (set:%d, rule:%d, type:%d, code:%d)

Firewall rule NOT match:

IGMP (set:%d, rule:%d)

Firewall rule NOT match:

ESP (set:%d, rule:%d)

Firewall rule NOT match:

GRE (set:%d, rule:%d)

IGMP access did not match the listed firewall rule and the

Business Secure Router logged it.

ESP access did not match the listed firewall rule and the

Business Secure Router logged it.

GRE ac access did not match the listed firewall rule and the Business Secure Router logged it.

Firewall rule NOT match:

OSPF (set:%d, rule:%d)

Firewall rule NOT match:

(set:%d, rule:%d)

Filter default policy

DROP!

Filter default policy

FORWARD!

Filter match DROP <set

%d/rule %d>

Filter match FORWARD

OSPF access did not match the listed firewall rule and the

Business Secure Router logged it.

Access did not match the listed firewall rule and the

Business Secure Router logged it.

IP address or protocol matched a default filter policy and the Business Secure Router dropped the packet to block access.

IP address or protocol matched a default filter policy.

Access was allowed and the router forwarded the packet.

IP address or protocol matched the listed filter rule and the

Business Secure Router dropped the packet to block access.

IP address or protocol matched the listed filter rule. Access was allowed and the router forwarded the packet.

NN47923-501

Appendix J Log descriptions 317

Table 81 Access logs

Log Message Description

(set:%d)

(rule:%d)

With firewall messages, this is the number of the ACL policy set and denotes the packet's direction (see

Table 82 ).

With filter messages, this is the number of the filter set.

With firewall messages, the firewall rule number denotes the number of a firewall rule within an ACL policy set.With filter messages, this is the number of an individual filter rule.

Router sent blocked web site message

Triangle route packet forwarded

Firewall sent TCP packet in response to DoS attack

Firewall sent TCP reset packets

Packet without a NAT table entry blocked

Out of order TCP handshake packet blocked

Drop unsupported/ out-of-order ICMP

The firewall allowed a triangle route session to pass through.

The firewall detected a DoS attack and sent a TCP packet in response.

The firewall sent out TCP reset packets.

The router blocked a packet that did not have a corresponding SUA/NAT table entry.

The router blocked a TCP handshake packet that came out of the proper order.

Router sent ICMP response packet

(type:%d, code:%d)

The Business Secure Router generates this log after it drops an ICMP packet due to one of the following two reasons:

1. The Business Secure Router does not support the ICMP packet's protocol.

2. The ICMP packet is an echo reply for which there was no corresponding echo request.

The router sent an ICMP response packet. This packet automatically bypasses the firewall.

See Table 83 for type and code details.

Nortel Business Secure Router 252 Configuration — Advanced

318 Appendix J Log descriptions

Table 82 ACL setting notes

ACL Set

Number

Direction

Description

LAN to WAN ACL set 1 for packets traveling from the

LAN to the WAN.

WAN to LAN ACL set 2 for packets traveling from the

WAN to the LAN.

LAN to LAN/Business Secure

Router

ACL set 7 for packets traveling from the

LAN to the LAN or the Business Secure

Router.

WAN to WAN/Business Secure

Router

ACL set 8 for packets traveling from the

WAN to the WAN or the Business

Secure Router.

Table 83 ICMP notes

Type

Code

Description

Echo Reply

Echo reply message

Destination Unreachable

Net unreachable

Host unreachable

Protocol unreachable

Port unreachable

A packet that needed fragmentation was dropped because it was set to Don't Fragment (DF)

Source route failed

Source Quench

A gateway can discard internet datagrams if it does not have the buffer space needed to queue the datagrams for output to the next network on the route to the destination network.

Redirect

Redirect datagrams for the Network

Redirect datagrams for the Host

Redirect datagrams for the Type of Service and Network

Redirect datagrams for the Type of Service and Host

Echo

NN47923-501

Appendix J Log descriptions 319

Table 83 ICMP notes

Type

Code

Description

Echo message

Time Exceeded

Time to live exceeded in transit

Fragment reassembly time exceeded

Parameter Problem

Pointer indicates the error

Timestamp

Timestamp request message

Timestamp Reply

Timestamp reply message

Information Request

Information request message

Information Reply

Information reply message

Table 84 Sys log

LOG MESSAGE DESCRIPTION

Mon dd hr:mm:ss hostname src="<srcIP:srcPort>" dst="<dstIP:dstPort>" msg="<msg>" note="<note>

This message is sent by the "RAS" when this syslog is generated. The messages and notes are defined in this appendix’s other charts.

VPN/IPSec logs

To view the IPSec and IKE connection log, type 3 in menu 27 and press [ENTER] to display the IPSec log as shown next. Figure 158 shows a typical log from the initiator of a VPN connection.

Nortel Business Secure Router 252 Configuration — Advanced

320 Appendix J Log descriptions

Figure 158 Example VPN initiator IPSec log

Index: Date/Time: Log:

------------------------------------------------------------

001 01 Jan 08:02:22 Send Main Mode request to <192.168.100.101>

002 01 Jan 08:02:22 Send:<SA>

003 01 Jan 08:02:22 Recv:<SA>

004 01 Jan 08:02:24 Send:<KE><NONCE>

005 01 Jan 08:02:24 Recv:<KE><NONCE>

006 01 Jan 08:02:26 Send:<ID><HASH>

007 01 Jan 08:02:26 Recv:<ID><HASH>

008 01 Jan 08:02:26 Phase 1 IKE SA process done

009 01 Jan 08:02:26 Start Phase 2: Quick Mode

010 01 Jan 08:02:26 Send:<HASH><SA><NONCE><ID><ID>

011 01 Jan 08:02:26 Recv:<HASH><SA><NONCE><ID><ID>

012 01 Jan 08:02:26 Send:<HASH>

Clear IPSec Log (y/n):

NN47923-501

Appendix J Log descriptions 321

VPN responder IPSec log

Figure 159 shows a typical log from the VPN connection peer.

Figure 159 Example VPN responder IPSec log

Index: Date/Time: Log:

------------------------------------------------------------

001 01 Jan 08:08:07 Recv Main Mode request from <192.168.100.100>

002 01 Jan 08:08:07 Recv:<SA>

003 01 Jan 08:08:08 Send:<SA>

004 01 Jan 08:08:08 Recv:<KE><NONCE>

005 01 Jan 08:08:10 Send:<KE><NONCE>

006 01 Jan 08:08:10 Recv:<ID><HASH>

007 01 Jan 08:08:10 Send:<ID><HASH>

008 01 Jan 08:08:10 Phase 1 IKE SA process done

009 01 Jan 08:08:10 Recv:<HASH><SA><NONCE><ID><ID>

010 01 Jan 08:08:10 Start Phase 2: Quick Mode

011 01 Jan 08:08:10 Send:<HASH><SA><NONCE><ID><ID>

012 01 Jan 08:08:10 Recv:<HASH>

Clear IPSec Log (y/n):

This menu is useful for troubleshooting. A log index number, the date and time the log was created, and a log message are displayed.

Note: Double exclamation marks (!!) denote an error or warning message.

Table 85 shows sample log messages during IKE key exchange.

Note: A PYLD_MALFORMED packet usually means that the two ends of the VPN tunnel are not using the same pre-shared key.

Nortel Business Secure Router 252 Configuration — Advanced

322 Appendix J Log descriptions

Table 85 Sample IKE key exchange logs

Log Message Description

Send <Symbol> Mode request to

<IP>Send <Symbol> Mode request to <IP>

Recv <Symbol> Mode request from <IP>Recv <Symbol> Mode request from <IP>

Recv:<Symbol>

The Business Secure Router has started negotiation with the peer.

The Business Secure Router has received an IKE negotiation request from the peer.

Phase 1 IKE SA process done

Start Phase 2: Quick Mode

!! IKE Negotiation is in process

!! Duplicate requests with the same cookie

!! No proposal chosen

!! Verifying Local ID failed!! Verifying Remote ID failed

IKE uses the ISAKMP protocol (refer to RFC2408 –

ISAKMP) to transmit data. Each ISAKMP packet contains payloads of different types that show in the log (see Table 87 ).

Phase 1 negotiation is finished.

Phase 2 negotiation is beginning using Quick Mode.

The Business Secure Router has begun negotiation with the peer for the connection already, but the IKE key exchange is not finished yet.

The Business Secure Router has received multiple requests from the same peer but it is still processing the first IKE packet from that peer.

The parameters configured for Phase 1 or Phase 2 negotiations do not match. Check all protocols and settings for these phases. For example, one party is using 3DES encryption, but the other party is using

DES encryption, so the connection fails.

During IKE Phase 2 negotiation, both parties exchange policy details, including local and remote

IP address ranges. If these ranges differ, the connection fails.

!! Local / remote IPs of incoming request conflict with rule <#d>

If the security gateway is 0.0.0.0, the Business

Secure Router uses the peer Local Addr as its

Remote Addr. If this IP (range) conflicts with a previously configured rule then the connection is not allowed.

The Local IP Addr range for the peer is invalid.

!! Invalid IP <IP start>/<IP end>

!! Remote IP <IP start> / <IP end> conflicts

If the security gateway is 0.0.0.0, the Business

Secure Router uses Local Addr for the peer as its

Remote Addr. If a peer Local Addr range conflicts with other connections, the Business Secure Router does not accept VPN connection requests from this peer.

NN47923-501

Appendix J Log descriptions 323

Table 85 Sample IKE key exchange logs

Log Message Description

!! Active connection allowed exceeded

!! IKE Packet Retransmit

!! Failed to send IKE Packet

!! Too many errors! Deleting

!! Phase 1 ID type mismatch

!! Phase 1 ID content mismatch

!! No known phase 1 ID type found

Peer ID: IP address type <IP address> vs. My Remote <IP address> vs. My Local <IP address>

-> <symbol>

Error ID Info

The Business Secure Router limits the number of simultaneous Phase 2 SA negotiations. The IKE key exchange process fails if this limit is exceeded.

The Business Secure Router did not receive a response from the peer and so retransmits the last packet sent.

The Business Secure Router cannot send IKE packets due to a network error.

The Business Secure Router deletes an SA when too many errors occur.

The ID type of an incoming packet does not match the local's peer ID type.

The ID content of an incoming packet does not match the local's peer ID content.

The ID type of an incoming packet does not match any known ID type.

The IP address type or IP address of an incoming packet does not match the peer IP address type or IP address configured on the local router. The log displays the IP address type and IP address of the incoming packet.

The IP address type or IP address of an incoming packet does not match the peer IP address type or IP address configured on the local router. The log displays this router’s configured remote IP address type or IP address that the incoming packet did not match.

The IP address type or IP address of an incoming packet does not match the peer IP address type or IP address configured on the local router. The log displays the configured local IP address type of the router or IP address that the incoming packet did not match.

The router sent a payload type of IKE packet.

The parameters configured for Phase 1 ID content do not match or the parameters configured for the

Phase 2 ID (IP address of single, range or subnet) do not match. Check all protocols and settings for these phases.

Nortel Business Secure Router 252 Configuration — Advanced

324 Appendix J Log descriptions

Table 86 shows sample log messages during packet transmission.

Table 86 Sample IPSec logs during packet transmission

LOG MESSAGE DESCRIPTION

!! WAN IP changed to <IP>

!! Cannot find IPSec SA

!! Cannot find outbound SA for rule <%d>

!! Discard REPLAY packet

!! Inbound packet authentication failed

!! Inbound packet decryption failed

Rule <#d> idle time out, disconnect

If the Business Secure Router’s WAN IP changes, all configured “My IP Addr” are changed to “0.0.0.0”. If this field is configured as

0.0.0.0, the Business Secure Router uses the current Business Secure Router WAN IP address (static or dynamic) to set up the VPN tunnel.

The Business Secure Router cannot find a phase 2 SA that corresponds with the SPI of an inbound packet (from the peer); the packet is dropped.

The packet matches the rule index number (#d), but Phase 1 or Phase 2 negotiation for outbound

(from the VPN initiator) traffic is not finished yet.

If the Business Secure Router receives a packet with the wrong sequence number it discards it.

The authentication configuration settings are incorrect. Check them.

The decryption configuration settings are incorrect. Check them.

If an SA has no packets transmitted for a period of time (configurable via CI command), the

Business Secure Router drops the connection.

Table 87 shows RFC-2408 ISAKMP payload types that the log displays. Refer to the RFC for detailed information on each type.

Table 87 RFC-2408 ISAKMP payload types

Log Display

PROP

TRANS

CER

Payload Type

Security Association

Proposal

Transform

Key Exchange

Identification

Certificate

NN47923-501

Appendix J Log descriptions 325

Table 87 RFC-2408 ISAKMP payload types

CER_REQ

HASH

SIG

NONCE

NOTFY

DEL

VID

Certificate Request

Hash

Signature

Nonce

Notification

Delete

Vendor ID

Table 88 PKI logs

Log Message

Enrollment successful

Enrollment failed

Failed to resolve

Enrollment successful

Enrollment failed

Failed to resolve

Rcvd ca cert:

Rcvd user cert:

Rcvd CRL <size>:

Rcvd ARL <size>:

Description

The SCEP online certificate enrollment was successful. The

Destination field records the certification authority server IP address and port.

The SCEP online certificate enrollment failed. The

Destination field records the certification authority server’s IP address and port.

The SCEP online certificate enrollment failed because the certification authority server’s address cannot be resolved.

The CMP online certificate enrollment was successful. The

Destination field records the certification authority server’s IP address and port.

The CMP online certificate enrollment failed. The Destination field records the certification authority server’s IP address and port.

The CMP online certificate enrollment failed because the certification authority server’s IP address cannot be resolved.

The router received a certification authority certificate, with subject name as recorded, from the LDAP server whose IP address and port are recorded in the Source field.

The router received a user certificate, with subject name as recorded, from the LDAP server whose IP address and port are recorded in the Source field.

The router received a CRL (Certificate Revocation List), with size and issuer name as recorded, from the LDAP server whose IP address and port are recorded in the Source field.

The router received an ARL (Authority Revocation List), with size and issuer name as recorded, from the LDAP server whose address and port are recorded in the Source field.

Nortel Business Secure Router 252 Configuration — Advanced

326 Appendix J Log descriptions

Table 88 PKI logs

Log Message

Failed to decode the received ca cert

Failed to decode the received user cert

Failed to decode the received CRL

Failed to decode the received ARL

Rcvd data <size> too large! Max size allowed: <max size>

Cert trusted:

Due to <reason codes>, cert not trusted: <subject name>

Description

The router received a corrupted certification authority certificate from the LDAP server whose address and port are recorded in the Source field.

The router received a corrupted user certificate from the

LDAP server whose address and port are recorded in the

Source field.

The router received a corrupted CRL (Certificate Revocation

List) from the LDAP server whose address and port are recorded in the Source field.

The router received a corrupted ARL (Authority Revocation

List) from the LDAP server whose address and port are recorded in the Source field.

The router received directory data that was too large (the size is listed) from the LDAP server whose address and port are recorded in the Source field. The maximum size of directory data that the router allows is also recorded.

The router has verified the path of the certificate with the listed subject name.

Due to the reasons listed, the certificate with the listed subject name has not passed the path verification. The recorded reason codes are only approximate reasons for not trusting the certificate. See Table 89 for the corresponding descriptions of the codes.

Table 89 Certificate path verification failure reason codes

Code Description

Algorithm mismatch between the certificate and the search constraints.

Key usage mismatch between the certificate and the search constraints.

Certificate was not valid in the time interval.

(Not used)

Certificate is not valid.

Certificate signature was not verified correctly.

Certificate was revoked by a CRL.

Certificate was not added to the cache.

Certificate decoding failed.

Certificate was not found (anywhere).

NN47923-501

Appendix J Log descriptions 327

Table 89 Certificate path verification failure reason codes

Code Description

Certificate chain looped (did not find trusted root).

Certificate contains critical extension that was not handled.

Certificate issuer was not valid (CA specific information missing).

(Not used)

CRL is too old.

CRL is not valid.

CRL signature was not verified correctly.

CRL was not found (anywhere).

CRL was not added to the cache.

CRL decoding failed.

CRL is not currently valid, but in the future.

CRL contains duplicate serial numbers.

Time interval is not continuous.

Time information not available.

Database method failed due to timeout.

Database method failed.

Path was not verified.

Maximum path length reached.

Table 90 IEEE 802.1X logs

Log Message

Local User Database accepts user.

Local User Database reports user credential error.

Local User Database does not find user`s credential.

RADIUS accepts user.

RADIUS rejects user. Pls check

RADIUS Server.

Description

A user was authenticated by the local user database.

A user was not authenticated by the local user database because of an incorrect user password.

A user was not authenticated by the local user database because the user is not listed in the local user database.

A user was authenticated by the RADIUS Server.

A user was not authenticated by the RADIUS

Server. Check the RADIUS Server.

Nortel Business Secure Router 252 Configuration — Advanced

328 Appendix J Log descriptions

Table 90 IEEE 802.1X logs

Log Message

Local User Database does not support authentication method.

User logout because of session timeout expired.

User logout because of user deassociation.

User logout because of no authentication response from user.

User logout because of idle timeout expired.

User logout because of user request.

Local User Database does not support authentication mothed.

Description

The local user database only supports the

EAP-MD5 method. A user tried to use another authentication method and was not authenticated.

The router logged off a user whose session expired.

The router logged off a user who ended the session.

The router logged off a user from which there was no authentication response.

The router logged off a user whose idle timeout period expired.

A user logged off.

No response from RADIUS. Pls check RADIUS Server.

Use Local User Database to authenticate user.

Use RADIUS to authenticate user.

No Server to authenticate user.

Local User Database does not find user`s credential.

A user tried to use an authentication method that the local user database does not support (it only supports EAP-MD5).

There is no response message from the RADIUS server, check the RADIUS server.

The local user database is operating as the authentication server.

The RADIUS server is operating as the authentication server.

There is no authentication server to authenticate a user.

A user was not authenticated by the local user database because the user is not listed in the local user database.

Log commands

Go to the command interpreter interface (see Appendix G, “Command

Interpreter” on page 267 for information on how to access and use the commands).

NN47923-501

Appendix J Log descriptions 329

Configuring what you want the Business Secure Router to log

Use the sys logs load command to load the log setting buffer that is used to configure which logs the Business Secure Router is to record.

Use sys logs category followed by a log category and a parameter to decide what to record.

Table 91 Log categories and available settings

Log Categories access attack error ike ipsec javablocked mten upnp urlblocked urlforward

Available Parameters

0, 1, 2, 3

0, 1

0, 1, 2, 3

0, 1

Use 0 to not record logs for that category, 1 to record only logs for that category, 2 to record only alerts for that category, and 3 to record both logs and alerts for that category.

Use the sys logs save command to store the settings in the Business Secure Router

(you must do this in order to record logs).

Displaying logs

Use the sys logs display command to show all of the logs in the Business Secure

Router’s log.

Use the sys logs category display command to show the log settings for all of the log categories.

Nortel Business Secure Router 252 Configuration — Advanced

330 Appendix J Log descriptions

Use the sys logs display [log category] command to show the logs in an individual

Business Secure Router log category.

Use the sys logs clear command to erase all of the Business Secure Router’s logs.

Log command example

This example shows how to set the Business Secure Router to record the access logs and alerts and then view the results.

ras> sys logs load ras> sys logs category access 3 ras> sys logs save ras> sys logs display access

# .time source destination notes

message

0|11/11/2002 15:10:12 |172.22.3.80:137 |172.22.255.255:137 |ACCESS BLOCK

Firewall default policy: UDP(set:8)

1|11/11/2002 15:10:12 |172.21.4.17:138 |172.21.255.255:138 |ACCESS BLOCK

Firewall default policy: UDP(set:8)

2|11/11/2002 15:10:11 |172.17.2.1 |224.0.1.60 |ACCESS BLOCK

Firewall default policy: IGMP(set:8)

3|11/11/2002 15:10:11 |172.22.3.80:137 |172.22.255.255:137 |ACCESS BLOCK

Firewall default policy: UDP(set:8)

4|11/11/2002 15:10:10 |192.168.10.1:520 |192.168.10.255:520 |ACCESS BLOCK

Firewall default policy: UDP(set:8)

5|11/11/2002 15:10:10 |172.21.4.67:137 |172.21.255.255:137 |ACCESS BLOCK

NN47923-501

331

Appendix K

Brute force password guessing protection

Table 92 describes the commands for enabling, disabling and configuring the brute force password guessing protection mechanism for the password.

Table 92 Brute force password guessing protection commands

Command sys pwderrtm sys pwderrtm 0 sys pwderrtm N

Description

This command displays the brute-force guessing password protection settings.

This command turns off the password’s protection from brute-force guessing. The brute-force password guessing protection is turned off by default.

This command sets the password protection to block all access attempts for N (a number from 1 to 60) minutes after the third time an incorrect password is entered.

Example sys pwderrtm 5

This command sets the password protection to block all access attempts for five minutes after the third time an incorrect password is entered.

Nortel Business Secure Router 252 Configuration — Advanced

332 Appendix K Brute force password guessing protection

NN47923-501

333

Appendix L

SIP

The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol that handles the setting up, altering, and tearing down of voice and multimedia sessions over the Internet. SIP is used in VoIP (Voice over IP), the sending of voice signals over the Internet Protocol.

SIP signaling is separate from the media for which it handles sessions. The media that is exchanged during the session can use a different path from that of the signaling. SIP handles telephone calls and can interface with traditional circuit-switched telephone networks.

SIP Identities

A SIP account uses an identity (sometimes referred to as a SIP address). A complete SIP identity is called a SIP URI (Uniform Resource Identifier). The URI of a SIP account identifies the SIP account in a way similar to the way an e-mail address identifies an e-mail account. The format of a SIP identity is

SIP-Number@SIP-Service-Domain.

SIP Number

The SIP number is the part of the SIP URI that comes before the @ symbol. A SIP number can use letters like in an e-mail address ([email protected], for example) or numbers like a telephone number ([email protected], for example).

Nortel Business Secure Router 252 Configuration — Advanced

334 Appendix L SIP

SIP Service Domain

The SIP service domain of the VoIP service provider is the domain name in a SIP

URI. For example, if the SIP address is [email protected], then

VoIP-provider.com is the SIP service domain.

SIP Call Progression

Table 93 displays the basic steps in the setup and tear down of a SIP call. A calls

Table 93 SIP Call Progression

1. INVITE

2. Ringing

3. OK

4. ACK

5.Dialogue (voice traffic)

6. BYE

7. OK

1 A sends a SIP INVITE request to B. This message is an invitation for B to participate in a SIP telephone call.

2 B sends a response indicating that the telephone is ringing.

3 B sends an OK response after the call is answered.

4 A then sends an ACK message to acknowledge that B has answered the call.

5 Now A and B exchange voice media (talk).

6 After talking, A hangs up and sends a BYE request.

7 B replies with an OK response confirming receipt of the BYE request and the call is terminated.

NN47923-501

Appendix L SIP 335

SIP Servers

SIP is a client-server protocol. A SIP client is an application program or device that sends SIP requests. A SIP server responds to the SIP requests.

When you use SIP to make a VoIP call, it originates at a client and terminates at a server. A SIP client could be a computer or a SIP phone. One device can act as both a SIP client and a SIP server.

SIP User Agent Server

A SIP user agent server can make and receive VoIP telephone calls. This means that SIP can be used for peer-to-peer communications even though it is a client-server protocol. In Figure 160 , either A or B can act as a SIP user agent client to initiate a call. A and B can also both act as a SIP user agent server to receive the call.

Figure 160 SIP User Agent Server

SIP Proxy Server

A SIP proxy server receives requests from clients and forwards them to another server.

In the following example, client device A calls someone who is using client device C.

1 The client device (A in the figure) sends a call invitation to the SIP proxy server (B).

2 The SIP proxy server forwards the call invitation to C.

Nortel Business Secure Router 252 Configuration — Advanced

336 Appendix L SIP

Figure 161 SIP Proxy Server

SIP Redirect Server

A SIP redirect server accepts SIP requests, translates the destination address to an

IP address and sends the translated IP address back to the device that sent the request. Then the client device that originally sent the request can send requests to the IP address that it received back from the redirect server. Redirect servers do not initiate SIP requests.

In the following example, client device A calls someone who is using client device C.

1 Client device A sends a call invitation for C to the SIP redirect server (B).

2 The SIP redirect server sends the invitation back to A with C’s IP address (or domain name).

3 Client device A then sends the call invitation to client device C.

NN47923-501

Figure 162 SIP Redirect Server

Appendix L SIP 337

SIP Register Server

A SIP register server maintains a database of SIP identity-to-IP address (or domain name) mapping. The register server checks your username and password when you register.

RTP

When you make a VoIP call using SIP, the RTP (Real time Transport Protocol) is used to handle voice data transfer. See RFC 1889 for details on RTP.

Nortel Business Secure Router 252 Configuration — Advanced

338 Appendix L SIP

SIP ALG

Some NAT routers can include a SIP Application Layer Gateway (ALG). A SIP

ALG allows VoIP calls to pass through NAT by examining and translating IP addresses embedded in the data stream. When a VoIP device (SIP client) behind the SIP ALG registers with the SIP register server, the SIP ALG translates the device’s private IP address inside the SIP data stream to a public IP address. You do not need to use STUN if your VoIP device is behind the SIP ALG.

STUN

Using STUN (Simple Traversal of User Datagram Protocol (UDP) through

Network Address Translators), the VoIP device can the presence and types of

NAT routers, firewalls, or both between it and the public Internet. With STUN, the VoIP device can also find the public IP address that NAT assigned, so the

VoIP device can embed it in the SIP data stream. See “ STUN - Simple Traversal of User Datagram Protocol (UDP) Through Network Address Translators

(NATs) ” (RFC 3489) for details on STUN.

Business Secure Router SIP ALG

• SIP clients must be connected to the LAN. A SIP server must be on the WAN.

• You can make and receive calls between the LAN and the WAN. You cannot make a call between the LAN and the LAN.

• The SIP ALG forwards UDP packets with a port 5060 destination to pass through.

• The Business Secure Router forwards SIP audio connections.

NN47923-501

Figure 163 Business Secure Router SIP ALG

Signaling session over UDP port 5060

Audio session using RTP

Appendix L SIP 339

SIP ALG and NAT

The Business Secure Router dynamically creates an implicit port forwarding rule for SIP traffic from the WAN to the LAN.

The SIP ALG on the Business Secure Router supports all NAT mapping types, including One to One , Many to One , Many to Many Overload and Many One to One .

SIP ALG and firewall

The Business Secure Router creates an implicit temporary firewall rule for the dynamic RTP port on the WAN to the SIP client device on the LAN. The firewall rule is created for both directions to allow voice packets. The firewall rule is deleted when the call is terminated.

SIP ALG and Multiple WAN

When the Business Secure Router has two WAN ports and uses the second highest priority WAN port as a back up, it drops SIP connections when the primary WAN port connection fails. The Business Secure Router does not automatically change the SIP connection to the secondary WAN port.

Nortel Business Secure Router 252 Configuration — Advanced

340 Appendix L SIP

If the primary WAN connection fails, the SIP client needs to re-register with the

SIP server through the secondary WAN port to have the SIP connection go through the secondary WAN port.

When the Business Secure Router uses both of the WAN ports at the same time, you can configure a routing policy to have the voice traffic from any IP address with UDP port 5060 and the RTP ports go over a specified WAN port.

Enabling or disabling the SIP ALG

The Business Secure Router SIP ALG is turned off by default to avoid retranslating the IP address of an existing SIP device that is using STUN. If you want to use a SIP client device (a SIP phone or IP phone for example) behind the

Business Secure Router without STUN, use the ip alg enable ALG_SIP command to activate the SIP ALG.

Signaling session timeout

Most SIP clients have an expire mechanism indicating the lifetime of signaling sessions. The SIP UA sends registration packets to the SIP server periodically and keeps the session alive in the Business Secure Router.

If the SIP client does not have this mechanism and makes no call during the

Business Secure Router SIP timeout default (60 minutes), the Business Secure

Router SIP ALG drops any incoming calls after the timeout period. You can use the ip alg siptimeout command to change the timeout value.

Audio session timeout

If no voice packets go through the SIP ALG before the timeout period default (5 minutes) expires, the SIP ALG does not drop the call but blocks all voice traffic and deletes the audio session. You cannot hear anything and you must make a new call to continue your conversation.

NN47923-501

341

Index

Numbers

4-Port Switch 33

A

ACK Message 334

Active 62, 65

ADSL standards 32

ALG 338

Allocated Budget 63

Alternative Subnet Mask Notation 260

Application Layer Gateway 338

Applications 39

AT command 57, 60, 180

ATM Options 95

Authen 63

Authentication 63, 85, 89

Authentication Protocol 85

Autonegotiating 10/100 Mb/s Ethernet LAN 34

Autosensing 10/100 Mb/s Ethernet LAN 34

Auxiliary 34

B

Backup 180

Brute Force Password Guessing Protection 36

Budget Management 202

BYE Request 334

C

Call Back Delay 61

Call Control 201

Call History 204

Call Scheduling 36, 213

Maximum Number of Schedule Sets 213

PPPoE 216

Precedence 214

Precedence Example 214

Call-Triggering Packet 174

Central Network Management 37

CHAP 63, 89

CHAP/PAP 89

Client-server Protocol 335

Collision 166

Command Interpreter Mode 199

Community 153

Conditions that prevent TFTP and FTP from working over WAN 183

Console Port 166, 167, 169, 254

Content Filtering 36

Contivity VPN Client Software 35 conventions, text 25 copyright 2

Cost Of Transmission 92

CPU Load 166

D

DDNS

Configuration 52

Nortel Business Secure Router 252 Configuration — Advanced

342 Index

DDNS Type 53

Denial of Service 131

DHCP 75

DHCP (Dynamic Host Configuration Protocol) 38

DHCP Ethernet Setup 74

Diagnostic 175

DIAL BACKUP 254

Dial Timeout 61

DoS (Denial of Service) 35

Drop Timeout 61

DTR 60

Dynamic DNS Support 37

E

Edit IP 63

EMAIL 53

E-mail Address 53

Enable Wildcard 53

Encapsulation 82, 87 encapsulation 33

Entering Information 45

Ethernet Encapsulation 94

F

F/W Version 180

Features 32

Filename Conventions 179

Filter 71, 93

Applying 150

Configuration 133

Configuring 136

Example 146

Generic Filter Rule 144

Generic Rule 145

NAT 149

Remote Node 151

Structure 134

NN47923-501

TCP/IP Rule 140

Filters

Executing a Filter Rule 134

IP Filter Logic Flow 142

Firewall 35

Activating 131

SMT Menus 131

Flow Control 43

FTP 211

FTP File Transfer 190

FTP Restrictions 183, 211

FTP Server 39, 123

Full Network Management 38

G

Gateway IP Address 101

General Setup 49

H

Hardware Setup 40

Hidden Menus 45

Hop Count 92

Host 53

Host IDs 258

HTTPS 35

HyperTerminal program 185, 188

I

Idle Timeout 64, 86

IEEE 802.1x 35

IGMP support 92

Incoming Protocol Filters 79

Initial Screen 43

Internet Access 81, 82

Internet access 32

Internet Access Configuration 81

Internet Access information 81

Internet Access Setup 106

Introduction to Filters 133

IP Address 63, 66, 77, 78, 168

Remote 66

IP Address Assignment 66

IP Addressing 257

IP Alias 37, 78

IP Alias Setup 77, 78

IP Classes 257

IP Multicast 37

Internet Group Management Protocol

(IGMP) 37

IP Pool 75, 76

IP Static Route 99, 100, 101

Active 101

Destination IP Address 101

IP Subnet Mask 101

Name 101

Route Number 101

IP Subnet Mask 66, 78

Remote 66

IPSec VPN Capability 34, 35

L

LAN 166

LAN Port Filter Setup 73

LAN Setup 73, 74

LAN-to-LAN application 87

Link type 165

LLC 95

LLC-based Multiplexing 95

Log 169

Log Facility 171

Logging 39

Logging In to the SMT 44

Index 343

M

Main Menu 45

Mean Time Between Failures 253

Metric 67, 92, 101

MTBF 253

Multicast 68, 77, 92

Multimedia 333

Multiplexing 33, 82, 87 multiplexing 95

My Login 62

My Password 62

My WAN Address 67, 92

N

Nailed-Up Connection 64

Nailed-up Connection 86

NAT 67, 149

Applying NAT in the SMT Menus 105

Configuring 108

Examples 119

Ordering Rules 112

NAT Routers 338

Network Address Translation 83

Network Address Translation (NAT) 38, 105

Network Address Translators 338

O

Offline 53

OK Response 334

Operation Temperature 253

Outgoing Protocol Filters 79

P

Packet

Error 165

Received 166

Nortel Business Secure Router 252 Configuration — Advanced

344 Index

Transmitted 166

Packet Filtering 36

Packets 165

PAP 63, 89

Password 44, 47, 153

Period(hr) 63

Ping 177

Port Forwarding 38

PPP 64

PPP Encapsulation 95

PPPoA 87

PPPoE 36, 249

PPPoE Encapsulation 86, 94

Private 67, 92, 101

Protocol Filters 79

Incoming 79

Outgoing 79 publications hard copy 26 related 26

R

Rate

Receiving 165

Transmission 165

Real time Transport Protocol 337 regulatory information 2

Rem IP Address 66

Rem Node Name 62, 65

Remote Management 209

Remote Management Limitations 211

Remote Node 85, 166

Remote Node Setup 86

Remote Node Filter 71, 93

Remote Node Index Number 165

Required fields 45

Reset Button 34

NN47923-501

Resetting the Time 208

Restore Configuration 186 retry count 61 retry interval 61

RFC 1889 337

RFC 3489 338

RFC-1483 88

RFC-2364 87

RIP 67, 77, 79, 92

Direction 79

Version 79

RTP 337

S

Schedule Sets

Duration 215

Server 108, 111, 114, 115, 121, 122, 206

Session Initiation Protocol 333 setup a schedule 214

SIP Account 333

SIP ALG 338

SIP Application Layer Gateway 338

SIP Client 335

SIP INVITE Request 334

SIP Redirect Server 336

SIP Register Server 337

SIP Servers 335

SIP URI 333

SIP User Agent Server 335

SMT 44

SNMP 37

Community 154

Configuration 153

Trusted Host 154

SNMP (Simple Network Management

Protocol) 37

SSH 35

Index 345

Stateful Inspection 35

SUA (Single User Account) 105

Subnet Mask 66, 77, 91, 101, 168

Subnet Masks 259

Subnetting 259

Syslog 170

Syslog IP Address 171

System Information 163, 166, 167

System Maintenance 163, 164, 165, 166, 168, 169,

170, 176, 177, 180, 183, 193, 194, 199, 201, 202,

204, 206

System Management Terminal 44

System Name 50

System Status 164

T

TCP/IP 65, 74, 77, 139, 140, 142, 145, 149

Setup 77

TCP/IP and DHCP Setup 74

TCP/IP filter rule 139 technical publications 26

Terminal Emulation 43 text conventions 25

TFTP File Transfer 192

TFTP Restrictions 183, 211

Time and Date 34

Time and Date Setting 205, 206

Time Zone 207

Timeout 64

Trace 169

Tracing 39 trademarks 2

Traffic Redirect 38

Setup 57

Triangle 229

Triangle Route Solutions 230

Trigger Port Forwarding 127

U

Uniform Resource Identifier 333

Universal Plug and Play 36

Upgradeable Firmware 39

Upload Firmware 189

UPnP 36

User Name 53

User Profiles 103

Username 44

V

VC 95

VC-based Multiplexing 87

Virtual Channel Identifier (VCI) 82

Virtual Path Identifier (VPI) 82

VT100 43

W

WAN DHCP 176, 177

WAN Setup 55, 56

WebGUI 132 www.dyndns.org 53

X

XMODEM protocol 181

Nortel Business Secure Router 252 Configuration — Advanced