Nortel BayStack 100-S Using Manual

Part No. 300868-G
November 2000
4401 Great America Parkway
Santa Clara, CA 95054
Using the BayStack
Instant Internet
Management Software
Version 7.11
Copyright © 2000 Nortel Networks
All rights reserved. November 2000.
The information in this document is subject to change without notice. The statements, configurations, technical data, and
recommendations in this document are believed to be accurate and reliable, but are presented without express or implied
warranty. Users must take full responsibility for their applications of any products specified in this document. The
information in this document is proprietary to Nortel Networks NA Inc.
The software described in this document is furnished under a license agreement and may be used only in accordance
with the terms of that license. The software license agreement is included in this document.
Trademarks
NORTEL NETWORKS is a trademark of Nortel Networks.
BayStack, Contivity, Instant Internet, Nortel Networks, and the Nortel Networks logo are trademarks of Nortel
Networks.
Microsoft, Windows, and Windows NT are registered trademarks of Microsoft Corporation.
All other trademarks and registered trademarks are the property of their respective owners.
Restricted rights legend
Use, duplication, or disclosure by the United States Government is subject to restrictions as set forth in subparagraph
(c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013.
Notwithstanding any other license agreement that may pertain to, or accompany the delivery of, this computer software,
the rights of the United States Government regarding its use, reproduction, and disclosure are as set forth in the
Commercial Computer Software-Restricted Rights clause at FAR 52.227-19.
Statement of conditions
In the interest of improving internal design, operational function, and/or reliability, Nortel Networks NA Inc. reserves
the right to make changes to the products described in this document without notice.
Nortel Networks NA Inc. does not assume any liability that may occur due to the use or application of the product(s) or
circuit layout(s) described herein.
In addition, the program and information contained herein are licensed only pursuant to a license agreement that contains
restrictions on use and disclosure (that may incorporate by reference certain limitations and notices imposed by third
parties).
2
300868-G
3
Nortel Networks NA Inc. software license agreement
NOTICE: Please carefully read this license agreement before copying or using the accompanying software or installing
the hardware unit with pre-enabled software (each of which is referred to as “Software” in this Agreement). BY
COPYING OR USING THE SOFTWARE, YOU ACCEPT ALL OF THE TERMS AND CONDITIONS OF THIS
LICENSE AGREEMENT. THE TERMS EXPRESSED IN THIS AGREEMENT ARE THE ONLY TERMS UNDER
WHICH NORTEL NETWORKS WILL PERMIT YOU TO USE THE SOFTWARE. If you do not accept these terms
and conditions, return the product, unused and in the original shipping container, within 30 days of purchase to obtain a
credit for the full purchase price.
1. License grant. Nortel Networks NA Inc. (“Nortel Networks”) grants the end user of the Software (“Licensee”) a
personal, nonexclusive, nontransferable license: a) to use the Software either on a single computer or, if applicable, on a
single authorized device identified by host ID, for which it was originally acquired; b) to copy the Software solely for
backup purposes in support of authorized use of the Software; and c) to use and copy the associated user manual solely
in support of authorized use of the Software by Licensee. This license applies to the Software only and does not extend
to Nortel Networks Agent software or other Nortel Networks software products. Nortel Networks Agent software or
other Nortel Networks software products are licensed for use under the terms of the applicable Nortel Networks NA Inc.
Software License Agreement that accompanies such software and upon payment by the end user of the applicable
license fees for such software.
2. Restrictions on use; reservation of rights. The Software and user manuals are protected under copyright laws.
Nortel Networks and/or its licensors retain all title and ownership in both the Software and user manuals, including any
revisions made by Nortel Networks or its licensors. The copyright notice must be reproduced and included with any
copy of any portion of the Software or user manuals. Licensee may not modify, translate, decompile, disassemble, use
for any competitive analysis, reverse engineer, distribute, or create derivative works from the Software or user manuals
or any copy, in whole or in part. Except as expressly provided in this Agreement, Licensee may not copy or transfer the
Software or user manuals, in whole or in part. The Software and user manuals embody Nortel Networks’ and its
licensors’ confidential and proprietary intellectual property. Licensee shall not sublicense, assign, or otherwise disclose
to any third party the Software, or any information about the operation, design, performance, or implementation of the
Software and user manuals that is confidential to Nortel Networks and its licensors; however, Licensee may grant
permission to its consultants, subcontractors, and agents to use the Software at Licensee’s facility, provided they have
agreed to use the Software only in accordance with the terms of this license.
3. Limited warranty. Nortel Networks warrants each item of Software, as delivered by Nortel Networks and properly
installed and operated on Nortel Networks hardware or other equipment it is originally licensed for, to function
substantially as described in its accompanying user manual during its warranty period, which begins on the date
Software is first shipped to Licensee. If any item of Software fails to so function during its warranty period, as the sole
remedy Nortel Networks will at its discretion provide a suitable fix, patch, or workaround for the problem that may be
included in a future Software release. Nortel Networks further warrants to Licensee that the media on which the
Software is provided will be free from defects in materials and workmanship under normal use for a period of 90 days
from the date Software is first shipped to Licensee. Nortel Networks will replace defective media at no charge if it is
returned to Nortel Networks during the warranty period along with proof of the date of shipment. This warranty does not
apply if the media has been damaged as a result of accident, misuse, or abuse. The Licensee assumes all responsibility
for selection of the Software to achieve Licensee’s intended results and for the installation, use, and results obtained
from the Software. Nortel Networks does not warrant a) that the functions contained in the software will meet the
Licensee’s requirements, b) that the Software will operate in the hardware or software combinations that the Licensee
may select, c) that the operation of the Software will be uninterrupted or error free, or d) that all defects in the operation
of the Software will be corrected. Nortel Networks is not obligated to remedy any Software defect that cannot be
reproduced with the latest Software release. These warranties do not apply to the Software if it has been (i) altered,
except by Nortel Networks or in accordance with its instructions; (ii) used in conjunction with another vendor’s product,
resulting in the defect; or (iii) damaged by improper environment, abuse, misuse, accident, or negligence. THE
FOREGOING WARRANTIES AND LIMITATIONS ARE EXCLUSIVE REMEDIES AND ARE IN LIEU OF ALL
OTHER WARRANTIES EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY WARRANTY OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Licensee is responsible for the security of its
own data and information and for maintaining adequate procedures apart from the Software to reconstruct lost or altered
files, data, or programs.
Using the BayStack Instant Internet Management Software Version 7.11
4
4. Limitation of liability. IN NO EVENT WILL NORTEL NETWORKS OR ITS LICENSORS BE LIABLE FOR
ANY COST OF SUBSTITUTE PROCUREMENT; SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
DAMAGES; OR ANY DAMAGES RESULTING FROM INACCURATE OR LOST DATA OR LOSS OF USE OR
PROFITS ARISING OUT OF OR IN CONNECTION WITH THE PERFORMANCE OF THE SOFTWARE, EVEN IF
NORTEL NETWORKS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT
SHALL THE LIABILITY OF NORTEL NETWORKS RELATING TO THE SOFTWARE OR THIS AGREEMENT
EXCEED THE PRICE PAID TO NORTEL NETWORKS FOR THE SOFTWARE LICENSE.
5. Government licensees. This provision applies to all Software and documentation acquired directly or indirectly by or
on behalf of the United States Government. The Software and documentation are commercial products, licensed on the
open market at market prices, and were developed entirely at private expense and without the use of any U.S.
Government funds. The license to the U.S. Government is granted only with restricted rights, and use, duplication, or
disclosure by the U.S. Government is subject to the restrictions set forth in subparagraph (c)(1) of the Commercial
Computer Software––Restricted Rights clause of FAR 52.227-19 and the limitations set out in this license for civilian
agencies, and subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause of DFARS
252.227-7013, for agencies of the Department of Defense or their successors, whichever is applicable.
6. Use of Software in the European Community. This provision applies to all Software acquired for use within the
European Community. If Licensee uses the Software within a country in the European Community, the Software
Directive enacted by the Council of European Communities Directive dated 14 May, 1991, will apply to the examination
of the Software to facilitate interoperability. Licensee agrees to notify Nortel Networks of any such intended
examination of the Software and may procure support and assistance from Nortel Networks.
7. Term and termination. This license is effective until terminated; however, all of the restrictions with respect to
Nortel Networks’ copyright in the Software and user manuals will cease being effective at the date of expiration of the
Nortel Networks copyright; those restrictions relating to use and disclosure of Nortel Networks’ confidential information
shall continue in effect. Licensee may terminate this license at any time. The license will automatically terminate if
Licensee fails to comply with any of the terms and conditions of the license. Upon termination for any reason, Licensee
will immediately destroy or return to Nortel Networks the Software, user manuals, and all copies. Nortel Networks is not
liable to Licensee for damages in any form solely by reason of the termination of this license.
8. Export and re-export. Licensee agrees not to export, directly or indirectly, the Software or related technical data or
information without first obtaining any required export licenses or other governmental approvals. Without limiting the
foregoing, Licensee, on behalf of itself and its subsidiaries and affiliates, agrees that it will not, without first obtaining all
export licenses and approvals required by the U.S. Government: (i) export, re-export, transfer, or divert any such
Software or technical data, or any direct product thereof, to any country to which such exports or re-exports are restricted
or embargoed under United States export control laws and regulations, or to any national or resident of such restricted or
embargoed countries; or (ii) provide the Software or related technical data or information to any military end user or for
any military end use, including the design, development, or production of any chemical, nuclear, or biological weapons.
9. General. If any provision of this Agreement is held to be invalid or unenforceable by a court of competent
jurisdiction, the remainder of the provisions of this Agreement shall remain in full force and effect. This Agreement will
be governed by the laws of the state of California.
Should you have any questions concerning this Agreement, contact Nortel Networks, 4401 Great America Parkway, P.O.
Box 58185, Santa Clara, California 95054-8185.
LICENSEE ACKNOWLEDGES THAT LICENSEE HAS READ THIS AGREEMENT, UNDERSTANDS IT, AND
AGREES TO BE BOUND BY ITS TERMS AND CONDITIONS. LICENSEE FURTHER AGREES THAT THIS
AGREEMENT IS THE ENTIRE AND EXCLUSIVE AGREEMENT BETWEEN NORTEL NETWORKS AND
LICENSEE, WHICH SUPERSEDES ALL PRIOR ORAL AND WRITTEN AGREEMENTS AND
COMMUNICATIONS BETWEEN THE PARTIES PERTAINING TO THE SUBJECT MATTER OF THIS
AGREEMENT. NO DIFFERENT OR ADDITIONAL TERMS WILL BE ENFORCEABLE AGAINST NORTEL
NETWORKS UNLESS NORTEL NETWORKS GIVES ITS EXPRESS WRITTEN CONSENT, INCLUDING AN
EXPRESS WAIVER OF THE TERMS OF THIS AGREEMENT.
300868-G
5
Contents
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Before you begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Text conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Related publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Hard-copy technical manuals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
How to get help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Chapter 1
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
How Instant Internet can function in your network . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
IP networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
IPX networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Services Instant Internet provides . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Deciding what to do next . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Chapter 2
User access administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Administration program overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Starting Admin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Administration program icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Default user and everyone group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Restoring the default user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Restoring the everyone group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Managing directory service users and groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Setting the domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Setting user name order . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Using the BayStack Instant Internet Management Software Version 7.11
6
Contents
Migrating your database to use unique users and groups by server . . . . . . . . . . . 41
Managing Windows 95, Windows 98, Windows NT, and Windows 2000
domain users and groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Viewing Windows 95, Windows 98, Windows NT, or Windows 2000
Users and Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Managing NetWare NDS users and groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Setting the context for NDS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Managing Novell Bindery users and groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Setting the NetWare preferred server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Setting up IP users not using iiLogin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Creating and removing users and groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Creating a new user or group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Creating a user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Creating a group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Adding a user to a group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Deleting users and groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Deleting a user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Deleting a group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Managing users and groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Copying user and group Internet access settings . . . . . . . . . . . . . . . . . . . . . . . . . 51
Viewing effective user access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Defining user and group access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Disabling user or group access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Ignoring group settings option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Enabling logging for a user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Configuring Internet access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Defining controlled Internet access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Three kinds of Internet addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Overview of configuring Internet access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Adding Internet access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Removing Internet access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Changing Internet access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Managing news group access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Adding news group access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Removing news group access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Changing news group access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
300868-G
Contents
7
Managing incoming port access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Adding incoming port access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Removing incoming port access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Changing incoming port access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Managing RAW sockets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Specifying the message a user sees upon an error . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Creating reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Common user and group access examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Allowing unlimited access for everyone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Restricting access to a few sites for everyone . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Allowing access to a few sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Managing a remote Instant Internet unit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Chapter 3
Internet activity logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Activity logging overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Monitoring an Instant Internet unit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Viewing statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Viewing users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Viewing Web site access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Viewing diagnostic information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Performing a Trace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Monitoring multiple Instant Internet units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Activating automatic logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Enabling Auto Run . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Configuring automatic logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Editing an automatic logging configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Deleting a log from the automatic logging configuration . . . . . . . . . . . . . . . . . . . 112
Exporting log files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Using the BayStack Instant Internet Management Software Version 7.11
8
Contents
Chapter 4
Proxy services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Understanding proxy servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Using Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Configuring Instant Internet as a Web proxy server . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Using a commercial proxy server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Enabling Web configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Configuring workstations to use the Instant Internet unit as a Web proxy server . . . 119
Configuring Instant Internet as a DNS proxy server . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Configuring Instant Internet as a SOCKS proxy server . . . . . . . . . . . . . . . . . . . . . . . 121
Using SOCKS workstations with the Administration program . . . . . . . . . . . . . . . . . . 122
Administration options that do not apply to SOCKS workstations . . . . . . . . . . . . 123
Host name access controls and SOCKS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Configuring socksified applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
Configuring common SOCKS-enabled software . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125
Third-party socksifying software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Additional information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Chapter 5
Advanced IP configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Using Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Configuring a static route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Configuring IP forwarding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Enabling IP forwarding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Enabling IP forwarding for a unit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
Enabling IP forwarding for two interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Enabling IP forwarding for two Ethernet interfaces . . . . . . . . . . . . . . . . . . . . 132
Using network address translation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Configuring address translation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
Disabling address translation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
300868-G
Contents
9
Publishing a private server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Using Dynamic DNS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Configuring Instant Internet to publish a private server . . . . . . . . . . . . . . . . . 136
Example: Publishing an SMTP server when you have a static
IP address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Example: Publishing a Web server when you have a dynamic
IP address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
Example: Publishing a server for NetMeeting . . . . . . . . . . . . . . . . . . . . . 141
Configuring an IP filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
Processing a packet through an IP filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
Applying a filter to an interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
Enabling Instant Internet as a DHCP server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
Scopes and leases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
Using the DHCP/BootP relay agent feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
Configuring Instant Internet as a DHCP server . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Using Instant Internet as a DHCP workstation . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Configuring the routing information protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Configuring an alias for an interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
Using a DMZ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Configuring Instant Internet to support a DMZ . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Configuring the interface to support the DMZ: . . . . . . . . . . . . . . . . . . . . . . . 161
Publishing the server(s) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
Deciding whether to enable IP forwarding for your DMZ . . . . . . . . . . . . . . . 162
Example: Using a DMZ to publish a Web server . . . . . . . . . . . . . . . . . . . . . . . . . 163
Chapter 6
IP security and VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Understanding virtual private networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Understanding modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
Using perfect forward secrecy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Using the default network specification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
Managing local and remote IP addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
Adding a local or remote IP address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
Removing a local or remote IP address . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
Using the BayStack Instant Internet Management Software Version 7.11
10
Contents
Using Pings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
Understanding how an Instant Internet-to-Instant Internet VPN works . . . . . . . . 177
Allowing only incoming connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
Allowing only outgoing connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
Allowing both outgoing and incoming connections . . . . . . . . . . . . . . . . . . . . 181
Understanding how an Instant Internet-to-CES VPN works . . . . . . . . . . . . . . . . 183
General guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Other issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
How a tunnel is initiated . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
Tunnel validity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
Dial-up environments and tunnel validity . . . . . . . . . . . . . . . . . . . . . . . . 186
Tunnel timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Tunneling to CES when Instant Internet has a static IP address . . . . . . . . . 188
Example for configuring a branch office connection in the CES . . . . . . . 189
Configuring Instant Internet as a main-mode VPN tunnel . . . . . . . . . . . 190
Tunneling to the CES when Instant Internet has a dynamic IP address . . . . 192
Example for configuring the non-Contivity client connection
on the CES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Configuring Instant Internet as an aggressive-mode VPN tunnel . . . . . . 194
Troubleshooting a VPN tunnel connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Viewing a unit’s IPsec log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
IPsec connection state information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Chapter 7
Web cache configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Introduction to Web caching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
How the Instant Internet unit functions as a proxy server . . . . . . . . . . . . . . . . . . 201
How the Instant Internet unit functions as a caching proxy server . . . . . . . . . . . 202
How Web caching works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
How the Instant Internet unit expires entries . . . . . . . . . . . . . . . . . . . . . . . . . 202
How Web caching works with a user’s local cache . . . . . . . . . . . . . . . . . . . . . . . 203
Connecting to the Instant Internet unit with a Web browser . . . . . . . . . . . . . . . . . . . . 204
Viewing the Instant Internet unit system status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Getting started with the Web cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
300868-G
Contents
11
Increasing efficiency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Fine-tuning cache settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Increasing response times . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Increasing bandwidth savings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Deciding how long to run an experiment . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Selecting a cache level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
How cache levels are defined . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
Expiration percent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
Example one . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
Example two . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
Minimum expiration time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
Example one . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
Example two . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
Special Web requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
Error message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
Predefined cache levels default values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Creating a custom cache level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
Interpreting statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Using statistics to fine-tune cache settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Viewing why requests are not sent from the cache . . . . . . . . . . . . . . . . . . . . . . . 216
Limiting the size of a cached entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Setting options for special Web requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
CGI requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
Query requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
“No-cache” requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
Setting the action the cache performs when a Web server error occurs . . . . . . . 222
Resetting cache statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
Managing cookies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Establishing a cookie management policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
Managing cookies for all unconfigured Web sites . . . . . . . . . . . . . . . . . . . . . . . . 225
Managing cookies for a particular Web site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
Enabling cookies for a particular Web site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
Sorting the Web sites list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Using the BayStack Instant Internet Management Software Version 7.11
12
Contents
Managing Web site access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
Blocking Web site access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Blocking access to all unconfigured Web sites . . . . . . . . . . . . . . . . . . . . . . . 229
Blocking access to a particular Web site . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Setting Web site activity display options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Configuring Web site display options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Bypassing the cache for a Web site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Saving and Restoring Web site configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Refreshing cache entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Setting active refresh options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Interpreting active refresh statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
Troubleshooting the Web cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
I requested a Web site, but there was no response. . . . . . . . . . . . . . . . . . . . . . . 236
I blocked a site, but it still opens in a user’s Web browser. . . . . . . . . . . . . . . . . . 236
I requested a Web page, but the content looks outdated. . . . . . . . . . . . . . . . . . . 236
I requested a Web page and the originating Web server takes a long time
to respond. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
I am not able to configure a personalized Web page. . . . . . . . . . . . . . . . . . . . . . 238
I logged on to a Web site, but I am prompted to log on again. . . . . . . . . . . . . . . 238
I added an item to my online shopping cart, but it’s still empty. . . . . . . . . . . . . . . 238
Chapter 8
Advanced communications configuration . . . . . . . . . . . . . . . . . . . . . . . . 239
Configuring advanced communication settings for an ISDN connection . . . . . . . . . . 239
Adding a backup phone number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
Setting the inactivity timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
Configuring advanced ISDN features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
Enabling bandwidth on demand . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Configuring voice call options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
Configuring incoming data call options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
300868-G
Contents
13
Configuring advanced communication settings for a dial-up connection . . . . . . . . . . 245
Adding a backup phone number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
Setting the inactivity timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Enabling bandwidth on demand . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Configuring the modem speaker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Setting the number of lines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Configuring advanced communication settings for a T1 connection . . . . . . . . . . . . . 249
Configuring advanced communication settings for an E1 connection . . . . . . . . . . . . 251
Configuring advanced communication settings for a PPPoE connection . . . . . . . . . 254
Chapter 9
IPX configuration and support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
Using Instant Internet as an IPX-to-IP gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
Security considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
Performance considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Normal delays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Number of simultaneous connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
When to consider a higher-speed connection . . . . . . . . . . . . . . . . . . . . . . . . 259
Configuring IPX workstations to use a new unit name . . . . . . . . . . . . . . . . . . . . . . . . 259
Configuring IPX frame types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Resolving Winsock conflicts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
16-bit Winsocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
32-bit Winsocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Winsock 1.1 and Winsock 2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Using multiple versions of Winsock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
Using multiple 16-bit Winsocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Using multiple 32-bit Winsocks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Winsock files installed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
Windows 3.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
16-bit only . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
Windows 95 and Windows 98 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
16-bit and 32-bit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
Windows 95 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
16-bit and 32-bit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
Using the BayStack Instant Internet Management Software Version 7.11
14
Contents
Windows NT 4.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
16-bit and 32-bit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
Resolving Winsock conflicts during installation . . . . . . . . . . . . . . . . . . . . . . . . . . 266
IP filters and Winsock compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Configuring the Instant Internet unit in a multiple-unit environment . . . . . . . . . . . . . . 267
Configuring fault tolerance and automatic user load balancing . . . . . . . . . . . . . . 268
Configuring multiple default sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
Example: Sales . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
Example: Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
Example: Marketing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Example: IS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Example: normal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
Installing multiple Instant Internet units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
Tips for installing multiple units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
Chapter 10
Instant Internet unit configuration, support, and diagnostics. . . . . . . . . 273
Restarting the Instant Internet unit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Identifying the login workstation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
Adding a unit to the selection list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
Understanding the name server list order . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276
Saving and restoring unit configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
Backing up a unit configuration to disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
Restoring a unit configuration from disk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
Changing the unit configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
Changing your ISP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
Changing registration information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
Changing a unit’s configuration password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Changing a unit’s name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Changing a unit’s time, date, or time zone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
Selecting additional support options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
Enabling diagnostic IP tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
300868-G
Contents
15
Testing connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Testing the connection to the Internet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
Testing the connection to a host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
Testing the response time of a host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
Tracing the route to a host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
Testing the echo port of a host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
Setting host connection test options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
Appendix A
Troubleshooting and error messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
Viewing the Instant Internet serial number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
Viewing system files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
Viewing system files in setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
Viewing unit log information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
Viewing a unit’s users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
Viewing a unit’s update history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
Viewing a unit’s advanced TCP/IP settings . . . . . . . . . . . . . . . . . . . . . . . . . . 305
Viewing a unit’s port mappings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
Viewing a unit’s support hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
Viewing system files through a Web browser . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
Viewing log files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
Viewing the update history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
Viewing the system settings file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
Viewing a unit’s port mappings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
Viewing the hosts file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
IP workstation error messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
IPX workstation error messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
Access errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
Server name errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
Winsock.dll errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
Version errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312
Errors connecting to the network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312
Common questions and answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
Using the BayStack Instant Internet Management Software Version 7.11
16
Contents
300868-G
17
Figures
Figure 1
Default User icon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Figure 2
Set Domain dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Figure 3
Set User Name Order dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Figure 4
Prompt to use selected user as a template . . . . . . . . . . . . . . . . . . . . . . . 46
Figure 5
Create a User dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Figure 6
Prompt to use selected group as a template . . . . . . . . . . . . . . . . . . . . . . 47
Figure 7
Create a Group dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Figure 8
Delete user confirmation message box . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Figure 9
Delete group confirmation message box . . . . . . . . . . . . . . . . . . . . . . . . . 50
Figure 10
Copy user confirmation message box . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Figure 11
Copy group confirmation message box . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Figure 12
Effective Settings of User dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Figure 13
Change Settings of User dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Figure 14
Change User Access dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Figure 15
Change Settings of User dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Figure 16
Change Internet Access dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Figure 17
Add Internet Access dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Figure 18
Change Settings of User dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Figure 19
Change Internet Access dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Figure 20
Delete access confirmation message box . . . . . . . . . . . . . . . . . . . . . . . . 68
Figure 21
Change Settings of User dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Figure 22
Change Internet Access dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Figure 23
Change Internet Access dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Figure 24
Change Settings of User dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Figure 25
Change News Groups dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Figure 26
Add News Group dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Figure 27
Change Settings of User dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Figure 28
Change News Groups dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Figure 29
Delete news group confirmation message box . . . . . . . . . . . . . . . . . . . . . 74
Using the BayStack Instant Internet Management Software Version 7.11
18
Figures
Figure 30
Change Settings of User dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Figure 31
Change News Groups dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Figure 32
Change News Group dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Figure 33
Change Settings of User dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Figure 34
Change Incoming Ports dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Figure 35
Add Incoming Port dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Figure 36
Change Settings of User dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Figure 37
Change Incoming Ports dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Figure 38
Delete incoming port confirmation message box . . . . . . . . . . . . . . . . . . . 81
Figure 39
Change Settings of User dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Figure 40
Change Incoming Ports dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Figure 41
Change Incoming Port dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Figure 42
Change Settings of User dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Figure 43
Select Reports dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Figure 44
Change User Access dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Figure 45
Change Internet access to deny access to a site example . . . . . . . . . . . . 88
Figure 46
Restrict Internet access example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Figure 47
Allow Internet access example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Figure 48
Monitor main window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
Figure 49
Sample Stats window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Figure 50
Sample Users window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Figure 51
Sample Log window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Figure 52
Sample Diag window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Figure 53
Sample Trace results file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Figure 54
Multiple Instant Internet units window . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Figure 55
Event Information dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Figure 56
Services dialog box, Web Proxy option . . . . . . . . . . . . . . . . . . . . . . . . . 117
Figure 57
WEB Proxy Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Figure 58
WEB Server Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . 119
Figure 59
Services dialog box, DNS Proxy option . . . . . . . . . . . . . . . . . . . . . . . . . 121
Figure 60
Services dialog box, SOCKS Proxy option . . . . . . . . . . . . . . . . . . . . . . . 122
Figure 61
Static Routes dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Figure 62
Static Route Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Figure 63
Other Settings dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
Figure 64
Interface Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
300868-G
Figures
19
Figure 65
Server Publication dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Figure 66
Server Publication Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . 138
Figure 67
Publishing an SMTP server when you have a static IP address . . . . . . 139
Figure 68
Other Settings dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
Figure 69
Publishing a server for NetMeeting . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
Figure 70
Interface Filter Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . 144
Figure 71
Filter Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Figure 72
Rule Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Figure 73
Interface Filter Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . 148
Figure 74
Services dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Figure 75
DHCP Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Figure 76
Services dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Figure 77
DHCP Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Figure 78
Scope Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
Figure 79
Enter Excluded Addresses dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . 155
Figure 80
Enter Server Address dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Figure 81
RIP’s dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
Figure 82
Enter IP Information for Interface dialog box . . . . . . . . . . . . . . . . . . . . . 162
Figure 83
Enter IP Information for Interface dialog box . . . . . . . . . . . . . . . . . . . . . 163
Figure 84
Server Publication dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
Figure 85
IPsec Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
Figure 86
IPsec Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Figure 87
Enter IP Address dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
Figure 88
Pings dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Figure 89
Ping Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Figure 90
IPsec Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
Figure 91
IPsec Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
Figure 92
Enter Monitor / Control Connection Information dialog box . . . . . . . . . . 180
Figure 93
IPsec Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
Figure 94
Enter Monitor / Control Connection Information dialog box . . . . . . . . . . 182
Figure 95
IPsec Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Figure 96
Enter Monitor / Control Connection Information dialog box . . . . . . . . . . 191
Figure 97
IPsec Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Figure 98
Enter Monitor / Control Connection Information dialog box . . . . . . . . . . 195
Figure 99
Instant Internet Web home page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Using the BayStack Instant Internet Management Software Version 7.11
20
Figures
Figure 100 Web Cache page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
Figure 101 ISDN Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
Figure 102 ISDN Configuration (advanced) dialog box for the 100-S
and 400-S units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
Figure 103 ISDN Configuration (advanced) dialog box for the 100 and 400 units . . 243
Figure 104 Dialup Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
Figure 105 Dialup Configuration (advanced) dialog box . . . . . . . . . . . . . . . . . . . . . . 247
Figure 106 Dialup Configuration (advanced) dialog box . . . . . . . . . . . . . . . . . . . . . . 248
Figure 107 T1 Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Figure 108 T1 Advanced Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . 250
Figure 109 E1 Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
Figure 110 E1 Advanced Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . 252
Figure 111 PPPoE Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
Figure 112 PPPoE Configuration (advanced) dialog box . . . . . . . . . . . . . . . . . . . . . 255
Figure 113 Windows 95 Run dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
Figure 114 Instant Internet Units dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
Figure 115 Select IPX Frame Types dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Figure 116 Restarting Instant Internet dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
Figure 117 iiLogin icon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
Figure 118 iiLogin Connected as username dialog box . . . . . . . . . . . . . . . . . . . . . . 274
Figure 119 Instant Internet Units dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
Figure 120 Enter Unit’s IP Address dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276
Figure 121 Backup Setup Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . 277
Figure 122 Restore Setup Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . 278
Figure 123 Prompt to restore users and groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
Figure 124 Dialup Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281
Figure 125 ISDN Configuration dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282
Figure 126 Registration Information dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
Figure 127 Enter Password dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Figure 128 Re-enter Password dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Figure 129 Unit Name dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Figure 130 Unit Time dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
300868-G
Figures
21
Figure 131 Time Zone dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
Figure 132 Services dialog box . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Figure 133 Tools main window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
Figure 134 Ping test started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
Figure 135 Ping test finished . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
Figure 136 Trace test started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296
Figure 137 Trace test finished . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
Figure 138 Stress test started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298
Figure 139 Stress test finished . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299
Figure 140 Options dialog box in Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
Figure 141 About Instant Internet Setup dialog box, Serial Number box . . . . . . . . . 303
Figure 142 Instant Internet Web home page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
Using the BayStack Instant Internet Management Software Version 7.11
22
Figures
300868-G
23
Tables
Table 1
Services that Instant Internet provides
. . . . . . . . . . . . . . . . . . . . . . . . . . 33
Table 2
Admin user icons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Table 3
Designating Internet access – wildcard symbol . . . . . . . . . . . . . . . . . . . . 61
Table 4
Designating Internet access – checkmark . . . . . . . . . . . . . . . . . . . . . . . . 62
Table 5
Designating Internet access — X . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Table 6
Sample Internet access control list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Table 7
Add Internet Access dialog box items . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Table 8
Add Incoming Port dialog box items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Table 9
Report options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Table 10
Monitor main window toolbar buttons
Table 11
Stats window statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Table 12
Stats window statistics for a dial-up or ISDN interface or a VPN
tunnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Table 13
Users window statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Table 14
Monitor main window toolbar buttons
Table 15
Sort options in the Users window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Table 16
Log statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Table 17
Log window toolbar buttons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Table 18
Sort options in the log window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Table 19
Diag window statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Table 20
AutoLog toolbar buttons
Table 21
Phase 1 main mode states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
Table 22
Phase 1 aggressive mode states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
Table 23
Phase 2 main mode states
Table 24
Other state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
Table 25
Cache level default expiration settings for text and non-text entries . . . 213
. . . . . . . . . . . . . . . . . . . . . . . . . . . 94
. . . . . . . . . . . . . . . . . . . . . . . . . . 100
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
Using the BayStack Instant Internet Management Software Version 7.11
24
Tables
300868-G
25
Preface
The BayStack™ Instant Internet™ hardware and software solution is a managed
and secure gateway that connects any type of LAN to the Internet through a single
IP address. It connects directly to a network and lets all LAN users access the
Internet simultaneously. Instant Internet, along with your service provider, can
allow all network users to enjoy the broad information services available on the
Internet automatically! Within minutes, you can browse the World Wide Web,
retrieve files, search for information, participate in news groups, and send and
receive e-mail.
Before you begin
This manual is intended for network administrators and contains the following
information:
•
•
•
•
•
•
•
•
•
•
Administering the Instant Internet unit
Administering user and group Internet access
Monitoring the Instant Internet unit
Configuring the Instant Internet unit as a DNS, Web, or SOCKS proxy
Configuring the IP services that the Instant Internet unit will use
Configuring IP security (IPsec) for a virtual private network (VPN)
Using Web cache configuration to administer and configure the Instant
Internet unit’s Web cache settings
Support and diagnostic functions of the Instant Internet unit
Using built-in tools to test a connection to the Internet and to a host
IP and IPX support
Using the BayStack Instant Internet Management Software Version 7.11
26
Preface
Before you use this manual, you need to do two things. First, write down the
model number and serial number of the Instant Internet unit. This information will
be required if you need to call Nortel Networks Technical Support. These numbers
are located on the back of the Instant Internet unit. You can also view the serial
number using the Setup utility. For more information, see “Viewing the Instant
Internet serial number” on page 303.
Model #_____________________________________________
Example: CQ1001104 or CQ2001E80
Serial # _____________________________________________
Example: I0300004F or I4000181CC404F
Second, review the basic installation process in Installing the BayStack Instant
Internet Management Software Version 7.11 and determine how you want Instant
Internet to function in your network.
300868-G
Preface
27
Text conventions
This manual uses the following text conventions:
angle brackets (< >)
Indicate that you choose the text to enter based on the
description inside the brackets. Do not type the
brackets when entering the command.
Example: If the command syntax is:
ping <ip_address>, you enter:
ping 192.32.10.12
bold courier text
Indicates text that you need to enter and command
names and options.
Example: Enter ipconfig /release.
Example: Use the winipcfg command.
italic text
Indicates file and directory names, new terms, book
titles, and variables in command syntax descriptions.
Where a variable is two or more words, the words are
connected by an underscore.
Example: If the command syntax is:
dns <name_server>
<name_server> is one variable and you substitute one
value for it.
screen text
Indicates command syntex and system output, for
example, prompts and system messages.
Example: Waiting for Instant Internet to
restart.
separator ( > )
Shows menu paths.
Example: From the Window Start menu, choose
Settings > Control Panel.
Using the BayStack Instant Internet Management Software Version 7.11
28
Preface
Related publications
For more information about using Instant Internet, refer to the following
publications:
For more information about using Instant Internet, refer to the following
publications:
•
Important Notice for the BayStack Instant Internet Version 7.11
(Part number 307603-E)
Provides instructions for viewing documentation and installing the Instant
Internet software and third-party applications (Adobe Acrobat Reader,
Netscape Communicator, and AniTa Terminal Emulator).
•
Installing the BayStack Instant Internet Management Software Version 7.11
(Part number 209226-B)
Provides instructions for installing the Instant Internet software.
•
Setting Up the BayStack Instant Internet 100 Unit (Part number 300866-G)
Provides instructions on installing and administering the Instant Internet 100
hardware.
•
Setting Up the BayStack Instant Internet 100-S Unit (Part number 209374-A)
Provides instructions on installing and administering the Instant Internet
100-S hardware.
•
Setting Up the BayStack Instant Internet 400 Unit (Part number 300867-G)
Provides instructions on installing and administering the Instant Internet 400
hardware.
•
Setting Up the BayStack Instant Internet 400-S Unit (Part number 209375-A)
Provides instructions on installing and administering the Instant Internet
400-S hardware.
•
Using the BayStack Instant Internet Management Software Version 7.11
(Part number 300868-G)
Provides an introduction to Instant Internet, instructions for administering the
product, and procedures for using Instant Internet features.
300868-G
Preface
•
29
Reference for the BayStack Instant Internet Remote Access Commands
Version 7.11 (Part number 302005-F)
Provides instructions and commands for remotely accessing Instant Internet.
•
BayStack Instant Internet Software and Documentation Version 7.11 CD
(Part number 206664-D)
Provides manuals for using and installing the Instant Internet software and
third-party applications. The CD contains the following documents:
— Installing the BayStack Instant Internet Management Software Version
7.11
— Setting Up the BayStack Instant Internet 100 Unit
— Setting Up the BayStack Instant Internet 100-S Unit
— Setting Up the BayStack Instant Internet 400 Unit
— Setting Up the BayStack Instant Internet 400-S Unit
— Using the BayStack Instant Internet Management Software Version 7.11
— Reference for the BayStack Instant Internet Remote Access Commands
Version 7.11
You can print selected technical manuals and release notes free, directly from the
Internet. Go to the www25.nortelnetworks.com/library/tpubs/ URL. Find the
product for which you need documentation. Then locate the specific category and
model or version for your hardware or software product. Use Adobe Acrobat
Reader to open the manuals and release notes, search for the sections you need,
and print them on most standard printers. Go to Adobe Systems at the
www.adobe.com URL to download a free copy of the Adobe Acrobat Reader.
You can purchase selected documentation sets, CDs, and technical publications
through the Internet at the www1.fatbrain.com/documentation/nortel/ URL.
Using the BayStack Instant Internet Management Software Version 7.11
30
Preface
How to get help
If you purchased a service contract for your Nortel Networks product from a
distributor or authorized reseller, contact the technical support staff for that
distributor or reseller for assistance.
If you purchased a Nortel Networks service program, contact one of the following
Nortel Networks Technical Solutions Centers:
Technical Solutions Center
Telephone
EMEA
(33) (4) 92-966-968
North America
(800) 2LANWAN or (800) 252-6926
Asia Pacific
(61) (2) 9927-8800
China
(800) 810-5000
An Express Routing Code (ERC) is available for many Nortel Networks products
and services. When you use an ERC, your call is routed to a technical support
person who specializes in supporting that product or service. To locate an ERC for
your product or service, go to the www12.nortelnetworks.com/ URL and click
ERC at the bottom of the page.
300868-G
31
Chapter 1
Introduction
The BayStack Instant Internet unit is a network gateway system that enables you
to access the Internet safely and efficiently, providing management tools that
allow you to track and block user activities. The Instant Internet unit connects any
type of LAN to the Internet using only a single IP address, thereby saving you
time and money.
This chapter provides information about the types of network environments in
which Instant Internet works as well as the services that Instant Internet provides
for your network.
How Instant Internet can function in your network
Before you install the Instant Internet unit, you should understand your network
environment and how the unit functions in the network.
Instant Internet can function in your network in three ways. It can:
•
•
•
Provide security – You can isolate your network from the Internet to help
ensure network security. You do this for three reasons:
— To prevent Internet users from outside your organization from seeing
internal IP addresses.
— To protect your network from being accessed by intruders or hackers.
— To permit remote LANs to communicate with your LAN over a virtual
private network (VPN) using IP security (IPsec).
Control Internet access – You can restrict your users’ access by date and
time, and you can restrict access to certain sites or news groups.
Ease administration – Instant Internet allows you to adopt the users and
groups you are already using from your directory services.
Using the BayStack Instant Internet Management Software Version 7.11
32
Chapter 1 Introduction
IP networks
For security purposes, on an IP network, you may want to isolate your network
from the Internet. You can isolate your network from the Internet by configuring
the network workstations to go through a router before accessing the Internet.
However, using a router to isolate the LAN can be very time-consuming to set up
and maintain because each LAN user must have a “legal” IP address and be
protected from hackers. Instant Internet, on the other hand, makes it easy to isolate
your IP network from the Internet by using address translation to translate illegal
(reserved private) LAN workstation IP addresses into legal IP addresses.
You can also configure IP security (IPsec) to use a virtual private network (VPN).
A VPN is a special type of connection that permits remote users or LANs to
communicate with another LAN over a public network, such as the Internet.
When you set up a VPN, you are essentially using a public network as your own
private, secure network.
On IP networks with IP workstations, there is no limit to the number of
application sessions (instances) that can access the Instant Internet unit.
IPX networks
An IPX network is automatically secure because there is no IP traffic on the
network. In this type of network, Instant Internet provides quick and easy access
to the Internet. On IPX networks with IPX workstations, Instant Internet supports
up to 250 application sessions.This means that IPX workstations can access the
Instant Internet unit using up to 250 application instances.
300868-G
Chapter 1 Introduction
33
Services Instant Internet provides
Table 1 describes the services that Instant Internet provides for IP and IPX
networks.
Table 1 Services that Instant Internet provides
Service
Features
Address Translation
The Address Translation service enables Instant Internet to act like a standard router
by routing IP information from one location to another. However, this service enables
Instant Internet to go beyond the simple routing role by translating illegal (reserved
private) LAN workstation IP addresses into legal IP addresses.
Address Translation supports the IPSEC ESP protocol.
Client Login
Instant Internet allows you to identify workstations for logging and access control.
DHCP Server
Using Instant Internet as a DHCP server allows you to set one option on each
workstation, and then configure Instant Internet once.
When you install Instant Internet, it determines whether or not you are running DHCP
on your network. If not, then Instant Internet configures itself as a DHCP server. If
Instant Internet does not configure itself as a DHCP server and you want to use this
service, you must enable it.
DNS Proxy Server
Instant Internet acts as a Domain Name Service (DNS) proxy server by translating
host names into numerical IP addresses.
IP Routing
Instant Internet provides access to the Internet through IP routing. It maintains
routing tables that help it determine the destination of data packets. This enables
non-Windows workstations (for example, Macintosh, UNIX, and OS/2) to access the
Internet through Instant Internet as IP workstations.
Remote
Configuration
You can use a Telnet application or a terminal emulation application (Instant Internet
100-S and 400-S units only) and remote access commands to configure the Instant
Internet unit from a remote location. For details, refer toReference for the BayStack
Instant Internet Remote Access Commands Version 7.11.
SOCKS Proxy
Server
You can configure the Instant Internet unit as a SOCKS proxy server as a means for
handling FTP requests. If you have IP workstations already configured as SOCKS
workstations, you can use the Instant Internet unit to connect them to the Internet.
VPN Tunnel
You can configure IP security (IPsec) to establish a virtual private network (VPN)
tunnel between an Instant Internet unit and a Connectivity Extranet Switch (CES),
between an Instant Internet unit and a BayRS, or between two Instant Internet units.
For details, refer to Using the BayStack Instant Internet Management Software
Version 7.11.
Using the BayStack Instant Internet Management Software Version 7.11
34
Chapter 1 Introduction
Table 1 Services that Instant Internet provides (continued)
Service
Features
Web Configuration
This feature allows you to access and edit the Instant Internet configuration files
using a Web browser.
Web (HTTP) Proxy
Server
Enabling the Instant Internet as a Web (HTTP) proxy server provides:
• A single point of contact for LAN workstations
• A single point for LAN workstations to obtain access to other proxies
• Web caching to the network in addition to individual workstations (on Instant
Internet 400 units equipped with additional memory and Instant Internet 400-S
units)
Deciding what to do next
Instant Internet is a powerful system that enables you to customize settings and
services specifically for your organization. Following are some suggestions for
getting started:
•
•
•
•
•
•
300868-G
To establish and maintain control over the Internet sites your users and groups
of users access, for example, block access to Web sites, newsgroups, and
incoming ports, refer to Chapter 2, “User access administration,” on page 35.
To log and view the Internet sites your users are accessing, refer to Chapter 3,
“Internet activity logging,” on page 93.
To use the Instant Internet unit as a Web, DNS, or SOCKS proxy server, refer
to Chapter 4, “Proxy services,” on page 115.
To adjust the default IP services or configure the IP services on Instant
Internet, refer to Chapter 5, “Advanced IP configuration,” on page 127.
To use the Instant Internet unit in a virtual private network (VPN), refer to
Chapter 6, “IP security and VPN,” on page 167.
To speed up the Internet response time even more by caching sites that are
accessed on a regular basis, refer to Chapter 7, “Web cache configuration,” on
page 201.
35
Chapter 2
User access administration
This chapter introduces Instant Internet’s Administration (Admin) program and
provides instructions on how to use Admin to set Internet access rights for users
and groups.
Administration program overview
Admin is the utility you use to establish and set Internet access rights for users and
groups within Instant Internet. Access rights control the times and days that users
have access to the Internet and to specific sites, including news groups, incoming
ports, and RAW sockets.
When you install Instant Internet, all network users are automatically set up to use
the default Instant Internet user profile, giving them full Internet access. If this
suits your environment, you do not need to further configure Instant Internet.
However, if you want some users to have restricted access to the Internet, or, if
you want to log the activity of a particular user, you can configure group and user
access to Internet resources.
You can create users in two ways:
•
•
Adopt your users and groups from your network directory services. For
details, refer to “Managing directory service users and groups” on page 38.
Create new users and groups for Instant Internet. For details, refer to
“Creating and removing users and groups” on page 45.
Using the BayStack Instant Internet Management Software Version 7.11
36
Chapter 2 User access administration
Starting Admin
To start Admin:
From the Instant Internet program group or menu (depending on your
operating system), select Admin.
If you have an IP network or a network with more than one Instant Internet
unit, the Instant Internet Units dialog box opens. Select the unit you want, and
then click OK. If you do not see the Instant Internet unit in the list, refer to
“Adding a unit to the selection list” on page 275.
If you have an IPX network with one Instant Internet unit, the Instant Internet
Admin main window opens.
Administration program icons
In Admin, the color of the symbol reflects the user’s type of directory service:
•
•
•
•
Light blue identifies an Instant Internet user.
Gold identifies Instant Internet groups.
Red identifies Novell Bindery or NetWare NDS users and groups.
Dark blue identifies NT users and groups.
The actual icon itself denotes the type of access granted to the user. Table 2
describes the user icons in Admin.
Table 2 Admin user icons
Icon
Meaning
User has no specific Internet access control, so Instant Internet assigns
default user settings.
User’s Internet access Disable option is activated, and the user has no
access to Internet resources.
User’s Enable Logging option is activated.
User has no specific Internet access control, but is inheriting access control
from a group (or groups).
300868-G
Chapter 2 User access administration
37
Table 2 Admin user icons (continued)
Icon
Meaning
User has specific Internet access.
User’s Internet access Ignore Group Settings option is activated and the user
has no access to the user’s group settings.
Default user and everyone group
When you install Instant Internet, a Default User and the Everyone group are
automatically set up for you. These provide a baseline for setting up and
establishing your users and groups.
Restoring the default user
When you create a new user, Instant Internet uses the Default User as a template.
The new user has all the settings and attributes of the Default User. You can then
change the settings for the new user to be whatever you would like them to be.
You can also change the settings of the Default User to the settings that you want
all new users to have.
To restore the Default User:
1
On the toolbar, click Users.
2
Choose Users > Create the Default User.
A new user icon labeled <default> is added to the List of Users (Figure 1).
Figure 1 Default User icon
Using the BayStack Instant Internet Management Software Version 7.11
38
Chapter 2 User access administration
Restoring the everyone group
When you first set up the Instant Internet unit, the Everyone group is
automatically set up for you. All users automatically belong to the Everyone
group. You can then create new groups and move users into those groups so that
you can administer a group of people with little effort and you can assign different
access rights for different groups. The Everyone group is helpful if you need to
assign the same user access to everyone on your network.
Note: It is possible to delete the Everyone group. However, if you delete
it and choose to restore it, the restored group does not have the same
properties as the original.
To restore the Everyone Group:
1
On the toolbar, click Groups.
2
From the menu bar, choose Groups > Create the Everyone Group.
A new group folder labeled Everyone is added to the List of Groups. All the
users on your network are automatically added to the folder.
3
If you want all your users to be able to use Internet Explorer, set the Internet
Access to allow 127.*.*.*. Refer to “Defining controlled Internet access” on
page 59.
Managing directory service users and groups
Instant Internet allows you to use the user groups that you already have set up in
your network directory services. This eases the administration setup process. The
directory services that Instant Internet adopts automatically are:
•
•
•
300868-G
Windows 95, Windows 98, Windows NT, and Windows 2000 domain users
and groups (refer to “Managing Windows 95, Windows 98, Windows NT, and
Windows 2000 domain users and groups” on page 41).
NetWare NDS users and groups (refer to “Managing NetWare NDS users and
groups” on page 42).
Novell Bindery users and groups (refer to “Managing Novell Bindery users
and groups” on page 43).
Chapter 2 User access administration
39
Adopting existing users and groups is convenient because you do not have to
create each new user or group or manage a duplicate database. Instead, Instant
Internet finds the users and groups for you and maintains their Internet access
settings.
Note: You cannot administer network directory users from Instant
Internet. If you want to make changes to users or groups and their
members, you must make the changes in the user or group’s specific
network directory service, not in Instant Internet.
Setting the domain
You can choose the domain of the users and groups you want to view.
To set the domain:
1
Choose View > Set Domain.
The Set Domain dialog box opens (Figure 2).
Figure 2 Set Domain dialog box
2
Select the domain you want to view and then click OK.
Using the BayStack Instant Internet Management Software Version 7.11
40
Chapter 2 User access administration
Setting user name order
If you are using multiple networks in your environment, you can specify the order
that Instant Internet uses to identify users and groups. The order is determined by
user type (NT, NDS, or Bindery).
For example, if Jane has a logon of JANE under the NT domain and another logon
for a Novell server with NDS as JDOE, you can use this option to determine
which user identification Instant Internet will use to identify Jane. If Set User
Name Order has NDS first, then Instant Internet identifies Jane as JDOE. This
does not affect how the Novell Server identifies her.
IP workstations on Windows 95, Windows 98, Windows NT, or Windows 2000
can check how they are identified from their workstation by clicking the Instant
Internet icon in the status area of the taskbar. Refer to “Identifying the login
workstation” on page 274.
To set user name order:
1
Choose View > Set User Name Order.
The Set User Name Order dialog box opens (Figure 3).
Figure 3 Set User Name Order dialog box
2
Select the option you want to move.
3
Do one of the following:
•
•
300868-G
Click the Up arrow to move the option to a higher priority. If you choose
the first option, you cannot move it higher.
Click the Down arrow to move the option to a lower priority. If you
choose the last option, you cannot move it lower.
Chapter 2 User access administration
41
Migrating your database to use unique users and groups by
server
You can migrate your database to use unique users and groups by server. This
feature is useful if you currently have bindery users and groups configured and
then select the Unique users and groups by server check box. Selecting this option
copies the access of all the configured users and groups to the matching users and
groups of the server you are currently viewing. The copied users and groups are
then deleted.
Note: You must be running a NetWare workstation and have the option
Unique users and groups by server selected in order to use this option.
For details, refer to “Setting the NetWare preferred server” on page 43.
To migrate your database to use unique users and groups by server:
Click View > Move to Server.
A check mark next to the menu item indicates that the option is enabled.
Managing Windows 95, Windows 98, Windows NT, and
Windows 2000 domain users and groups
In the Instant Internet Admin window, Windows 95, Windows 98, Windows NT,
and Windows 2000 domain users are displayed as dark blue figure icons and
groups are displayed as dark blue folders.
In the Windows 95, Windows 98, Windows NT, and Windows 2000 domain
environments, Instant Internet uses the Windows 95, Windows 98, Windows NT,
or Windows 2000 domain user and group names. To change group membership,
modify users, and so forth, the Windows 95, Windows 98, Windows NT, or
Windows 2000 administration utilities must be used.
For more information on managing users and groups, refer to “Managing users
and groups” on page 50.
Using the BayStack Instant Internet Management Software Version 7.11
42
Chapter 2 User access administration
Viewing Windows 95, Windows 98, Windows NT, or Windows
2000 Users and Groups
To view or not view NT users and groups:
Choose View > View NT Users and Groups.
Managing NetWare NDS users and groups
Instant Internet displays NDS users as red figure icons and groups as red folders in
the Instant Internet Admin window.
In the Novell environment, Instant Internet uses the NDS user names and groups.
To change group membership, modify users, and so forth, you must use NDS
administration utilities (refer to the Instant Internet Admin online Help for more
information).
For more information on managing users and groups, refer to “Managing users
and groups” on page 50.
Note: In a Novell environment, if a user is logged in to the NetWare
Directory Services (NDS), by default Instant Internet uses the NDS user
name and groups for access control. If you have both NDS and Bindery
users on your network, you may want to force the use of the Bindery
user name and groups. Refer to “Setting user name order” on page 40.
To view or not view NDS users and groups:
Choose View > View NDS Users and Groups.
300868-G
Chapter 2 User access administration
43
Setting the context for NDS
In NetWare Directory Services (NDS), context refers to the location of an object
in the directory tree. The context is necessary for NDS to locate specific network
resources.
Note: You must use the Novell NetWare workstation to set context.
To edit the context for the selected user or group:
1
Choose View > Set Context.
2
Edit the context and save the new configuration.
Managing Novell Bindery users and groups
Instant Internet displays Bindery users as red figure icons and groups as red
folders in the Instant Internet Admin window.
For more information on managing users and groups, refer to “Managing users
and groups” on page 50.
To view or not view Bindery users and groups:
Choose View > View Bindery Users and Groups.
Note: In a Novell environment, when a user is logged into the NetWare
Directory Services (NDS), Instant Internet by default uses the NDS user
name and groups for access control. If you have both NDS and Bindery
users on your network, you may want to force the use of the Bindery user
name and groups. Refer to “Setting user name order” on page 40.
Using the BayStack Instant Internet Management Software Version 7.11
44
Chapter 2 User access administration
Setting the NetWare preferred server
Instant Internet provides the ability to set the NetWare server of the users and
groups you want to view. When a preferred server is set it becomes the one that is
displayed first.
Note: You must be running a NetWare workstation to use this feature.
To set the NetWare preferred server:
1
Choose View > Set Preferred Server.
2
Select the preferred server and then click OK.
To assign different access settings for the same bindery user or group on
different servers, select Unique users and groups by server.
Setting up IP users not using iiLogin
When Instant Internet is installed on an IP workstation running Windows 95,
Windows 98, Windows NT, or Windows 2000, an Instant Internet icon (iiLogin)
appears in the your system tray. You can double-click the icon to find out how
that workstation is logged on. For more information, refer to “Identifying IP
Workstations” in Installing the BayStack Instant Internet Management Software
Version 7.11.
UNIX and Macintosh workstations cannot use the iiLogin workstation
identification. Others, such as guests or temporary employees who use
your network occasionally, also may not have an iiLogin workstation
identification. These types of users are identified in Admin by their IP address.
Users that do not have the iiLogin workstation identification use the Internet
access settings for the Default user. However, if you want to control their access,
then you can create a “wildcard user” with a name that reflects the IP address of
these users. For instructions on how to create a new user, refer to “Creating a new
user or group” on page 45.
300868-G
Chapter 2 User access administration
45
For example, you may assign the IP addresses: 192.0.0.130, 192.0.0.131, and
192.0.0.132 to guest workstations. Using the IP address 102.0.0.* (* is the
wildcard character) for your wildcard users will allow you to control these
accesses as a group. Only users identified in Admin by an IP address that falls in
that range are affected by the access controls you place on this wildcard user. All
other users are affected by either the Default User’s access controls or other access
controls you may have set for them, even if their IP address falls in the range of
the wildcard user.
Creating and removing users and groups
Instant Internet provides the ability to create and maintain users and groups within
Instant Internet that are distinct and separate from your network. This option is
helpful if you want to add users or remove users on the basis of Internet access but
do not want to make changes to the existing network directory service. When you
use Instant Internet to set up and maintain the Internet access settings for these
users, they do not appear in your network directory services.
Creating a new user or group
Instant Internet provides two methods for adding new users and groups:
•
•
Using a template. The new user or group inherits all template attributes. This
feature is useful when you add multiple users or groups that require the same
Internet access.
Creating each user or group individually. You must create and configure each
new user or group individually.
Instant Internet provides a default user facility, specifying attributes that it uses for
individual users. If you add a user and do not set specific Internet access settings,
that user is considered a default user.
Using the BayStack Instant Internet Management Software Version 7.11
46
Chapter 2 User access administration
Creating a user
To create a new user:
1
Do one of the following:
•
•
2
On the toolbar, click Users.
Choose Users > View User List.
Select the icon of the user you want to use as a template.
If you do not want to use a template, you do not need to select a user.
3
On the toolbar, click Create.
If you selected a user in step 2, you are prompted to verify that the user’s
profile is to serve as a template (Figure 4).
Figure 4 Prompt to use selected user as a template
The Create a User dialog box opens (Figure 5).
Figure 5 Create a User dialog box
4
Enter the new user name.
User names can be up to 255 characters in length and must be unique.
5
300868-G
Click OK.
Chapter 2 User access administration
47
Creating a group
To create a new group:
1
Do one of the following:
•
•
2
On the toolbar, click Groups.
Choose Groups > View Group List.
Select the icon of the group you want to use as a template.
If you do not want to use a template, you do not have to select a group.
3
On the toolbar, click Create.
If you selected a group in step 2, you are prompted to verify that the group’s
profile is to serve as a template (Figure 6).
Figure 6 Prompt to use selected group as a template
The Create a Group dialog box opens (Figure 7).
Figure 7 Create a Group dialog box
4
Enter the new group name.
Group names can be up to 255 characters in length and must be unique.
5
Click OK.
Using the BayStack Instant Internet Management Software Version 7.11
48
Chapter 2 User access administration
Adding a user to a group
When you add a user to a group, the user inherits the group’s characteristics. You
can add a user to or remove it from a group.
To add a user to a group by dragging:
1
On the toolbar, click Users.
2
In the List of Users area, select the icon of the user.
3
In the Groups the User Is Not In area, select the group folder to which you
want to add the user.
4
Drag the folder to Groups the User Is In.
Note: You cannot use dragging to move users who have been adopted
from directory services.
To add a user to a group using the Move toolbar button:
1
On the toolbar, click Users.
2
Select the group folder to which you want to move the user.
3
Select the user you want to move.
4
On the toolbar, click Move.
To remove a user from a group by dragging:
1
On the toolbar, click Users.
2
In the List of Users area, select the icon of the user.
3
In the Groups the User Is In area, select the group folder from which you want
to remove the user.
4
Drag the folder to Groups the User Is Not In.
Note: You cannot use dragging functions to move users who have been
adopted from directory services.
300868-G
Chapter 2 User access administration
49
To remove a user from a group using the Move toolbar button:
1
On the toolbar, click Users.
2
Select the group folder from which you want to remove the user.
3
Select the user you want to move.
4
On the toolbar, click Move.
Deleting users and groups
Only those users and groups that were created within the Instant Internet utility
may be deleted by the Instant Internet utility. When a user name is deleted, Instant
Internet uses the Default User access setting to control that user’s Internet access.
Deleting a user
To delete a user:
1
From the List of Users, select the user you want to delete.
2
On the toolbar, click Delete.
A confirmation message box opens (Figure 8).
Figure 8 Delete user confirmation message box
3
Click Yes to verify the deletion.
Using the BayStack Instant Internet Management Software Version 7.11
50
Chapter 2 User access administration
Deleting a group
To delete a group:
1
From the List of Groups, select the group folder.
2
On the toolbar, click Delete.
A confirmation message box opens (Figure 9).
Figure 9 Delete group confirmation message box
3
Click Yes to confirm the deletion.
Managing users and groups
You can view a list of all users and groups in the Instant Internet Admin window.
Icons displaying a figure represent a user; those displaying a folder represent a
group of users.
Note: The procedures and instructions in this section also apply to the
users and groups adopted from the directory services of your network.
To display all users, either click the Users toolbar button or choose Users > View
User List from the menu bar.
The Instant Internet Admin main window displays the following information:
•
•
•
300868-G
List of Users
Groups the User Is In
Groups the User Is Not In
Chapter 2 User access administration
51
When you select a user, all groups to which the user belongs display as folders in
the Groups the User Is In area. All groups to which the user does not belong
display as folders in the Groups the User Is Not In area.
To display all groups, either click the Groups toolbar button or choose
Groups > View Groups List from the menu bar.
The Instant Internet Admin window displays the following information:
•
•
•
List of Groups
Users In the Group
Users Not In the Group
When you select a group, all users in the group are displayed as figures in the
Users In the Group area. All users who do not belong are displayed as figures in
the Users Not In the Group area.
Note: If you want be able to view the username rather than the IP
address in all logs, either give the default user no access and put everyone
else in a group that has the access you want or create a user that matches
your IP address scheme, and make sure that user is assigned no access.
Copying user and group Internet access settings
To simplify the process of adding users or modifying existing users, you can copy
the Internet access settings from one user or group and paste it to another user or
group.
To copy the Internet access settings of one user to another user:
1
On the toolbar, click Users.
2
Select the user with the access settings you want to copy.
3
Do one of the following:
•
•
4
On the toolbar, click Copy.
Choose Users > Copy a User.
Select the destination user.
Using the BayStack Instant Internet Management Software Version 7.11
52
Chapter 2 User access administration
5
On the toolbar, click Paste.
A confirmation message box opens (Figure 10).
Figure 10 Copy user confirmation message box
6
Click Yes to copy the user.
To copy the Internet access settings of one group to another group:
1
On the toolbar, click Groups.
2
Select the group that has the access settings you want to copy.
3
Do one of the following:
•
•
On the toolbar, click Copy.
Choose Groups > Copy a Group.
4
Select the destination group.
5
On the toolbar, click Paste.
A confirmation message box opens (Figure 11).
Figure 11 Copy group confirmation message box
6
300868-G
Click Yes to copy the group.
Chapter 2 User access administration
53
Viewing effective user access
Because Instant Internet lets you configure the Internet access of individual users
as well as groups, a particular user may have Internet access designated through
several groups, and access might vary from group to group. Instant Internet
provides the View Effective User Access option so that you can view the user’s
effective (actual) Internet access.
To view a user’s effective user access:
Do one of the following:
•
•
On the toolbar, click Effect.
Choose Users > View Effective User Access.
The Effective Settings of User dialog box opens (Figure 12).
Figure 12 Effective Settings of User dialog box
Using the BayStack Instant Internet Management Software Version 7.11
54
Chapter 2 User access administration
You can view User Access (time and days a user may access the Internet),
Internet Access (IP addresses and ports to which a user has access), News
Groups (news groups to which a user has access), and Incoming Ports (the
incoming ports that users may access). You can view but not edit this
information with this feature. For instructions on editing these configuration
settings, refer to “Configuring Internet access” on page 58, “Defining
controlled Internet access” on page 59, “Managing news group access” on
page 70, and “Managing incoming port access” on page 76.
Defining user and group access
When you assign Internet access to users or groups of users, use these guidelines:
•
•
To simplify administration, set the Internet access control for groups, rather
than for individual users, whenever possible.
After you set group access to a set of Internet resources, access for every user
in the group changes simultaneously when Internet access changes for the
group.
A user can belong to several groups, each with different Internet access settings.
When this happens, Instant Internet assigns the user the most restrictive Internet
access.
For example, Peter is a member of the group New Hires, which has access to the
Internet on Monday through Friday from 10 a.m. to 2 p.m. Peter is also a member
of the group Development, which has unlimited access to the Internet. With
Admin, Peter has Internet access on Monday through Friday from 10 a.m. to 2
p.m. only, because that is the most restrictive.
You can view the access effectively applied to the user’s access to the Internet.
Refer to “Viewing effective user access” on page 53.
300868-G
Chapter 2 User access administration
55
When a user accesses Instant Internet, Instant Internet searches the user database
in this sequence:
1
Instant Internet determines if the user has an Instant Internet user profile.
2
Instant Internet determines if the user’s groups are configured as Instant
Internet groups. If the user has an Instant Internet user profile or is a member
of one or more Instant Internet groups, Instant Internet uses the most
restrictive access attributes.
3
If Instant Internet finds no Instant Internet group or user profile for the user, it
designates the default Instant Internet user profile settings as the user’s
Internet access settings.
Note: Any users not assigned specifically to a group or who do not have
an Instant Internet user profile automatically assume the default Instant
Internet user profile and are identified by their IP address. Refer to
“Setting up IP users not using iiLogin” on page 44.
Use the Change option to limit or expand user and group Internet access. It is most
common to change Internet access for a group rather than for an individual user,
unless a particular user has unique Internet access requirements. Changing access
for a group simultaneously changes the access of each user in the group.
To change user or group access:
1
Select the icon of the user or group you want to change.
2
On the toolbar, click Change.
The Change Settings of User dialog box opens (Figure 13).
Using the BayStack Instant Internet Management Software Version 7.11
56
Chapter 2 User access administration
Figure 13 Change Settings of User dialog box
The options and buttons on this dialog box are explained in more detail in the
following sections.
Disabling user or group access
The disable option has a different meaning for users than it does for groups. If you
disable access for a user, that user is denied access to the Internet. If you disable
access for a group, access settings that have been defined for that group are
ignored and individual settings are used to determine access for each member of
the group. Disabling access is most useful when dealing with groups you adopted
from a directory service.
To disable user or group access:
In the Change Settings of User dialog box (Figure 13), select the Disable
check box.
300868-G
Chapter 2 User access administration
57
Ignoring group settings option
The ignore group settings option is available only for users. When you choose this
option, Instant Internet ignores the group Internet access settings of the groups
that this user belongs to. Instead, Instant Internet uses only the user’s specific
Internet access.
For example, if you choose the Ignore group settings for one user in a particular
group, Instant Internet uses the individual user’s Internet access options only and
ignores the settings for that group.
To ignore group settings for a user:
In the Change Settings of User dialog box (Figure 13), select the Ignore
group settings check box.
Enabling logging for a user
The Enable Logging option keeps a record of each Internet site (IP address and
port number) that a user accesses. Refer to “Viewing a unit’s users” on page 304.
This log is separate from the User Log, which is a continuous running total and
summary kept for each user (until the log is cleared). The Automatic Logging
utility (refer to “Activating automatic logging” on page 109) collects this data and
writes it to a file.
The log is maintained, regardless of this setting. The Enable Logging option
controls only the detailed connection log.
Note: The log file generated by logging can grow rapidly, so the amount
of logging information an Instant Internet unit can store depends on the
load.
The Instant Internet Monitoring program can collect the logging data on a
different computer running Windows. You can display or save this data to a
common file format, so that you can manipulate the data into the format you want
with an external program, such as Excel. Refer to “Activity logging overview” on
page 93.
Using the BayStack Instant Internet Management Software Version 7.11
58
Chapter 2 User access administration
To enable logging for a user:
In the Change Settings of User dialog box (Figure 13), select the Enable
logging check box.
Configuring Internet access
The User Access button in the Change Settings of User dialog box lets you specify
days of the week and times during the day when users may access the Internet.
The User Access option defines the settings for days of week and hours of day.
To configure user access for a specific day of week and time of day:
1
In the Change Settings of User dialog box (Figure 13), click User Access.
The Change User Access dialog box opens (Figure 14), showing the days of
week and hours in a day.
Figure 14 Change User Access dialog box
2
To select user access, click the appropriate button.
•
•
•
300868-G
Full – Total uncontrolled Internet access.
Controlled – Internet access is limited to specified IP addresses and
ports. Refer to “Defining controlled Internet access” on page 59.
None – Absolutely no Internet access is permitted.
Chapter 2 User access administration
•
59
Not Set – (For advanced administration only.) When a user is a member
of one or more groups, this option allows you to control the access of the
user during specified times and leave the remaining time “not set” so that
other group settings will take effect.
3
To set all days and hours for a specific button, double-click one of the access
buttons and then proceed with step 7.
4
Position the mouse pointer over the graph.
5
Drag to select the access hours for each day.
As you drag, the color of the graph in the area you are dragging changes to the
color designated by the button you selected. Release the mouse button when
you complete your selection. You can designate as many areas this way as you
choose. Note that the graph is divided into half-hour increments, and that one
square on the graph can have two colors in it.
6
Select the days of the week and hours of each day for which Internet access is
to be allowed, and then click OK.
Internet access is available for the specified days and times only.
7
Click OK.
After you make changes to User Access, an asterisk (*) appears to the left of the
option, indicating that specific Internet User Access settings have been defined.
For those times that you mark “Controlled,” you can allow or prohibit specific IP
addresses, host names, and port numbers for the group or user. Refer to
“Overview of configuring Internet access” on page 61.
Defining controlled Internet access
The Internet Access button in the Change Settings of User dialog box (Figure 13)
enables you to define the access the user or group has to the Internet for those
times you have defined user access as controlled (blue). You can specify IP
addresses, domain names, and port numbers that give users Internet access, thus
providing total Internet access control.
You can define Internet access only if you have defined the user or group access
to “Controlled.” Refer to “Configuring Internet access” on page 58.
Using the BayStack Instant Internet Management Software Version 7.11
60
Chapter 2 User access administration
Before you continue, familiarize yourself with the basic concepts of Internet
addressing protocols.
Three kinds of Internet addressing
There are three kinds of Internet addressing:
•
IP addresses are direct communications over the Internet to the appropriate
destinations. All connections on the Internet are made using IP addresses.
Each IP address consists of an actual IP address and a port number. The
format is nnn.nnn.nnn.nnn:#. You can use one to three digits between each
decimal point in the address (such as, 206.210.192.99). IP addresses and port
numbers are separated by a colon (:). For example, 198.67.8.99:80.
•
Host names are human readable versions of IP addresses, such as
nortelnetworks.com or instant.net. The list of allowed/denied host names
controls only the ability to look up the IP address associated with a host name.
Note: If you allow access based on host names, you must also allow
access to their associated IP addresses. To allow access to one Web site
and dis-allow access to all others, allow all IP addresses but deny access
based on host name.
For example, if you open a browser and type in “www.xyz.com”, the browser
first asks the DNS proxy to look up the address of that name. Instant Internet
then checks the access controls having to do with host names and decides
whether or not the site is allowable. The access controls therefore determine
whether or not a name can be resolved into an address.
•
Port numbers can be any number from 0 to 65535, where the first 1024 are
well-known port numbers that define specific tasks. For example, Web
browsing occurs on port number 80, file transfer protocol (ftp) uses ports 20
and 21, and simple mail transfer protocol (SMTP) uses port 25.
Note: You can think of the IP address (or domain name) as the address of
an apartment building, with the port number functioning as an apartment
within the building.
Access to ports can be connectionless (UDP) or connection-oriented (TCP).
300868-G
Chapter 2 User access administration
61
Overview of configuring Internet access
When a user attempts Internet access, Instant Internet checks the access list for
that user and determines whether or not to permit access to that address. Instant
Internet sorts all access controls by:
•
•
•
Day of week and time of day
Fully specified addresses
Partially specified addresses (using wildcards)
The Internet Access option lets you designate specific IP addresses and port
numbers to which each user or group may gain access.
Note: You must set the Day of Week and the Time of Day access to
controlled (blue) for these entries to be enforced. Refer to “Configuring
Internet access” on page 58.
You can designate Internet addresses as IP addresses or host names, and you can
select port numbers from the access list provided, or enter them numerically.
Within this option, Internet access is designated as follows:
•
An asterisk (*), the wildcard symbol, is all encompassing, whether
designating full access, no access, or specific addresses or ports (Table 3).
Table 3 Designating Internet access – wildcard symbol
Address
Type
√ *:*
√206.210.192.99:*
•
Explanation
Allow both TCP & UDP Specifies total Internet access.
Allow both TCP & UDP Specifies access to all ports at this
specific IP address only.
A check mark (3) designates user access to the specified address or port
(Table 4).
Using the BayStack Instant Internet Management Software Version 7.11
62
Chapter 2 User access administration
Table 4 Designating Internet access – checkmark
Address
√ 198.*
√ *:80
•
Type
Explanation
Allow both TCP & UDP Specifies access to all ports at all IP
addresses beginning with 198.
Allow TCP only
Specifies IP access only to port 80
at all connection-oriented IP
addresses.
An X designates no access to the specified address or port (Table 5).
Table 5 Designating Internet access — X
Address
Type
Explanation
X *:21
Disallow TCP
Specifies no ftp access from any
address.
When you click Internet Access in the Change Settings of User dialog box, the
Internet Access dialog box opens with the group’s or user’s current Internet access
control list in the format of access symbol, type, IP address, port number, and host
name. Internet accessibility is listed from the most specific to the least specific.
Table 6 shows a sample Internet access control list.
Table 6 Sample Internet access control list
Address
Type
√ *:*
Allow both TCP & UDP User has unlimited Internet access.
X 198.67.8.99:80
Disallow TCP
√ 198.67.8.99:*
√ *:80
300868-G
Explanation
User may not browse this IP
address.
Allow both TCP & UDP IP address has unlimited access.
User can access any port for the
specified IP address.
Allow TCP only
User may browse only.
X *:25
Disallow Both TCP &
UDP
User cannot access SMTP.
X *:*
Disallow both TCP &
UDP
User has no Internet access.
Chapter 2 User access administration
63
You can redefine a group’s or user’s access control list from the Internet Access
dialog box. You can add, delete, or change IP addresses, host names, and port
numbers to which the specified group or user has access.
If a user or group access is set to “Full” (refer to “Configuring Internet access” on
page 58), that user has access to everything on the Internet. However, if you add
one restriction to the Internet access list, the user has no Internet access at all.
Therefore, if you want to restrict access to only a few sites, you must first allow
access to everything. You can allow access to all IP addresses, ports, and host
names, and then disallow access one by one, as desired. Or, you can disallow
access to all IP addresses, ports, host names, and then allow access one by one,
as desired.
The reverse is true if you have the user or group access set to “Controlled.” In this
case, the user has no Internet access, and you must specifically allow Internet
access to IP addresses, ports, and host names.
When you make changes to Internet Access, an asterisk (*) appears to the left of
the option, indicating that specific Internet access control settings have been
defined.
Adding Internet access
To add Internet access to a user or group:
1
In the Admin window, select a group folder or user icon.
2
On the toolbar, click Change.
The Change Settings of User dialog box opens (Figure 15).
Using the BayStack Instant Internet Management Software Version 7.11
64
Chapter 2 User access administration
Figure 15 Change Settings of User dialog box
3
Click Internet Access.
The Change Internet Access dialog box opens (Figure 16) and displays the
current access control list for the group or user.
Figure 16 Change Internet Access dialog box
300868-G
Chapter 2 User access administration
4
65
Click Add.
The Add Internet Access dialog box opens (Figure 17).
Figure 17 Add Internet Access dialog box
Table 7 describes the items in the Add Internet Access dialog box
Table 7 Add Internet Access dialog box items
Item
Description
Allow
Allows access.
Do not allow
Denies access.
Host Name
Enter a host name for which you are defining access.
Lookup IP Address
If you do not know the IP address of a host name, you can enter
the host name and then click Lookup IP Address. Instant Internet
looks up the IP address of the specified host name.
Type
•
•
•
IP Address
Enter the IP address of the host name. If you do not know the IP
address, you can enter the host name and select the Lookup IP
Address button. Instant Internet looks up the IP address of the
specified host name.
Port
Select a port number.
TCP – connection oriented
UDP – connectionless
Both – TCP and UDP
Using the BayStack Instant Internet Management Software Version 7.11
66
Chapter 2 User access administration
Note: You can define access to a host name without specifying its
corresponding IP address (or addresses). Some sites change their IP
addresses regularly, so to avoid editing the access list often, you can
specify the host name without the IP address. Remember, however, that
you must also allow host names for any IP addresses that you allow.
5
Click Allow.
6
Enter the Host Name.
If you want to specify an IP address, but do not know what it is, click Lookup
IP Address.
7
Select a Type.
8
Enter the IP Address (optional).
9
Enter the Port number.
10 Click OK.
Removing Internet access
To remove Internet access from a group or user:
1
In the Admin window, select a group folder or user icon.
2
On the toolbar, click Change.
The Change Settings of User dialog box opens (Figure 18).
300868-G
Chapter 2 User access administration
67
Figure 18 Change Settings of User dialog box
3
Click Internet Access.
The Change Internet Access dialog box opens (Figure 19) and displays the
current access control list for the group or user.
Figure 19 Change Internet Access dialog box
4
Select the Internet address for which the group (or user) is to be denied access.
Using the BayStack Instant Internet Management Software Version 7.11
68
Chapter 2 User access administration
5
Click Delete.
A confirmation message box opens (Figure 20).
Figure 20 Delete access confirmation message box
6
Click Yes to confirm the deletion.
The IP address is deleted from the group’s (or user’s) access control list, and
the user no longer has access to that Internet address.
Changing Internet access
To change the Internet access of a user or group:
1
In the Admin window, select a group folder or user icon.
2
On the toolbar, click Change.
The Change Settings of User dialog box opens (Figure 21).
300868-G
Chapter 2 User access administration
69
Figure 21 Change Settings of User dialog box
3
Click Internet Access.
The Change Internet Access dialog box opens (Figure 22) and displays the
current access control list for the group or user.
Figure 22 Change Internet Access dialog box
4
Select the Internet address for which the group (or user) access is to be
changed.
Using the BayStack Instant Internet Management Software Version 7.11
70
Chapter 2 User access administration
5
Click Change.
The Change Internet Access dialog box opens (Figure 23).
Figure 23 Change Internet Access dialog box
6
Change the information.
7
Click OK.
Managing news group access
The News Group button on the Change Settings of User dialog box (Figure 24)
enables you to designate specific news groups to which each user or group may
gain or be denied access.
News group access is designated when a check mark is displayed next to the name
of the news group. If access is denied, an X is displayed.
You can add, delete, or change news groups to which the selected user has access.
300868-G
Chapter 2 User access administration
71
Adding news group access
To add a news group to group or user access:
1
In the Admin window, select a group folder or user icon.
2
On the toolbar, click Change.
The Change Settings of User dialog box opens (Figure 24).
Figure 24 Change Settings of User dialog box
3
Click News Groups.
The Change News Groups dialog box opens (Figure 25).
Using the BayStack Instant Internet Management Software Version 7.11
72
Chapter 2 User access administration
Figure 25 Change News Groups dialog box
4
Click Add.
The Add News Group dialog box opens (Figure 26).
Figure 26 Add News Group dialog box
The following information is displayed:
•
•
•
5
Do one of the following:
•
•
300868-G
Allow – Allows access.
Do not allow – Denies access.
News Groups – Enter the name of the news group for which you are
defining access.
To allow access to the news group, click Allow.
To deny access to the news group, click Do not allow.
Chapter 2 User access administration
6
73
Enter the name of the news group for which you are defining access.
Note: You can also add or remove an entire section of news groups
by placing an asterisk after the news group address. For example,
alt.binaries.pictures.* selects all the sub-news groups within the
alt.binaries.pictures news group.
7
Click OK.
Removing news group access
To remove a news group from the list:
1
In the Admin window, select a group folder or user icon.
2
On the toolbar, click Change.
The Change Settings of User dialog box opens (Figure 27).
Figure 27 Change Settings of User dialog box
3
Click News Groups.
The Change News Groups dialog box opens (Figure 28).
Using the BayStack Instant Internet Management Software Version 7.11
74
Chapter 2 User access administration
Figure 28 Change News Groups dialog box
4
Select the news group to which the group (or user) is to be denied access.
5
Click Delete.
A confirmation message box opens (Figure 29).
Figure 29 Delete news group confirmation message box
6
Click Yes to confirm the deletion.
The news group is deleted from the group’s (or user’s) access list, and the user
no longer has access to that news group.
Changing news group access
To change group or user access to current news groups:
1
300868-G
In the Admin window, select a group folder or user icon.
Chapter 2 User access administration
2
75
On the toolbar, click Change.
The Change Settings of User dialog box opens (Figure 30).
Figure 30 Change Settings of User dialog box
3
Click News Groups.
The Change News Groups dialog box opens (Figure 31).
Figure 31 Change News Groups dialog box
Using the BayStack Instant Internet Management Software Version 7.11
76
Chapter 2 User access administration
4
Select the news group for which the group (or user) access is to be changed.
5
Click Change.
The Change News Group dialog box opens (Figure 32).
Figure 32 Change News Group dialog box
6
Change the information.
7
Click OK.
When you make changes to news group access, an asterisk (*) is displayed to
the left of the option, indicating that specific news group access control
settings have been defined.
Managing incoming port access
The Incoming Ports button on the Change Settings for User dialog box
(Figure 33) enables you to designate incoming ports to which each user or group
is allowed access. An incoming port is the port number that outside workstations
can access. Incoming ports allow a user to run server applications on a local
computer.
For example, if a user has incoming port access to port 80, the user can start a Web
server on a local computer. To run the server’s FTP applications on a local
computer, select incoming port 21.
Incoming port access is designated by a check mark next to the name of the port
within the Incoming Ports access option. If access to an incoming port is denied,
an X is displayed next to the name of the port.
300868-G
Chapter 2 User access administration
77
You can add, delete, or change incoming ports to which the selected user has
access.
Port numbers 0, 25, 50, 79, 106, 109, 110 and the range 5001-65535 are open by
default. You can have total control of port access by configuring incoming ports
individually for any particular group or user.
Adding incoming port access
To add an incoming port to group or user access:
1
In the Admin window, select a group folder or user icon.
2
On the toolbar, click Change.
The Change Settings of User dialog box opens (Figure 33).
Figure 33 Change Settings of User dialog box
3
Click Incoming Ports.
The Change Incoming Ports dialog box opens (Figure 34).
Using the BayStack Instant Internet Management Software Version 7.11
78
Chapter 2 User access administration
Figure 34 Change Incoming Ports dialog box
4
Click Add.
The Add Incoming Port dialog box opens (Figure 35).
Figure 35 Add Incoming Port dialog box
Table 8 describes the items in the Add Incoming Port dialog box.
300868-G
Chapter 2 User access administration
79
Table 8 Add Incoming Port dialog box items
Item
Description
Allow
Allows access.
Do not allow
Denies access.
Type
•
•
•
IP Address
Enter the IP address of the host name. If you do not know the IP
address, you can enter the host name and select the Lookup IP
Address button. Instant Internet looks up the IP address of the
specified host name.
Port
Select a port number. If you are specifying a range of ports, this is
the beginning port number.
Ending Port
To enter a range of ports, select an ending port number.
5
TCP – connection oriented
UDP – connectionless
Both – TCP and UDP
Do one of the following:
•
•
To allow access to the incoming port, click Allow.
To deny access to the incoming port, click Do not allow.
6
Select a Type.
7
Specify an IP Address.
8
Specify an Incoming Port.
9
Specify an Ending port.
10 Click OK.
Removing incoming port access
To remove an incoming port from the list:
1
In the Admin window, select a group folder or user icon.
2
On the toolbar, click Change.
The Change Settings of User dialog box opens (Figure 36).
Using the BayStack Instant Internet Management Software Version 7.11
80
Chapter 2 User access administration
Figure 36 Change Settings of User dialog box
3
Click Incoming Ports.
The Change Incoming Ports dialog box opens (Figure 37).
Figure 37 Change Incoming Ports dialog box
4
300868-G
Select the incoming port to which the group (or user) is to be denied access.
Chapter 2 User access administration
5
81
Click Delete.
A confirmation message box opens (Figure 38).
Figure 38 Delete incoming port confirmation message box
6
Confirm the deletion when prompted.
The incoming port is deleted from the group’s (or user’s) access list, and the
user no longer has access to that incoming port.
Changing incoming port access
To change group or user access of current incoming ports:
1
In the Admin window, select a group folder or user icon.
2
On the toolbar, click Change.
The Change Settings of User dialog box opens (Figure 39).
Using the BayStack Instant Internet Management Software Version 7.11
82
Chapter 2 User access administration
Figure 39 Change Settings of User dialog box
3
Click Incoming Ports.
The Change Incoming Ports dialog box opens (Figure 40).
Figure 40 Change Incoming Ports dialog box
4
300868-G
Select the incoming port for which the group (or user) access is to be changed.
Chapter 2 User access administration
5
83
Click Change.
The Change Incoming Port dialog box opens (Figure 41).
Figure 41 Change Incoming Port dialog box
6
Change the information.
7
Click OK.
When you make changes to an incoming port’s access, an asterisk (*) appears
to the left of the option, indicating that specific incoming ports access control
settings have been defined.
Managing RAW sockets
The No RAW Sockets option on the Change Settings for User dialog box
(Figure 42) applies to:
•
•
IPX workstations
IP workstations when Instant Internet address translation is enabled for the
client-side interface
Some Internet applications (typically diagnostics such as ping) use a protocol of
RAW sockets for communication. Because these sockets require special low-level
control of the IP packets, some administrators may want to restrict user access to
these diagnostics. This type of connection is not blocked by restricting the IP
address in the Instant Internet access control list.
Using the BayStack Instant Internet Management Software Version 7.11
84
Chapter 2 User access administration
To prohibit the use of RAW sockets:
1
In the Admin window, select a group folder or user icon.
2
On the toolbar, click Change.
The Change Settings of User dialog box opens (Figure 42).
Figure 42 Change Settings of User dialog box
3
Select the No RAW Sockets check box.
This prohibits the use of RAW sockets.
An error message that the Internet user will see when the No RAW Sockets option
is selected is Error 10044, WSAESOCKTNOSUPPORT. If messages are allowed,
IPX workstations will receive a RAW sockets restricted message panel, and IP
workstations will receive an ICMP restricted message panel.
Note: In Tools, ping and trace receive errors if No RAW Sockets is
enabled.
300868-G
Chapter 2 User access administration
85
Specifying the message a user sees upon an error
The No Messages option in the Change Settings for User dialog box allows you to
control what users see when they attempt to access restricted Instant Internet sites.
When messages are enabled, a message is displayed with an explanation of why
the user’s attempted access failed.
For example, if the user tried to access www.xrated.com, which has been
disallowed, the message “Host name restricted” is displayed. However, if you
select No Messages, the user sees only the application’s error message, such as,
“Host name does not appear in the DNS table,” or a similar message that does not
reveal why the access failed.
Creating reports
The Instant Internet Reports option lets you select user and group Internet access
reports and save them to disk for use with other applications. You can select
specific user and group reports or you can save all reports to the specified drive
and directory.
To create a report:
1
Choose File > Reports.
The Select Reports dialog box opens (Figure 43).
Figure 43 Select Reports dialog box
Using the BayStack Instant Internet Management Software Version 7.11
86
Chapter 2 User access administration
2
Use the information in Table 9 to choose the report options you want.
Table 9 Report options
Item
Description
Selected
If you choose this option, you can choose the reports you want.
All
When you choose this option, the Users area becomes active.
Users
•
•
Groups
Configured Access – Reports on the access defined for each group.
Configured Access – Reports on the access defined for each user.
Effective Access – Reports on the effective access for each user.
3
Click OK.
4
Enter the drive and directory where you want the reports to be saved.
Common user and group access examples
The following examples represent the most common ways of creating users and
groups in Admin. This section gives general instructions on:
•
•
•
Setting unlimited access (next)
Restricting access to a few sites (page 88)
Allowing access to a few sites (page 88)
Allowing unlimited access for everyone
To allow unlimited access for everyone in a group:
1
Set the Everyone Group’s access to Full access.
Refer to “Configuring Internet access” on page 58 for more information. The
Change User Access dialog box opens (Figure 44).
300868-G
Chapter 2 User access administration
87
Figure 44 Change User Access dialog box
2
Configure News Group access to allow access to all news groups.
Refer to “Managing news group access” on page 70 for more information.
3
Configure Incoming Ports to allow access to all ports and Both TCP and UDP.
Refer to “Managing incoming port access” on page 76 for more information.
After you complete the previous steps, all users follow the Everyone Group access
settings.
Note: If a user’s individual access settings are more restrictive than the
Everyone Group settings, Instant Internet uses the more restrictive access
settings.
Using the BayStack Instant Internet Management Software Version 7.11
88
Chapter 2 User access administration
Restricting access to a few sites for everyone
To restrict a few sites for everyone:
1
Set the Everyone Group’s access to Controlled access.
Refer to “Configuring Internet access” on page 58 for more information.
2
Configure Internet Access for the Everyone Group by restricting access to a
site. Figure 45 shows an example.
Refer to “Defining controlled Internet access” on page 59 and for more
information.
Figure 45 Change Internet access to deny access to a site example
3
Repeat Step 2 for each site for which you want to restrict access.
You should now see a list of sites restricted to all users within the Everyone
Group, similar to that in Figure 46.
300868-G
Chapter 2 User access administration
89
Figure 46 Restrict Internet access example
4
Configure Incoming Ports to allow access to all ports and Both TCP and UDP.
Refer to “Managing incoming port access” on page 76 for more information.
After you have completed these steps, all users follow the Everyone Group access
settings.
Note: If a user’s individual access settings are more restrictive than the
Everyone Group settings, then Instant Internet uses the more restrictive
access settings.
Using the BayStack Instant Internet Management Software Version 7.11
90
Chapter 2 User access administration
Allowing access to a few sites
Some major Web sites such as www.microsoft.com and www.cnn.com have more
than one IP address. For very large sites, you must allow access to all IP addresses
for the site.
To allow a few sites for everyone in a group:
1
Set the Everyone Group’s access to Controlled access.
Refer to “Configuring Internet access” on page 58 for more information.
2
Configure Internet Access for the Everyone Group by allowing access to
www.nortelnetworks.com.
Refer to “Defining controlled Internet access” on page 59 for more
information.
3
Repeat step 2 to allow access to the site www.cnn.com.
You should now see a list of sites allowed to all users within the Everyone
Group, similar to that in Figure 47.
Figure 47 Allow Internet access example
300868-G
Chapter 2 User access administration
4
91
Configure Incoming Ports to allow access to all ports and Both TCP and UDP.
Refer to “Managing incoming port access” on page 76 for more information.
All users now have access to only the sites on the list.
Note: If a user’s individual access settings are more restrictive than the
Everyone Group settings, then Instant Internet uses the more restrictive
access settings.
Managing a remote Instant Internet unit
Admin cannot manage the remote users and groups unless the LANs are linked
together such that the administrator at the main site’s PC has access to the group.
The complete LAN directory is known when the PC client runs Admin. The PC
client, rather than the Instant Internet unit, obtains user or group information from
the NT domain controller or NetWare server.
To use the remote site’s groups and users rather than the local groups and users,
create an additional icon in the Instant Internet section of the Start menu called
“Admin Remote,” which runs Admin with the /remote command.
Note: You will see only users and groups that have had access controls
defined for that unit. If a group has certain Internet access permissions,
you will see the group in Admin, but you will not necessarily see the
users in that group unless they have some unique privilege defined.
Using the BayStack Instant Internet Management Software Version 7.11
92
Chapter 2 User access administration
300868-G
93
Chapter 3
Internet activity logging
This chapter offers information on advanced Instant Internet features that allow
experienced network supervisors to monitor and log Internet activity.
Activity logging overview
Instant Internet’s Monitor program is a utility that monitors individual Instant
Internet units in real time. It provides a dynamic display of the performance and
load of a specific Instant Internet unit (or multiple units) on bar graphs and
histograms.
With Monitor, you can monitor statistics, logs, and diagnostics of one or more
Instant Internet units. Because it provides multi-document interface (MDI), you
can use Monitor to view an individual Instant Internet unit or several units
simultaneously.
To start the Monitor program:
1
Locate the Instant Internet menu or program group (depending on your
operating system).
2
Select Monitor.
3
If prompted, select an Instant Internet unit to monitor.
If the Instant Internet unit is not in the list of units to choose from, refer to
“Adding a unit to the selection list” on page 275.
The Monitor main window opens (Figure 48).
Using the BayStack Instant Internet Management Software Version 7.11
94
Chapter 3 Internet activity logging
Figure 48 Monitor main window
Table 10 describes the toolbar buttons in the Monitor main window.
Table 10 Monitor main window toolbar buttons
Button
Description
Opens a window that shows you statistics about the Instant Internet
unit.
Opens a window that shows which users are currently using the Instant
Internet unit.
Opens a window that shows the logging activity of the Instant Internet
unit.
Opens a window that shows diagnostic information about the
connections to the Instant Internet unit.
300868-G
Chapter 3 Internet activity logging
95
The toolbar on the Monitor main window changes depending on the type of
information you are monitoring. For example, the buttons available for Stats are
different from the buttons available for Users. To see this, practice clicking the
Stats, Users, Log, and Diag buttons to see what happens to the toolbar.
Monitoring an Instant Internet unit
To monitor an Instant Internet unit:
1
In the Monitor main window, click the button for the information you want to
view.
2
When prompted, select the Instant Internet unit you want to monitor.
The information for the selected unit is displayed.
If you do not see the Instant Internet unit you want to monitor, refer to
“Adding a unit to the selection list” on page 275.
Viewing statistics
The Stats windows displays the statistical information available for the selected
Instant Internet unit, including a real-time graph that shows the data being either
sent or received in kilobits per second.
To view statistics for a unit:
Click the Stats toolbar button.
The Stats window opens (Figure 49).
Using the BayStack Instant Internet Management Software Version 7.11
96
Chapter 3 Internet activity logging
Figure 49 Sample Stats window
Table 11 lists the statistics displayed in the Stats window.
Table 11 Stats window statistics
Item
Description
Server
The name of the Instant Internet unit selected for monitoring.
IP Add
The IP address of the selected interface or the destination IP
address of the selected VPN tunnel.
Firmware
The version of the firmware running on the Instant Internet unit.
Up
The number of days, hours, minutes, and seconds the Instant
Internet unit has been up since last reset.
Apps
The number of applications currently accessing the unit. Instant
Internet can support an unlimited number of IP workstation
application instances and up to 250 IPX workstation application
instances.
Show
•
•
•
300868-G
Sends – When you select this option, only the data sent is
displayed.
Recvs – When you select this option, only the data received is
displayed.
Both – When you select this option, the data for Sends is
displayed in blue, and the data for Recvs is displayed in red.
Chapter 3 Internet activity logging
97
Table 11 Stats window statistics (continued)
Item
Description
Speed
The speed (in kilobits) at which data is being sent and received.
To calculate the speed in kilobytes, divide by 8.
Interface
If you have more than one interface, you can choose the interface
you want to monitor. You can also select the VPN tunnel you want to
monitor.
In Bytes/Out Bytes
The data sent and received since the last reset is displayed (in
kilobytes). To calculate this speed in kilobits, multiply the kilobytes
by 8.
Table 12 lists additional statistics that are displayed for a dial-up or ISDN
interface or a VPN tunnel.
Table 12 Stats window statistics for a dial-up or ISDN interface or a VPN
tunnel
Item
Description
Last call
Day, date, time, and year of last Internet connection, as well as a
description of the connection.
Status
Whether the Instant Internet connection is up or down, and the
number or hours and minutes up or down. For a VPN tunnel, it
shows authentication and encryption types for a connection. For
ISDN, the status field always has the form:
up|down, n/m active (dialing x) (no MP) (y disabled)
• up|down - The status of the interface. This status depends on
whether the interface is fully activated and IPCP negotiation is
complete.
• n/m active - Where “n” is the number of individual B channels
active, and “m” is the number of available B channels in the
bundle (normally 2).
• (dialing x) - Appears only if one or more of the B channels are
attempting to connect. “x” is the number of channels dialing.
• (no MP) - Appears only if a Multilink connection is attempted but
the ISP does not allow MP or the ISP rejects the MP request.
• (y disabled) - Appears only if one or more individual B channel
interfaces are disabled. “y” indicates the number of disabled
interfaces.
Timeout
Current timeout value is displayed in 0:00/0:00 format. The first
value shows how much time has elapsed with no activity. The
second value shows the inactivity timeout value. For a VPN tunnel,
it shows the SA lifetime (timeout).
Using the BayStack Instant Internet Management Software Version 7.11
98
Chapter 3 Internet activity logging
Table 12 Stats window statistics for a dial-up or ISDN interface or a VPN
tunnel (continued)
Item
Description
Connects
The number of successful connections, number of connection
attempts, and percentage of successful connections.
Disconnects
The number of lines dropped from the user’s end of the connection,
number of total line drops, and percentage of connections dropped
from the user’s end.
When the Stats window is active, you can select any of the following options on
the toolbar:
•
I/F Disable – This button disables the Instant Internet interface selected in the
list box below the graph. To re-enable the unit, click the I/F Enable toolbar
button.
Caution: If you are using a dynamic IP address and a different IP
address is accessed when the dial-up connection reestablishes, this may
disconnect users currently on the selected Instant Internet unit.
•
Line – This button displays the connection status. This button is available for
the following connections:
a
Between the phone line and the Internet
If the line is active it shows a green arrow pointing up. If the line is
inactive it shows a red arrow pointing down. To activate or deactivate a
line, click the corresponding button.
b
Between ends of a VPN tunnel
This button appears for a VPN tunnel only if you are monitoring an IPsec
interface. You use it to test situations where you want to force the tunnel
to be inactive. To make a VPN tunnel connection inactive, click the down
arrow button.
The Stats menu contains options for the above buttons, and it also contains the
following options:
300868-G
Chapter 3 Internet activity logging
•
•
99
Forget password – If you select the Remember Password option when you
are prompted for a password for a specific Instant Internet unit, this option
cancels that selection.
Forget all passwords – If you select the Remember Password option when
you are prompted for a password for an Instant Internet unit, this option
cancels that selection for all Instant Internet units.
Viewing users
You can view a list of all users connected to the Instant Internet unit. The user
name that appears in the log is controlled by the Set User Name Order you
configure in Admin. Refer to “Setting user name order” on page 40. IP
workstations not logged in with the Instant Internet workstation login workstation
are identified in the log by their IP address.
To view a list of users connected to an Instant Internet unit:
Click the Users toolbar button.
The Users window opens.
Figure 50 shows a sample Users window.
Figure 50 Sample Users window
Using the BayStack Instant Internet Management Software Version 7.11
100
Chapter 3 Internet activity logging
Table 13 lists the information shown in the Users window.
Table 13 Users window statistics
Item
Description
User
The user names.
Sent
The amount of data the user sent.
Received
The amount of data the user received.
Time on
The amount of time the user has been logged onto the Instant
Internet unit.
Last accessed
The time the user last accessed the Instant Internet unit.
Apps
The number of applications being used to access the Internet.
Instant Internet can support an unlimited number of IP workstation
application instances and up to 250 IPX workstation application
instances.
When the Users window is active, the options in Table 14 are available on the
toolbar.
Table 14 Monitor main window toolbar buttons
Button
Description
Refreshes the display to view up-to-the-minute user
information, including users added.
Clears all columns for all users. The displayed information is
cumulative since the log was last reset. When you select Clear,
the user’s Sent, Received, Time, and Last columns are reset to
zero. After you select Clear, users are added to the log as they
access Instant Internet.
Exports user data to a specified file for use at a later date. This
option is useful before clearing the User Log.
You can select a single user and click this button. This logs the
user off temporarily until they access the network again.
You can select this button to log off all users. This logs them off
temporarily until they access the network again.
300868-G
Chapter 3 Internet activity logging
101
Note: The Log Off toolbar buttons log off IPX users only.
The Users menu contains options for the above buttons, and it also contains the
following options:
•
•
Forget password – If you select the Remember Password option when you
are prompted for a password for a specific Instant Internet unit, this option
cancels that selection.
Forget all passwords – If you select the Remember Password option when
you are prompted for a password for an Instant Internet unit, this option
cancels that selection for all Instant Internet units.
Table 15 describes the sort options when the Users window is open.
Table 15 Sort options in the Users window
Item
Description
Users
Sorts the list by user name.
Bytes sent
Sorts the list numerically by bytes sent.
Bytes received
Sorts the list numerically by bytes received.
Time on
Sorts the list numerically by the amount of time the user has been
logged on.
Last access date
Sorts the list chronologically by the date the user last accessed the
selected Instant Internet unit.
Apps
Sorts the list, numerically, by number of applications used.
First access time
Sorts the list chronologically by the time each user first accessed the
Instant Internet unit.
Reverse sort
Reverses the sort order currently displayed.
Viewing Web site access
You can view a record of each Internet Web site that a user accesses.
Note: Monitor keeps a log for each user for whom you enabled logging.
For details, refer to “Enabling logging for a user” on page 57.
Using the BayStack Instant Internet Management Software Version 7.11
102
Chapter 3 Internet activity logging
To view a list of Web sites the user accessed:
Click the Log toolbar button.
The Log window opens.
Figure 51 shows a sample Log window.
Figure 51 Sample Log window
Table 16 describes the information available in the Log window for each selected
Instant Internet unit:
Table 16 Log statistics
300868-G
Item
Information
Time
Shows the time and date of the activity.
Name
Shows the name of the user. When a user starts a task before you
enable the monitoring feature, the IP address is displayed here.
Event
The type of event.
Chapter 3 Internet activity logging
103
When the Log window is active, you can select any of the toolbar buttons in
Table 17.
Table 17 Log window toolbar buttons
Button
Description
Refreshes the display to view up-to-the-minute information for
the selected Instant Internet unit.
Clears all data from the log. After you select Clear, there is no
user activity shown in this log until the next access.
Exports data to a specified file for use at a later date. This option
is useful before clearing the Connection Log.
The Log menu contains options for the above buttons, and it also contains the
following options:
•
Lookup Addresses – Changes the IP addresses to their host names.
Note: If you leave Lookup Addresses set, it takes a while for the initial
Log window to open, especially if there are a lot of entries.
•
•
Forget password – If you select the Remember Password option when you
are prompted for a password for an Instant Internet unit, this option cancels
that selection.
Forget all passwords – If you select the Remember Password option when
you are prompted for a password for an Instant Internet unit, this option
cancels that selection for all Instant Internet units.
Table 18 describes the sort options when the Log window is open.
Table 18 Sort options in the log window
Item
Description
ID
Sorts the log, alphabetically, by user ID.
Time
Sorts the log, chronologically, by date and time of event.
Reverse sort
Reverses the current sort order.
Using the BayStack Instant Internet Management Software Version 7.11
104
Chapter 3 Internet activity logging
Viewing diagnostic information
You can view diagnostic information for a particular Instant Internet unit.
To view diagnostic information:
Click the Diag toolbar button.
The Diag window opens.
Figure 52 shows a sample Diag window.
Figure 52 Sample Diag window
Note: The information in the Diag window is not automatically
refreshed.
300868-G
Chapter 3 Internet activity logging
105
Table 19 lists the statistics displayed in the Diag window.
Table 19 Diag window statistics
Item
Description
Interface
If the Instant Internet unit has more than one interface, you can
choose the interface you want to monitor. You can also choose
a VPN tunnel to monitor.
MTU size
This shows the Maximum Transmission Unit size.
Output queue
This shows the output packet queue size or the number of packets
in the output queue.
Flags
This shows the flags set (demand, dialing, default, MP, single).
Encapsulation
This shows the protocol used by the interface, for example, PPP or
Frame Relay.
Server
The name of the Instant Internet unit selected for monitoring.
IP Addr
The IP address of the Instant Internet interface being monitored or
the destination IP address of the VPN tunnel being monitored.
Net Mask
This shows the network mask address for the selected interface.
HW Addr
The MAC address of the Instant Internet interface being monitored.
Last time
The last day, date, time, and year that data was sent and received.
Bytes
The data sent and received since the last reset is displayed (in
kilobytes). To calculate this speed in kilobits, multiply the kilobytes
by 8.
Discards
The number of packets discarded.
Errors
The number of errors sent and received on the server selected for
monitoring.
Last call
This shows the time of the last call (used only for dial-up interface
information).
Last successful call
The time of the last successful call (used only for dial-up interface
information).
Line state
Shows whether a connection is up, down, or disabled.
Trace state
This trouble shooting option shows what options you have selected
on a trace. The following options are available for trace status: In
(Input), Out (Output), NonIP (Non IP messages), and NoBC
(Suppress broadcasts). This information is used by Nortel
Networks technical support personnel for troubleshooting.
Bundle wanted
In multiple dial-out interfaces (such as, ISDN bundled into one
interface), this shows the bundle wanted.
Bundle in
In multiple dial-out interfaces, this shows the actual bundle, which
may be different than the Bundle wanted.
Using the BayStack Instant Internet Management Software Version 7.11
106
Chapter 3 Internet activity logging
Performing a Trace
You can use the trace function to diagnose problems with a workstation, an Instant
Internet unit on the network, or a connection with your ISP. Whenever you are
having a problem, a Nortel Networks Technical Support representative may
request that you run a trace on a particular interface (for example, Eth1 or dial-up)
and then ask you to export the results to a file in a certain format. You can then
e-mail the trace results file to the Nortel Networks Technical Support
representative for analysis.
To perform a trace:
1
In the Diag window, select an interface.
For an ISDN interface, select one of the channels, such as ISDN-B1.
2
Click Trace.
3
Select the appropriate options for running the trace based on what the Nortel
Networks Technical Support representative tells you.
4
Click Start to begin the trace.
5
Click Stop to end the trace.
Caution: Do not leave a trace running for a long period of time. A large
trace results file can consume system resources and affect network
performance.
6
To view the results of a trace, click View.
The trace results file window opens.
Figure 53 shows a sample trace results file window.
300868-G
Chapter 3 Internet activity logging
107
Figure 53 Sample Trace results file
7
To close the trace results file, choose File > Exit.
Monitoring multiple Instant Internet units
Monitor lets you view multiple units by selecting the units to view and then
specifying Tile or Cascade. Cascading the view places one Instant Internet unit in
front of the other (stacks them) on the screen. Tiling the view shows multiple units
side-by-side and above and below one another on the screen.
To monitor multiple Instant Internet units simultaneously:
1
In Monitor, click the appropriate toolbar button.
2
From the list, select the Instant Internet unit to monitor, and then click OK.
The monitoring window for the selected unit opens.
Using the BayStack Instant Internet Management Software Version 7.11
108
Chapter 3 Internet activity logging
3
Repeat steps 1 and 2 for each unit you want to monitor.
4
To arrange the windows, do one of the following:
•
•
5
Choose Window > Tile.
Choose Window > Cascade.
Manually size each window to suit your needs.
Figure 54 shows a sample Monitor window with multiple Instant Internet
units.
Figure 54 Multiple Instant Internet units window
300868-G
Chapter 3 Internet activity logging
109
Activating automatic logging
The Instant Internet Automatic Logging (AutoLog) feature lets you save selected
connection and user log files from the Instant Internet unit to a disk file at
specified intervals.
To use the automatic logging feature, enable the feature at a PC on your LAN. The
AutoLog program must then remain running for the duration of the log. If you
close the task down on the PC that initiated the autolog while autolog is running,
the autolog feature stops. This program can run in the background with no effect
on the user’s activities.
To activate automatic logging:
Do one of the following:
•
•
In Windows 3.x, select the AutoLog icon in the Instant Internet program
group.
In Windows 95, Windows 98, Windows NT, or Windows 2000, choose
Start > Instant Internet > AutoLog.
The AutoLog window opens.
The AutoLog toolbar buttons (Table 20) provide shortcut keys to the menu bar
options.
Table 20 AutoLog toolbar buttons
Button
Description
Starts saving all configured log information. Choose this option
from the File menu in the AutoLog window.
Stops logging. Choose this option from the File menu in the
Event Information window.
Activates online Help. When you click this button, the mouse
pointer changes to the symbol on the button. Move the pointer to
the option for which you require help, and then click it.
Context-sensitive online Help is displayed.
Using the BayStack Instant Internet Management Software Version 7.11
110
Chapter 3 Internet activity logging
Enabling Auto Run
When you activate Auto Run, the AutoLog program automatically activates when
the Event Activity Information log runs.
To enable the Auto Run option:
In the AutoLog window, choose Options > Auto Run.
Configuring automatic logging
The AutoLog window displays the following information:
•
•
•
Log Type – Shows whether the type of log is a User log or a Connection log.
Server Name – Shows the name of the selected Instant Internet unit.
Frequency – Shows how often the logs are automatically saved.
When AutoLog activates for the first time, the AutoLog window columns are
blank. You must configure the log types, server names, and frequency of auto
saves.
To configure log types, server names, and the frequency of auto saves:
1
In the AutoLog window, click Add.
The Event Information dialog box opens (Figure 55).
300868-G
Chapter 3 Internet activity logging
111
Figure 55 Event Information dialog box
2
In the Server to log list, select an Instant Internet unit for automatic logging.
3
In the Log Type area, select whether the log is a User log or a Connection log.
4
To have Instant Internet look up addresses, select the Lookup Addresses
check box.
If you enable this option, Instant Internet automatically turns numeric
addresses into readable names.
5
In the Log File directory box, specify the name of the directory where you
want Instant Internet to store the AutoLog files.
Instant Internet assigns log file names in the following manner:
•
•
•
•
•
U Specifies the file is a User log file.
C Specifies the file is a Connection log file.
y Specifies the last digit of the current year.
ddd Specifies the day of the year that the file is created (for example,
140th, 300th).
ccc Specifies a count to keep each file unique.
Using the BayStack Instant Internet Management Software Version 7.11
112
Chapter 3 Internet activity logging
6
Select a Logging interval.
You can enter and select increments of a number of minutes, hours, or days.
7
In the Create new log file area, select how often Instant Internet is to create a
new log file.
Each time a new file is saved, automatic logging assigns a new count number
to the log file name to keep each file unique. You can choose:
•
•
•
•
•
8
Every time – Creates a new log file each time a scheduled save is
performed.
Daily – Creates a new log file every day.
Weekly – Creates a new log file once a week.
Monthly – Creates a new log file once a month.
Never – Never creates a new log file. Instant Internet repeatedly adds the
selected log information to the same file name.
Click OK.
Editing an automatic logging configuration
To edit the automatic logging configuration:
1
In the AutoLog window, select the log configuration you want to edited.
2
Click Edit.
The Event Information window opens
3
Make the required changes to the configuration.
4
Click OK.
Deleting a log from the automatic logging configuration
To delete a log that currently runs automatically:
300868-G
1
In the AutoLog window, select the log you want to delete from the Log Type
list.
2
Click Delete.
3
Confirm the deletion as prompted.
Chapter 3 Internet activity logging
113
Exporting log files
When a User Log file or Connection Log file is exported to a spreadsheet file, you
will see additional information that is not shown when you view the files in
Monitor.
All information is exported with each field separated by a comma
(comma-delimited format) so that any spreadsheet can easily read the file. Access
time information in both the User Log and Connection Log files is exported in
seconds so that any spreadsheet can easily convert the seconds into an
hours:minutes:seconds format.
Exported user log files include the following information:
•
•
•
•
•
•
•
•
User Name
MAC or IP address
First access time
Last access time
Time on in seconds
Bytes sent
Bytes received
Applications in use
Exported connection log files include the following information:
•
•
•
•
•
Time of event
Connection ID
User Name
Event
MAC or IP address (only for Event = start)
Using the BayStack Instant Internet Management Software Version 7.11
114
Chapter 3 Internet activity logging
300868-G
115
Chapter 4
Proxy services
This chapter describes how to use Setup to configure the Instant Internet unit as a
Web, DNS, or SOCKS proxy server and provides additional information on
SOCKS configuration.
Understanding proxy servers
A proxy server makes a connection to the application server for the client. The
proxy server relays data between the client and the applications server. From the
application server’s perspective, the proxy server is the client.
When a client wants to make a connection to an application server, the client
connects to the proxy server. The application server’s address and port number are
passed to the proxy server via a proxy protocol. The proxy server then connects to
the application server. After the connection to the application server is established,
the proxy server relays data between the client and the applications server.
You can use the Instant Internet unit as a:
•
•
•
Web (HTTP) proxy server
DNS proxy server
SOCKS proxy server
Using Setup
Setup is the utility you use to create and configure servers and services for the
Instant Internet unit. When you install Instant Internet, you create and configure
general servers and services.
Using the BayStack Instant Internet Management Software Version 7.11
116
Chapter 4 Proxy services
To start Setup:
1
From the Instant Internet program group or menu (depending on your
operating system), select Setup.
2
The next step varies depending on your individual configuration. Select the
option that best fits your configuration:
•
•
If you have an IP network or a network with more than one Instant
Internet unit, the Instant Internet Units dialog box opens. Select the
appropriate unit, and then click OK. If you do not see the Instant Internet
unit in the list, refer to “Adding a unit to the selection list” on page 275.
If you have an IPX network with one Instant Internet unit, the Instant
Internet Setup main window opens.
Configuring Instant Internet as a Web proxy server
You can configure the Instant Internet unit to function as a Web (HTTP) proxy
server which enables you to direct all workstations to a remote proxy. You can
also configure the Instant Internet unit as a Web cache in addition to or instead of
the cache on an individual workstations. Web caching is available only for Instant
Internet 400 units equipped with extra memory and Instant Internet 400-S units.
The benefits of using Instant Internet as a Web (HTTP) proxy server include:
•
•
Enabling it to direct Instant Internet workstation access through a remote
proxy
Enabling Web caching in the Instant Internet unit in addition to the individual
workstations
You can use a Web browser to configure cache and system settings. For details,
refer to Chapter 7, “Web cache configuration,” on page 201.
300868-G
Chapter 4 Proxy services
117
Before you can use the Instant Internet unit as a Web proxy server, you must
enable both the Web Proxy and Web Configuration options. When you first install
Instant Internet, these features are enabled by default. If you disabled these
options, you must re-enable them.
Note: To handle FTP requests using the HTTP proxy, enable SOCKS on
Instant Internet and in your browser. Fill in the HTTP and SOCKS proxy
address but leave the rest blank. The browser will then use the HTTP
proxy for Web access and SOCKS for all other types of access.
To configure the Instant Internet unit as a Web (HTTP) proxy server:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > Services.
The Services dialog box opens (Figure 56).
Figure 56 Services dialog box, Web Proxy option
3
Select the Web Proxy check box.
4
Click Configure.
The WEB Proxy Configuration dialog box opens (Figure 57).
Using the BayStack Instant Internet Management Software Version 7.11
118
Chapter 4 Proxy services
Figure 57 WEB Proxy Configuration dialog box
5
Do any of the following:
•
•
If you want the Web proxy to run transparently, select the Run
transparently check box and then choose the interface on which you want
the Web proxy to run transparently. This option is helpful because when it
is enabled you do not need to configure the Web browser on each
workstation. The browsers will automatically use Instant Internet as the
Web proxy. The Web proxy must be run transparently if you want to
effectively control user access.
Enter the Port (usually 8080) where you want the Web proxy to run. If
you choose this option, you must configure the Web browsers on all
workstations to use Instant Internet as the Web proxy server.
6
Click OK.
7
Use your Web browser to configure Web caching and set other parameters.
Using a commercial proxy server
You can use a commercial proxy server for services such as “kid-safe” Internet
service. To do so, enable the transparent proxy for the Instant Internet unit. Then
use a browser to configure the Instant Internet proxy to cascade to the proxy that
you want to use. Be sure to enter the proxy server’s IP address in the Proxy
through (HTTP address) box.
300868-G
Chapter 4 Proxy services
119
Enabling Web configuration
If you want to configure Web cache settings or view and edit Instant Internet
system and log files, you must enable Web configuration.
To enable Web configuration:
1
In the Services dialog box (Figure 56), select the WEB Configuration check
box.
2
Click Configure.
The WEB Server Configuration dialog box opens (Figure 58).
Figure 58 WEB Server Configuration dialog box
3
Enter the Port number for the Web proxy server.
The default is 80.
4
Click OK.
Configuring workstations to use the Instant Internet unit
as a Web proxy server
If you chose to run the Web proxy transparently, you do not need to change the
browser configuration for each workstation. If you chose not to have the Instant
Internet unit run the Web proxy transparently, then follow the steps below to
configure your workstations for an HTTP proxy.
To configure Netscape Communicator for the PC:
1
Choose Edit > Preferences.
The Preferences dialog box opens.
Using the BayStack Instant Internet Management Software Version 7.11
120
Chapter 4 Proxy services
2
In the Category area, select Advanced.
3
Select Proxies.
4
Select the Manual Proxy Configuration option.
5
To see the current proxy configuration, click View.
6
In the HTTP host box, add the IP address of the Instant Internet unit’s LAN
interface.
If you are an IPX client on an IPX network where the Instant Internet has no
IP address, use “localhost” as the HTTP hostbox.
7
In the Port box, enter the port you selected when you enabled the Web proxy
service (typically 8080).
8
Click OK through all dialog boxes to save your changes.
Netscape Communicator now uses the HTTP (Web) proxy when it connects to
any non-local host.
Configuring Instant Internet as a DNS proxy server
A Domain Name Service (DNS) server translates host names into IP addresses.
Your ISP usually provides this server. Instant Internet provides a DNS proxy
service through which your IP workstations can access your ISP’s server. There
are several advantages to using this service:
•
•
•
Access control – By setting up Instant Internet as a DNS proxy server, you
can apply host name access controls to your IP workstations.
Maintenance – Because only the Instant Internet unit is aware of the ISP’s
DNS server, configuration changes (such as adding or removing additional
DNS servers) do not require changes to each IP workstation.
Performance – The DNS proxy service provides local caching of DNS
information, which is then shared by all users. This keeps most DNS queries
on the local LAN.
By default, Instant Internet is installed as a DNS proxy server.
300868-G
Chapter 4 Proxy services
121
To disable or re-enable the DNS Proxy option:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > Services.
The Services dialog box opens (Figure 59).
Figure 59 Services dialog box, DNS Proxy option
3
Select or clear the DNS Proxy check box.
A check mark indicates that the option is enabled.
4
Click OK.
Configuring Instant Internet as a SOCKS proxy server
A SOCKS proxy server provides a firewall for a network, allowing a secure
connection to the internet. When you configure the Instant Internet unit as an Web
proxy server, it provides only HTTP proxy support therefore, configuring the unit
as a SOCKS proxy server also provides a means for handling FTP requests.
If you have IP workstations already configured as SOCKS workstations, you can
use the Instant Internet unit to connect them to the Internet. For details on
configuring SOCKS workstations, refer to “Configuring common
SOCKS-enabled software” on page 125.
Using the BayStack Instant Internet Management Software Version 7.11
122
Chapter 4 Proxy services
To configure the Instant Internet as a SOCKS proxy server:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > Services.
The Services dialog box opens (Figure 60).
Figure 60 Services dialog box, SOCKS Proxy option
3
Select the SOCKS check box.
4
Click OK.
Using SOCKS workstations with the Administration
program
If you have IP workstations already configured as SOCKS workstations, you can
use the Instant Internet unit as a SOCKS proxy server to connect them to the
Internet. For details, refer to “Configuring Instant Internet as a SOCKS proxy
server” on page 121.
If you are using SOCKS workstations, there are some things you need to be aware
of when using the Administration program to control Internet access. For details
on using the Administration program, refer to “Administration program
overview” on page 35.
300868-G
Chapter 4 Proxy services
123
Administration options that do not apply to SOCKS
workstations
When you configure the Instant Internet unit as a SOCK proxy server, the
following Administration options do not apply to SOCKS workstations:
•
•
•
Incoming ports access control – SOCKS does not allow any incoming
connections except after an outgoing connection is made to an allowed host.
RAW sockets access control – SOCKS does not provide proxy services
(that is, it prohibits traffic) for protocols other than TCP and UDP.
No message option – The application and the SOCKS workstation software
are responsible for presenting and interpreting error messages from the
SOCKS server.
Note: The No message option does apply to workstations using the
workstation login.
Host name access controls and SOCKS
SOCKS requires that the workstation software specify a destination when making
a request to the SOCKS server. It does allow the workstation to specify the
destination either by IP address or by host name. To enable access control by host
name, the Instant Internet unit must be allowed to resolve host names to IP
addresses.
There are two ways to enforce host name access controls:
•
Directly – Direct host name access control is easy to enforce but requires
the use of a SOCKS version 5 workstation or shim that supports remote host
name resolution. Both Aventail AutoSocks and NEC SocksCap32 support this
feature. Unfortunately, a limited number of workstations provide this feature.
Most workstations are limited to SOCKS version 4, which does not support
this feature.
Using the BayStack Instant Internet Management Software Version 7.11
124
Chapter 4 Proxy services
•
Indirectly – Indirect host name access control requires that the Instant
Internet DNS proxy server be used by all SOCKS workstations. In this case,
requests to resolve restricted host names are refused, preventing the
workstation from making the connection. Since the DNS proxy is typically
used in conjunction with the SOCKS server to provide complete isolation of
the local network from the Internet, few problems should occur.
Configuring socksified applications
Instant Internet supports applications configured to use SOCKS-enabled or
socksified applications. Configuring workstation software varies for each
application. See your software documentation for specific instructions on
configuring workstation software.
You typically need to provide the following information:
•
•
•
•
•
300868-G
IP address of the SOCKS server – The IP address is shown in the Interfaces
list box and is associated with the LAN router interface.
Domain name – Instant Internet needs to be set up as a DNS proxy in order to
keep access control for host names.
SOCKS proxy port – This is currently required to be 1080, which is the
well-known port for SOCKS servers.
SOCKS protocol version – Instant Internet supports both SOCKS versions 4
and 5. If SOCKS is required, select the latest version supported by your
application.
Authentication method – If SOCKS Version 5 is supported, you may have
the option of selecting authentication methods. Instant Internet supports the
SOCKS Version 4 User ID method as well as the Version 5 User name/
Password method. GSSAPI and Challenge Handshake Authentication
Protocol (CHAP) are not currently supported.
Chapter 4 Proxy services
•
125
Remote or local address resolution – If SOCKS Version 5 is supported, you
may have the option of selecting remote or local address resolution. Remote
resolution is preferred because it reduces traffic between the Instant Internet
unit and the SOCKS workstation.
Note: Microsoft Internet Explorer is not natively SOCKS-enabled for
Apple Macintosh computers and is not available for IBM OS/2
workstations. Netscape, however, works on all platforms.
Configuring common SOCKS-enabled software
IP workstations configured to use Instant Internet as the gateway and DNS server
can access the Internet without modifying their browser applications. If you
choose to use SOCKS, you must configure the browser applications as follows.
To configure Netscape Navigator for the PC:
1
Start Netscape Navigator.
2
Choose Edit > Preferences.
3
Select Advanced.
4
Select Proxies.
5
Select the Manual Proxy Configuration option.
6
Click View.
7
Complete the Socks host and Port boxes.
8
Click OK through all dialog boxes to save the settings.
Netscape Navigator now uses the SOCKS server when connecting to any
non-local host.
To configure Internet Explorer for the PC:
1
Start Internet Explorer.
2
Choose View > Options.
3
Select Connection.
Using the BayStack Instant Internet Management Software Version 7.11
126
Chapter 4 Proxy services
4
Select the Connect through a proxy server check box.
5
Complete the SOCKS host name or IP address and the Server Port boxes.
Local network connections can be via the SOCKS server or direct. The Do not use
proxy server for local (intranet) addresses check box controls this action.
Third-party socksifying software
Although SOCKS is supported directly by some common applications, many
older applications that are not SOCKS-enabled can be socksified. Socksifying
allows these applications to use the SOCKS server transparently. SOCKS
workstation software, which performs this transparent socksification of
non-SOCKS enabled software, is often called a socksifying layer because it acts
as an invisible layer between the application and the platform’s native TCP/IP
software.
For the PC platform, several third-party socksifying layers are available, both
commercially and publicly. See your software product documentation for setup
information.
Additional information
More information on socksifying software packages can be found on the
following Web sites:
•
•
•
www.aventail.com – Aventail produces AutoSocks, a completely transparent
layer that runs on Windows 3.x, Windows 95, and Windows NT. AutoSocks is
a commercial product.
www.socks.nec.com – NEC produces several public domain socksifying
layers for various platforms, including Windows 3.x, Windows 95, Windows
NT, and several UNIX operating systems.
www.hummingbird.com – Hummingbird produces a freely downloadable
socksifying layer for NT 4.0. Its technology was used by Microsoft for
Internet Explorer’s SOCKS support.
Note: The Instant Internet SOCKS server has been tested with NEC’s
SOCKS CAP32 workstation software and with Aventail’s AutoSOCKS
v2.03.
300868-G
127
Chapter 5
Advanced IP configuration
When you initially install and configure Instant Internet, it uses a set of default
services that most network administrators will prefer to use. If you want Instant
Internet to use IP services that are different than the defaults, you need to use
Setup to configure the IP services that you want it to use. This chapter provides
information on configuring IP services for Instant Internet.
For more information about these services, refer to Reference for the BayStack
Instant Internet Remote Access Commands Version 7.11.
Using Setup
Setup is the utility you use to create and configure servers and services for the
Instant Internet unit. When you install Instant Internet, you create and configure
general servers and services. You can change these settings using Setup.
To start Setup:
1
From the Instant Internet program group or menu (depending on your
operating system), select Setup.
2
The next step varies depending on your individual configuration. Select the
option that best fits your configuration:
•
•
If you have an IP network or a network with more than one Instant
Internet unit, the Instant Internet Units dialog box opens. Select the
appropriate unit, and then click OK. If you do not see the Instant Internet
unit in the list, refer to “Adding a unit to the selection list” on page 275.
If you have an IPX network with one Instant Internet unit, the Instant
Internet Setup main window opens.
Using the BayStack Instant Internet Management Software Version 7.11
128
Chapter 5 Advanced IP configuration
Note: Before you begin, back up the Instant Internet unit’s configuration.
For details, refer to “Backing up a unit configuration to disk” on
page 277.
Configuring a static route
In its role as a conventional IP router, Instant Internet maintains a routing table to
determine where to transmit packets. Routes are specified using the “address/bits”
method. For example, the IP address 1.2.3.0 with the submask 255.255.255.0 is
identical to the static route 1.2.3.0/24. The /24 bits entry indicates that the first 24
bits of the address specify the network portion, with the remaining 8 bits
specifying the host address.
In many cases, the route to an IP network may not be automatically derived from
the interface address and submask information. This occurs any time another
router must be used to reach a particular network. The most common example is
the “default route” that is used to reach any network not specified by any other
route. Typically, the default route refers to the Internet, but in certain situations,
it may refer to another router which in turn can reach both other internal networks
as well as the Internet. When direct Internet connectivity is available, the default
route always specifies the route to the Internet.
If you have more than one network using the Instant Internet unit, you can specify
static routes so that the networks can communicate with each other through
Instant Internet.You can configure a static route for multiple networks or for a
single network that has subnetworks.
Static routes are essentially manually specified route entries that must be
explicitly entered and maintained for accuracy. Static routes leave little ambiguity
in terms of the routing that the Instant Internet unit uses.
To add a static route:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > Static Routes.
The Static Routes dialog box opens (Figure 61).
300868-G
Chapter 5 Advanced IP configuration
129
Figure 61 Static Routes dialog box
3
Click Add.
The Static Route Configuration dialog box opens (Figure 62).
Figure 62 Static Route Configuration dialog box
4
In the Destination Address field, enter the IP address of the network to which
you are routing.
5
In the Bits field, enter the number of bits for the network portion of the
address, for example, 24.
If you do not specify the number of bits, 32 (an individual host) is assumed.
Using the BayStack Instant Internet Management Software Version 7.11
130
Chapter 5 Advanced IP configuration
6
In the Interface list, select the name of the IP interface on which to transmit
packets intended for this destination.
7
In the Gateway Address field, enter the IP address of another router
(reachable on the specified interface) to which packets to the destination
should be forwarded.
If you do not specify a gateway address, it is assumed that the destination is
directly reachable on the specified interface, in which case, the metric defaults
to 0.
8
In the Metric field, enter a number to specify the order used when there are
multiple paths. A lower number gets higher precedence. The default is 1.
9
In the main Setup window, click Save and Exit.
Configuring IP forwarding
IP forwarding allows the Instant Internet unit to route IP addresses without
modification. Enabling IP forwarding allows all routable IP traffic through with
no filtering, unless filters are defined. By default, IP forwarding is disabled.
If you want to configure IP security (IPsec) for a virtual private network (VPN),
IP forwarding must be enabled.
Note: IP forwarding can compromise your network’s security. If you
decide that IP forwarding is necessary to meet your needs, be aware of the
security risks to any computer with a real TCP/IP stack that has an
Internet routable IP address.
Enabling IP forwarding
If you have a network interface, you can enable IP forwarding. By default, if two
TCP/IP interfaces are configured on the Instant Internet unit, IP traffic cannot pass
between them. The two interfaces are totally independent IP networks.
IP forwarding lets Instant Internet act as a router in some specialized applications.
Use this feature with caution to ensure that the Instant Internet unit firewall is
maintained at all times. For example, if you have IP Forwarding enabled, then you
should have filters in place to protect your network from various attacks including
300868-G
Chapter 5 Advanced IP configuration
131
Smurf. In order to block Smurf, you must deny any packet containing the
broadcast address for any inside network. Before you enable IP forwarding, check
with your ISP to ensure that you have a LAN account that provides you with a
range of IP addresses.
Note: The Enable IP Forwarding option is available only if you
configured two interfaces for the unit.
Enabling IP forwarding for a unit
To enable IP forwarding:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > Other Settings.
The Other Settings dialog box opens (Figure 63).
Figure 63 Other Settings dialog box
3
Select the Enable IP Forwarding check box.
Instant Internet now allows IP forwarding for the Instant Internet unit.
Using the BayStack Instant Internet Management Software Version 7.11
132
Chapter 5 Advanced IP configuration
Enabling IP forwarding for two interfaces
To enable IP forwarding for a dial-up, ISDN or leased-line interface and a LAN
interface:
1
Enable IP forwarding for the unit.
Refer to “Enabling IP forwarding for a unit” on page 131.
2
In the main Setup window, click Save and Exit.
You must allow the changes to take effect immediately before IP forwarding
is enabled.
3
Ensure that any computer on your network running TCP/IP that you want to
have access to the Internet using the Instant Internet unit has the default
gateway configured to be the IP address of the Instant Internet unit’s
client-side interface.
The subnet mask should match the subnet mask that you entered for the
Network Interface.
You can also enable IP forwarding with two Ethernet interfaces. Before enabling
IP forwarding, check with your ISP to ensure that you have a LAN account that
provides you with a range of IP addresses.
Enabling IP forwarding for two Ethernet interfaces
To enable IP Forwarding with two Ethernet interfaces:
1
Configure your router to route the additional networks through the Instant
Internet unit’s router interface connected to the router (Eth1, Eth2).
2
If the client-side interface does not have an IP address, add one.
a
Start Setup, and if prompted, select a unit to configure.
b
Click Add.
c
Assign an appropriate IP address and subnet mask.
The IP address must be on a different subnet than the router-side
interface. If you are already using a legal, ISP-assigned address between
the router and the Instant Internet unit, you must either properly subnet, or
use a different (valid) network number for the client-side interface. The
Instant Internet actually routes between the two interfaces.
300868-G
Chapter 5 Advanced IP configuration
3
133
Enable IP Forwarding.
Refer to “Enabling IP forwarding for a unit” on page 131.
4
In the main Setup window, click Save and Exit.
You must allow the changes to take effect immediately before IP forwarding
is enabled.
5
Ensure that any computer on your network running TCP/IP that you want to
have access to the Internet using the Instant Internet unit has the default
gateway configured to be the IP address of the client-side interface.
The subnet mask should match the subnet mask that you entered for the
client-side interface.
Using network address translation
Network address translation (NAT) provides a secure method to use a single
network for both public (Internet) and private (LAN) communications. NAT uses
one set of IP addresses for internal communication and a completely different set
of IP addresses for external communications, thereby keeping the public from
learning the private IP addresses.
Instant Internet supports both input and output NAT. When input NAT is
specified, Instant Internet translates packets as soon as they are received. When
output NAT is specified, Instant Internet translates a packet when it is sent.
The Setup utility contains a checkbox that you use to turn Address Translation on
and off. When selected, address translation reflects the most logical form of NAT.
If the interface is an internal LAN interface, then the checkbox refers to input
NAT. If the interface is used as the default route or is a WAN interface, the
checkbox refers to output NAT.
Note: You can override the NAT direction. If you set the NAT direction,
the checkbox displayed by the Setup utility is dimmed and you must
change it in Advanced TCP/IP settings or through the command line
interface. For more information, see Reference for the BayStack Instant
Internet Remote Access Commands Version 7.11.
Using the BayStack Instant Internet Management Software Version 7.11
134
Chapter 5 Advanced IP configuration
Configuring address translation
Address translation allows the Instant Internet unit to route traffic that has private
or reserved IP addresses to and from the Internet. Instant Internet can isolate your
LAN from the Internet by performing address translation on routed packets,
which enables it to translate workstation addresses into legal IP addresses. IP
address translations are totally transparent to workstations on the LAN.
Some of the benefits of using Instant Internet as an address translator include:
•
•
•
Translating addresses transparently.
Simplifying the administrator’s task by allowing existing, private addressing
schemes to be used while still allowing Internet access.
Acting as a firewall.
If the Instant Internet unit is currently running address translation and is logically
installed between the servers you want to be public (for example, Web servers or
mail servers) and the Internet, then you must add provide some additional
configuration. See “Publishing a private server” on page 135.
Disabling address translation
When Instant Internet hardware and software are installed, output address
translation is automatically enabled as a default for your unit. However, if you are
using IP forwarding, you should disable address translation. For more information
on IP forwarding, refer to “Configuring IP forwarding” on page 130.
To disable address translation:
1
Start Setup, and if prompted, select a unit to configure.
2
In the Interfaces area, select your WAN interface in the list and then click
Configure.
The <interface name> Configuration dialog box opens (Figure 64).
300868-G
Chapter 5 Advanced IP configuration
135
Figure 64 Interface Configuration dialog box
3
Clear the Address Translation check box.
4
Click OK.
Publishing a private server
Server publications (static network address translation) allows you to publish
privately addressed servers to the Internet, while keeping the firewall intact.
Even if you do not have a static IP address, Instant Internet provides you with the
ability to publish a server as a fully qualified domain name (FQDN). When you
define the address translation for the server, you specify the WAN interface name
rather than its current IP address.
Using Dynamic DNS
The Dynamic DNS functionality provided by Instant Internet performs a DNS
update whenever the address of an interface changes. Carefully consider the
implications of using Dynamic DNS before you implement it for anything other
than forming VPNs because there is generally no security with respect to the
modification of an entry. In more private environments, as for VPN, the lack of
security is not as much of a factor because:
Using the BayStack Instant Internet Management Software Version 7.11
136
Chapter 5 Advanced IP configuration
•
•
•
The host name can be non-obvious because the host name itself becomes a
form of a password.
In a private environment, you can configure the Dynamic DNS to accept
updates only from certain ISP address ranges.
Even if another host name is discovered, or its address is compromised, IPsec
still contains its own security measures such as the pre-shared key and the
particular address ranges to be exchanged.
You can configure Instant Internet so that a DNS update is performed each time
the address of an interface changes. The information required is:
•
•
The fully qualified domain name to be updated.
The IP address or fully qualified domain name for the DNS server that will
accept the update. This is normally the primary authority for the zone.
Configuring Instant Internet to publish a private server
To configure Instant Internet to publish a private server regardless of whether you
have a static or a dynamic IP address from your ISP, you need the following
information:
•
•
•
•
300868-G
Public Address - The public IP address that will reach the Instant Internet
unit or the name of the interface that connects your Instant Internet unit to the
Internet.
Public Port - The port number or name that the outside world uses to reach
your server.
Private Address - The IP address of the server on your network.
Private Port - The port number or name of the server on your network.
Usually, public port and private port are the same.
Chapter 5 Advanced IP configuration
137
To configure Instant Internet to publish a private server:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > Server Publication.
The Server Publication dialog box opens (Figure 65).
Figure 65 Server Publication dialog box
3
Click Add.
The Server Publication Configuration dialog box opens (Figure 66).
Using the BayStack Instant Internet Management Software Version 7.11
138
Chapter 5 Advanced IP configuration
Figure 66 Server Publication Configuration dialog box
4
Enter the public IP address (or interface) and private address. For examples,
refer to “Example: Publishing an SMTP server when you have a static IP
address” on page 138, “Example: Publishing a Web server when you have a
dynamic IP address” on page 139, and “Example: Publishing a server for
NetMeeting” on page 141.
5
Click OK.
Example: Publishing an SMTP server when you have a static IP
address
In this example, you are setting up a server that has a static IP address (Figure 67).
to be reachable from the Internet. Instant Internet has set up the IP network, and
the LAN addresses have IP addresses such as 192.168.1.nnn (where nnn is a
number between 0 and 255). The Instant Internet unit’s client-side IP address is
192.168.1.1. The SMTP server is on the LAN and has the address 192.168.1.10.
The Instant Internet unit’s public address is 134.177.3.28 (provided by your ISP)
To publish the server, you add the public entry “134.177.3.28” as the public
address and “smtp (25)” as the port to the list of server publications. The server’s
private address is “192.168.1.10 port smtp (25).”
300868-G
Chapter 5 Advanced IP configuration
139
Figure 67 Publishing an SMTP server when you have a static IP address
Example: Publishing a Web server when you have a dynamic IP
address
In this example, you are setting up a Web server when your ISP provides you with
a dynamic IP address. Instant Internet has set up the local IP network, and the
DHCP server has assigned IP addresses. The Instant Internet unit has a dialup
connection to the Internet and an Ethernet connection to the LAN. The Web server
is to be called “iibox.dynamic.myzone.com.” The Web server has the IP address,
192.168.1.10. The Dynamic DNS name server for “dynamic.myzone.com” has
the IP address 192.122.98.75.
To publish a Web server when you have a dynamic IP address from your ISP:
1
Enter the public address and port.
In this example, select the dial-up interface from the list as the public address
and www as the port.
2
Enter the private address and port.
In this example use, 192.168.1.10 as the private address and www as the port.
Using the BayStack Instant Internet Management Software Version 7.11
140
Chapter 5 Advanced IP configuration
3
Click OK.
The Server Publication configuration dialog box closes and returns you to the
Server Publication dialog box (Figure 65).
4
Click OK.
5
Choose Support > Other Settings (Figure 68).
The Other Settings dialog box opens.
Figure 68 Other Settings dialog box
6
Enter the name under “Notify DNS Server of dial-up interface address
change.
This is the FQDN of the Web server.
In this example, use the name, “iibox.dynamic.myzone.com.”
7
Enter the DNS address of the Dynamic DNS server.
In this example, use the DNS address, “192.122.98.75.”
300868-G
8
Click OK.
9
In the main Setup window, click Save and Exit.
Chapter 5 Advanced IP configuration
141
Now, the reference to the Fully Qualified Domain Name (FQDN) reflects the
current address of the dial-up interface.
Note: The time-to-live, or the amount of time that the result of the DNS
query can be cached before a new lookup is performed, is kept very small
so that changes to the interface’s address are reflected in the DNS
relatively quickly.
Example: Publishing a server for NetMeeting
You can use NetMeeting to conference two or more individuals together over the
Internet. NetMeeting allows you to talk to one another, view presentations
together, or work on a white board together regardless of your location.
Connecting to a directory server or the MSN Messenger Service only works for
outgoing calls. However, you can use the MSN Messenger Service to request that
a person on the same network as the Instant Internet unit make the call.
Instant Internet automatically configures itself for holding a NetMeeting with
external computers. However, you must configure Instant Internet to route
incoming NetMeeting data to a particular workstation.
In this example, the Instant Internet unit’s public address is 134.177.3.28
(provided by your ISP). The IP address of the PC that is set to accept an incoming
NetMeeting call is 190.210.35.6
To set up the NetMeeting, select the WAN interface as the public entries with
ports 1720 and 1731 in the list of server publications (Figure 69) on page 144.
You add the workstation’s IP address of 190.210.35.6 and ports 1720 and 1731 as
the private entries.
Using the BayStack Instant Internet Management Software Version 7.11
142
Chapter 5 Advanced IP configuration
Figure 69 Publishing a server for NetMeeting
After the workstation has been set up to accept incoming NetMeeting calls, people
can call you by using the IP address or the FQDN of the Instant Internet unit.
Note: If your Instant Internet unit uses a dynamic IP address, you can
use the Dynamic DNS facility so that all that all you have to do is type in
the FQDN of the Instant Internet unit that you have registered in the
Dynamic DNS.
Configuring an IP filter
An IP filter permits or denies access of packets into, out of, or through Instant
Internet. Filters are powerful tools for controlling the behavior of packets and
frames. They protect the integrity of Instant Internet and the networks to which it
is passing traffic. Typically, a filter permits the passage of a few, well-understood
packets and denies the passage of everything else.
Each filter has a logical name and contains a list of rules. You can apply filters to
any interface on either input or output processing, or both. Filter rules are
processed in the order specified, and there is an implicit deny all filter at the end
of the list. When a filter is not specified for an interface, all traffic is allowed.
300868-G
Chapter 5 Advanced IP configuration
143
You can create filters that form templates for performing a particular type of
filtering. The reason for creating filters and then applying them to an interface,
instead of just applying them directly to an interface, is that this method provides
inherent consistency and allows you to apply the same list of rules to multiple
interfaces without having to ensure consistency each time.
After you create a filter, you can apply it as an input filter or an output filter. For
details, refer to “Applying a filter to an interface” on page 148.
Processing a packet through an IP filter
When a packet is “dropped into” the top of the stack of filters, the matching
criteria at each filter is applied. If a match occurs, the specified permit or deny
action is executed. If a match does not occur, the packet “drops down” to the next
filter in the stack and the matching process is applied again.
If a packet drops through all the filters and a match never occurs, Instant Internet
has to know what to do with a packet. There must be a default action. The default
action could be either to permit all packets that do not match or to deny them. The
default action in Instant Internet is to deny these types of packets. Any packet that
is referred to a filter list but does not find a match is automatically dropped.
This last default filter is called an implicit deny any filter. As the name implies, the
line does not show up in any filter list you build. It is simply a default action and it
exists at the end of any and all filter lists.
You can however, override this implicit deny filter by making the last line of the
list an explicit permit any filter. Packets dropping through all the other filters will
match the explicit permit any filter before they get to the default implicit deny any
filter. Therefore all packets not matching anything else are permitted and nothing
ever reaches the implicit deny.
Filter lists are executed sequentially, from the top down. This concept is
important. Perhaps the most common cause of malfunctioning filter lists is putting
the individual filtering lines in the wrong sequence.
Using the BayStack Instant Internet Management Software Version 7.11
144
Chapter 5 Advanced IP configuration
To configure an IP filter:
1
Start Setup, and if prompted, select a unit to configure.
2
In the Interfaces area, select an interface and then click Filters.
The <interface name> Filter Configuration dialog box opens (Figure 70).
Figure 70 Interface Filter Configuration dialog box
300868-G
Chapter 5 Advanced IP configuration
3
145
Click Add.
The Filter Configuration dialog box opens (Figure 71).
Figure 71 Filter Configuration dialog box
4
In the Filter Name box, enter a name for the filter.
5
Click Add.
The Rule Configuration dialog box opens (Figure 72).
Using the BayStack Instant Internet Management Software Version 7.11
146
Chapter 5 Advanced IP configuration
Figure 72 Rule Configuration dialog box
6
Select the Action for any packet matching the filter rule:
•
•
•
•
7
Allow – Allows the packet.
Deny – Denies the packet.
L4switch – Sends the packet to the Web (HTTP) proxy.
NAT – Sends the packet for address translation.
Select the Protocol to which you want to apply the rule.
IP is the default.
If you select TCP, the Established check box becomes available. You can
select this option to match TCP packets belonging to established connections.
This is typically used to allow packets for established workstation sessions
while preventing access to servers.
8
In the Source area, enter the following information:
•
•
300868-G
Address – The IP address of the source. You can use any valid IP address
or host name. If you do not specify a source, the default is any source
address.
Bits – The number of bits of the network portion of the source address.
The default is 32.
Chapter 5 Advanced IP configuration
•
•
9
147
Port – If you are specifying a range of ports, this is the beginning port
number. This is meaningful only for TCP or UDP filter rules and specifies
the port of the data packet.
Ending Port – If you are specifying a range of ports, this is the ending
port number in the range. This is meaningful only for TCP or UDP filter
rules. The ending port must be greater than the beginning port.
In the Destination area, enter the following information:
•
Address – The IP address of the destination. You can use any valid IP
address or host name. The default is any destination address.
Note: Instant Internet removes the IP options field from received
packets, including the source routing option. This prevents Instant
Internet from forwarding source-routed packets under any circumstances,
and it generally processes such packets as if addressed to the unit itself.
•
•
•
Bits – The number of bits of the network portion of the destination
address. The default is 32.
Port – If you are specifying a range of ports, this is the beginning port
number. This is meaningful only for TCP or UDP filter rules, and
specifies the port of the data packet.
Ending Port – If you are specifying a range of ports, this is the ending
port number in the range. This is meaningful only for TCP or UDP filter
rules. The ending port must be greater than the beginning port.
10 Click OK.
You return to the Filter Configuration dialog box, and the filter you just
configured appears in the list.
If you define more than one filter, you can change the order in which the
filters are executed by selecting a filter and using the arrows to the left to
move the filter up or down in the list.
11 Click OK.
The <interface> Filter Configuration dialog box opens (Figure 70).
12 Apply the filter to the interface (see below).
Using the BayStack Instant Internet Management Software Version 7.11
148
Chapter 5 Advanced IP configuration
Applying a filter to an interface
After you create a filter, you can apply it to the interface as an input filter or an
output filter. A common question is “When do you use an input filter versus an
output filter?” In many cases, it does not make a difference. In complex
configurations with multiple interfaces, however, there is a benefit of one over the
other. For example, if you have a network with a host to which no one should be
allowed to telnet, you can apply an output filter to that interface to which the host
is connected that blocks Telnet packets from being transmitted to that host. Then
there is no need to apply this filter to the input of all other interfaces.
To apply a filter to an interface:
1
In the Interfaces area, select an interface and then click Filters.
The <interface name> Filter Configuration dialog box opens (Figure 73).
Figure 73 Interface Filter Configuration dialog box
300868-G
Chapter 5 Advanced IP configuration
2
Select the filters you want to apply to the interface. Choose from:
•
•
3
149
In filter – Applies the filter to incoming packets as they are received.
Out filter – Applies the filter to packets just before they are transmitted
by the interface.
Click OK.
Enabling Instant Internet as a DHCP server
The Instant Internet unit can function as a DHCP server on your network and
assign IP addresses to workstations and other IP devices dynamically. Using the
Instant Internet unit as a DHCP server is the recommended configuration for the
unit. You may want to use this feature if you do not want to administer static IP
addresses for every workstation on your network.
For a discussion of using the Instant Internet unit as a DHCP server, refer to
Installing the BayStack Instant Internet Management Software Version 7.11.
Scopes and leases
A DHCP scope is a pool of IP addresses, together with a subnet mask and default
gateway. Each subnet can have only one scope with a single, contiguous range of
IP addresses. You can create the effect of several ranges, if necessary, by creating
a scope that encompasses all the desired ranges and then excluding the addresses
that fall between the desired ranges. You can establish multiple leases to support
multiple subnets, such as an Ethernet subnet and a token ring subnet.
When a computer using DHCP for its configuration (a DHCP workstation) is
turned on, it requests an IP address, and other configuration information, from the
DHCP server. If there is an available address in the DHCP server’s pool, or scope,
the server grants permission to use that IP address for a given amount of time
(a lease). Before the lease expires, the workstation asks the server to extend the
lease, so that the lease remains in effect until (some time after) the workstation
computer is turned off.
Using the BayStack Instant Internet Management Software Version 7.11
150
Chapter 5 Advanced IP configuration
In fairly static network environments, where computers are not frequently moved
in and out of the network, long-term leases (days, or even weeks or months) are
sometimes used. The advantage of long leases is that the DHCP server may be
down for maintenance or repairs for a long period of time before DHCP
workstations lose their leases on their addresses, and must stop using the network.
The disadvantage of long leases is that the IP address used by a computer that is
removed from the network will not be available for use by another computer until
the lease expires. Thus, in a situation where it is common for visitors to bring their
portable computers into the office and connect to the network, or in situations
where the pool of available addresses is very small, shorter leases may be
desirable. The overhead of renewing a lease is negligible and need not be a
concern when selecting a lease period. Leases as short as 20 minutes are perfectly
practical.
Using the DHCP/BootP relay agent feature
A DHCP server can provide IP addresses to workstations on remote subnets if
a DHCP/BootP Relay Agent exists on each workstation network. A Relay Agent
routes the workstation requests to the actual DHCP server. The DHCP/BootP
Relay Agent functionality can be provided by any RFC 1542 compliant router.
If you do not have such a router, you can enable the Relay Agent feature in the
Instant Internet DHCP server.
Note: If you choose to use Instant Internet as a DHCP/BootP Relay
Agent, none of the other configuration parameters for the Instant Internet
DHCP server have any meaning. The Instant Internet DCHP server does
not directly provide configuration information to workstations, but
merely acts as a gateway for communication between DHCP workstations
and the DHCP server.
To use the Relay Agent feature:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > Services.
The Services dialog box opens (Figure 74).
300868-G
Chapter 5 Advanced IP configuration
151
Figure 74 Services dialog box
3
Select the DHCP check box.
4
Click Configure.
The DHCP Configuration dialog box opens (Figure 75).
Figure 75 DHCP Configuration dialog box
Using the BayStack Instant Internet Management Software Version 7.11
152
Chapter 5 Advanced IP configuration
5
In the Relay Agent area, click in the checkbox to enable.
6
Specify the address of the DHCP server to be used by the Instant Internet unit.
7
Click OK.
Configuring Instant Internet as a DHCP server
If you already had a DHCP server running when you first set up the Instant
Internet unit, the Instant Internet unit did not set itself up to run as a DHCP server.
You may, however, later choose to have the Instant Internet unit become the
DHCP server.
To configure Instant Internet as a DHCP server:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > Services.
The Services dialog box opens (Figure 76).
Figure 76 Services dialog box
300868-G
Chapter 5 Advanced IP configuration
3
Select the DHCP check box.
4
Click Configure.
153
The DHCP Configuration dialog box opens (Figure 77).
Figure 77 DHCP Configuration dialog box
5
In the Scopes area, click Add.
The Scope Configuration dialog box opens (Figure 78), where can you add a
range of addresses for the Instant Internet unit to use. You can also specify any
addresses within that range that you want to exclude.
Using the BayStack Instant Internet Management Software Version 7.11
154
Chapter 5 Advanced IP configuration
Figure 78 Scope Configuration dialog box
6
In the IP Addresses area, specify the following:
•
•
•
•
Start Address – The first address of the range of addresses you want the
Instant Internet unit to use.
End Address – The last address of the range of addresses you want the
Instant Internet unit to use.
Subnet Mask – This is automatically entered after you enter the Start
Address and you move the cursor out of the Start Address field.
Router Address – Enter the IP address of the router you want the
workstations to use. This should be the IP address of the Instant Internet
unit.
To exclude any addresses in the range you specified above:
a
In the Excluded Addresses section, click Add.
The Enter Excluded Addresses dialog box opens (Figure 79).
300868-G
Chapter 5 Advanced IP configuration
155
Figure 79 Enter Excluded Addresses dialog box
This feature allows you to have more control over how IP addresses are
assigned to groups and users.
b
Specify the following:
Start Address – The first address of the range of addresses you want to
exclude.
End Address – The last address of the range of addresses you want to
exclude.
Note: Be sure to exclude the IP address of the Instant Internet unit.
c
Click OK.
You return to the Scope Configuration dialog box (Figure 78 on
page 154).
7
Click OK.
8
In the DHCP Configuration dialog box (Figure 77), in the DNS Servers area,
click Add.
The Enter Server Address dialog box opens (Figure 80).
Using the BayStack Instant Internet Management Software Version 7.11
156
Chapter 5 Advanced IP configuration
Figure 80 Enter Server Address dialog box
9
Specify the DNS servers for the workstations to use.
You should enter the IP address of the Instant Internet unit.
10 Click OK.
You return to the DHCP Configuration dialog box (Figure 77 on page 153).
11 In the WINS Servers area, click Add.
The Enter Server Address dialog box opens (Figure 80 on page 156).
12 Specify WINS Servers for the workstations to use.
13 Click OK.
You return to the DHCP Configuration dialog box (Figure 77 on page 153).
14 In the WINS Servers area, specify the Node Type for the WINS servers to use.
•
•
•
•
B – Uses IP broadcast messages.
P – Uses point-to-point communications.
M – Tries a broadcast (B) first, and, if that fails, it tries point-to-point (P).
H – Tries point-to-point (P) first, and, if that fails, it tries broadcast (B).
15 In the Lease area, specify the number of days, hours, and minutes for IP
addresses to be leased or assigned to LAN workstations.
16 Click OK.
300868-G
Chapter 5 Advanced IP configuration
157
Using Instant Internet as a DHCP workstation
You can also configure Instant Internet to be used as a DHCP workstation.
However, this functionality is intended to support modems that use the DHCP
protocol to assign dynamic IP addresses. Do not allow the Instant Internet unit to
receive an IP address from an existing DHCP server on the network interface
because the client workstations must be configured to use the Instant Internet unit
as a gateway and DNS server.
Configuring the routing information protocol
Routing information protocol (RIP) allows a router to select the best path for
sending packets to help speed up data transfer. Every 30 seconds, all routers
configured to use the RIP technology broadcast a message that contains their own
destination network addresses and the number of hops it takes to get to them (hop
count) as well as the destination network addresses and associated hop count of
any neighboring routers that they have been in contact with. The routers then use
the information gathered from these broadcasts to determine whether or not a
network is reachable and how far away it is to determine the best route to send a
packet.
Using the BayStack Instant Internet Management Software Version 7.11
158
Chapter 5 Advanced IP configuration
To configure Instant Internet to use the RIP feature:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > RIP’s.
The RIP’s dialog box opens (Figure 81).
Figure 81 RIP’s dialog box
3
Decide whether or not to accept announcements from other routers. In the
Accept Announcements from other Router check box, do one of the
following:
•
•
Place a check mark in the check box to accept announcements from
another router.
Clear the check box to ignore announcements from other routers.
Note: Accept applies to all forms of RIP (V1, V2 Broadcast, or V2
Multicast), when enabled.
4
In the Announce Routes section, select the interface(s) for which you would
like to announce information.
All selected interfaces are highlighted. To select or de-select an interface,
place the cursor on the interface and click.
300868-G
Chapter 5 Advanced IP configuration
5
159
Select the Version of RIP that you would like to use.
— None. When you select none, you do not send RIP messages.
— V1. When you select V1, you send RIP messages to all known routers
without subnet information.
— V2 Broadcast. When you select V2 Broadcast, you send RIP messages to
all known routers including information for subnet masks. (This version
is included in order to be backwards compatible for older versions of
Instant Internet. Use V2 Multicast for all other purposes).
— V2 Multicast. When you select V2 Multicast, you also send RIP
messages to all known routers, including information for subnet masks,
but you minimize the load on other computers because the number of RIP
messages being sent and received are limited to computers with V2
Multicast enabled.
6
Click OK.
7
Continue with any other procedures or click Save and Exit.
Configuring an alias for an interface
An Instant Internet unit can support multiple IP addresses and subnets on one
physical interface. Each IP address has a name that helps distinguish what each IP
address is being used for. The name that is given to each additional IP address is
its alias.
When combined with Static NAT, this is useful to publish additional public
addresses for Web and mail servers existing in the privately addressed local
network.
Example
The Eth1 interface may already have a private IP address and mask like
192.168.1.1/24. An alias interface could be added to Eth1 to provide an additional
address and mask, so that two different IP networks are operating on the same
physical interface. This is desirable in some cases where public and private
addresses are used on a single LAN, and an additional LAN segment is not
available (such as with an Instant Internet 100 unit).
Using the BayStack Instant Internet Management Software Version 7.11
160
Chapter 5 Advanced IP configuration
To add an alias to an Instant Internet unit:
1
Start Setup, and if prompted, select a unit to configure.
2
Click Add.
3
Click Alias.
4
Enter a unique name for the interface.
5
Select the interface to which the alias will be added.
6
Enter the desired new IP address and subnet mask for the interface.
If left blank, the default is 255.255.255.255.
7
Click OK.
To turn on address translation for this alias:
1
Click Configure
2
Place a check mark in the Address Translation check box if NAT is desired.
For more information, see “Configuring address translation” on page 134.
Using a DMZ
A Demilitarized Zone (DMZ) is a network segment that is separate from your
internal network and usually contains publicly accessible servers. The devices on
a DMZ often have publicly announced IP addresses and require less security than
your internal network. Segmenting your Web, FTP, e-mail or DNS servers in a
DMZ allows you to host your own Internet services but keep your internal
network secure.
You may use Instant Internet for a DMZ in one of two ways:
•
•
300868-G
With a single server or a hub connected to an additional Ethernet connector
such as the second Ethernet connector (Eth2) on the back of the Instant
Internet 100-S or 400-S.
With each individual server connected to a port on the seven port switch on
the front of the Instant Internet 100-S or 400-S unit. The primary benefit of
using the switch for your DMZ is to isolate data traffic from one server to
another and to eliminate the requirement for a separate hub.
Chapter 5 Advanced IP configuration
161
To add a server to the DMZ:
1
Determine an appropriate IP address range for the DMZ subnet and assign the
server an IP address in the DMZ subnet.
2
Connect the server to the DMZ.
Use a cross-over cable to connect an Ethernet connector on the rear of the
Instant Internet unit directly to a single machine on the DMZ. Use a only a
straight through cable to connect an Ethernet connector on the rear of the
Instant Internet to a hub or switch to connect multiple machines to the DMZ.
When connecting to the seven-port switch (Eth1) on the Instant Internet 100-S
or 400-S unit, use either a straight-through or a cross-over cable.
Configuring Instant Internet to support a DMZ
Once a DMZ has been connected to the Instant Internet unit, you configure Instant
Internet to support the DMZ:
•
•
•
Configure the interface
Publish the server
Decide whether or not to enable IP forwarding
Configuring the interface to support the DMZ:
1
Start Setup, and if prompted, select a unit to configure.
2
Click Add.
3
Click Network.
The Enter IP Information for <Eth2> dialog box opens (Figure 82).
Using the BayStack Instant Internet Management Software Version 7.11
162
Chapter 5 Advanced IP configuration
Figure 82 Enter IP Information for Interface dialog box
4
Assign the Instant Internet interface an IP address within the DMZ subnet.
5
Enter a subnet mask. If left blank, the default is 255.255.255.0.
6
Click OK.
Publishing the server(s)
To make the server(s) in the DMZ publicly accessible, use server publication:
1
Start Setup, and if prompted, select a unit to configure.
2
From the menu bar, choose Support > Server publication.
For instructions, see “Configuring Instant Internet to publish a private server” on
page 136. Publishing the server(s) protects the DMZ by limiting traffic to only the
published services.
Deciding whether to enable IP forwarding for your DMZ
When IP forwarding is not enabled, clients on the private LAN are restricted to
public access of the servers on the DMZ. To allow unrestricted access between
your LAN clients and the server(s) on the DMZ subnet, you must enable IP
forwarding. See “Enabling IP forwarding” on page 130 for details.
300868-G
Chapter 5 Advanced IP configuration
163
Example: Using a DMZ to publish a Web server
This section provides an example for publishing a server.
In this example, you are publishing a server with a public IP address of
134.177.3.28. Your LAN uses private addresses, and you are using the seven-port
switch for your LAN and Eth2 for your DMZ.
To configure the interface for the DMZ:
1
Start Setup, and if prompted, select a unit to configure.
2
Click Add.
3
Click Network.
The Enter IP Information for <Eth2> dialog box opens (Figure 83).
Figure 83 Enter IP Information for Interface dialog box
4
Enter 134.177.3.1 as the IP address for the Instant Internet interface on the
DMZ subnet.
5
Enter a subnet mask. You can use the default 255.255.255.0.
6
Click OK.
Using the BayStack Instant Internet Management Software Version 7.11
164
Chapter 5 Advanced IP configuration
To publish the server:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > Server Publication.
3
Click Add.
4
In the following fields, enter this information:
•
•
•
•
•
5
Protocol: TCP
Public IP address: 134.177.3.28
Port: www
Private IP address: 134.177.3.28
Port: www
Click OK.
The Server Publication dialog box opens (Figure 84).
Figure 84 Server Publication dialog box
300868-G
Chapter 5 Advanced IP configuration
6
165
Click OK.
You now have a Web server that can be accessed from the Internet but you also
have a secure LAN. Your own LAN clients can also access the Web server
through this server publication, but if IP forwarding is disabled, only in the same
way that external clients can access it from the Internet. If IP forwarding enabled,
then unrestricted access is allowed between the private LAN and the DMZ.
Using the BayStack Instant Internet Management Software Version 7.11
166
Chapter 5 Advanced IP configuration
300868-G
167
Chapter 6
IP security and VPN
This chapter explains how to configure IP security to use the Instant Internet unit
and a Contivity Extranet Switch (CES) or two Instant Internet units in a virtual
private network (VPN).
Understanding virtual private networking
Instant Internet includes IP security (IPsec) virtual private networking (VPN)
capabilities designed to establish a tunnel with a Contivity Extranet Switch (CES),
another Instant Internet unit at different location, or other IPsec-compliant
devices. A VPN is a special type of connection that permits remote users or LANs
to communicate with another LAN over a public network, such as the Internet.
When you set up a VPN, you are essentially using a public network as your own
private, secure network. When users connect through the VPN, you incur only the
local toll charges to your ISP.
To create a VPN, a special connection, called a “tunnel,” is first established
between the two sites. Tunnels allow private IP traffic to flow across the Internet,
including NetBIOS information (for Windows networking) encapsulated within
IP packets. Through the tunnel, all IP-based resources and applications on the
remote LAN become available to the local site.
Using the BayStack Instant Internet Management Software Version 7.11
168
Chapter 6 IP security and VPN
User data sessions through tunnels can specify DES encryption to assure privacy,
authentication, which proves that the data was not intercepted and modified, or
both. Instant Internet supports 56-bit encryption (DES) for VPN tunneling as a
standard feature. Instant Internet also supports 168-bit encryption (3DES) as an
add-on feature.
Note: The export of 3DES encryption outside North America is
regulated by the U.S. Government. If you require 3DES encryption, you
must purchase the 3DES Encryption Module (part number CQ1010005).
Contact your Nortel Networks sales representative for more information.
For authentication, Instant Internet supports:
•
•
MD5 - Message Digest 5
SHA - Secure Hash Algorithm
Understanding modes
Whenever you configure a tunnel between two Instant Internet units or an Instant
Internet unit and a Contivity CES, Setup determines what mode needs to be used.
After you add a VPN, you can change the mode to be used in the tunnel.
Internet Security Association and Key Management Protocol (ISAKMP)
negotiations proceed in two phases. During phase 1, two ISAKMP peers establish
a secure, authenticated channel with which to communicate. The ISAKMP is used
to protect further negotiation traffic. During phase 2, other Security Associations
(SA) are negotiated on behalf of IPsec.
Internet Key Exchange (IKE) defines two basic methods used to accomplish a
phase 1 authenticated key exchange:
•
•
300868-G
Main mode – Main mode provides identity protection because the identity of
the peers is exchanged in encrypted messages after the Diffie-Hellman key
exchange.
Aggressive mode – In aggressive mode, the name of the tunnel interface is
sent as the source ID in the initial proposal. This allows the remote gateway to
identify the incoming connection by name, rather than by IP address and
therefore can be used with dynamic addresses.
Chapter 6 IP security and VPN
169
Contivity version 2.6 has also implemented aggressive mode for
non-contivity clients, in order to support more client implementations. Instant
Internet leverages this new capability to act as a single-user client on behalf of
the network (many-to-one NAT).
Using perfect forward secrecy
Perfect forward secrecy (PFS) means that the compromise of a single key only
permits access to data protected by that key. PFS has been added primarily for
easy compatibility with Contivity.
The PFS setting between the Instant Internet unit and the Contivity CES must
match. The Instant Internet unit responds to a phase 2 key exchange performed
by the destination regardless of this setting. Note that PFS also incurs significant
additional computational overhead that you may want to avoid unless you
understand the security implications and PFS is required.
The default setting for PFS depends on whether you add an IPsec to tunnel to
another Instant Internet or Contivity. The default when connecting to another
Instant Internet unit is off. The default when connecting to Contivity is on.
To enable PFS:
1
Start Setup, and if prompted, select a unit to configure.
2
In the Interfaces area, select the IPsec interface for which you want to modify
the PFS.
3
Click Configure.
The IPsec Configuration dialog box opens (Figure 85).
Using the BayStack Instant Internet Management Software Version 7.11
170
Chapter 6 IP security and VPN
Figure 85 IPsec Configuration dialog box
4
Select the PFS check box to enable perfect forward secrecy.
•
To disable PFS, clear the check box.
Using the default network specification
Instant Internet has an IPsec form of “default network.” This default network is
used to select Instant Internet’s source address for a packet whose destination is at
the other end of an IPsec tunnel. This feature allows Instant Internet to participate
in its own IPsec tunnels for its own services such as DNS and proxies. You can
also combine the default network command with NAT so that all addresses can be
translated to a single source address that is also a valid source address in an IPsec
tunnel.
300868-G
Chapter 6 IP security and VPN
171
To modify your default network setting:
1
Start Setup, and if prompted, select a unit to configure.
2
Select the IPsec interface for which you want to modify the default network
setting.
3
Click Configure.
The IPsec Configuration dialog box opens (Figure 86).
Figure 86 IPsec Configuration dialog box
4
In the Default Network area, select an interface from the list.
Using the BayStack Instant Internet Management Software Version 7.11
172
Chapter 6 IP security and VPN
Managing local and remote IP addresses
You can add or remove local and remote IP addresses for a VPN tunnel. Adding a
remote address of 0.0.0.0/0 designates non-split tunneling while specifying the
actual remote subnet designates split tunneling.
•
Non-Split Tunneling – When you configure a VPN with non-split tunneling,
Instant Internet sends all packets over the IPsec tunnel.
•
Split Tunneling – When you configure a VPN with split tunneling, Instant
Internet sends the packets destined for the Internet outside of the IPsec tunnel
and directly to the Internet, and sends only the packets destined for the VPN
over the IPsec tunnel. The benefit of a split-tunnel configuration is that each
site’s Internet traffic does not traverse the IPsec tunnel, and the home office
does not have to provide Internet connectivity for all of the branch offices.
Adding a local or remote IP address
To add a local or remote IP address:
1
In the IPsec Configuration dialog box, in the Local Addresses or Remote
Addresses area, click Add.
The Enter IP Address dialog box opens (Figure 87).
Figure 87 Enter IP Address dialog box
300868-G
2
Enter the IP Address of a local or remote network that is to be allowed to
participate in the tunnel.
3
Enter the number of bits.
4
Click OK.
Chapter 6 IP security and VPN
173
Removing a local or remote IP address
To remove a local or remote IP address:
1
In the IPsec Configuration dialog box, in the Local Addresses or Remote
Addresses area, select the address and then click Remove.
2
In the confirmation dialog box, click Yes.
Using Pings
Instant Internet provides a background ping facility that you can use to monitor
and control the connection state of a VPN and serve as a “keep-alive” for the
tunnel. You use control when you want to maintain a permanent connection. You
typically use monitor with a dial-up connection when you do not want to keep the
connection active but you still want to check the status of a tunnel.
The following capabilities are available for the Ping command:
•
All Modes – For all modes of ping, the destination address, interval, and
timeout can be specified. The destination should be chosen as some device
that is reachable and for which a response is representative of the desired
connectivity.
For example, if the purpose of the ping is to validate a VPN connection, then
it is best to choose a destination that is reached through the VPN tunnel, if
possible, such as the private address of the remote Instant Internet or
Contivity.
— Length – This box is normally left blank so that the shortest possible
packet is used.
— Interval – Specifies the number of seconds between ping attempts. The
default is 1 second.
— Timeout – Specifies the number of seconds that are allowed for a
response. The default is 5 seconds.
Using the BayStack Instant Internet Management Software Version 7.11
174
Chapter 6 IP security and VPN
•
Monitor Mode – The monitor mode does not initiate a connection and is not
considered to be activity against a dial-up interface’s idle timeout. This mode
does not keep a connection active.
Note: A monitor ping is considered to be activity on the CES but is not
considered to be activity against Instant Internet’s dial-up timeout.
Therefore, Instant Internet is free to drop the line. After the line is
dropped, the monitor ping disables the connection. The CES idle timeout
disables the other end of the connection.
In monitor mode, if the specified interface is not active the ping does not
occur. Also, in the case of an IPsec interface, if the interface used to reach the
corresponding remote gateway is not active, then the ping does not occur. If
an IPsec interface is specified and no response is received for three
consecutive pings, the tunnel information is destroyed and is rebuilt as
required by normal VPN activity.
If the ping fails for three consecutive times, the interface is brought down, but
is not disabled from further activity. This is normally used for IPsec interfaces
because the ping failure indicates that the IPsec tunnel is no longer operating
properly. If this happens, any active IPsec tunnels are destroyed and are
rebuilt as required by normal activity.
•
Control Mode – The control mode is useful for maintaining permanent
connections, switching to a backup interface when a primary interface
becomes unavailable and the primary interface does not have a reliable
indication of its availability or both.
For example, in xDSL and cable modem environments, the Instant Internet
interface that connects to the Internet is usually an Ethernet interface, and that
interface is always active as long as the link exists between Instant Internet
and the xDSL or cable modem. A ping in control mode always attempts to use
the specified interface (even if it is considered inactive for normal use), and if
three consecutive responses are not received, the interface is made inactive (if
an IPsec interface is used, any associated tunnels are destroyed). The ping
continues to transmit on the interface, even while it is unavailable for normal
traffic. After responses are received, the interface is made available again.
Note: The control mode initiates a connection and is considered as
activity. A control mode ping attempts to keep the path to the destination
active at all times.
300868-G
Chapter 6 IP security and VPN
•
175
Background Mode – Standard background mode is a standard ping with no
other special provisions. This mode sends a ping to the specified destination,
which initiates a connection if required, and counts as activity. The receipt of
a response (or the lack of one) has no effect on system operation.
To configure a ping:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > Ping’s.
The Pings dialog box opens (Figure 88).
Figure 88 Pings dialog box
3
Click Add.
The Ping Configuration dialog box opens (Figure 89).
Using the BayStack Instant Internet Management Software Version 7.11
176
Chapter 6 IP security and VPN
Figure 89 Ping Configuration dialog box
4
Enter the IP address or host name of the remote computer you want to ping.
When using ping from Instant Internet-to-Instant Internet, it is best to select
the private address of the remote Instant Internet to ping to. When using ping
from Instant Internet to a CES, it is best to select the private address of the
Contivity to ping.
5
Enter the length of the data.
6
Enter the time, in seconds, for the interval of time between packets.
7
Enter the period of time to wait for a ping to come back.
8
Select the type of ping to run:
•
•
•
9
300868-G
Monitor – Used for IPsec, this option checks the validity of a tunnel.
After a series of failed pings, this option destroys the tunnel. This type of
ping does not initiate a dial-up connection or cause a dial-up connection
to be kept active. The ping monitors the validity of the tunnel.
Control – Manages the operating status of an interface. This type of ping
can be used to force a connection to be kept active at all times.
Background – Runs the ping in the background. This can be used to keep
a dial-up connection active.
If you selected Monitor or Control, select the interface to monitor or control.
Otherwise skip this step.
Chapter 6 IP security and VPN
177
10 Select the interface used to initiate the ping. The default source is the IP
address of the interface that is closest to the destination.
11 Click OK to close the Ping configuration dialog box.
12 Click OK to close the Pings dialog box.
13 Click Save and Exit.
14 Click Yes to have the changes take effect immediately (optional).
15 Click Yes to test the connection (optional).
Understanding how an Instant Internet-to-Instant Internet
VPN works
The Instant Internet unit’s VPN capabilities are designed to establish a secure
tunnel with another Instant Internet unit at a different location. When you
establish a VPN between two Instant Internet units, you can decide what types of
connection you want to allow to your unit. This option provides you with another
means for selecting the level of security necessary.
You may specify whether or not you want to allow strictly incoming or outgoing
connections to establish a tunnel. You may also specify to allow both incoming
and outgoing connections to establish a tunnel.
Allowing only incoming connections
You select this option to allow incoming connections only to establish a tunnel.
Use this feature when connecting with a remote site that has a dynamic IP address
or is a third-party IPsec client.
To allow only incoming connections to establish a tunnel:
1
Start Setup, and if prompted, select a unit to configure.
2
Click Add.
3
In the Select Connection Type dialog box, click IPsec.
4
In the Select Connection Device dialog box, click BayStack II.
5
In the Select Type of Connections dialog box, click Incoming only.
The IPsec Configuration dialog box opens (Figure 90).
Using the BayStack Instant Internet Management Software Version 7.11
178
Chapter 6 IP security and VPN
Figure 90 IPsec Configuration dialog box
6
In the Name box, enter a name for the tunnel. This name must match the one
used on the other end of the tunnel.
7
In the Key box, enter a key for the tunnel. The key is the password for the
tunnel and must be mutually agreed upon by both Instant Internet units.
8
Click Add to enter an IP address of a local network to participate in the tunnel.
You can specify an address here to force a packet to go through the tunnel.
The default local address, 0.0.0.0/0, allows all IP addresses on your LAN to
be reached through the tunnel. This provides no security, however. To remove
this address, click the address and then click Remove. You can also specify
the addresses allowed in the tunnel. For more information, refer to “Adding a
local or remote IP address” on page 172.
9
In the main Setup window, click Save and Exit.
10 Click Yes to have the changes take effect immediately (optional).
11 Click Yes to test the connection (optional).
Allowing only outgoing connections
You select this option to allow outgoing connections on a tunnel. Select this
option when you are initiating the connection but are not receiving incoming
connections, such as when you have a dynamic IP address for your unit.
300868-G
Chapter 6 IP security and VPN
179
To allow only outgoing traffic to flow through your end of a tunnel:
1
Start Setup, and if prompted, select a unit to configure.
2
Click Add.
3
In the Select Connection Type dialog box, click IPsec.
4
In the Select Connection Device dialog box, click BayStack II.
5
In the Select Type of Connections dialog box, click Outgoing only.
The IPsec Configuration dialog box opens (Figure 91).
Figure 91 IPsec Configuration dialog box
6
In the Name box, enter a name for the tunnel. This name must match the one
used on the other end of the tunnel.
7
In the Key box, enter a key for the tunnel. The key is the password for the
tunnel and must be mutually agreed upon by both Instant Internet units.
8
In the Destination box, enter the remote Instant Internet unit’s public address
or Fully Qualified Domain Name (FQDN). If an FQDN is specified, it is
resolved each time a connection is initiated.
9
In the Local Addresses area, click Add to enter the IP addresses of a local
network allowed to participate in the tunnel. For more information, refer to
“Managing local and remote IP addresses” on page 172.
The default local address is that of your Local Area Network.
Using the BayStack Instant Internet Management Software Version 7.11
180
Chapter 6 IP security and VPN
10 In the Remote Addresses area, click Add to enter the IP addresses of the
remote site that is accessed through the tunnel. For more information, refer to
“Adding a local or remote IP address” on page 172.
11 Click OK to close the IP Configuration dialog box. Determine whether or not
you want to monitor or control the connection.
•
•
No – The connection is not monitored or controlled. Skip to step 16.
Yes – You are given the opportunity to configure the monitor and control
settings.
The Enter Monitor / Control Connection Information dialog box opens
(Figure 92).
Figure 92 Enter Monitor / Control Connection Information dialog box
12 Choose whether you want to monitor or control the connection by clicking the
option.
For more information, refer to “Using Pings” on page 173.
13 Enter the IP address of a device that is reachable through the tunnel and
representative of the desired connectivity (usually the private address of the
remote unit).
14 Select the source interface of the connection being monitored or controlled.
15 Click OK.
300868-G
Chapter 6 IP security and VPN
181
16 In the main Setup window, click Save and Exit.
17 Click Yes to have the changes take effect immediately (optional).
18 Click Yes to test the connection (optional).
Allowing both outgoing and incoming connections
You select this option to allow both incoming and outgoing connections to
establish a tunnel. Select this option only if security is not as much of an issue.
To allow both incoming and outgoing connections for a tunnel:
1
Start Setup, and if prompted, select a unit to configure.
2
Click Add.
3
In the Select Connection Type dialog box, click IPsec.
4
In the Select Connection Device dialog box, click BayStack II.
5
In the Select Type of Connections dialog box, click Both.
The IPsec Configuration dialog box opens (Figure 93).
Figure 93 IPsec Configuration dialog box
6
In the Name box, enter a name for the tunnel. This name must match the one
used at the other end of the tunnel.
Using the BayStack Instant Internet Management Software Version 7.11
182
Chapter 6 IP security and VPN
7
In the Key box, enter a key for the tunnel. The key is the password for the
tunnel and must be mutually agreed upon by both Instant Internet units.
8
In the Destination box, enter the remote Instant Internet unit’s public address
or FQDN. If an FQDN is specified, it is resolved each time a connection is
initiated.
9
In the Local Addresses area, click Add to enter the IP addresses of a local
network allowed to participate in the tunnel. For more information, refer to
“Managing local and remote IP addresses” on page 172.
You can specify an address here to force a packet to go through the tunnel.
The default local address, is that of your Local Area Network.
10 In the Remote Addresses area, click Add to enter the IP addresses of the
remote site that allowed to participate in the tunnel. For more information,
refer to “Adding a local or remote IP address” on page 172.
11 Click OK to close the IP Configuration dialog box.
12 Determine whether or not you want to monitor or control the connection:
•
•
No – The connection is not be monitored or controlled. Skip to step 17.
Yes – You are given the opportunity to configure the monitor and control
settings.
The Enter Monitor / Control Connection Information dialog box opens
(Figure 94).
Figure 94 Enter Monitor / Control Connection Information dialog box
300868-G
Chapter 6 IP security and VPN
183
13 Choose whether you want to monitor or control the connection by clicking the
option.
For more information, refer to “Using Pings” on page 173.
14 Enter the IP address of the device that is reachable through the tunnel and
representative of the desired connectivity (usually the private address of the
remote unit).
15 Select the source interface of the connection being monitored or controlled.
16 Click OK.
17 In the main Setup window, click Save and Exit.
18 Click Yes to have the changes take effect immediately (optional).
19 Click Yes to test the connection (optional).
Understanding how an Instant Internet-to-CES VPN works
The Instant Internet unit’s VPN capabilities are also designed to establish a tunnel
with a Contivity Extranet Switch (CES) at another location. You can configure an
Instant Internet-to-CES VPN regardless of whether you get a static IP address or a
dynamic IP address from your ISP.
When you get a dynamic IP address from your ISP, the tunnel uses aggressive
mode. When you get a static IP address from your ISP, the tunnel uses main mode.
If an Instant Internet unit that uses dynamic IP addresses establishes a tunnel with
a CES, the CES considers the Instant Internet to be a “non-Contivity client.” If an
Instant Internet unit that uses static IP addresses establishes a tunnel with a CES,
the CES considers the Instant Internet as a branch office. This type of tunneling is
called branch-to-branch tunneling.
General guidelines
Following are some general guidelines to keep in mind before you begin
configuring the VPN.
The CES branch-to-branch office mode and non-contivity client modes are
supported.
Using the BayStack Instant Internet Management Software Version 7.11
184
Chapter 6 IP security and VPN
•
For branch-to-branch mode, at least one public, static IP address must be
available at both the location of the CES and of the Instant Internet unit.
Only the CES branch office routing type of “static” is supported; RIP mode
works only between CESs.
A branch office connection configured on a CES must not have a remote
endpoint address which is reachable on any of the local subnets on that CES.
There must be at least one router between the CES and the branch office
router.
CES does not allow the remote endpoint to be included in the remotely
available networks.
•
For client mode, because all traffic must be translated to the static address that
was assigned on Contivity, the static address must exist on Instant Internet.
Often, the static address is the same as Instant Internet’s private LAN address.
If the address is not the same, create an alias interface on Instant Internet and
assign the static address to that alias.
Set the default network to the interface that has the static address, and enable
output NAT on the IPsec interface. This translates all packets leaving the
IPsec interface (before they are encrypted and encapsulated) to have that
interface’s address as a source. (Alternatively, input NAT can be configured
on the private LAN interface.)
Another router bordering CES must provide a route to Instant Internet’s
public address. Proxy ARP can be used if Instant Internet’s default network
address is valid on the CES private network.
There are no restrictions on the connection medium used by the Instant Internet
unit. The unit supports IPsec on any type of available interface (including a LAN
connection to another router).
Instant Internet does not support certificates. Only pre-shared keys can be used for
authentication. On Instant Internet, the name of the IPsec interface must match the
user ID that was created on Contivity.
300868-G
Chapter 6 IP security and VPN
185
Instant Internet supports Perfect Forward Secrecy (PFS) for easy compatibility
with Contivity because Contivity, by default, has PFS enabled. When you use
Setup to configure a connection to Contivity, PFS is enabled on the Instant
Internet unit by default.
PFS incurs significant additional computational overhead that you may
want to avoid unless you understand the security implications and PFS is
required
•
•
•
Instant Internet does not support 40-bit Data Encryption Standard (DES).
Instant Internet does support 56-bit encryption (DES) for VPN tunneling as a
standard feature. Instant Internet also supports 168-bit encryption (3DES) as
an add-on feature.
During phase 1 negotiations, CES requires single DES. If you wish to use
3DES, you must also select single DES for encryption type. Instant Internet
uses triple DES (3DES) for the actual tunneled data if it is configured as
higher priority than DES.
Instant Internet does not support compression. The fact that Instant Internet
does not support compression does not affect compression on the CES.
Compression may be enabled on the CES even though it is not supported on
Instant Internet.
Other issues
•
If you enable the Instant Internet unit as a DNS proxy server, the DNS
addresses configured in Instant Internet must be able to resolve all desired
host names, whether part of the public Internet, the private network, or
otherwise.
As an alternative, if Instant Internet clients are configured to use a DNS proxy
server other than the Instant Internet unit, they follow the rules for Microsoft
networking, which allows more flexibility in determining name resolution.
For more information, refer to your Microsoft networking documentation.
Using the BayStack Instant Internet Management Software Version 7.11
186
Chapter 6 IP security and VPN
How a tunnel is initiated
Neither the Instant Internet unit nor the CES can manually initiate a branch office
connection. To initiate a VPN tunnel, some activity must be performed to initiate a
tunnel connection. Some ways that a tunnel may be initiated include: using a ping
or browsing to a site that uses the tunnel. For example, a host on one LAN could
ping a host on another LAN where the packet is expected to travel through a
configured VPN tunnel.
Tunnel validity
Currently, the IPsec protocol does not provide a “keep-alive” mechanism as part
of its standard. If one endpoint of a tunnel disconnects without the knowledge of
the other (for example, if the server on one end is rebooted), the remaining “live”
endpoint still attempts to send traffic through the tunnel. In this situation, the
tunnel status may appear to be valid to the live endpoint, but communications are
not possible. However, after the disconnected endpoint (the end that was
rebooted) initiates a new tunnel as warranted by traffic, the tunnel is reestablished
and operates properly.
Instant Internet provides a Ping utility as a “keep-alive” mechanism in order to
circumvent the problems associated with losing one end of a tunnel. For more
information refer to “Using Pings” on page 173.
Dial-up environments and tunnel validity
In a dial-up or equivalent (analog, ISDN, PPPoE) environment, the Internet
connection may not exist at all times which can cause a problem when a tunnel is
no longer valid. A tunnel connection is completely independent of the dial-up
connection to the Internet and remains valid and expires as configured regardless
of whether or not the dial-up connection is active. Because static IP addressing is
required for a VPN, this is of little consequence because as soon as the connection
is reestablished, the tunnel traffic can continue.
If, however, the dial-up connection is interrupted (inadvertently or intentionally
due to an idle timeout), and the gateway at one endpoint of the tunnel informs the
other endpoint that the tunnel is to be deleted, this information cannot reach the
remote gateway and it will not know that the tunnel is no longer valid. After the
dial-up connection is re-established, it continues to attempt to use this now invalid
tunnel (as described above regarding one endpoint disconnecting).
300868-G
Chapter 6 IP security and VPN
187
This situation occurs due to a limitation of the IPsec protocol; however, there are
two ways you can work around this limitation:
•
•
Maintain traffic in the tunnel in both directions on a relatively constant basis.
This option is possible only when the dial-up connection can exist at all times.
One way to maintain traffic is to send a ping command back and forth from
each gateway’s network to the other.
Reduce the VPN connection timeout. By using shorter timeouts, you can
determine the maximum amount of time required for the system to recover.
Before you implement this solution, consider that substantial computational
overhead is required. For example, an Instant Internet unit model 100 requires
approximately 11 seconds to perform the phase 1 negotiation, so every time
the primary tunnel is re-keyed, traffic is interrupted for that amount of time
(on the model 400 unit this process requires approximately one second).
Note: The phase 1 negotiation timeout is controlled on the CES with the
Forced Logoff parameter, whereas a subnet tunnel is controlled by the
re-key timeout.
•
Use a ping to monitor or control the tunnel (refer to “Using Pings” on
page 173).
Tunnel timeouts
The Instant Internet unit’s IPsec feature performs all communications across a
Security Association (SA), also referred to as a tunnel. An SA is negotiated using
Internet Key Exchange (IKE) standards using two main types of negotiation,
phase 1 and phase 2, and a timeout (specified by time or amount of data) is
associated with each SA. When this timeout expires, the SA is no longer valid and
a new one must be negotiated if needed. The phase 1 negotiation uses a very
secure algorithm that establishes secure communications between the gateways
(the Instant Internet unit and the CES) but does not refer to any specific tunnel.
When phase 1 is complete, additional SAs are negotiated using the phase 2
protocol, with the keys exchanged across the secure phase 1 tunnel. These SAs
refer to specific network pairs.
Using the BayStack Instant Internet Management Software Version 7.11
188
Chapter 6 IP security and VPN
It is important to understand that there is a separate SA for each possible
combination of subnets. For example, if the Instant Internet unit’s IPsec
configuration has two local subnets and four remote subnets, then a total of eight
separate SAs exists if all subnets are communicating with each other. In this case,
the CES has four subnets listed in the Local Accessible Networks and two subnets
listed in the Remote Accessible Networks for the branch office connection.
Note: When troubleshooting a VPN tunnel, remember that each of these
SAs is established as needed and each is subject to its own possible
success or failure during negotiation.
Either gateway can establish communications as needed. For example, an SA can
be initiated by either the Instant Internet unit or by the CES. The initiator of an SA
determines the timeout for that SA. Typically, the timeouts are set the same on
each end, so this is not an issue.
When the Instant Internet unit initiates a phase 1 connection, it sets the timeout to
be the same as that used for the phase 2 SAs. This approximates the effect of
perfect forward secrecy (PFS) because the phase 1 SA expires after the specified
timeout and must be renegotiated before any phase 2 SAs can be re-keyed. Note
that when the CES initiates a phase 1 SA, it does not specify a timeout.
Note: If this behavior is undesirable, use the Forced Logoff parameter in
the CES to apply the specified timeout to the phase 1 SA. For details,
refer to your CES documentation.
Tunneling to CES when Instant Internet has a static IP address
When a tunnel is established between CES and Instant Internet and the Instant
Internet unit has a static IP address, the tunnel is called a branch-to-branch tunnel.
If you have a static IP address, you can configure a branch-to-branch VPN tunnel
between Instant Internet and a CES, Network address translation (NAT) is not
normally performed through the tunnel.
300868-G
Chapter 6 IP security and VPN
189
Configuring a VPN between Instant Internet and a CES is a two-step process:
•
•
Configure the branch office connection in the CES, (next).
Configure Instant Internet as a main-mode tunnel (page 190).
Example for configuring a branch office connection in the CES
This procedure provides an example for configuring a branch office connection on
the CES for tunneling. For detailed information, refer to your product
documentation.
To configure the branch office connection on the CES:
1
In the CES main window, Choose Profiles > Networks.
2
Create a Network Name, and for the subnet information, if not using split
tunneling, specify an IP address of 0.0.0.0 and a mask of 0.0.0.0 or, if you use
split tunneling, specify the IP addresses of all local subnets that will
participate in the VPN. To determine whether you are using split or non-split
tunnelling, refer to “Managing local and remote IP addresses” on page 172.
3
Click Add to create the new network.
4
Click Close.
5
Choose Profiles > Branch Office.
6
Select the user involved in the tunnel and then click Edit.
7
Select the Enable Branch Office Connection check box.
8
For the user’s connection, specify the Network Name you just created in the
Local Accessible Networks.
9
Specify the Instant Internet unit’s public IP address as the Remote Endpoint.
10 Specify the Instant Internet unit’s internal LAN-side IP addresses in the
Remote Accessible Networks.
11 Specify a pre-shared key.
12 Click OK.
Using the BayStack Instant Internet Management Software Version 7.11
190
Chapter 6 IP security and VPN
Configuring Instant Internet as a main-mode VPN tunnel
To configure Instant Internet when your ISP provides you with a static IP address:
1
Start Setup, and if prompted, select a unit to configure.
2
In the main Setup window, click Add.
3
In the Select Connection Type dialog box, click IPsec.
4
In the Select Connection Device dialog box, click Contivity.
5
In the Contivity Extranet Switch dialog box, click Yes.
The IPsec Configuration dialog box opens (Figure 95).
Figure 95 IPsec Configuration dialog box
6
Enter the following information:
•
•
•
300868-G
Name – Select the default name suggested or enter a unique name for the
tunnel. This name should be one that you can associate easily with this
particular tunnel. This name does not have to match the one used at the
other end of the tunnel.
Key – Enter the password that both sides use to establish a connection.
This key must match the pre-shared key you configured on the CES.
Destination – Specify the public IP address of the CES.
Chapter 6 IP security and VPN
7
191
In the Local Addresses area, click Add to enter the local IP addresses allowed
to participate in the tunnel. For more information, refer to “Adding a local or
remote IP address” on page 172.
The information in this box should coincide with the Network setup in step 2
of the configuration of the CES. The default local address is that of your local
area network.
8
In the Remote Addresses area, click Add to enter the IP addresses of a remote
site allowed to participate in the tunnel. For more information, refer to
“Adding a local or remote IP address” on page 172.
9
Click OK to close the IP Configuration dialog box.
The Enter Monitor / Control Connection Information dialog box opens
(Figure 96).
Figure 96 Enter Monitor / Control Connection Information dialog box.
10 Choose whether you want to monitor or control the connection by clicking the
option.
For more information refer to “Using Pings” on page 173.
11 Enter the IP address of the device that is reachable through the tunnel and
representative of the desired connectivity (usually the private address of the
remote unit).
12 Select the source interface of the connection being monitored or controlled.
The source should be the interface for your local LAN.
Using the BayStack Instant Internet Management Software Version 7.11
192
Chapter 6 IP security and VPN
13 Click OK.
14 In the main Setup window, select the VPN tunnel and then click Configure.
15 Specify the default network to be equal to the connection to the router.
16 Clear the PFS check box. NAT is optional.
17 Click OK.
18 In the main Setup window, click Save and Exit.
19 Click Yes to have the changes take effect immediately.
20 Click Yes to test the connection (optional).
The tunnel is configured. For more information on how to initiate a tunnel after it
has been configured, refer to “How a tunnel is initiated” on page 186.
Tunneling to the CES when Instant Internet has a dynamic IP
address
When a tunnel is established between the CES and an Instant Internet unit that
gets a dynamic IP address from the ISP, the tunnel is called an aggressive mode
tunnel. CES 2.6 includes additional support for aggressive mode clients.
Instant Internet can send identification information when a connection is made
using aggressive mode, therefore, CES 2.6 allows Instant Internet to have a
dynamic IP address. However, the CES never initiates an aggressive mode
connection; all such connections must be initiated from the opposite side of the
tunnel.
Configuring a VPN between Instant Internet and the CES when Instant Internet
has a Dynamic IP address is a two-step process:
•
•
300868-G
Configure the non-Contivity client connection on the CES, (next).
Configure Instant Internet as an aggressive mode VPN tunnel (refer to
“Configuring Instant Internet as an aggressive-mode VPN tunnel” on
page 194).
Chapter 6 IP security and VPN
193
Example for configuring the non-Contivity client connection on the
CES
This procedure provides an example for configuring a non-Contivity client
connection on the CES for tunneling. For detailed information, refer to your
product documentation.
To configure the non-Contivity client connection on the CES:
1
From Profiles > Networks, add a network that will be using the VPN.
2
From Profiles > Groups, add a group or select an existing group that will be
using the VPN and edit that group with the following information.
•
•
•
3
For Connectivity, configure the idle timeout to 1 be minute and then click
OK.
For IPsec, select the network that was added in step 1 in the Split Tunnel
Networks box.
For IPsec, configure the CES to allow non-Contivity clients for the
appropriate group and then click OK.
From Profiles > Users, add a user or select an existing user from the group
that was edited in step 2 to use the VPN.
You must create the user as a “local user” in the LDAP database (internal or
external); you cannot use RADIUS authentication for this type of connection.
4
Edit the new or selected user with the following information:
•
Assign an address to the client user.
This address must be usable on Contivity’s private network, but there are
no restrictions in terms of whether the address is public, private, or even a
native part of Contivity’s private network. This address should be the
same as the Static address in the Instant Internet setup. Do not add a
subnet mask.
•
Assign a user ID and password.
The user ID and password must match the one given on the other end of
the tunnel.
5
Ensure that another router on Contivity’s private network has a static route for
the client address, with a destination of Contivity’s private address or use
proxy ARP.
Using the BayStack Instant Internet Management Software Version 7.11
194
Chapter 6 IP security and VPN
Configuring Instant Internet as an aggressive-mode VPN tunnel
To configure Instant Internet when your ISP provides you with a dynamic IP
address:
1
Start Setup, and if prompted, select a unit to configure.
2
In the main Setup window, click Add.
3
In the Select Connection Type dialog box, click IPsec.
4
In the Select Connection Device dialog box, click Contivity.
5
In the Contivity Extranet Switch dialog box, click No.
The IPsec Configuration dialog box opens (Figure 97).
Figure 97 IPsec Configuration dialog box
300868-G
6
Enter a name for the tunnel. This name is the “local user” you configured in
the CES.
7
Enter a key for the tunnel. The key is the password for local user configured
in CES.
8
Enter a destination. The destination is the public IP address of the CES.
9
Enter the static IP address that was assigned to the local user on Contivity.
Chapter 6 IP security and VPN
195
The static address is often the same as Instant Internet’s private LAN address,
but this is not necessary. If the address is not the same, Setup creates an alias
interface on Instant Internet and assign it the static address. This address is the
same as the Remote user that was set up in Contivity.
10 Click Add to enter the remote IP addresses allowed to participate in the
tunnel.
These addresses must match the networks set up in Contivity’s Profiles >
networks. For more information on adding IP addresses, refer to “Adding a
local or remote IP address” on page 172.
11 Click OK to close the IPsec Configuration dialog box.
The Enter Monitor / Control Connection Information dialog box opens
(Figure 98).
Figure 98 Enter Monitor / Control Connection Information dialog box
12 Choose whether you want to monitor or control the connection by clicking the
option.
For more information, refer to “Using Pings” on page 173.
13 Enter the IP address of any machine on the opposite end of the tunnel.
You might use the IP address of the main router at the home office.
14 Select the source interface of the connection being monitored or controlled.
Usually, it is best to accept the default interface that Instant Internet provides.
Using the BayStack Instant Internet Management Software Version 7.11
196
Chapter 6 IP security and VPN
15 Click OK.
16 In the main Setup window, click Save and Exit.
17 Click Yes to have the changes take effect immediately.
18 Click Yes to test the connection (optional).
The tunnel is configured. For more information on how to initiate a tunnel after it
has been configured, refer to “How a tunnel is initiated” on page 186.
Note: Setup also creates an alias interface.
Troubleshooting a VPN tunnel connection
If you have troubles establishing a VPN tunnel connection make sure to check
both ends of the tunnel to make sure that the tunnel configuration matches. Some
common areas that may cause problems include but are not limited to:
•
•
•
PFS settings
Default network settings
IP addresses
Instant Internet provides several methods for testing and troubleshooting IPsec:
•
•
Use the ipsec command to view a list of active tunnels. For details, refer to
Reference for the BayStack Instant Internet Remote Access Commands
Version 7.11.
View the Instant Internet unit’s IPsec log to refer to information on IPsec
negotiations. For details, refer to “Viewing a unit’s IPsec log” on page 197.
You can also use the ipsec log command to activate or deactivate this log.
For details, refer to Reference for the BayStack Instant Internet Remote Access
Commands Version 7.11.
•
Use the Instant Internet Monitor program to monitor and control the status
of individual tunnels. The interface list contains the IPsec tunnel names.
When you select an IPsec interface, Monitor displays the status. You can
bring the tunnel down using the line control button on the toolbar.
300868-G
Chapter 6 IP security and VPN
197
For details on using Monitor, refer to Chapter 3, “Internet activity logging,”
on page 93.
•
Use CES session statistics to view VPN connection information. For more
information, refer to your Contivity External Switch documentation.
You can diagnose most IPsec connectivity problems using a combination of
Instant Internet’s IPsec log and the CES Session Statistics of the CES.
Viewing a unit’s IPsec log
The IPsec log details low-level protocol information regarding IPsec negotiations
for a virtual private network (VPN) tunnel.
To view a unit’s IPsec log:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose View > Ipsec Log.
3
Review the file as needed.
To print the file, choose File > Print.
4
To close the file, choose File > Close.
IPsec connection state information
Table 21, Table 22, Table 23 and Table 24 display state information for an IPsec
connection available in the IPsec log.
An even-numbered state indicates that the remote gateway (CES) or Instant
Internet unit initiated the transaction. An odd-numbered state indicates that the
selected Instant Internet unit initiated the transaction.
Using the BayStack Instant Internet Management Software Version 7.11
198
Chapter 6 IP security and VPN
Table 21 Phase 1 main mode states
No.
Meaning
Reason
10
Waiting for Security Association.
•
•
•
Phase 1 did not receive main or
aggressive mode.
Instant Internet did not choose any
of the other end’s proposals.
Invalid aggressive mode user
name.
11
Sent Security Association, waiting for Security Association. The other end did not choose any of
Instant Internet’s proposals.
12
Sent Security Association, waiting for Key Exchange.
13
Sent Security Association, waiting for Key Exchange.
14
Sent Key Exchange, waiting for Identification.
The pre-shared keys did not agree.
15
Sent Key Exchange, waiting for Identification.
The pre-shared keys did not agree.
16
Phase 1 complete.
17
Phase 1 complete.
Table 22 Phase 1 aggressive mode states
No.
Meaning
Reason
21
Sent Security Association, waiting for Security Association. •
•
•
22
Sent Security Association, waiting for Hash.
23
Phase 1 complete.
24
Phase 1 complete.
25
Phase 1 received invalid hash.
300868-G
Remote unit did not accept
aggressive mode
Remote unit did not choose any of
Instant Internet’s proposals
Invalid user name.
Pre-shared keys did not agree
Pre-shared keys did not agree
Chapter 6 IP security and VPN
199
Table 23 Phase 2 main mode states
No.
Meaning
Reason
31
Waiting for phase 1 completion to initiate phase 2.
Phase 1 did not complete because of
error.
32
Waiting for Security Association, Inform, or Delete.
•
•
•
33
Sent Security Association, waiting for Security Association. •
•
•
•
34
Sent Security Association, waiting for Hash.
35
Phase 2 complete.
36
Phase 2 complete.
39
Received Delete.
Phase 2 did not receive quick mode
or inform mode.
Instant Internet did not choose any
of the other end’s proposals.
Their subnets did not agree without
local and remote configuration.
The other end did not choose any of
the Instant Internet proposals.
The Instant internet subnets did not
agree with the other end’s local and
remote configuration.
Perfect Forward Secrecy not
configured, other end requires it.
Perfect Forward Secrecy sent, not
received.
Table 24 Other state
No.
Meaning
Reason
99
Received error Notification.
The Instant Internet subnets did not
agree with the remote unit’s local and
remote configuration.
Using the BayStack Instant Internet Management Software Version 7.11
200
Chapter 6 IP security and VPN
300868-G
201
Chapter 7
Web cache configuration
This chapter introduces Web caching and describes how to administer the Instant
Internet unit’s Web cache.
Introduction to Web caching
When you configure the Instant Internet unit as a Web proxy server, it functions as
a proxy server for Web requests and a repository for Web content. When you use
the unit as a Web cache, you can:
•
•
•
Reduce access time and save bandwidth when you use cache content for
shared entries. For details, refer to “Increasing efficiency” on page 207.
Maintain corporate privacy and increase cache performance when you block
cookies. For details, refer to “Managing cookies” on page 223.
Reduce employee recreation on company time when you block access to
certain sites. For details, refer to “Managing Web site access” on page 228.
How the Instant Internet unit functions as a proxy server
When configured as a Web proxy server, the Instant Internet unit is a demand-side
downstream caching proxy server that helps reduce bandwidth consumption and
improve request and response times.
Depending on how you configure the Instant Internet unit, it can operate as a
network layer cache server or as a true proxy server. A network layer cache server,
often called a “transparent” cache server, operates by intercepting HTTP requests
transparently to the Web browser and effectively shortening the Web entry
retrieval process if the entry is in the cache.
Using the BayStack Instant Internet Management Software Version 7.11
202
Chapter 7 Web cache configuration
How the Instant Internet unit functions as a caching proxy
server
In its capacity as a downstream caching proxy server that stores copies of Internet
content (Web entries), the Instant Internet unit manages traffic to and from the
Internet. Web content requested from the Internet is cached in a common pool of
Web entries in the cache. When another user requests the same Web content, the
entry is sent from the cache rather than from the originating Web server. This
process improves response times and saves bandwidth.
As a proxy server, the Instant Internet unit functions as both a server and a client.
When connected to a remote server on the Internet, it functions as a client
requesting Web content. When a user requests Web content, the Instant Internet
unit delivers the request from the user to the Internet as if it is the client (user).
When accepting requests from users on your network, the Instant Internet unit
functions as a server and returns requested Web content from the Internet to the
user as if it was the originating Web server.
How Web caching works
Each time a user requests Web content and the originating Web server returns a
response to that request, the response is stored in the cache as an “entry.” An entry
is generated for every element of a requested Web page (including graphics, text
and interactive items). If a page containing 10 graphics is viewed by a user, 11
entries are cached—one for the page itself and one for each graphic.
Note: If a need arises to clear the Web cache, restart the unit. Carefully
consider the ramifications of this action before doing so.
How the Instant Internet unit expires entries
The Web entry originator can stamp the entry with an expiration date and time.
When an entry has an expiration date and time, the Instant Internet unit honors the
expiration stamp and expires the entry accordingly. If there is no expiration date
and time stamp, the Instant Internet unit calculates an internal expiration time
based on the cache level. For details, refer to “Predefined cache levels default
values” on page 213.
300868-G
Chapter 7 Web cache configuration
203
Before the Instant Internet unit sends requested Web content to the user, it
evaluates each Web entry and then does one of two things:
•
•
If the entry is not already in the cache, the cache server retrieves the entry
from the originating Web server, caches it, and then sends the entry to the
user.
If the entry is in the cache, the cache server evaluates the date and time of the
entry and then does one of the following:
— If the entry in the cache is still fresh, the cache server sends the entry in
the cache to the user.
— If the entry in the cache is expired, the cache server sends a conditional
request to the originating Web server. If the data on the server has
changed, it replaces the cached entry with the new entry from the
originating Web server, and then sends the new entry to the user.
How Web caching works with a user’s local cache
As a downstream caching proxy server, the Instant Internet unit is located between
a user’s workstation on the network and the Internet. If you disable the local cache
on a user’s Web browser, the Instant Internet unit is the user’s primary cache and
all requests for Web content go directly to the cache server. If you enable the local
cache, the cache server is a secondary cache. Requests for Web content are
directed first to the user’s local cache, and then to the Instant Internet unit.
Although using the Instant Internet unit as the only cache slightly increases traffic
on your local network, doing so provides several advantages. This setup:
•
•
•
Frees up hard disk space on each user’s workstation by eliminating the need to
reserve space for caching.
Increases the number of entries in the cache that are available to all users.
Increases cache statistics because all requests for Web content pass through
the Instant Internet unit which gives the truest measure of the efficiency of the
cache.
Using the BayStack Instant Internet Management Software Version 7.11
204
Chapter 7 Web cache configuration
•
Decreases the amount of inappropriate or unauthorized content on a user’s
workstation. When you block access to a Web site, a message appears
notifying the user that access has been blocked (refer to “Blocking Web site
access” on page 229). However, if the user’s local cache was enabled when
the user accessed the Web site the first time, the Web entries are still in the
local cache and the user can view them. If the user’s local cache was disabled
when the user accessed the site, the message is displayed immediately.
Connecting to the Instant Internet unit with a Web
browser
Using Netscape Navigator or Microsoft Internet Explorer, you can configure and
manage all Web proxy and caching functions for the Instant Internet unit.
Note: Web caching is supported only on Instant Internet 400 units
equipped with extended memory and Instant Internet 400-S units.
Before you can use a Web browser to manage Web cache options or configure
system files, you must enable the Instant Internet unit as a Web proxy and enable
Web configuration. You must also configure each workstation to use the Instant
Internet unit as the Web proxy server. For details, refer to “Configuring Instant
Internet as a Web proxy server” on page 116.
To connect to the Instant Internet unit:
1
In the Address or Location box of your Web browser, type the IP address of
the Instant Internet unit.
If the unit is password-protected, the Username and Password Required
dialog box opens. A user name is not required.
2
Enter the password for the unit.
The Home page opens (Figure 99).
300868-G
Chapter 7 Web cache configuration
205
Figure 99 Instant Internet Web home page
To browse to the Home page:
On any page, click Home.
Viewing the Instant Internet unit system status
On the Web Cache page (Figure 100), you can view a brief status of the cache
server, including whether caching is enabled, the current cache level, whether
active refresh is enabled, the hit rate, and proxy information.
From this page you have direct access to the following pages and information:
•
•
•
•
Web Cache Statistics (click Statistics). For more information on interpreting
statistics, refer to “Increasing efficiency” on page 207.
Web Sites (click Web Sites). For more information on managing Web sites,
refer to “Managing cookies” on page 223 and “Managing Web site access” on
page 228.
Web Cache Configuration (click Configure). For more information on
configuring the cache server, refer to “Increasing efficiency” on page 207.
System Administration (click Admin). The information on these Web pages is
used by technical support personnel for troubleshooting. Fore more
information on system administration, refer to “Viewing system files through
a Web browser” on page 306.
Using the BayStack Instant Internet Management Software Version 7.11
206
Chapter 7 Web cache configuration
To view the Web Cache page:
On the Home page, click Web Cache.
The Web Cache page opens (Figure 100).
Figure 100 Web Cache page
Getting started with the Web cache
The Instant Internet unit is easy to install and easy to use. In fact, after you
configure the Instant Internet unit as a Web proxy server, it immediately begins
caching Web entries. Cache statistics are available, but you do not have to monitor
the cache server or change settings unless you want to.
The Web cache is configured with some default settings that help you start
caching Web content and saving bandwidth immediately. However, if you want to
fine-tune the Instant Internet unit settings to take advantage of added features,
start with the following:
300868-G
Chapter 7 Web cache configuration
•
•
•
207
To increase cache performance and efficiency:
— Change the cache level from Moderate to Aggressive. For details, refer to
“Increasing efficiency” on page 207.
— Set how the Instant Internet unit responds to CGI, query, and ‘no-cache’
requests. For details, refer to “Setting options for special Web requests”
on page 219.
— Restrict Web servers from setting cookies on client workstations. Doing
so increases efficiency, but also helps you protect your corporate online
privacy. For details, refer to “Managing cookies” on page 223.
To reduce employee recreation on company time, restrict access to certain
Web sites. For details, refer to “Managing Web site access” on page 228.
To keep the most frequently requested Web entries fresh, enable the active
refresh option. For details, refer to “Refreshing cache entries” on page 234.
Increasing efficiency
Bandwidth is a measure of the capacity of a network connection or device to carry
data, in this case, your Internet connection. The amount of data that is transmitted
in a fixed amount of time depends on the bandwidth capacity of your connection.
The more efficiently you cache Web entries, the less bandwidth is required and the
lighter the network load.
The Instant Internet unit helps save bandwidth by caching frequently-requested
Web entries, thereby reducing traffic, decreasing the load on your Internet
connection, and improving response time to your users. For example, users
accessing the Internet through a 56K modem connection all share the total
bandwidth of 56 Kb/s. As more users log on to the Internet, the bandwidth
available to each user declines. The cache helps to save bandwidth by reducing
Internet traffic, and as a result, each user experiences faster response times.
The idea that your LAN bandwidth and your Internet connection bandwidth are
usually different is important as related to caching. Cache minimizes bandwidth
requirements of the server-side connection and improves efficiency by increasing
the number of requests that are serviced in the higher bandwidth portion of a
network.
Using the BayStack Instant Internet Management Software Version 7.11
208
Chapter 7 Web cache configuration
Fine-tuning cache settings
The Instant Internet unit is designed to save bandwidth and speed access times for
shared Web content. To get the best performance from the cache server, you can
fine-tune individual cache settings to meet the needs of your Internet users. If you
decide you want to fine-tune the Instant Internet unit’s cache settings, consider the
following.
Increasing response times
To ensure that users always experience the fastest response times for
frequently-requested Web entries, enable active refresh. This option attempts to
keep the most frequently requested Web entries available in the cache by
refreshing them from the Internet. For details, refer to “Refreshing cache entries”
on page 234.
Increasing bandwidth savings
You have several options for increasing efficiency and saving bandwidth. You
can:
•
•
•
•
300868-G
Change the cache level. The Instant Internet unit is shipped with three
predefined cache levels and an additional custom level that sets expiration and
certain special Web request options for the Instant Internet unit. The first thing
you can do to increase efficiency is change from the default Moderate cache
level to the Aggressive level. For details, refer to “Selecting a cache level” on
page 209.
Restrict Web servers from setting cookies on client workstations. Restricting
cookies enables the cache server to cache Web entries it may otherwise be
unable to cache. For details, refer to “Managing cookies” on page 223.
Restrict user access to certain Web sites. Frequent or recreational access to
unacceptable Web sites can fill up the cache and unnecessarily increase
bandwidth consumption. For details, refer to “Managing Web site access” on
page 228.
Review the cache statistics and make adjustments based on individual
statistics. Fine-tuning cache settings can increase bandwidth savings. For
details, refer to “Using statistics to fine-tune cache settings” on page 215.
Chapter 7 Web cache configuration
209
When you first install the Instant Internet unit, you should run it with the default
settings until the cache entries fill up to 100% (Cache entries % full statistic on the
Web Cache Statistics page) to establish a benchmark against which you can
measure future changes. After you review the statistics and understand the savings
you gained with the default settings, fine-tune the cache settings and begin your
experiments.
Note: Be sure to adjust only one or two settings at a time to make it
easier to measure the results of your changes.
Deciding how long to run an experiment
When you experiment with the available cache settings, you should let the cache
entries fill up to 100% after each adjustment. First, monitor how much time
elapses before the cache is filled with the current settings. Then, when you know
that length of time, run the experiment for twice that long to get meaningful data.
For example, if the cache fills up in 2 days, run your experiment for twice the
amount of time (4 days) to see the effects of your changes on the cache statistics.
Running the experiment for the same amount of time as it takes the cache to fill up
may not provide accurate statistics.
Note: To ensure that the statistics are accurate with your new settings,
reset the cache statistics before you begin each experiment. For details,
refer to “Resetting cache statistics” on page 222.
Selecting a cache level
The Instant Internet unit is shipped with three predefined cache levels—
Conservative, Moderate, and Aggressive—and an additional Custom level for
which you can define your own settings. Each cache level sets expiration options
that are applied to entries in the cache that do not have an expiration date and time
stamp.
Note: The Instant Internet unit always uses the actual expiration date and
time if the originator of a Web entry has set them for an entry.
Using the BayStack Instant Internet Management Software Version 7.11
210
Chapter 7 Web cache configuration
Changing the cache level is the first and easiest change you can make when you
want to increase bandwidth savings.
How cache levels are defined
Each predefined cache level sets:
•
•
•
Default settings for an expiration percent and minimum expiration time for
text and non-text entries.
Whether certain types of Web content requests (CGI, query, and “no-cache”)
are retrieved from the cache or from the originating Web server.
Whether the user receives a cached entry or a message when an error occurs.
Note: Text entries refer to text stored in ASCII code, such as, words,
sentences, and paragraphs. Non-text, or binary, entries refer to any entries
other than text, for example, graphics files, program code, or executable
files.
Expiration percent
The expiration percent specifies the percentage of the current date the Instant
Internet unit should use when calculating a text or non-text entry’s expiration.
When an entry stored in the cache has no expiration date and time stamp, the
Instant Internet unit calculates the expiration time based on the following formula:
% of (current date and time - entry’s last modified date and time)
Setting the percentage high allows for more cache usage at the risk that the cache
may return a stale or outdated entry. Setting the percentage low ensures that the
entry is more current at the risk of less cache usage.
The degree of staleness is not how long an entry has been in the cache, but how
long since the cached copy was synchronized with the originating Web server’s
copy. Only you can decide what degree of staleness is acceptable. A copy of one
of Shakespeare’s plays that is one year old is probably acceptable to most users,
but a stock quote that is ten minutes old might be worthless.
300868-G
Chapter 7 Web cache configuration
211
If you use the Aggressive level with a text expiration of 100%, the Instant Internet
unit subtracts the text entry’s last modified date and time (which is always
stamped on the entry) from the current date and time. If a request for that entry
comes within 100% of the time before the calculated expiration time, the cached
entry is sent to the user.
Example one
A user requests a Web page of Shakespeare’s sonnets called sonnets.html at noon
on 7/4/2000 that has a last modified date and time of 48 hours ago at noon on
7/2/2000. With the Aggressive text expiration set to 100%, the sonnets.html page
will expire 48 hours into the future at noon on 7/6/2000. In this case, the cached
entry is sent to the user.
Example two
The sonnets.html Web page that a user requested at noon on 7/4/2000 contains a
picture of William Shakespeare called bard.gif that has a last modified date and
time of 365 days ago at noon on 7/4/1999. With the Aggressive non-text
expiration set to 200%, the bard.gif file will expire 730 days into the future at
noon on 7/4/2002. In this case, the cached entry is sent to the user.
Minimum expiration time
The minimum expiration time (entered in minutes) specifies how the Instant
Internet unit extends the freshness time of a text or non-text entry after it is
downloaded and cached. You can set a minimum time extension so that regardless
of what the calculation is for the expiration percent, the Instant Internet unit uses
the following formula:
minimum expiration time = minimum number of minutes after an entry
expires before it is checked against the originating Web server
Set this value lower if users consistently request information that changes often,
for example stock quotes. Set it higher if users request information that does not
change often, for example, Shakespeare’s sonnets.
If the calculated time is less than the minimum value, the minimum value is used
(“Example one” on page 211). If the calculated time is more than the minimum
value, the calculated time is used (“Example two” on page 211).
Using the BayStack Instant Internet Management Software Version 7.11
212
Chapter 7 Web cache configuration
Example one
You request a Web page of stock quotes called quotes.html at noon on 7/4/2000.
The page contains a picture of the most-requested stock of the hour called
hotstock.gif that has a last modified date and time of five minutes ago at 11:55
AM on 7/4/2000. With the Aggressive non-text expiration set to 200%, the
hotstock.gif file should expire at 12:05 PM, but because the Aggressive non-text
minimum expiration time is set to 60 minutes, the calculated time (10 minutes) is
less than the minimum value (60 minutes), so the minimum value is used, and the
hotstock.gif file will expire at 1:00 PM. In this case, the cached entry is sent to the
user.
Example two
You request a Web page of stock quotes at noon on 7/4/2000. The Web page
calls a list of the previous day’s top eight most-requested stocks called
8stocks.html that has a last modified date and time of seven hours ago at 5:00 AM
on 7/4/2000. With the Aggressive text minimum expiration time set to 30 minutes,
the 8stocks.html page should expire at 5:30 AM. Because the Aggressive text
minimum expiration time is set to 200%, the calculated time (14 hours) is more
than the minimum value (30 minutes), so the calculated value is used and the
8stocks.html file will expire 14 hours into the future at 6:00 PM. In this case, the
cached entry is sent to the user.
Special Web requests
Special Web requests include CGI requests, query requests, and “no-cache”
requests. For details, refer to “Setting options for special Web requests” on
page 219.
Error message
You can select whether a user receives an error message or receives a cached entry
if the originating Web server sends an error. For details, refer to “Setting options
for special Web requests” on page 219.
300868-G
Chapter 7 Web cache configuration
213
Predefined cache levels default values
You can choose from the following predefined cache levels:
•
•
•
Conservative – This level reduces Internet traffic and decreases the possibility
of the cache returning stale information, but it also minimizes the
effectiveness of the cache. Select this option only if your users are having
problems receiving fresh data.
Moderate – This level extends entry expiration times to further reduce
Internet traffic and allows cached responses to CGI and query requests. This
is the system default.
Aggressive – This level further extends expiration times and allows cached
responses to CGI and query requests. This level provides the most bandwidth
savings.
Table 25 shows the default expiration settings for text and non-text entries and
request and response settings for each predefined cache level.
Table 25 Cache level default expiration settings for text and non-text entries
Conservative
Moderate
Aggressive
Text
Non-Text
Text
Non-Text
Text
Non-Text
Expiration Percent
10
20
20
40
100
200
Minimum Expiration
Time (in minutes)
5
10
10
20
30
60
CGI Requests
Disabled
Enabled
Enabled
Query Requests
Disabled
Enabled
Enabled
“No-Cache” Requests*
Disabled
Disabled
Disabled
Return Expired Cache
Entry on Server Error
Enabled
Enabled
Enabled
*”No-cache” requests are not enabled for any predefined cache level. If you want to enable “no-cache” requests, you
must create a Custom cache level.
Using the BayStack Instant Internet Management Software Version 7.11
214
Chapter 7 Web cache configuration
Creating a custom cache level
If one of the predefined cache levels does not meet your needs, you can create a
Custom cache level and enter your own expiration and custom Web content
request settings. Before you begin tuning these settings, be sure you understand
how they work.
Typically you will create a Custom level if you want to keep longer timeout values
(Moderate or Aggressive level), but want to disable CGI and query requests
(Conservative level).
When you create a Custom cache level, start with one of the predefined settings
and then fine-tune the individual settings you want (Table 25). For example, if the
Aggressive level expiration settings work for you, but you want to disable CGI
and query requests, select the Aggressive level and then disable those two options.
Note: If you enter 0 as the expiration percent, the entry is automatically
considered to be expired and the minimum expiration time is used. If you
set the minimum expiration time to 0, the calculated value is used.
To create a Custom cache level:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Configure.
The unit Configuration page opens.
3
In the unit Level area, click Customize.
The Custom Cache Level page opens.
4
Configure the Custom cache level options.
Click Help for more information about each field on any page.
300868-G
Chapter 7 Web cache configuration
215
Interpreting statistics
On the Web Cache Statistics page, you can view statistical information about the
Instant Internet unit’s Web cache. The data available on this page can help you
understand how your organization uses the cache. You can use these statistics to
assess the effectiveness of the Web cache and to fine-tune options to enjoy the
greatest bandwidth savings.
Note: Some of the statistics on the Web Cache Statistics page are for
your information only. You cannot fine-tune them. More information
about these fixed statistics is available on the Statistics Help page. This
chapter focuses on the statistics you can manipulate when you fine-tune
your cache settings.
To view Web cache statistics:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Statistics.
The Web Cache Statistics page opens.
Click Help for more information about each field on any page.
Using statistics to fine-tune cache settings
On the Web Cache Statistics page, you can view information on the response rate,
maximum and average entry size, entry expiration settings, entry request counts,
cache utilization, request and response settings, and why requests are not sent
from the cache.
Experiment with the various expiration options and monitor the Web Cache
Statistics page to determine the best settings for your organization’s Web usage.
Using the BayStack Instant Internet Management Software Version 7.11
216
Chapter 7 Web cache configuration
When you evaluate the cache statistics, consider the following:
•
Hit Rate Statistics – The hit rate displays the number of times the Instant
Internet unit returned information from the cache rather than a Web server.
Expect a hit rate of between 25% to 45%. A high percentage indicates that
information is being sent from the cache and the Instant Internet unit is
operating efficiently.
If the hit rate is lower, do any of the following:
•
— Move up one cache level, for example, from Moderate to Aggressive and
see if the change increases the hit rate.
— Review the statistics for “Why requests are not served from the cache”
and adjust the settings to increase the number of hits.
Single Hit Statistics – If the statistics for a single hit is high (the 1 request
statistic in the Cache entry request count area), the Web entries are being
requested only once which decreases the cache statistics. Web caching is most
effective when multiple users request the same Web content.
Typically, when the statistics for entries with a single hit are 70% or less, the
cache statistics are higher (40% to 50% hit ratio). If the statistics for single hit
entries are above 80%, the cache statistics are lower (20% to 30% hit ratio).
These statistics can vary depending on cache usage.
Viewing why requests are not sent from the cache
When a user requests Web content, the request passes through the cache and is
evaluated. The requested entries are sent from the cache whenever possible.
When a request is not fulfilled from the cache, it is typically because the entry has
expired. In this case, the request is fulfilled from the originating Web server.
In addition to expiring, there are other reasons that entries are not sent from the
cache. The Instant Internet unit tracks and records statistics about these entries
that are not sent from the cache. You can improve some of these statistics by
tuning the Instant Internet unit to enable certain types of special Web requests to
be sent from the cache.
To increase the number of entries sent from the cache, review the following
statistics for why requests are not sent from the cache and then fine-tune the cache
settings accordingly.
300868-G
Chapter 7 Web cache configuration
•
•
•
•
•
217
If the statistics show that requests are not returned from the cache because the
entry exceeded the maximum size, adjust the maximum entry size. For details,
refer to “Limiting the size of a cached entry” on page 217.
If the statistics show that requests are not returned because the request
contained a query, enable query results to be cached. You can enable this
option automatically when you set the cache level to Moderate or Aggressive
(refer to “Selecting a cache level” on page 209) or you can create a Custom
cache level and enable the option individually (refer to “Setting options for
special Web requests” on page 219).
If the statistics show that requests are not returned from the cache because
the request contained a CGI (Common Gateway Interface) request, enable
CGI requests to be cached. You can enable this option automatically when
you set the cache level to Moderate or Aggressive (refer to “Selecting a cache
level” on page 209) or you can create a Custom cache level and enable the
option individually (refer to “Setting options for special Web requests” on
page 219).
If the statistics show that requests are not returned from the cache because a
“no-cache” header was embedded in the request or the response, enable
“no-cache” responses to be cached. For details, refer to “Setting options for
special Web requests” on page 219.
If the statistics show that requests are not returned from the cache because
there were cookies in the response, restrict servers from setting cookies on
client workstations. For details, refer to “Managing cookies” on page 223.
Note: To determine the total percentage of requests that are not sent from
the cache but could be, total the numbers or percentages for the
aforementioned statistics. If the total percentage is over 10%, tuning these
settings could increase the hit rate.
Limiting the size of a cached entry
You can specify the maximum size of an entry that can be cached. Limiting the
size of an entry helps protect the cache from being filled up by extremely large
entries, for example, streaming data.
Using the BayStack Instant Internet Management Software Version 7.11
218
Chapter 7 Web cache configuration
You need to adjust the maximum size of a Web entry and then look at two
statistics to help determine the new value:
•
•
To determine whether you need to adjust the maximum size of a Web entry,
look at the statistic for “Data exceeded max size” in the “Why requests are not
served from the cache” area. If this number is high (over 10%), you should
probably increase the maximum entry size.
In the “Cache entries” area, look at the statistics for the “Average entry size.”
This statistic displays the average size of each entry stored in the cache. If the
average entry size is small, you can set the maximum size entry lower. If it is
large, set it higher.
To review the statistics:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Statistics.
The Web Cache Statistics page opens.
Click Help for more information about each field on any page.
To adjust the maximum entry size:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Configure.
The Web Cache Configuration page opens.
3
In the Web Cache Space Options area, enter the Maximum size entry to cache
(in kilobytes).
Click Help for more information about each field on any page.
300868-G
Chapter 7 Web cache configuration
219
Setting options for special Web requests
Special Web requests contain more than HTML-based Web content. These special
requests usually require user interaction or input and could contain private or
personalized information. The Instant Internet unit has several options for
maximizing Web content cacheability while minimizing the return of sensitive
information. There are three types of special Web requests: CGI, query, and
“no-cache” requests. Statistics are available on the Web Cache Statistics page to
help you decide whether to enable these requests.
CGI requests
A CGI (Common Gateway Interface) program is an application that runs on the
originating Web server and is designed to accept input from and return data to a
user. An example of this type of request is a request where you enter information
in a form and receive other information in return. You can select whether to
retrieve the same CGI requests from the cache or from the originating Web server.
If you select to retrieve the same CGI requests from the cache and two users use a
CGI program to request the same information from the same Web server and the
results are the same, the results are sent from the cache rather than the originating
Web server.
To determine whether you may need to enable CGI requests, look at the statistic
for “CGI request” in the “Why requests are not served from the cache” area. If this
number is high (over 10%), you should enable the option to retrieve CGI requests
from the cache. This option is enabled by default for the Moderate Aggressive
cache levels.
Query requests
You can select whether to retrieve the same query requests (for example, to a
search engine) from the cache or from the originating Web server.
For example, if you select to retrieve the same query requests from the cache and
two users perform a search for “Shakespeare’s sonnets” using the same search
engine and the results are the same, the results are sent from the cache rather than
the originating Web server.
Using the BayStack Instant Internet Management Software Version 7.11
220
Chapter 7 Web cache configuration
To determine whether you need to enable query requests, look at the statistic for
“Query request” in the “Why requests are not served from the cache” area. If this
number is high (over 10%), you should enable the option to retrieve query
requests from the cache. This option is enabled by default for the Moderate and
Aggressive cache levels.
Note: CGI and query requests are used to generate an answer based on
the input passed within the URL. The Instant Internet unit searches the
URL for an indication that the request may contain a CGI request or a
query request. For example, a dictionary Web site may receive a query
request that contains the word to be defined in the URL. In most cases,
the results of these types of requests are cached. However, if an
originating Web server uses CGI or query requests to generate a response
that contains a user’s private or personalized data, for example, a stock
portfolio, you may need to disable caching of these types of requests.
Note that when you disable CGI or query requests, you disable them for
all Web sites. If you do not want to do this, you can bypass caching of
the “problem” sites and continue to cache CGI and queries for all other
sites. For details on bypassing a Web site, refer to “Bypassing the cache
for a Web site” on page 231.
CGI and query requests are enabled for the Moderate and Aggressive
cache levels. If your users access Web sites that do not permit CGI and
query requests to be cached, but you do not want to use the Conservative
expiration settings, create a Custom cache level and disable CGI and
query requests. For details, refer to “Creating a custom cache level” on
page 214.
“No-cache” requests
A “no-cache” request is a request that forces an entry to be sent from the
originating Web server rather than the cache. “No-cache” requests can be initiated
in the entry by the originator or by the user who requests the entry. Some
originators explicitly place “no-cache” headers into their entries to discourage
caching. And some Web browsers insert a “no-cache” header in the request when
a user forces a request (pressing the Shift key while clicking the browser’s Reload
toolbar button).
300868-G
Chapter 7 Web cache configuration
221
For example, if you select to retrieve “no-cache” requests from the cache, when
a user forces a request, the request is not honored and is fulfilled from the cache.
To determine whether you need to enable “no-cache” requests, look at the statistic
for “‘no-cache’ request” in the “Why requests are not served from the cache” area.
When you enable the option to retrieve “no-cache” requests from the cache, you
increase the possibility of stale data. Nortel Networks recommends that you do
not enable this option.
Note: The option to retrieve “no-cache” requests from the cache is not
enabled for any predefined cache level. If you want to enable “no-cache”
requests, you must create a Custom cache level. For details, refer to
“Creating a custom cache level” on page 214.
To set options for special Web requests:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Configure.
The unit Configuration page opens.
3
In the Web Cache Level area, click Customize.
The Custom Cache Level page opens.
4
In the Request/Response Options area, configure the special Web request
settings.
Click Help for more information about each field on any page.
For details on setting a custom cache level, refer to “Creating a custom cache
level” on page 214.
Using the BayStack Instant Internet Management Software Version 7.11
222
Chapter 7 Web cache configuration
Setting the action the cache performs when a Web server
error occurs
Originating Web servers sometimes send errors to users. Typically, this happens
when a user requests Web content from an originating Web server that is down or
is not responding. In this situation, you can select one of two responses the Instant
Internet unit makes:
•
•
Send the Web entry it has stored in the cache if the Instant Internet unit fails to
connect to the originating Web server, even if the cache entry is expired.
Return the connection failure error message to the user.
To set the action the cache performs in response to an originating Web server
error:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Configure.
The unit Configuration page opens.
3
In the Web Cache Level area, click Customize.
The Custom Cache Level page opens.
4
In the Request/Response Options area, select or clear the Return expired
cache entry on server error check box.
Click Help for more information about each field on any page.
Resetting cache statistics
When you change configuration options, you may want to reset the statistics to
measure how the new configuration affects cache usage. Resetting statistics does
not delete cached entries; it clears past results so that the statistics reflect cache
usage with the current settings. To delete all entries in the cache, restart the Instant
Internet unit. For details, refer to “Restarting the Instant Internet unit” on
page 273.
300868-G
Chapter 7 Web cache configuration
223
To reset cache statistics:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Statistics.
The Web Cache Statistics page opens.
3
Click Reset Statistics.
When you reset cache statistics, all calculated values are reset to zero.
Managing cookies
Web sites can collect and store information about the users who browse their site
with a function known as a “cookie.” A cookie is information saved on your
computer’s hard drive that sends information back to the originating Web server
which uses that information to track your identity and browsing habits. Cookies
enable the Web site to personalize your browsing session according to your past
preferences, and generally make navigating the Web site or purchasing items
easier.
A Web site is said to be “serving cookies” if it places a cookie file on your
computer’s hard drive. When you browse through the site, the cookie is returned
with the information about your movements to the Web server. In this case, the
workstation is said to be “returning cookies.”
The way cookies are managed on your hard drive depends on the Web browser
you use. For example, Netscape Navigator uses a single cookie file (cookie.txt)
that is modified when a cookie is set. Microsoft Internet Explorer manages
individual cookie files in a directory.
Cookies cannot read anything from a computer’s hard drive and cannot perform
any functions that compromise a user’s computer. You can usually block cookies
to improve cache efficiency and privacy without affecting Web site access.
Using the BayStack Instant Internet Management Software Version 7.11
224
Chapter 7 Web cache configuration
Establishing a cookie management policy
Your cookie management policy will be the result of experimentation. Usually
you can view a Web site without having to return cookies, so you can block the
return of cookies and still cache the entry without affecting the data. But some
Web sites, for example, sites that use shopping carts or that allow you to manage
an investment account, require that clients return cookies to pass personal settings
or information. If a Web site requires cookies and you block cookies from that
site, the user may receive an error message indicating that cookies are required. In
this case, you can enable cookies only for that site.
Statistically, 20% to 25% of Web content contains cookies. When you block
cookies, the Instant Internet unit caches Web entries it may not ordinarily cache if
they contained cookies.
To take full advantage of the Instant Internet unit, Nortel Networks recommends
that you block all cookies for all unconfigured Web sites and permit cookies only
for individual Web sites that require them.
Note: In this manual, the term “unconfigured Web site” is used to refer to
any Web site that is accessed for the first time through the Instant Internet
unit as well as any Web site that does not have site-specific settings. The
term “configured Web site” refers to any Web site that has site-specific
settings configured on its cache settings page.
For example, if you cache entries from www.abcnews.com, and then set
the default Web site option to block cookies for all Web servers, the
Instant Internet unit no longer accepts cookies from www.abcnews.com
because it is an unconfigured Web site that complies with the default Web
site options. However, if you set the site-specific option for
www.abcnews.com to allow the Web server to set cookies, it is a
configured Web site. Setting the default Web site option to block cookies
to all servers has no effect on www.abcnews.com; you can still view
entries with cookies for that site.
300868-G
Chapter 7 Web cache configuration
225
If a Web site requires cookies, but they are blocked, any of the following may
occur:
•
•
•
•
The originating Web server returns a message indicating that cookies are
required.
When a Web site requires a user ID and password, the Web site prompts the
user to sign on again after the user signs on the first time.
When a Web site offers online shopping, the user adds an item to an order, but
does not see the item in the shopping cart.
A user’s personalized settings for a Web site are not remembered on
subsequent visits to the site.
Establishing a policy to block cookies for all unconfigured Web sites provides two
benefits:
•
•
Allows more entries to be cached. By default, the Instant Internet unit does
not cache text requests that contain cookies.
Protects your organization’s online privacy by preventing cookies from being
set and returned to anonymous Web servers.
Managing cookies for all unconfigured Web sites
You can restrict unconfigured Web sites from setting cookies on client
workstations as well as restrict clients from returning cookies to unconfigured
Web sites. All new and previously unconfigured Web sites accessed through the
Instant Internet unit will use these default settings.
To block cookies for all unconfigured Web sites:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Web Sites.
The Web Sites page opens.
3
Click Default Options.
The Default Web Site Options page opens.
Using the BayStack Instant Internet Management Software Version 7.11
226
Chapter 7 Web cache configuration
4
In the Options For All (unconfigured) Web Sites area, configure the settings.
Click Help for more information about each field on any page.
Managing cookies for a particular Web site
After you determine that the user does need access to the Web site, you must
first determine which Web site requires cookies and then enable cookies for that
Web site.
When a user has trouble accessing a particular Web site because cookies are
required, you must first determine which site requires cookies. The most efficient
way to do this is to sort the Web site list by most recent access (refer to “Sorting
the Web sites list” on page 227) and look for Web servers that are serving cookies
and have a Web site name related to the problem site.
Sorting by most recent access is helpful because the actual Web site serving
cookies is often not the Web site name. For example, a user trying to access the
Web site www.abcnews.com may receive a message that cookies are required,
but the actual site that requires the cookie may be www.my.myabc.com.
When you identify the site, click the site name in the list to configure site-specific
options for that Web site to enable cookies (refer to “Enabling cookies for a
particular Web site” on page 226) and then have the user try to access the Web site
again. If the user is still unable to access the site, you may need to bypass the
cache for that Web site. For details, refer to “Bypassing the cache for a Web site”
on page 231.
Enabling cookies for a particular Web site
If you block cookies for all unconfigured Web sites, you can later enable a
particular Web site to set cookies on client workstations and enable clients to
return cookies to the site.
300868-G
Chapter 7 Web cache configuration
227
To enable cookies for a particular Web site:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Web Sites.
The Web Sites page opens.
3
Click the IP address or host name for the individual Web site.
The individual Web site’s access information and settings page opens.
4
In the Site Specific Options area, do any of the following:
•
•
To enable the Web site to set cookies on client workstations, select the
Allow this server to set cookies in clients check box.
To enable clients to return cookies to the Web site, select the Allow clients
to return cookies to this server check box.
Click Help for more information about each field on any page.
Sorting the Web sites list
On the Web Sites page, you can view a list of all recently requested Web sites.
Each record displays the IP address or host name of the requested site, the date
and time of its most recent access, and the number of times an entry has been
requested from the Web site. You can sort the list by name, access time, and
number of requests.
The Instant Internet unit records the IP address or host name of each requested
Web site. Each time a user requests Web content and the originating Web server
returns a response to that request, the response is stored in the cache as a Web
entry. If an entry exists in the cache, its associated IP address or host name appears
in the Web sites list. The fact that a Web site is in the list does not necessarily
mean it has Web entries in the cache. All configured Web sites are maintained in
the list of Web sites indefinitely. However, unconfigured Web sites can expire
from the list through attrition.
Note: When you bypass a site, Web entries from that site are not cached.
However, the Web site is in the list of Web sites because it is a configured
Web site.
Using the BayStack Instant Internet Management Software Version 7.11
228
Chapter 7 Web cache configuration
Tracking active Web entries is especially useful if there is a problem with a
particular site. For example, if cookies are turned off and the site requires cookies,
you have a record of the request. The most efficient way to determine which site
requires cookies is to sort the Web site list by most recent access and look for Web
servers that are serving cookies and have a Web site name related to the problem
site. Click the entry to view the cache settings page for the Web site, and then
enable cookies for that site.
Note: Be aware that often the site that you cannot access is not the site
that is serving cookies. Because there may be links to other sites for
personalized information, the cookie could be coming from a seemingly
unrelated site.
To view the Web sites list:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Web Sites.
The Web Sites page opens.
Click Help for more information about each field on any page.
Managing Web site access
Establishing a Web site access policy helps you determine how to configure Web
sites. Your Web site access policy will be the result of experimentation. When you
establish your policy, consider the following:
•
•
300868-G
If you block access to all unconfigured Web sites, users will not have access
to any Web site on the Internet and you must permit access to each site
individually. For details, refer to “Blocking access to all unconfigured Web
sites” on page 229.
If you permit access to all unconfigured Web sites, users have access to any
and all Web sites on the Internet and you must block access to inappropriate or
unauthorized Web sites individually. For details, refer to “Blocking access to a
particular Web site” on page 230.
Chapter 7 Web cache configuration
229
Blocking Web site access
You can block access to particular Web sites on an individual basis or for all
unconfigured Web sites (for a definition of “unconfigured Web site,” refer to the
note on page 224).
When a user requests access to the restricted Web server, the following message is
displayed indicating that access is denied:
“Access to this Web site has been blocked. Contact your system administrator for
more information.”
Note: After you block a Web site, that site’s entries are no longer sent
from the Instant Internet unit. However, if a user has the local cache
enabled, the content requested from the blocked site may still be in the
local cache and may be displayed. Eventually the Web entries in the
local cache will expire. For more information on a user’s local cache,
refer to “How Web caching works with a user’s local cache” on
page 203.
Blocking access to all unconfigured Web sites
When you block access to all unconfigured Web sites, you restrict access to all
new and previously unconfigured Web sites accessed through the Instant Internet
unit.
To block access to all unconfigured Web sites:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Web Sites.
The Web Sites page opens.
3
Click Default Options.
The Default Web Site Options page opens.
Using the BayStack Instant Internet Management Software Version 7.11
230
Chapter 7 Web cache configuration
4
In the Options For All (unconfigured) Web Sites area, select the Block access
to server check box.
Click Help for more information about each field on any page.
Blocking access to a particular Web site
To block access to a particular Web site, it must be in the list of Web sites. If the
Web site to which you want to block access is not in the list, you must first browse
to that Web site.
To block access to a particular Web site:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Web Sites.
The Web Sites page opens.
3
Click the IP address or host name for the individual Web site.
The cache settings page for the individual Web site opens.
4
In the Site Specific Options area, select the Block access to this server check
box.
Click Help for more information about each field on any page.
Setting Web site activity display options
On the Web Sites page, you can view activity details for each Web site, including:
•
•
•
•
•
300868-G
Whether a Web site is serving cookies and if clients are returning them.
Whether access to a site is restricted.
Whether the cache has been bypassed for a site.
The date and time of the most recent access to the Web site.
The number of times an entry has been requested from the Web site.
Chapter 7 Web cache configuration
231
Configuring Web site display options
On the Default Web Site Options page, you can choose not to view the access
activity details on the Web sites list.
You can also specify the number of Web site records that are displayed on a single
page of Web sites. The default is 10, the minimum is 1, and the maximum is 100.
If more than the specified number of records is available, click Next or Prev to
advance to the next or previous page of the Web sites list.
To set the Web site access activity detail option:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Web Sites.
The Web Sites page opens.
3
Click Default Options.
The Default Web Sites Option page opens.
4
In the Display Options area, do any of the following:
•
•
Select or clear the Display most recent access and activity notices for each
site check box.
Enter the Number of entries to display per page.
Click Help for more information about each field on any page.
Bypassing the cache for a Web site
Occasionally, you may need to bypass the cache altogether for a particular Web
site. For example, some sites require special authentication, send Web content
obtained from a secure server, or use a non-standard protocol. In this case, making
adjustments to the site’s individual cache settings may not correct the problem.
You may need to bypass the cache for that site.
Using the BayStack Instant Internet Management Software Version 7.11
232
Chapter 7 Web cache configuration
The reasons why you would bypass the cache are very similar to the reasons why
you need to enable cookies. The reasons are:
•
•
When a Web site requires a user ID and password, the Web site prompts the
user to sign on again after the user signs on the first time or the initial login
fails.
When a Web site offers online shopping, the user adds an item to an order, but
does not see it in their shopping cart.
For example, when a user cannot access a particular Web site because the site uses
a non-standard protocol, you must first determine which site is the problem site.
As in the case of Web sites that require cookies, the most efficient way to do this is
to sort the Web site list by most recent access (refer to “Sorting the Web sites list”
on page 227) and look for Web servers that have site names related to the problem
site.
Note: When you bypass the cache for a particular Web site, no Web
entries are cached for that site which can affect the cache statistics.
Before you bypass the cache, be sure to eliminate the possibility that the
site requires cookies or that there is a problem with the originating Web
server.
To bypass the cache for a particular Web site:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Web Sites.
The Web Sites page opens.
3
Click the IP address or host name for the individual Web site.
The cache settings page for the individual Web site opens.
4
In the Site Specific Options area, select the Bypass the Web Proxy/Cache
when accessing this server check box.
Click Help for more information about each field on any page.
300868-G
Chapter 7 Web cache configuration
233
Saving and Restoring Web site configuration
Instant Internet provides you with a way to save and restore your Web site
configuration. This tool is useful when you need to return the unit for repair.
However, the tool is also useful for sharing cookie lists with other Instant Internet
users.
To save a Web site configuration:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Web Sites.
3
Click Backup.
4
In the Filename box, enter a name for the file that you can easily remember or
associate with this file.
5
Click Save
The Save As dialog box opens
6
Navigate to the place on your local machine where you would like to save the
Web site configuration file.
7
Click Save.
To restore a Web site configuration:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Web Sites.
3
Click Restore.
4
Click Browse and locate the .wcb file that was previously saved.
5
Select the .wcb file.
6
Click Open.
7
Click Submit.
Web site configurations may be restored to any computer that uses the Web cache
feature Instant Internet provides.
Using the BayStack Instant Internet Management Software Version 7.11
234
Chapter 7 Web cache configuration
Refreshing cache entries
To increase response times for Web entries, enable active refresh. This option
attempts to keep the most frequently requested Web entries available in the cache
by refreshing them from the Internet. Rather than wait for a request for Web
content, the Instant Internet unit actively evaluates the entries in the cache, tests
them, and reloads them if necessary before they expire.
Actively refreshing Web entries helps to save bandwidth overall, but creates a
slight increase in bandwidth because the cache server functions as another user
requesting Web content.
Setting active refresh options
Nortel Networks recommends that you set active refresh to operate during your
company’s normal business hours. For example, if your company’s business hours
are Monday through Friday, from 8 AM to 5 PM, select each week day and set the
start time to 8:00 AM and the duration to 9 hours and 00 minutes. The same time
is used for each selected day.
Note: Disable active refresh or limit its use if you pay Internet access
fees based on usage time.
To enable active refresh and set refresh options:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Configure.
The Web Cache Configuration page opens.
3
In the Active Refresh area, click Options.
The Active Refresh Options page opens.
4
Select the Enable Active Refresh check box and then configure active refresh
settings.
Click Help for more information about each field on any page.
300868-G
Chapter 7 Web cache configuration
235
Interpreting active refresh statistics
The active refresh statistics display the number of Web entries the cache server
actively retrieved from originating Web servers so that the entries were available
in the cache when a user requested them. The percent displays the percentage of
active refresh entries that have been accessed by users since the entries were
refreshed. Users would have to wait to retrieve the entries if active refresh is
disabled.
Expect a hit rate of between 40% to 60%, but the percentage will vary based on
usage. A high percentage indicates that users are requesting actively refreshed
entries. A lower percentage (10% to 15%) indicates that active refresh is not
providing much of a benefit and you may want to disable this option to save
bandwidth.
To view active refresh statistics:
1
On the Home page, click Web Cache.
The Web Cache page opens.
2
On the Web Cache page, click Statistics
The Web Cache Statistics page opens.
3
View the statistics in the Active Refresh area.
Click Help for more information about each field on the page.
Troubleshooting the Web cache
Following are some common problems you may encounter when using the Instant
Internet unit as a Web proxy and what you can do to resolve them.
Using the BayStack Instant Internet Management Software Version 7.11
236
Chapter 7 Web cache configuration
I requested a Web site, but there was no response.
Problem: The Web site requires cookies, and cookies are blocked.
Solution: Enable cookies for the problem Web site. For details, refer to
“Managing cookies for a particular Web site” on page 226.
Problem: The Web site uses a protocol that is not compatible with proxy servers.
Solution: Bypass the cache for the problem Web site. For details, refer to
“Bypassing the cache for a Web site” on page 231.
Problem: The originating Web server could be down or not responding.
Solution: Send a request to the Web site again later.
Problem: The Instant Internet unit is unable to communicate with the particular
Web Server.
Solution: Bypass the cache for the problem Web site. For details, refer to
“Bypassing the cache for a Web site” on page 231. If bypassing the cache does not
solve the problem, the originating Web server may be down or is not responding.
(Be sure to reenable the cache for the problem Web site.)
I blocked a site, but it still opens in a user’s Web browser.
Problem: The user may have the local cache enabled on the user’s workstation
and the content requested from the blocked site may still be in the local cache and
is being displayed. For more information on the local cache, refer to “How Web
caching works with a user’s local cache” on page 203.
Solution 1: Purge the user’s local cache. For details, refer to your Web browser’s
documentation.
I requested a Web page, but the content looks outdated.
Problem: The Web content is being retrieved from the user’s local cache and is
stale. For more information on the local cache, refer to “How Web caching works
with a user’s local cache” on page 203.
300868-G
Chapter 7 Web cache configuration
237
Solution 1: Purge the user’s local cache. For details, refer to your Web browser’s
documentation.
Solution 2: Force the Web entries to bypass the cache. In Netscape Navigator
press the [Shift] key while clicking the Reload toolbar button.
Problem: The expiration settings for the cache level are set too aggressively.
Solution 1: Force the Web entries to bypass the cache. In Netscape Navigator
press the [Shift] key while clicking the Reload toolbar button.
Solution 2: Change the cache level. For details, refer to “Selecting a cache level”
on page 209.
Problem: The Web server is down or is not responding and the Instant Internet
unit is configured to return expired Web entries when a Web server error occurs.
Solution: Create a custom cache level and disable the option to return expired
Web entries when a Web server error occurs. For details, refer to “Creating a
custom cache level” on page 214 and “Setting the action the cache performs when
a Web server error occurs” on page 222.
I requested a Web page and the originating Web server
takes a long time to respond.
Problem: The Web server is down or is not responding and the Instant Internet
unit is configured to return expired Web entries on a server error.
Solution: Create a custom cache level and disable the option to return expired
Web entries on a server error. For details, refer to “Selecting a cache level” on
page 209.
Problem: The Internet is slow, your Internet Service Provider has a bottleneck, or
the originating Web server is down.
Solution: Send a request to the Web site again later.
Using the BayStack Instant Internet Management Software Version 7.11
238
Chapter 7 Web cache configuration
I am not able to configure a personalized Web page.
Problem: The Web site requires cookies and cookies are blocked.
Solution: Enable cookies for the problem Web site. For details, refer to
“Managing cookies for a particular Web site” on page 226.
Problem: The cache server is incompatible with the originating Web server.
Solution: Bypass the cache for the problem Web site. For details, refer to
“Bypassing the cache for a Web site” on page 231.
I logged on to a Web site, but I am prompted to log on
again.
Problem: The Web site requires cookies and cookies are blocked.
Solution: Enable cookies for the problem Web site. For details, refer to
“Managing cookies for a particular Web site” on page 226.
Problem: The cache server is incompatible with the originating Web server.
Solution: Bypass the cache for the problem Web site. For details, refer to
“Bypassing the cache for a Web site” on page 231.
I added an item to my online shopping cart, but it’s still
empty.
Problem: The Web site requires cookies, and cookies are blocked.
Solution: Enable cookies for the problem Web site. For details, refer to
“Managing cookies for a particular Web site” on page 226.
Problem: The cache server is incompatible with the originating Web server.
Solution: Bypass the cache for the problem Web site. For details, refer to
“Bypassing the cache for a Web site” on page 231.
300868-G
239
Chapter 8
Advanced communications configuration
This chapter describes how to configure advanced communication settings for a
dial-up, ISDN, T1, E1, or PPPoE connection. Both the T1 and E1 interfaces allow
you to configure a backup ISDN connection to the internet in case your primary
connection fails.
Configuring advanced communication settings for an
ISDN connection
If you have an ISDN interface on the Instant Internet unit, you can configure a
backup connection phone number, bandwidth on demand settings, inbound voice
and outbound priority (100-S and 400-S units only), and the inactivity timeout.
You configure these settings through the ISDN Configuration dialog box.
To open the ISDN Configuration dialog box:
1
Start Setup, and if prompted, select a unit to configure.
2
In the Interfaces area, select the ISDN interface and then click Configure.
The ISDN Configuration dialog box opens (Figure 101).
Using the BayStack Instant Internet Management Software Version 7.11
240
Chapter 8 Advanced communications configuration
Figure 101 ISDN Configuration dialog box
If you have an ISDN connection, and your interface is disabled by an ISP that uses
multiple devices on the same phone number but does not support Multilink across
the devices, select the Do not disable second channel on PPP negotiation failure
check box.
Adding a backup phone number
Instant Internet dials the primary phone number first after each successful
connection. However, for those times when the primary ISDN phone number is
busy or fails, you can designate a backup phone number. When Instant Internet
detects a busy signal or problem in dialing the main phone number, it
automatically dials the backup phone number to make a connection.
300868-G
Chapter 8 Advanced communications configuration
241
To add or change a backup phone number for an ISDN connection:
1
In the Backup box, enter the backup phone number.
If your second channel (B channel) dials a different phone number, you can
enter a secondary phone number. Use a slash (/) to separate the two numbers.
If the exchange (first three digits) is the same for both numbers, you may enter
only the last digits of the secondary phone number.
Example: 555-1212/555-1213 or 555-1212/1213.
2
Click OK.
Setting the inactivity timeout
The inactivity timeout saves connect-time charges during times when no one is
requesting Internet access. It specifies the number of minutes or seconds of
inactivity over the ISDN connection after which Instant Internet terminates the
connection. When you need access again, Instant Internet automatically
reestablishes a connection within a few seconds.
To configure the inactivity timeout for an ISDN connection:
1
In the Inactivity timeout box, enter the new setting.
If you have a dedicated ISDN connection, enter 0.
2
Click OK.
Configuring advanced ISDN features
You can configure the following advanced settings for an ISDN connection:
•
•
•
Bandwidth on demand
Inbound voice and outbound priority (Instant Internet 100-S and Instant
Internet 400-S units only)
Incoming call settings
Using the BayStack Instant Internet Management Software Version 7.11
242
Chapter 8 Advanced communications configuration
To configure advanced ISDN features:
1
Click Advanced.
The ISDN Configuration (advanced) dialog box opens. This dialog box
differs depending on the type of hardware that you have. Figure 102 is for the
Instant Internet 100-S and Instant Internet 400-S units and Figure 103 is for
the Instant Internet 100 and Instant Internet 400 units.
Figure 102 ISDN Configuration (advanced) dialog box for the 100-S and 400-S
units
300868-G
Chapter 8 Advanced communications configuration
243
Figure 103 ISDN Configuration (advanced) dialog box for the 100 and 400 units
Enabling bandwidth on demand
You can set the dial and hang-up thresholds and the demand timeout for the ISDN
interface.
To enable bandwidth on demand:
1
Click Advanced.
The ISDN Configuration (advanced) dialog box opens. Refer to Figure 102 or
Figure 103 depending on your hardware.
2
Select the Dial on demand check box.
3
Change any of the following information:
•
•
•
4
Dial threshold – Enter the percentage of bandwidth that must be in use
before an additional interface can dial.
Hangup threshold – Enter the percentage of bandwidth below which an
interface hangs up.
Timeout – The number of minutes with no traffic before the additional
interface hangs up. A value of zero prevents the interface from timing out.
Click OK.
Using the BayStack Instant Internet Management Software Version 7.11
244
Chapter 8 Advanced communications configuration
Configuring voice call options
If you have an Instant Internet 100-S or 400-S unit, you can set the way the ISDN
interface handles incoming and outgoing ISDN voice calls.
To configure voice call options:
1
Click Advanced.
The ISDN Configuration (advanced) dialog box opens (Figure 102).
2
In the Outbound priority area, select one of the following:
•
•
3
Data – Specifies that data gets first priority for control of the line when
you are attempting a voice call. If you try to make a voice call and all
channels are busy, you hear a busy signal.
POTS – Specifies that voice gets first priority for control of the line when
you are making a voice call. If you make a voice call and all channels are
busy, one of the data channels is dropped to allow the voice call to
continue.
In the Inbound Voice area, select one of the following:
•
•
POTS – Specifies that an inbound call marked as voice is sent to the
telephone line.
DOVBS – Specifies that an inbound call marked as voice is sent to the B
channel of the ISDN line. The inbound call is treated as a data call and
then the incoming call option in the following section applies.
Configuring incoming data call options
You can set the way the ISDN interface handles incoming ISDN data calls.
To configure the incoming data call option:
1
Click Advanced.
The ISDN Configuration (advanced) dialog box opens. Refer to Figure 102 or
Figure 103 depending on your hardware.
300868-G
Chapter 8 Advanced communications configuration
2
In the Incoming Calls area, select one of the following.
•
•
•
•
•
3
245
No incoming calls allowed – The Instant Internet unit rejects all
incoming calls. This is the system default.
Call ISP after receiving incoming call – When the Instant Internet unit
detects an incoming call, it rejects the call and then initiates a call to the
ISP. The Instant Internet unit essentially interprets the incoming call as a
request to bring up the line. Select this option if your ISDN line is
configured to disconnect after a period of inactivity, but you need to allow
traffic from the Internet to establish a connection. This option may require
additional arrangements with your ISP.
Allow incoming calls – The Instant Internet unit answers all incoming
calls and places calls as necessary. For the Instant Internet unit to answer
the call, the remote site must supply the same user ID and password you
entered when you configured the ISDN connection. If you select this
option, enter the local phone numbers for the two B channels.
Call ISP, disconnect, wait for call back – Instant Internet initiates a call
to your ISP. When the ISP answers the call it validates your account,
disconnects, and then calls the Instant Internet unit. Select this option if
you are charged by the minute for placing calls, but your ISP is not. This
option may not be available in all areas and will require additional
arrangements with your ISP. If you select this option, enter the local
phone numbers for the two B channels.
Only incoming calls (no outgoing) – Instant Internet answers all
incoming calls but does not place any calls. For the Instant Internet unit to
answer the call, the remote site must supply the same user ID and
password you entered when you configured the ISDN connection. If you
select this option, enter the local phone numbers for the two B channels.
Click OK.
Configuring advanced communication settings for a
dial-up connection
If you have an analog or dual-analog modem interface on the Instant Internet unit,
you can configure a backup connection phone number, bandwidth on demand
settings, the inactivity timeout, and modem speaker settings. You configure these
settings through the Dialup Configuration dialog box.
Using the BayStack Instant Internet Management Software Version 7.11
246
Chapter 8 Advanced communications configuration
To open the Dialup Configuration dialog box:
1
Start Setup, and if prompted, select a unit to configure.
2
In the Interfaces area, select the dial-up interface and then click Configure.
The Dialup Configuration dialog box opens (Figure 104).
Figure 104 Dialup Configuration dialog box
Adding a backup phone number
Instant Internet dials the primary phone number first after each successful
connection. However, for those times when the primary dial-up phone number is
busy or fails, you can designate a backup phone number. When Instant Internet
detects a busy signal or problem in dialing the main phone number, it
automatically dials the backup phone number to make a connection.
To add or change a backup phone number for a dial-up connection:
In the Backup box, enter the backup phone number and then click OK.
300868-G
Chapter 8 Advanced communications configuration
247
Setting the inactivity timeout
The inactivity timeout saves connect-time charges during times when no one is
requesting Internet access. It specifies the number of minutes or seconds of
inactivity over the dial-up connection after which Instant Internet terminates the
connection. When you need access again, Instant Internet automatically
reestablishes a connection within a few seconds.
To configure the inactivity timeout for a dial-up connection:
In the Inactivity timeout box, enter the new setting and then click OK.
Enabling bandwidth on demand
If you have a dual-analog modem configuration, you can set the dial and hang-up
thresholds and the demand timeout for the dial-up connection.
To configure bandwidth on demand:
1
Click Advanced.
The Dialup Configuration (advanced) dialog box opens (Figure 105).
Figure 105 Dialup Configuration (advanced) dialog box
2
Select the Dial on demand check box.
Using the BayStack Instant Internet Management Software Version 7.11
248
Chapter 8 Advanced communications configuration
3
Make any changes to the following information:
•
•
•
4
Dial threshold – Enter the percentage of bandwidth that must be in use
before an additional interface can dial.
Hangup threshold – Enter the percentage of bandwidth below which an
interface hangs up.
Timeout – The number of minutes with no traffic before the interface
hangs up. A value of zero prevents the interface from timing out.
Click OK.
Configuring the modem speaker
To configure the modem speaker:
1
Click Advanced.
The Dialup Configuration (advanced) dialog box opens (Figure 106).
Figure 106 Dialup Configuration (advanced) dialog box
Note: If you have a dual-analog interface, the Dialup Configuration
(advanced) dialog box looks like the dialog box in Figure 105.
300868-G
2
Set the Modem Speaker to On or Off.
3
Set the Speaker Volume.
4
Click OK.
Chapter 8 Advanced communications configuration
249
Setting the number of lines
If you have a dual-analog modem configuration, you can select the number of
lines that the Instant Internet unit uses to dial out.
To select the number of lines:
In the Number of lines box, select the number of lines and then click OK.
Configuring advanced communication settings for a T1
connection
If you have T1 interface on the Instant Internet unit, you can configure the starting
channel, line style, clock, auto-loopback settings. and a backup interface.
To configure advanced communication settings for a T1 interface:
1
Start Setup, and if prompted, select a unit to configure.
2
In the Interfaces area, select the T1 interface and then click Configure.
The T1 Configuration dialog box opens (Figure 107).
Using the BayStack Instant Internet Management Software Version 7.11
250
Chapter 8 Advanced communications configuration
Figure 107 T1 Configuration dialog box
3
Click Advanced.
The T1 Advanced Configuration dialog box opens (Figure 108).
Figure 108 T1 Advanced Configuration dialog box
300868-G
Chapter 8 Advanced communications configuration
4
251
Configure any of the following:
•
•
•
•
•
•
Starting Channel – A T1 line has 24 channels (1to 24). When you order
a fractional T1 service, only part of the channels are available for data
transmission. In some cases the Instant Internet unit may need to send
data on a block of channels that do not start on Channel 1, so you must
change the starting channel.
Channels are – Depending on what your T1 service provider assigns you,
you will select Consecutive (every one) or Alternating (every other one).
In some rare cases, you may have a block of channels available but may
be able to send data only on every other channel. In this case, select
alternating.
Line style – The T1 bandwidth is used to carry T1 performance data and
commands, such as loopback. This data may follow one of two standards:
ANSI T1.403 or AT&T 54016. This value should be supplied by your T1
service provider. If this value is set incorrectly, the performance data may
not be available and a loopback request may not be recognized.
Clock – If the network provides the clock for the T1 line, select External.
If the Instant Internet unit provides the clock, select Internal. In almost all
cases, the network provides the clock.
Auto loopback – Auto loopback is used for diagnostics and allows the
network to force the Instant Internet unit into loopback. Leave this check
box selected unless directed otherwise by a technical support
representative.
Backup interface – If you have an Instant Internet 400-S unit, an ISDN
connection is available for use as a backup connection to the Internet
should your T1 connection become unavailable.
Configuring advanced communication settings for an E1
connection
If you have E1 interface on the Instant Internet unit, you can configure the starting
channel, line style, clock, auto-loopback setting, and a backup interface.
To configure advanced communication settings for an E1 interface:
1
Start Setup, and if prompted, select a unit to configure.
Using the BayStack Instant Internet Management Software Version 7.11
252
Chapter 8 Advanced communications configuration
2
In the Interfaces area, select the E1 interface and then click Configure.
The E1 Configuration dialog box opens (Figure 109).
Figure 109 E1 Configuration dialog box
3
Click Advanced.
The E1 Advanced Configuration dialog box opens (Figure 110).
Figure 110 E1 Advanced Configuration dialog box
300868-G
Chapter 8 Advanced communications configuration
4
253
Configure any of the following:
•
•
•
•
•
•
•
•
Starting Channel – An E1 line has 32 channels (1 to 32). When you
order a fractional E1 service, only part of the channels are available for
data transmission. In some cases the Instant Internet unit may need to
send data on a block of channels that do not start on Channel 1, so you
must change the starting channel.
Channels are – Depending on what your E1 service provider assigns you,
you will select Consecutive (every one) or Alternating (every other one).
In some rare cases, you may have a block of channels available but may
be able to send data only on every other channel. In this case, select
alternating.
Line style – The E1 bandwidth is used to carry E1 performance data and
commands, such as loopback. This data may follow one of two standards:
ANSI T1.403 or AT&T 54016. This value should be supplied by your E1
service provider. If this value is set incorrectly, the performance data may
not be available and a loopback request may not be recognized.
Clock – If the network provides the clock for the E1 line, select External.
If the Instant Internet unit provides the clock, select Internal. In almost all
cases, the network provides the clock.
Auto loopback – Auto loopback is used for diagnostics and allows the
network to force the Instant Internet unit into loopback. Leave this check
box selected unless directed otherwise by a technical support
representative.
CRC4 checksum – CRC4 checksum allows you to enable or disable the
CRC4 checksum bits.
NFAS – Select NFAS to require both NFAS and FAS word for frame
sync. If NFAS is not selected, only FAS word is needed for frame sync.
Backup interface – A ISDN connection is available for use as a backup
connection to the Internet should your E1 connection become
unavailable.
Using the BayStack Instant Internet Management Software Version 7.11
254
Chapter 8 Advanced communications configuration
Configuring advanced communication settings for a
PPPoE connection
If you have a PPP over Ethernet (PPPoE) connection, you can configure dial
on-demand settings to establish a connection to the Internet as needed.
To configure dial on-demand settings:
1
Start Setup, and if prompted, select a unit to configure.
2
In the Interfaces area, select the PPPoE interface and then click Configure.
The PPPoE Configuration dialog box opens (Figure 111).
Figure 111 PPPoE Configuration dialog box
300868-G
Chapter 8 Advanced communications configuration
3
255
Click Advanced.
The PPPoE Configuration (advanced) dialog box opens (Figure 112).
Figure 112 PPPoE Configuration (advanced) dialog box
4
Select the Demand mode check box.
When you clear this check box, the Instant Internet unit establishes and
maintains a connection indefinitely.
5
In the Timeout boxes, enter the number of minutes of no traffic before the
interface hangs up.
6
Click OK.
Using the BayStack Instant Internet Management Software Version 7.11
256
Chapter 8 Advanced communications configuration
300868-G
257
Chapter 9
IPX configuration and support
This chapter describes how to use the Instant Internet unit in an IPX environment.
Using Instant Internet as an IPX-to-IP gateway
Instant Internet supports IPX networks by serving as an IPX-to-IP gateway. In an
IPX network, you do not need to load TCP/IP on every workstation because there
is no IP traffic.
Security considerations
In dial-up mode, Instant Internet fully satisfies the design requirements for secure
PC LAN access to the Internet. Instant Internet is not a firewall or a filter, but a
point where the Internet stops. With the IPX configuration of the Instant Internet,
you do not need to load TCP/IP anywhere on the LAN—not on any workstation,
nor on any server. All Internet packets stop at the unit. Internet users cannot see
LAN resources and hackers cannot get in.
To achieve the same level of security using Instant Internet with a router as with a
dial-up connection, you should use the dual-Ethernet option. Ensure that the
router resides on a LAN segment that is separate from all other LAN servers and
resources. This configuration completely isolates IP traffic from the local LAN
and provides the same hardware firewall as an Instant Internet unit with a dial-up
connection.
Note: The Instant Internet unit cannot prevent individual LAN users
from transferring sensitive information on the Internet via e-mail or fax.
Using the BayStack Instant Internet Management Software Version 7.11
258
Chapter 9 IPX configuration and support
Performance considerations
The Internet is a world-wide network in which millions of participating members,
including host computers and users, change constantly. Because there are many
factors, both single and combined, that influence your Internet access, it is
impossible to discuss performance in terms of precise numbers. Additionally, the
speed of the user’s workstation and available memory size affects performance.
The following information provides some broad guidelines.
Normal delays
Some delays you might experience while accessing the Internet are normal. For
example, delays can happen if a computer to which you are trying to connect is
down or simply busy, if the path is congested, or if there is a temporary Internet
circuit failure anywhere along the line. These types of delays are beyond the
control of the Instant Internet unit. By the very nature of the Internet’s structure,
any operation is prone to delays.
Number of simultaneous connections
Instant Internet is limited to 250 simultaneous IPX applications, which can be 250
users, each running a single application. Windows users running multiple Internet
applications at the same time can occupy the equivalent number of user positions.
Total available bandwidth is shared among concurrent users. Depending on the
applications in use at the same time and their respective socket requirements, the
number of simultaneous connections can vary. Operations that produce heavier
loads include simultaneous FTP downloading, file transfers, downloading large
graphics, and, in some cases, intensive Web browsing.
300868-G
Chapter 9 IPX configuration and support
259
When to consider a higher-speed connection
You may want to use a higher speed digital connection if:
•
•
•
•
Performance is slow.
Your LAN has a large number of users.
Demand for Internet access is heavy.
Internet access is critical to your business.
Contact your Nortel Networks sales representative to discuss your environment
and possible upgrade solutions.
Configuring IPX workstations to use a new unit name
When you change the name of the Instant Internet unit, you must individually
configure each IPX workstations to use the new name. For details on changing a
unit’s name, refer to “Changing a unit’s name” on page 285.
Note: You cannot use the BayStack Instant Internet Software and
Documentation Version 7.11 CD to perform this procedure. You must
first copy the software to the network. For details, refer to Installing the
BayStack Instant Internet Management Software Version 7.11.
You can configure IPX workstations using the workstation software you copied to
a network drive or the BayStack Instant Internet Software and Documentation
Version 7.11 CD.
To configure and IPX workstation to use a new unit name:
1
Do one of the following:
•
•
•
If you are using Windows 95, Windows 98, Windows NT, or Windows
2000, from the Windows Start menu, choose Run.
If you are using Windows 3.x, choose File > Run.
The Run dialog box opens (Figure 113).
Using the BayStack Instant Internet Management Software Version 7.11
260
Chapter 9 IPX configuration and support
Figure 113 Windows 95 Run dialog box
2
Enter:
d:\instinet\install.exe /select
where d:\ is the letter of the network drive or the CD-ROM drive.
3
Click OK.
The update process begins. If you have only one unit, the update process
completes and the name is updated.
If you have more than one unit, the Instant Internet Units dialog box opens
(Figure 114).
Figure 114 Instant Internet Units dialog box
4
300868-G
Select the new Instant Internet unit name and then click OK.
Chapter 9 IPX configuration and support
261
Configuring IPX frame types
By default, Instant Internet enables support for all IPX frame types. You can,
however, enhance performance slightly by turning off certain frame types if you
know that they are not used.
To select the frame types you want the Instant Internet unit to support:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > IPX Frame Type.
The Select IPX Frame Types dialog box opens (Figure 115).
Figure 115 Select IPX Frame Types dialog box
3
Do the following:
•
•
4
Select the check boxes of the frame types you want the Instant Internet
unit to use.
Clear the check boxes of the frame types you do not want the Instant
Internet unit to use.
Click OK.
Using the BayStack Instant Internet Management Software Version 7.11
262
Chapter 9 IPX configuration and support
Resolving Winsock conflicts
When you install the IPX version of the Instant Internet workstation software,
some of the Winsocks on the workstation are replaced with the Instant Internet
version. These Winsocks enable Instant Internet to use the IPX protocol for
Internet access.
During installation, you have the opportunity to rename any existing Winsocks.
The Instant Internet IPX workstation software supports most Winsock 1.1- or
Winsock 2.0-compliant applications.
There are three ways to reconcile Winsock compatibility issues. You can:
•
•
•
Migrate the workstation operating system to the Winsock 2.0 standard.
Use multiple versions of Winsock, which is discussed in the following
sections. To use this effectively, it is important to understand how Winsocks
work and some limitations of using multiple Winsocks.
Install TCP/IP on the workstations that are having Winsock conflicts (refer to
“Installing TCP/IP on a Workstation” of Installing the BayStack Instant
Internet Management Software Version 7.11) and configure them to use the
Instant Internet unit as an IP-to-IP gateway. As an IPX client, the client
applications share the Instant Internet TCP/IP stack, whereas when a
workstation has its own TCP/IP stack, all applications use the standard TCP/
IP protocol and Microsoft Winsocks for access and most compatibility
concerns can be avoided.
16-bit Winsocks
All 16-bit Winsock applications use the winsock.dll file. When you start a 16-bit
application, it searches for the .dll file in the following order:
•
•
•
•
•
Memory
Its own application directory
windows\system directory
Search path
All mapped drives
If another application has already loaded a winsock.dll file, the new application
uses the loaded version; otherwise, it looks in its application directory.
300868-G
Chapter 9 IPX configuration and support
263
32-bit Winsocks
All 32-bit Winsock applications (those specifically designed for Windows 95,
Windows 98, Windows NT, and Windows 2000) use the wsock32.dll file. When
you start a 32-bit application, it searches for the .dll file in the following order:
•
•
•
•
Its own application directory (it does not look in memory)
windows\system directory
Search path
All mapped drives
Not every application follows the rules listed above. Some 32-bit applications look only in
the windows\system directory. This is something to keep in mind when you make a decision
about how to use multiple versions of Winsock.
Note: The Instant Internet 32-bit Winsock 2.0 is named ws2pt.dll.
Winsock 1.1 and Winsock 2.0
The Install program always installs the Winsock 2.0 client software on Windows
98, Windows NT, and Windows 2000 workstations. On a Windows 95
workstation, the Install program auto-detects what Winsock standard is installed
on the workstation. If for some reason this does not happen during installation,
you can force the Install program to install the Winsock 2.0-compliant Winsocks
with the install.exe /ws2 switch.
When you install Instant Internet, you must close all applications (including virus
protection programs) that may be using the Winsock.
Using multiple versions of Winsock
You have two options for resolving a Winsock conflict. You can install TCP/IP
(for details, refer to “Installing TCP/IP on a Workstation” of Installing the
BayStack Instant Internet Management Software Version 7.11), or you can use
multiple versions of Winsock.
Using the BayStack Instant Internet Management Software Version 7.11
264
Chapter 9 IPX configuration and support
Using multiple 16-bit Winsocks
Using multiple versions of Winsock in a 16-bit environment can be frustrating
because an application looks for the Winsock in memory first, which requires the
user to close each application before opening another. If you decide to use a 16-bit
Winsock, do the following:
1
Place the appropriate winsock.dll in each application directory. For example,
in Netscape, place the winsock.dll that had an Instant Internet version number
as the time stamp in the same directory as the netscape.exe file and leave your
other winsock.dll in the Windows directory or wherever it previously resided.
2
Close each application before you open another.
Using multiple 32-bit Winsocks
Using multiple versions of Winsock in a 32-bit environment allows you to have
more than one loaded into memory at a time. If you want to use the Microsoft
wsock32.dll file for some applications and the Instant Internet file for others, then
you need to make sure that the appropriate wsock32.dll file is in the appropriate
application directory.
If you have many applications that use the Microsoft wsock32.dll file and only a
few that use the Instant Internet file, you should leave the Microsoft file in the
windows/system directory and relocate the Instant Internet wsock32.dll file. If the
opposite is true, then leave the Instant Internet file in the windows\system
directory and move the Microsoft file.
Note: Some proprietary applications look in the windows\system
directory first rather than their own application directory.
300868-G
Chapter 9 IPX configuration and support
265
Winsock files installed
The following sections describe the Winsock files that are installed for Instant
Internet.
Windows 3.x
The following files are copied on a Windows 3.x workstation.
16-bit only
c:\windows\winsock.ini
c:\windows\winsock.dll (renames existing file and replaces)
c:\windows\ptnetwrk.dll
Windows 95 and Windows 98
The following files are copied on a Windows 95 or Windows 98 workstation for
Winsock 1.1.
16-bit and 32-bit
c:\windows\winsock.ini
c:\windows\winsock.dll (renames existing file and replaces)
c:\windows\ptnetwrk.dll
c:\windows\ptnetwrk.vxd
c:\windows\system\wsock32.dll (renames existing file and replaces)
c:\windows\system\ptnet32.dll
Using the BayStack Instant Internet Management Software Version 7.11
266
Chapter 9 IPX configuration and support
Windows 95
The following files are copied on a Windows 95 workstation for Winsock 2.0
when you use the install.exe /ws2 installation switch.
16-bit and 32-bit
c:\windows\winsock.ini
c:\windows\winsock.dll (renames existing file and replaces)
c:\windows\ptnetwrk.dll
c:\windows\ptnetwrk.vxd
c:\windows\system\ws2pt.dll
c:\windows\system\ptnet32.dll
Windows NT 4.0
The following files are copied on a Windows NT 4.0 workstation.
16-bit and 32-bit
\winnt\winsock.ini
\winnt\system32\drivers\pti.sys
\winnt\system32\oemnxpii.inf
\winnt\system32\ptnetwrk.dll
\winnt\system32\ptnet32.dll
\winnt\system32\ws2pt.dll
\winnt\system32\winsock.dll (renames existing file and replaces)
Resolving Winsock conflicts during installation
When you install a local or network copy of the Instant Internet software, certain
computer-specific files such as .dll and .ini files are copied transparently to the
appropriate directories.
If Instant Internet finds other winsock.dll or wsock32.dll files during installation,
one of the following messages is displayed:
Found winsock.dll in: <drive:\directory>
Found wsock32.dll in: <drive:\directory>
300868-G
Chapter 9 IPX configuration and support
267
To run Internet applications properly, Instant Internet requires the Winsock that
comes with this product. If it finds another Winsock, you must either delete the
preexisting Winsock file or rename it.
Caution: If you choose to continue installing Instant Internet while
allowing multiple versions of winsock.dll to run, you risk improper
operation of Instant Internet with Internet applications.
IP filters and Winsock compatibility
Filters apply to the Winsock server’s packets, although input filters would not
apply since these packets are always generated internally and never come from an
external source. If you do not want the Winsock to be constrained by the output
filters for an interface, simply allow all traffic from Instant Internet’s IP address.
For example:
ip filter winsock allow source x.x.x.x
ifconfig network outfilter winsock
The designation x.x.x.x is the IP address assigned to the network interface. This
address works because internally-generated packets destined for hosts on the
network connected to the network interface always have a source IP address of
the network interface. Refer to “Configuring an IP filter” on page 142 for more
information on IP filtering.
Configuring the Instant Internet unit in a multiple-unit
environment
When you use multiple Instant Internet units in an IPX network, you have several
additional options. Among these options are the ability to provide fault tolerance,
automatic user load balancing, and modified user access to individual units.
You can set specific defaults in the install.cfg file before installing the individual
workstation software, then you can use these defaults to assign specific users to
specific Instant Internet units during automatic workstation installation.
Using the BayStack Instant Internet Management Software Version 7.11
268
Chapter 9 IPX configuration and support
For details on using the install.cfg file, refer to Installing the BayStack Instant
Internet Management Software Version 7.11.
Note: When you install multiple Instant Internet units, be sure to install
each unit individually (that is, plug in one unit, configure the unit, and
complete the installation before plugging in the next unit). This practice
maintains the simplicity of installing multiple units and avoids any
confusion regarding which unit is currently being configured.
Configuring fault tolerance and automatic user load
balancing
With multiple Instant Internet units, you achieve fault tolerance and automatic
user load balancing with the unit= line parameter in the install.cfg file.
unit=iibox1
If you want to connect to a particular unit and use a second unit as backup in
the event that the first unit is down or busy (or has reached its simultaneous
application limit), the install.cfg entry looks like this:
unit=iibox1,backupii
where you have two Instant Internet units, one called iibox1 and the second called
backupii.
To allow load balancing across multiple Instant Internet units, see the following
example. The brackets define the set of units to which a user is randomly
connected.
unit={instant1,salesii,iibox2}
In the following example, the user connects randomly to iia or iib. If one fails, the
unit tries the other; if both fail, it connects to iibackup.
unit={iia,iib},iibackup
300868-G
Chapter 9 IPX configuration and support
269
In the next example, the user connects randomly to iia or iib. If the connection to
one of these units fails, the other is not tried; iibackup is tried instead.
unit=*{iia,iib},iibackup
Configuring multiple default sets
•
•
•
In a multiple-unit installation, you can create a default menu that can prompt
users to make choices. You do this by making multiple default entries in the
install.cfg file, for example:
The available Instant Internet units are iibox1, iibox2, and backupii.
The select= statement parameter builds a menu (displayed at the individual
workstation installation) from which the user selects a workgroup.
The Default section at the beginning of the install.cgf file must contain:
[DEFAULT]
select=[Sales],[Accounting],[Marketing],[IS],[Normal]
This entry creates the menu the user sees at the individual workstation installation.
The workgroups are Sales, Accounting, Marketing, IS, and Normal. You can
further configure the default installation for the various workgroups.
Note: Using the install.cfg file for automatic workstation installation is
described in more detail in Installing the BayStack Instant Internet
Management Software Version 7.11. There you can find detailed
descriptions of the options for install.cfg, including the use of the asterisk
(*).
For details on how to use the unit= line, refer to “Configuring fault
tolerance and automatic user load balancing” on page 268.
Using the BayStack Instant Internet Management Software Version 7.11
270
Chapter 9 IPX configuration and support
Example: Sales
In this example, this set of defaults is called “Sales. ”
[SALES]
description=Sales
type=private
directory=*c:\instinet
unit=iibox1,iibox2,backupii
choice=*-admin
The software installs to a private directory, c:\instinet, but the user is not prompted
to supply the directory name (refer to Installing the BayStack Instant Internet
Management Software Version 7.11). The first default unit is iibox1. The second
default unit is iibox2. The third default is backupii. The administrative utilities are
not installed, and you are not prompted to install them.
Example: Accounting
In this example, this set of defaults is called “Accounting.”
[ACCOUNTING]
description=Accounting
type=private
directory=c:\instinet
unit=iibox2,iibox1,backupii
choice=*-admin
The software installs to a private directory, and you are prompted with c:\instinet
as a default location. The first default unit is iibox2. The second default is iibox1.
The third default is backupii. The administrative utilities are not installed, and you
are not prompted to install them.
300868-G
Chapter 9 IPX configuration and support
271
Example: Marketing
In this example, this set of defaults is called “Marketing.”
[MARKETING]
description=Marketing
type=private
directory=*c:\instinet
unit={iibox1,iibox2,backupii}
choice=*-admin
The software installs to a private directory, c:\instinet, but you are not prompted to
supply the directory name (refer to Installing the BayStack Instant Internet
Management Software Version 7.11). The user is connected randomly to either
iibox1, iibox2, or backupii (page 268). The administrative utilities are not
installed, and you are not prompted to install them.
Example: IS
In this example, this set of defaults is called “IS.”
[IS]
description=IS
type=network
directory=f:\instinet
unit=iibox1,iibox2,backupii
choice=+admin
The software installs to a network directory, and you are prompted with f:\instinet
as the default location of the software on the network. The first default unit is
iibox1. The second default is iibox2. The third default is backupii. The
administrative utilities are installed.
Using the BayStack Instant Internet Management Software Version 7.11
272
Chapter 9 IPX configuration and support
Example: normal
In this example, this set of defaults is called “Normal.”
[NORMAL]
description=Normal
; No defaults here. All questions asked.
The “;” in front of the last line indicates that it is a comment line only. For the
Normal workgroup, there are no defaults and all installations prompts are
displayed.
Installing multiple Instant Internet units
You can increase user capacity and access speed by installing multiple Instant
Internet units on a single LAN. The automatic load balancing feature among the
units enhances overall performance by distributing Instant Internet requests to
each Instant Internet unit rather than by distributing all requests to one unit.
Installing more than one unit also provides fault tolerance, allowing users to
restart an Internet application quickly in the rare event that one unit fails.
Tips for installing multiple units
If you are installing multiple units, be sure to install each unit individually—plug
in one unit, configure it, and then complete the installation before plugging in the
next unit. This practice maintains the simplicity of installing multiple units and
avoids any confusion about which unit is currently being configured. You can
save any administrative user information and restore the information to multiple
units.
When you install the components of the Instant Internet software, select an Instant
Internet unit for the Internet applications to use from the list of units.
300868-G
273
Chapter 10
Instant Internet unit configuration, support, and
diagnostics
This chapter describes how to view and change the Instant Internet unit
configuration.
Restarting the Instant Internet unit
To restart the Instant Internet:
1
Start Setup, and if prompted, select a unit to restart.
2
Choose File > Restart Unit.
The Restarting Instant Internet dialog box opens (Figure 116)
Figure 116 Restarting Instant Internet dialog box
Using the BayStack Instant Internet Management Software Version 7.11
274
Chapter 10 Instant Internet unit configuration, support, and diagnostics
Identifying the login workstation
When Instant Internet is installed on an IP workstation running Windows 95,
Windows 98, Windows NT, or Windows 2000, the iiLogin icon (Figure 117)
appears in the system tray.
Figure 117 iiLogin icon
You can view the user name, user type, unit IP address, and the name order of
directory services. For more information, refer to “Identifying IP Workstations” of
Installing the BayStack Instant Internet Management Software Version 7.11.
To identify the Login workstation:
Double-click the iiLogin icon.
The iiLogin Connected as username dialog box opens (Figure 118).
Figure 118 iiLogin Connected as username dialog box
300868-G
Chapter 10 Instant Internet unit configuration, support, and diagnostics
275
Adding a unit to the selection list
In a multi-unit installation, you are prompted to choose a unit to administer when
you start any of the administration utilities. Because of the nature of IP, all
available Instant Internet units may not appear in the selection list. If you do not
see the unit you want, you can add the unit to the list of available units.
Note: You cannot use this procedure to install a new Instant Internet
unit! This procedure merely locates an existing Instant Internet unit.
To add an Instant Internet unit to the list of available units:
1
Start any administration utility.
The Instant Internet Units dialog box opens (Figure 119).
Figure 119 Instant Internet Units dialog box
2
Click Add.
The Enter Unit’s IP Address dialog box opens (Figure 120).
Using the BayStack Instant Internet Management Software Version 7.11
276
Chapter 10 Instant Internet unit configuration, support, and diagnostics
Figure 120 Enter Unit’s IP Address dialog box
3
Enter the IP address of the Instant Internet unit you want to add to the
selection list and then click OK.
The Instant Internet unit is now displayed in the selection list.
To remove a unit from the selection list:
Click Remove.
Note: You can remove a unit only that you added to the list.
Understanding the name server list order
Name servers translate readable host computer names into numeric IP addresses.
Your ISP supplies you with one or more name server addresses and also creates
and maintains the name servers. If you enter more than one name server, Instant
Internet tries to connect to the first name server and, if it fails, continues down the
list until a successful connection is made. The server that responds is then moved
to the top of the list.
300868-G
Chapter 10 Instant Internet unit configuration, support, and diagnostics
277
Saving and restoring unit configurations
Using Setup, you can back up configuration settings to a disk file so that you can
restore the configuration when you exchange or upgrade the unit or when you
make extensive changes to the unit’s configuration.
For example, if you want to make changes to the Advanced TCP/IP Settings in
Instant Internet, it is a good idea to make a backup of the Instant Internet unit’s
current configuration before making any changes. You can then restore the
original configuration if the changes you make cause problems.
Backing up a unit configuration to disk
To back up the new configuration to disk:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose File > Backup to Disk.
The Backup Setup Configuration dialog box opens (Figure 121).
Figure 121 Backup Setup Configuration dialog box
3
Navigate to the drive and directory to which you want to save the
configuration.
If you want to save the configuration to a floppy disk, insert a disk in the
floppy drive.
4
Enter a name in the File Name box.
Using the BayStack Instant Internet Management Software Version 7.11
278
Chapter 10 Instant Internet unit configuration, support, and diagnostics
5
In the Save File as Type box, select .iis.
6
Click OK.
Restoring a unit configuration from disk
When you restore an Instant Internet unit’s configuration, you restore and
overwrite all configuration settings.
Note: Configuration changes do not take place until you click Save and
Exit. If you restored a configuration in error, click Cancel changes.
To restore a configuration from disk:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose File > Restore from Disk.
The Restore Setup Configuration dialog box opens (Figure 122).
Figure 122 Restore Setup Configuration dialog box
3
Navigate to the drive and directory of the backup configuration file.
4
Select the File Name of the backup configuration file.
5
Click OK.
You are prompted to restore the users and groups (Figure 123).
300868-G
Chapter 10 Instant Internet unit configuration, support, and diagnostics
279
Figure 123 Prompt to restore users and groups
6
If you want to restore the user and group configurations in Admin, click Yes;
otherwise, click No.
7
In the Setup main window, click Save and Exit.
Changing the unit configuration
Before you change the Instant Internet unit’s configuration, you should back up
the current configuration. If the changes you make cause problems, you can
restore the original configuration using this backup file. Refer to “Saving and
restoring unit configurations” on page 277.
To change the Instant Internet unit’s configuration:
Start Setup, and if prompted, select a unit to configure.
The Setup program first ensures that the unit is functioning properly, and then
displays the main Setup window.
Note: If you forget your password and need to configure the unit, you
can do so by resetting the DIP switches on the back of the unit. For
details, refer to the hardware manual for your Instant Interent unit.
Refer to the appropriate sections that follow for instructions on changing the
Instant Internet unit’s configuration. Change the information as your ISP or as a
Nortel Networks support representative advises. After each change, click Save
and Exit. You are then asked:
Using the BayStack Instant Internet Management Software Version 7.11
280
Chapter 10 Instant Internet unit configuration, support, and diagnostics
Do you want the changes to take effect immediately?
If you respond No, Instant Internet writes the new configuration data to the unit,
but the new configuration does not take effect until you restart the Instant Internet
unit.
If you respond Yes, Instant Internet writes the new configuration data to the unit,
disconnects all users, and reinitializes with its new configuration. During the few
moments of configuration, the unit does not respond on the network, but screen
messages inform you of actions taking place. Instant Internet displays the
message:
Do you want to test the connection?
If you respond Yes, Instant Internet tests the Internet connection and advises you
of the results and any actions to take.
If you respond No, you may choose to test now or anytime later by selecting either
option from the Setup menu.
Changing your ISP
If you change ISPs or any information about your connection changes (user name,
password, connection phone number), you must reconfigure the Instant Internet
unit with the new information.
Note: You must change your ISP information only if you have a dial-up
or ISDN connection to the Internet. If you have a leased-line or router
connection, you generally do not have to reconfigure the unit if you
change ISPs.
To ensure a smooth transition to a new ISP and minimal interruption of your
Internet access, check with Nortel Networks before switching ISPs to make
sure that your new ISP is on the list of those currently supported. If it is not
supported, call the Internet Service Provider Hotline at 800-2LANWAN, Express
Routing Code #169, and supply the new provider’s contact phone number and
your account information so that the name can be added to the Nortel Networks
list of ISPs.
300868-G
Chapter 10 Instant Internet unit configuration, support, and diagnostics
281
To change your ISP information:
1
Start Setup, and if prompted, select a unit to configure.
2
In the Interfaces area, select the dial-up or ISDN interface.
3
Click Configure.
One of two things happens:
•
If you selected a dial-up interface, the Dialup Configuration dialog box
opens (Figure 124).
Figure 124 Dialup Configuration dialog box
•
If you selected an ISDN interface, the ISDN Configuration dialog box
opens (Figure 125).
Using the BayStack Instant Internet Management Software Version 7.11
282
Chapter 10 Instant Internet unit configuration, support, and diagnostics
Figure 125 ISDN Configuration dialog box
4
In the Provider box, select the new ISP’s name from the list.
If you do not see your ISP in the list, select ! Default.
300868-G
5
In the Phone box, enter the new phone number.
6
In the Backup box, enter the new backup phone number (if available).
7
In the User ID box, enter your new user ID.
8
In the Password box, enter your new password.
9
Click OK.
Chapter 10 Instant Internet unit configuration, support, and diagnostics
283
Changing registration information
You should review and update your registration information periodically so that
you can receive the latest product news and information on upgrades through
e-mail from Nortel Networks.
To review or update your registration information:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Setup > Registration.
The Registration Information dialog box opens (Figure 126).
Figure 126 Registration Information dialog box
3
Change or add the appropriate information.
4
Click OK.
Using the BayStack Instant Internet Management Software Version 7.11
284
Chapter 10 Instant Internet unit configuration, support, and diagnostics
Changing a unit’s configuration password
Be sure to remember your configuration password. You must enter it to make any
configuration changes to the unit.
Note: If you forget your password and need to configure the Instant
Internet unit, you can do so by resetting the DIP switches on the back of
the unit. For details, refer to Setting Up the BayStack Instant Internet
100-S Unit, Setting Up the BayStack Instant Internet 100 Unit, Setting
Up the BayStack Instant Internet 400-S Unit, or Setting Up the BayStack
Instant Internet 400 Unit depending on the type of Instant Internet unit
you have.
To change a unit’s configuration password:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Setup > Change Password.
The Enter Password dialog box opens (Figure 127).
Figure 127 Enter Password dialog box
3
Enter the new password and then click OK.
The password is case-sensitive, therefore password is not the same as
PASSWORD, or Password.
The Re-enter Password dialog box opens (Figure 128).
300868-G
Chapter 10 Instant Internet unit configuration, support, and diagnostics
285
Figure 128 Re-enter Password dialog box
4
Enter the new password again and then click OK.
5
In the main Setup window, click Save and Exit.
Changing a unit’s name
If you have more than one Instant Internet unit, it is very important that you give
each unit a unique name.
Note: When you change the name of the Instant Internet unit, you must
configure all of your IPX (but not IP) workstations to use the new name.
For details, refer to “Configuring IPX workstations to use a new unit
name” on page 259.
To change the name of the Instant Internet unit:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Setup > Change Name.
The Unit Name dialog box opens (Figure 129).
Figure 129 Unit Name dialog box
3
Enter the new unit name.
You can enter up to 13 letters, digits, and symbols (with no spaces).
Using the BayStack Instant Internet Management Software Version 7.11
286
Chapter 10 Instant Internet unit configuration, support, and diagnostics
4
Click OK.
5
Click Save and Exit.
Changing a unit’s time, date, or time zone
To change the time, date, or time zone for a selected Instant Internet unit:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Setup > Time.
The Unit Time dialog box opens (Figure 130), showing the current date and
time.
Figure 130 Unit Time dialog box
3
Select one of the following options:
•
•
•
300868-G
Enter the date and time manually. Continue with step 4.
Set the date and time to that of the workstation. Continue with step 5.
Use an NTP server for the date and time. Continue with step 6.
4
Enter the new date and time in the appropriate boxes and then click Set New
Date/Time. Continue with step 7.
5
Click Set to Workstation Date/Time. Continue with step 7.
Chapter 10 Instant Internet unit configuration, support, and diagnostics
6
287
To use an NTP server for the date and time, select the Enable NTP check box
and then do one of the following:
•
•
•
To set the time using an NTP server, click Add. Enter the domain name or
IP address of the NTP server, and then click OK.
To change from one NTP server to another, select the server to be
changed, and then click Change. Enter the IP address or domain name of
the new NTP server, and then click OK.
To remove an NTP server, select the server to be removed. Click Remove,
and then click Yes.
When you use an NTP server for the time and date, the Instant Internet unit
checks that server every 12 hours for the correct time. If you have a dial-up
connection, this check occurs only when a line is up.
You can view the “NTP log” provided in Setup to verify that the correct server
supplied the time and any adjustments.
7
Click Time Zone.
The Time Zone dialog box opens (Figure 131).
Figure 131 Time Zone dialog box
8
Select the time zone.
•
9
To automatically adjust the unit’s clock for daylight savings time, select
the check box.
Click OK through all dialog boxes.
10 In the main Setup window, click Save and Exit.
Using the BayStack Instant Internet Management Software Version 7.11
288
Chapter 10 Instant Internet unit configuration, support, and diagnostics
Selecting additional support options
To view and select additional support options:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > Other Settings.
3
Select or clear any of the following check boxes:
— Enable IP Forwarding – This option enables IP Forwarding for the
interface.
— Enable Token-Ring Source Routing – This option is available only if
you have a token ring interface.
— Disable <interface> interface at: – You can enter a time for the interface
to be disabled (Disable time) and time for it to be enabled (Enable time).
Use this option if you do not want to allow Internet access at certain times
of the day.
Enabling diagnostic IP tools
Instant Internet has several diagnostic tools available. These tools are
automatically set up during installation. Typically you will use these diagnostic
tools for troubleshooting at the direction of technical support personnel.
•
•
•
•
•
300868-G
Chargen – A service that generates a test pattern (characters) at the maximum
possible rate. The default is to leave this option turned off.
Discard – A service that discards any message or packet sent to it. The default
is to leave this option turned off.
Echo – A service that sends back any message or packet sent to it. The default
is to leave this option turned off.
Ident – A service that validates the sender of a message or packet. This
service allows a server, to which the computer is already connected, to find
out the true user name of the internal machine. The default is to leave this
option turned on.
SNMP – A service that provides communications at the applications network
layer. The default is to leave this option turned on.
Chapter 10 Instant Internet unit configuration, support, and diagnostics
•
289
Telnet – A service that provides terminal-emulation capabilities for logging in
to the Instant Internet unit from a remote location. The default is to leave this
option turned on. For more information about how to use this service with the
Instant Internet unit refer to Reference for the BayStack Instant Internet
Remote Access Commands Version 7.11.
To enable diagnostic IP tools:
1
Start Setup, and if prompted, select a unit to configure.
2
Choose Support > Services.
The Services dialog box opens (Figure 132).
Figure 132 Services dialog box
3
Select the check box of each diagnostic IP tool you want to enable.
4
Click OK.
Testing connections
If you are having trouble accessing the Internet or a particular host, you can use
several diagnostic tools to test these connections.
Using the BayStack Instant Internet Management Software Version 7.11
290
Chapter 10 Instant Internet unit configuration, support, and diagnostics
Testing the connection to the Internet
You can run a test sequence to verify that Instant Internet can connect to the
Internet. The connection test calls each of the domain name servers listed to
confirm that the server exists and is, in fact, a domain name server. Test
Connection also does a forward and reverse DNS lookup for the Instant Internet
unit’s IP address on the default interface.
To test the connection to the Internet:
1
Start Setup, and if prompted, select a unit to test.
2
Choose Setup > Test Connection.
A dialog box opens indicating the test results and any subsequent actions to
take.
Testing the connection to a host
Instant Internet is shipped with a set of utilities to assist you with testing and
troubleshooting host connection problems. iiLogin allows you to determine how
an IP workstation is identified and to which Instant Internet unit the workstation
is connected. Tools allows you to view host connections through various features
such as ping, trace, and stress. It also allows you to troubleshoot problems that
might occur.
Tools provides a user friendly screen to assist you in quickly finding an answer
to host connection problems. From this screen, you can ping a host, trace a host
connection, and stress test the host connection.
Note: Many sites will not allow you to use these tools to test against
them. You may get errors if you try to test against a site that does not
want you testing.
Also, ping and trace will get errors if the No RAW Sockets option is
enabled for the user logged on to that workstation. For details on
enabling No RAW Sockets, refer to “Managing RAW sockets” on
page 83.
300868-G
Chapter 10 Instant Internet unit configuration, support, and diagnostics
291
To start Tools:
In the Instant Internet program group or menu (depending on your operating
system), select Tools.
The Tools main window opens (Figure 133).
Figure 133 Tools main window
The troubleshooting tools include:
•
•
•
Ping – Finds a host and determines the response time for that host.
Trace – Finds the route used to get to a specific host.
Stress – Tests the echo port of a selected host.
Using the BayStack Instant Internet Management Software Version 7.11
292
Chapter 10 Instant Internet unit configuration, support, and diagnostics
Testing the response time of a host
The ping tool finds a host and determines the response time for that host. Ping
tests the connection to a specified host by sending data to the specified host and
waiting for the packet to be returned. When a host is successfully pinged, the data
packet is returned to the requester. If the ping is unsuccessful, then there is a
problem with the connection or with the route used to connect to the host.
Using the ping tool, you can:
•
•
•
Determine if a host is accessible.
View a host’s response or lag time.
View the packet loss for a host.
To perform a ping test:
1
Select the Host you want to ping.
If the host you want to ping is not in the list, type the host name or IP address
in the Host box.
2
Click Ping.
The ping test begins, and you can watch its progress.
If you want to stop the ping test before it is complete, click Stop. This can be
useful if you see the problem before the test completes.
You can set options for the ping test, such as the number of pings. See “Setting
host connection test options” on page 300 for more information.
The ping test returns the following information:
•
•
•
•
The host address with number of data bytes and timeout length
The milliseconds per ping
The percentage of lost packets (the number of packets not received divided by
the total number of packets sent)
The average number of milliseconds per ping
Figure 134 shows a sample of the beginning of a ping test.
300868-G
Chapter 10 Instant Internet unit configuration, support, and diagnostics
293
Figure 134 Ping test started
In the figure above, a ping test was started on the host name
www.nortelnetworks.com. As you can see, the window is divided into two areas.
The top area shows a graphic representation of how long it took each ping trial to
complete. The bottom area shows the statistics of the ping test.
In the bottom area of the window, the first column of data displays the sequence of
trials, the second column describes the number of milliseconds it took to complete
each trial, and the third column shows the address pinged.
After the ping test completes, the percentage of lost packets and the average
number of milliseconds per trial are displayed at the bottom of the statistics area
of the window, as shown in Figure 135.
Using the BayStack Instant Internet Management Software Version 7.11
294
Chapter 10 Instant Internet unit configuration, support, and diagnostics
Figure 135 Ping test finished
Tracing the route to a host
You can use the trace tool to find the route used to get to a specific host. This
troubleshooting tool allows you to view all sites in the route for a specific trace to
pinpoint any problems in data communication.
The trace tool shows the path taken to get to a specified host. For instance, if you
perform a trace on the host name www.baynetworks.com, you will see a list of the
locations (hops) used to get to www.baynetworks.com.
Using the trace tool, you can:
•
•
300868-G
View the number of hops needed to reach a particular host.
Find the last “reached” hop before the desired host was recognized as
unreachable.
Chapter 10 Instant Internet unit configuration, support, and diagnostics
295
To perform a trace test:
1
Select the Host you want to trace.
If the host you want to trace is not in the list, type the host name or IP address
in the Host box.
2
Click Trace.
The trace test begins, and you can watch its progress.
If you want to stop the trace test before it is complete, click Stop. This can be
useful if you see the problem before the test completes.
You can set options for the trace test, such as the number of hops per trace. See
“Setting host connection test options” on page 300 for more information.
A trace test returns the following information:
•
•
•
•
The selected host address with the maximum number of hops
The host addresses traced
The percentage of lost packets (the number of packets received divided by the
total number of packets sent)
The average number of milliseconds per hop
Figure 136 shows the beginning of a trace test.
Using the BayStack Instant Internet Management Software Version 7.11
296
Chapter 10 Instant Internet unit configuration, support, and diagnostics
Figure 136 Trace test started
In the figure above, a trace was started on the host name www.baynetworks.com.
As you can see, the window is divided into two areas. The top area shows a
graphic representation of how long it took each trace trial to complete. The bottom
area shows the statistics of the trace test.
In the bottom area of the window, the first column displays the sequence of hops,
the second column describes the number of milliseconds per test that it took to get
to the specified host, and the third column shows the host address traced.
After the trace completes, the percentage of lost packets and the average number
of milliseconds per hop are displayed at the bottom of the statistics area of the
window, as shown in Figure 137.
300868-G
Chapter 10 Instant Internet unit configuration, support, and diagnostics
297
Figure 137 Trace test finished
Testing the echo port of a host
You can use the stress tool to test the echo port of a selected host. An echo port is
a well-known port that returns any data sent to it. The stress test generates a load
on the system to see what the throughput is to a host.
Using the stress tool, you can:
•
•
Load a host for testing.
Measure the throughput of a host.
To test the echo port of a host:
1
Choose the Host you want to test.
If the host you want to stress is not in the list, type the host name or IP address
in the Host box.
Using the BayStack Instant Internet Management Software Version 7.11
298
Chapter 10 Instant Internet unit configuration, support, and diagnostics
2
Click Stress.
The stress test begins, and you can watch its progress.
If you want to stop the stress test before it is complete, click Stop. This can be
useful if you see the problem before the test completes.
You can set options for the stress test, such as the number of times the test is
performed. See “Setting host connection test options” on page 300 for more
information.
A stress test returns the following information:
•
•
•
•
•
The milliseconds per transmission block
The size of the transmission block
The number of bytes per second
The total number of bytes and seconds
The average number of bytes per second
Figure 138 shows the beginning of a stress test.
Figure 138 Stress test started
300868-G
Chapter 10 Instant Internet unit configuration, support, and diagnostics
299
In Figure 138, a stress test was started on the host name www.baynetworks.com.
The window is divided into two areas. The top area shows a graphic
representation of how long it took each stress trial to complete. The bottom area
shows the statistics of the stress test.
In the bottom area of the window, the first column shows the number of transmits
performed. The second column displays the number of milliseconds per test that it
took to get to the specified site or host. The third column shows the number of
bytes sent and received, and the fourth column shows the number of bytes sent per
second.
After the stress test completes, the total number of bytes sent and the average
number of bytes per second are displayed at the bottom of the statistics area of the
window, as shown in Figure 139.
Figure 139 Stress test finished
Using the BayStack Instant Internet Management Software Version 7.11
300
Chapter 10 Instant Internet unit configuration, support, and diagnostics
Setting host connection test options
You can customize how Tools performs a Ping, a Trace, and a Stress.
To set options for a test:
1
Click Options.
The Options dialog box opens (Figure 140).
Figure 140 Options dialog box in Tools
2
Set any of the following options:
•
300868-G
Ping
— Number of pings – The number of pings you want the ping test to
complete.
— Length of ping data – The size of the data sent.
— Timeout in seconds – The number of seconds allowed before the test
fails.
Chapter 10 Instant Internet unit configuration, support, and diagnostics
•
•
3
301
Trace
— Maximum hops – The maximum number of hops per trace.
— Lookup names – If selected, this option looks up and displays host
names.
— Timeout in seconds – The number of seconds allowed before a hop
is considered unreachable.
Stress
— Repeat count – The number of times the stress test is performed.
— Block size – The size of the data packet sent or received, not
including the headers.
— Send/Receive (echo) – When selected, this option allows data to be
sent and received.
— Send only (discard) – When selected, this option allows data to be
sent only.
— Receive only (chargen) – When selected, this option allows data to
be received only.
— Non-blocking – This option determines how the Winsock receives
data.
Click OK.
Using the BayStack Instant Internet Management Software Version 7.11
302
Chapter 10 Instant Internet unit configuration, support, and diagnostics
300868-G
303
Appendix A
Troubleshooting and error messages
This appendix describes some methods for troubleshooting the Instant Internet
unit and describes error messages.
Viewing the Instant Internet serial number
To view the serial number through the Instant Internet Setup program:
1
Start the Instant Internet Setup program.
For details see “Using Setup” on page 127.
2
Choose Help > About IISetup.
The About Instant Internet Setup dialog box opens and the serial number is
displayed in the Serial Number box (Figure 141).
Figure 141 About Instant Internet Setup dialog box, Serial Number box
Using the BayStack Instant Internet Management Software Version 7.11
304
Appendix A Troubleshooting and error messages
Viewing system files
System files and log settings and entries are typically used by technical support
representatives for troubleshooting. You can view these files using the Instant
Internet Setup program or through your Web browser. to view the following
information, you can also view most of it through your Web browser.
Viewing system files in setup
In Setup, you can view the Instant Internet unit’s log, users, update history,
advanced TCP/IP settings, port mappings, and hosts.
Viewing unit log information
The unit log details a unit’s activity since it was last restarted.
To view the unit log:
1
Choose View > Unit Log.
2
Review the file as needed.
To print the file, choose File > Print.
3
To close the file, choose File > Close.
Viewing a unit’s users
A list of users currently connected to a specific unit is available for viewing
purposes only. To view the list of users currently connected to a specific unit:
300868-G
1
Choose View > Users.
2
To view up-to-the-minute changes in users for the unit, click Refresh.
3
To return to the main Setup window, click Cancel.
Appendix A Troubleshooting and error messages
305
Viewing a unit’s update history
Each Instant Internet unit keeps a record of the versions that have been installed
and upgraded. This is the update history log.
To view an update history log for a unit:
1
Choose View > Update History.
2
Review the file as needed.
To print the file, choose File > Print.
3
To close the file, choose File > Close.
Viewing a unit’s advanced TCP/IP settings
To view the advanced TCP/IP settings for a unit:
1
Choose Support > Advanced TCP/IP Settings.
2
Review the file as needed.
To print the file, choose File > Print.
3
To close the file, choose File > Close.
Viewing a unit’s port mappings
To view a list of the port mappings for a unit:
1
Choose Support > Port Mappings.
A window opens that contains a Port Mappings List. Do not edit this list
unless you have previous port mappings experience.
2
Review the file as needed.
To print the file, choose File > Print.
3
To close the file, choose File > Close.
Using the BayStack Instant Internet Management Software Version 7.11
306
Appendix A Troubleshooting and error messages
Viewing a unit’s support hosts
To view the support hosts for a unit:
1
Choose Support > Hosts from the menu bar.
A window opens that contains a Host List.
Caution: Do not edit this list unless you have experience with static
hosts.
2
Review the file as needed.
To print the file, choose File > Print.
3
To close the file, choose File > Close.
Viewing system files through a Web browser
From a Web browser, you can view the Instant Internet unit’s log, update history,
system settings, port mappings, and hosts.
Note: Before you can use a Web browser to view system files, you must
enable Web configuration. For details, refer to “Enabling Web
configuration” on page 119.
To connect to the Instant Internet unit using a Web browser:
1
In the Address or Location box of your Web browser, type the IP address of
the Instant Internet unit.
If the unit is password protected, the Username and Password Required dialog
box opens. A user name is not required.
2
Enter the password for the unit.
The Home page opens (Figure 142).
300868-G
Appendix A Troubleshooting and error messages
307
Figure 142 Instant Internet Web home page
3
On the Home page, click Admin.
The System Administration page opens.
Viewing log files
Several log files are generated to help troubleshoot a connection. The log files
generated depend on your configuration.
To view the log files:
On the System Administration page, click Config.
The page for the selected log opens.
Viewing the update history
Each Instant Internet unit maintains a record of the software versions that have
been installed and upgraded.
To view the unit’s update history:
On the System Administration page, click Update History.
The Update History page opens.
Using the BayStack Instant Internet Management Software Version 7.11
308
Appendix A Troubleshooting and error messages
Viewing the system settings file
To view the system settings file:
On the System Administration page, click Config.
The System Settings page opens.
Viewing a unit’s port mappings
To view the unit’s port mappings:
On the System Administration page, click Port Mappings.
The Port Mappings page opens.
Viewing the hosts file
To view the hosts file:
On the System Administration page, click Hosts.
The Hosts page opens.
IP workstation error messages
This information assists you in interpreting and troubleshooting error messages
workstations see when running third-party applications that access the Internet.
IP workstations must be running iiLogin in order for these error messages to be
shown. In addition, the administrator must decide whether or not the workstations
should be shown these error messages. Refer to “Specifying the message a user
sees upon an error” on page 85.
300868-G
Appendix A Troubleshooting and error messages
309
“Your administrator has restricted access to this site.”
The user has attempted to access a site (either by IP address or host name), an
incoming port, or a news group that has been restricted in the either the user
access (time of day, day of week) or in the Internet access controls.
You may also get an access control violation error message if No RAW Sockets
has been specified and you have attempted to ping, trace, or otherwise use ICMP
to access a site.
IPX workstation error messages
This information assists you in interpreting and troubleshooting error messages
workstations see when running third-party applications.
Access errors
Access denied to server [#]
Error 2 indicates the user does not have access to the specified Instant Internet
unit. You can configure the user to access this unit in Admin. For details, refer to
“User access administration” on page 35.
Any other error number indicates a problem with the actual user access file. Make
note of the error number and contact Nortel Networks Technical Support.
Access denied to server [106]
Server access error 106 indicates that version 3.0 workstations are running with a
version 3.1 or 4.0 user/group database. Instant Internet version 6.0 does not
support workstations earlier than version 3.10. You must upgrade your
workstations.
Access restricted to server
Using the BayStack Instant Internet Management Software Version 7.11
310
Appendix A Troubleshooting and error messages
This error indicates that the user does not have access to a specified unit at the
current time. The user must wait until the configured access time before using the
selected Instant Internet unit.
Access denied to server
This error indicates that the user does not have access to a specified unit at the
current time. The user must wait until the configured access time before using the
selected Instant Internet unit.
Error initializing access
An internal winsock.dll problem exists. Note the error number and contact Nortel
Networks Technical Support.
Unable to locate server [#]
Error 1 indicates that the Instant Internet unit specified in the winsock.ini file is
down at this time. Any other error number indicates a problem accessing the
Instant Internet unit. You should note the error number.
The problem might be that the server entry in the winsock.ini file is not a valid
Instant Internet unit name. You might want to enter another unit name and retry
the connection, or, from Program Manager, choose File > Run. Run install /select.
The winsock.ini file is configured with the server name.
Unable to connect to server
In this case, the most typical problem is hardware-related. Be sure to check all
cables to ensure that they are connected properly.
Unable to contact server
300868-G
Appendix A Troubleshooting and error messages
311
In this case, the most typical problem is hardware-related. Be sure to check all
cables to ensure that they are connected properly.
IP address restricted
Incoming port restricted
News group restricted
RAW sockets restricted
Host name restricted
These errors indicate that the user does not have access to the item or area
indicated. The user must be given permission to access that item or area. Refer to
“Defining user and group access” on page 54.
Server name errors
The following error messages indicate that the Instant Internet unit’s name is not
properly configured in the winsock.ini file, or that there is no server= entry in the
winsock.ini file.
No server names
Server name not configured
Server name syntax error
Do one of the following:
•
•
Run the Instant Internet Installation program.
Start the Run program and enter install /select. The winsock.ini file is
configured with the server name.
Winsock.dll errors
The following error messages indicate internal problems with the winsock.dll file.
Note the error number.
Workstation has not been initialized
Error initializing access
To run Internet applications properly, Instant Internet requires the winsock.dll that
comes with the product.
Using the BayStack Instant Internet Management Software Version 7.11
312
Appendix A Troubleshooting and error messages
Version errors
Version error messages typically indicate that the selected Instant Internet unit is
not running the current version of Instant Internet.
Server is wrong version [#]
Workstation is wrong version
Error response from server [#]
Improper response from server
Incorrect response from server [#]
Server did not connect
Instant Internet requires that you install the correct version of Instant Internet
software to the selected unit. Make sure that you have installed the appropriate
software for the selected unit.
Errors connecting to the network
The following errors might occur when Instant Internet tests the network
connection. These messages indicate that the network might not be properly
installed to the local workstation. Note the error number and contact Nortel
Networks Technical Support.
Error determining name
Network not available
Unable to register name
These error messages indicate that a problem exists in your network. They are not
related to your workstation or Instant Internet. Note the error number and contact
Nortel Networks Technical Support.
Network error connecting to server [#]
Network error establishing connection with server [#]
For information about error messages not included in this section, refer to the
online Help.
300868-G
Appendix A Troubleshooting and error messages
313
Common questions and answers
Question: I moved an Instant Internet unit from a Windows NT domain to a
peer-to-peer Windows 95 (or Windows 98 or Windows 2000) network. Now the
Admin utility will not let me delete the old domain users. How can I delete the old
users?
Answer: You must set the access for the old users to the default user. Use the
following procedure:
1
Start the Admin utility.
2
Select the users that you want to delete and then click Change.
3
Select User Access.
4
Click Clear and then click OK.
5
Repeat steps 1 – 4 for Internet Access, News Groups, and Incoming Ports.
6
Clear the Disable, Ignore Group Settings, No Raw Sockets, and No Messages
check boxes.
7
Click OK.
When you clear the View NT Users and Groups check box, the users are
deleted.
Using the BayStack Instant Internet Management Software Version 7.11
314
Appendix A Troubleshooting and error messages
300868-G
315
Glossary
3DES
triple Data Encryption Standard. A 168-bit encryption standard used for VPN
tunneling in Instant Internet. The export of 3DES encryption outside the U.S.
is regulated by the U.S. Government. If you require 3DES encryption, you
must purchase the 3DES Encryption Module (part number CQ1010005).
ACL
Access Control List. The usual means by which access to and denial of
network services is controlled by network security systems. It is a list of the
available services and the hosts permitted to use each service.
address
A unique identifier assigned to networks and stations that allows each device
individually to receive and reply to messages.
AMI
Alternate Mark Inversion. A signal-encoding scheme in which a “1” is
represented alternately as positive and negative voltage. It does not use
translation coding but can detect noise-induced errors at the hardware level.
ANSI
American National Standards Institute.
asynchronous
A method of transmission in which the time intervals between characters are
not required to be equal and signals are sourced from independent clocks with
different frequencies and phase relationships. Start and stop bits may be added
to coordinate character transfer.
AUI
Attachment (or Attached) Unit Interface. A connector on the network adapter
used to connect cables to fiber optic, coaxial, or 10BASE-T transceivers.
Using the BayStack Instant Internet Management Software Version 7.11
316
Glossary
authentication
The process of identifying an individual (usually by username and password)
or system (by an authentication algorithm). When you configure IPsec for a
VPN, you can choose from MD5, SHA, and null.
B8ZS
Bipolar with B-Zero Substitution.
baud
The signaling rate of a line; the number of voltage or frequency transitions per
second.
Bindery
In Novell NetWare products, this is a database that contains information about
all the users, workstations, servers, and other objects recognized by the server.
Instant Internet adopts the information about the users.
BNC connector
A small coaxial connector with a half-twist locking shell.
BootP
bootstrap protocol. A protocol that allows a diskless workstation to boot and
obtain necessary information, such as an IP address.
CES
Contivity Extranet Switch.
CGI
Common Gateway Interface.
CHAP
Challenge Handshake Authentication Protocol. A method of establishing
security on PPP links where the peers must share a plain text “secret.”
The caller sends a challenge message to its receiving peer and the receiver
responds with a value it calculates based on the secret. The first peer then
matches the response with its own calculation of what the response should be.
If the values match, the link is established.
300868-G
Glossary
317
Chargen
A service used for troubleshooting that generates a test pattern (characters) at
the maximum possible rate.
client
A computer system or process that requests a service of another computer
system or process. A workstation requesting the contents of a file from a file
server is a client of the file server.
cookie
A cookie is information saved on your computer’s hard disk that tracks your
activity at a particular Web site and provides information to the server about
your identity and browsing habits.
CRC
Cyclic Redundancy Check. A method for detecting data transmission errors.
CSU
Channel Service Unit. A device that terminates a T1 digital circuit to perform
certain line-conditioning functions and ensure network compliance.
day/time access control
The Day/Time Access Control restricts user access to the Internet on specified
days of the week and/or hours of the day.
DDNS
Dynamic Domain Name Service.
DES
Data Encryption Standard. A 56-bit encryption standard used for VPN
tunneling in Instant Internet.
DHCP
Dynamic Host Configuration Protocol. DHCP. DHCP is an industry standard
intended to ease the burden of configuring TCP/IP computers by providing a
mechanism for allocating network addresses.
Using the BayStack Instant Internet Management Software Version 7.11
318
Glossary
dial-up connection
A temporary, as opposed to dedicated, connection between computers
established over an analog or digital phone line.
DIP
Dual In-line Pins.
Directory Service
A network service that maintains user account information such as user
information, security, access rights, and group membership. Examples of
directory services include NetWare NDS and NT Domain User and Groups.
Discard
A service used for troubleshooting that discards any message or packet sent to
it.
DLL
Dynamic Link Library.
DMZ
Demilitarized Zone (DMZ). A less secure, publicly accessible, network
segment that sits between the Internet and your internal network.
DNS
Domain Name Server or Domain Name Service. Addressing system that
incorporates the domain name into the IP address.
domain name
Used to organize Internet names into manageable groups, such as
nortelnetworks.com or instant.net.
DOVBS
Data over Voice. A technology used to transmit data and voice simultaneously
over twisted-pair copper wiring.
DSL
digital subscriber lines. A type of high-speed communications technology that
supports connections from a telephone switching station to a home or office
over copper wires.
300868-G
Glossary
319
DSU
Digital Service Unit. A device connecting data terminal equipment (DTE) to
digital communication lines, which ensures that data to be transmitted across
the network is formatted correctly.
Echo
A service used for troubleshooting that sends back any message or packet sent
to it.
ESF
Extended Superframe.
Ethernet
A widely used LAN technology defined by the Ethernet and IEEE 802.3
specification.
encryption
A way to achieve data security by translating data into a secret code. To read
an encrypted file, you must have access to a secret key or password that
enables you to decrypt it. When configuring IPsec for a VPN, you can choose
from DES, 3DES, and null.
FAS
Frame Alignment Signal. A distinctive signal inserted within a frame that
helps maintain synchronization.
filtering
The process of examining a data packet on the network and determining the
destination of the data to decide whether the packet should be passed along on
the local LAN, copied to another LAN, or dropped.
FQDN
Fully Qualified Domain Name. The complete combination of the host name,
domain nam and top-level domain. For example: www.NortelNetworks.com.
frame
A unit of data transmission in a local area network, usually Ethernet or token
ring.
Using the BayStack Instant Internet Management Software Version 7.11
320
Glossary
frame relay
A high-speed, packet switching WAN protocol designed to provide efficient,
high-speed frame or packet transmission with minimum delay. Frame relay
uses minimal error detection and relies on higher level protocols for error
control.
FTP
File Transfer Protocol. Protocol that allows a user on one host to access and
transfer files to and from another host over a network. On the Internet, a tool
for accessing linked files.
GMT
Greenwich Mean Time.
host name
A readable name that uniquely identifies a device on the Internet and is
associated with a corresponding IP address. If the IP address is dynamically
assigned by the ISP, the host name can also be dynamically assigned, based on
the actual port accessed each time you make a connection.
host name access control
The host name access control is used to restrict users from contacting
specified hosts by host name. Wildcards may be used to restrict access to
hosts matching general patterns.
HTTP
HyperText Transfer Protocol. A client/server protocol for linking text files to
one another in order to share information on the Internet and the World Wide
Web (WWW).
HTTP proxy (or Web proxy)
Acts as a “go-between” between the requester of pages from an HTTP server
and the Internet.
hub
A physical layer device, connected to other devices, that restores a signal’s
amplitude and timing for transfer across a network. Known as a repeater in
most IEEE 802.3 standards and also called a concentrator.
300868-G
Glossary
321
IAC
Internet Access Control.
icon
A graphic symbol on a user interface.
Ident
A service used for troubleshooting validates the sender of a message or
packet.
indirect host name access control
When IP requests are subjected to host name access controls when the DNS
Proxy forwards the query.
IKE
Internet Key Exchange. A key exchange and security negotiation protocol
IP
Internet Protocol. Part of the TCP/IP suite of protocols. Describes the
software responsible for routing packets and addressing devices.
IP address
Internet Protocol address. A means of communication that allows
communication over the Internet to be directed to the appropriate destination.
Every computer on the Internet must have a unique IP address. IP addresses
are allocated by an ISP in following format: nnn.nnn.nnn.nnn, where nnn is a
numeric value from 0 to 255. IP addressing might be referred to as being static
(fixed) or dynamic.
IP address access control
The IP Address Access Control is used to restrict users from contacting
specified hosts by IP address. Wildcards may be used to restrict ranges of
addresses.
Using the BayStack Instant Internet Management Software Version 7.11
322
Glossary
IPX
Internet Packet Exchange. The Novell NetWare protocol that provides
datagram delivery of messages. IPX facilitates communications between end
stations on geographically dispersed LANs supporting a large range of
applications and provides the network layer functions of addressing and
routing to facilitate communications between a client and a NetWare server.
IPsec
IP security. A method of authenticating encrypted sessions by negotiating an
encryption algorithm and key.
inactivity timeout
An Instant Internet parameter that specifies the number of minutes of
inactivity over the dial-up connection after which Instant Internet terminates
the connection and hangs up the phone. When you need a new connection,
Instant Internet dials the ISP and re-establishes a connection, which takes
about 30 seconds.
interface
A set of instructions that allows one device or protocol to send and receive
data. In the case of Instant Internet, an interface represents the protocol used
to connect to the Internet and might be described as either dial-up or router.
Internet Access Control
IAC. The function that Instant Internet uses to control the times and days
users have access to the Internet and to specific sites, including news groups,
incoming ports, and RAW sockets.
ISDN
Integrated Services Digital Network. An international telecommunications
standard for voice, data, and signaling over digital connections.
ISP
Internet service provider.
ITU
International Telecommunications Union.
300868-G
Glossary
323
LAN
Local Area Network.
Lease (DHCP)
When DHCP allocates an IP address, it “rents” the address to the requesting
client for a period of time called a lease. The lease may be as short as a few
minutes or as long as “forever”. The client can renew the lease or let it expire.
leased-line
A private transmission line (T1, DDS, V.35, or X.21) reserved for the leasing
customer’s sole use.
LED
Light Emitting Diode.
LMI
Local Management Interface.
MAC
Media Access Control. A physical address that is the portion of the data-link
layer in 802.x networks that controls addressing information of the packet and
enables data to be sent and received across a local area network.
MAU
Media (or medium) attachment unit. In token ring networks, a device defined
by the IEEE 802.5 standard that supplies a physical connection to the network
cabling medium and includes circuitry to convert signals between a form
suitable for the network and a form suitable for the station.
MD5
An authentication algorithm used to create a digital signature that uses hash
security to convert a message into a fixed string of digits.
MDI
Multiple Document Interface. Allows an application to have a main window
and any number of child windows.
Medium Dependant Interface: The interface changes depending upon the
medium used.
Using the BayStack Instant Internet Management Software Version 7.11
324
Glossary
modem
(from modulation-demodulation) A device that transmits signals over
telephone lines. It converts binary electrical signals into acoustic signals, and
vice versa.
multilink PPP
An extension to the PPP protocol that enables you to group a set of links into
a bundle for more bandwidth. The links in the bundle can operate at different
speeds. Typical links can be ISDN B channels, dial-up connections, and
leased-lines.
name servers
A means of translating readable host computer names into actual IP addresses
so that you don’t have to remember long numbers to access other computers
and destinations on the Internet. Also called DNS.
NAT
Network Address Translation. The modifying of IP addresses and/or port
numbers as they pass through a router or other such device. There are various
types and implementations of NAT, but Instant Internet provides a
“many-to-one NAT” whereby many internal IP addresses are represented as a
single IP address to the outside world. This method is also sometimes called
PAT, for Port Address Translation.
NDS
NetWare Directory Services. A global naming service used in NetWare 4.x.
NetBIOS
Network Basic Input/Output System. An interface and upper-level protocol
developed by IBM for use with a proprietary adapter for its PC network
product. NetBIOS provides a standard interface to the lower networking
layers. Essentially, the protocol provides higher-level programs with access
to the network.
NFAS
Not-Frame Alignment Signal.
NT1
Network Terminator 1.
300868-G
Glossary
325
NUI
Network User Identification.
ODI
Open Datalink Interface.
OS
Operating System.
packet
A group of bits, including data and control signals, arranged in a specific
format and transmitted as a whole.
PAP
Password Authentication Protocol. A method of establishing security on PPP
links where the caller must provide a password in order to establish the link.
PBX
Private Branch Exchange.
PING
Packet Internet Groper. A program in the Tools application that is useful for
testing and debugging networks. PING sends an echo packet to the specified
host, waits for a response, and reports success/failure and statistics about its
operation.
PFS
Perfect Forward Secrecy. A method of encryption that uses a single key
exchange.
POP
Point of Presence. The (local or long distance) carrier’s switching central
office. For an Internet Service Provider (ISP), a POP is a local number that a
user can call to connect to the ISP.
POP3
The most recent version of the Post Office Protocol, which provides clients
access to e-mail.
Using the BayStack Instant Internet Management Software Version 7.11
326
Glossary
port
A 16-bit identifier that transport protocols use to distinguish between multiple
destinations within a given host computer endpoint.
POTS
Plain Old Telephone Service. The standard phone service that most homes
use.
PPP
Point-to-Point Protocol. Protocol between the terminal and the router. A
communications protocol that provides dial-up access to the Internet.
PPPoE
Point-to-Point Protocol over Ethernet. A type of Internet connection that
enables you to select from a variety of different Internet service providers in
Ethernet-like environments, for example, a cable modem, xDSL, or wireless
environment.
proxy server
A server that acts on behalf of another.
protocol
A formal set of rules developed by international standards bodies, LAN
equipment vendors, or groups governing the format, control, and timing of
network communications.
provider
An Internet Service Provider that offers Internet access and services to its
customers. Access can be provided through dial-up, ISDN, or leased-lines
(T1, DDS, V.35, or X.21). Services include mail, newsreader servers, and ftp
and Web servers maintained on behalf of clients.
raw socket
A type of socket, distinct from TCP or UDP, which provides features required
by certain diagnostics such as “ping” and “trace route.” These programs
require special low-level control of the IP packets, so some administrators
may want to restrict user access to these diagnostics.
300868-G
Glossary
327
relaying
The process of moving data along a path determined by a routing process. The
data is relayed between a source and a destination.
remote (device)
Any network device that is accessible only by means of communication over
a digital or analog (dial-up) network.
RFC
Request for Comment. These documents are the standards for the IP protocol.
RIP
Routing Information Protocol. A distance-vector protocol in the IP suite (used
by IP and IPX network-layer protocol) that enables routers in the same
autonomous system to exchange routing information by means of periodic
updates.
ROM
Read-Only Memory.
router
A device that forwards traffic between networks, based on network layer
information and routing tables. A router decides which path network traffic
follows, using routing protocols to gain information about the network and
algorithms to choose the best route based on a routing matrix.
SA
Security Association. See tunnel.
SHA
Secure Hash Algorithm. An authentication algorithm that uses hash security.
SMTP
Simple Mail Transfer Protocol. A service designed specifically for electronic
mail that functions as a unified post office for addressing mail to all users on
all nodes of wide area and local area networks.
Using the BayStack Instant Internet Management Software Version 7.11
328
Glossary
SNMP
Simple Network Management Protocol. A standard for network management
that uses a common software agent to manage local and wide area network
equipment from different vendors.
SOCKS
An Internet protocol that lets IP client applications connect to the Internet
through a firewall.
SPID
Service Profile Identifier. Used only in North America, SPID numbers are
unique identifier numbers provided by your local telephone company when
you install an ISDN line. Usually, two SPID numbers are provided, but
sometimes one and even none is provided. In many cases, both SPID numbers
are required if you want to connect at a speed greater than 64 Kb/s. A SPID
number is typically 14 digits long and consists of the 10-digit telephone
number (area code plus phone number), followed by the digits “0101.” Other
variations of this number are possible and your telephone company can
provide you with the correct information for your ISDN line.
STP
Shielded Twisted Pair.
subnet mask
A value used to route packets on TCP/IP networks. The subnet mask is
automatically computed based on the IP address and might differ, depending
on whether your installation uses nonstandard subnets. With Instant Internet,
you do not change a subnet mask address unless you are familiar with IP
addressing practices.
synchronous
Signals that are sourced from the same timing reference. Synchronous causes
the interval between successive bits, characters, or events to remain constant
or locked in to a specific clock frequency.
T1
A North American Telecommunications term for a digital carrier facility used
to transmit a DS-1 formatted signal at 1.544 Mb/s.
300868-G
Glossary
329
TCP
Transmission Control Protocol. The major transport protocol in the Internet
suite of protocols providing reliable, connection-oriented, full-duplex
streams.
TCP/IP
Transmission Control Protocol/Internet Protocol. A set of networking
protocols designed to link computers from multiple vendors.
Telnet
A service that provides terminal-emulation capabilities for logging into the
Instant Internet unit from a remote location. For more information about how
to use this service with your Instant Internet unit, refer to Reference for the
BayStack Instant Internet Remote Access Commands Version 7.11.
token ring
A network topology and data signaling scheme in which a special data packet
(called a token) is passed from one station to another along an electrical ring.
A transmitting station takes possession of the token, transmits the data, then
frees the token after the data has made a complete circuit of the electrical ring.
token ring source routing
This option is available only on token ring units and enables the use of token
ring source routing protocol. This protocol is required for operation through
certain types of token ring bridges.
transceiver
See MAU
tunnel
In a virtual private network (VPN), a special connection established between
two sites. Tunnels allow private IP traffic to flow across the Internet
encapsulated within IP packets. Through the tunnel, all IP-based resources
and applications on the remote LAN become available to the local site.
UCT
Universal Coordinated Time.
Using the BayStack Instant Internet Management Software Version 7.11
330
Glossary
UTP
Unshielded Twisted Pair.
VPN
virtual private network. A special type of network connection that permits
remote users or LANs to communicate with another LAN over a public
network, such as the Internet.
WAN
Wide Area Network.
Web cache
A server (or collection of servers) that stores copies of Internet content. The
Web cache server can be either located on the LAN on which the clients it will
serve are also located, or it can be embedded within the enterprise WAN or at
the client’s Internet service provider.
Web configuration
Allows you to configure the Instant Internet unit using a Web browser.
Web proxy (or HTTP proxy)
Acts as a “go-between” between the requester of pages from an HTTP server
and the Internet.
Winsock
A software layer that isolates the network transport protocol from the client
application requesting a network service. Winsock runs only on Microsoft
Windows operating systems and environments.
WWW
World Wide Web.
xDSL
See DSL.
300868-G
331
Index
Numbers
address translation
basic information 33
configuring 134
server publications 135
16-bit winsocks
description 262
using multiple 264
addressing, types of 60
32-bit winsocks
description 263
using multiple 264
Admin
icons 36
overview 35
starting 36, 116, 127
3DES encryption 168
administration program
activating 36, 116, 127
icons 36
overview 35
A
access
errors 309
examples 86
group,defining 55
incoming ports 76
Internet
configuring 61
control list 62
overview 59
news group 70
user
defining 55
disabling 56
view effective 53
adopting users and groups
Bindery 43
NDS 42
NT domain 41
advanced TCP/IP settings 305
aggressive mode 192
alias 159
analog modem 245
access denied message 229
AutoLog
auto run option 110
configuring 110
starting 109
active refresh
about 234
and bandwidth savings 234
and increased response times 208
recommended times 234
statistics 235
automatic logging
activating 109
auto run option 110
configuring 110
deleting a log 112
function 109
automatic user load balance 268
Using the BayStack Instant Internet Management Software Version 7.11
332
Index
B
back up unit configuration 277
backup phone number
adding 245
changing 245
bandwidth
about 207
and active refresh 234
saving 202
saving with Web cache 207
savings, increasing 208
bandwidth savings
and active refresh 234
and cache levels 208
and cache settings 208
and user access 208
increasing 208
cache level
Aggressive 213
and bandwidth savings 208
Conservative 213
default values 213
defined 210
Moderate 213
predefined 209
selecting 209
settings 213
cache server
network layer 201
transparent 201
cache settings
and bandwidth savings 208
experimenting 209
fine-tuning 208
caching proxy server 201
benchmark, establishing for statistics 209
CGI request 219
Bindery, users and groups
move to server 41, 44
overview 43
viewing 43
chargen 288, 301
blocked Web site
and the local cache 229
troubleshooting 236
BootP 150
C
cache
bypassing for a Web site 231
clearing 222
efficiency, increasing 207
filling up 209
increasing response times 208, 234
performance, increasing 207
reasons to bypass 232
client identification,iiLogin 44
client login
basic information 33
identifying the client 274
clients
DHCP, Instant Internet as 157
identifying 274
IP 33, 40, 44, 83, 99, 120, 125, 274
IPX 83, 259, 262, 285
SOCKS 121, 122, 123, 124, 125
configured Web site, defined 224
conflicts, winsocks 262
connections
higher speed 259
simultaneous 258
context, set for NDS users and groups 43
Contivity Extranet Switch (CES) 167
conventions, text 26
300868-G
Index
cookie management policy
benefits 225
establishing 224
recommended 224
cookies
and bandwidth savings 208
and online shopping cart 225
and prompt to log on again 225
blocking for unconfigured Web sites 225
cache action if blocked 225
defined 223
enabling for a particular Web site 226
establishing a management policy 224
managing 223
required 225
viewing for a Web site 230
Custom cache level
available options 213
creating 214
333
directory services
adopt users and groups from 38
Bindery 43
NDS 42
NT domain 41
set user name order 40
discard 288, 301
DMZ
adding a Web server 161
configuring Instant Internet for 161
example, publishing a Web server 163
uses 160
using 160
DNS proxy
basic information 33
configuring 120
domain, set for NT users and groups 39
dual-analog modem 245
bandwidth on demand 247
number of lines 249
customer support 29
Dynamic DNS 135
D
date
changing 286
expiration for an entry 202, 210
Default Network Specification 170
default user, restoring 37
delays, normal 258
DES encryption 168
Dynamic Host Configuration Protocol (DHCP)
configure Instant Internet as DHCP server 152
configuring 149
Instant Internet as a DHCP client 157
leases 149
relay agent 150
scopes 149
E
diagnostic IP tools 288
dial threshold 243, 244, 247, 249
dia-lup connection
backup phone number 246
dial-up connection
bandwidth on demand 247
modem speaker 248
statistics 97
tunnel validity 186
E1 interface, advanced communications 251
echo 288, 301
effective user access 53
encryption
3DES 168
56-bit 168
DES 168
Using the BayStack Instant Internet Management Software Version 7.11
334
Index
entry
active refresh 234
CGI in request 217
cookie in request 217
defined 202
degree of staleness 210
evaluated by cache server 203
exceeded maximum size 217
expiration percent 210
expiration time 211
how expired 202
increasing the number sent from the cache 216
maximum size, determining 218
maximum size, setting 217
minimum expiration time 211
no expiration date 210
no time stamp 210
no-cache header in request 217
non-text 210
number to display, setting 231
outdated 210, 236
query in request 217
refreshing 207, 208
stale 210, 236
text 210
tracking 228
error messages
access errors 309
IP client 308
IPX client 309
network-related 312
server name 311
version 312
Web cache server 212
winsock.dll 311
error, setting the action the cache server
performs 222
Ethernet 149, 257
everyone group, restoring 38
300868-G
expiration percent
about 210
automatically expiring 214
example 211
setting to zero 214
expiration time
about 211
calculating 211
example 212
setting to zero 214
F
fault tolerance 268
filtering
IP 142
winsock compatibility 267
frame type 261
G
groups
access
changing 58
day and time 58
defining 55
examples 86
ignore group settings 57
adding users to a 48
adopt from directory services 38
Bindery groups 43
copying 51, 52
creating 45
deleting 49
display
all 50, 51
users in group 51
users not in group 51
managing 50
moving 48
NDS groups 42
NT domain groups 42
reports 85
Index
H
hang-up threshold 243, 244, 247, 249
hit rate
active refresh 235
increasing 216
statistics 216
home page 204, 306
host connections, troubleshoot 290
host route, tracing 294
host, echo port 297
http proxy
configuring 116, 117
configuring clients to use 119
run transparently 118
I
icons, in administration program 36
ident tool 288
identifying a client workstation 274
ignore group settings 57
iiLogin
client identification 44
identifying clients who don’t use 44
identifying IP clients 44, 274
iisetup
additional support options 288
advanced communication settings 239
dial-up 245
E1 251
ISDN 239
PPPoE 254
T1 249
changing your unit configuration 279
diagnostics 288
IP services
address translation 134
alias 159
DHCP servers 149
IP filters 142
IP forwarding 128, 130
335
RIP 157
static routes 128
using additional 127
IPX 261
multiple-unit environments 267
name server list order 276
PFS 169
Proxy Servers
DNS 120
SOCKS 121
Web 116
proxy servers
DNS 115
SOCKS 115
Web 115
restarting your unit 273
Saving and restoring unit configurations 277
testing connections 289
Virtual Private Network (VPN)
default network specification 170
Instant Internet-to-CES 183
Instant Internet-to-Instant Internet 177
IP addresses 172
mode types 168
Pings 173
troubleshooting 196
using 167
incoming call options 244
incoming ports, defining access to 76
increased response times
and active refresh 234
enabling 208
install.cfg, customizing 267, 268, 269
installing
IP version 31
IPX version 31
multiple Instant Internet units 272
winsocks conflicts 266
Instant Internet unit
adding to list 275
advanced TCP/IP settings 305
as DHCP client 157
Using the BayStack Instant Internet Management Software Version 7.11
336
Index
configuration
backup 277
changing 167, 273
restore 278
date, changing 286
hosts 306
ISP, changing 280
missing from selection list 275
name server list, changing 276
name, changing 285
not in selection list 275
password, changing 284
port mappings 305
registration, changing 283
remote 91
removing from the list 276
restart 273
restore configuration 278
time zone, changing 286
time, changing 286
unit log information 304
update history 305, 307
user information 304
Instant Internet-to-CES VPNs 183
Instant Internet-to-Instant Internet VPNs 177
interface filter 148
Internet access
configuring 61
control list 62
overview 59
Internet addressing, types of 60
Internet connection, testing 290
Internet Key Exchange (IKE) 187
IP addressing, types of 60
IP clients
accessing a DNS proxy 120
accessing the Internet 33
configuring for Internet access 125
error messages 308
identification 40
identifying 99
identifying the login workstation 274
300868-G
system tray addition 44
using RAW sockets 83
IP filtering
function 142
winsocks compatibility 267
IP forwarding
basic information 130
dial-up, ISDN, and Leased-line 132
Ethernet interfaces 132
IP network 32, 36, 116, 127
IP routing, basic information 33
IP security 167
IP services
address translation
configuring 134
function 33
client login 33
configuring 127
diagnostic tools 288
DNS proxy
configuring 120
function 33
IP forwarding 130
enabling 130
IP routing 33
SOCKS proxy
configuring 121, 122
function 33
Web configuration 34
Web proxy
enabling 117
function 34
IPsec
connecting with CES 167
log 197
IPSEC ESP protocol 33
IPX
clients 83, 259, 262, 285
frame types 261
network 32, 36, 116, 127
security 257
Index
ISDN connection
backup phone number 240
bandwidth on demand 243, 244, 247, 249
inactivity timeout 241
incoming calls 244
secondary phone number 241
statistics 97
ISP, changing 280
337
modem
analog 245
dual analog 245
modem speaker, configuring 248
modes
aggressive 168
determining 168
main 168
Monitor utility
activating 93
stats 98
trace function 106
user 101
L
leases, DHCP 149, 156
load balance 268
local cache 203
local IP address
adding for a VPN 172
removing from a VPN 173
log files
connection 57, 110, 113
exporting 113
user 110, 113
monitoring
multiple Instant Internet units 107
real-time 93
starting 93
using 93
move to server, Bindery users and groups 41
multiple Instant Internet units
default sets 269
installing 272
monitoring 107
support 272
using 267
logging
automatic 109
enable 57
M
MAC address 105, 113
N
Macintosh 33, 44
name order, user 40
mail server, add static address 138, 139
name server list, changing 276
maximum entry size
determining 218
specifying 217
name service proxy 33
message, access denied 229
messages, enabling/disabling 85
minimum expiration time
about 211
calculating 211
example 212
setting to zero 214
NDS, users and groups
overview 42
set context 43
viewing 42
NetMeeting 141
Netscape
configure to use Web (http) proxy 119
configuring to use SOCKS 125
Using the BayStack Instant Internet Management Software Version 7.11
338
Index
network
connection errors 312
how Instant Internet functions in 31
IP 32, 36, 116, 127
IPX 32, 36, 116, 127
Network address translation (NAT) 133
network layer cache server 201
news groups, defining access to 70
no-cache header 220
no-cache request 220
non-split tunneling
about 172
configuring 188
non-text entry 210
NT domain, users and groups
overview 41
set domain 39
viewing 42
O
port
control access to 61, 62
in IP address 60
incoming, control access to 76, 77, 79, 81
numbers 60
Web proxy 118
well-known numbers 60
PPPoE connection, advanced
communications 254
preferred server, setting for Netware 44
private server, publishing 136
product support 29
proxy
DNS 33, 120, 124
http 34, 116, 117
SOCKS 33, 121
Web 34, 116, 117
proxy server
another company’s 118
caching 201
transparent 201
out-of-band management 33
publications
hard copy 29
related 27
P
Publishing 139
OS/2 33
password, changing 284
Perfect Forward Secrecy (PFS)
for use with Contivity 185
in Virtual Private Networks (VPN) 185
measuring effect 188
understanding 169
publishing a server
configuring 136
definition 135
dynamic IP addresses 139
NetMeeting 141
static IP addresses 138
phone number, secondary 241
Q
ping
background, controlling connection state 173
control 174
monitor 174
setting options 300
using 292
query request 219
300868-G
Index
R
339
serial number
recording 26
viewing 303
raw sockets
access control 123
error messages 309, 311
in ping and trace 290
where used 83
server publication, Web server 139
server, SMTP 138, 139
registration information, changing 283
relay agent, DHCP 150
remote access commands 33
remote configuration
out-of-band management 33
Telnet 33
terminal emulation 33
remote Instant Internet unit 91
remote IP address
adding for a VPN 172
removing from a VPN 173
reports, generating 85
request
CGI 219
cookie 217
forcing 220
no-cache 220
not served from the cache 216
query 219
special 212
restart, Instant Internet unit 273
restore, unit configuration 278
Routing Information Protocol (RIP) 157
services, IP
address translation
configuring 134
function 33
client login 33
configuring 127
diagnostic tools 288
DNS proxy
configuring 120
function 33
IP forwarding
enabling 130
function 130
IP routing 33
SOCKS proxy
configuring 121, 122
function 33
Web configuration 34
Web proxy 34
enabling 117
Setup utility 115, 127
shopping cart 225, 232, 238
single hit statistics 216
SMTP server 138
SMTP, server 139
SNMP 288
scopes, DHCP 149, 153
SOCKS proxy
basic information 33
configuring 121, 122
secondary phone number 241
SOCKS-enabled applications, configuring 125
Security Association (SA) 187
socksified applications, configuring 124
S
security, IPX 257
selection list, Instant Internet unit not in 275
Using the BayStack Instant Internet Management Software Version 7.11
340
Index
special Web request
about 212, 219
CGI 219
enabling 221
no-cache 220
not sent from the cache 216
options, setting 219
query 219
testing Internet connection 290
split tunneling, about 172
time zone, changing 286
static address translation 135
timeout
definition 243, 248, 300, 301
demand 243
inactivity 97
setting in Stats 97
static routes 128
statistics
active refresh 235
and bandwidth savings 215
hit rate 216
single hit 216
using to fine-tune cache settings 215
viewing 215
Web cache 218
stress
setting options 300
using 297
support options 288
support, Nortel Networks 29
text conventions 26
text entry 210
time
changing 286
expiration for an entry 202, 211
no time stamp 210
token ring 149, 288
tools
ping 292
setting options 300
starting 291
stress 297
trace 294
trace
host echo port 297
host route 294
T
trace in tools
setting options 300
using 295
T1 interface, advanced communications 249
transparent cache server 201
TCP/IP
advanced settings 305
IPX requirements 257
using IP forwarding 130, 132, 133
transparent proxy server 201
TCP/IP, SOCKS and 126
technical publications 29
technical support 29
Telnet 33
telnet
definition 289
templates, for creating users and groups 45
terminal emulation 33
300868-G
troubleshooting
blocked site opens in Web browser 236
cannot configure a personalized Web page 238
empty shopping cart 238
host connections 290
no response 236
outdated Web content 236
prompt to log on again 238
slow response 237
stale Web content 236
Index
tunnel
dial-up environment 186
IKE 187
initiating 186
non-split 172
phase 1 negotiation 187
phase 2 negotiation 187
SA 187
split 172
timeouts 187
troubleshooting 196
validity 186
tunneling
about 167
U
UDP
filter rules
Destination, Ending Port 147
Destination, Port 147
Source, Ending Port 147
Source, Port 147
port access 60
protocol 123
selecting connection type 65, 79
unconfigured Web site
access, blocking 229
cookies, blocking 225
defined 224
unit configuration
backup 277
changing 167, 273
restore 278
unit information
advanced TCP/IP settings 305
date 286
hosts 306
ISP 280
name 285
name server list 276
password 284
port mappings 305
341
registration 283
time 286
time zone 286
unit log 304
update history 305, 307
users 304
UNIX 33, 44
update history 305
user name, not required 306
user name, set order 40
users
access
changing 58
day and time 58
defining 55
disabling 56
effective 53
examples 86
logging 57
adding to a group 48
adopt from directory services 38
Bindery users 43
copying 51
creating 45
deleting 49
display
groups user is in 51
groups user is not in 51
ignore group settings 57
managing 50
moving 48
name order, set 40
NDS users 42
NT domain users 42
reports 85
who don’t use iiLogin 44
wildcard 44
Users, in Monitor 99
Using the BayStack Instant Internet Management Software Version 7.11
342
Index
V
version error messages 312
Virtual Private Network (VPN)
about 167
and CES 177, 183
and Contivity Extranet Switch 177, 183
and DNS proxy server 185
configuration guidelines 183
configuring with non-split tunneling 188
how to use 34
Instant Internet features 167
IPsec 167
local IP address 172
remote IP address 172
troubleshooting 196
volume control, modem 248
VPN
non-split tunneling 172
split tunneling 172
VPN tunnel
disconnecting 98
monitoring 97
statistics 97
W
Web browser
and cookie management 223
local cache 203
Web cache home page 306
Web cache server
as a client 202
as a secondary cache 203
as a server 202
as the only cache 203
fine-tuning 208
status, viewing 205
Web cache statistics
resetting 222
reviewing 218
Web cache,introduction 201
300868-G
Web caching 202
Web configuration
basic information 34
enabling 119
Web entry, defined 202
Web page
content, troubleshooting 236
personalized, troubleshooting 238
Web proxy
basic information 34
configure clients to use 119
configuring 116
run transparently 118
Web server response time, troubleshooting 237
Web site
access information, viewing 230
access, blocking 229, 230
activity details 231
and authentication 232
and login prompt 232
and online shopping cart 232
blocked, troubleshooting 236
cache, bypassing 231
configured 224
cookie information, viewing 230
cookie requirements 226
cookies, blocking 226
host name 227
IP address 227
logon, troubleshooting 238
recently accessed, list of 227
records, displaying 231
request, troubleshooting 236
unconfigured 224
Web site access
activity details 231
blocking 229, 230
policy 228
viewing 230, 231
Web sites list
and bypassed sites 227
sorting 227
Index
343
wildcard user 44
Winsock files 265
winsock.dll, error messages 311
winsocks
16-bit
dll requirements 262
multiple 264
32-bit
dll requirements 263
multiple 264
conflicts 262
installation error 266
IP filtering compatibility 267
Using the BayStack Instant Internet Management Software Version 7.11
">