User manual INTELLINET 516204

Broadband Router User Guide Broadband Router User Guide Dec. 2001 Limitation of Liability Information in this document is subject to change without notice and does not represent a commitment on the part. The material contained herein is supplied without representation or warranty of any kind. Therefore assumes no responsibility and shall have no liability of any kind arising from the supply or use of this document or the material contained herein. This manual copyright© 2001. All rights reserved. No part of this document may be copied or re-used without prior written consent 1Broadband Router About This User Guide Welcome to the Networking world of multifunction routers! Thank you for investing in a Broadband Router. We are dedicated to provide the most efficient, easy to configure, and trouble free equipment in the networking industry. This manual is intended as a basic introduction to your Broadband Router. It supplies enough information to make the Broadband Router operational in most common environments: connecting to the Internet , receiving calls from dial-in users, or connecting to another network through the telephone network. We'll describe how to use your web browser to configure the Broadband Router and to perform some basic operations, e.g. upgrading the software, or viewing the connection log, a task which may be useful in ongoing operations. Finally, we'll tell you how to obtain information and help for subjects that are beyond the scope of this manual. This manual consists of seven chapters and three appendixes: Chapter One: Introduction, explains the features and capabilities of the Broadband Router. Chapter Two: Installing the Broadband Router, gives the simple steps you follow to install the Broadband Router and configure your workstations. Chapter Three: Configuring the Broadband Router, explains how to log in to the ARM Manager, describes the browser screen, and provides the steps needed to configure your Broadband Router for specific applications. It provides easy-to-follow instructions for quick Internet access and provides a guide to the most popular Broadband Router configurations. Chapter Four: Advanced Configuration, provides information on advanced router configuration setup. Chapter Five: Managing the Broadband Router, explains the management features of the Broadband Router. Chapter Six: Messages, lists messages you may see in the ARM message window, and what they mean. Appendix A: Specifications Appendix B: Glossary Appendix C: Warranty, Copyright, FCC Notice Safety Warnings · The Broadband Router is not intended to be serviced by the user. Do not open the case. Contents Chapter 1 Introduction What's in the box? Overview of the Broadband Router Broadband Router Applications Accessing the Internet Accessing Servers from the Public Network Supporting Dial-in Access to Your Network Accessing Internet and Dial-In Simultaneously Creating Your Own Private Wide Area Network Accessing Internet and LAN-to-LAN Simultaneously Creating a Virtual Private Network (VPN) A Configuration Example Security Overview A Physical Look at the Broadband Router The Connectors on the Back The LEDs on the Front Chapter 2 Installing the Broadband Router Installing the Broadband Router Setting Up a Windows PC for Configuring the Broadband Router Connecting more Devices through a Hub to the Broadband Router Chapter 3 Configuring the Broadband Router Internet Access in Five Minutes Using Setup Wizard Overview of The ARM Browser Screen What is a Connection Profile? Internet Access Interface Configuring a Basic Internet Access Profile via EWAN Configuring Auto Backup Configuring a Basic Internet Access Profile via Modem Adding Internet Access Profiles Deleting or Modifying Internet Access Profiles Remote Office Access Advanced Options for Remote Office Profiles Deleting or Modifying Remote Office Access Profiles Dial-in User Access Dial-In User Advanced Options Deleting Dial-in User Profiles Internet Access Time Restrictions Chapter 4 Advanced Configuration NAT(Network Address Translation) Virtual Server/DMZ (De-military Zone) iii Firewall (IP/IPX Filtering) VPN (Virtual Private Network ) Bridging Chapter 5 Managing the Broadband Router System Status Connection Log About System System Upgrade Clear Configuration Reset System Change Password System Time Chapter 6 Messages Messages Appendix A Broadband Router Specifications Appendix B Glossary Appendix C Warranty, Copyrights, FCC Notice Warranty Copyrights FCC Part 15 Notice iv 1Broadband Router 1 Introduction This chapter gives the introduction to the Broadband Router. What' in the Box? s Your Broadband Router box should contain the items listed below · · · 1 Broadband Router 1 AC Adapter, AC 9V 1A 1 RS-232 serial cable with DB-9 (9 pin) male connector and RJ45 plug to connect the Broadband Router Console/COM port and external ISDN TA/ Analog Modem 1 female to female 9 pin adaptor to connect the Broadband Router Console port to a PC COM port. 1 CAT5 UTP cross-over LAN cable to connect the Broadband Router EWAN port to an external ADSL or Cable Modem · · Note: · · Some Cable Modems use straight LAN cable 1 CD-ROM containing the online documentation 1 Quick-Start Guide Overview of the Broadband Router The Broadband Router is a small desktop router that sits between your local Ethernet network and a remote network (e.g., the Internet or a remote office). The Broadband Router contains an EWAN port connecting to an external ADSL/Cable modem , a Console/ COM port for connection to a console device(such as a PC COM port ), and a four-port 10/100Mbps Ethernet switch for connection to PCs on your local network. The Console/COM port can alsobe used to connect to the Internet(as a back-up such as when the ADSL/Cable modem line is not operational) or a remote office via an external ISDN TA or Analog Modem, and even allows a remote user(a tele-commuter or a traveling sales person) to dial in and access your local network. Data comes into the Broadband Router from the local LAN and then is "routed" to the remote network, and vice versa. Broadband Router Applications The main functions of the Broadband Router -to allow devices on your LAN to access the Internet, -to allow access to the servers from the public network, 1-1 -to support remote users to directly dial in and access your LAN, -to support direct dial-up communication with remote offices and share resources between remnote LANs. - to create Virtual Private Network (VPN) to allow remote LANs to share resources with each other over the Internet. Accessing the Internet The most common use for the Broadband Router is to provide Internet access, so that everyone on your LAN can surf the web and send/receive email or files. The Broadband Router automatically acquires the necessary IP address when the connection to the Internet is established. You don't need to apply for and assign an IP address to each PC or workstation on your network. Accessing Servers from the Public Network If you want special servers to be accessible by remote users across the Internet (e.g., an e-mail server, an FTP server, or a web server), you can configure the Broadband Router to proxy the service from its own address. This means that the remote user can address the router as if it were the special server and the Broadband Router will redirect this connection to the appropriate computer on the network. Supporting Dial-in Access to Your Network You can set up your Broadband Router to allow users to connect to your network and share resources from home or while they're travelling. The Broadband Router built-in configuration program makes the necessary setup a snap. As a security feature, after a user calls in, the Broadband Router can hang up and call that user back at a preconfigured telephone number. Figure 1-1 Dial-in Access You can set up the Broadband Router to provide Internet access for everyone on your LAN and allow a remote user to dial in to your network via V.90 Modem or ISDN TA simultaneously. 1-2 Figure 1-2 Internet Access and Dial-in Simultaneously Creating Your Own Private Wide Area Network You can create your own private wide area network with Broadband Router via external ISDN TA / modem and allow two or more remote networks to connect to one another and share resources. The remote network can use a broadband router even though it is a different vendor - as long as it also supports LAN to LAN communications. Figure 1-3 Connecting Two Networks with Broadband Router You can set up the Broadband Router to provide Internet access for everyone on your LAN and create your own private wide area network via V.90 Modem or ISDN TA simultaneously. 1-3 Figure 1-4 Internet Access and LAN-to-LAN Simultaneously Creating a Virtual Private Network (VPN) Virtual Private Networking (VPN) provides a means to connect remote LANs over the Internet, while only local toll charges to an Internet Service Provider are incurred even if the two LANs are physically remote to each other. To create a VPN between two sites, a special connection called "tunnel" followed by a VPN data session has to be set up over the Internet. After a VPN data session is set up, data can be sent over it, optionally encrypted to prevent unauthorized access. Additionally, VPN tunnels allow IP, IPX and Bridging traffic to flow across the Internet, including NetBIOS information (for Windows networking) encapsulated within IP or IPX packets. All information required for a VPN is defined in a VPN profile, which contains, for example, the IP address of the VPN partner and authentication information (including the encryption key that is used). When a PC from one site tries to communicate with a device on the other site for the first time, the VPN tunnel and data session establishment process will be triggered automatically. For the originating side, first the destination IP address will be used to search for the corresponding VPN profile. Based on the information conifgured in the matched VPN profile, a VPN tunnel is created, a VPN data session will be created and authentication information exchanged, then data traffic can start to flow. For the destination side, when a VPN data session creation is requested, the router will base on the originating IP address to search for a matched profile. Once found, the Broadband Router will use the information in the matched profile to authenticate the incoming "call", after which data transfer can begin. More than one VPN data sessions can be established over the same tunnel. See chapter 4 for detailed configuration instructions. 1-4 Figure 1-5 Creating a Virtual Private Network A Configuration Example In Figure 1-6, two Broadband Routers are installed in two different locations. They are connected to the Internet via ADSL/Cable modem, allowing users to surf the Web. They are also connected to each other through the telephone network, forming a private company network. Figure 1-6 Connecting Two Private Networks This example illustrates an important feature of the Broadband Router: a private device can be accessed from the Internet by mapping the application port number to a port number on the Broadband Router. In this case, an Internet user accesses a web server with IP address 206.112.113.6, which is the Broadband Router' IP address. s When properly configured, the Broadband Router will translate that port 80 of that address to port 80 of the private IP address, 192.168.168.112. In this example, all devices on both LANs (except for the Web servers) are configured to obtain their IP addresses automatically (i.e., from the built-in DHCP server in the Broadband Router). It is important for the Web Server on LAN #1 to have the same IP address all the time (so that users can use the same IP address to access it), it also means the Broadband Router should also be assigned a static IP address. IP addresses assigned to the devices on the LAN are only used in the local LAN environment (with default IP network address of 192.168.168.0), therefore these devices naturally form a private network and are not accessible by users across the Internet, unless they are mapped. It is still possible to assign public IP addresses obtained from your ISP to devices on your LAN so that they can be accessed by users 1-5 across the Internet. These public addresses can co-exist with private IP address on the same LAN. In order for LAN to LAN communication to work in such configurations, the default private network Broadband Routeraddress (192.168.168.0) for one of the above Broadband Router has to be changed (to 192.168.170.0 in the above example). The traffic between these two networks is secure because data are sent across the telephone network via a direct phone call. A Security Overview More and more people are concerned about security of their data in the Internet The Broadband Router provides many ways to help make your network and your data secure: · · · · · · All dial-in users and LAN-to-LAN communications require PPP PAP/CHAP/ MS-CHAP authentication (basically user name and password) The Broadband Router also supports call-back for dial-in users - so that remote user are really who they say they are The Broadband Router uses a private IP addressing scheme to prevent devices on your LAN from access by outside users Console, Telnet and ARM support password protection DES encryption with PPP/ECP negotiation is supported for VPN connections IP packet filtering may be used to futher enhance security requirements A Physical Look at the Broadband Router The Connectors on the Back The following illustration shows the rear panel of Broadband Router. (1 )4 RJ-45 10/100 Switch connectors for connecting to PCs and workstations or connecting external Ethernet hub, or switch with uplink switch on port 1. (2) 1 RJ-45 EWAN connector for connecting to Internet via ADSL/Cable modem (3) 1 RJ-45 connector to be a COM port connecting to external ISDN TA/ modem or to be a Console port connecting to PC. (4) 1 AC power connector for connecting through an AC power adapter (included as part of the product) to the wall power outlet (5) 1 power ON/OFF switch 1-6 Figure 1-7 Broadband Router Connectors The LEDs on the Front There are 20 LEDs on the front of the Broadband Router that show connection and traffic status of Power, PPPoE, COM, EWAN and LAN ports: Figure 1-8 LEDs LAN LED1 FDX/CO L ON FDX LED2 LNK/AC T Physical No Physical OFF HDX Linkage Sending or FLASH Collision Receiving N/A Receivin g Data 10Mbps No Data 100/10 RX N/A LED3 LED4 COM LED5 TX N/A LED6 CD Carrier Detect No No Data Carrier On-Hook LED7 OH Off-Hook EWAN LED8 ACT/ LINK N/A COL Physical Linkage No Physical N/A Sending or Linkage LED9 POWER LED10 PPPoE PPPoE Linkage No PPPoE Linkage Sending or Receiving N/A Packet Linkage 100Mbps Sending Data N/A N/A Receivin g Packet Note: Some of the features above are optional. Please refer to Appendix A for the details. 1-7 2Broadband RouterBroadband Router 2 Installing the Broadband Router Now you should be ready to connect your Broadband Router devices on your LAN . Follow these steps to install the Broadband Router: Step 1 Connect ADSL/Cable modem to the Broadband Router EWAN port using crossover CAT5 UTP LAN cable. Some Cable Modems use straight LAN cables Note: Step 2 Connect a PC/Workstation to one of the LAN ports of the Broadband Router, such as port 1 or port 2 (using a straight or cross-over LAN cable, respectively). See below for more details of how to connect to an external repeater hub or LAN switch. Connect the AC adapter to the Broadband Router and an electrical outlet. Step 3 Figure 2-1 Broadband Router Connectors 2-1 Setting Up a Windows PC for Configuring the Broadband Router This section describes how to configurea PC on the LAN in order to communicate with the Broadband Router. The PC need to have an Ethernet interface cards installed, and be connected to the Broadband Router either directly(to its LAN ports) or indirectly through an external LAN hub or switch. It should also have TCP/IP installed, enabled, and configured to obtain an IP address automatically(i.e., through a DHCP server). If TCP/IP is not already installed, follow the steps below for its installation. Note: Any TCP/IP capable workstation can communicate with the Broadband Router. To configure workstations other than Windows 95/98/NT, please consult the manufacturer' documentation. s Step 1 Connect your PC to one of the Broadband Router Switch ports. If you connect to LAN port 1, you should use a straight LAN cable and set the Uplink switch to the Normal position. or use a crossover LAN cable and set the Uplink switch to Uplink. See Figure 2-3.. From the Win95/98 Start Button, select Settings, then Control Panel. The Win95/98 Control Panel displays. Double-click on the Network icon. Step 2 Step 3 Step 4 Check your list of Network Components in the Network window Configuration tab. If TCP/IP has already been installed, go to Step 8. Otherwise, select Add to install it now. Installed components Look for TCP/IP Add button Client for Microsoft Networks 2-2 Step 5 Step 6 In the new Network Component Type window, select Protocol. In the new Select Network Protocol window, select Microsoft in the Manufacturers area. Select Microsoft Select TCP/IP Step 7 In the Network Protocols area of the same window, select TCP/IP, then click OK. You may need your Win95/98 CD to complete the installation. After TCP/IP installation is complete, go back to the Network window shown in Step 4. Select TCP/IP in the list of Network Components. Click Properties, and check the settings in each of the TCP/IP Properties window: Step 8 Step 9 TCP/IP Properties Tabs (IP Address Tab shown) -Bindings Tab: both Client for Microsoft Networks and File and printer sharing for Microsoft Networks should be selected. -Gateway Tab: All fields should be blank -DNS Configuration Tab: Disable DNS should be selected -IP Address Tab: Obtain IP address automatically should be selected Step 10 When the Broadband Router connected to the LAN (and powered on), reboot the PC. After the PC is re-booted, you should be ready to configure the Broadband Router. See Chapter 3. 2-3 Connecting more Devices through a Hub to the Broadband Router The Broadband Router provides four LAN ports to allow up to four PCs or Workstations to be connected to it directly. If you want to connect more devices, you can connect an external hub or switch to LAN port 1 using a straight LAN cable if the Uplink switch is set to the Uplink position, or using a cross-over LAN cable if the Uplink switch is set to the Normal position. Figure 2-2 Connecting a Hub or Switch to the Broadband Router The uplink switch is shown in the following picture. Figure 2-3 Uplink Switch 2-4 30Broadband Router 3 Configuring the Broadband Router Once you have completed the installation stage and have configured a PC properly as described in chapter two, you are ready to configure the Broadband Router for actual applications. This chapter describes how to configure your Broadband Router for basic Internet access. Internet Access in Five Minutes You can configure your Broadband Router quickly by the Setup Wizard at you first time logging on the router. Setup Wizard The Wizard will lead you step by step to configure the router for your Internet Access by connecting ADSL/Cable modem. You can change your Internet Access configuration by clicking the Setup Wizard item on the top of left side in ARM(Access Router Manager) menu. 1. Open your browser and type http://192.168.168.230 in the browser' address s box, it is the default IP address of your router. 2. Logging On After entering the default IP address as described above, a password prompt screen will ask you to log on. If you are logging on for the first time, you should accept the factory default password (which is "password"). The password is always displayed as a string of asterisks ("*"). Clicking the Log On button will begin a Access Router Manager (ARM) session. The next time you log in, even if you have modified the password , the default password ("password") will still be used as the default. You need to change it to the correct password before you will be let in. No matter what password you use, each character will always be displayed in the logon prompt as a "*". If you forget the password, you need to follow steps described in chapter 5 to be able to log on. 3-1 3. Enter your ISP information There are 4 ways to connect to your ISP, these 4 methods can be found in the "Obtain IP Addresses" section, they include: (1) Static (2) via DHCP (3) via PPP over Ethernet (4) via PPTP (1) Some ISPs may give you a static IP, if this is the case you'll need to select Static in Obtain IP addresses and set the following settings. After you finish your settings, please click Save. Enter the following information: The file name "df_profile" is the default file name of your Internet Access connection which is configured by Setup Wizard. Obtain IP Addresses: The method you want to connect to your ISP. EWAN IP Address: The IP Address of your EWAN. 3-2 EWAN IP Netmask: The IP Netmask of your EWAN. ISP Gateway IP Address: The IP address of your ISP Gateway. (2) If your ISP will automatically give you an IP address(Cable connections), select via DHCP the following screen will appear. Please enter the following information: Obtain IP Address: via DHCP(will automatically get an IP from your ISP for you), (Optional) Host Name(System Name): The Host Name provided by your system. (Optional) Clone MAC: If you want to assign the router a cloned MAC address, please select enable. (Optional) MAC Address: Input the MAC address that the ISP requires to establish a connection. Note: Some ISPs require a specific MAC address in order to establish a connection. (3) Some ISP' require the PPPoE protocol in order to connect to the Internet. If s you choose via PPP over Ethernet the following will appear. Please enter the following information: 3-3 Obtain IP Addresses: Some DSL-based ISPs use PPPoE to establish communication with end-users. ISP Account Name: The user name of your ISP account. ISP Account Password: The password of your ISP account. (Optional) Service Name: The Service Name provided by your ISP, if one is required, otherwise, leave it empty. (Optional) Access concentrator Name: The Access Concentrator Name provided by your ISP, if one is required, otherwise, leave it empty. Idle Timeout (0-3600 seconds): The default value of the idle timeout is 120 seconds, which represents the number of seconds of inactivity over the connection. When this value is reached, the Broadband Router will disconnect the call. You can change the idle timeout value to anything between 0 to 3600 seconds. But if you select 0, the connection will never be timed out. (4) Some ISP' require the PPTP protocol in order for you to connect to the Internet. s If you choose via PPTP the following screen will appear. Obtain IP Addresses: Some DSL-based ISPs use PPTP to establish communication with end-users. (Optional) Host Name(System Name): You can give your router a name. PPTP local IP Address: IP address of Broadband Router for the PPTP connection. Consult your ISP for this information. check with your ISP to see if PPTP is used. PPTP IP Netmask: IP network mask for the PPTP Tunnel. Consult your ISP for this information. PPTP Remote IP Address: IP address of the ISP for the PPTP Tunnel. consult your ISP for this information. ISP Account Name: The user name of your ISP account. ISP Account password: The password of your ISP account. Idle Timeout (0-3600 seconds): The default value of the idle timeout is 120seconds. It represents the number of seconds of inactivity over the connection. When this value is reached, the Broadband Router will disonnect the connection. You can change the 3-4 idle timeout value to anything between 0 to 3600 seconds. But if you select 0, the connection will never be timed out. Overview of The ARM Browser Screen Before you begin the configuration, take a moment to look at the ARM screen. AAARM Menu AAMessage Window AAConfiguration Window ARM Menu This part of the browser screen contains items you can click to display the various screens for configuring your Broadband Router, including EWAN, connection profiles, and protocols, as well as system monitoring, tools, and help. Configuration Window This is the window where the actual configuration screens appear. Before any selection of the configuration is made, the window shows a picture of the Broadband Router with cables and peripheral devices that can be connected to it. Message Window Whenever appropriate, the Broadband Router will display system status or error messages in this window. For example, when you try to connect to the Internet, if you had configured your password incorrectly, the message window will display an appropriate message. 3-5 What is a Connection Profile? To access the Internet, you need to apply for an account with an ISP (Internet Service Provider), who will provide you the ISP Account name and ISP Account Password that you need to call, as well as phone number if necessary to dial-up to your ISP. You need to enter such information into a "connection profile" in the Broadband Router. Likewise, a connection profile needs to be created for each dial-in user, each remote office, or each VPN user. Essentially, a connection profile contains all information that the Broadband Router needs to access the Internet, or support a remote dial-in user, or set up a connection with a remote office, or create a VPN. Such information includes dial-up phone numbers, authentication information (the local user name and password and possibly the remote site user name password), plus other information that may be required for the communication. Configuring an Internet Access Profile (via EWAN) To configure an Internet access connection profile, from the ARM menu, press Connection Profiles. If there are no other profiles at this point, you will immediately enter a profile configuration screen. First decide what interface to use for Internet access. Selecting Internet Access Interface Either EWAN or Modem can be used for Internet access. If you select the EWAN port, you need to connect the EWAN port to an external ADSL/Cable Modem. If you select the Modem interface, you need to connect the COM port to an external ISDN TA/Analog Modem. Now select Internet Access as the Access Type , then press Enter, which will cause the following screen to show. There are 4 ways to obtain an IP Address for your router, including via PPP over Ethernet, via DHCP and "Static", "PPTP". Please refer to the configuration in Setup Wizard. Configuring Auto Backup When the primary connection(ADSL/Cable) is down, the system will attempt to set up the backup external ISDN or modem connection automatically. Only when the backup connection disconnects(or idle timeout), then the router will attempt to establish primary link again when there is user traffic to send. Step 1 Configuration Profiles -- Internet Access: df_profile 3-6 Step 2 Select the Backup. Step 3 Key in the following information. Remote Phone Number: the telephone number of your ISP. ISP Account Name: the username of your ISP account. ISP Account Password: the password of your ISP account. You can delete the backup profile by clicking Delete. Step 4 Aftern configuration, please click OK, and then click Save, to save you configuration. You will see the your backup profile added in the Profile Summary. 3-7 Configuring a Basic Internet Access Profile( via Modem) Except ADSL/Cable modem, you also can access Internet via V.90 or ISDN modem. The following screen show you the interface configuration via Modem. Please select Internet Access, and click Next . The following screen will appear. 3-8 Step 1 Enter the following information: Profile Name: the name that you will use to identify this Internet access profile. Remote Phone Number: the telephone number of your ISP. ISP Account Name: the username of your ISP account. ISP Account Password: the password of your ISP account. Step 2 Click Advanced to get to the screen as below: STAC Compression: allows outgoing data to be compressed to achieve higher throughput, and compressed incoming data to be recognized. The ability to use compression depends on the capabilities of the ISP. Idle Timeout(0-3600): This is where you specify the idle timeout The default value of the idle timeout is 300 seconds. It represents the number of seconds of inactivity over the connection: when this value is reached, the Broadband Router will disconnect the call. You can change the idle timeout value to anything between 0 to 3600 seconds. But if you select 0, the connection will never time out. After you make the change, click OK. You will are returned to the previous screen Step 3 Click Save and Test Note: When you click Save and Test, the Broadband Router attempts to place a call to your Internet Service Provider. Watch the Message Window for any messages. If the test is successful, your users will be ready to access the Internet. If not, the Broadband Router will try to give you enough information to let you know why the connection is not successful. If Save and Test is successful, users on your LAN can now start to access the Internet. However, it is required that these devices have also been configured to obtain IP addresses automatically, as described in Chapter 2. Users may need to reboot their computers in order to obtain the DNS information obtained during the Save and Test operation. Adding Internet Access Profiles Step 1 If you want to add additional Internet access connection profiles, you need to select Connection Profiles from the ARM Menu: 3-9 Configuration - Connection Profiles: Then the following screen will show: You should highlight New in the list, and then click NEXT, which will lead you through the configuration as above. Deleting or Modifying Internet Access Profiles To delete or modify a Connection Profile: Step 1 Select Connection Profiles from the ARM menu. Configuration - Connection Profiles The following screen will appear. Step 2 Highlight the entry in the list, and click DELETE to delete the profile, or click NEXT to modify the profile, in which case the same screen as configured previously will appear. 3-10 Remote Office Access In order for the local LAN to access a remote LAN, you need to configure a remote office access connection profile for the router on each site (the remote router and the local router). Note that the remote site does not have to have a Broadband Router, and may not be configurable by the local administrator. In either case, make sure the configuration of the Broadband Router matches the requirements of the remote site. Note: You need to change the private IP network when you want to create a private WAN with your remote offices (without using public IP addresses), so that all LANs in the private WAN will have IP addresses on a unique network. It is not necessary to modify the private IP address if you do not intend to communicate with other private networks such as a remote office. Step 1 Select Connection Profiles from the ARM menu: Configuration - Connection Profiles Please select Connection Profiles, the Interface Configuration screen will appear. Step 2 Click NEXT to continue. The following screen appears. 3-11 Profile Name: the name that you will use to identify this profile. Call Direction: If the remote site will be dialing in only, select Incoming. If the Broadband Router will only be dialing out to the remote site, select Outgoing. Select Both if either side can initiate the connection. The default setting is Both. Depending on the direction selected, some of the fields will not be displayed. Call Back: specifies the call back option, either Yes or No. If Call Back is enabled (select Yes), the Broadband Router checks the Remote Account Name and Remote Account Password. If authentication passes, the Broadband Router disconnects the incoming call, and calls theremote site back using the number specified in the Call Back field. If Call Back is not set (Select No), the Call Back Number field will not be displayed. If the Call Direction is Outgoing only, Call Back options are not displayed. Remote Phone Number: the phone number of the remote router connected to the remote LAN. My Account Name: the name that the remote system will use to authenticate the local system. My Account Password: the password of the remote system will use to authenticate the local system. Remote Account Name: the name of the remote system. Remote Account Password: the password that the local system will use to authenticate the remote system. Note: Make sure the remote site is configured with your Account Name and Account Password. Step 3 Click Save and Test or go to "Advanced Options for Remote Office Profiles", shown below for more choices. 3-12 Note: When you click Save and Test, the Broadband Router attempts to place a call to the remote LAN and log in. Watch the Message Window for any messages. Advanced Options for Remote Office Profiles Step 1 Key in the following information: STAC Compression: allows outgoing data to be compressed to achieve higher throughput, and compressed incoming data to be recognized. The ability to use compression depends on the capabilities of the ISP Idle Timeout: the number of seconds of inactivity over the connection. When this value is reached, the Broadband Router will disconnect the call. You can set the idle timeout from 0 to 3600 seconds. The default setting is 300 seconds. If you select 0, the connection will never time out. Enable IP: select Yes to allow IP routing over a connection using this profile IP RIP: enable or disable IP Routing Information Protocol. IP RIP Version: select RIP-I if the Routing Information Protocol, version 1 is to be used, or RIP-II if the Routing Information Protocol, version 2 is to be used for this connection. Note: The use of RIP-I or RIP-II depends upon the System-wide setting of RIP. If the system-wide setting is Disable, the RIP setting for all connection profiles will be disabled. If the system-wide setting is RIP-I, only RIP-I may be selected in any profile. If the system-wide setting is RIP-II, either RIP-I or RIP-II may be selected in any individual profile. 3-13 Set as IP Default Route (e.g., for Internet Access): select Yes if you want users on your local LAN to get their Internet access through a connection to the remote LAN or if this connection is to be used to locate an IP resource not otherwise defined in the IP Routing Table. If Yes is selected, the Remote IP Address and Netmask fields do not appear. Note: If you allow Internet access in this manner, make sure you do not have any Internet Access configuration profiles set up on the Broadband Router. Remote IP Address: the IP address of a destination computer on a network reachable through this connection. Remote IP Netmask: the IP subnet mask of the Remote IP Address Enable IPX: select Yes to allow IPX routing over a connection using this profile IPX RIP/SAP: enable or disable IPX Routing Information Protocol and Service Advertising Protocol. Set as IPX Default Route: if this parameter is set to Yes, then the Broadband Router uses this connection if no other route for an IPX packet can be found in the routing table. Remote IPX Network Number: the IPX network number of a network reachable through this connection. If you set this connection as the default IPX route, an entry in this field is not required. Enable Bridging: select Enable to bridge other protocols, for example, SNA, Appletalk, and NetBEUI. Deleting or Modifying Remote Office Access Profiles To delete or modify a Connection Profile: Step 1 Select Connection Profiles from the ARM menu. Configuration - Connection Profiles The following screen appears. Highlight the entry in the list you want to delete or modify, and click DELETE to delete the profile or click NEXT to modify the profile. Dial-in User Access Step 1 Select Connection Profiles from the ARM menu: Configuration - Connection Profiles 3-14 Information about each dial-in user who is allowed access is stored in a "connection profile." When you select Connection Profiles, the Connection Profile Summary screen appears only if you have existing Connection Profiles The following screen appears. Step 2 Highight the New and click the Next. You may see a screen as the following: Step 3 Select Modem as the interface, then select Single User Dial-in from the list of access types. 3-15 Step 4 Click NEXT to continue and display the following screen. Step 5 Enter the following information: Profile Name: a name that you will use to identify this profile. Call Back: sets the call back option. If selected, the Broadband Router disconnects after authenticating the dial-in user, and dials the remote user' call back phone number to reconnect. s Call Back Phone Number: the number the Broadband Router calls if Call Back is Yes. This field will not appeare if Call Back is not selected. User Name: the username that is dialing in. User Password: the password for the remote dial-in user. Note that Authentication is CHAP,MS-CHAP (MicroSoft Challenge Handshake Authentication Protocol) or PAP (the Password Authentication Protocol). CHAP,or MS-CHAP will be first tried to authenticate the incoming call, and if that fails, PAP will be used. Step 6 Click Save to add the connection profile to the Broadband Router database, or select ADVANCED for more options. 3-16 User Dial-In Advanced Options STAC Compression: allows outgoing data to be compressed to achieve higher throughput, and compressed incoming data to be recognized. The ability to use compression depends on the capabilities of the ISP Idle Timeout: the number of seconds of inactivity over the connection. When this value is reached, the Broadband Router will disconnect the call. You can set the idle timeout from 0 to 3600 seconds. The default setting is 300 seconds. If you select 0, the connection will never time out. Enable IP: select YES to allow IP routing over a connection using this profile Dynamic IP Assignment: Suggest you choose Yes to get IP address automatically. If you coose No, you have to set a static IP address by Dialer IP Address and Router IP address. Dialer IP Address: Please key in the private IP address reserved for the dialer. Router IP Address: Please key in a private IP address for the router, not the default IPaddress. e.g. 192.168.168.1. Enable IPX: select YES to allow IPX routing over a connection using this profile Dynamic IPX network Number Assign: sets the IPX network number as a random or manually. Remote IPX Network Number: sets the IPX network number on the remote workstation. If you set "YES" for the Dynamic IPX network Number , this field is not displayed. Enable Bridging: select Enable to bridge other protocols, for example, SNA, Appletalk, and NetBEUI (or IP and/or IPX if they are not routed) To add additional dial-in profiles, repeat steps 2 through 7. To modify an existing dial-in profile, select the corresponding profile name in Step 3 instead, which will lead to Step 5 directly. 3-17 .Deleting Dial-in User Profiles To delete a Connection Profile: Step 1 Select Connection Profiles from the ARM menu. Configuration - Connection Profiles The Connection Profile Summary screen appears. Highlight the entry in the list you want to delete, and click DELETE. 3-18 Internet Access Time Restrictions For cost, security and efficiency reasons, you may want to adjust the times when the Broadband Router will be allowed to automatically connect to the Internet. A simple setup screen is used to enter the days of the week and the hours of the day during which Internet access is allowed. The Broadband Router will not connect to the Internet outside of the configured times. In order for this feature to be effective, the Broadband Router must be configured for the current local time. To do this, see the section, "Setting the System Time", above. Note, however, that if for some reason the Broadband Router is reset or powercycled, the previous time setting will be lost. Until you once again set the time, the Broadband Router will either allow Internet access or not, depending upon a setting which is configured below. To view or change Internet access time restriction settings, select Internet Access Time from the menu: Configuration - Internet Access Time The following screen is displayed: Step 1 Set the days of the week during which Internet access is allowed. Select Day Range if you want to specify a range of days. If you select All, Internet access will be allowed every day. Set the time during which Internet access will be allowed. Not that this setting is based upon a 24 hour clock. Select Time Range to enter a consecutive period of time between which Internet access is allowed. If you select All, Internet access will be allowed from midnight to midnight on the days selected in Step 1. Enter the default setting for Internet access if the router is power-cycled or reset. If you enter "Yes" (the default), then Internet access will be allowed unconditionally until the clock is set. If you enter "No", then Internet access will not be allowed until the clock is set. Click Save to enable your settings. Step 2 Step 3 Step 4 3-19 4Broadband Router 4 Advanced Configuration NAT(Network Address Translation) NAT let you share one public IP address to lower ADSL/Cable cost for your Internet access. You can use the IP/DHCP screen button from the ARM(under Advanced) menu to enter a public IP address, modify the private IP address, modify or enter DNS addresses configure WINS addresses and node type or enable/disable the DHCP service. Step 1 Select IP/DHCP from the ARM menu: Configuration - Advanced IP/DHCP Then the following screen displays: Step 2 Enter the following information: Note: To install publicly addressed servers on your network (e.g., Web or ftp servers), you need to apply for an IP address for each server plus one for the LAN port of the Broadband Router. All these public IP addresses have to belong to the same IP network. 4-1 Public IP Address: the public IP address for the LAN interface on the Broadband Router. Internet Modem or EWAN Interface (IP address usually assigned by ISP) LAN Interface Public IP address Private IP address Public computers on your public network Private workstations on your private network Public IP Netmask: the network mask for the public network address on your LAN. Private IP Address: the private IP address for the LAN interface on the Broadband Router. The default private IP address is 192.168.168.230. If you want to create your own private network through other Broadband Router at remote office locations, you need to make sure that each Broadband Router on each LAN is assigned an address in a unique private IP network . Note: If you use a PC (that obtains an IP address automatically) to change the private IP address (e.g., from the default of 192.168.168.230 to 192.168.167.230) either from the browser or through a telnet session, right after the change is made, you will no longer be able to communicate with your Broadband Router. To reconnect, you need to re-boot your computer, so that your device will reacquire a new IP address and the default Gateway from the Broadband Router based on the new private IP network address. Your device will then again be able to communicate with your Broadband Router. For the same reason, all devices on the LAN need to be restarted before they can access the Internet again. Private IP Netmask: the network mask for your private network. Its value is 255.255.255.0 and can be changed. The Broadband Router private address of 192.168.xxx.yyy is called a "Class C" IP address. This means that changing xxx will change the network while changing yyy will assign a different address in the same network. Primary DNS IP Address: the IP address of the primary Domain Name Server (DNS). If properly configured, when a computer re-boots and acquires the IP address from the Broadband Router, the IP addresses of both the primary and the secondary DNS server will be provided to requesting client workstations. This field will reflect the DNS addresses acquired from the ISP and will be used to assign to requesting DHCP clients (see below). You may change this address if you want another address to be assigned instead. The Broadband Router will save any 4-2 manually configured DNS addresses. Secondary DNS IP Address: the IP address of the secondary Domain Name Server. Note: When a Broadband Router connects to the ISP, it will automatically be assigned the IP address of a primary Domain Name Server (DNS), as well as the IP address for a secondary DNS. DHCP: you can enable or disable the DHCP server feature provided by the Broadband Router. If you want the Broadband Router to act as a DHCP server and assign private IP addresses to requesting DHCP clients, you need to enable the DHCP (this is the default). When enabled, the Broadband Router will provide an IP address, network mask, gateway' IP s address (the Broadband Router' private IP address), DNS addresses, the s WINS server IP address, and Window' node type to clients on the LAN s making DHCP requests. Note: Devices that require public IP addresses on your network are by definition not DHCP clients. Therefore, you need to assign their IP addresses, network mask, default gateway' IP address, primary and secondary DNS IP s addresses manually. Configure WINS Server: select Yes if you want the DHCP server to assign WINS Server addresses and NetBIOS Node Type. This will cause the following fields to appear. Primary WINS Server: enter the IP address of a WINS Server to be assigned to a requesting DHCP client. Secondary WINS Server: enter the IP address of a second WINS Server to be assigned to a requesting DHCP client. NodeType: select a NetBIOS Node Type to be assigned to a requesting DHCP client. For a definition of these node types, consult your Microsoft documentation b: Broad cast p: Peer to Peer m: Mix-node h: Hybrid IP Address Assignment - High: Addresses are assigned dynamically to DHCP clients and dial-in users from the range of private addresses as defined by the IP Address Assignment - High/Low. The high address defaults to the highest address in the subnet. This is adjustable by the administrator using this configuration item. If the private network is reconfigured outside the current range, the dynamic assignment range is reset to default values. IP Address Assignment - Low: This is the lower end of the dial-in single user address assignment range described above. This range defaults at the low end to the high address minus 253. This is adjustable by the administrator using this configuration item. 4-3 The IP Routing Table The IP routing table contains all the information that the Broadband Router needs to route an IP data packet. You can view the IP routing table by clicking on the IP Routing Table button at the bottom of the System IP Configuration screen. From this screen, you can also add new routing entries to the table. The following screen shows an example of the IP routing table. When an IP packet arrives in the Broadband Router, IP tries to determine if the destination IP address contained in the packet is within the network defined by the "Dest IP" and "Netmask" pair of an entry in the routing table. If a match is found, the packet is forwarded to the interface or profile specified in the "Ifname" field. The "Hops" field is the number of routers the packet must travel through in order to reach its final destination. If this value is zero, the destination is in a network directly attached to this router, such as a LAN. If no match is found with a destination network, then a special entry called the "Default IP Route" may be used. This normally is set to a path where another router can be reached that has additional information about other networks not known to the local router, such as the interface to the Internet. If no match is found and a default IP route is not defined, the IP packet is discarded and will go nowhere. An entry for a specific host or network may be added manually. This "static route" is indicated by an "S" in the Flags field. Other flag field entries are "H" for host, and "G" for gateway. Note: To delete a static route, select it in the routing table and click the Delete button. You cannot delete Host or Gateway routes. Adding the Default Route or a Static Route To add/change the default route or add a static route: Step 1 Click the ADD button in the IP Routing Table screen to display the 4-4 following screen: Step 2 Enter the following information: Add Default Route: select if you want to specify a new default route. Note that the Remote IP Address and Remote IP netmask fields do not appear if you select this option. Note: Mis-configuring the default route may result in abnormal system behavior and/or unnecessary telephone charges. Add IP: If you want to add a static route, please select Static Route. Remote IP Address: the remote IP address of the new route. Remote IP Netmask: the IP netmask of the new route. Gateway: select whether the gateway is an IP address or interface. Hop Count: the maximum number of hops for this route. Step 3 Click Save. Static DHCP assignments In certain LAN environments, it is desirable for some PCs to be assigned the same address each time it requires a DHCP server. Broadband Router is capable of configuring up to 20 PCs for static assinments. Each PC is to be assigned a static address requires an entry to be configured in the DHCP static Assignment Table. Please click Static DHCP button in System IP Configuration, the following screen will appear. 4-5 Please click Add button to add a static entry in the following screen. Name: Enter a convenient display name for this reosurce. IP Address: The IP address to be consistently assigned to this device. MAC Address: The hardware address associated with the Ehternet adapter which is permanently assigned to this machine. Note that dashes must separate each pair of hexadecimal digits. To Configure IPX Settings Step 1 To select IPX Protocol, select IPX from the Menu: 4-6 Configuration - Advanced Features - IPX: Step 2 Enter the following information: Ethernet Frame Type: the Ethernet frame type on the LAN, normally detected automatically by the Broadband Router, however you may change this selection. Options are Ethernet_802.3, Ethernet_802.2, Ethernet_II, and Ethernet_SNAP. Network Number: a unique identifier for the IPX network on your LAN. Normally, this is automatically detected by the Broadband Router. IPX RIP/SAP: enables or disables IPX Routing Information Protocol and Service Advertising Protocol, used for exchanging routing tables and server information among IPX RIP/SAP agents. Step 3 Press Save to save the changes to the Broadband Router, or press IPX Routing Table to display or modify the IP Routing Table or press IPX SAP Table to display or modify the IPX SAP Table. The IPX Routing Table The IPX routing table contains all the information that the Broadband Router needs to route an IPX data packet. You can view the IPX routing table by clicking on the IPX Routing Table button at the bottom of the System IPX Configuration screen. From this screen, you can also add new routing entries to the table. The following screen shows an example of the IPX routing table. When an IPX packet arrives in the Broadband Router, IPX tries to determine if the destination IPX Network Number contained in the packet is within the network 4-7 defined by the "Network Number" in an entry in the routing table. If a match is found, the packet is forwarded to the interface or profile specified in the "Gateway IfName" field. The "Hops" field is the number of routers the packet must travel through in order to reach its final destination. If this value is zero, the destination is in a network directly attached to this router, such as a LAN. If no match is found with a destination network, then a special entry called the "Default IPX Route" is used. This normally is set to a path where another router can be reached that has additional information about other networks not known to the local router. If no match is found and a default IPX route is not defined, the IPX packet is discarded and will go nowhere. An entry for a specific host or network may be added manually. This "static route" is indicated by an "S" in the Flags field. Note: To delete a static route, select it in the routing table and click the Delete button. You cannot delete a non-static route. Adding the Default IPX Route or a Static IPX Route The procedure to add or change the IPX default route or to add an IPX static route is as follows: Step 1 Click the ADD button at the bottom of the IPX Routing Table screen to display the following screen: Step 2 Enter the following information: Add IPX: select the type of entry to be added. If you specify a Default Route, the Destination Network Number and Hop Count fields do not appear. Select Static Route if you want to add a static route. Note: Mis-configuring the IPX default route may result in abnormal system behavior and/or unnecessary telephone charges. Destination Network Number: the IPX Network Number reachable through this new route. 4-8 Gateway Interface Name: this specifies the interface through which the destination network can be reached. This is either the LAN or a profile name. Gateway MAC Address: identifies the MAC address of the gateway on the LAN through which the Destination Network Number can be reached. This field only appears if the Gateway Interface Name is the LAN. Hop Count: the maximum number of hops for this route. Step 3 Click Save. The IPX SAP Table The IPX SAP table contains Service Advertising information gathered from adjacent routers or configured statically. This information provides requesting IPX clients with the services available on their network and a path to reach that service. You can view the IPX SAP table by clicking on the IPX SAP Table button at the bottom of the System IPX Configuration screen. From this screen, you can also add new SAP entries to the table. The following screen shows an example of the IPX SAP table. SAP table entries contain the following pieces of information: Server Name: This is a string of up to 48 characters that identifies the device providing the service Network Number: This is the identification of the network on which the Server resides Node: The node address of the device providing the service. Note that this node address may correspond to the device' physical MAC address, or it s may be an internal node number Socket: The two byte (four hexadecimal digit) address of the IPX socket providing the service Type: The Service Type. Well-known service types include: Hexadecimal Value 0000 - Service Type Unknown 4-9 Service Type Print Queue File Server Job Server Print Server Archive Server Remote Bridge Server Advertising Print Server Hexadecimal Value 0003 0004 0005 0007 0009 0024 0047 - - IfName: The name of the interface through which this resource may be accessed. This is either the LAN or a connection profile name Hops: The number of routers the packet must travel through in order to reach its final destination. If this value is zero, the destination is in a network directly attached to this router, i.e., the LAN. Flags: An "S" denotes a static IPX route The Broadband Router will respond to a workstation request for the names and address information of servers of a specific service types or all service types. The router will search the SAP table for these entries and respond with the necessary information that the workstation can use to communicate with the desired service. An entry for a specific service may be added manually. This "static SAP entry" is indicated by an "S" in the Flags field. Note: To delete a static SAP entry, select it in the SAP table and click the Delete button. You cannot delete non-static entries. Adding a Static SAP Entry The procedure to add an IPX static SAP entry is as follows: Step 1 Click the ADD button at the bottom of the IPX SAP Table screen to 4-10 display the following screen: Step 2 Enter the following information: Server Name: The name of the server offering the service. This name may be up to 48 characters. IPX Network Number: The network number on which the server resides. Up to eight hexadecimal digits may be entered. IPX Node Number: The node number of the server. This is entered as six pairs of hexadecimal digits. IPX Socket Number: The socket number used to reach this service (up to four hexadecimal digits). IPX Service Type: The type of service offered. See the table above for typical Service Types. Up to four hexadecimal digits are accepted. The value "FFFF" is not valid. Hop Count: the number of hops to reach this device. Step 3 Click Save. Virtual Server/DMZ(De-military Zone) NAT feature makes all hosts behind this product are invisable. You can make some of them accessible by enabling the Virtual Server mapping. A virtual server is defined as a service port, and all requests to this port will be redirected to the PC specified by teh server IP. Step 1 Select Virtual Server/DMZ from the Menu: 4-11 Configuration - Virtual Server/DMZ Step 2 Enter the following information: DMZ: Key in the private IP for your DMZ host. HTTP(port 80): Key in the private IP and re-mapped port number. FTP, TELNET, SMTP, POP3 services have well-known port number as shown. IF you want to add other services, you can click Add other PAT, to key in the service port Number, the private IP and re-mapped port number. Please check the samll box ahead of the PAT which you want to be active. Note: The Maximum of Add other PAT is 23. Firewall (IP/IPX Filtering) This section describes the packet filtering feature. Note: Packet filtering is a sophisticated feature that can substantially impact your Broadband Router operation. Therefore be sure that you fully understand the description in this chapter before you start to configure and use this feature, since if you make any mistakes, it may produce drastic and potentially undesired results. A Packet Filtering Overview The Broadband Router already provides you with many different ways to ensure the security of your data in your local environment. Packet filtering is a security feature that allows you to selectively pass or throw away data traffic between your local LAN and the wide area network (e.g., the Internet). Packet Filtering allows each IP or IPX 4-12 packet exiting a router interface to be examined for a match with a configured set of rules and an action to be taken depending upon whether the packet statisfies any rule or not. In the browser manager, a set of rules may be configured over any existing interface as represented by a WAN profile. To configure a set of rules for packets exiting the LAN interface (in addition to any WAN interface), you must use the Filtering commands in the Command Line Interface. If the contents of the packet do not match any rule for that interface, then the packet is either forwarded or discarded, depending upon the filter default for that interface. Otherwise, the exception action is taken, i.e., the packet is discarded or forwarded, the opposite of the default action. The Broadband Router maintains separate filtering tables for IP and IPX traffic. These filters are configured separately. Configuration commands allow you to define: each and every IP or IPX packet to be inspected to determine if it should be allowed or disallowed to be transmitted over a WAN interface alternatively. Due to the conflicting nature of allow and disallow, only one of the above two choices can be made for each WAN interface. After the choice is made, you can define selection rules to "select" which packets will be allowed (or disallowed). Each packet selection rule consists of an IP protocol and set of local IP addresses/ports or an IPX Packet Type and a set of local IPX network number(s), node(s) and socket(s) a set of remote IP addresses/ports or remote IPX network numbers/nodes/ sockets The following table indicates the types of values that may be configured for each rule condition. 4-13 Protocol IP Condition Parameter Configuration Formats Protocol TCP/UDP/ ICMP/IGMP/ Any Single/Range/ Network/Any Single/Range/ Any Address Port IPX Packet Type Network Number Node Number Socket Single/Any Single/Range/ Any Single/Any Single/Range/ Any Therefore packet filtering simply defines sets of rules of what to allow or disallow through a set of parameters highlighted below: For IP, remote devices with IP addresses/port numbers are allowed (or disallowed) to communicate with local devices with IP addresses/port numbers over a WAN connection and using a specific IP protocol. For IPX, remote devices with IPX network numbers/nodes/sockets are allowed (or disallowed) to communicate with local devices with IPX network numbers/nodes/sockets over a WAN connection. Examples of packet filtering requirements are: 1. "I want to block any user in my remote office from being able to access my local NetWare server". The corresponding "translated" packet rule is: All IPX communication with my remote office is allowed EXCEPT remote devices with Any IPX network number and Any IPX node number and Any IPX socket which are disallowed from communicating with the local NetWare server (identified by its IPX network number, IPX Node Number and Any socket number over my specified remote office connection profile 4-14 using any IPX packet type. 2. "I want to disallow people in the manufacturing department to access the Internet". The corresponding "translated" packet rule is: All access to the Internet is allowed EXCEPT remote devices with the range of IP addresses in the manufacturing department and any port number which are disallowed to communicate with any IP address/port number over my Internet connection using any IP protocol. Configuring IP Packet Rules To add a new IP packet rule or to edit an existing one, select IP Filter from the ARM menu: Configuration - Advanced - IP Filter Step 1 From the IP Filtering Configuration screen, select the WAN profile of interest from the pull down menu. For example, if your only need is to control access to the Internet, you should only select the Internet access profile. Step 2 Step 3 Select discarded or sent as the default action as desired, which is equivalent to disallow and allow, respectively. If you are just starting, click Add to add a new selection rule. If you have previously defined rules, you will see those rules shown as entries in the rule table, and you can edit the rule by first highlighting the desired entry in the rule table followed by clicking the Edit button. 4-15