User manual ISKRATEL SI2000 CALLISTO821 ROUTER

SI2000 CALLISTO821+ ROUTER USERS GUIDE Copyright© 2005 Iskratel, Ltd. All rights reserved. SI2000 Callisto821+ Router Users Guide Index: 1 1.1 1.2 1.2.1 1.2.2 1.3 2 2.1 2.1.1 SI2000 Callisto821+ Router Features of SI2000 Callisto821+ Router Using SI2000 Callisto821+ Router Internet access Security Package contents Getting started Installation of hardware Ports WAN RES (Reset button) Ethernet 10Base-T/100Base-T port AC power socket Light indicators Ethernet (UTP) cables Preliminary setup LAN and TCP/IP setup User defined IP address Obtain an IP automatically Telnet management connection WEB management connection Managing SI2000 Callisto821+ Router Telnet management CLI terminology Transport Interface Object List Example: Attaching a transport to an interface CLI command groups CLI conventions add delete clear set show Help with completing CLI commands User accounts Adding new users User passwords Changing user settings WEB management About WEB management Status Quick start System Configuration Status page Status Advanced Diagnostics Port Connection Status 6 6 6 6 7 7 8 8 8 8 8 8 9 9 10 11 11 11 12 12 13 17 17 17 17 17 18 18 18 18 20 20 20 20 21 21 21 22 23 23 24 24 24 25 25 25 25 26 26 26 26 2.1.2 2.1.3 2.2 2.2.1 2.2.2 2.2.3 3 3.1 3.1.1 3.1.2 3.1.3 3.1.4 3.1.5 3.2 3.2.1 3.2.2 2/107 SI2000 Callisto821+ Router Users Guide 3.2.3 3.2.4 3.3 3.3.1 3.3.2 3.4 3.4.1 3.4.2 3.5 3.5.1 4 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.7.1 4.8 5 5.1 5.2 5.2.1 5.2.2 5.2.3 5.3 5.4 5.5 5.6 WAN Status LAN Status Hardware Status Defined Interfaces System page Event Log Remote Access Firmware Update Backup / Restore Restart Router Configuration page Save Configuration Authentication LAN Connections WAN Connections Security ZIPB IP Routes DHCP server DHCP relay DNS client DNS relay Bridge Ports ADSL Port Ethernet ports System (backup, restore, reset) Backup / Restore Backup configuration Restore configuration Restart Restart Firmware upgrade Upgrade Update Bridged configurations Creating new bridged connection Changing ATM QoS parameters of the connection Changing scheduler profile Changing bridge interface settings Bridge settings Interface configuration VLAN Configuration Creating new VLAN Forward All/Unregistered Configuration Routed connections About routed configurations PPPoE routed Computer configuration Creating connection Modifying connection RFC1483 routed PPPoA routed IPoA routed PPPoE over Ethernet/Bridge routed 26 27 27 27 27 27 28 29 29 29 30 30 31 33 36 39 40 43 45 49 50 51 52 52 53 54 54 54 54 55 56 56 57 57 57 59 59 61 61 62 63 65 65 66 67 69 69 69 69 70 73 74 76 78 79 3/107 SI2000 Callisto821+ Router Users Guide 6 6.1 6.2 6.2.1 7 7.1.1 7.1.2 7.1.3 7.1.4 8 8.1 8.1.1 8.1.2 8.2 8.2.1 8.2.2 8.2.3 8.3 8.3.1 8.3.2 8.3.3 9 9.1 9.1.1 9.1.2 Quality of Service ATM Quality of Service Ethernet based Quality of Service Configuring Scheduler Listing current scheduler profiles Creating new scheduler profile Difference between priority and wf2qplus scheduling Internet Access Encapsulation IPoA RFC1483 PPPoE PPPoA VPI and VCI Multiplexing VC-based multiplexing LLC-based multiplexing WAN IP Address Security options Security Enabling security Enabling security Enabling Firewall and Intrusion Detection Setting a default security level Configuring security interfaces Configuring security interfaces NAT Global IP Address Pools Reserved Mappings DMZ Configuring NAT Configuring NAT NAT Global Address Configuring NAT global addresses NAT Reserved Mapping Configuring NAT reserved mapping Firewall Port Filtering Validators Triggers Intrusion Detection Firewall policies Configuring Firewall policies Configuring Portfilters Configuring Validators Triggers Configuring Triggers Intrusion Detection Settings Configuring Intrusion Detection Settings Troubleshooting Recovery mode Flash memory Main flash memory Recovery flash memory Updating main flash memory 82 82 82 83 83 84 84 86 86 87 87 87 87 87 88 88 88 89 90 90 91 91 91 91 91 91 92 93 93 93 93 93 94 94 96 96 97 98 98 98 98 98 98 99 101 102 102 104 104 106 106 106 106 106 106 4/107 SI2000 Callisto821+ Router Users Guide 9.2 Configuring LAN interface on PC Updating flash memory Dealing with difficulties 106 107 107 5/107 SI2000 Callisto821+ Router Users Guide 1 SI2000 CALLISTO821+ ROUTER 1.1 Features of SI2000 Callisto821+ Router Your SI2000 Callisto821+ Router router features: - high speed data transmission on single twisted copper pair for Internet access - full rate operations up to 24 Mbit/s in downstream - 10/100BaseT Ethernet port for LAN or PC connection - PPPoE (RFC2516) connection support for accessing the Internet - PPP over CHAP or PAP - support for PPP over ATM - support for IP over ATM - RFC1483 bridged and routed support - IEEE 802.1q VLAN support - IEEE 802.1p Ethernet based quality of service - DHCP server for easy IP address management including - DHCP relay - DNS client - DNS relaying - WEB management and Telnet management over CLI (Command Line Interface) for LAN users - firmware upgrade over WEB management - support for VC based and LLC based multiplexing - NAT (Network Address Translation) for single IP address Internet connection, used by the whole LAN community - firewall filtering functions, allowing better network security and management - intrusion detection 1.2 Using SI2000 Callisto821+ Router 1.2.1 Internet access Your SI2000 Callisto821+ Router can also be used for high speed Internet connections. The TCP/IP standards, most commonly used for using the Internet, are supported by the router. The PPPoE connections in dial-up or dial-in mode are also possible. In order to use your SI2000 Callisto821+ Router for Internet access, there must be a DSLAM installed at a provider company's infrastructure near you. DSLAM is a rack of ADSL line cards that links many customer ADSL connections to a single high speed ine. A typical Internet access application is shown below on figure 2. You can also use NAT (Network Address Translation) services that your SI2000 Callisto821+ Router provides when setting up an Internet connection. This feature allows multiple users on LAN to use the Internet connection, basing on one IP address. The DNS server and DNS relaying is also supported. 6/107 SI2000 Callisto821+ Router Users Guide Figure 1: Example of Internet access connection 1.2.2 Security Connecting your computer to the Internet exposes it to a wide range of risks. The SI2000 Callisto821+ Router comes with security functions to safeguard your system and data. Three types of interfaces can be controlled by the Firewall: Internal (LAN), external (WAN) and DMZ (DeMilitarized Zone). A DMZ is usually used by a company that wants to host its own Internet services without sacrificing unauthorized access to its private network. Typically, the DMZ contains devices accessible to Internet traffic such as HTTP, FTP, DNS and SMTP servers. You can configure the Firewall to allow or block access from one interface type to another interface type. You can configure the Firewall by using a default Security level, by Firewall port filters, by Firewall validators and by Security triggers. 1.3 Package contents SI2000 Callisto821+ Router package comes with following items: 1. SI2000 Callisto821+ Router unit 2. AC adapter 3. Ethernet UTP cord 4. CD-ROM containing user's guide 7/107 SI2000 Callisto821+ Router Users Guide 2 GETTING STARTED 2.1 Installation of hardware 2.1.1 Ports The following figure shows the rear panel of your SI2000 Callisto821+ Router. Figure 2: The rear panel of the SI2000 Callisto821+ Router WAN This port is used for connecting the ADSL cable to your phone jack. Connect the SI2000 Callisto821+ Router to the ADSL port to access the Internet. RES (Reset button) This button is used to reset the configuration of the router to factory default values. You must hold this button while the router is starting-up until ALM led will start flashing fast (about 30 seconds). Callisto821+ will use factory default settings only for the time it is running. If you want to preserve factory default settings save the configuration. Ethernet 10Base-T/100Base-T port Use a straight-through or crossover ethernet cable (2.1.3Ethernet (UTP) cables) to connect your SI2000 Callisto821+ Router to a computer or any other device. It is possible to manage the settings of the router with telnet connection using this port. The factory setting for IP address is 192.168.1.1. 8/107 SI2000 Callisto821+ Router Users Guide AC power socket Plug the power cable to ensure power to the SI2000 Callisto821+ Router. 2.1.2 Light indicators Figure 3: The front panel of the SI2000 Callisto821+ Router The following figure shows the front panel of your SI2000 Callisto821+ Router. There are five LEDs on the front panel of the router that indicate the status of your SI2000 Callisto821+ Router. The description is given in table 1. table 1: LEDs description LED Status PWR on off 100M/10M on off blinking on off blinking slow blinking fast blinking Description Power on. Power off or fatal malfunction. Ethernet link is established. No ethernet activity. No ethernet link established. Ethernet activity. ADSL line is established. ADSL interface is not functional. ADSL interface is in handshake mode looking for DSLAM ADSL interface detected DSLAM on the other side and negotiating link parameters. malfunction WAN ALM 9/107 SI2000 Callisto821+ Router Users Guide 2.1.3 Ethernet (UTP) cables It was earlier mentioned that you should use a straight-through Ethernet cable to connect your SI2000 Callisto821+ Router to a computer directly or use a crossover cable to connect to an external hub. The explanation on what does that mean follows. There are 8 contacts on UTP connector, described in the next table. The UTP connectors are shown on figure 5 : table 2: UTP contacts Contact MDI signal 1 TD+ 2 TD3 RD+ 4 Not used by 10Base-T 5 Not used by 10Base-T 6 RD7 Not used by 10Base-T 8 Not used by 10Base-T Figure 4: The UTP connectors In case of straight-through cable, the contacts on both sides of the cable are connected in the same way, like shown on the left side of figure 6. In case of crossover cable, the contacts on both sides of the cable are connected cross-over, like shown on the right side of figure 6. Figure 5: Ethernet cable: straight-through connected cable (left) and crossover connected cable (right) 10/107 SI2000 Callisto821+ Router Users Guide 2.2 Preliminary setup 2.2.1 LAN and TCP/IP setup This section of the manual provides important information to keep in mind when setting up the first connection between your computer and SI2000 Callisto821+ Router. The factory default settings of the SI2000 Callisto821+ Router have values listed bellow: Local IP address: Subnet mask: DHCP server: 192.168.1.1 255.255.255.0 Disabled User defined IP address The default option is to set up the connection by yourself. In this case you must specify the IP address of your system. Be careful that the subnet values of your system and the router are the same, e.g. 192.168.1.0 (IP address 192.168.1.1 for router and IP address 192.168.1.2 for computer). Example is shown on the picture bellow. Figure 6: User defined IP address set up for Local Area Connection on computer The IP address of the router can also be changed, you can learn about that under the 2.2.2Telnet management connection and 2.2.3WEB management connection sections of the Getting started chapter. 11/107 SI2000 Callisto821+ Router Users Guide Obtain an IP automatically If you enable DHCP server in Callisto821+, is the easiest way to set up a connection to configure the LAN adapter on your system to obtain an IP automatically. This can be done in your operational system by managing the Local Area Connection Properties. The TCP/IP protocol must be installed on your system and set to obtain an IP address automatically. Example is shown on the figure 7. Figure 7: IP obtain automatically set up for Local Area connection on computer 2.2.2 Telnet management connection This section of the document describes the basic principles on how to manage the basic settings of the SI2000 Callisto821+ Router using the Telnet client terminal connection. In order to set up the Telnet Client connection, the router and the computer must reside in the same IP network (e.g. 192.168.1.0). To establish a Telnet connection do the following: 1. Open the Command Prompt. 2. Type in the command for accessing certain IP address over Telnet Client connection: telnet e.g. telnet 192.168.1.1 for default settings of the SI2000 Callisto821+ Router. 3. The initial screen of Command Line Interface (CLI) will appear: 12/107 SI2000 Callisto821+ Router Users Guide Figure 8: The initial screen of the CLI window in Telnet Client To login to the system for the first time, at Login prompt, enter the following user name and password: Login: Password: admin admin To change Local IP address of the router, do next: Type in the CLI prompt: ip set interface iplan ipaddress where is the desired IP address, e.g. 192.168.5.123. Attention! When the IP address of the SI2000 Callisto821+ Router has been changed, the current terminal session in the Telnet management will no longer be possible. You have to establish the new one using the IP address you have given to the Callisto821+. When changing the IP address of the SI2000 Callisto821+ Router be careful that the subnet values (for example 192.168.2.0 and 192.168.2.) of the Callisto821+ and Personal Computer always stay the same! If that is not the case, the LAN communication between both systems will not be possible. If you have set the IP address with subnet different from the computer ones (the subnet value of the router and the PC do not match) for the router, you have to change the IP settings of the Personal Computer, so that the subnet values will match again! 2.2.3 WEB management connection 13/107 SI2000 Callisto821+ Router Users Guide SI2000 Callisto821+ Router has embedded WEB server included in the firmware. This section of the document describes the basic principles on how to manage the settings of the SI2000 Callisto821+ Router using WEB management connection with any web browser. To access Web management connection enter the URL at your web browser: http:// e.g. http://192.168.1.1 where is the Local IP address of the SI2000 Callisto821+ Router, e.g. 192.168.1.1 for factory default settings. The IP addresses of router and computer must be parts of the same IP network (e.g. 192.168.1.0). You are asked to enter username and password: Enter the user name admin and password admin. 14/107 SI2000 Callisto821+ Router Users Guide The Status page is displayed: To change Local IP address of the router, do next: Click on LAN Settings below Status line in the Status page. The default IP address is not shown in the table that appears. You can edit default IP address by using the Change default LAN port IP address button below. The following page will appear: 15/107 SI2000 Callisto821+ Router Users Guide Figure 10: Changing IP address with Web management Now just type in the desired IP address in the Primary IP Address boxes and click on Apply button. New IP address will be set. Once you have changed the IP address of the router, make sure that the IP address of computer is a part of the same network! 16/107 SI2000 Callisto821+ Router Users Guide 3 MANAGING SI2000 CALLISTO821+ ROUTER 3.1 Telnet management Telnet Client uses the Telnet Protocol, part of the TCP/IP suite of protocols, to connect to a remote computer over a network. In order to set up the Telnet Client connection, the router and the computer must be parts of the same IP network (e.g. 192.168.1.0). The CLI is the Command Line Interface for configuring SI2000 Callisto821+ Router, using the Telnet Protocol. This chapter provides you with basic CLI description. For further information refer to SI2000 Callisto821+ Router CLI Reference Manual. 3.1.1 CLI terminology In order to use the Telnet Client with the CLI command prompt, you need to understand the following CLI terms: Transport A transport is a layer 2 session and everything below it. You can create a transport and attach it to a bridge or router so that data can be bridged or routed via the attached transport. For example, see Attaching a transport to an interface in this chapter. Your SI2000 Callisto821+ Router supports following transports: PPPoA PPPoE RFC1483 IPoA Ethernet Interface Bridges and routers both also have interfaces. A single transport is attached to a bridge or router via an interface. For example, see Attaching a transport to an interface in this chapter. 17/107 SI2000 Callisto821+ Router Users Guide Object An object is anything that you can create and manipulate as a single entity, for example interfaces, transports, static routes and NAT rules. List Objects are numbered entries in a list. For example if you have created more than one IP interface, the following command: ip list interfaces produces a list of numbered interface objects. Object numbers are displayed in the first column under heading ID. Example is shown in the next figure: Figure 11: List of objects Example: Attaching a transport to an interface ...To attach a transport to a bridge or router, you need to : 1. Create a transport. In the following command, an Ethernet transport is created and named ether1 and the port name is specified (ethernet): ethernet add transport ether1 ethernet 2. Create an interface. In the following command, a bridge interface is created and called bridgeintf: bridge add interface bridgeintf 3. Attach the transport to the interface. In the following command, the ether1 ethernet transport is attached to the bridgeintf bridge interface: bridge attach bridgeintf ether1 3.1.2 CLI command groups 18/107 SI2000 Callisto821+ Router Users Guide Your SI2000 Callisto821+ Router has an associated group of commands available in the CLI for configuring the device over Telnet Client. Each command in the group starts with the same command string, e.g. all router configuration commands start with ip. The typical CLI command groups that are embedded in your SI2000 Callisto821+ Router are listed in this chapter along with a simple explanation of the use. The bold and italic part of text is the command string. ald / Algorithmic dropper Used for: add, configure and remove ALD profiles ip / Router configuration Used for: add, configure and remove IP interfaces. bridge / Bridge configuration Used for: add, configure and remove bridge interfaces. ethernet /Ethernet configuration Used for: create and remove ethernet transports and provide statistics. rfc1483 / RFC1483 configuration Used for: create, configure and remove RFC transports. ipoa / IPoA configuration Used for: create, configure and remove IP over ATM transports. pppoa / PPPoA configuration Used for: create, configure and remove PPP over ATM server and client transports. pppoe / PPPoE configuration Used for: create, configure and remove PPP over ethernet server and client transports. dhcpserver / DHCP server configuration Used for: define the DHCP network topology. dhcpclient / DHCP client configuration Used for: add, change and remove DHCP client interface declarations. dhcprelay / DHCP relay configuration Used for: add and remove DHCP server addresses for relaying. dnsrelay / DNS relay configuration Used for: add and remove DNS server addresses. dnsclient / DNS client configuration Used for: add and remove DNS client addresses. igmp / IGMP configuration Used for: configure igmp behavior for IP stack. logger / Log to a remote host using syslog Used for: configure syslog. security / Security configuration Used for: enable the security module, create, configure and remove security interfaces and create or configure triggers. nat / NAT configuration 19/107 SI2000 Callisto821+ Router Users Guide Used for: enable/ disable NAT (Network Address Translation) objects, create, configure and remove global address pools and reserve mappings. scheduler / Configuration commands for scheduler Used for: add and remove scheduler profiles. sntpclient / DNS client Simple Network Time Protocol Client commands Used for: add and remove SNTP server addresses. firewall / Firewall configuration Used for: create, configure and remove port filters and validators. Control Intrusion Detection. transports / Transports configuration Used for: display and delete existing transport configuration details. port / Port configuration Used for: configure and display port information. system / System administration commands Used for: perform system maintenance tasks. user / User commands Used for: add and remove users for accessing the device. 3.1.3 CLI conventions The CLI of your SI2000 Callisto821+ Router uses standard, intuitive command names that can be used in different instances: add Use this command to add and name objects (e.g. interfaces or transports). The add command requires attributes to be specified as arguments in a certain order. For example, to create an Ethernet transport, you need to specify the transport name and system port: ethernet add transport delete The delete command deletes named objects or numbered objects, as displayed during using the list command: ethernet delete transport { } clear The clear command deletes all named entities that belong to an object, for example the following command: 20/107