Administrator???s

Handbook

Motorola Netopia?? Embedded Seftware

Version 8.7.4

Enterprise Series Routers

iv Administrator???s Handbook

Contents v

vi Administrator???s Handbook

Contents vii

viii Administrator???s Handbook

Contents ix

Index

x Administrator???s Handbook

Introduction 1-1

Chapter 1

Introduction

This Administrator???s Handbook covers the advanced features of the Motorola Netopia?? ENT Enterprise-Series Router family.

Your Motorola Netopia?? equipment offers advanced con???guration features accessed through the Main Menu of the Telnet con???guration screen. This Administrator???s Handbook documents the advanced features, including advanced testing, security, monitoring, and con???guration. This Administrator???s Handbook should be used as a companion to the Quickstart Guide and the Getting Started Guide. You should read the Quickstart Guide and the Getting Started Guide before reading this Administrator???s Handbook.

What???s New in 8.7.4

New in Motorola Netopia?? Embedded Software Version 8.7.4 are the following features:

???Specify Source Address of Outbound Router Traf???c. See ???Enhanced Dead Peer Detection??? on page 6-15.

???Ability to support multiple networks over the same IPSec tunnel. See ???Multiple Network IPsec??? on page 6-17.

???Backup timer can now be set in seconds instead of minutes. Minimum failure setting has been reduced to 10 seconds. See Chapter 8, ???Line Backup.???

???USB-equipped models now support Macintosh Mac OS X on the USB port.

???VLAN enhancements. See ???VLAN Con???guration??? on page 3-11.

???IP multicast to layer 2 unicast mapping. See ???IGMP (Internet Group Management Protocol)??? on page 3-52.

Corresponding commands have been added to the Command Line Interface (CLI). In addition:

???DHCP Generic Options support.

???DHCP ???ltersets support.

???Support for router generated packets with their source address outside the local member range for IPSec force all tunnels.

See the Command Line Interface Commands Reference available on the Motorola Netopia?? website.

1-2 Administrator???s Handbook

Telnet-based Management

Telnet-based management is a fast menu-driven interface for the capabilities built into Motorola Netopia?? Embedded Software Version 8.7.4. Telnet-based management provides access to a wide variety of features that the Router supports. You can customize these features for your individual setup. This chapter describes how to access the Telnet-based management screens. This section covers the following topics:

??????Motorola Netopia?? Telnet Menus??? on page 1-2

??????Motorola Netopia?? Models??? on page 1-3

??????Connecting through a Telnet Session??? on page 1-4

??????Navigating through the Telnet Screens??? on page 1-5

Motorola Netopia?? Telnet Menus

Telnet-based management screens contain the main entry points to Motorola Netopia?? Embedded Software Version 8.7.4 con???guration and monitoring features. The entry points are displayed in the Main Menu shown below:

Netopia 3366 V 8.7.4

Easy Setup...

WAN Configuration...

System Configuration...

Utilities & Diagnostics...

Statistics & Logs...

Quick Menus...

Quick View...

???The Easy Setup menus display and permit changing the values contained in the default connection pro???le. You can use Easy Setup to initially con???gure the Router directly through a Telnet session.

Easy Setup menus contain up to ???ve descendant screens for viewing or altering these values. The number of screens depends on whether you have optional features installed.

The Quickstart Guide describes the Easy Setup menus to get you up and running quickly.

Introduction 1-3

???The WAN Con???guration menu displays and permits changing your connection pro???le(s), Virtual Private Networks (VPNs) and default pro???le, creating or deleting additional connection pro???les, and con???guring or recon???guring the manner in which you may be using the Router to connect to more than one service provider or remote site. See ???WAN Con???guration,??? beginning on page 2-1. See also Chapter 5, ???Virtual Private Networks (VPNs).???

???The System Con???guration menus display and permit changing:

and more. See ???System Con???guration Features,??? beginning on page 3-1.

???The Utilities & Diagnostics menus provide a selection of the various tools for monitoring and diagnosing the Router's behavior, as well as for updating the software and rebooting the system. See Chapter 11, ???Utilities and Diagnostics.???

???The Statistics & Logs menus display several sets of tables and device logs that show information about your Router, your network, and their history. See ???Statistics & Logs,??? beginning on page 9-3.

???The Quick Menus screen is a shortcut entry point to a variety of the most commonly used con???guration menus that are accessed through the other menu entry points.

???The Quick View menu displays at a glance current real-time operating information about your Router. See

???Quick View Status Overview??? on page 9-1.

Motorola Netopia?? Models

This Administrator???s Handbook covers all of the Motorola Netopia?? ENT Enterprise-Series Router models. However some information in this guide will only apply to a speci???c model.

Screen differences

Because different Motorola Netopia?? ENT Enterprise-Series models offer many different features and interfaces, the options shown on some screens in this Administrator???s Handbook may not appear on your own particular model???s Telnet screen.

These differences are noted throughout the manual.

1-4 Administrator???s Handbook

Connecting through a Telnet Session

Features of Motorola Netopia?? Embedded Software Version 8.7.4 can be con???gured through the Telnet screens.

Before you can access the console screens through Telnet, you must have:

???A network connection locally to the Router or IP access to the Router.

???Telnet software installed on the computer you will use to con???gure the Router

Configuring Telnet software

If you are con???guring your device using a Telnet session, your computer must be running a Telnet software program.

???If you connect a PC with Microsoft Windows, you can use a Windows Telnet application or run Telnet from the Start menu.

???If you connect a Macintosh computer, Mac OS X users can use the Terminal application that comes with Mac OS X in the Utilities folder.

Introduction 1-5

Navigating through the Telnet Screens

Use your keyboard to navigate the Motorola Netopia?? Embedded Software Version 8.7.4???s con???guration screens, enter and edit information, and make choices. The following table lists the keys to use to navigate through the Telnet screens.

To help you ???nd your way to particular screens, some sections in this guide begin with a graphical path guide similar to the following example:

This particular path guide shows how to get to the Network Protocols Setup screens. The path guide represents these steps:

1.Beginning in the Main Menu, select System Con???guration and press Return. The System Con???guration screen appears.

2.Select IP Setup and press Return. The IP Setup screen appears.

To go back in this sequence of screens, use the Escape key.

1-6 Administrator???s Handbook

2-2 Administrator???s Handbook

WAN Ethernet Configuration

Set up the basic IP attributes of your Ethernet Module in this screen.

???Address Translation Enabled allows you to specify whether or not the router performs Network Address Translation (NAT) on the Ethernet WAN port. NAT is enabled by default.

???Obtain WAN address via DHCP allows you to toggle WAN DHCP Off and On. DHCP is On by default. so that if you do not change the setting, the Router will acquire its WAN IP address automatically. By default, the router acts as a DHCP client on the Ethernet WAN port and and attempts to acquire an address from a DHCP server.

???The Local WAN IP Address ???eld allows you to manually con???gure an IP address for use on the Ethernet WAN port. This ???eld only becomes visible if you toggle Obtain WAN address via DHCP to Off.

???The Local WAN IP Mask ???eld becomes visible if you specify a Local WAN IP Address. This allows you to manually con???gure an IP subnet mask for use on the Ethernet WAN port. This item is visible only if you have con???gured a non-zero Ethernet IP Address; otherwise, the router obtains a subnet mask via DHCP.

???The NAT Map List and NAT Server List options are set to the defaults, Easy-PAT List and Easy-Servers. These provide standard NAT mappings. For more advanced NAT con???gurations, see ???Multi-NAT??? on page 4-1.

???NAT Options allows you to specify IP Passthrough, allowing a single PC on the LAN to have the router???s public address assigned to it. See ???IP Passthrough??? on page 4-27.

???If you set Stateful Inspection Enabled to Yes, you can enable a security feature for computers on your LAN when NAT is disabled. See ???Stateful Inspection??? on page 3-3.

???The Filter Set pop-up allows you to associate an IP ???lter set with the Ethernet WAN port. See ???About Filters and Filter Sets??? on page 10-20.

???Remove Filter Set allows you to remove a previously associated ???lter set.

???The WAN Ethernet Speed Setting is con???gurable via a pop-up menu. Options are:

??? Auto-Negotiation (the default)

2-4 Administrator???s Handbook

The Transmit RIP pop-up menu is hidden if NAT is enabled.

Routing Information Protocol (RIP) is needed if there are IP routers on other segments of your Ethernet network that the Motorola Netopia?? Router needs to recognize. Set to ???Both??? (the default) Motorola Netopia?? Embedded Software Version 8.7.4 will accept information from either RIP v1 or v2 routers. Alternatively, select Receive RIP and select v1, v2, or v2 MD5 Authentication from the popup menu. With Receive RIP set to ???v1,??? the Motorola Netopia?? Router???s Ethernet port will accept routing information provided by RIP packets from other routers that use the same subnet mask. Set to ???v2,??? the Motorola Netopia?? Embedded Software Version 8.7.4 will accept routing information provided by RIP packets from other routers that use different subnet masks.

For more information on v2 MD5 Authentication, see ???RIP Options??? on page 7-9.

If you want the Motorola Netopia?? Router to advertise its routing table to other routers via RIP, select Transmit RIP and select v1, v2 (broadcast), or v2 (multicast) from the popup menu. With Transmit RIP v1 selected, the Motorola Netopia?? Embedded Software Version 8.7.4 will generate RIP packets only to other RIP v1 routers. With Transmit RIP v2 (broadcast) selected, the Motorola Netopia?? Embedded Software Version 8.7.4 will generate RIP packets to all other hosts on the network. With Transmit RIP v2 (multicast) selected, the Motorola Netopia?? Embedded Software Version 8.7.4 will generate RIP packets only to other routers capable of recognizing RIP v2 packets.

ADSL Line Configuration screen

The ADSL Line Con???guration screen is shown below:

ADSL Line Configuration

1.Select Circuit Type and from the pop-up menu choose the type of circuit to which you will be connecting: Multimode, T1.413, G.dmt, or G.lite.

2.Select Trellis Coding Enabled. Toggle it to On (the default) or Off.

3.Select Signaling Mode and choose Echo Cancellation or FDM (the default).

4.If you selected Multimode Circuit Type, the Fast Retrain Enabled ???eld appears. Toggle it to On (the default) or Off.

WAN Con???guration 2-5

5.For model 3341 and 3366C ADSL modems, a Wiring Type pop-up menu allows you to choose the type of copper pair wiring in use at your location. For all other models this option is preset and does not appear.

Usually, the default AutoSense will detect the type and adjust itself accordingly. If you want to set it yourself, and you know the type of wiring you have, choose either Tip/Ring (Inner Pair) or A/A1 (Outer Pair) from the pop-up menu.

6.Select Data Link Encapsulation and press Return. The pop-up menu will offer you the choice of PPP or RFC1483.

7.Toggle Annex Modes enabled to On only if your service provider supports it. The embedded software has the ability to support Annex M mode. However, Annex M mode may affect the training timing in some cases. Consequently, the default is Off. Not all services support this feature for all subscribers.

ATM Circuit Configuration

On ADSL WAN interfaces, the Asynchronous Transfer Mode (ATM) connection between the router and the central of???ce equipment (DSLAM) is divided logically into one or more virtual circuits (VCs). A virtual circuit may be either a permanent virtual circuit (PVC) or a switched virtual circuit (SVC). Motorola Netopia?? Routers support PVCs.

VCs are identi???ed by a Virtual Path Identi???er (VPI) and Virtual Channel Identi???er (VCI). A VPI is an 8-bit value between 0 and 255, inclusive, while a VCI is a 16-bit value between 0 and 65535, inclusive.

???Circuits support attributes in addition to their VPI and VCI values. When con???guring a circuit, you can specify an optional circuit name of up to 14 characters. The circuit name is used only to identify the circuit for management purposes as a convenience to aid in selecting circuits from lists. The default circuit name is ???Circuit <n>???, where <n> is some number between one and eight corresponding to the circuit???s position in the list of up to eight circuits.

???You can also individually enable or disable a circuit without deleting it. This is useful for temporarily removing a circuit without losing the con???gured attributes.

???In order to function, each circuit must be bound to a Connection Pro???le or to the Default Pro???le. Among other attributes, the pro???le binding speci???es the IP addressing information for use on the circuit. Each circuit must be bound to a distinct Connection Pro???le.

ATM VPI/VCI Autodetection. You can bind multiple circuits to the same Connection Pro???le. Motorola Netopia?? Embedded Software Version 8.7.4 allows you to have a standard con???guration that uses, for example, four VCs (0/35, 0/38, 8/35, 8/38) pointing to the same pro???le.

The unit will now automatically select the active VC on networks with a VPI/VCI of any of these four values without any custom con???guration of the unit. You must, however, manually create these VCs and associate them with the pro???le you desire.

You con???gure Virtual Circuits in the Add/Change Circuit screen.

2-6 Administrator???s Handbook

ATM Circuits Configuration

Show/Change Circuit...

Add Circuit...

Delete Circuit...

8.To add a circuit, select Add Circuit and press Return. The Add Circuit screen appears.

???Enter a name for the circuit in the Circuit Name ???eld.

???Toggle Circuit Enabled to Yes.

???Enter the Virtual Path Identi???er and the Virtual Channel Identi???er in the Circuit VPI and Circuit VCI ???elds, respectively.

???The Peak Cell Rate ???eld is editable. Motorola Netopia?? Embedded Software Version 8.7.4 supports three ATM classes of service for data connections: Unspeci???ed Bit Rate (UBR), Constant Bit Rate (CBR), and Variable Bit Rate (VBR). You can con???gure these classes of service on a per VC basis. The

WAN Con???guration 2-7

default ATM class of service is UBR.

Quality of Service (QoS) settings

Note: QoS settings are not available on Ethernet-to-Ethernet WAN models.

???Select the QoS (Quality of Service) setting from the pop-up menu: UBR. CBR, or VBR.

UBR: No con???guration is needed for UBR VCs. Leave the default value 0 (maximum line rate).

CBR: One parameter is required for CBR VCs. Enter the Peak Cell Rate that applies to the VC. This value should be between 1 and the line rate. You set this value according to speci???cations de???ned by your service provider.

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes.

VBR: This class is characterized by:

???a Peak Cell Rate (PCR), which is a temporary burst, not a sustained rate, and

???a Sustained Cell Rate (SCR),

???a Burst Tolerance (BT), speci???ed in terms of Maximum Burst Size (MBS). The MBS is the maximum number of cells that can be transmitted at the peak cell rate and should be less than, or equal to the Peak Cell Rate, which should be less than, or equal to the line rate.

VBR has two sub-classes:

a. VBR non-real-time (VBR-nrt): Typical applications are non-real-time traf???c, such as IP data traf???c. This class yields a fair amount of Cell Delay Variation (CDV).

b. VBR real time (VBR-rt): Typical applications are real-time traf???c, such as compressed voice over IP and video conferencing. This class transmits cells with a more tightly bounded Cell Delay Variation. The applications follow CBR.

???Then, select a Connection Pro???le for the Circuit. To use the Default Pro???le, select Use Default Pro???le for Circuit and press Return. For other options, select a pro???le from the Use Connection Pro???le pop-up menu.

2-8 Administrator???s Handbook

Note: With multiple VCs you must explicitly statically bind the second (and all subsequent) VCs to a pro???le. The ???rst VC will automatically statically bind according to pre-de???ned dynamic binding rules when you add the second VC. It will revert back to dynamic binding if the number of VCs is reduced to one; for example, by deleting previously de???ned VCs.

When the link comes up the router binds the VC dynamically to the ???rst suitable Connection Pro???le or to the Default Pro???le if there is no Connection Pro???le con???gured.

???If you factory default the router, the VC binds to the Default Pro???le.

???If you delete a Connection Pro???le that is statically bound to a VC, the VC binding is set back to the Default Pro???le. If there is only one VC de???ned, the VC dynamically binds to the ???rst suitable pro???le or to the Default Pro???le. If there are multiple VCs de???ned, it binds to the Default Pro???le.

???If you add a second VC, it is initialized to the Default Pro???le, and the menu screens display the VC Connection Pro???le-related items, allowing you to bind to a speci???c Connection Pro???le instead of the Default Pro???le. In addition, the router statically binds the ???rst VC according to the rules used to select a pro???le for dynamic binding. At this point, each pro???le uses static binding when the link is brought up.

???If there are no VCs when you add a VC -- for example, if you deleted all your previous VCs and started adding them again -- dynamic binding will occur when the link comes up. If you delete a VC, leaving only one VC, that VC resumes dynamically binding again.

??? Select ADD Circuit NOW and press Return.

9.To display or change a circuit, select Display/Change Circuit, select a circuit from the pop-up menu, and press Return. The ???elds are the same as those in the Add Circuit screen.

10.To delete a circuit, select Delete Circuit, select a circuit from the pop-up menu, and press Return. In the con???rmation window, select CONTINUE and press Return.

11.Press Escape to return to the WAN Setup menu.

Creating a New Connection Profile

Connection pro???les are useful for con???guring the connection and authentication settings for negotiating a PPP connection. If you are using the PPP data link encapsulation method, you can store your authentication information in the connection pro???le so that your user name and password (or host name and secret) are transmitted when you attempt to connect.

Connection pro???les de???ne the networking protocols necessary for the Router to make a remote connection. A connection pro???le is like an address book entry describing how the Router is to get to a remote site, or how to recognize and authenticate a connection. To create a new connection pro???le, you navigate to the WAN Con???guration screen from the Main Menu, and select Add Connection Pro???le.

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes. Configure a new Conn. Profile. Finished? COMMIT or CANCEL to exit.

1.Select Pro???le Name and enter a name for this connection pro???le. It can be any name you wish. For example: the name of your ISP.

2.Toggle Pro???le Enabled to Yes or No. The default is Yes. You can toggle it to No, if you want to disable it later.

3.Select Encapsulation Type and press Return. The pop-up menu offers the possible data link encapsulation methods for connection pro???les used for a variety of purposes: PPP, RFC1483, ATMP, PPTP, IPsec, L2TP.

Multiple Data Link Encapsulation Settings

4.Select Encapsulation Options and press Return.

??? If you selected ATMP, PPTP, L2TP, or IPSec, see Chapter 5, ???Virtual Private Networks (VPNs).???

2-12 Administrator???s Handbook

IP Profile Parameters

RIP Profile Options...

Return/Enter to select <among/between> ...

Configure IP requirements for a remote network connection here.

6.Toggle or enter your IP Parameters. For more information, see:

??????IP Setup??? on page 7-1

??????Network Address Translation (NAT)??? on page 3-2

??????Stateful Inspection Options??? on page 3-8

??????Filter Sets??? on page 3-2

???The RIP Pro???le Options selection displays the RIP Pro???le Parameters screen.

???The Receive RIP pop-up menu controls the reception and transmission of Routing Information Protocol (RIP) packets on the WAN port. The default is Both v1 and v2.

A Transmit RIP pop-up menu is hidden if NAT is enabled.

Routing Information Protocol (RIP) is needed if there are IP routers on other segments of your Ethernet network that the Motorola Netopia?? Router needs to recognize. Set to ???Both??? (the default) Motorola Netopia?? Embedded Software Version 8.7.4 will accept information from either RIP v1 or v2 routers.

Alternatively, select Receive RIP and select v1, v2, or v2 MD5 Authentication from the popup menu. With Receive RIP set to ???v1,??? the Motorola Netopia?? Router???s Ethernet port will accept routing information provided by RIP packets from other routers that use the same subnet mask. Set to ???v2,??? the Motorola Netopia?? Embedded Software Version 8.7.4 will accept routing information provided by RIP packets from other routers that use different subnet masks.

For more information on v2 MD5 Authentication, see ???RIP Options??? on page 7-9.

PPPoE/PPPoA Autodetection

Beginning with Software Version 8.5, if you are using PPP, and you have selected PPPoE as the Underlying Encapsulation, you can further enable the ability to connect automatically to your ISP???s central of???ce equipment whether they are using PPP over Ethernet or PPP over ATM.

Note: This feature applies only to ATM-based WAN connections.

7.Select PPPoE Options and press Return. The PPPoE Options screen appears.

2-14 Administrator???s Handbook

Return/Enter accepts * Tab toggles * ESC cancels.

Toggle PPPoA Autodetect to On.

If your ISP is using PPPoE, the connection will be made normally. If your ISP is using PPPoA, when the Motorola Netopia?? Gateway detects this, it will automatically switch to PPPoA transparently.

8.Return to the Add Connection Pro???le screen by pressing Escape.

9.Select COMMIT and press Return. Your new Connection Pro???le will be added.

If you want to view the Connection Pro???les in your device, return to the WAN Con???guration screen, and select Display/Change Connection Pro???le. The list of Connection Pro???les is displayed in a scrolling pop-up screen.

WAN Con???guration 2-15

You can also delete Connection Pro???les by selecting them in the same manner using the Delete Connection Pro???le option in the WAN Con???guration screen.

Advanced Connection Options

Depending on your model, the Advanced Connection Options screen offers a variety of powerful options for advanced users. Screens shown in this section may vary from what your particular model displays.

Configuration Changes Reset WAN Connection

The menu supports delaying some con???guration changes until after the Motorola Netopia?? Router is restarted.

If your Motorola Netopia?? Router is precon???gured by your service provider, or if you are not remotely con???guring the router, you can leave this setting unchanged.

The purpose of this feature is to defer con???guration changes only when remotely con???guring or recon???guring the Motorola Netopia?? Router to prevent premature Telnet disconnection. When this feature is enabled, no changes to the WAN setup, datalink encapsulation, Connection Pro???les, or Default Gateway will take effect until after the Motorola Netopia?? Router is restarted. Until the Motorola Netopia?? Router is restarted the WAN link and the routing table remain unaffected.

A single setting in the Advanced Connection Options screen controls this feature, as shown below.

Advanced Connection Options

Scheduled Connections...

Backup Configuration...

Prioritize Delay-Sensitive Data: No

Diffserv Options...

VRRP Options...

Return/Enter to configure SA Backup Parameters.

When you toggle Con???guration Changes Reset WAN Connection either to Yes or No using the Tab key and press Return, a pop-up window asks you to con???rm your choice.

2-16 Administrator???s Handbook

Toggling from Yes to No makes the router ready to be con???gured. If you toggle from No to Yes after any con???guration changes have been entered (and con???rm the reboot), your changes are committed and the router comes up using the newly created con???guration.

Scheduled Connections

Scheduled connections are useful for PPPoE, PPTP, and ATMP connection pro???les.

To go to the Scheduled Connections screen, from the WAN Con???guration screen select Advanced Connection Options and then select Scheduled Connections.

WAN Con???guration 2-17

Scheduled Connections

Display/Change Scheduled Connection...

Add Scheduled Connection...

Delete Scheduled Connection...

Navigate from here to add/modify/change/delete Scheduled Connections.

Viewing scheduled connections

To display a table of scheduled connections, select Display/Change Scheduled Connection in the Scheduled Connections screen. Each scheduled connection occupies one row of the table.

The ???rst column in the table shows a one-letter representation of the Days of the week, from Monday (M or m) to Sunday (S or s). If a letter representing a day is capitalized, the connection will be activated on that day; a lower-case letter means that the connection will not be activated on that day. If the scheduled connection is con???gured for a once-only connection, the word ???once??? will appear instead of the days of the week.

The other columns show:

2-18 Administrator???s Handbook

???The time of day that the connection will Begin At

???The duration of the connection (HH:MM)

???Whether it???s a recurring Weekly connection or used Once Only

???Which connection pro???le (Conn. Prof.) is used to connect

???Whether the scheduled connection is currently Enabled

The Router checks the date and time set in scheduled connections against the system date and time.

Adding a scheduled connection

To add a new scheduled connection, select Add Scheduled Connection in the Scheduled Connections screen and press Return. The Add Scheduled Connection screen appears.

Follow these steps to con???gure the new scheduled connection:

???To activate the connection, select Scheduled Connection Enable and toggle it to On. You can make the scheduled connection inactive by toggling Scheduled Connection Enable to Off.

???Decide how often the connection should take place by selecting How Often and choosing Weekly or Once Only from the pop-up menu.

???The Schedule Type allows you to set the exact weekly schedule or once-only schedule. Options are:

???Forced Up, meaning that this connection will be maintained whether or not there is a demand call on the line.

???Forced Down, meaning that this connection will be torn down or blocked whether or not there is a demand call on the line.

WAN Con???guration 2-19

???Demand-Allowed, meaning that this schedule will permit a demand call on the line.

???Demand-Blocked, meaning that this schedule will prevent a demand call on the line.

???Periodic, meaning that the connection is retried several times during the scheduled time.

???Random Retry, which operates as follows:

First, it will wait 0 to 60 seconds before starting, then it will try three times to bring the connection up as quickly as possible;

Second, on each successive retry after these ???rst three attempts it will wait a random number of seconds between zero and a user-speci???ed maximum.

Should the connection come up, and subsequently go down, the Scheduled Connection will start over with three retries. Switched connections have a variable redial back-off time depending on the interface type. Consequently, the ???rst three attempts for such connections will be slower. Once the connection is up it will be forced to remain up.

???If How Often is set to Weekly, the item directly below How Often reads Set Weekly Schedule. If How Often is set to Once Only, the item directly below How Often reads Set Once-Only Schedule.

Set Weekly Schedule

If you set How Often to Weekly, select Set Weekly Schedule and go to the Set Weekly Schedule screen.

???Select the days for the scheduled connection to occur and toggle them to Yes.

Return/Enter accepts * Tab toggles * ESC cancels.

???Select Scheduled Window Start Time and enter the time to initiate the scheduled connection.

???You must enter the time in the format H:M, where H is a one- or two-digit number representing the hour and M is a one- or two-digit number representing the minutes. The colon is mandatory. For example, the entry

2-20 Administrator???s Handbook

1:3 (or 1:03) would be accepted as 3 minutes after one o???clock. The entry 7:0 (or 7:00) would be accepted as seven o???clock, exactly. The entries 44, :5, and 2: would be rejected.

???Select AM or PM and choose AM or PM from the pop-up menu.

???Select Scheduled Window Duration Per Day and enter the maximum duration allowed for this scheduled connection, per call.

???Retry interval (minutes) becomes visible if you have selected Random Retry. This option allows you to set the upper limit for the number of minutes to use for the retry time (the attempts after the ???rst three attempts). It accepts values of 1 ??? 255 minutes; the default setting is 5 minutes. With a setting of 5 minutes it will try every 0 ??? 300 seconds after the ???rst three retries to bring up the connection.

You are ???nished con???guring the weekly options. Return to the Add Scheduled Connection screen to continue.

Set Once-Only Schedule

If you set How Often to Once Only, select Set Once-Only Schedule and go to the Set Once-Only Schedule screen.

???Select Place Call On (Date) and enter a date in the format MM/DD/YY or MM/DD/YYYY (month, day, year).

Note: You must enter the date in the format speci???ed. The slashes are mandatory. For example, the entry 5/7/98 would be accepted as May 7, 1998. The entry 5/7 would be rejected.

???Select Scheduled Window Start Time and enter the time to initiate the scheduled connection.

WAN Con???guration 2-21

Note: You must enter the time in the format H:M, where H is a one- or two-digit number representing the hour and M is a one- or two-digit number representing the minutes. The colon is mandatory. For example, the entry 1:3 (or 1:03) would be accepted as 3 minutes after one o???clock. The entry 7:0 (or 7:00) would be accepted as seven o???clock, exactly. The entries 44, :5, and 2: would be rejected.

???Select AM or PM and choose AM or PM.

???Select Scheduled Window Duration and enter the maximum duration allowed for this scheduled connection. Use the same format restrictions noted above.

You are ???nished con???guring the once-only options. Return to the Add Scheduled Connection screen to continue.

???In the Add Scheduled Connection screen, select Use Connection Pro???le and choose from the list of connection pro???les you have already created. A scheduled connection must be associated with a connection pro???le to be useful. The connection pro???le becomes active during the times speci???ed in the associated scheduled connection, if any exists.

???Select ADD SCHEDULED CONNECTION to save the current scheduled connection. Select CANCEL to exit the Add Scheduled Connection screen without saving the new scheduled connection.

Modifying a scheduled connection

To modify a scheduled connection, select Display/Change Scheduled Connection in the Scheduled Connections screen to display a table of scheduled connections.

Select a scheduled connection from the table and press Return. The Change Scheduled Connection screen appears. The parameters in this screen are the same as the ones in the Add Scheduled Connection screen (except that ADD SCHEDULED CONNECTION and CANCEL do not appear). To ???nd out how to set them, see ???Adding a scheduled connection??? on page 2-18.

Deleting a scheduled connection

To delete a scheduled connection, select Delete Scheduled Connection in the Scheduled Connections screen to display a table of scheduled connections.

Select a scheduled connection from the table and press the Return key to delete it. To exit the table without deleting the selected scheduled connection, press the Escape key.

Backup Configuration

See ???Line Backup??? on page 8-1.

2-22 Administrator???s Handbook

Diffserv Options

Motorola Netopia?? Embedded Software Version 8.7.4 offers Differentiated Services (Diffserv) enhancements. These enhancements allow your Router to make Quality of Service (QoS) decisions about what path Internet traf???c, such as Voice over IP (VoIP), should travel across your network. For example, you may want streaming video conferencing to use high quality, but more restrictive, connections, or, you might want e-mail to use less restrictive, but less reliable, connections.

When you select Diffserv Options, the Diffserve Options con???guration screen appears.

Diffserv Options

???Differentiated Services is disabled by default. To enable Differentiated Services, toggle Diffserv Enabled to Yes and press Return.

The Diffserv options are displayed.

WAN Con???guration 2-23

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes.

???Enter a value from 60 to 100 (percent) in the Lo/Hi Ratio ???eld.

Differentiated Services uses the low-to-high priority queue ratio to regulate traf???c ???ow. For example, to provide the least possible latency and highest possible throughput for high priority traf???c, you could set the ratio to 100(%). This would cause the Router to forward low priority data only after the high priority queue is completely empty. In practice, you should set it to something less than 100%, since the low priority traf???c might have to wait too long to be passed, and consequently be subject to time-outs.

When the LoHi value is 50 or below, it is equivalent to turning off the service.

Note: Low to High Priority Queue Asymmetry Field (lohi-asymmetry)

This parameter is a percentage between 50 and 100 used to regulate the level of packets allowed to be pending in the low priority queue. It can be used to some degree to adjust the relative throughput bandwidth for low vs. high priority traf???c.

For example, to provide for least possible latency and highest throughput for high priority packets, you can set the lohi-asymmetry to 100%. This will cause the gateway to forward low priority packets only when the high priority queue is completely empty. If the high priority stream throughput is such that it fully loads the Gateway, the low priority stream will in this case be completely suppressed. If it is a TCP stream, it probably will time out. To keep low priority TCP connections ???alive??? with minimal throughput while other applications are loading the Gateway with high priority traf???c, you might try setting the parameter to 90%. The means a low priority packet will be forwarded whenever the relative packet count asymmetry, de???ned as (low)/(high + low) with is greater than .90.

Lowering the lohi-asymmetry value will lower the throughput and widen the latency distribution of the high priority streams, so for best results, especially during heavy high priority loading, the value should be left high. Setting the ???eld to 50%, for example, is almost equivalent to turning off the service as far as the Gateway's behavior is concerned.

Much of the bene???t of DiffServe is a cumulative one observed as packets traverse the nodes on a network from endpoint to endpoint. A small improvement in the latency distribution for the ???ow through a single network node (such as a Motorola Netopia?? ???edge??? Gateway) may not be especially noticeable in a VoIP conversation, for example. If the latency for the VoIP packets in a stream can be minimized through 10 or 20 nodes in the route to the other end of the conversation, however, the cumulative difference may be very noticeable.

In general, a VoIP call, for example, is low bandwidth ??? bi-directional UDP streams totaling about 20 packets/sec, or

2-24 Administrator???s Handbook

bandwidths from 20 kbps to 90 kbps, depending on the CODEC setting ??? compared to the total throughput bandwidth of the Gateway and the network. There will usually be fewer than two or three packets pending in the Gateway in any queue in the Gateway during the conversation. If, during the call, however, a user is sur???ng and decides to download, or upload, a ???le through the Gateway, it is possible that during the ???le transfer the voice quality of the VoIP call could be degraded. A higher setting for the lohi-asymmetry will prevent this from occurring.

On the other hand, if 10 or 20 VoIP calls are simultaneously being handled by the Gateway, for example, in an of???ce setting, then 1000-2000 packets/sec are being throughput at high priority. If one or several of the callers in the of???ce then attempt to download, 10-15 packets may be pending in the low priority receive queues, with perhaps 2-3 pending in the high. The corresponding asymmetry in this case would be around 80-86%. If it were found in this situation that the ???le transfers were too sluggish, then the lohi-asymmetry threshold could be set to 80%. This would cause more of the low priority traf???c to be throughput, at the expense of the high priority streams. As a result, the ???le downloads might proceed at a more satisfactory rate, while the degradation to the 10 or 20 VoIP calls might not be noticeable.

The lo-hi asymmetry parameter is therefore one means of balancing the traf???c load to satisfy everyone.

You can then de???ne custom Rules. If your applications do not provide Quality of Service (QoS) control, rules allow you to de???ne streams for some protocols, port ranges, and between speci???c end point addresses.

???To de???ne a Rule, select Add Rules and press Return.

(Once you have added one or more rules, you can edit any of them by returning to this screen and selecting

Show/Change Rules.)

The Diffserv Rule screen appears.

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes.

???Name ??? Enter a name in this ???eld to label the rule.

???Protocol ??? Select the protocol from the pop-up menu: TCP (default), UDP, ICMP, or Other. ???Other??? is appropriate for setting up rules on protocols with non-standard port de???nitions. IPSEC and PPTP are common examples.

WAN Con???guration 2-25

???Priority ??? This is the Quality of Service setting for the rule, based on the TOS bit information. Select assure, expedite, or off (default) from the pop-up menu. The following table outlines the TOS bit settings and behavior:

???Numerical Protocol ??? If you select ???Other??? protocol, this ???eld appears for you to provide its actual protocol number, with a range of 0 ??? 255.

???Direction ??? Choose outbound (default), inbound, or both from the pop-up menu.

???Start Port ??? For TCP or UDP protocols, you can optionally specify a range of ports. Enter the starting port here.

???End Port ??? Enter the ending port here.

???Inside IP Address/Netmask ??? For outbound ???ows, specify an IP address and subnet mask on your LAN. For inbound ???ows, this setting is ignored.

???Outside IP Address/Netmask ??? If you want traf???c destined for and originating from a certain WAN IP address to be controlled, enter the IP address and subnet mask here. If you leave the default all-zeroes, the outside address check is ignored.

For outbound ???ows, the outside address is the destination IP address for traf???c; for inbound packets, the outside address is the source IP address.

When you are ???nished, select COMMIT and press Return. You will be returned to the Diffserv Options screen and your settings will take effect.

Priority Queuing (TOS bit)

Motorola Netopia?? Embedded Software Version 8.7.4 offers the ability to prioritize delay-sensitive data over the WAN link on DSL connections.

Certain types of IP packets, such as voice or multimedia packets, are sensitive to latency introduced by the network. This means that if such packets are not received rapidly, the quality of service degrades. If you expect to route signi???cant amounts of such traf???c you can con???gure your router to prioritize this type of traf???c using the priority queuing feature.

To con???gure your router to prioritize delay-sensitive data, navigate to the Advanced Connection Options screen in the console menu.

2-26 Administrator???s Handbook

The Advanced Connection Options screen appears.

Advanced Connection Options

Scheduled Connections...

Backup Configuration...

Prioritize Delay-Sensitive Data: No

Diffserv Options...

VRRP Options...

Return/Enter to configure SA Backup Parameters.

The Router will recognize a delay-sensitive packet as having the low-latency bit set in the TOS ???eld of the IP header.

If you toggle Prioritize Delay-Sensitive Data to Yes the router will place these packets at the front of the transmission queue to the WAN link, overtaking non-delay-sensitive traf???c. Accepting the default No will allow the normal sequential queue of data packets.

VRRP Options (WAN Link Failure Detection)

Beginning with Software Version 8.5.1, the software offers VRRP Options to detect Layer 3 link failures on the WAN. When you enable this feature, the Motorola Netopia?? Router will continuously Ping one or two hosts that you specify to determine when a link fails, even if the physical connection remains established. If Layer 3 WAN Link Failure Detection is enabled, the Motorola Netopia?? Router will send continuous Pings, so the WAN link will stay up and idle timeout will not occur.

See ???Virtual Router Redundancy (VRRP)??? on page 7-34 for a detailed description of VRRP and how to create Virtual Routers.

To enable WAN Link Failure Detection, select VRRP Options in the Advanced Connection Options menu. The VRRP Options menu appears.

WAN Con???guration 2-27

Return/Enter accepts * Tab toggles * ESC cancels.

Toggle Ping Enable to On and press Return. The Ping settings options appear.

???The Ping Host Name or IP Address #1 and Ping Host Name or IP Address #2 ???elds allow you to enter the fully-quali???ed host name(s) or IP address(es) in standard dotted-quad format of the hosts you want to Ping for connection validation. If no ICMP echo(es) are returned from these hosts, the connection is assumed to be lost, and the Virtual Router will relinquish Master status.

???The Delay (s) ???eld allows you to specify the time in seconds between Pings. The default is ???ve (5) seconds.

???The Ping failures ???eld allows you to specify the number of Ping time-outs or failures after which the connection is assumed to be lost. The default is ten (10).

2-28 Administrator???s Handbook

Return/Enter goes to new screen.

Return/Enter to configure Xposed IP addresses.

The Add Exposed Address List screen appears.

Add Exposed Address List

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes.

Enter a descriptive name for the list and press Return. A new ???eld Add Exposed Address Range appears.

3-6 Administrator???s Handbook

Add Exposed Address Range ("xposed_list_1")

Add Exposed Address Range ("xposed_list_1")

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes.

???First Exposed Address: Start IP Address of the exposed host range.

???Last Exposed Address: End IP Address of the exposed host range

???Protocol: Select the Protocol of the traf???c to be allowed to the host range from the pop-up menu. Options are Any, TCP, UDP, or TCP and UDP.

???Port Start: Start port of the range to be allowed to the host range. The acceptable range is from 1 - 65535.

???Port End: End port of the range to be allowed to the host range. The acceptable range is from 1 - 65535.

System Con???guration 3-7

You can edit or delete exposed address lists by selecting Show/Change Exposed Address List or Delete Exposed Address List. A list of previously con???gured exposed addresses appears. This allows you to select an exposed address list for editing or deletion.

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

Note: Add, Edit, or Delete exposed addresses options are active only if NAT is disabled on a WAN interface. The hosts speci???ed in exposed addresses will be allowed to receive inbound traf???c even if there is no corresponding outbound traf???c.

Exposed Address Associations

Enable and con???gure stateful inspection on a WAN interface.

System Con???guration 3-9

Stateful Inspection Parameters

Enter max. allowed TCP sequence number difference (1 - 65535), 0 to disable.

???Max. TCP Sequence Number Difference: Enter a value in this ???eld. This value represents the maximum sequence number difference allowed between subsequent TCP packets. If this number is exceeded, the packet is dropped. The acceptable range is 0 ??? 65535. A value of 0 (zero) disables this check.

???Enable default mapping to router: This is disabled by default. Toggling this option to Yes will allow the router to respond to traf???c received on this interface, for example, ICMP Echo requests.

Note: If Stateful Inspection is enabled on a base connection pro???le (for example, for PPP, RFC1483 bridged/routed, or PPPoE), Enable default mapping to router must be yes to allow inbound VPN terminations. (for example. for PPTP/ATMP client access to the router)

???Deny Fragmented Packets: Toggling this option to Yes causes the router to discard fragmented packets on this interface.

???You can apply these parameters to your Exposed Address lists by selecting your Exposed Address List from the pop-up menu,

3-10 Administrator???s Handbook

System Con???guration 3-11

VLAN Configuration

Overview

A Virtual Local Area Network (VLAN) is a network of computers or other devices that behave as if they are connected to the same wire even though they may be physically located on different segments of a LAN. You set up VLANs by con???guring the Gateway software rather than hardware. This makes VLANs very ???exible. VLANs behave like separate and independent networks.

Beginning with Version 8.7.4, VLANs are now strictly layer 2 entities. They can be thought of as virtual Ethernet switches, into which can be added: Ethernet ports, router IP interfaces, ATM PVC/VCC interfaces, SSIDs, and any other physical port such as USB, HPNA, or MOCA. This allows great ???exibility in how the components of a system are connected to each other.

VLANs are part of Motorola???s VGx Virtual Gateway technology which allows individual port-based VLANs to be treated as separate and distinct ???channels.??? When data is passed to a Motorola Netopia?? VGx-enabled broadband gateway, speci???c policies, routing, and prioritization parameters can be applied to each individual service, delivering that service to the appropriate networked device with the required level of quality of service (QoS). In effect, a single Motorola gateway acts as separate virtual gateways for each distinct service being delivered.

Motorola???s VGx technology provides service segmentation and QoS controls, and supports delivery of triple play applications: voice for IP Telephony, video for IPTV, and data.

Your Gateway supports the following:

???Global VLANs - these are used when trunking/tagging is required on any port member of the VLAN. Trunks are used to interconnect switches to form networks. The VLANs can communicate with each other via a trunking connection between the two switches using the router.

-Supports 802.1q and 802.1p; both are con???gurable

???Port-based VLANs - these can be used when no trunking is required

???Routed VLANs

-WAN-side VLAN with Multiple WAN IPoE/PPPoE interface support and IP interface-to-VLAN binding

-LAN-side VLAN with IP interface-to-VLAN binding

-Inter-VLAN routing groups to extend VLAN segmentation up through the IP routing layer.

???Bridged VLANs - these VLANs are used to bridge traf???c from LAN to WAN

???Prioritization per VLAN and per port

3-12 Administrator???s Handbook

Ethernet Switching/Policy Setup

Before you con???gure any VLANs, an uncon???gured Gateway is set up as a router composed of a LAN switch, a WAN switch, and a router in the middle, with LAN and WAN IP interfaces connected to their respective switches. These bindings between Ethernet switch ports, IP LAN interface, IP WAN interface and WAN physical ports are automatically created.

When you con???gure any VLANs, the default bindings are no longer valid, and the system requires explicit binding between IP interfaces and layer 2 interfaces. Each VLAN can be thought of as a layer 2 switch, and enabling each port or interface in a VLAN is analogous to plugging it in to the layer 2 switch.

Thereafter, in order for devices to communicate on layer 2, they must be associated in the same VLAN. For devices to communicate at layer 3, the devices must be either on the same VLAN, or on VLANs that have an Inter-VLAN routing group enabled in common.

When con???guring VLANs you must de???ne how traf???c needs to be forwarded:

???If traf???c needs to be bridged between LAN and WAN you can create a single VLAN that encompasses the WAN port and LAN ports.

???If traf???c needs to be routed then you must de???ne four elements:

???LAN-side VLANs

???WAN-side VLANs

???Associate IP Interfaces to VLANs

???Inter-VLAN Routing Groups: con???guration of routing between VLANs is done by association of a VLAN to a Routing Group. Traf???c will be routed between VLANs within a routing group. The LAN IP Ethernet Interface can be bound to multiple LAN VLANs, but forwarding can be limited between an Ethernet LAN port and a WAN VLAN if you properly con???gure Inter-VLAN groups.

Inter-VLAN groups are also used to block routing between WAN interfaces. If each WAN IP interface is bound to its own VLAN and if you con???gure a different Inter-VLAN group for each WAN VLAN then no routing between WAN IP interfaces is possible.

???Example: to route between a VCC and all the LAN ports, which effectively is similar to the default con???guration without any VLANs:

Create a VLAN named "WAN" consisting of your Connection Pro???le and Inter-VLAN-Routing Group-1

Create a VLAN named "LAN" consisting of Eth 0/1, Eth 0/2, Eth 0/3, Eth 0/4, SSID 1, SSID 2, SSID 3, SSID 4 (etc.), and Inter-VLAN-Routing Group-1

System Con???guration 3-13

An example of multiple VLANs, using a Netopia Router with VGx managed switch technology, is shown below:

A VLAN Model Combining Bridging and Routing

System Con???guration 3-15

The Add VLAN screen appears.

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes. Configure a new VLAN and its associated ports.

You can create up to 16 VLANs, and you can also restrict any VLAN, and the computers on it, from administering the Router.

???VLAN ID ??? The VLAN ID ???eld allows you to enter a VID. This must be a unique identifying number between 1 and 4094. (A VID of zero (0) is permitted on the Ethernet WAN port only.)

???VLAN Type ??? LAN or WAN Port(s) can be enabled on the VLAN. See ???Adding Port interfaces??? on page 3-20 for more information. You can choose a type designation as follows:

port-based: Traf???c sent to this port will be treated as belonging to the VLAN, and will not be forwarded to other ports that are not within a common VLAN segment.

global: Indicates that the ports joining this VLAN are part of a global 802.1q Ethernet VLAN. This VLAN includes ports on this Router and may include ports within other devices throughout the network. The VID in this case may de???ne the behavior of traf???c between all devices on the network having ports that are members of this VLAN segment.

???VLAN Name ??? A descriptive name for the VLAN.

3-16 Administrator???s Handbook

???VLAN Network ??? From the VLAN Network pop-up menu select None, Primary LAN, a Connection Pro???le (for the IP networking con???guration) or, if you have con???gured an Additional LAN (ALAN), an Additional LAN. See

???Additional LANs??? on page 7-38.

Once a VLAN has been successfully added, configure ports using the "Add Port Interface" option of the "Display/Change VLAN" menu.

???802.1x ??? This option is only available for Router models with VGx technology. Otherwise, it does not appear. If you are con???guring a VLAN for a Motorola Netopia?? Router model with VGx technology (wired or wireless), you can specify a RADIUS server for user authentication by toggling 802.1x to Yes. See ???Adding a RADIUS Pro???le??? on page 3-18. The default is No.

System Con???guration 3-17

Associating Inter-VLAN Routing Groups

Note: You must ???rst ADD the VLAN before associating the Inter-VLAN-Routing Groups or the Port Interfaces. Once you have added the VLAN, you access the Inter-VLAN-Routing screen and the Add Port Interface screen by selecting Display/Change VLAN from the VLAN Con???guration screen.

???Inter-VLAN-Routing ??? Inter-VLAN groups allow VLANs in the group to route traf???c to the others as discussed on page 3-12; ungrouped VLANs cannot route traf???c to each other.

When you select Inter-VLAN-Routing, the Inter-VLAN-Routing screen appears.

For each VLAN Group that you want to route traf???c to each other, toggle VLAN Group-n Enabled to On and press Return.

Press Escape to return to the Add VLAN screen.

3-18 Administrator???s Handbook

Adding a RADIUS Profile

???Authentication Pro???le ??? If you toggle 802.1x to Yes, this option displays. Select Authentication Pro???le and press Return.

If you have RADIUS server pro???les already de???ned, the pop-up menu allows you to select one for use with this VLAN. If none are de???ned, the pop-up menu offers the option to con???gure a RADIUS Pro???le.

Caution!If you enable 802.1x for a VLAN that includes a wireless SSID, you must access the Wireless LAN Con???guration menu and set Enable Privacy to WPA-802.1x as well. See ???Enable Privacy??? on page 3-41. If multiple SSIDs are split across several VLANs, the VLANs must either:

???all have 802.1x enabled with WPA-802.1x enabled in Wireless Privacy, or

???have the VLANs set to 802.1x disabled and Wireless Privacy set to some other privacy setting. In that case Wireless Privacy can be any setting. Wireless does not currently support separate privacy modes per SSID.

When enabling WPA-802.1x, wireless will default to the RADIUS con???guration speci???ed in Advanced Security Options (see ???Advanced Security Options??? on page 10-5), unless it is part of a VLAN. If it is part of a VLAN it will use the VLAN authentication pro???le's speci???ed RADIUS server.

Select Add RADIUS Pro???le and press Return.

The Add Server Pro???le screen appears.

The Add Server Pro???le screen allows you to specify the RADIUS server and its authentication credentials to be associated with your VLAN.

???Pro???le Name ??? Enter a descriptive name for the pro???le, up to 35 characters.

???Remote Server Addr/Name ??? Enter the IP address or fully quali???ed server name.

???Remote Server Secret ??? Enter the server CHAP secret.

???Alt Remote Server Addr/Name ??? If you have an alternate RADIUS server, enter the IP address or server name here, as above.

???Alt Remote Server Secret ??? If you have an alternate RADIUS server, enter the server CHAP secret here, as above.

???RADIUS Identi???er ??? Enter the RADIUS Network Access Server (NAS) identi???er. The default NAS identi- ???er is an ASCII representation of the server???s base MAC address.

???RADIUS Server Authentication Port ??? Ordinarily, the RADIUS server port number is 1812. If you are using a different port number, enter it here.

Select ADD PROFILE and press Return. You will be returned to the Add VLAN screen.

3-20 Administrator???s Handbook

Adding Port interfaces

Note: You must ???rst ADD the VLAN before associating the Inter-VLAN-Routing Groups or the Port Interfaces. Once you have added the VLAN, you access the Inter-VLAN-Routing screen and the Add Port Interface screen by selecting Display/Change VLAN from the VLAN Con???guration screen.

Once you have created a VLAN entry you must associate it with a port interface. This interface may be either a physical port, such as USB or Ethernet, or a Network ID (SSID) of a wireless LAN. If you have a Motorola Netopia?? Router model that offers Motorola???s VGx technology, you can also associate a VLAN with each of the physical Ethernet managed switch ports.

When setting up a VLAN, typically you will add one or more physical ports, such as an Ethernet port or a wireless SSID.

Note: You can associate two VLANs, one of which is 802.1x authenticated and the other is not, with the same port. This allows you to have authenticated access for PCs on the wired-or wireless LAN to non-authenticated devices such as print servers.

Return to the VLAN Con???guration screen, select Display/Change VLAN, and from the pop-up menu, select the VLAN ID to be modi???ed.

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

The Display/Change VLAN screen appears.

System Con???guration 3-21

Add Port Interface...

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes.

Select Add Port Interface and press Return.

The Add Port Interface screen appears. The Add Port Interface screen varies depending on the types of ports available on your Motorola Netopia?? Router. (The example below shows the four Ethernet ports, four wireless SSIDs, and the Easy Setup Connection Pro???le that was created in your initial con???guration of a 4-port wireless VGx model.)

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

From the Port Interfaces pop-up menu, select the port(s) that you want to associate with this VLAN.

You specify the characteristics of the VLAN by setting the next three parameters:

???Tag ??? The Tag option is only available on global type ports. Packets transmitted from this port through this VLAN must be tagged with the VLAN VID. Packets received through this port destined for this VLAN must be tagged with the VLAN VID by the source.

3-22 Administrator???s Handbook

???TOS-Priority ??? Use any 802.1p priority bits in the VLAN header to prioritize packets within the Gateway???s internal queues, according to DiffServ priority mapping rules. See ???Diffserv Options??? on page 2-22 for more information.

???IPTOS-Promote ??? Write any 802.1p priority bits into the IP-TOS header bit ???eld for received IP packets on this port destined for this VLAN. Write any IP-TOS priority bits into the 802.1p priority bit ???eld for tagged IP packets transmitted from this port for this VLAN. All mappings between Ethernet 802.1p and IP-TOS are made according to a pre-de???ned QoS mapping policy. The pre-de???ned mapping can now be set in the CLI. See the Command Line Interface Commands Reference for more information.

Select COMMIT and press Return. Your VLAN settings will be associated with the port you have selected.

Example:

Add Port Interface...

Change Port Interface...

Display/Delete Port Interface...

Return/Enter to Add Port Interface to VLAN.

Note: VLAN changes require a reboot to take effect. See ???Restarting the System??? on page 11-8.

System Con???guration 3-23

Changing or Deleting a VLAN

You can change or delete a VLAN by returning to the VLAN Con???guration screen and selecting Display/Change VLAN or Delete VLAN. In either case, select the VLAN that you want to change or delete from the pop-up menu, and press Return.

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

3-26 Administrator???s Handbook

Add Server Profile

Remote Server Addr/Name:

Remote Server Secret:

Alt Remote Server Addr/Name:

Alt Remote Server Secret:

RADIUS Identifier:

RADIUS Server Authentication Port: 1812

Return accepts * ESC cancels * Left/Right moves insertion point * Del deletes. Configure a new RADIUS or TACACS profile.

Con???gure your pro???le in the same way as described in ???Adding a RADIUS Pro???le??? on page 3-18.

Note: VLAN changes require a reboot to take effect. See ???Restarting the System??? on page 11-8.

3-28 Administrator???s Handbook

2.Enter a VLAN ID (1 ??? 4094) and enter the VLAN Name you would like.

Once a VLAN has been successfully added, configure ports using the "Add Port Interface" option of the "Display/Change VLAN" menu.

ADD VLANCANCEL

Return/Enter to select <among/between> ...

Configure a new VLAN and its associated ports.

For example, call it Network A. This VLAN will be for SSID 2, which is a "closed system" SSID, and the Ethernet ports.

3.For the VLAN Network select the Primary LAN from the pop-up menu.

Once a VLAN has been successfully added, configure ports using the "Add Port Interface" option of the "Display/Change VLAN" menu.

ADD VLANCANCEL

4.Select ADD VLAN and press Return.

This creates the VLAN and returns you to the VLAN Con???guration screen.

5.In the VLAN Con???guration screen select Display/Change VLAN, and from the pop-up menu select Network A (which you have just created).

System Con???guration 3-29

Then select Inter-VLAN-Routing. The Inter-VLAN-Routing screen appears.

Toggle VLAN Group-1 Enabled to On and press Return. Press Escape to return to the previous screen.

6.Select Add Port Interface and press Return.

Add Port Interface...

Return/Enter to Add Port Interface to VLAN.

In the Add Port Interface screen, you add the Port Interfaces you want associated with the VLAN.

In this case, select all of the physical Ethernet ports: Eth 0/1 through Eth 0/4, and wireless SSID 2. You must select the interfaces one at a time and press COMMIT for each one.

System Con???guration 3-31

7.In the Add VLAN screen, create your second VLAN.

Once a VLAN has been successfully added, configure ports using the "Add Port Interface" option of the "Display/Change VLAN" menu.

ADD VLANCANCEL

Return/Enter to select <among/between> ...

Configure a new VLAN and its associated ports.

The VLAN Name must be given another unique name. For example, call it Network B. This will be for SSID 1.

8.For the VLAN Network select the Primary LAN from the pop-up menu.

Once a VLAN has been successfully added, configure ports using the "Add Port Interface" option of the "Display/Change VLAN" menu.

ADD VLANCANCEL

9.Select ADD VLAN and press Return.

This creates the VLAN and returns you to the VLAN Con???guration screen.

10.In the VLAN Con???guration screen select Display/Change VLAN, and from the pop-up menu select Network B (which you have just created).

3-32 Administrator???s Handbook

11.Select Inter-VLAN-Routing and press Return. Toggle VLAN Group-2 Enabled to On and press Return.

Since we do not want this VLAN to communicate with the other LAN ports, it must be made part of a different Inter-VLAN-Routing group, Group-2.

Press Escape to return to the previous screen.

12. Select Add Port Interface and press Return.

Add Port Interface...

Change Port Interface...

Display/Delete Port Interface...

System Con???guration 3-33

In the Add Port Interface screen, you add the Port Interfaces you want associated with this VLAN.

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

Select the SSID 1 port interface.

Add Port Interface...

TOS-Priority:No

IPTOS-Promote:No

Add A Port Interface to a VLAN.

13. Select COMMIT and press Return. Press Escape.

3-36 Administrator???s Handbook

Add Port Interface...

Change Port Interface...

Display/Delete Port Interface...

Return/Enter to Add Port Interface to VLAN.

Members of Groups 1 and 2 will now be able to communicate with the Internet (WAN), but not with each other.

17. Once you have ???nished with the VLAN con???guration restart the Motorola Netopia?? Router.

System Con???guration 3-37

Date and time

You can set the system???s date and time parameters in the Set Date and Time screen. Date and Time parameters govern the reporting of system events. These events are recorded in the system logs.

Select Date and Time in the System Con???guration screen and press Return. The Set Date and Time screen appears.

By default, Network Time Protocol (NTP) is enabled, allowing your Router to obtain Date and Time information periodically over the Internet. You do not have to reset the system clock manually.

However, manual control is available if you desire it.

Follow these steps to adjust the system???s date and time parameters manually:

1.Toggle NTP (Network Time Prot.) Enabled to On to synchronize the Router???s time and date with a network server. Toggle this ???eld to Off to manually set the time and date; the options in this screen will change to allow you to manually enter the time and date parameters. Motorola Netopia?? Embedded Software Version 8.7.4 updates timestamps reported in the system logs with new timestamps as these are updated via NTP. See ???Statistics & Logs??? on page 9-3.

Note: If time and date are manually set, that information will be lost upon reboot or loss of power.

2.Enter the IP address of the time server in the ???eld Time Server 1 Host Name/IP Address and, alternatively, Time Server 2 Host Name/IP Address, if you prefer to use server(s) different from the defaults.

3.Select the Router???s time zone from the Time Zone pop-up menu and press Return.

4.In the NTP Update Interval ???eld, enter how often to synchronize with the time server, using the format HHHH:MM where H is hours and M is minutes.

System Con???guration 3-39

???Block Wireless Bridging: Toggle this setting to Yes to block wireless clients from communicating with other wireless clients on the LAN side of the Gateway.

???Channel: (1 through 11) on which the network will broadcast. This is a frequency range within the 2.4Ghz band. Channel selection depends on government regulated radio frequencies that vary from region to region. The widest range available is from 1 to 14. However, in North America only 1 to 11 may be selected. Europe, France, Spain and Japan will differ. Channel selection can have a signi???cant impact on performance, depending on other wireless activity close to this Gateway. Channel selection is not necessary at the client computers; the clients will scan the available channels seeking access points using the same ESSID as the client.

???AutoChannel: (only available for 802.11G models). AutoChannel is a feature that allows the Netopia Router to determine the best channel to broadcast automatically.

Three settings are available from the pull-down menu: Off, At Startup, and Continuous.

???Off is the default setting; the Netopia Router will use the con???gured default Channel selected from the previous menu.

???At Startup causes the Netopia Router at startup to brie???y initialize on the default channel, then per- form a full two- to three-second scan, and switch to the best channel it can ???nd, remaining on that channel until the next reboot.

???Continuous performs the at-startup scan, and will continuously monitor the current channel for any other Access Point activity. If Access Point activity is detected on the same channel, the Motorola Netopia?? Router will initiate a scan of the other channels, locate a less active one, and switch. Once it has switched, it will remain on this channel for at least 30 minutes before switching again if a new Access Point is detected.

Note: Channel scans can be disruptive to normal wireless activity and may take a few minutes.

???Closed System: If you toggle Closed System to Closed, the wireless network is hidden from the scanning features of wireless client computers. Unless both the wireless clients and the Router share the same SSID in Closed System mode, the Router???s wireless LAN will not appear as an available network when scanned for by wireless-enabled computers. Members of the Closed System WLAN must log onto the Router???s wireless network with the identical SSID as that con???gured in the router.

Closed System mode is an ideal way to increase wireless security and to prevent casual detection by unwanted neighbors, of???ce users, or malicious users such as hackers.

If you toggle it to Open, it is more convenient, but potentially less secure, for clients to access your WLAN by scanning available access points. You must decide based on your own network requirements.

3-40 Administrator???s Handbook

Note: Enabling Closed System Mode on your wireless Gateway provides another level of security, since your wireless LAN will no longer appear as an available access point to client PCs that are casually scanning for one.

Your own wireless network clients, however, must log into the wireless LAN by using the exact SSID of the Motorola Netopia?? Gateway.

In addition, if you have enabled WEP encryption on the Motorola Netopia?? Gateway, your network clients must also have WEP encryption enabled, and must have the same WEP encryption key as the Motorola Netopia?? Gateway.

Once the Motorola Netopia?? Gateway is located by a client computer, by setting the client to a matching SSID, the client can connect immediately if WEP is not enabled. If WEP is enabled then the client must also have WEP enabled and a matching WEP key.

Wireless client cards from different manufacturers and different operating systems accomplish connecting to a wireless LAN and enabling WEP in a variety of ways. Consult the documentation for your particular wireless card and/or operating system.

Wireless Multimedia (WMM)

Wireless Multimedia is an advanced feature that allows you to prioritize various types of data travelling over the wireless network. Certain types of data that are sensitive to delays, such as voice or video, must be prioritized ahead of other, less delay-sensitive types, such as email.

Wireless Multimedia implements wireless Quality of Service (QoS) by transmitting data depending on Diffserv priority settings. See ???Diffserv Options??? on page 2-22. These priorities are mapped into four Access Categories (AC), in increasing order of priority:

???Background (BK),

???Best Effort (BE),

???Video (VI), and

???Voice (VO).

It requires Wireless Multimedia (WMM)-capable clients, usually a separate feature enabled at the client network settings, and client PC software that makes use of Differentiated Services (Diffserv). Refer to your operating system instructions for enabling Diffserv QoS.

3-42 Administrator???s Handbook

Wireless LAN Configuration

Wireless Multiple SSID Setup...

MAC Address Authentication...

Select an 8 to 63 character passphrase. At least 20 is ideal for best security.

???WPA - 802.1x: If you select WPA - 802.1x you can then con???gure a RADIUS server to authenticate users of the wireless network. To do this, you must return to the Security menu, Advanced Security Options to specify the RADIUS server you want to use. See ???Advanced Security Options??? on page 10-5 and ???VLAN Con???guration??? on page 3-11.

Wireless LAN Configuration

Configure a RADIUS server in the Security menu, under Advanced Security Options, to authenticate using 802.1x. If the SSID is part of a VLAN, it will use the VLAN's

configured RADIUS server in the Authentication Profile instead.

Wireless Multiple SSID Setup...

MAC Address Authentication...

???WPA Version: If you select either WPA-802.1x or WPA-PSK as your privacy setting, the WPA Version pop-up menu allows you to select the WPA version(s) that will be required for client connections. Choices are:

??? All, for maximum interoperability,

System Con???guration 3-43

???WPA Version 1, for backward compatibility,

???WPA Version 2, for maximum security.

All clients must support the version(s) selected in order to successfully connect.

Wireless Multiple SSID Setup...

MAC Address Authentication...

???WEP: Alternatively, you can provide a level of data security by enabling WEP (Wired Equivalent Privacy) for encryption of network data. You can enable 40-, 128-, or 256-bit WEP Encryption (depending on the capability of your client wireless card) for IP traf???c on your LAN.

Wireless Multiple SSID Setup...

MAC Address Authentication...

3-44 Administrator???s Handbook

You select a single key for encryption of outbound traf???c. The WEP-enabled client must have an identical key of the same length, in the identical slot (1 ??? 4) as the Gateway, in order to successfully receive and decrypt the traf???c. Similarly, the client also has a ???default??? key that it uses to encrypt its transmissions. In order for the Gateway to receive the client???s data, it must likewise have the identical key of the same length, in the same slot. For simplicity, a Gateway and its clients need only enter, share, and use the ???rst key.

The pop-up menu for enabling WEP offers these settings: On - Automatic or On - Manual.

???On - Automatic uses a passphrase to generate encryption keys for you. You enter a passphrase that you choose in the Passphrase ???eld. The passphrase can be any string of words or numbers.

Note: While clients may also have a passphrase feature, these are vendor-speci???c and may not necessarily create the same keys. You can passphrase generate a set of keys on one, and manually enter them on the other to get around this.

Select the Default Key (#1 ??? #4). The longer the key, the stronger the encryption and the more dif???cult it is to break the encryption.

???On - Manual allows you to enter your own encryption keys manually. This is a dif???cult process, but only needs to be done once. Avoid the temptation to enter all the same characters.

Default Key (#1 ??? #4): Speci???es which key the Router will use to encrypt transmitted traf???c. The default is key #1.

Key (#1 ??? #4): The encryption keys. You enter keys using hexadecimal digits. For 40/64bit encryption, you need ten digits; 26 digits for 128bit, and 58 digits for 256bit WEP. Hexadecimal characters are 0 ??? 9, and a ??? f. The longer the key, the stronger the encryption and the more dif???cult it is to break the encryption.

Examples:

40bit: 02468ACE02

128bit: 0123456789ABCDEF0123456789

System Con???guration 3-45

256bit: 592CA140F0A238B0C61AE162F592CA140F0A238B0C61AE162F21A09C

Multiple SSIDs

???Wireless Multiple SSID Setup: This feature allows you to add additional network identi???ers (SSIDs or Network Names) for your wireless network.

To enable it, select Wireless Multiple SSID Setup and press Return. The Multiple SSID Con???guration screen appears.

Configure additional wireless SSID's that clients can associate with.

Toggle Enable Multiple SSIDs to Yes, and enter names or other identi???ers for up to three additional SSIDs you want to create.

3-48 Administrator???s Handbook

???Allow only speci???ed addresses - limits access to only those addresses that you enter.

???Deny only speci???ed addresses - prevents access from only those addresses that you enter.

If you want to apply MAC Authentication to addresses on the wired LAN as well as the wireless LAN, toggle

Wireless Only to No.

Note: The Wireless Only option appears only on models equipped with a wireless interface.

Select Add MAC Address and press Return. The Add MAC Address screen appears.

Return/Enter accepts * Tab toggles * ESC cancels.

Configure a new MAC in this Screen.

Enter the MAC (hardware) address of the client PC you want to authorize for access to your wireless LAN. MAC Allowed is set to Yes (enabled) by default. Toggling this to No (disabled) speci???cally denies access from this MAC address.

Select ADD MAC NOW, and press Return.

Your entry will be added to a list of up to 32 authorized addresses. To display the list of authorized MAC addresses, select Display/Change MAC Addresses from the Authorized MAC Addresses menu.

The list is displayed as shown below.

3-50 Administrator???s Handbook

1.Select 57600, 38400, 19200, or 9600.

Console Configuration

2.Select SET CONFIG NOW to save the new parameter settings. Select CANCEL to leave the parameter unchanged and exit the Console Con???guration screen.

SNMP (Simple Network Management Protocol)

These screens allow you to monitor and con???gure your network by means of a standard Simple Network Management Protocol (SNMP) agent.

???Details are given in ???Simple Network Management Protocol (SNMP)??? on page 9-8.

Security

These screens allow you to add users and de???ne passwords on your network.

???Details are given in ???Security??? on page 10-1.

Upgrade Feature Set

You can upgrade your Motorola Netopia?? Router by adding new feature sets through the Upgrade Feature Set utility.

See the release notes that came with your Router or feature set upgrade, or visit the Motorola Web site at www.netopia.com for information on new feature sets, how to obtain them, and how to install them on your Router.

System Con???guration 3-51

Router/Bridge Set

For Motorola Netopia?? DSL Routers, this feature allows you to turn off the routing features and use your device as a bridge. It is not an option for Ethernet WAN models. Motorola Netopia?? Embedded Software Version 8.7.4 further allows you to choose to have the Router both bridge and route IP traf???c. If you select either option, the device will restart itself, and reset all the settings to factory defaults. Any con???gurations you have made will be erased. Use this feature with caution. If you decide to change it again, you must recon???gure the device from scratch.

From the Main Menu, select System Con???guration.

Select Router/Bridge Set and form the pop-up menu, choose the option you want:

???Router ??? retains the full routing features and corresponding menus.

???Bridge ??? the device becomes a simple bridge, offering no routing features. Corresponding menus are hidden.

???Mixed-bridging-routing ??? allows concurrent bridging and routing and retains corresponding menus for routing features.

You will be challenged to con???rm your choice.

3-52 Administrator???s Handbook

If you chose CONTINUE, the device will reboot and restart in the selected mode. Routing features will be disabled or changed and the Telnet menus corresponding con???guration items, such as Easy Setup, will be removed.

Example of Bridge-only mode menus

Netopia Router

WAN Configuration...

System Configuration...

Utilities & Diagnostics...

Statistics & Logs...

Quick View...

If you decide to return to the previous mode, you can repeat the process. Remember that you will have to recon???gure all your previous settings.

IGMP (Internet Group Management Protocol)

Multicasting is a method for transmitting large amounts of information to many, but not all, computers over an Internet. One common use is to distribute real time voice, video, and data services to the set of computers which have joined a distributed conference. Other uses include: updating the address books of mobile computer users in the ???eld or sending out company newsletters to a distribution list.

Since a router should not be used as a passive forwarding device, Motorola Netopia?? Routers use a protocol for forwarding multicasting: Internet Group Management Protocol (IGMP).

Motorola Netopia?? Gateways support IGMP Version 1, Version 2 or Version 3. See ???Multicast Forwarding??? on page 7-32 for more information.

Unicasting multicast-streams for a wireless link aims at improving the receipt of multicast data by a wireless client. (The router replaces the multicast MAC-address with the physical MAC-address of the wireless client. If there is more than one wireless client interested in the same multicast group, the router will revert to multicasting the stream immediately. When one or more wireless clients leave a group, and the router determines that only a single wireless client is interested in the stream, it will once again unicast the stream.)

This feature is only available if IGMP Snooping is enabled.

IGMP ???Snooping??? is a feature of Ethernet layer 2 switches that ???listens in??? on the IGMP conversation between computers and multicast routers. Through this process, it builds a database of where the multicast routers reside by noting IGMP general queries used in the querier selection process and by listening to other router protocols.

System Con???guration 3-53

From the host point of view, the snooping function listens at a port level for an IGMP report. The switch then processes the IGMP report and starts forwarding the relevant multicast stream onto the host's port. When the switch receives an IGMP leave message, it processes the leave message, and if appropriate stops the multicast stream to that particular port. Basically, customer IGMP messages although processed by the switch are also sent to the multicast routers.

In order for IGMP snooping to function with IGMP Version 3, it must always track the full source ???lter state of each host on each group, as was previously done with Version 2 only when Fast Leave support was enabled.

To con???gure the IGMP options available in Motorola Netopia?? Routers, select IGMP (Internet Group Management Protocol) and press Return.

The IGMP Setup screen appears.

IGMP Setup

Return/Enter accepts * Tab toggles * ESC cancels.

You can set the following options:

???IGMP Snooping ??? toggling this option to On enables the Motorola Netopia?? Router to ???listen in??? to IGMP traf???c. The Router discovers multicast group membership for the purpose of restricting multicast transmissions to only those ports which have requested them. This helps to reduce overall network traf???c from streaming media and other bandwidth-intensive IP multicast applications.

???Wireless M2U (Wireless Multicast-to-Unicast) ??? if IGMP Snooping is set to On, toggling this option to On permits mapping an IP multicast to a wireless unicast. If IGMP Snooping is set to Off, this option does not appear. Wireless M2U allows a higher wireless transmission rate to be used to "stream" IP multicast packets. This mapping is limited to a single stream to a single client per group, otherwise the router will revert to multicasting the stream immediately.

???Robustness ??? a way of indicating how sensitive to lost packets the network is. IGMP can recover from robustness minus 1 lost IGMP packet. The default value is 2.

???Query Interval(s) ??? the amount of time in seconds between IGMP General Query messages sent by the querier router. The default query interval is 125 seconds.

3-54 Administrator???s Handbook

???Query Response Interval (deci-sec) ??? the maximum amount of time in tenths of a second that the IGMP router waits to receive a response to a General Query message. The default query response interval is 10 seconds and must be less than the query interval.

???Unsolicited Report Interval(s) ??? the amount of time in seconds between repetitions of a particular computer???s initial report of membership in a group. The default unsolicited report interval is 10 seconds.

???IGMP Querier Version ??? select a version of the IGMP Querier from the pop-up menu: v1, v2 or v3. If you know you will be communicating with other hosts that are limited to v1 or v2, for backward compatibility, select accordingly; otherwise, allow the default v3.

If you have upgraded from earlier software versions, and had previously selected v2, v3 will be the new default.

Note: IGMP Querier version is relevant only if the router is con???gured for IGMP forwarding. If any IGMP v1 routers are present on the subnet, the querier must use IGMP v1. The use of IGMP v1 must be administratively con???gured, since there is no reliable way of dynamically determining whether IGMP v1 routers are present on a network. IGMP forwarding is enabled per IP Pro???le and WAN Connection Pro???le.

See ???Multicast Forwarding??? on page 7-32 for more information.

If you chose IGMP Querier Version v2 or v3, select V2/V3 Settings, and press Return.

The IGMP V2/V3 Settings screen appears.

Amount of time in deci-seconds that the IGMP router waits to receive a response

You can con???gure the following parameters:

???Last Member Query Interval (deci-sec) ??? the amount of time in tenths of a second that the IGMP router waits to receive a response to a Group-Speci???c Query message. The last member query interval is also the amount of time in seconds between successive Group-Speci???c Query messages. The default last member query interval is 1 second (10 deci-seconds).

System Con???guration 3-55

???Last Member Query Count ??? the number of Group-Speci???c Query messages sent before the router assumes that there are no members of the host group being queried on this interface. The default last member query count is 2.

???Fast Leave ??? Toggling this option to On enables a non-standard expedited leave mechanism. The querier keeps track of which client is requesting which channel by IP address. When a leave message is received, the querier can check its internal table to see if there are any more clients on this group. If there are none, it immediately sends an IGMP leave message to the upstream querier. By default, Fast Leave is set to Off.

Press Escape twice to return to the System Con???guration menu.

Logging

You can con???gure a UNIX-compatible (BSD syslog protocol - RFC 3164) syslog client to report a number of subsets of the events entered in the Router???s WAN Event History. See ???WAN Event History??? on page 9-4.

Select Logging from the System Con???guration menu.

The Logging Con???guration screen appears.

Logging Configuration

Return/Enter accepts * Tab toggles * ESC cancels.

By default, all events are logged in the event history.

???By toggling each event descriptor to either Yes or No, you can determine which ones are logged and which are ignored.

???You can enable or disable the syslog client dynamically. When enabled, it will report any appropriate and previously unreported events.

???You can specify the syslog server???s address either in dotted decimal format or as a DNS name up to 63 characters.

???You can specify the UNIX syslog Facility to use by selecting the Facility pop-up.

3-56 Administrator???s Handbook

???The following three ???elds allow you to log exceptions based on your ???lter policies:

???Filter Violations,

???Accepted Packets, and

???Access Attempts

See ???About Filters and Filter Sets??? on page 10-20 for more information.

You will need to install a Syslog client daemon program on your PC and con???gure it to report the WAN events you speci???ed in the Logging Con???guration screen.

The following screen shows a sample syslog dump of WAN events:

Log event dispositions

Note: Syslog must be enabled to comply with Logging requirements mentioned in The Modular Firewall Certi???cation Criteria - Baseline Module - version 4.1 (speci???ed by ICSA Labs).

For more information, please go to the following URL:

http://www.icsalabs.com/icsa/docs/html/communities/firewalls/pdf/4.1/baseline.pdf

System Con???guration 3-57

Message format

Protocol:<TCP/UDP> srcIP: <value> dstIP: <value> srcPort: <value> dstPort<value> <reason-string>

Protocol:<ICMP> srcIP: <value> dstIP: <value> type:<value> code:<value> <reason-sting>

Protocol:<value> srcIP: <value> dstIP: <value> <reason-sting>

The following syslog messages may be generated by the Router based on system-events:

1.permitted

2.attempt

3.administrative access authenticated and allowed

4.administrative access allowed

5.dropped - violation of security policy

6.dropped - invalid checksum

7.dropped - invalid data length

8.dropped - fragmented packet

9.dropped - cannot fragment

10.dropped - no route found

11.dropped - possible land attack

12.dropped - reassembly timeout

13.dropped - illegal size

14.dropped - invalid IP version

15.TCP SYN ???ood detected

16.Telnet receive DoS attack - packets dropped

17.administrative access denied - telnet access not allowed

18.administrative access denied - invalid user name

19.administrative access denied - invalid password

20.administrative access attempted

21.administrative access denied - web access not allowed

3-58 Administrator???s Handbook

The following syslog messages may be generated by the router if WAN Event Log Options are enabled:

1.Device Restarted

2.EN: IP up, WAN 1, gateway: <IP Address> local: <IP Address>

3.Received NTP Date and Time [mon][dd][hh][mm][ss][year]

4.NTP con???guration has been changed

5.System Date/Time con???guration changed

6.PPP: IPCP negotiated, session [sessionID], rem: [IP Address] local: [IP Address]

7.RFC1483-[ID]: IP up, gateway: [IP Address] local: [IP Address]

8.PPP: Channel [channelID] up [reason] Pro???le name: [name]

9.PPP: NCP up, session [sessionID] Channel [channelID] Final (fallback) negotiated auth: Local [IP Address], Remote [IP Address]

10.PPP: MP negotiated, session [sessionID] Remote EDO: [value]

11.PPP: CCP negotiated, session [sessionID], type: [type] Local mode: [mode], Remote mode: [mode]

12.* PPP:[sessionID] authentication failed, Channel [channelID] Reason: [reason]

13.PPP: [authentication type] remote accepted us, Channel [ChannelID] Remote name: [name]

14.PPP: [authentication type] we accepted remote, Channel [ChannelID] Remote name: [name]

15.PPP: NCP up (more) Remote (auth) name: [name]

16.* PPP: Remote auth name not found: [name]

17.PPP: BACP negotiated, session [sessionID] Local MN: [local], Remote MN: [remote]

18.PPP: IPCP down, session [sessionID]

19.PPP down:[reason]

20.IP: Demand call requested by [IP Address] to IP destination [IP Address]

21.PPP: Timeout, session [sessionID]

22.>>WAN: [ID} activated at [rate] Kbps

23.>>WAN: [ID] deactivated

24.* WAN: data link inactive, no valid pro???le

25.RFC1483-[ID]: IP up, gateway: [IP Address] local: [IP Address]

26.RFC1483-[ID]: IP down

27.RFC1483-[ID]: IP connection refused

28.RFC1483-[ID]: IP up, local: [IP Address]

29.PPPOE:[ID] pro???le [Pro???le Name]

30.PPPOE: PADI Sent

31.PPPOE: PADO Received

32.PPPOE: PADR Sent

System Con???guration 3-59

33.PPPOE: PADS Received

34.PPPOE: PADT Received

35.PPPOE: PADT Sent

36.PPPOE: Discovery state started pro???le [Pro???le Name]

37.PPPOE: Session state started pro???le [Pro???le Name]

38.PPPoE: Auth. Failed with Server: [Server]

39.PPTP: IP up, rem: [IP Address], via: [IP Address] tunnel id: [ID]

40.PPTP: IP down, rem: [IP Address] tunnel id: [ID]

41.IPsec: VPN installed:pro???le: [Name], spi: [SPI], rem sg: [IP Address]

42.IPsec: VPN fail: pro???le: [Name]

43.IPsec: VPN removed: pro???le: [Name], spi: [SPI], rem sg: [IP Address]

44.IPsec: tx: spi not found, pro???le [Name]

45.IPsec: tx: no remote sg, pro???le [Name]

46.IPsec: tx: local vpn, pro???le [Name], spi [SPI], src [IP Address]

47.IPsec: tx: remote vpn, pro???le [Name], spi [SPI], dest [IP Address]

48.IPsec: tx: remote route, pro???le [Name], spi [SPI], sg [IP Address]

49.IPsec: tx: local addr, pro???le [Name], spi [SPI], sg [IP Address]

50.IPsec: rx: spi mismatch, pro???le [Name], spi [SPI], sg [IP Address]

51.IPsec: rx: auth fail, pro???le [Name], spi [SPI], sg [IP Address]

52.IPsec: rx: crypt fail, pro???le [Name], spi [SPI], sg [IP Address]

53.IPsec: rx: spi not found, protocol [Prot], spi [SPI], sg [IP Address]

54.IPsec: rx: sg mismatch, pro???le [Name], spi [SPI], sg [IP Address]

55.IPsec: rx: sa proto, pro???le [Name], spi [SPI], sg [IP Address]

56.IPsec: rx: unknown protocol, pro???le [Name], spi [SPI], sg [IP Address]

57.IPsec: rx: vpn host accepted, pro???le [Name], spi [SPI], sg [IP Address]

58.IPsec: rx: vpn host rejected, pro???le [Name], spi [SPI], sg [IP Address]

59.IPcomp: compression failure, pro???le [Name], spi [SPI], sg [IP Address]

60.IPcomp rx: IPcomp mismatch?, pro???le [Name], spi [SPI], sg [IP Address]

61.Last message repeated [Num.] times

62.IKE: no ph1 preferences assigned, sg [IP Address]

63.IKE: DNS lookup failure, pro???le [Name]

64.IKE: no matching ph1 pro???le: sg [IP Address]

65. IKE: no matching ph1 proposal sg [IP Address] pro???le [Name], sg [IP Address]

3-60 Administrator???s Handbook

74.L2TP: tunnel up, rem: [IP Address], via: [IP Address] id: [ID]

75.L2TP: tunnel down, rem: [IP Address], tunnel id: [ID]

76.L2TP: peer failed to authenticate, tunnel id: [ID]

77.L2TP: no matching pro???le for rcvd hostname, id: [ID]

78.L2TP: session up, session id: [SessionID], tunnel id: [ID]

79.L2TP: session down, session id: [SessionID]

80.L2TP: tunnel result code = [Result], error code = [Error]

81.L2TP: session result code = [Result], error code = [Error]

82.SCHED: Next retry in [Num.] seconds pro???le [Name]

Procedure for Default Installation for ICSA firewall certification of Small/Medium Business Category Module (ADSL Routers)

Note: The following installation procedure outlines steps needed to enable required features to comply with ICSA ???rewall certi???cation. For more information please go to the following URLs:

http://www.icsalabs.com/icsa/docs/html/communities/firewalls/pdf/4.1/baseline.pdf

http://www.icsalabs.com/icsa/docs/html/communities/firewalls/pdf/4.1/smb.pdf

Install via the Console menu

1.Access the Router through the serial interface (if available) or telnet to the product from the private (LAN) side. DHCP server is enabled on LAN by default. See ???Connecting through a Telnet Session??? on page 1-4.

Set up a Connection Pro???le to con???gure WAN connectivity: (Follow the Easy Setup instructions in the Quickstart Guide, or create a new Connection Pro???le. See ???Creating a New Connection Pro???le??? on page 2-8.)

2.Go to Easy Setup???

3.Set Data Circuit VPI (0-255) to the desired value

4.Set Data Circuit VCI (32-65535) to the desired value

5.Select NEXT SCREEN

System Con???guration 3-61

6.Choose None as the value for Underlying Encapsulation???

7.Local WAN IP Address and Local WAN IP Mask can be left at 0.0.0.0 if WAN interface can receive IP Address from a DHCP server

8.Select NEXT SCREEN

9.Primary Domain Name Server and Secondary Domain Name Server can be left at 0.0.0.0, if dynamic address is used on WAN

10.Select RESTART DEVICE

Set up administrative interface access restriction

(See ???Telnet Tiered Access ??? Two Password Levels??? on page 10-1 for more information.)

1.Go to System Con???guration???

2.Select Security??? and then Superuser Con???guration

3.Type desired username and password. You will be asked to re-enter password. Navigate to 'ADD SUPERUSER' to add 'Superuser' and restrict access to administrative console.

4.Once 'Superuser' is created, you can add further users, if desired, by going to Add Access Name/Pass- word...

5.Escape once back to Main Menu

Setting up an encrypted communication channel: (PPTP with MS-CHAP/MPPE)

(See ???Virtual Private Networks (VPNs)??? on page 5-1 for more information.)

1.From the Main Menu, Go to Quick Menus...

2.Select ATMP/PPTP Default Pro???le

3.Set Answer ATMP/PPTP Connections: to Yes

4.Under PPTP Con???guration Options set Receive Authentication... to MS-CHAP

5.Escape once back to Quick Menus

6.Scroll up to Add Connection Pro???les and press Enter

7.Supply a descriptive Pro???le Name.

8.Set the Encapsulation Type... to PPTP and press Enter

9.Enter Encapsulation Options...

a.Enter the PPTP Partner IP Address - this can be set to 0.0.0.0

b.For Authentication... select MS-CHAP

c.For Data Encryption... select MPPE

d.Enter the Receive Host Name and Receive Secret the client will be entering as their username and password in their Dial-up Networking VPN pro???le.

e.Set Initiate Connections to No.

f.Adjust the Idle Timeout (seconds) to whatever you prefer. The default value is 300 seconds.

3-62 Administrator???s Handbook

g.Escape once back to the Add Connection Pro???le screen.

h.Press Enter on COMMIT to save this pro???le

10.Select Display/Change Connection Pro???le... and press Enter on the VPN pro???le you have just created.

11.Set Pro???le Enabled: to Yes

12.Select IP Pro???le Parameters...

a.Set Address Translation to No

b.If Stateful Inspection Enabled is set to Yes, make sure that Enable default mapping to router under Stateful Inspection Options... is enabled.

c.Set Remote IP Address: to a static private IP address on this Router???s network that is available and not being served via DHCP

d.Set Remote IP Mask: to 255.255.255.255. Alternatively, you can leave the Remote IP Address: and Remote IP Mask: at 0.0.0.0, and your router can assign an IP address to the PPTP client.

e.Do not enable a ???lter set in the VPN pro???le. Ignore Rip Pro???le Options???

f.Escape to the Main Menu and go to Utilities and Diagnostics...

g.Select Restart System... and CONTINUE

The router is now con???gured for incoming PPTP from a remote Dial-Up Networking client.

Set up NTP

(See ???Date and time??? on page 3-37 for more information.)

1.NTP is enabled by default.

2.To change NTP Settings, Go to System Con???guration and select Date and Time???

3.Set Date and Time parameters, if desired

a.NTP Enabled can be set to On/Off

b.Time Server 1 Host Name/IP Address and Time Server 2 Host Name/IP Address points to the primary and secondary Time Servers respectively.

c.Time Zone??? can be changed (defaults to Paci???c Standard Time)

d.NTP Update Interval can be changed (defaults to one hour)

e.System Date Format can be changed (defaults to MM/DD/YY)

f.System Time Format can be changed (defaults to AM/PM)

g.Escape to the Main Menu and go to Utilities and Diagnostics...

h.Select Restart System... and CONTINUE

Set up Syslog

(See ???Logging??? on page 3-55 for more information.)

1.Go to System Con???guration and select Logging???

2.Under Syslog Parameters,

System Con???guration 3-63

a.Set Syslog Enabled to Yes

b.Set Hostname or IP Address to the Syslog Server

c.Facility??? can be changed (default to Local 0)

d.Set Log Filter Violations to Yes - this will log packets that are dropped by the Router due to violations

e.Set Log Accepted Packets to Yes

f.Set Log Access Attempts to Yes

g.Escape twice to the Main Menu and go to Utilities and Diagnostics...

h.Select Restart System... and CONTINUE

Enable the Stateful Inspection Firewall

See ???Stateful Inspection??? on page 3-3 for more information.)

1.Go to System Con???uration???, Select Stateful Inspection???

a.UDP no-activity timeout (sec) can be adjusted.

b.TCP no-activity timeout (sec) can be adjusted.

c.Set DoS Detect to Yes

d.Escape twice to get to the Main Menu

2.Go to WAN Con???guration???

3.Select Display/Change Connection Pro???le???

4.Select Easy Setup Pro???le (if available) or the desired Connection Pro???le you have created.

5.Go to IP Pro???le Parameters

6.Under IP Pro???le Parameters, Set Stateful Inspection Enabled to Yes

7.Select Stateful Inspection Options???

a.Under Stateful Inspection Parameters, con???gure Max. TCP Sequence Number Difference, if desired.

b.Set Enable default mapping to router to No

c.Deny Fragmented Packets can be set to Yes

8.Escape twice to Change Connection Pro???le menu, select COMMIT

9.Escape to the Main Menu and go to Utilities and Diagnostics...

10.Select Restart System... and CONTINUE

3-64 Administrator???s Handbook

Multi-NAT 4-1

Chapter 4

Multi-NAT

Motorola Netopia?? Embedded Software Version 8.7.4 offers advanced Multiple Network Address Translation functionality.

You should read this chapter completely before attempting to con???gure any of the advanced NAT features.

This chapter covers the following topics:

???Overview on page 4-1

???MultiNAT Con???guration on page 4-6

???Easy Setup Pro???le con???guration on page 4-6

???Server Lists and Dynamic NAT con???guration on page 4-7

???Adding Server Lists on page 4-15

???Binding Map Lists and Server Lists on page 4-21

???NAT Associations on page 4-25

???IP Passthrough on page 4-27

???MultiNAT Con???guration Example on page 4-30

Overview

NAT (Network Address Translation) is a means of mapping one or more IP addresses and/or IP service ports into different values. This mapping serves two functions:

???It allows the addresses of many computers on a LAN to be represented to the public Internet by only one or a few addresses, saving you money.

???It can be used as a security feature by obscuring the true addresses of important machines from potential hackers on the Internet.

To help you understand some of the concepts discussed here, it may be helpful to introduce some NAT terminology.

The term mapping refers to rules that associate one or more private addresses on the Motorola Netopia?? Router???s LAN to one or more public addresses on the Motorola Netopia?? Router???s WAN interface (typically the Internet).

The terms private and internal refer to addresses on the Motorola Netopia?? Router???s LAN. These addresses are considered private because they are protected or obscured by NAT and cannot be directly accessed from the WAN (or Internet) side of the Motorola Netopia?? Router unless speci???cally con???gured otherwise.

The terms public and external refer to the WAN (or Internet) side of the Motorola Netopia?? Router.

4-2 Administrator???s Handbook

Features

MultiNAT features can be divided into several categories that can be used simultaneously in different combinations on a per-Connection Pro???le basis.

The following is a general description of these features:

Port Address Translation

The simplest form of classic Network Address Translation is PAT (Port Address Translation). PAT allows a group of computers on a LAN, such as might be found in a home or small of???ce, to share a single Internet connection using one IP address. The computers on the LAN can surf the Web, read e-mail, download ???les, etc., but their individual IP addresses are never exposed to the public network. Instead, a single IP address acts as the source IP address of traf???c originating from the LAN. The Motorola Netopia?? Router allows you to de???ne multiple PAT mappings, which can be individually mapped to different public IP addresses. This offers more control over the access permitted to users on the LAN.

A limitation of PAT is that communication must be initiated from the internal network. A user on the external side cannot access a machine behind a PAT connection. A PAT enhancement is the ability to de???ne multiple PAT mappings. Each of these can optionally map to a section or range of IP addresses of the internal network. PAT mapping allows only internal users to initiate traf???c ???ow between the internal and external networks.

Server lists

Server lists, sometimes known as exported services, make it possible to provide access from the public network to hosts on the LAN. Server lists allow you to de???ne particular services, such as Web, ftp, or e-mail, which are available via a public IP address. You de???ne the type of service you would like to make available and the internal IP address to which you would like to provide access. You may also de???ne a speci???c public IP address to use for this service if you want to use an IP other than the WAN IP address of the Motorola Netopia?? Router.

Static mapping

If you want to host your own Website or provide other Internet services to the public, you need more than classic NAT. The reason is noted under Port Address Translation above ??? external users cannot initiate traf???c to computers on your LAN because external users can never see the real addresses of the computers on your LAN. If you want users outside your LAN to have access, for example, to a Web or FTP server that you host, you need to make a public representation of the real IP addresses of those servers.

Static mappings are a way to make one or more private IP addresses fully accessible from the public network via corresponding public IP addresses. Some applications may negotiate multiple TCP connections in the process of communication, which often does not work with traditional PAT. Static mapping offers the ability to use these applications through NAT. Each private IP address is mapped, on a one-to-one basis, to a public IP address that can be accessed from the Internet or public network. As with PAT mappings, you may have multiple static mappings to map a range of private IP addresses to a range of public IP addresses if desired.

Multi-NAT 4-3

Dynamic mapping

Dynamic mapping, often referred to as many-to-few, offers an extension to the advantages provided by static mapping. Instead of requiring a one-to-one association of public addresses and private addresses, as is required in static mapping, dynamic mapping uses a group of public IP addresses to dynamically allocate static mappings to private hosts that are communicating with the public network. If a host on the private network initiates a connection to the Internet, for example, the Motorola Netopia?? Router automatically sets up a one-to-one mapping of that host???s private IP address to one of the public IP addresses allocated to be used for Dynamic NAT. As long as this host is communicating with the Internet, it will be able to use that address. When traf???c from that host ceases, and no traf???c is passed from that host for ???ve minutes, the public address is made available again for other private hosts to use as necessary.

When addresses are returned to the group of available addresses, they are returned to the head of the group, being the most recently used. If that same host requests a connection an hour later, and the same public address is still available, then it will be mapped to the same private host. If a new host, which has not previously requested a connection, initiates a connection it is allocated the last, or oldest, public address available.

Dynamic NAT is a way of sharing a range of public, or exterior, NAT addresses among one or more groups of private, or interior, hosts. This is intended to provide superior support for applications that traditionally have dif???culty communicating through NAT. Dynamic NAT is intended to provide functionality beyond many-to-one and one-to-one translation. Motorola Netopia?????s NAT implementation makes it possible to have a static mapping of one public address to one private address, thus allowing applications such as NetMeeting to work by assuring that any traf???c sent back to the source IP address is forwarded through to the internal machine.

Static one-to-one mapping works well if you have enough IP addresses for all the workstations on your LAN. If you do not, Dynamic NAT allows machines to make full use of the publicly routable IP addresses provided by the ISP as necessary, on demand. When these public IP addresses are no longer being used by a particular workstation, they are returned to a pool of available addresses for other workstations to use.

A common example is a DSL customer???s application. Most DSL ISPs only provide customers with a few IP addresses for use on their network. For networks with more than four or ???ve machines it is usually mandatory to use NAT. A customer may have 15 workstations on the LAN, all of which need Internet access. The customer is only provided ???ve IP addresses by their ISP. The customer has eight hosts, which only need to use email and have Web access, but another seven hosts, which use NetMeeting to communicate with clients once or twice a day. NetMeeting will not work unless a static one-to-one mapping exists for the machine running NetMeeting to use for communication. The customer does not have enough IP addresses to create a one-to-one mapping for each of the seven users. This is where dynamic NAT applies.

The customer can con???gure four of these addresses to be used for Dynamic NAT. The ???fth address is then used for the eight other machines that do not need one-to-one mappings. As each machine con???gured to use addresses from the dynamic pool tries to connect to the Internet it is allocated a public IP address to use temporarily. Once the communication has been terminated, that IP address is freed for one of the other six hosts to use.

4-6 Administrator???s Handbook

Currently there is a restriction that the remote user must be routed to via the WAN interface, otherwise the connections will fail. There is no restriction as to the number of connections.

There is no user con???guration required for this feature.

MultiNAT Configuration

You con???gure the MultiNAT features through the Telnet menu:

???For a simple 1-to-many NAT con???guration (classic NAT or PAT), use the Easy Setup Pro???le con???guration, described below.

???For the more advanced features, such as server lists and dynamic NAT, follow the instructions in:

???System Con???guration, described on page 4-7

???IP pro???le parameters, described on page 4-21

Easy Setup Profile configuration

The screen below is an example. Depending on the type of Router you are using, ???elds displayed in this screen may vary.

Connection Profile 1: Easy Setup Profile

Enter basic information about your WAN connection with this screen.

The Local WAN IP Address is used to con???gure a NAT public address range consisting of the Local WAN IP Address and all its ports. The public address map list is named Easy-PAT List and the port map list is named

Easy-Servers.

The two map lists, Easy-PAT List and Easy-Servers, are created by default and NAT con???guration becomes effective.This will map all your private addresses (0.0.0.0 through 255.255.255.255) to your public address. These map lists are bound to the Easy Setup Pro???le. See Binding Map Lists and Server Lists on page 4-21.

This is all you need to do if you want to continue to use a single PAT, or 1-to-many, NAT con???guration.

Multi-NAT 4-7

Server Lists and Dynamic NAT configuration

You use the advanced NAT feature sets by ???rst de???ning a series of mapping rules and then grouping them into a list. There are two kinds of lists -- map lists, made up of dynamic, PAT and static mapping rules, and server lists, a list of internal services to be presented to the external world. Creating these lists is a four-step process:

1.De???ne the public range of addresses that external computers should use to get to the NAT internal machines. These are the addresses that someone on the Internet would see.

2.Create a List name that will act as a rule or server holder.

3.Create a map or rule that speci???es the internal range of NATed addresses and the external range they are to be associated with.

4.Associate the Map or Server List to your WAN interface via a Connection Pro???le or the Default Pro???le.

The three NAT features all operate completely independently of each other, although they can be used simultaneously on the same Connection Pro???le.

You can con???gure a simple 1-to-many PAT (often referred to simply as NAT) mapping using Easy Setup. More complex setups require con???guration using the Network Address Translation item on the IP Setup screen.

An example MultiNAT con???guration at the end of this chapter describes some applications for these features. See the MultiNAT Con???guration Example on page 4-30.

In order to con???gure the Router to make servers on your LAN visible to the Internet, you use advanced features in the System Con???guration screens, described in System Con???guration.

System Configuration

To access the Network Address translation (NAT) con???guration screens, from the Main Menu navigate to System Con???guration:

4-8 Administrator???s Handbook

System Configuration

IP Setup...

Filter Sets...

IP Address Serving...

Network Address Translation (NAT)...

Stateful Inspection...

VLAN Configuration...

Date and Time...

Wireless Configuration...

Console Configuration

SNMP (Simple Network Management Protocol)...

Security...

Upgrade Feature Set...

Router/Bridge Set...Router

IGMP (Internet Group Management Protocol)...

Logging...

Use this screen if you want options beyond Easy Setup.

Select Network Address Translation (NAT) and press Return.

The Network Address Translation screen appears.

Network Address Translation

Add Public Range...

Show/Change Public Range...

Delete Public Range...

Add Map List...

Show/Change Map List...

Delete Map List...

Add Server List...

Show/Change Server List...

Delete Server List...

NAT Associations...

Return/Enter to configure IP Address redirection.

Public Range de???nes an external address range and indicates what type of mapping to apply when using this range. The types of mapping available are dynamic, static and pat.

Map Lists de???ne collections of mapping rules. A rule maps interior range addresses to exterior range addresses by the mapping techniques de???ned in the map list.

Server Lists bind internal IP addresses and ports to external IP addresses and ports so that connections initiated from the outside can access an interior server.

Multi-NAT 4-9

NAT rules

The following rules apply to assigning NAT ranges and server lists:

???Static public address ranges must not overlap other static, PAT, public addresses, or the public address assigned to the Router???s WAN interface.

???A PAT public address must not overlap any static address ranges. It may be the same as another PAT address or server list address, but the port range must not overlap.

You con???gure the ranges of exterior addresses by ???rst adding public ranges.

Select Add Public Range and press Return.

The Add NAT Public Range screen appears.

Add NAT Public Range

???Select Range Name and give a descriptive name to this range.

???Select Type and from the pop-up menu, assign its type. Options are static, dynamic, or pat (the default).

???If you choose pat as the range type, select Public Address and enter the exterior IP address in the range you want to assign. Select First and Last Public Port and enter the ???rst and last exterior ports in the range. These are the ports that will be used for traf???c initiated from the private LAN to the out- side world.

Note: For PAT map lists and server lists, if you use the Public Address 0.0.0.0, the list will acquire its public IP address from the WAN IP address speci???ed by your WAN IP con???guration in the Connection Pro???le. If that is a static IP address, then the PAT map list and server lists will acquire that address. If it is a negotiated IP address, such as may be assigned via DHCP or PPP, the PAT map list and server lists will acquire that address each time it is negotiated.

???If you choose dynamic as the range type, a new menu item, First Public Address, becomes visible.

Select First Public Address and enter the ???rst exterior IP address in the range you want to assign.

Select Last Public Address and enter an IP address at the end of the range.

4-10 Administrator???s Handbook

???If you choose static as the range type, a new menu item, First Public Address, becomes visible. Select First Public Address and enter the ???rst exterior IP address in the range you want to assign. Select Last Public Address and enter an IP address at the end of the range.

???Select ADD NAT PUBLIC RANGE and press Return. The range will be added to your list and you will be returned to the Network Address Translation screen.

Once the public ranges have been assigned, the next step is to bind interior addresses to them. Because these bindings occur in ordered lists, called map lists, you must ???rst de???ne the list, then add mappings to it.

From the Network Address Translation screen select Add Map List and press Return.

The Add NAT Map List screen appears.

Add NAT Map List

Add Map...

???Select Map List Name and enter a descriptive name for this map list. A new menu item, Add Map, appears.

???Select Add Map and press Return. The Add NAT Map screen appears.

Multi-NAT 4-11

Add NAT Map ("my_map")

Use NAT Public Range...

???Select First and Last Private Address and enter the ???rst and last interior IP addresses you want to assign to this mapping.

???Select Use NAT Public Range and press Return. A screen appears displaying the public ranges you have de???ned.

Up/Down Arrow Keys to select, ESC to cancel, Return/Enter to Delete.

???From the list of public ranges you de???ned, select the one that you want to map to the interior range for this mapping and press Return.

4-12 Administrator???s Handbook

If none of your precon???gured ranges are suitable for this mapping, you can select <<NEW RANGE>> and create a new range. If you choose <<NEW RANGE>>, the Add NAT Public Range screen displays and you can create a new public range to be used by this map. See Add NAT Public Range on page 4-9.

???The Add NAT Map screen now displays the range you have assigned.

Add NAT Map ("my_map")

Public Range Start Address is: 206.1.1.6

???Select ADD NAT MAP and press Return. Your mapping is added to your map list.

Modifying map lists

You can make changes to an existing map list after you have created it. Since there may be more than one map list you must select which one you are modifying.

From the Network Address Translation screen select Show/Change Map List and press Return.

???Select the map list you want to modify from the pop-up menu.

Multi-NAT 4-13

Network Address Translation

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

The Show/Change NAT Map List screen appears.

Show/Change NAT Map List

Add Map...

Show/Change Maps...

Delete Map...

???Add Map allows you to add a new map to the map list.

???Show/Change Maps allows you to modify the individual maps within the list.

???Delete Map allows you to delete a map from the list.

Selecting Show/Change Maps or Delete Map displays the same pop-up menu.

Multi-NAT 4-15

Adding Server Lists

Server lists, also known as Exports, are handled similarly to map lists. If you want to make a particular server???s port accessible (and it isn???t accessible through other means, such as a static mapping), you must create a server list.

Select Add Server List from the Network Address Translation screen.

The Add NAT Server List screen appears.

Add NAT Server List

Add Server...

???Select Server List Name and type in a descriptive name. A new menu item, Add Server, appears.

???Select Add Server and press Return. The Add NAT Server screen appears.

4-16 Administrator???s Handbook

Add NAT Server ("my_servers")

???Select External Service and press Return. A pop-up menu appears listing a selection of commonly exported services.

???Choose the service you want to export and press Return.

You can choose a precon???gured service from the list, or de???ne your own by selecting Other. If you select Other, a screen is displayed that allows you to enter the port number range for your customized service.

Multi-NAT 4-17

???Enter the First and Last Port Number between ports 1 and 65535. Select OK and press Return. You will be returned to the Add NAT Server screen.

???Enter the Server Private IP Address of the server whose service you are exporting.

Since MultiNAT permits the mapping of multiple private IP addresses to multiple public IP addresses, your ISP or corporate site???s Router must be con???gured such that it knows that your multiple public addresses are accessible via your Router.

If you want to use static mappings to map internal servers to public addresses, your ISP or corporate site's Router must also be con???gured for static routes to these public addresses on the Motorola Netopia?? Router.

???Enter the Public IP Address to which you are exporting the service.

Note: For PAT map lists and server lists, if you use the Public Address 0.0.0.0, the list will acquire its public IP address from the WAN IP address speci???ed by your WAN IP con???guration in the Connection Pro???le. If that is a static IP address, then the PAT map list and server lists will acquire that address. If it is a negotiated IP address, such as may be assigned via DHCP or PPP, the PAT map list and server lists will acquire that address each time it is negotiated.

???Choose the protocol from the pop-up menu: TCP and UDP, TCP only, or UDP only.

4-18 Administrator???s Handbook

???Enter the Internal Port Start, if different from and not already preselected from the External Service type list.

???Select ADD NAT SERVER and press Return. The server will be added to your server list and you will be returned to the Add NAT Server List screen.

Note: In order to use CUSeeMe through the Motorola Netopia?? Router, you must export the ports 7648 and 7649. In MultiNat, you may use a port range export. Without the export, CUSeeMe will fail to work. This is true unless a static mapping is in place for the host using CUSeeMe. In that case no server list entry is necessary.

Modifying server lists

Once a server list exists, you can select it for modi???cation or deletion.

???Select Show/Change Server List from the Network Address Translation screen.

???Select the Server List Name you want to modify from the pop-up menu and press Return.

Multi-NAT 4-19

Network Address Translation

+-NAT Server List Name-+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

The Show/Change NAT Server List screen appears.

Show/Change NAT Server List

Add Server...

Show/Change Server...

Delete Server...

???Selecting Show/Change Server or Delete Server displays the same pop-up menu.

4-22 Administrator???s Handbook

IP Profile Parameters

RIP Profile Options...

Toggle to Yes if this is a single IP address ISP account.

Configure IP requirements for a remote network connection here.

???Select NAT Map List and press Return. A pop-up menu displays a list of your de???ned map lists.

IP Profile Parameters

???Select the map list you want to bind to this Connection Pro???le and press Return. The map list you selected will now be bound to this Connection Pro???le.

???Select NAT Server List and press Return. A pop-up menu displays a list of your de???ned server lists.

Multi-NAT 4-23

IP Profile Parameters

+-NAT Server List Name-+

???Select the server list you want to bind to this Connection Pro???le and press Return. The server list you selected will now be bound to this Connection Pro???le.

Note: There is no interdependency between NAT and IP Addressing. Also, the Local WAN IP Address and Mask ???elds??? visibility are dependent only on the IP Addressing type.

IP Parameters (WAN Default Profile)

The Motorola Netopia?? Embedded Software Version 8.7.4 using RFC 1483 supports a WAN default pro???le that permits several parameters to be con???gured without an explicitly con???gured Connection Pro???le.

The procedure is similar to the procedure to bind map lists and server lists to a Connection Pro???le.

From the Main Menu go to the WAN Con???guration screen, then the Default Pro???le screen. Select IP Parameters and press Return.

The IP Parameters (Default Pro???le) screen appears.

4-24 Administrator???s Handbook

IP Parameters (Default Profile)

Return/Enter accepts * Tab toggles * ESC cancels.

???Toggle Address Translation Enabled to Yes.

???Select NAT Map List and press Return. A pop-up menu displays a list of your de???ned map lists.

IP Parameters (Default Profile)

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

???Select the map list you want to bind to the default pro???le and press Return. The map list you selected will now be bound to the default pro???le.

???Select NAT Server List and press Return. A pop-up menu displays a list of your de???ned server lists.

Multi-NAT 4-25

IP Parameters (Default Profile)

+-NAT Server List Name-+

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

???Select the server list you want to bind to the default pro???le and press Return. The server list you selected will now be bound to the default pro???le.

Note: There is no interdependency between NAT and IP Addressing. Also, the Local WAN IP Address and Mask ???elds??? visibility are dependent only on the IP Addressing type.

NAT Associations

Con???guration of map and server lists alone is not suf???cient to enable NAT for a WAN connection because map and server lists must be linked to a pro???le that controls the WAN interface. This can be a Connection Pro???le, a WAN Ethernet interface, a default pro???le, or a default answer pro???le. Once you have con???gured your map and server lists, you may want to reassign them to different interface-controlling pro???les, for example, Connection Pro???les. To permit easy access to this IP Setup functionality, you can use the NAT Associations screen.

You access the NAT Associations screen from the Network Address Translation screen.

Select NAT Associations and press Return. The NAT Associations screen appears.

4-26 Administrator???s Handbook

???You can toggle NAT? On or Off for each Pro???le/Interface name. You do this by navigating to the NAT? ???eld associated with each pro???le using the arrow keys. Toggle NAT on or off by using the Tab key.

???You can reassign any of your map lists or server lists to any of the Pro???le/Interfaces. You do this by navigating to the Map List Name or Server List Name ???eld associated with each pro???le using the arrow keys. Select the item by pressing Return to display a pop-up menu of all of your con???gured lists.

NAT Associations

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

???Select the list name you want to assign and press Return again. Your selection will then be associated with the corresponding pro???le or interface.

4-28 Administrator???s Handbook

IP Profile Parameters

RIP Profile Options...

Toggle to Yes if this is a single IP address ISP account.

Configure IP requirements for a remote network connection here.

If you select NAT Options, in either case, the NAT Options screen appears.

NAT Options

Toggle ON to allow local WAN IP address to be used on LAN in addition to NAT.

If you toggle IP Passthrough Enabled to Yes, additional ???eld(s) appear.

Multi-NAT 4-29

Enter MAC addr. of IP passthrough host, or zeroes for first come first serve.

Toggling IP Passthrough DHCP Enabled to Yes displays the IP Passthrough DHCP MAC address ???eld. This is an editable ???eld in which you can enter the MAC (hardware) address of the designated PC be used as the DHCP Client Identi???er for dynamic address reservation. The MAC address must be six colon-delimited or dash-delimited sets of hex digits ('0' ??? 'FF').

First Come First Serve Mode

Motorola Netopia?? Embedded Software Version 8.7.4 IP Passthrough allows a ???rst come ???rst serve mode.

NAT Options defaults to an all-zeroes MAC address.

If you leave the default all-zeroes MAC address, the Router will select the next DHCP client that initiates a DHCP lease request or renewal to be the IP passthrough host. When the WAN comes up, or if it is already up, the Router will serve this client the IP passthrough/WAN address. When this client's lease ends, the IP passthrough address becomes available for the next client to initiate a DHCP transaction. The next client will get the IP passthrough address. Note that there is no way to control which PC has the IP passthrough address without releasing all other DHCP leases on the LAN.

Note: If you specify a non-zeroes MAC address, the DHCP Client Identi???er must be in the format speci???ed above. Macintosh computers allow the DHCP Client Identi???er to be entered as a name or text, however Motorola Netopia?? routers accept only strict (binary/hex) MAC address format. Macintosh computers display their strict MAC addresses in the TCP/IP Control Panel (Classic MacOS) or the Network Preference Pane of System Preferences (Mac OS X).

Once con???gured, the passthrough host's DHCP leases will be shortened to two minutes. This allows for timely updates of the host's IP address, which will be a private IP address before the WAN connection is established. After the WAN connection is established and has an address, the passthrough host can renew its DHCP address binding to acquire the WAN IP address.

4-30 Administrator???s Handbook

A restriction

Since both the router and the passthrough host will use same IP address, new sessions that con???ict with existing sessions will be rejected by the router. For example, suppose you are a teleworker using an IPSec tunnel from the router and from the passthrough host. Both tunnels go to the same remote endpoint, such as the VPN access concentrator at your employer???s of???ce. In this case, the ???rst one to start the IPSec traf???c will be allowed; the second one ??? since, from the WAN it's indistinguishable ??? will fail.

MultiNAT Configuration Example

To help you understand a typical MultiNAT con???guration, this section describes an example of the type of con???guration you may want to implement on your site. The values shown are for example purposes only. Make your own appropriate substitutions.

A typical DSL service from an ISP might include ???ve user addresses. Without PAT, you might be able to attach only ???ve IP hosts. Using simple 1-to-many PAT you can connect more than ???ve devices, but use only one of your addresses. Using multiNAT you can make full use of the address range. The example assumes the following range of addresses offered by a typical ISP:

Public IP addresses assigned by the ISP are 206.1.1.1 through 206.1.1.6 (255.255.255.248 subnet mask).

Your internal devices have IP addresses of 192.168.1.1 through 192.168.1.254 (255.255.255.0 subnet mask).

In this example you will statically map the ???rst ???ve public IP addresses (206.1.1.1 - 206.1.1.5) to the ???rst ???ve corresponding private IP addresses (192.168.1.1 - 192.168.1.5). You will use these 1-to-1 mapped addresses to give your servers ???real??? addresses. You will then map 206.1.1.6 to the remaining private IP addresses (192.168.1.6 - 192.168.1.254) using PAT.

The con???guration process is as follows:

From the Main Menu go to the Easy Setup and then the Connection Pro???le screen.

4-32 Administrator???s Handbook

Select Show/Change Public Range, then Easy-PAT Range, and press Return. Enter the value your ISP assigned for your public address (206.1.1.6, in this example). Toggle Type to pat. Your public address is then mapped to the remaining private IP addresses using PAT. (If you were not using the Easy-PAT Range and Easy-PAT List that are created by default by using Easy Setup, you would have to de???ne a public range and map list. For the purpose of this example you can just alter this range and list.)

Change NAT Public Range

Select CHANGE NAT PUBLIC RANGE and press Return. This returns you to the Network Address Translation screen.

Select Add Public Range and press Return. Type a name for this static range, as shown below. Enter the ???rst and last public addresses your ISP assigned in their respective ???elds as shown. The ???rst ???ve public IP addresses (206.1.1.1 - 206.1.1.5, in this example) are statically mapped to the ???rst ???ve corresponding private IP addresses (192.168.1.1 - 192.168.1.5).

Multi-NAT 4-33

Add NAT Public Range

Select ADD NAT PUBLIC RANGE and press Return. You are returned to the Network Address Translation screen.

Next, select Show/Change Map List and choose Easy-PAT List. Select Add Map. The Add NAT Map screen appears. (Now the name Easy-PAT List is a misnomer since it has a static map included in its list.) Enter in 192.168.1.1 for the First Private Address and 192.168.1.5 for the Last Private Address.

Add NAT Map ("Easy-PAT List")

Use NAT Public Range...

Select Use NAT Public Range and from the pop-up menu choose Static Range. Select ADD NAT MAP and press Return.

This will statically map the ???rst ???ve public IP addresses to the ???rst ???ve corresponding private IP addresses and will map 206.1.1.6 to the remaining private IP addresses using PAT.

4-34 Administrator???s Handbook

Notes on the example

The Easy-Map List and the Easy-PAT List are attached to any new Connection Pro???le by default. If you want to use this NAT con???guration on a previously de???ned Connection Pro???le then you need to bind the Map List to the pro???le. You do this through either the NAT Associations screen or the pro???le???s con???guration screens.

The PAT part of this example setup will allow any user on the Motorola Netopia?? Router's LAN with an IP address in the range of 192.168.1.6 through 192.168.1.254 to initiate traf???c ???ow to the outside world (for example, the Internet). No one on the Internet would be able to initiate a conversation with them.

The Static mapping part of this example will allow any of the machines in the range of addresses from 192.168.1.1 through 192.168.1.5 to communicate with the outside world as if they were at the addresses 206.1.1.1 through 206.1.1.5, respectively. It also allows any machine on the Internet to access any service (port) on any of these ???ve machines.

You may decide this poses a security risk. You may decide that anyone can have complete access to your FTP server, but not to your Router, and only limited access to the desired services (ports) on the Web and Mail servers.

To make these changes, ???rst limit the range of remapped addresses on the Static Map and then edit the default server list called Easy-Servers.

???First, navigate to the Show/Change Map List screen, select Easy-PAT List and then Show/Change Maps. Choose the Static Map you created and change the First Private Address from 192.168.1.1 to 192.168.1.4. Now the Router, Web, and Mail servers??? IP addresses are no longer included in the range of static mappings and are therefore no longer accessible to the outside world. Users on the Internet will not be able to Telnet, Web, SNMP, or ping to them. It is best also to navigate to the public range screen and change the Static Range to go from 206.1.1.5.

???Next, navigate to Show/Change Server List and select Easy-Servers and then Add Server. You should export both the Web (www-http) and Mail (smtp) ports to one of the now free public addresses. Select Service... and from the resulting pop-up menu select www-http. In the resulting screen enter your Web server's address, 192.168.1.2, and the public address, for example, 206.1.1.2, and then select ADD NAT SERVER. Now return to Add Server, choose the smtp port and enter 192.168.1.3, your Mail server's IP address for the Server Private IP Address. You can decide if you want to present both your Web and Mail services as being on the same public address, 206.1.1.2, or if you prefer to have your Mail server appear to be at a different IP address, 206.1.1.3. For the sake of this example, alias both services to 206.1.1.2.

Now, as before, the PAT con???guration will allow any user on the Motorola Netopia?? Router's LAN with an IP address in the range of 192.168.1.6 through 192.168.1.254 to initiate traf???c ???ow to the Internet. Someone at the FTP server can access the Internet and the Internet can access all services of the FTP machine as if it were at 206.1.1.5. The Router cannot directly communicate with the outside world. The only communication between the Web server and the Internet is through port 80, the Web port, as if the server were located on a machine at IP address 206.1.1.2. Similarly, the only communication with the Mail server is through port 25, the SMTP port, as if it were located at IP address 206.1.1.2

Virtual Private Networks (VPNs) 5-1

Chapter 5

Virtual Private Networks (VPNs)

The Motorola Netopia?? Embedded Software Version 8.7.4 offers IPsec, PPTP, and ATMP tunneling support for Virtual Private Networks (VPN).

The following topics are covered in this chapter:

???"Overview" on page 5-1

???"About PPTP Tunnels" on page 5-4

???"About IPsec Tunnels" on page 5-7

???"About L2TP Tunnels" on page 5-7

???"About GRE Tunnels" on page 5-10

???"About ATMP Tunnels" on page 5-14

???"Encryption Support" on page 5-16

???"ATMP/PPTP Default Pro???le" on page 5-17

???"VPN QuickView" on page 5-18

???"Dial-Up Networking for VPN" on page 5-19

???"Allowing VPNs through a Firewall" on page 5-23

???"Windows Networking Broadcasts" on page 5-30

Overview

When you make a long distance telephone call from your home to a relative far away, you are creating a private network. You can hold a conversation, and exchange information about the happenings on opposite sides of the state, or the continent, that you are mutually interested in. When your next door neighbor picks up the phone to call her daughter at college, at the same time you are talking to your relatives, your calls don't overlap, but each is separate and private. Neither house has a direct wire to the places they call. Both share the same lines on the telephone poles (or underground) on the street.

These calls are virtual private networks. Virtual, because they appear to be direct connections between the calling and answering parties, even though they travel over the public wires and switches of the phone company; private, because neither pair of calling and answering parties interacts with the other; and networks, because they exchange information.

Computers can do the same thing; it's called Virtual Private Networks (VPNs). Equipped with a Motorola Netopia?? Router, a single computer or private network (LAN) can establish a private connection with another computer or private network over the public network (Internet).

5-2 Administrator???s Handbook

Motorola Netopia?? Embedded Software Version 8.7.4 can be used in VPNs either to initiate the connection or to answer it. When used in this way, the Routers are said to be tunnelling through the public network (Internet). The advantages are that, like your long distance phone call, you don't need a direct line between one computer or LAN and the other, but use the local connections, making it much cheaper; and the information you exchange through your tunnel is private and secure.

Tunneling is a process of creating a private path between a remote user or private network and another private network over some intermediate network, such as the IP-based Internet. A VPN allows remote of???ces or employees access to your internal business LAN through means of encryption allowing the use of the public Internet to look ???virtually??? like a private secure network. When two networks communicate with each other through a network based on the Internet Protocol, they are said to be tunneling through the IP network.

Virtual Private Network

Unlike the phone company, private and public computer networks can use more than one protocol to carry your information over the wires. Several such protocols are in common use for tunnelling, Point-to-Point Tunnelling Protocol (PPTP), IP Security (IPsec), Layer 2 Transport Protocol (L2TP), Generic Routing Encapsulation (GRE), and Ascend Tunnel Management Protocol (ATMP). The Motorola Netopia?? Router can use any of these.

???Point-to-Point Tunneling Protocol (PPTP) is an extension of Point-to-Point Protocol (PPP) and uses a client and server model. Motorola Netopia?????s PPTP implementation is compatible with Microsoft???s and can function as either the client (PAC) or the server (PNS). As a client, a Motorola Netopia?? Router can provide all users on a LAN with secure access over the Internet to the resources of another LAN by setting up a tunnel with a Windows NT server running Remote Access Services (RAS) or with another Motorola Netopia?? Router. As a server, a Motorola Netopia?? Router can provide remote users a secure connection to the resources of the LAN over a dial-up, cable, DSL, or any other type of Internet access. Because PPTP can create a VPN tunnel using the Dial-Up Networking (DUN) (see "Dial-Up Networking for VPN" on page 5-19) utility built into Windows 95, 98, or NT, no additional client software is required.

???IPsec stands for IP Security, a set of protocols that supports secure exchange of IP packets at the IP layer. IPsec is deployed widely to implement Virtual Private Networks (VPNs). IPsec supports two encryption

Virtual Private Networks (VPNs) 5-3

modes: Transport and Tunnel. Transport mode encrypts only the data portion (payload) of each packet, but leaves the header untouched. The more secure Tunnel mode encrypts both the header and the payload. On the receiving side, an IPsec-compliant device decrypts each packet. The Motorola Netopia?? Embedded Software Version 8.7.4 supports the more secure Tunnel mode.

DES stands for Data Encryption Standard, a popular symmetric-key encryption method. DES uses a 56-bit key. The Motorola Netopia?? Embedded Software Version 8.7.4 offers IPsec DES encryption over the VPN tunnel.

???Ascend Tunnel Management Protocol (ATMP) is the protocol that is implemented in many Ascend gateways. ATMP is a simple protocol for connecting nodes and/or networks together over the Internet via a tunnel. ATMP encapsulates IP or other user data without PPP headers within General Routing Encapsulation (GRE) protocol over IP. ATMP is more ef???cient than PPTP for network-to-network tunnels.

When used to initiate the tunnelled connection, the Router is called a PPTP Access Concentrator (PAC, in PPTP language), or a foreign agent (in ATMP language). When used to answer the tunnelled connection, the Motorola Netopia?? Router is called a PPTP Network Server (PNS, in PPTP language) or a home agent (in ATMP language).

In either case, the Motorola Netopia?? Router wraps, or encapsulates, information that one end of the tunnel exchanges with the other, in a wrapper called General Routing Encapsulation (GRE), at one end of the tunnel, and unwraps, or decapsulates, it at the other end.

Con???guring the Motorola Netopia?? Router for use with the different protocols is done through the Telnet-based menu screens. Each type is described in its own section:

???"About PPTP Tunnels" on page 5-4

???"About IPsec Tunnels" on page 5-7

???"About L2TP Tunnels" on page 5-7

???"About GRE Tunnels" on page 5-10

???"About ATMP Tunnels" on page 5-14

Your con???guration depends on which protocol you (and the gateway at the other end of your tunnel) will use, and whether or not you will be using VPN client software in a standalone remote connection.

Note: You must choose which protocol you will be using, since you cannot both export PPTP and use ATMP, or vice versa, at the same time.

Having both an ATMP tunnel and a PPTP export is not possible because functions require GRE and the Router???s PPTP export/server does not distinguish the GRE packets it forwards. Since it processes all of them, ATMP tunneling is impaired. For example, you cannot run an ATMP tunnel between two gateways and also have PPTP exported on one side.

Summary

A Virtual Private Network (VPN) connects the components of one network over another network. VPNs accomplish this by allowing you to tunnel through the Internet or another public network in a manner that provides the same security and features formerly available only in private networks.

VPNs allow networks to communicate across an IP network. Your local networks (connected to the Motorola

Netopia?? Router) can exchange data with remote networks that are also connected to a VPN-capable gateway.

Virtual Private Networks (VPNs) 5-5

When you de???ne a Connection Pro???le as using PPTP by selecting PPTP as the datalink encapsulation method, and then select Data Link Options, the PPTP Tunnel Options screen appears.

PPTP Tunnel Options

???Enter the PPTP Partner IP Address. This speci???es the address of the other end of the tunnel.

If you do not specify the PPTP Partner IP Address the Router cannot initiate tunnels, i.e., act as a PPTP Access Concentrator (PAC) for this pro???le. It can only accept tunnel requests as a PPTP Network Server (PNS).

???If you specify the PPTP Partner IP Address, and the address is in the same subnet as the Remote IP Address you speci???ed in the IP Pro???le Parameters, the Tunnel Via Gateway option becomes visible. You can enter the address by which the Router partner is reached.

If you do not specify the PPTP Partner IP Address, the Router will use the default gateway to reach the partner and the Tunnel Via Gateway ???eld is hidden. If the partner should be reached via an alternate port (i.e. the LAN instead of the WAN), the Tunnel Via Gateway ???eld allows this path to be resolved.

???From the pop-up menu select an Authentication protocol for the PPP connection. Options are PAP, CHAP, or MS-CHAP. The default is PAP. The authentication protocol must be the same on both ends of the tunnel.

???You can specify a Data Compression algorithm, either None or Standard LZS, for the PPTP connection.

Note: When the Authentication protocol is MS-CHAP, compression is set to None, and the Data Compression option is hidden.

???When the authentication protocol is MS-CHAP, you can specify a Data Encryption algorithm for the PPTP connection. Available options are MPPE and None (the default). For other authentication protocols, this option is hidden. When MPPE is negotiated, the WAN Event History reports that it is negotiated as a CCP (compression) type. This is because the MPPE protocol uses a compression engine, even though it is not itself a compression protocol.

5-6 Administrator???s Handbook

Note: Motorola Netopia?? Embedded Software Version 8.7.4 supports 128-bit (???strong???) encryption. Unlike MS-CHAP version 1, which supports one-way authentication, MS-CHAP version 2 supports mutual authentication between connected gateways and is incompatible with MS-CHAP version 1 (MS-CHAP-V1). When you choose MS-CHAP as the authentication method for the PPTP tunnel, the Motorola Netopia?? Router will start negotiating MS-CHAP-V2. If the gateway you are connecting to does not support MS-CHAP-V2, it will fall back to MS-CHAP-V1, or, if the gateway you are connecting to does not support MPPE at all, the PPP session will be dropped.

???You can specify a Send Host Name which is used with Send Secret for authenticating with a remote PNS when the pro???le is used for initiating a tunnel connection.

???You must specify a Send Password (the CHAP and MS-CHAP term for password), used for authenticating the tunnel when initiating a tunnel connection.

???You can specify a Receive Host Name which is used with the Receive Secret for authenticating a remote PPTP client.

???You must specify a Receive Password, used for authenticating the remote PPTP client.

???You can specify that this Router will Initiate Connections (acting as a PAC) or only answer them (acting as a PNS).

???Tunnels are normally initiated On Demand; however, you can disable this feature. When disabled, the tunnel must be manually established or may be scheduled using the scheduled connections feature. See "Scheduled Connections" on page 2-16.

???Some networks that use Microsoft Windows NT PPTP Network Servers require additional authentication information, called Windows NT Domain Name, when answering PPTP tunnel connection requests. Not all Windows NT installations require this information, since not all such installations use this authentication feature. The Windows NT Domain Name is not the same as the Internet domain name, but is the name of a group of servers that share common security policy and user account databases. Your PPTP tunnel partner???s administrator will supply this Windows NT Domain Name if it is required. If you con???gure your Router to initiate PPTP tunnel connections by toggling Initiate Connections to Yes, the Optional Windows NT Domain Name ???eld appears. Enter the domain name your network administrator has supplied.

???You can specify the Idle Timeout, an inactivity timer, whose expiration will terminate the tunnel. A value of zero disables the timer. Because tunnels are subject to abrupt termination when the underlying datalink is torn down, use of the Idle Timeout is strongly encouraged.

???Return to the Connection Pro???le screen by pressing Escape.

???Select IP Pro???le Parameters and press Return. The IP Pro???le Parameters screen appears.

Virtual Private Networks (VPNs) 5-7

IP Profile Parameters

???Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel.

About IPsec Tunnels

IPsec stands for IP Security, a set of protocols that supports secure exchange of IP packets at the IP layer. IPsec is deployed widely to implement Virtual Private Networks (VPNs). See "Overview" on page 5-1 for more information.

IPsec supports two encryption modes: Transport and Tunnel. Transport mode encrypts only the data portion (payload) of each packet, but leaves the header untouched. The more secure Tunnel mode encrypts both the header and the payload. On the receiving side, an IPsec-compliant device decrypts each packet. Motorola Netopia?? Routers support the more secure Tunnel mode.

Motorola Netopia?? Embedded Software Version 8.7.4 offers IPsec 3DES encryption over the VPN tunnel. DES stands for Data Encryption Standard, a popular symmetric-key encryption method. DES uses a 56-bit key. Motorola Netopia?? Routers offer IPsec 3DES (triple DES) encryption as a standard option. Some models support built-in hardware acceleration of 3DES encryption at line speeds.

Internet Key Exchange (IKE) is an authentication and encryption key management protocol used in conjunction with the IPsec standard. IPsec key management offers a wide variety of options which are explained in

Chapter 6, ???Internet Key Exchange for VPNs.???

About L2TP Tunnels

L2TP stands for Layer 2 Tunnelling Protocol, an extension to the PPP protocol. L2TP combines features of two other tunneling protocols: PPTP and L2F. Like PPTP, L2TP is a Datalink Encapsulation option in Connection Pro???les. It is not an option in device or link con???guration screens, as L2TP is not a native encapsulation. Consequently, the Easy Setup Pro???le does not offer L2TP datalink encapsulation. See the "Creating a New Connection Pro???le" on page 2-8 for information on creating Connection Pro???les.

5-8 Administrator???s Handbook

L2TP configuration

To de???ne an L2TP tunnel, navigate to the Add Connection Pro???le menu from the Main Menu.

When you de???ne a Connection Pro???le as using L2TP by selecting L2TP as the datalink encapsulation method, and then select Encapsulation Options, the L2TP Tunnel Options screen appears.

???Enter the L2TP Partner IP Address. This speci???es the address of the other end of the tunnel. If you do not specify the L2TP Partner IP Address the Router cannot initiate tunnels.

???If you specify the L2TP Partner IP Address, and the address is in the same subnet as the Remote IP Address you speci???ed in the IP Pro???le Parameters, the Tunnel Via Gateway option becomes visible. You can enter the address by which the Router partner is reached.

If you do not specify the L2TP Partner IP Address, the Router will use the default gateway to reach the partner and the Tunnel Via Gateway ???eld is hidden. If the partner should be reached via an alternate port (i.e. the LAN instead of the WAN), the Tunnel Via Gateway ???eld allows this path to be resolved.

???Toggle L2TP Tunnel Authentication to No or Yes.

If you set authentication on the tunnel, an editable Pass-phrase ???eld appears where you can specify a password between eight and 15 characters long.

???From the pop-up menu select a PPP Authentication protocol for the PPP connection. Options are PAP, or CHAP. The default is PAP. The authentication protocol must be the same on both ends of the tunnel.

???You can specify a Data Compression algorithm, either None or Standard LZS, for the L2TP connection.

???You can specify a Send Host Name which is used with Send Secret for authenticating with a remote PNS when the pro???le is used for initiating a tunnel connection.

???You must specify a Send Password (or Secret, the CHAP term for password), used for authenticating the tunnel when initiating a tunnel connection.

???You can specify a Receive Host Name which is used with the Receive Secret for authenticating a remote L2TP client.

???You must specify a Receive Password (or CHAP Secret), used for authenticating the remote L2TP client.

???You can specify that this Router will Initiate Connections (acting as a PAC) or only answer them (acting as a PNS).

5-10 Administrator???s Handbook

???Tunnels are normally initiated On Demand; however, you can disable this feature. When disabled, the tunnel must be manually established or may be scheduled using the scheduled connections feature. See "Scheduled Connections" on page 2-16.

???You can specify the Idle Timeout (in seconds), an inactivity timer, whose expiration will terminate the tunnel. A value of zero disables the timer. Because tunnels are subject to abrupt termination when the underlying datalink is torn down, use of the Idle Timeout is strongly encouraged.

???Return to the Connection Pro???le screen by pressing Escape.

???Select IP Pro???le Parameters and press Return.

???In the Pro???le Parameters screen, enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel. Press Escape to return to the Connection Pro???le screen. Select COMMIT and press Return. The tunnel Connection Pro???le will be activated.

About GRE Tunnels

Generic Routing Encapsulation (GRE) protocol is another form of tunneling that Motorola Netopia?? routers support. A GRE tunnel is brought up when a valid GRE pro???le is installed, and brought down when the pro???le is disabled, or deleted.

GRE tunnels are not connection-based, but rather are installed and simply wait for GRE packets. There is no special startup initiation as with PPPoE or PPTP. GRE is best adapted to simple routing and/or tunneling, and is not for use with any sensitive data. GRE offers no encryption; and authentication of data integrity is limited to checksum veri???cation, if enabled.

To set up a GRE tunnel, you create a Connection Pro???le including the IP address and other relevant information for the remote partner.

Virtual Private Networks (VPNs) 5-11

When you de???ne a Connection Pro???le as using GRE by selecting GRE as the Encapsulation Type, and then select Encapsulation Options, the GRE Tunnel Options screen appears.

GRE Tunnel Options

Enter an IP address in decimal and dot form (xxx.xxx.xxx.xxx).

???Enter a GRE Partner IP Address in standard dotted-quad format to specify the address of the other end of the tunnel.

???You can optionally toggle Send Checksums to Yes to verify that no data corruption or loss is incurred in transmission. Ordinarily, it is not necessary to send checksums, and you can leave the default No.

5-12 Administrator???s Handbook

???Sequence Datagrams can also be left at the default No, unless you are otherwise instructed. Datagram sequencing is mainly needed if compression is being used.

???You can enter a 32- bit Key of up to 10-digits (numbers only). The receiver can use this key to identify the source of the packet. The key is a way to match a packet to a tunnel connection.

If you choose to enter a key, be sure that both tunnel endpoints' con???gurations have matching keys.

???If you enter a zero (0), the key ???eld is disabled.

???Return to the Add Connection Pro???le screen by pressing Escape.

???Select IP Pro???le Parameters and press Return. The IP Pro???le Parameters screen appears.

IP Profile Parameters

RIP Profile Options...

Toggle to Yes if this is a single IP address ISP account.

Configure IP requirements for a remote network connection here.

???Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel.

???Press Escape to return to the Add Connection pro???le screen, select COMMIT and press Return. Your GRE Connection Pro???le will be enabled.

VPN force-all

GRE tunnelling supports ???VPN force-all,??? which forces all traf???c coming from the LAN onto the GRE tunnel. You accomplish this by setting the default route to go through the GRE tunnel. A secondary host route where all tunneled GRE packets route to the actual WAN interface can be con???gured as a static route when required.

The following table outlines various force-all con???gurations for different networking scenarios; all other options can safely use their default values:

Virtual Private Networks (VPNs) 5-13

Note: A GRE tunnel cannot transmit RIP routes over a force-all tunnel, or with a remote member IP with a host part of all zeros.

Virtual Private Networks (VPNs) 5-15

When you de???ne a Connection Pro???le as using ATMP by selecting ATMP as the datalink encapsulation method, and then select Data Link Options, the ATMP Tunnel Options screen appears.

ATMP Tunnel Options

Note: An ATMP tunnel cannot be assigned a dynamic IP address by the remote server, as in a PPP connection. When you de???ne an ATMP tunnel pro???le, the Local WAN IP Address, assigned in the IP Pro???le Parameters screen, must be the true IP address, not 0.0.0.0, if NAT is enabled.

???ATMP Partner IP Address speci???es the address of the other end of the tunnel. When unspeci???ed, the Router can not initiate tunnels (i.e., act as a foreign agent) for this pro???le; it can only accept tunnel requests as a home agent.

???When you specify the ATMP Partner IP Address, and the address is in the same subnet as the Remote IP Address you speci???ed in the IP Pro???le Parameters, you can specify the route (Tunnel Via Gateway) by which the Router partner is reached. If you do not specify the ATMP Partner IP Address, the Router will use the default gateway to reach the partner and the Tunnel Via Gateway ???eld is hidden. If the partner should be reached via an alternate port (i.e., the LAN instead of the WAN), the Tunnel Via Gateway ???eld allows this path to be resolved.

???You can specify a Network Name. When the tunnel partner is another Motorola Netopia?? Router, this name may be used to match against a Connection Pro???le. When the partner is an Ascend gateway in Gateway mode, then Network Name is used by the Ascend gateway to match a gateway pro???le. When the partner is an Ascend gateway in Gateway mode, leave this ???eld blank.

???You must specify a Password, used for authenticating the tunnel.

Note: The Password entry will be the same for both ends of the tunnel.

???For Netopia-to-Netopia connections only, you can specify a Data Encryption algorithm for the ATMP connection from the pop-up menu, either DES or None. None is the default.

Note: Ascend does not support DES encryption for ATMP tunnels.

???You must specify a Key String of up to (and including) 20 characters when DES is selected. When encryption is None, this ???eld is invisible.

5-16 Administrator???s Handbook

???You can specify that this Router will Initiate Connections, acting as a foreign agent (Yes), or only answer them, acting as a home agent (No).

???Tunnels are normally initiated On Demand; however, you can disable this feature. When disabled, the tunnel must be manually established through the call management screens.

???You can specify the Idle Timeout, an inactivity timer, whose expiration will terminate the tunnel. A value of zero disables the timer. Because tunnels are subject to abrupt termination when the underlying datalink is torn down, use of the Idle Timeout is strongly encouraged.

???Return to the Connection Pro???le screen by pressing Escape.

???Select IP Pro???le Parameters and press Return. The IP Pro???le Parameters screen appears.

IP Profile Parameters

???Enter the Remote IP Address and Remote IP Mask for the host to which you want to tunnel.

Encryption Support

Encryption is a method for altering user data into a form that is unusable by anyone other than the intended recipient. The recipient must have the means to decrypt the data to render it usable to them. The encryption process protects the data by making it dif???cult for any third party to get at the original data.

Motorola Netopia?? PPTP is fully compatible with Microsoft Point-to-Point Encryption (MPPE) data encryption for user data transfer over the PPTP tunnel. Microsoft Windows NT Server provides MPPE encryption capability only when Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) is enabled. Motorola Netopia?? complies with this feature to allow MPPE only when MS-CHAP is negotiated. MS-CHAP and MPPE are user-selectable options in the PPTP Tunnel Options screen. If either the client or the server side speci???es encryption, then encryption becomes mandatory for both.

5-18 Administrator???s Handbook

ATMP/PPTP Default Profile

???Toggle Answer ATMP/PPTP Connections to Yes if you want the Router to accept VPN connections or No (the default) if you do not.

???For PPTP tunnel connections only, you must de???ne what type of authentication these connections will use. Select Receive Authentication and press Return. A pop-up menu offers the following options: PAP (the default), CHAP, or MS-CHAP.

???If you chose PAP or CHAP authentication, from the Data Compression pop-up menu select either None (the default) or Standard LZS.

If you chose MS-CHAP authentication, the Data Compression option is not required, and this menu item becomes hidden.

VPN QuickView

You can view the status of your VPN connections in the VPN QuickView screen.

From the Main Menu select QuickView and then VPN QuickView.

The VPN QuickView screen appears.

Virtual Private Networks (VPNs) 5-19

Pro???le Name: Lists the name of the Connection Pro???le being used, if any.

Type: Shows the data link encapsulation method (PPTP or ATMP).

Rx Pckts: Shows the number of packets received via the VPN tunnel.

Tx Pckts: Shows the number of packets transmitted via the VPN tunnel.

Rx Discard: Shows the number of packets discarded.

Remote Address: Shows the tunnel partner???s IP address.

Dial-Up Networking for VPN

Microsoft Windows Dial-Up Networking software permits a remote standalone workstation to establish a VPN tunnel to a PPTP server such as a Motorola Netopia?? Router located at a central site. Dial-Up Networking also allows a mobile user who may not be connected to a PAC to dial into an intermediate ISP and establish a VPN tunnel to, for example, a corporate headquarters, remotely. Motorola Netopia?? Routers also can serve as a PAC at the workstation's site, making it unnecessary for the standalone workstation to initiate the tunnel. In such a case, the Dial-Up Networking software is not required, since the Motorola Netopia?? Router initiates the tunnel.

This section is provided for users who may require the VPN client software for Dial-Up Networking in order to connect to an ISP who provides a PPTP account.

Microsoft Windows Dial-Up Networking (DUN) is the means by which you can initiate a VPN tunnel between your individual remote client workstation and a private network such as your corporate LAN via the Internet. DUN is a software adapter that allows you to establish a tunnel.

Virtual Private Networks (VPNs) 5-21

Creating a new Dial-Up Networking profile

A Dial-Up Networking pro???le is like an address book entry that contains the information and parameters you need for a secure private connection. You can create this pro???le by using either the Internet Connection Wizard or the Make New Connection feature of Dial-Up Networking. The following instructions tell you how to create the pro???le with the Make New Connection feature. Do the following:

1.Double-click the My Computer (or whatever you have named it) icon on your desktop.

Open the Dial-Up Networking folder, and then double-click Make New Connection. The Make New Connection wizard window appears.

2.Type a name for this connection (such as the name of your company, or the computer you are dialing into).

From the pull-down menu, select the device you intend to use for the virtual private network connection. This can be any device you have installed or connected to your PC. Click the Next button. A screen appears with ???elds for you to enter telephone numbers for the computer you want to connect to.

3.Type the directory number or the Virtual Circuit Identi???er number.

This number is provided by your ISP or corporate administrator. Depending on the type of device you are using, the number may or may not resemble an ordinary telephone directory number.

4.Click the Next button.

The ???nal window will give you a chance to accept or change the name you have entered for this pro???le. If you are satis???ed with it, click the Finish button. Your pro???le is complete.

Configuring a Dial-Up Networking profile

Once you have created your Dial-Up Networking pro???le, you con???gure it for TCP/IP networking to allow you to connect to the Internet through your Internet connection device. Do the following:

1.Double-click the My Computer (or whatever you have named it) icon on your desktop.

Open the Dial-Up Networking folder. You will see the icon for the pro???le you created in the previous section.

2.Right-click the icon and from the pop-up menu select Properties.

3.In the Properties window click the Server Type button.

Virtual Private Networks (VPNs) 5-23

5.Click the OK button in this window and the next two windows.

Windows XP Client Configuration

1.From your Windows XP desktop, click on Start ---> My Network Places and select View Network Connections from the Network Tasks area.

2.Click Create a New Connection in the Network Tasks area to start the New Connection Wizard. Click Next.

3.In the Network Connection Type box that appears, select the Connect to the network at my workplace radio button. Click Next.

4.In the Network Connection box that appears, select the Virtual Private Network connection radio button. Click Next.

5.In the Connection Name window's text box labeled Company Name, assign the name of the organization or connection to which you log in.

6.In the VPN Server Selection window's text box labeled Host Name or IP address, type the Local WAN IP address of the router to which you are connecting.

7.In the Connection Availability window, you can select the Anyone's Use radio button if you want to make this connection accessible to other users of your workstation. Otherwise, leave it set to the default My use only selection. Click Next.

8.Click Finish. This completes the VPN con???guration. Also, you can click the Add a shortcut to this connection to my desktop checkbox to put an icon on the desktop.

Connecting using Dial-Up Networking

A Dial-Up Networking connection will be automatically launched whenever you run a TCP/IP application, such as a web browser or email client. When you ???rst run the application a Connect To dialog box appears in which you enter your User name and Password. If you check the Save password checkbox, the system will remember your User name and Password, and you won???t be prompted for them again.

Allowing VPNs through a Firewall

An administrator interested in securing a network will usually combine the use of VPNs with the use of a ???rewall or some similar mechanism. This is because a VPN is not a complete security solution, but rather a component of overall security. Using a VPN will add security to transactions carried over a public network, but a VPN alone will not prevent a public network from in???ltrating a private network. Therefore, you should combine use of a ???rewall with VPNs, where the ???rewall will secure the private network from in???ltration from a public network, and the VPN will secure the transactions that must cross the public network.

A strict ???rewall may not be provisioned to allow VPN traf???c to pass back and forth as needed. In order to ensure that a ???rewall will allow a VPN, certain attributes must be added to the ???rewall's provisioning. The provisions necessary vary slightly between ATMP and PPTP, but both protocols operate on the same basic premise: there are control and negotiation operations, and there is the tunnelled traf???c that carries the payload of data between the VPN endpoints. The difference is that ATMP uses UDP to handle control and negotiation, while PPTP uses TCP. Then both ATMP and PPTP use GRE to carry the payload.

5-24 Administrator???s Handbook

For PPTP negotiation to work, TCP packets inbound and outbound destined for port 1723 must be allowed. Likewise, for ATMP negotiation to work, UDP packets inbound and outbound destined for port 5150 must be allowed. Source ports are dynamic, so, if possible, make this ???exible, too. Additionally, PPTP and ATMP both require a ???rewall to allow GRE bi-directionally.

The following sections illustrate a sample ???ltering setup to allow either PPTP or ATMP traf???c to cross a ???rewall:

???"PPTP example" on page 5-24

???"ATMP example" on page 5-27

Make your own appropriate substitutions. For more information on ???lters and ???rewalls, see Chapter 10, ???Security.???.

PPTP example

To enable a ???rewall to allow PPTP traf???c, you must provision the ???rewall to allow inbound and outbound TCP packets speci???cally destined for port 1723. The source port may be dynamic, so often it is not useful to apply a compare function upon this portion of the control/negotiation packets. You must also set the ???rewall to allow inbound and outbound GRE packets, enabling transport of the tunnel payload.

From the Main Menu navigate to Display/Change IP Filter Set, and from the pop-up menu select Basic Firewall.

Select Display/Change Input Filter.

Display/Change Input Filter screen

Select Input Filter 1 and press Return. In the Change Input Filter 1 screen, set the Destination Port information as shown below.

Virtual Private Networks (VPNs) 5-25

Change Input Filter 1

Return/Enter accepts * Tab toggles * ESC cancels.

Enter the packet specific information for this filter.

Select Input Filter 2 and press Return. In the Change Input Filter 2 screen, set the Protocol Type to allow GRE as shown below.

Change Input Filter 2

Return/Enter accepts * Tab toggles * ESC cancels.

Enter the packet specific information for this filter.

5-26 Administrator???s Handbook

In the Display/Change Filter Set screen select Display/Change Output Filter.

Display/Change Output Filter screen

Select Output Filter 1 and press Return. In the Change Output Filter 1 screen, set the Protocol Type and Destination Port information as shown below.

Change Output Filter 1

Return/Enter accepts * Tab toggles * ESC cancels.

Enter the packet specific information for this filter.

Select Output Filter 2 and press Return. In the Change Output Filter 2 screen, set the Protocol Type to allow GRE as shown below.

5-28 Administrator???s Handbook

Change Input Filter 1

Return/Enter accepts * Tab toggles * ESC cancels.

Enter the packet specific information for this filter.

Select Input Filter 2 and press Return. In the Change Input Filter 2 screen, set the Protocol Type to allow GRE as shown below.

Change Input Filter 2

Return/Enter accepts * Tab toggles * ESC cancels.

Enter the packet specific information for this filter.

Virtual Private Networks (VPNs) 5-29

In the Display/Change IP Filter Set screen select Display/Change Output Filter.

Display/Change Output Filter screen

Select Output Filter 1 and press Return. In the Change Output Filter 1 screen, set the Protocol Type and Destination Port information as shown below.

Change Output Filter 1

Return/Enter accepts * Tab toggles * ESC cancels.

Enter the packet specific information for this filter.

5-30 Administrator???s Handbook

Select Output Filter 2 and press Return. In the Change Output Filter 2 screen, set the Protocol Type to allow GRE as shown below.

Change Output Filter 2

Return/Enter accepts * Tab toggles * ESC cancels.

Enter the packet specific information for this filter.

Windows Networking Broadcasts

Motorola Netopia?? software provides the ability to forward Windows Networking NetBIOS broadcasts. This is useful for, for example, a Virtual Private Network, in which you want to be able to browse the remote network to which you are tunnelling, as part of your Windows Network Neighborhood.

Routed connections, such as VPNs, can not use NetBEUI to carry the Network Neighborhood information. They need to use NetBIOS, because NetBEUI cannot be routed. This feature will allow browsing the Network Neighborhood without any additional workstation con???guration.

You enable this feature in the IP Pro???le Parameters screen of your Connection Pro???le. The IP Pro???le Parameters screen varies slightly, depending on whether your model router connects directly to the Internet, or if it connects via an Ethernet connection through a cable or DSL modem. The enabling feature is the same for both:

Using the Tab key, toggle NetBIOS Proxy Enabled from the default No to Yes, and press Return. Your remote

Network Neighborhood becomes accessible from your Windows desktop.

Note: The remote IP address and subnet mask should strictly match the IP address and subnet mask con???gured on the LAN interface of the remote router. See the following example.

5-32 Administrator???s Handbook

When Router B receives this broadcast, it sends it on its LAN.

Con???guration for Router A

IP Profile Parameters

Con???guration for Router B

IP Profile Parameters

Virtual Private Networks (VPNs) 5-33

Note: Microsoft Network browsing is available with or without a Windows Internet Name Service (WINS) server. Shared volumes on the remote network are accessible with or without a WINS server. Local LAN shared volumes that have Port Address Translation (PAT) applied to them are not available to hosts on the remote LAN. For tunnelled traf???c, NAT on the WAN has no effect on the Microsoft Networking traf???c.

Make sure the NetBIOS ???lter is not enabled in your Internet Connection Pro???le.

Motorola includes the NetBIOS Proxy feature as an enhancement and convenience for our customers. It has been lab-tested and many customers use it successfully. However, Motorola cannot guarantee that this feature will automatically give you the networking functionality you expect. There are many possible issues with the various Windows operating systems that may prevent NetBIOS from functioning as described above. Motorola Technical Support does not troubleshoot problems customers may encounter with their Windows operating system

5-34 Administrator???s Handbook

???From the Encapsulation Type pop-up menu select IPsec.

???Then select Encapsulation Options. The IPsec Tunnel Options screen appears.

IPsec Tunnel Options

For Key Management you can use either IKE or Manual. If you choose Manual, skip to ???IPsec Manual Key Entry??? on page 6-22. If you choose IKE (the default) continue below.

???Select IKE Phase 1 Pro???le and press Return.

6-4 Administrator???s Handbook

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

???A pop-up window displays a list of IKE Phase 1 Pro???les that you have con???gured. If you have not previously con???gured an IKE Phase 1 Pro???le, the selection ADD PH1 PROFILE allows you to do that now.

Adding an IKE Phase 1 Profile

IKE Phase 1 Pro???les contain the information that the two ends of a tunnel use to authenticate each other and the parameters that govern the public key cryptography exchanges that are required to generate new keys periodically. Make sure to add an IKE Phase 1 Pro???le. If an IKE Phase 1 Pro???le is not assigned to an IKE Connection Pro???le, all VPN traf???c for that pro???le will be discarded.

Select ADD PH1 PROFILE. The Add IKE Phase 1 Pro???le screen appears.

Add IKE Phase 1 Profile

Internet Key Exchange for VPNs 6-5

???The Pro???le Name ???eld accepts any name of up to 16 characters. Sixteen IKE Phase 1 pro???les are supported, since each of the potential sixteen Connection Pro???les may be associated with a separate IKE Phase 1 pro???le.

???The Mode pop-up menu allows you to choose between Main Mode (the default) and Aggressive Mode.

???In Main Mode the Router hides the Local and Remote Identity Type and Value ???elds, defaults to the host address, and always uses the IPV4 Address and the local and remote tunnel endpoint address.

???In Aggressive Mode the Local and Remote Identity Type pop-up menus allow you to choose the type of Identity value to use: IPv4 Address, IPv4 Subnet, IPv4 Range, Host Name, E-Mail Address, Key ID (ASCII), and Key ID (HEX). The Local and Remote Identity Type and Value menus allow you to specify one of the following, based on what Local Identity Type you selected in the previous pop-up menu:

IPv4 Address: A single IPv4 address in the familiar dotted-quad notation (a.b.c.d).

IPv4 Subnet: A single IPv4 network address in dotted-quad notation (a.b.c.d) followed by a mask speci???ed either by a slash and a bit-count between 0 and 32 OR by a second dotted-quad.

IPv4 Range: Two IPv4 addresses in dotted quad notation (a.b.c.d) separated by a space.

Host Name: A fully-quali???ed domain name (FQDN).

E-Mail Address: An RFC 822 e-mail address in the form user@hostname.

Key ID (ASCII): An opaque string consisting of printable ASCII characters represented as a sequence of printable ASCII characters.

Key ID (HEX): An opaque string consisting of arbitrary 8-bit ASCII values represented as a sequence of hexadecimal digits, each of which corresponds to one nibble of the string value.

???The Authentication Method pop-up menu speci???es the IKE Phase 1 authentication method. The only currently supported authentication method is Shared Secret. Other methods may be supported in future software releases.

???The Shared Secret ???eld allows you to enter a shared secret phrase (between 1 and 48 characters long) that will be used to generate key material for IKE Phase 1.

???The Encryption Algorithm pop-up menu speci???es the IKE Phase 1 encryption algorithm, and may be either DES (the default) or 3DES.

???The Hash Algorithm pop-up menu speci???es the IKE Phase 1 hash algorithm, and may be either SHA1 (the default) or MD5.

???The Dif???e-Hellman Group pop-up menu speci???es the IKE Phase 1 Dif???e-Hellman key exchange size, and may be either Group 1 (768 bits), Group 2 (1024 bits) (the default), or Group 5 (1536 bits).

???If you select Xauth Options the Xauth Options screen appears.

Internet Key Exchange for VPNs 6-7

???VPN concentrator ??? This con???gures Xauth to expect to receive authentication credentials, and to pos- sibly serve VPN IP parameters.

When Xauth is set to VPN concentrator, you can con???gure the IPSec pro???le to allow the Router to respond when the remote client requests an internal IP address:

Remote Members: If the Remote Members is a single address within the Local Members range, then the Router will respond with that address to incoming address requests from Xauth clients. For exam- ple a Local Range of 192.168.1.1/24, and a Remote Range of 192.168.1.99/32 allows the response 192.168.1.99, when an internal address is requested.

Since the Local Range is not required to be of type ???subnet,??? and the Router might need to respond with an internal subnet mask, the subnet mask is set to an even multiple of 8 bits based on the num- ber of addresses in the local range. See ???Multiple Network IPsec??? on page 6-17.

???From the Xauth Recipient Auth. Check pop-up menu, select the database to be used for authentication:

???Local ??? If you choose this option, the Gateway will use the locally con???gured username and password, for both concentrator and client modes.

???RADIUS - If you choose this option, the Gateway will use the globally con???gured RADIUS server when acting in concentrator mode.

???Enter an Xauth Local Username, the locally con???gured username to be sent in client mode. This is used to check received authentication credentials when not checking them with RADIUS.

???Enter an Xauth Local Password, the locally con???gured password to be sent in client mode. This is used to check received authentication credentials when not checking them with RADIUS.

Advanced IKE Phase 1 Options

???If you select Advanced IKE Phase 1 Options the Advanced IKE Phase 1 Options screen appears.

6-8 Administrator???s Handbook

Normally it is not necessary to change the settings of the items on the Advanced IKE Phase 1 Options screen. Most of these settings exist for ensuring compatibility with remote IKE implementations that may have certain limitations.

???The Negotiation pop-up menu allows you to specify the way the device will respond to a connection attempt. Normal (the default) is a two-way mode; Initiate Only or Respond Only permit limiting the connection to one-way only.

???The SA Use Policy pop-up menu speci???es the policy that the Router will use to determine which Phase 1 SAs to use when multiple valid Phase 1 SAs are available for transmitting traf???c on an IPsec tunnel.

Because the Router normally re???keys prior to the expiration of the current Phase 1 SAs, multiple valid Phase 1 SAs may exist during the period of time after the Router has re-keyed and established new Phase 1 SAs and the time at which the old Phase 1 SAs expire.

???If you select Newest SAs Immediately, the Router will begin using the newly created Phase 1 SAs immediately after they are negotiated.

???If you select Old SAs Until Expired, the Router will continue using the old Phase 1 SAs until they expire and will begin using the newly created Phase 1 SAs only after the old ones are no longer valid.

???Allow Dangling Phase 2 SAs toggles whether or not Phase 2 SAs are permitted to survive the expiration of the Phase 1 SAs under which they were created. Phase 2 SAs ???dangle??? when the Phase 1 SA under which they were created expires before they do. There is no requirement that the Phase 1 SA exist for the duration of the Phase 2 SA???s lifetime, but it is convenient because a Delete message may be sent.

???Phase 1 SA Lifetime (seconds) speci???es the duration in seconds for which the SA will remain valid. The range of permissible values is the set of non-negative integer values between 0 and 2^32-1. The default value is 28,800 seconds. The value zero speci???es the default.

???Send Initial Contact Message toggles whether or not the IKE negotiation process begins by sending an initial contact message. The default is Yes.

6-10 Administrator???s Handbook

WAN Configuration

WAN (Wide Area Network) Setup...

Display/Change Connection Profile...

Add Connection Profile...

Delete Connection Profile...

ATMP/PPTP Default Profile...

IKE Phase 1 Configuration...

Advanced Connection Options...

Return/Enter to configure IPSec tunnel configuration options.

From here you will configure yours and the remote sites' WAN information.

Selecting Display/Change IKE Phase 1 Pro???le or Delete IKE Phase 1 Pro???le displays an IKE Phase 1 Pro???le pop-up menu listing the names of all currently de???ned IKE Phase 1 pro???les:

IPsec Configuration

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

Selecting Display/Change IKE Phase 1 Pro???le and choosing an IKE phase 1 pro???le name from the pop-up list displays the Change IKE Phase 1 Pro???le screen. This screen is identical to the Add IKE Phase 1 Pro???le screen shown on page 6-4.

Selecting Delete IKE Phase 1 Pro???le and choosing an IKE phase 1 pro???le name from the pop-up list displays a con???rmation alert asking you to con???rm that you really want to delete the speci???ed IKE phase 1 pro???le:

Key Management

You specify your IKE key management on a per-Connection Pro???le basis. You can do this in one of three ways:

???You can create your IKE Phase 1 Pro???le ???rst, and then associate it with an existing Connection Pro???le

???You can create a Connection Pro???le and then modify it to associate it with an existing IKE Phase 1 Pro???le

???You can create a new Connection Pro???le and add a new IKE Phase 1 Pro???le as you go

You can do this WAN Con???guration menus.

Refer to ???Creating a New Connection Pro???le??? on page 2-8 for instructions on creating a Connection Pro???le if you don???t already know how to do that.

You can access the Key Management menus from the Change Connection Pro???le menu under the WAN Con???guration screen for a Connection Pro???le you have already created,

or you can create a new Connection Pro???le with your IKE settings included, as you go.

The IKE Key management settings are part of the Data Link Options that you specify in the Add Connection Pro???le or Change Connection Pro???le menus. In this description, it is assumed that you are changing an existing Connection Pro???le.

6-12 Administrator???s Handbook

A Change Connection Pro???le screen is shown below.

Example #1: Change Connection Pro???le menu, showing Encapsulation Type pop-up:

Telco Options...

Note: The Change Connection Pro???le screen will offer different options, depending on the model of gateway you are using. You can associate an IPsec pro???le with the Primary, the Backup, or choose to apply it to Any Port of the WAN interface by choosing the interface from the Interface Group pop-up menu as shown below.

Example #2: Add Connection Pro???le menu, showing Interface Group pop-up:

Internet Key Exchange for VPNs 6-13

From the Encapsulation Type pop-up menu, select IPsec. Then select Encapsulation Options and press Return.

The IPsec Tunnel Options screen appears.

IPsec Tunnel Options

The Key Management pop-up menu at the top of the IPsec Tunnel Options screen allows you to choose between IKE key management (the default for a new IPsec pro???le) and Manual key management.

If you select Manual, the IKE Phase 1 Pro???le option does not display, and you must enter your IPsec Manual Keys under the IPsec Manual Keys screen. See ???IPsec Manual Key Entry??? on page 22.

???The IKE Phase 1 Pro???le pop-up menu allows you to associate an IKE Phase 1 Pro???le with the IPsec tunnel. An IKE Phase 1 Pro???le speci???es the set of parameters that will be used for the IKE Phase 1 exchange. IKE Phase 1 Pro???les may be shared by multiple IPsec tunnels. The pop-up menu item displays the name of the currently associated IKE Phase 1 Pro???le, if any, or is blank if no IKE Phase 1 pro???le is associated with the tunnel.

The pop-up menu lists the names of all currently de???ned IKE Phase 1 Pro???les. The pop-up menu also includes an <<ADD PH1 PROFILE>> item to allow you to de???ne a new IKE Phase 1 Pro???le directly without ???rst going to the IPsec Con???guration screen, and a <<NONE>> item to allow you to dissociate an existing IKE Phase 1 Pro???le from the IPsec tunnel.

The remainder of the screen allows you to con???gure the IKE Phase 2 parameters that control the contents of the single IKE Phase 2 proposal sent by the Router. These same items specify the values that must be offered by one of the remote peer???s proposals.

???The Encapsulation pop-up menu allows you to select what IPsec encapsulations will be used: ESP only (the default), AH only, or AH+ESP (both AH and ESP).

???An AH Authentication Transform pop-up menu (which is visible only if you have selected AH or AH+ESP encapsulation) allows you to specify the type of AH authentication: HMAC-MD5-96 or HMAC-SHA1???96.

6-14 Administrator???s Handbook

???The ESP Encryption Transform pop-up menu (which is visible only if you have selected ESP or AH+ESP encapsulation) allows you to specify the type of ESP encryption: DES, 3DES, or NULL (no encryption).

???The ESP Authentication Transform pop-up menu (which is visible only if you have selected ESP or AH+ESP encapsulation) allows you to specify the type of ESP authentication: None, HMAC-MD5-96, or HMAC-SHA1???96.

Advanced IPsec Options

If you select Advanced IPsec Options, the Advanced IPsec Options screen appears.

Advanced IPsec Options

This screen allows you to specify the lifetime associated with each IPsec Security Association (SA) and control when the SA will expire and become invalid.

???SA Lifetime (seconds) speci???es the duration in seconds for which the SA will remain valid. The range of permissible values is the set of non-negative integer values between 0 and 2^32-1. The default value is 28,800 seconds (1 hour). The value zero speci???es the absence of an elapsed time lifetime.

???SA Lifetime (Kilobytes) speci???es the maximum number of kilobytes of data that may be secured (encrypted/decrypted or authenticated) using the SA before it expires and becomes invalid. The range of permissible values is the set of non-negative integer values between 0 and 2^32-1. The default value is 0 Kilobytes. The value zero speci???es the absence of a secured data lifetime.

Note: It is invalid to set both lifetime values to zero! This condition is not enforced by the console (in order to avoid order dependencies when con???guring the items), but rather is enforced at runtime and will cause the IPsec pro???le to assume the defaults. In such a case, the SA Lifetime (seconds) will default to 300 seconds.

???Perfect Forward Secrecy toggles whether or not Perfect Forward Secrecy will be used. Enabling Perfect Forward Secrecy (the default) causes IKE to perform a new Dif???e-Hellman exchange with each Phase 2

Internet Key Exchange for VPNs 6-15

re-key. Because the additional Dif???e-Hellman exchanges required for Perfect Forward Secrecy introduce additional overhead, it may be good to disable Perfect Forward Secrecy when security does not require it.

???Dead Peer Detection toggles whether or not the Router will detect a remote peer being of???ine.

Enhanced Dead Peer Detection

Motorola Netopia?? Embedded Software Version 8.7.4 adds new Dead Peer Detection mechanisms.

In previous software versions, when Dead Peer Detection was enabled, a counter would begin in the router when any traf???c was sent through the tunnel. Determination of a dead peer could take up to eight minutes.

Motorola Netopia?? Embedded Software Version 8.7.4 provides a new Dead Peer Detection mechanism. An IPsec IP net interface sends ICMP ping requests to a speci???c IP address on a Remote Member network. The ping is periodic, and the reply is expected within a certain amount of time. If the ICMP reply does not arrive within that time, the peer is considered dead, the current phase 2 SAs are torn down, and the IKE SA starts a new phase 1 negotiation, followed by the normal phase 2 negotiation, thereafter.

When you toggle Dead Peer Detection to Yes (on), new options appear.

Advanced IPsec Options

???Ping host allows you to specify the host IP address of the host to ping, and from which replies will be expected.

This ???eld is only available if you have previously con???gured, and committed, remote network IP data in the Add Network Con???guration screen under Advanced IP Pro???le Options. See ???Add Network Con???guration??? on page 6-18.

???Beginning with Software Version 8.7.4, Ping source address allows you to specify the source IP address of outbound router traf???c. This permits multiple IPSec tunnels to transmit and receive DPD packets via the correct tunnel.

???Ping retry interval and Ping reply timeout options appear.

6-16 Administrator???s Handbook

The defaults are 5 seconds and 90 seconds, respectively. You may adjust these to suit your network???s tolerances.

Note:

???ICMP Dead Peer Detection is not available when using manual re-keying.

???ICMP Dead Peer Detection does not initiate a series of phase 2 exchanges upon detecting a dead peer; it instead initiates a new phase 1 negotiation, followed by a new phase 2 negotiation once contact with the peer has been re-established.

???If you are using Multiple Network IPsec, the IP address of the ICMP Dead Peer Detection mechanism must be constrained to the set of network ranges de???ned for the IPsec pro???le.

Press Escape to return to the Add or Change Connection Pro???le screen, and select IP Pro???le Parameters. If you enable IKE key management the IP Pro???le Parameters screen appears.

IP Profile Parameters

Enter the IP Address or hostname of the remote tunnel endpoint.

???The Remote Tunnel Endpoint ???eld accepts either an IP address in the familiar dotted???quad notation a.b.c.d or a hostname to be resolved using the Domain Name System (DNS).

Note: When the Remote Tunnel Endpoint is an IP address, it will drop IKE packets if they are not sourced from the Remote Tunnel Endpoint IP address.

When the Remote Tunnel Endpoint is a hostname, there is no check on the source address of the packet; hostnames are used/resolved only for initiating outgoing connections.

Internet Key Exchange for VPNs 6-17

Multiple Network IPsec

Motorola Netopia?? Embedded Software Version 8.7.4 offers an enhancement to IPsec VPN tunnels allowing multiple network support. This feature enhances your Motorola Netopia?? Router???s Virtual Private Networking functionality.

This feature allows you to de???ne many local and remote network ranges for a given IPsec VPN pro???le. Each of these ranges has its own IPsec tunnel. However, each tunnel has a common tunneling endpoint and encryption policy. This is useful, for example, for branch of???ce management of multiple IP subnets over an encrypted VPN tunnel. The following diagram illustrates this feature:

Advantages of Multiple Network IPsec are:

???scalability

??????exibility, by adding any combination of remote/local network ranges

???support for sub-netting, host and network range addressing modes

???works with manual keying and Internet Key Exchange (IKE), including Xauth IKE extension (see page 6-5).

???each IPsec network works under the same local/remote tunnel endpoints

???beginning with Software Version 8.7.4, you can specify more than one force-all tunnel in a single pro- ???le.

???Select Add Network and press Return. The Add Network Con???guration screen appears.

CANCEL

???The Remote Member Format and Local Member Format pop-up menus allow you to choose a format for your network end points: Subnet, Range, or a single Host Address.

???If you choose Subnet, you must enter the Remote Member Address and the subnet mask that is the

Remote Member Mask.

Enter the Local Member Address and the Local Member Mask in their respective ???elds.

???If you choose Range, the next two ???elds become Remote Member 1st Address and Remote Member Last Address. You supply these values.

Complete the Local Member 1st Address and Local Member Last Address ???elds.

???If you choose Host Address, you need only supply the Remote Member Address and the Local Mem- ber Address; the other ???elds are hidden.

???Select COMMIT and press Return to add the con???guration. This returns you to the IP Pro???le Parameters screen. Select COMMIT and press Return in the IP Pro???le Parameters screen. This returns you to the Change Connection Pro???le screen. Select COMMIT and press Return in the Change Connection Pro???le screen.

Note:

???Any two IPsec tunnels differ only by the local/remote networks they are intended to reach; they have the same encryption policy, which is derived from the base pro???le.

???The feature is limited to 8 networks per tunnel.

If you return to the IP Pro???le Parameters screen, two new ???elds are displayed:

Internet Key Exchange for VPNs 6-19

IP Profile Parameters

???Display/Change Network allows you to make changes to existing network con???gurations you have made. If you select Display/Change Network, a list of your con???gured networks displays.

---------------------------------SCROLL DOWN----------------------------------

???Scroll down and up with the arrow keys to select the one you want to change, and press Return. You will be returned to the Network Con???guration screen where you can make any required changes.

6-20 Administrator???s Handbook

???If you select Delete Network in the IP Pro???le Parameters screen, the same scrolling list will display. When you select one of the networks and press Return, a warning screen will ask you to con???rm your choice:

???Specifying IKE key management alters the Advanced IP Pro???le Options screen as follows:

Advanced IP Profile Options

Enter an IP address in decimal and dot form (xxx.xxx.xxx.xxx).

???You can specify a Local Tunnel Endpoint Address. If not 0.0.0.0, this value must be one of the assigned interface addresses, either WAN or LAN. This is used as the source address of all IPsec traf???c.

???You can specify a Next Hop Gateway. If you specify the Remote Tunnel Endpoint Address, and the address is in the same subnet as the Remote Members Network you speci???ed in the IP Pro???le Parameters, the Next Hop Gateway option allows you to enter the address by which the Router partner is reached.

If you do not specify the Remote Tunnel Endpoint Address, the Router will use the default gateway to reach the partner. If the partner should be reached via an alternate port (for example, the LAN instead of the WAN), the Next Hop Gateway ???eld allows this path to be resolved.

???You can specify an Idle Timeout (seconds) value. The idle timeout tells the Router that if no traf???c passes through the tunnel for the speci???ed number of seconds, no automatic SA re-key should be performed. When new traf???c does pass through the tunnel, the idle timeout interval resets again when the current SAs expire.

If you set the value to zero, the Router will re-key the SA whenever the SA Lifetime interval speci???es, regardless of whether traf???c is passing through it or not. This will effectively ???nail up??? the tunnel.

Internet Key Exchange for VPNs 6-21

???Maximum Packet Size permits you to modify the MTU setting for the tunnel. Some ISPs require a setting of e.g. 1492 (or other value). The default 1500 is the most common and you usually don???t need to change this unless otherwise instructed. Accepted values are from 100 ??? 1500.

This is the starting value that is used for the MTU when the IPSec tunnel is installed. It speci???es the maximum IP packet length for the encapsulated AH or ESP packets sent by the router. The MTU used on the IPSec connection will be automatically adjusted based on the MTU value in any received ICMP can't fragment error messages that correspond to IPSec traf???c initiated from the router. Normally the MTU only requires manual con???guration if the ICMP error messages are blocked or otherwise not received by the router.

IPsec WAN Configuration Screens

You can also con???gure IKE Phase 1 Pro???les in the WAN Con???guration menus.

The WAN Con???guration screen now includes IKE Phase 1 Con???guration as shown:

WAN Configuration

WAN (Wide Area Network) Setup...

ATM Circuits Configuration...

Display/Change Connection Profile...

Add Connection Profile...

Delete Connection Profile...

WAN Default Profile...

ATMP/PPTP Default Profile...

IKE Phase 1 Configuration...

Advanced Connection Options...

Establish WAN Connection...

Disconnect WAN Connection...

Return/Enter for WAN Line configuration.

From here you will configure yours and the remote sites' WAN information.

Select IKE Phase 1 Con???guration and press Return.

The IKE Phase 1 Con???guration screen appears.

Internet Key Exchange for VPNs 6-23

Select IPsec Manual Keys and press Return.

IPsec Manual Keys

SHA1 ESP Auth. Key:

SHA1 AH Auth. Key:

Depending on your selections of Encapsulation, Encryption Transform, and Authentication Transform in the IPsec Tunnel Options screen, the IPsec Manual Keys screen will display differing entry ???elds to enter authorization keys and encryption keys.

With Manual Keys, you must manually con???gure identical authentication and encryption keys at both ends of the tunnel. The authentication keys are either 32 (for MD5) or 40 (for SHA1) ascii hex characters, while the encryption keys are 16 (for DES) or 48 (for triple-DES) ascii-hex characters.

VPN Quickview

Statistics are displayed on the VPN Quick View screen.

The VPN Quick View screen has been modi???ed slightly in software version 8.6.

6-24 Administrator???s Handbook

VPN Quick View

If the remote tunnel end point is a hostname (or ???0.0.0.0???) 0.0.0.0 is displayed until a Security Association is established. Previously the remote members network was displayed.

WAN Event History Error Reporting

The following events are logged and displayed in the WAN Event History screen:

6-26 Administrator???s Handbook

IP Setup 7-1

Chapter 7

IP Setup

Motorola Netopia?? Embedded Software Version 8.7.4 uses Internet Protocol (IP) to communicate both locally and with remote networks. This chapter shows you how to con???gure the gateway to route IP traf???c. You also learn how to con???gure the gateway to serve IP addresses to hosts on your local network.

Motorola???s IP routing features Network Address Translation and IP address serving.

This section covers the following topics:

??????IP Setup??? on page 7-1

??????RIP Options??? on page 7-9

??????IP Address Serving??? on page 7-17

??????More Address Serving Options??? on page 7-23

??????DHCP Relay Agent??? on page 7-28

??????Connection Pro???les??? on page 7-30

??????Multicast Forwarding??? on page 7-32

Network Address Translation allows communication between the LAN connected to the Router and the Internet using a single (or a few) IP address(es) instead of a routed account with separate IP addresses for each computer on the network.

Network Address Translation also provides increased security by hiding the local IP addresses of the LAN connected to the Motorola Netopia?? gateways from the outside world.

The setup is simpler, so ISPs typically offer Internet accounts supporting Network Address Translation at a signi???cant cost savings.

For a detailed discussion of Network Address Translation, see Chapter 4, ???Multi-NAT.???

IP Setup

The IP Setup options screen is where you con???gure the Ethernet side of the Router. The information you enter here controls how the gateway routes IP traf???c.

Consult your network administrator or ISP to obtain the IP setup information (such as the Ethernet IP address, Ethernet subnet mask, default IP gateway, and Primary Domain Name Server IP address) you will need before changing any of the settings in this screen. Changes to these settings that you make in this screen will take effect only after the Motorola Netopia?? device is reset.

7-2 Administrator???s Handbook

To go to the IP Setup options screen, from the Main Menu, select System Con???guration, then IP Setup. The IP Setup screen appears.

Set up the basic IP attributes of your Netopia in this screen.

Follow these steps to con???gure IP setup for your Router:

???Select Ethernet IP Address and enter the IP address for the Router???s Ethernet port.

???Select Ethernet Subnet Mask and enter the subnet mask for the Ethernet IP address that you entered in the last step.

???If you desire multiple subnets select De???ne Additional Subnets. If you select this item you will be taken to the IP Subnets screen. This screen allows you to de???ne IP addresses and masks for additional subnets. See ???IP subnets??? on page 7-3 for details.

The Motorola Netopia?? Embedded Software Version 8.7.4 supports multiple IP subnets on the Ethernet interface. You may want to con???gure multiple IP subnets to service more hosts than are possible with your primary subnet. It is not always possible to obtain a larger subnet from your ISP. For example, if you already have a full Class C subnet, your only option is multiple Class C subnets, since it is virtually impossible to justify a Class A or Class B assignment.

If you are using NAT, you can use the reserved Class A or Class B subnet.

???Select Default IP Gateway and enter the IP address for a default gateway. This can be the address of any major gateway accessible to the Router.

A default gateway should be able to successfully route packets when the Router doesn???t know how to route to the intended recipient???s IP address. Typically, a default gateway is the ISP???s gateway.

???If a backup gateway is available, select Backup IP Gateway and enter the IP address of a gateway that you want to use for backup in the event of a connection failure. See ???Backup Default Gateway??? on page 8-14 for con???guration details.

7-4 Administrator???s Handbook

#3:

#4:

#5:

#6:

#7:

#8:

Note: You need not use this screen if you have only a single Ethernet IP subnet. In that case, you can continue to enter or edit the IP address and subnet mask for the single subnet on the IP Setup screen.

This screen displays up to eight rows of two editable columns, preceded by a row number between one and eight. If you have eight subnets con???gured, there will be eight rows on this screen. Otherwise, there will be one more row than the number of con???gured subnets. The last row will have the value 0.0.0.0 in both the IP address and subnet mask ???elds to indicate that you can edit the values in this row to con???gure an additional subnet. All eight row labels are always visible, regardless of the number of subnets con???gured.

???To add an IP subnet, enter the Router???s IP address on the subnet in the IP Address ???eld in a particular row and the subnet mask for the subnet in the Subnet Mask ???eld in that row.

For example:

IP Setup 7-5

#6:

#7:

#8:

???To delete a con???gured subnet, set both the IP address and subnet mask values to 0.0.0.0, either explicitly or by clearing each ???eld and pressing Return to commit the change. When a con???gured subnet is deleted, the values in subsequent rows adjust up to ???ll the vacant ???elds.

The subnets con???gured on this screen are tied to the address serving pools con???gured on the IP Address Pools screen, and changes on this screen may affect the IP Address Pools screen. In particular, deleting a subnet con???gured on this screen will delete the corresponding address serving pool, if any, on the IP Address Pools screen.

If you have con???gured multiple Ethernet IP subnets, the IP Setup screen changes slightly:

Return/Select to view/configure IP Subnets.

Set up the basic IP attributes of your Netopia in this screen.

7-6 Administrator???s Handbook

The IP address and Subnet mask items are hidden, and the De???ne Additional Subnets... item becomes Subnet Con???guration.... If you select Subnet Con???guration, you will return to the IP Subnets screen that allows you to de???ne IP addresses and masks for additional Ethernet IP subnets.

Static routes

Static routes are IP routes that are maintained manually. Each static route acts as a pointer that tells the Router how to reach a particular network. However, static routes are used only if they appear in the IP routing table, which contains all of the routes used by the Router (see ???IP Routing Table??? on page 9-6).

Static routes are helpful in situations where a route to a network must be used and other means of ???nding the route are unavailable. For example, static routes are useful when you cannot rely on RIP.

To go to the Static Routes screen, select Static Routes in the IP Setup screen and press Return.

The Static Routes screen will appear.

Static Routes

Display/Change Static Route...

Add Static Route...

Delete Static Route...

Configure/View/Delete Static Routes from this and the following Screens.

Viewing static routes

To display a view-only table of static routes, select Display/Change Static Route. The table shown below will appear.

IP Setup 7-7

Select a Static Route to modify.

The table has the following columns:

Dest. Network: The network IP address of the destination network.

Subnet Mask: The subnet mask associated with the destination network.

Next Gateway: The IP address of the gateway that will be used to reach the destination network.

Priority: An indication of whether the Router will use the static route when it con???icts with information received from RIP packets.

Enabled: An indication of whether the static route should be installed in the IP routing table. To return to the Static Routes screen, press Escape.

Adding a static route

To add a new static route, select Add Static Route in the Static Routes screen. The Add Static Route screen will appear.

7-8 Administrator???s Handbook

Add Static Route

ADD STATIC ROUTE NOWCANCEL

Configure a new Static Route in this Screen.

???To install the static route in the IP routing table, select Static Route Enabled and toggle it to Yes. To remove the static route from the IP routing table, select Static Route Enabled and toggle it to No.

???Be sure to read the rules on the installation of static routes in the IP routing table. See ???Rules of static route installation??? on page 7-9.

???Select Destination Network IP Address and enter the network IP address of the destination network.

???Select Destination Network Subnet Mask and enter the subnet mask used by the destination network.

???Select Next Gateway IP Address and enter the IP address for the gateway that the Router will use to reach the destination network. This gateway does not necessarily have to be part of the destination network, but it must at least know where to forward packets destined for that network.

???Select Route Priority and choose High or Low. High means that the static route takes precedence over RIP information; Low means that the RIP information takes precedence over the static route.

???If the static route con???icts with a connection pro???le, the connection pro???le will always take precedence.

???To make sure that the static route is known only to the Router, select Advertise Route Via RIP and toggle it to No. To allow other RIP-capable gateways to know about the static route, select Advertise Route Via RIP and toggle it to Yes. When Advertise Route Via RIP is toggled to Yes, a new item called RIP Metric appears below Advertise Route Via RIP.

With RIP Metric you set the number of gateways, from 1 to 15, between the sending gateway and the destination gateway. The maximum number of gateways on a packet???s route is 15. Setting RIP Metric to 1 means that a route can involve 15 gateways, while setting it to 15 means a route can only involve one gateway.

???Select ADD STATIC ROUTE NOW to save the new static route, or select CANCEL to discard it and return to the Static Routes screen.

IP Setup 7-9

???Up to 32 static routes can be created, but one is always reserved for the default gateway, which is con???gured using either Easy Setup or the IP Setup screen in system con???guration.

Modifying a static route

To modify a static route, in the Static Routes screen select Display/Change Static Route to display a table of static routes.

Select a static route from the table and go to the Change Static Route screen. The parameters in this screen are the same as the ones in the Add Static Route screen (see ???Adding a static route??? on page 7-7).

Deleting a static route

To delete a static route, in the Static Routes screen select Delete Static Route to display a table of static routes. Select a static route from the table and press Return to delete it. To exit the table without deleting the selected static route, press Escape.

Rules of static route installation

The Motorola Netopia?? Embedded Software Version 8.7.4 applies certain rules before installing enabled static routes in the IP routing table. An enabled static route will not be installed in the IP routing table if any of the following conditions are true:

???The static route???s Next Gateway IP Address matches an IP address in the range of IP addresses being distributed by DHCP.

???The static route???s Next Gateway IP Address is determined to be unreachable by the Router.

???The static route???s route information con???icts with a connection pro???le???s route information.

???The connection pro???le associated with the static route has a disabled dial-on-demand setting, and there is no current connection using that connection pro???le.

A static route that is already installed in the IP routing table will be removed if any of the conditions listed above become true for that static route. However, an enabled static route is automatically reinstalled once the conditions listed above are no longer true for that static route.

RIP Options

Motorola Netopia?? Embedded Software Version 8.7.4 supports RIP-2 MD5 Authentication (RFC2082 Routing Internet Protocol Version 2, Message Digest 5). The purpose of MD5 authentication is to provide an additional level of con???dence that a RIP packet received was generated by a reliable source. In other words, MD5 authentication provides an enhanced level of security that information that your PC receives does not originate from a malicious source posing as part of your network.

Overview

All participants in an authenticated RIP environment on a network must share an identi???er key. There is no key exchange protocol like IKE, so all keys must be manually entered by an administrator.

RIP-2 MD5 Authentication requires that an interface con???gured to receive authenticated packets ignore unau- thenticated packets or packets authenticated with an invalid key. An interface that is not con???gured for receiving authenticated packets ignores authenticated ones.

7-10 Administrator???s Handbook

On a Motorola Netopia?? router, every interface will be allowed to have up to two keys. RIP-2 MD5 authentication can be con???gured on the Ethernet LAN (all models), Ethernet WAN models, Connection Pro???les, and the Default Pro???le. Keys can have lifetimes, de???ned as a start date and time and an end date and time, or in???nite.

Key management

Typically, you con???gure only one key on a given interface and all of the interfaces that interact with that interface. RIP updates are sent every 30 seconds. Each RIP packet is authenticated using one key and sent. When the Motorola Netopia?? router receives an authenticated RIP packet from a device, it keeps track of that device (peer).

The longer it is in use, a single key becomes less secure. Therefore, RFC2082 speci???es that an interface must support at least two keys per interface to allow a transition from an old key to a new key. It is recommended that you specify an overlapping time of ???ve minutes for transitioning from one key to the next. Whenever two keys are valid at the same time, the Motorola Netopia?? router tries to determine if other peers (devices that it has received an authenticated packet from in the past three minutes) on its network are using the new key. If any of the peers have not used the new key yet, the Motorola Netopia?? router will send RIP updates twice, once with each key.

If the last valid key expires, the Device Event History logs a ???* RIP: last authentication key expired??? message, and continues to use that key as if it were still valid.

Authentication configuration

To con???gure RIP-2 MD5 authentication, from the Main Menu, select System Con???guration, then IP Setup.

The IP Setup screen appears.

Enter an IP address in decimal and dot form (xxx.xxx.xxx.xxx).

Set up the basic IP attributes of your Netopia in this screen.

7-12 Administrator???s Handbook

???RIP v2 Authentication Keys is visible only if v2 MD5 Authentication is enabled for either Receive or Transmit RIP.

Note:

???All of the changes on this menu require a reboot. This is unique to the Ethernet LAN. RIP changes on all other interfaces are immediately effective.

???If you set the RIP Receive option to Both v1 and v2, the interface will ignore authenticated RIP packets since authenticated v1 packets do not exist. Only v2 packets can be authenticated.

???Select RIP v2 Authentication Keys.

The RIP v2 Authentication Keys screen appears.

IP Setup 7-13

RIP v2 Authentication Keys

Display/Change Key...

Add Key...

Delete Key...

Adding a key

Select Add Key. The Add Key Screen appears.

???The key identi???er Key ID can be any numeric value from 0 ??? 255, and must be unique per interface. You can not have two keys with the same key ID on an interface.

???The Authentication Key may consist of from 1 ??? 16 ASCII characters. These appear as asterisks when typed.

7-14 Administrator???s Handbook

???The Start Date and End Date formats are determined by the System Date Format, set on the Set Date and Time menu under the System Con???guration menus.

???The Start Time and End Time formats are determined by the System Time Format. The AM or PM pop-up menus do not appear if the time format is 24 hour time.

???The End Time Mode pop-up menu allows you to select either Date or In???nite. This determines whether or not the key will expire at a speci???ed time and date, or remain effective inde???nitely.

End Date, End Time, and AM or PM do not appear if the End Time Mode is set to ???In???nite???. In???nite means that the key begins when it begins, but it never expires. The acceptable year range is from 1904 ??? 2039.

???When you are satis???ed with your entries, select COMMIT and press Return.

This menu will not accept a non-unique Key ID on the same interface; failure to enter an authentication key; or a negative start date, end date, or start time and end time range.

Changes to RIP Keys on all interfaces are immediately effective. This differs from the remainder of the RIP con???guration on the Ethernet LAN, which requires a reboot. It is important that the keys be able to change dynamically, however, because the purpose of entering more than one key on an interface is to insure a smooth transition between keys with no network outages.

Changing or deleting a key

You change or delete a key by selecting it from a pop-up menu. In the RIP v2 Authentication Keys menu, select

Display/Change Key.

Delete Key...

Up/Down Arrow Keys to select, ESC to dismiss, Return/Enter to Edit.

Note: The date and time formats are determined by the system date and time formats. If the current date and time fall within the range of dates and times, the Valid ???eld indicates ???yes???, otherwise it indicates ???no???.

You modify the Change Key menu in the same way as in the Add Key menu (see ???Adding a key,??? on page 13).

If you select Delete Key, a pop-up menu will ask you to con???rm your choice.

IP Setup 7-15

Connection Profiles and Default Profile

RIP-2 MD5 authentication may be con???gured in Connection Pro???les, as well. If you are not using NAT, your public Internet connection can bene???t from sending authenticated RIP packets as well as receiving them. To con???gure RIP-2 MD5 authentication for a Connection Pro???le, you can either change an existing Connection Pro???le, or create a new one.

The Default Pro???le Leased and Switched menus are the same as the Connection Pro???le RIP option and associated menus. For brevity, the following example shows only the Connection Pro???le RIP option and associated menus.

In either case, navigate to the RIP Pro???le Parameters screen under the IP Pro???le Parameters menu of the Display/Change (or Add) Connection Pro???le screen.

The connection pro???le RIP Pro???le Parameters screen appears.

7-16 Administrator???s Handbook

RIP v2 Authentication Keys...

???Receive RIP is always visible. Here you select Off, v1, v2, Both v1 and v2, or v2 MD5 Authentication from the pop-up menu. For MD5 authentication, you must select v2 MD5 Authentication.

???If NAT is disabled, Transmit RIP is visible. Here you select Off, v1, v2 (broadcast), v2 (multicast), v2 MD5 (broadcast), or v2 MD5 (multicast) from the pop-up menu. For MD5 authentication, you must select v2 MD5 (either broadcast or multicast).

???If you chose any Transmit RIP option other than Off, TX RIP Policy is visible. Here you select Poison Reverse or Split Horizon from the pop-up menu. Unless otherwise instructed, leave the default Poison Reverse.

???If either Receive RIP or Transmit RIP is set to v2 MD5 Authentication, RIP v2 Authentication Keys is visible. Selecting RIP v2 Authentication Keys takes you to the RIP v2 Authentication Keys screen, where you can con???gure your keys in the same manner as in ???Adding a key,??? on page 13. After con???guring your key, press COMMIT in the Add or Change Key screen, then press Escape three times to return to the Add or Change Connection Pro???le screen.

???Select COMMIT in the Connection Pro???le screen and press Return. Your changes become effective for the speci???ed Connection Pro???le.

Power interruptions

Motorola Netopia?? 4000 Series routers use NTP updates to set the correct time. Consequently, the starting time after a power cycle, whether from power failure or deliberately switching power off and on, is in the year 1904. This could invalidate some keys that would otherwise be valid. To prevent this, if the system time is before the year 2000, all keys are considered valid regardless of their speci???ed date and time ranges.

IP Setup 7-17

IP Address Serving

In addition to being a gateway, the Router is also an IP address server. There are three protocols it can use to distribute IP addresses.

???The ???rst, called Dynamic Host Con???guration Protocol (DHCP), is widely supported on PC networks, as well as Apple Macintosh computers using Open Transport and computers using the UNIX operating system. Addresses assigned via DHCP are ???leased??? or allocated for a short period of time; if a lease is not renewed, the address becomes available for use by another computer. DHCP also allows most of the IP parameters for a computer to be con???gured by the DHCP server, simplifying setup of each machine.

???The second, called BootP (also known as Bootstrap Protocol), is the predecessor to DHCP and allows older IP hosts to obtain most of the information that a DHCP client would obtain. However, in contrast, BootP address assignments are ???permanent??? since there is no lease renewal mechanism in BootP.

???The third protocol, called Dynamic WAN, is part of the PPP/MP suite of wide area protocols used for WAN connections. It allows remote terminal adapters and NAT-enabled gateways to be assigned a temporary IP address for the duration of their connection.

Since no two hosts can use the same IP address at the same time, make sure that the addresses distributed by the Router and those that are manually con???gured are not the same. Each method of distribution must have its own exclusive range of addresses to draw from.

Go to the System Con???guration screen. Select IP Address Serving and press Return. The IP Address Serving screen will appear.

7-18 Administrator???s Handbook

???If you enabled IP Address Serving, then DHCP, BootP clients and Dynamic WAN clients are automatically enabled.

???The IP Address Serving Mode pop-up menu allows you to choose the way in which the Router will serve IP addresses. The device can act as either a DHCP Server or a DHCP Relay Agent. (See ???DHCP Relay Agent??? on page 7-28 for more information.) In most cases, you will use the device to serve its own pool of IP addresses, hence DHCP Server is the default. Address serving can also be disabled.

???Select Number of Client IP Addresses and enter the total number of contiguous IP addresses that the Router will distribute to the client machines on your local area network. Twelve-user models are limited to twelve IP addresses.

In the screen example shown above, ???ve Client IP addresses have been allocated.

???Select 1st Client Address and enter the ???rst client IP address that you will allocate to your ???rst client machine. For instance, on your local area network you may want to ???rst ???gure out which machines are going to be allocated speci???c static IP addresses so that you can determine the pool of IP addresses that you will be serving addresses from via DHCP, BootP, and/or Dynamic WAN.

Example: Your ISP has given your Router the IP address 192.168.6.137, with a subnet mask of 255.255.255.248. The subnet mask allocated will give you six IP addresses to use when connecting to the ISP over the Internet. Your address range will be from .137 ??? .143. In this example you would enter 192.168.6.138 as the 1st Client Address, since the gateway itself must have an IP address.

???To enable DHCP, select Serve DHCP Clients and toggle it to Yes. DHCP serving is automatic when IP Address Serving is enabled.

???The DHCP Next-Server ???eld allows you to enter the IP address of the next server in the boot process, which is typically a Trivial File Transfer Protocol (TFTP) server.

7-20 Administrator???s Handbook

This screen consists of between two and eight rows of four columns each. There are exactly as many rows as there are Ethernet IP subnets con???gured on the IP Subnets screen.

???The Subnet (# host addrs) column is non-selectable and non-editable. It indicates the network address of the Ethernet IP subnet for which an address pool is being con???gured and the number of host addresses available on the subnet. The network address is equal to the gateway???s IP address on the subnet bitwise-ANDed with the subnet mask. The host address count is equal to the subnet size minus three, since one address is reserved for the network address, one for the subnet broadcast address, and one for the gateway???s interface address on the subnet.

You can edit the remaining columns in each row.

???The 1st Client Addr and Clients columns allow you to specify the base and extent of the address serving pool for a particular subnet. Entering 0.0.0.0 for the ???rst client address or 0 for the number of clients indicates that no addresses will be served from the corresponding Ethernet IP subnet.

???The Client Gateway column allows you to specify the default gateway address that will be provided to clients served an address from the corresponding pool. The value defaults to the Router???s IP address on the corresponding subnet (or the Router???s default gateway, if that gateway is located on the subnet in question). You can override the value by entering any address that is part of the subnet.

DHCP, BootP, and dynamic WAN clients may receive an address from any one of the address serving pools con???gured on this screen.

Numerous factors in???uence the choice of served address. It is dif???cult to specify the address that will be served to a particular client in all circumstances. However, when the address server has been con???gured, and the clients involved have no prior address serving interactions, the Router will generally serve the ???rst unused address from the ???rst address pool with an available address. The Router starts from the pool on the ???rst row and continues to the pool on the last row of this screen.

Once the address server and/or the clients have participated in address serving transactions, different rules apply:

IP Setup 7-21

???When requesting an address, a client will often suggest an address to be assigned, such as the one it was last served. The Router will attempt to honor this request if the address is available. The client stores this address in non-volatile storage, for example, on disk, and the speci???c storage method/location differs depending on the client operating system.

???When requesting an address, a client may provide a client identi???er, or, if it does not, the Motorola Netopia?? Embedded Software Version 8.7.4 may construct a pseudo-client identi???er for the client. When the client subsequently requests an address, the Router will attempt to serve the address previously associated with the pseudo-client identi???er. This is normally the last address served to the client.

???Otherwise, the Motorola Netopia?? will select the least-recently used available address, starting from the ???rst address in the ???rst pool and ending with the last address in the last pool.

Note: The address serving pools on this screen are tied to the IP subnets con???gured on the IP Subnets screen. Changes to the IP Subnets screen may affect this screen. In particular, deleting a subnet on the IP Subnets screen will delete the corresponding address serving pool, if any, on this screen.

DHCP NetBIOS Options

If your network uses NetBIOS, you can enable the Router to use DHCP to distribute NetBIOS information.

NetBIOS stands for Network Basic Input/Output System. It is a layer of software originally developed by IBM and Sytek to link a network operating system with speci???c hardware. NetBIOS has been adopted as an industry standard. It offers LAN applications a variety of ???hooks??? to carry out inter-application communications and data transfer. Essentially, NetBIOS is a way for application programs to talk to the network. To run an application that works with NetBIOS, a non-IBM network operating system or network interface card must offer a NetBIOS emulator. Many vendors either provide a version of NetBIOS to interface with their hardware or emulate its transport layer communications services in their network products. A NetBIOS emulator is a program provided by NetWare clients that allow workstations to run applications that support IBM???s NetBIOS calls.

???Select DHCP NetBIOS Options and press Return. The DHCP NetBIOS Options screen appears.