Compatible Systems IntraPort Enterprise-2 User Manual

IntraPort Enterprise-2

VPN Access Server

Administrator’s Guide

Compatible Systems Co rporation

4730 Waln ut Street

Suite 102

Boulder, Colorado 80301

303-444-9532
800-356-0283

http://www.compatible.com

IntraPort Enterprise-2 VPN Access Server Administrator’s Guide, Version 1
Copyright © 1999, Compatible Systems Corporation

All rights reserved. IntraPort Enterprise, RISC Router, MicroRouter and CompatiView are
trademarks of Compatible Systems Corporation. Other trademarks are the property of their
respective holders.

Part number: A00-1855

FCC Notice: This product has been certified to comply with the limits for a Class A computing
device, pursuant to Subpart J of Part 15 of FCC Rules. It is designed to provide reasonable pro­tection against radio or television communication interference in a commercial environment.
Operation of this equipment in a residential area could cause interference with radio or television
communication.

Table of Contents

i

Introduction to the IntraPort Enterprise-2 1

A NOTE ABOUT REMOTE CLIENT CONNECTIONS 1
INTRAPORT ENTERPRISE-2 INSTALLATION OVERVIEW 1
INTRAPORT ENTERPRISE-2 MANUAL OVERVIEW 2

Chapter 1 - Getting Started 3

A FEW NOTES 3

Please Read the Manuals 3
Warranty and Service 3
Getting Help with the IntraPort Enterprise-2 3

W

HAT YOU WILL NEED TO GET STARTED 4

Supplied with the IntraPort Enterprise-2 4
Additional Items Needed for Installation 4

Chapter 2 - Mounting Instructions 5

CHANGING THE POWER SUPPLY VOLTAGE SETTINGS 5
R

ACK MOUNTING INSTRUCTIONS 6

Standard 19-inch Rack Mount 6
Earthquake Mount in a 19-inch Rack 8
Telco Rack Mount 11
Wall Mount 13

P

OWER CORD RETAINER INSTALLATION 15

Chapter 3 - Network Installation 16

CONNECTING THE SERVER TO THE ETHERNET 16
CONNECTING A MANAGEMENT CONSOLE 17
P

OWERING UP THE SERVER 17

Chapter 4 - CompatiView Software Installation 18

COMPATIVIEW FOR WINDOWS 18

System Requirements 18
Installation and Operat io n 18
Transport Protocols and CompatiView 19

Chapter 5 - Command Line Management 20

OUT-OF-BAND COMMAND LINE MANAGEMENT 20
TEMPORARILY RECONFIGURING A HOST FOR COMMAND LINE MANAGEMENT 20
SETTING UP TELNET OPERATION 21

Chapter 6 - Basic Configuration Guide 22

ETHERNET INTERFACE CONFIGURATION 22

IP Settings for Dual-Ethernet Setups 22
IP Settings for Single-Ethernet Setups 23

Table of Contents

ii

IPX Protocol 23

Required for IPX 23
Suggested for IPX 23

AppleTalk Protocol 24

Required for AppleTalk 24
Suggested for AppleTalk 24

Configuring the Server for LAN-to-LAN Tunnels 24

Required for LAN-to-LAN Tunnel Configurations 24
Suggested for LAN-to-LAN Tunnel Configurations 24

Configuring the Server for IP and IPX Client Tunnels 24

Required for Client Tunnel Configurations 24
Suggested for Client Tunnel Configurations 25
VPN User Database 25

Setting up RADIUS Authentication 25

Setting the IntraPort Enterprise-2 for a RADIUS Server 25
RADIUS Server User Authentication Settings 25

Setting up SecurID Authentication 26

Setting the IntraPort Enterprise-2 for an ACE/Server 27
ACE/Server Settings 27

S

AVING A CONFIGURATION FILE TO FLASH ROM 27

Chapter 7 - Shipping Defaults 28

DEFAULT PASSWORD 28
ETHERNET INTERFACES 28

IP Defaults 28
IPX Defaults 28
AppleTalk Defaults 28

Chapter 8 - LED Patterns and Test Switch Settings 29

INTRAPORT ENTERPRISE-2 LED PATTERNS 29

Over Temp 29
Sys Ready 29
General Indicators 29
Ethernet Traffic Indicat ors 29

Load % Indicators 29

INTRAPORT ENTERPRISE-2 SWITCH SETTINGS 30

Appendix A - Connector and Cable Pin Outs 31

PIN OUTS FOR DB-25 MALE TO DB-25 FEMALE CONSOLE CABLE 31

Table of Contents

iii

Appendix B - Downloading Software From Compatible Systems 32

Appendix C - Security Dynamics ACE/Server Information 33

Appendix D - When the “Over Temp” Light Comes On 34

REPLACING OR CLEANING THE INTRAPORT ENTERPRISE-2 AIR FILTER 35

Appendix E - Terms and Conditio ns 36

List of Figures

iv

Figure 1. Mounting Screws 4
Figure 2. Location of Voltage Switch on the Power Supply 5
Figure 3. Standard Rack-Mount Installation 6
Figure 3.1. Mounting the IntraPort Enterprise-2 in the Standard Rack 7
Figure 4. Installing Bracket Extenders 8
Figure 4.1. Installing Earthquake Rack-Mount Brackets 9
Figure 4.2 Mounting the IntraPort Enterprise-2 Chassis in the Earthquake Rack 10
Figure 5. Installing Telco Rack-Mount Brackets 11
Figure 5.1. Mounting the IntraPort Enterprise-2 Chassis in the Telco Rack 12
Figure 6. Installing Wall-Mount Brackets 13
Figure 6.1. Securing the IntraPort Enterprise-2 Chassis to the Board 14
Figure 7. Attaching the IntraPort Enterprise-2 Power Cord Retainer 15
Figure 8. IntraPort Enterprise-2 VPN Access Server 16
Figure 9. Detail of Front Panel 16
Figure 10. Removing the Chassis Cover and Filter 35

Introduction to the IntraPort Enterprise-2 1

Introduction to the IntraPort Enterprise-2

Congratulations on your purchase of the IntraPort Enterprise-2 VPN Access Server. The
IntraPort Enterprise-2 supports up to 64 LAN-to-LAN tunnels and up to 2000 simultaneous
remote client connections.

In addition, it offers DES and 3DES encryption using dual built-in hardware coprocessors.

A Note About Remote Client Connections

In order to create a tunnel to a network over the Internet, remote users must run VPN Client
software on a Windows95/98 PC, Windows NT PC, Mac OS, Linux, or Sun Solaris computer
which is connected to the Internet via PPP or Ethernet.

The IntraPort VPN Clients are applications which set up the remote access VPN tunnels to the
IntraPort Enterprise-2 VPN Access Server and make sure that appropriate data gets sent.

The clients work in conjunction with your communications software. Connections can be

made to the Internet via PPP software or over a local intranet via a workstation’s LAN adapter.
Together, these pieces provide cost-effective on-demand connections to your corporate
network.

IntraPort Enterprise-2 Installation Overview

This manual will help you mount the IntraPort Enterprise-2 VPN Access Server in a rack and
install it on your Local Area Network. It also includes general maintenance information and
some technical specifications. For the most up-to-date information available on the IntraPort
Enterprise-2 VPN Access Server, please visit the Techn ical Suppo rt s ection o f our Web site at:
http://www.compatible.com.

In short, the installation steps are:

1. Mount the IntraPort Enterprise-2 in a rack or other appropriate setting.

2. Install the IntraPort Enterprise-2 hardware on your Ethern et LAN and co nnect one o r

both of the 10/100 twisted-pair Ethernet interfaces to a Fast Ethernet or Ethernet hub.

3. Select the management tool you wish to use with the server. If you want to use the

CompatiView management software, you must install the software on a Windows PC
computer which is connected to your network.

4. Configure the IntraPort Enterprise-2 LAN and tunnel parameters using the manage-

ment tool you have chosen.

5. Install and Configure the VPN Client software for remote users. (See the IntraPort

VPN Client Reference Guide.)

Introduction to the IntraPort Enterprise-2 2

IntraPort Enterp ri se-2 Man u a l Overvi ew

The manual is divided int o s everal s ecti ons th at sh oul d pr ovi de you w it h the basic information
you will need to use the IntraPort Enterprise-2 on your network. For the latest documentation
on Compatible Systems products, including the most current version of this manual, visit the
Technical Support section of our Web site.

Chapter 1 - Getting Started

This part of the manual describes the contents of the IntraPort Enterprise-2 package and
emphasizes the preparation and equipment you will need to install the server.

Chapter 2 - Mounting Instructions

This part of the manual includes detailed instructions for mounting the IntraPort Enterprise-2
in a variety of equipment racks.

Chapter 3 - Network Installation

This part of the manual includes step-by-step instructions on how to physically install the
server and connect it to your local Ethernet. Instructions are included fo r twisted-pair Ethernet
environments.

Chapter 4 - CompatiView Software Installation

This part of the manual describes how to install CompatiView, Compatible Systems’ GUI
(Graphical User Interface) management software which is included with your server.

Chapter 5 - Command Line Preparation

This part of the manual provides basic instructions for using command line management and
text-based configuration.

Chapter 6 - Basic Configuration Guide

This part of the manual provides a minimal list of parameters that must be entered into a server
for proper operation.

Chapter 7 - Shipping Defaults

This part of the manual lists factory defaults.

Chapter 8 - LED Patterns and Switch Settings

This part of the manual describes the LED indicators and the test switch settings.

Appendices

This part of the manual includes add itional informat ion that mi ght be of in terest t o you such as
technical specifications, some maintenance procedures and instructions for downloading
current software.

Chapter 1 - Getting Star ted 3

Chapter 1 - Getting Started

A Few Notes

Please Read the Manuals

The manuals included with your IntraPort Enterprise-2 VPN Access Server contain very
important information about installing and operating the IntraPort Enterprise-2. Please read
this manual, and refer to the management reference guides as required. It’s worth the few
minutes it will take.

Also, please fill out the warranty registration card and return it to us today. This will help us
keep you informed about updates to the IntraPort Enterprise-2 and future products available
from Compatible Systems.

You can also register on the Web at http://www.compatible.com. If you’d like to be notified
via e-mail about new products and receive important news from Compatible Systems, please
join our e-mail list on the Web.

Warranty and Service

The IntraPort Enterprise-2 is covered by the Compatible Systems Integr ated Suppo rt Pack age,
which includes a lifetime comprehensive warranty, a twenty-four hour advance replacement
program, unlimited phone support and software upgrades for the life of the product. A 24 x 7
support plan is also available.

Compatible Systems maintains copies of current software updates on the Internet. You may
download product software from the Internet at any time. For more information on down­loading current product software, see Appendix B.

Getting Help with the IntraPort Enterprise-2

If you have a question about the IntraPort Enterprise-2 and can’t find the answer in one of the
manuals included with the product, please visit the technical support section of our Web site
(http://www.compatible.com). This site includes extensive technical resources which may
answer many of your questions. You can also request technical support by filling out a brief
form. Technical support requests received via the Web fo rm will receive expedited treatment.
You may also call Compatible Systems Corporation or send s upp ort q ues tions via e-mail to
[e-mail]. Compatible Systems' phone number is listed on the front of this
guide. We will be happy to help you.

Chapter 1 - Getting Star ted 4

What You Will Need to Get Started

Before connecting the IntraPort Enterprise-2 VPN Access Server, please check the list below
to make sure that you have received all of the items that are supplied with the server package.

You should also make sure you have any additional items that are necessary to connect the
server to your network.

Supplied with the IntraPort Enterprise-2

Please check your shipping package for the following items:

• IntraPort Enterprise-2 unit

• Power cord

• One left earthquake rack-mount bracket

• One right earthquake rack-mount bracket

• One left long rack-mount extender

• One right long rack-mount extender

• Two short rack-mount extenders

• Two Telco/wall-mount brackets

• Two hand le spacers

• Two handles

• 32 assorted mounting screws (see Figure 1)

• One DB-25 male to DB-25 female console cable

• One reusable replacement air filter

• One power cord retainer

• One cable tie

• CD-ROM including:

4 CompatiView software for Windows
4 Operating software
4 VPN Client software (Windows and Mac OS versions)
4 HTML version of product documentation (which can be vi ewed with your favorit e

Web br owser)

• VPN Client Reference Guide

• CompatiView Management Software Reference Guide

• Text-Based Configuration and Command Line Management Reference Guide

• Warranty registration card

Figure 1. Mounting Screws

Additional Items Needed for Installation

Before connecting the IntraPort Enterprise-2 to your network, you need to make sure that you
have the necessary equipment. See Chapter 3 - Network Installation for details.

Chapter 2 - Mounting Instructions 5

Chapter 2 - Mounting Instructions

The IntraPort Enterprise-2 VPN Access Server can be left stand-alone on a desktop or equip­ment table or it can be mounted in a 19-inch rack, in a Telco rack or on a wall. Compatible
Systems provides all the parts necessary for securing the supplied mounting brackets to the
device; however, due to the variety of equipment racks and mounting techniques, you will
need to provide your own screws or clips to secure the mounting brackets to the equipment
rack or wall.

v

Note: When stacking other equipment on the IntraPort Enterprise-2 VPN Access Server, do

not exceed 35 pounds of evenly distributed weight on top of the server. Additional weight may
bend the case.

Changing the Power Supply Voltage Settings

The default setting for the voltage switch on the power supply for the Enterprise-2 is for a low
input voltage (marked 115V on the switch). If your electrical system requires a high input
voltage on the power supply, you must change it manually on the device before

plugging the

device in.
To change the settings:

1. Make sure the server is powered down and not connected to any power source.

2. Remove the front bezel by prying carefully using a flat head screwdriver to loosen it.

3. Using a small screw driver, change the voltage switch to the desired setting (230V for
high input voltage, 115V for low input voltage).

4. Replace the front bezel by firmly pressing it into the 6 slots.

Figure 2. Location of Voltage Switch on the Power Supply

Chapter 2 - Mounting Instructions 6

Rack Mounting Instructions

Standard 19-inch Rack Mount

Figure 3. Standard Rack-Mount Installation

Brackets are provided for mounting the IntraPo rt Enterprise-2 in a standard 19-inch equipment
rack. To rack-mount the server in a standard equipment rack:

1. Determine the desired location. The IntraPort Enterprise-2 requires 6.5 vertical inches
(4 shelf positions) of rack space.

2. Remove the front three vertically aligned pan-head machine screws from each side of
the server chassis as illustrated in Figure 3.

3. Using the black 10-32 flat-head screws provided, ins tall the mounting brack ets on the
sides of the server as shown.

4. Using the undercut 10-32 flat-head screws provided, install the handle and spacer on
the front of the mounting brackets as shown. (This step is optional.)

Chapter 2 - Mounting Instructions 7

Figure 3.1. Mounting the IntraPort Enterprise-2 in the Standard Rack

5. Using your screws or clips, fasten the mounting brackets to the equipment rack as
shown in Figure 3.1.

Chapter 2 - Mounting Instructions 8

Earthquake Mount in a 19-inch Rack

Figure 4. Installing Bracket Extenders

Earthquake brackets are provided for mounting the IntraPort Enterprise-2 in a standard
19-inch equipment rack. If the server will be located in an area prone to earthquakes, it is
strongly recommended that you use the earthquake br ackets f or mo unting the device. To earth­quake-mount the server in a standard equipment rack:

1. Determine the desired location. For proper placement of the brackets and extenders,
it is recommended that you first assemble the unattached brackets and extenders in
the equipment rack, using your own bracket-mounting screws or clips. Then remove
the front two brackets as illustrated in Figure 4 (be sure to mark their places on the
equipment rack). The IntraPort Enterprise-2 requires 6.5 vertical inches (4 shelf posi­tions) of rack space.

Chapter 2 - Mounting Instructions 9

Figure 4.1. Installing Earthquake Rack-Mount Brackets

2. Remove the 6 pan-head machine screws from each side of the IntraPort Enterprise-2 chassis and the two bottom corner pan-head

machine screws from the rear of the chassis as illustrated in Figure 4.1. Be sure to set the screws in a safe place so that you may

use them later if you change the mounting.

3. Using the black 10-32 flat-head screws provided, install the mounting brackets on the sides of the server as shown in Figure 4.1.

Using the provided

6-32 pan-head screws, fasten the rear of the chassis to the rear tab of the mounting bracket.

4. Using the undercut 10-32 flat-head s crews provided, install the h andles and spacers on the front of the mo unting brackets as shown.

Chapter 2 - Mounting Instructions 10

Figure 4.2 Mounting the IntraPort Enterprise-2 Chassis in the Earthquake Rack

1. While supporting the chassis, slide the rack-mount brackets into the installed rear
extenders as shown in Figure 4.2.

2. Using your screws or clips, fasten the fro nt bracket to the equipment rack as shown in
Figure 4.2.

3. Using the provided 4-40 pan-head screws, fasten the brackets and bracket extenders
together . The standard rack -mount bracket, extender and screws fit together as shown
in Figure 4.2.

Chapter 2 - Mounting Instructions 11

Telco Rack Mount

Figure 5. Installing Telco Rack-Mount Brackets

Brackets are provided for mounting the IntraPort Enterprise-2 chassis in a Telco rack. To
rack-mount the server into a Telco rack:

1. Determine the desired location. The IntraPort Enterprise-2 chassis requir e s 6 .5 verti­cal inches (4 shelf positions) of rack space.

2. Remove the bottom center pan-head machine screw from each side of the server chas­sis.

3. Using the black 10-32 flat-head screws provided, install the Telco/wall-mount brack­ets on the sides of the server as shown in Figure 5.

Chapter 2 - Mounting Instructions 12

Figure 5.1. Mounting the IntraPort Enterprise-2 Chassis in the Telco Rack

4. While supporting the chassis, move the device and the mounting brackets into the
desired rack position and use your own screws or clips to fasten the server and bracket
to the rack as shown in Figure 5.1.

Chapter 2 - Mounting Instructions 13

Wall Mount

Figure 6. Installing Wall-Mount Brackets

Brackets are provided for mounting the IntraPort Enterprise-2 on a wall. To wall-mount the
server:

1. Determine the desired location. The IntraPort Enterprise-2 chassis requir e s 6 .5 verti­cal inches and a mounting backboard measuring at least 24” x 24” x 1/2” (not sup­plied).

2. Remove the three bottom 10-32 pan-head machine screws from each side of the chas­sis as illustrated in Figure 6.

3. Using the 10-32 black flat-head screws provided, install the Telco/wall-mount brack­ets on the sides of the server as shown.

Chapter 2 - Mounting Instructions 14

Figure 6.1. Securing the IntraPort Enterprise-2 Chassis to the Board

4. Lay the server on top of the board and mark the wall-mount screw locations on the
board. To make inserting the scre w easier, pre-drill the screw locations before you
mount the device.

v

Note: If the backboard on which the server chassis will be mounted is already installed,

skip to Step 6.

5. Locate the wall studs and, using your own screws, attach the mounting backboard
securely to the wall by screwing the board to the studs.

v

Note: The IntraPort Enterprise-2 should be wall-mounted with the front and rear of the

chassis perpendicular to the floor and at eye level, so you can read the front LEDs. All four
mounting screws must be anchored to solid wood.

6. Using the supplied wood screws, fasten the unit to the board as illustrated in Figure

6.1, starting with the top bracket and then the bottom. Use extreme caution during
this step, making sure you are securely supporting the weight of the device until it is
firmly fastened to the board.

Chapter 2 - Mounting Instructions 15

Power Cord Retainer Installation

Figure 7. Attaching the IntraPort Enterprise-2 Power Cord Retainer

v Note: It is recommended that you determine the setting of your voltage switch before
installing the power cord retainer. For mor e information on power supply voltage settings, see

Changing the Power Supply Voltage Settings at the beginning of this chapter.

Chapter 3 - Network Installation 16

Chapter 3 - Network Installation

Figure 8. IntraPort Enterprise-2 VPN Access Server

Figure 9. Detail of Front Panel

Connecting the Server to the Ethernet

Because slot 1 is IPSec-only (meaning it will only handle IPSec packets and will drop all other
traffic), you need to pay special attention to your Ethernet connection setup.

The IPSec-only slot should only be used if you are planning to set the IntraPort Enterprise-2 to
operate in parallel with your existing firewall. This is the recommended setup. In this scenario,
the Ethernet interface on slot 1 should be connected to the same Ethernet segment as your
Internet gateway router while the Ethernet interface on slot 0 will serve as an IP, IPX and
AppleTalk router port for your internal networks.

The other option is to set up the server behind yo ur firewall us ing the Ethe rnet interface o n slot
0 only. In this scenario, slot 1 is not used and should not be plugged in to anything. You will
also have to set up your firewall to allow IPSec traffic through.

The 10/100 Ethernet interfaces directly support 100BaseTx or 10BaseT twisted-pair Ethernet.
The actual hardware is not numbered by slot. To connect one of the IntraPort Enterprise-2’s
Ethernet interfaces to twisted-pair Ethernet cabling, you will need an unshielded twisted-pair
station cable that is connected to a 10BaseT-compatible twisted-pair hub (for a transmit speed
of 10 Mbps) or a 100Mbps Fast Ethernet hub (for a transmit speed of 100 Mbps).

v

Note: Ethernet cables and cable connectors are not supplied with the IntraPort Enter-

prise-2. Category 5 cabling is required for 100 BaseT operation. Please contact your reseller
or your Compatible Systems representative for information on obtaining the correct Ethernet
cabling supplies.

Chapter 3 - Network Installation 17

If your twisted-pair hub is already in place, you can connect the server to an active network
without interrupting network activity.

Simply plug the unshielded twisted-pair cable (that is already connected to your Ethernet hub)
into the RJ-45 Ethernet connector on the front of the unit.

Connecting a Management Console

If you wish to connect an out-of-band management console, use the supplied DB-25 male to
DB-25 female cable and connect to the Console interface on the top

slot (slot 0) on the
IntraPort Enterprise-2. You can use a dumb terminal or a computer equipped with VT100
terminal emulation.

v

Note: If you connect to the console using a slot other than slot 0, all configuration changes will

be lost when the box is rebooted.

The default settings for the Console interface are VT100 terminal emulation, 9600 bps, 8 bits,
no parity, 1 stop bit and no Flow Control.

v

Note: The IntraPort Enterprise-2 also has two AUX interfaces. These are modem connec-

tions which should only be used in consultation with Compatible Systems’ Technical Support
staff, who will provide instruction on their use.

Powering Up the Server

v Note: The default setting for the voltage switch on the power supplies for the IntraPort
Enterprise-2 is for a low input voltage (marked 115V on the switch). If your electrical system
requires a high input voltage on the power supplies, you must change the settings before
plugging in the server (for instructions, see Changing the Power Supply Voltage Settings).

Connect the supplied power cord to the front of the IntraPort Enterprise-2 and set the power
switch to “On.” At power-up, the server will take approximately one minute to become visible
to CompatiView (see Chapter 4 - CompatiView Software Installation for more information) .

v

Note: If you want to use Telnet as a management method, you must first configure an IP

address into the server using an out-of-band console, or reconfigure the IP address on an IP
host or workstation on the same Ethernet segment as the server. See Chapter 5 - Command

Line Management for more information.

Chapter 4 - CompatiView Software Installation 18

Chapter 4 - CompatiView Software Installation

All of the products in Compatible Systems’ internetworking and VPN families, including the
IntraPort Enterprise-2, can be managed from a single GUI management platform called
CompatiView. CompatiView for Windows is included on the CD-ROM which was shipped
with your IntraPort Enterprise-2 VPN Access Server.

v

Note: An older version of CompatiView for Mac OS is also included on the CD-ROM

shipped with your server. The Mac OS version can be used with other Compatible products
such as MicroRouters and RISC Routers; however, it is not compatible with the IntraPort
Enterprise-2 VPN Access Server software. You must use CompatiView for Windows, versions

5.0 or later, to manage your server with CompatiView.

CompatiView for Windows

CompatiView for Windows allows you to manage the server from an IBM-compatible PC
running Win dows 95/98 or W i ndows NT. The PC can either be configured as an IPX client on
a Novell NetWare internet, or as an IP WinSock client on an IP internet.

System Requirements

In order to successfully run CompatiView for Windows, you need:

• IBM PC or compatible w/ 486 or later processor

• Microsoft Windows 95/98 or Windows NT installed

• VGA or better monitor

• IP - A WinSock-compatible transport stack

and/or

• IPX - A Netware or Microsoft Client installation

v

Note: To choose the active transport protocol on a Windows machine which has both IPX

and IP installed, select “Options” from the Database menu and click the General tab. Then
select the appropriate radio button under “Transport.”

Installation and Operation

The Windows version of the CompatiView program can be found in the Network Manage­ment/CompatiView/W indows directory on the CD-ROM that was included with your IntraPort
Enterprise-2 VPN Access Server.

Run the auto-installation program (CV5x file) by double-clicking on it. The installati on
program will ask you to select (or create) a directory in which it should locate CompatiView
and its associated files and database subdirectory.

Once the installation is complete, double click on the CompatiView icon to open the program.
For further information on using CompatiView, see the CompatiView Management Software
Reference Guide included with your server.

v

Note: For an up-to-date descr ipti on of the ch anges (if any) made t o Windows system files by

the installation program, see the README.TXT file located in the CompatiView installation
directory.

Chapter 4 - CompatiView Software Installation 19

Transport Protocols and CompatiVi ew

CompatiView will be able to use the transport protocol (IP or IPX) you have selected to access
Compatible Systems products anywhere on your internetwork. Depending on your security
setup, you may also be able to use the IP transport option to manage devices across the
Internet.

The IP protocol does not provide a method for CompatiView to automatically discover the
IntraPort Enterprise-2 VPN Access Server. To initially contact the server over IP using
CompatiView, you must first enter a valid IP address into the server. You can do this either on
a console directly connected to the server or by setting a workstation’s IP address to

198.41.12.2 with a Class C subnet mask (255.255.255.0) so that it can communicate over
Ethernet with 198.41.12.1 (the shipping default of Ethernet 0:0). After setting the server’s IP
address, be sure to change the workstation’s configuration back to its original settings.

The IPX protocol does

allow CompatiView to automatically discover the server. Compatible
Systems devices are configured to autoseed the two most common IPX frame types upon
startup (802.2 and 802.3 (raw)). If CompatiView has the IPX/SPX protocol selected as its
transport, it will be necessary to either powerup the server before powering up the workstation,
or reboot the workstation after the server has completed its boot sequence. This process will
ensure that the workstat ion and the server have the proper IPX network bindings for communi­cation.

Chapter 5 - Command Line Management 20

Chapter 5 - Command Line Management

The command line interface allows you to configure and monitor the IntraPort Enterprise-2
VPN Access Server in-band via Telnet or out-of-band with a terminal connected to the server’s
Console interface.

v

Note: Proper syntax is vital to effective operation of command line management. Case is

not significant – you may enter commands in upper case, lower case, or a combination of the
two.

Out-of-Band Command Line Management

You can use command line management and text-based configuration out-of-band as a perma­nent management tool, or only temporarily in order to set the server’s IP parameters to allow
in-band Telnet access.

In order to access the command line out-of-band, do the following:

1. Set a terminal or a PC equipped with VT100 terminal emulation to a baud rate of
9600, 8 bits, no parity, 1 stop bit and no Flow Control.

2. Connect it to the server’s Console interface using the cable which was supplied with
the IntraPort Enterprise-2.

3. Press the < Return> key one or two times.

4. Enter the default password letmein at the password prompt. The command line inter-
face prompt will appear on the screen.

If you plan to use out-of-band access for ongoing management of your server, you can find
further information on configuring your server in Chapter 6 - Basic Configuration Guide.
Otherwise, see the section later in this chapter on Setting Up Telnet Operation for information
on setting the server to allow Telnet access from hosts on its network.

Temporarily Reconfiguring a Host for Command Line Management

You can temporarily reconfigure an IP host in order to set the server’s IP parameters to allow
in-band Telnet access.

If you wish to set the server’s basic IP parameters in this fashion, the host must be on the same
Ethernet segment as one of the server’s Ethernet interfaces. You can then do the following:

1. Set the host’s IP address to 198.41.12.2, with a Class C subnet mask (255.255.255.0)
and then Telnet to 198.41.12.1.

2. Enter the default password letmein at the password prompt. The command line inter-
face prompt will appear on the screen.

3. Use the configure command and set the IPAddress, SubnetMask, and IPBroadcast
keywords in the IP Ethernet 0:0 section.

4. Use the save command to save the changes to the device’s Flash ROM.

5. Change th e host’s configuration back to its original settings.

See the next section (Setting Up Telnet Operation) for information on setting the server to
allow Telnet access from hosts on its network.

Chapter 5 - Command Line Management 21

Setting Up Telnet Operation

Telnet is a remote terminal communications protocol based on TCP/IP. With Telnet you can
log into and manage the IntraPort Enterprise-2 from anywhere on your IP internetwork,
including across the Internet if your security setup allows it. To manage the server with Telnet,
you must:

1. Run Telnet client software on your local computer, which will communicate with the
Telnet server built into the IntraPort Enterprise-2.

2. You must also set some bas ic IP paramet ers in the ser ver . The required parameters for
Telnet access to an interface are the IP address, IP subnet mask, and IP broadcast
address. There are several ways to set them.

•You may set them using text-based configuration either out-o f-b and v ia the Conso le interface
or in-band via a reconfigured IP host. Instructions for setting up these two methods were
given earlier in this chapter. Once you have set up the command line interface, do the fol­lowing:

A. Use the configure command and set the IPAddress, SubnetMask, and IPBroadcast

keywords in the IP Ethernet 0:0 section.

B. Use the save command to save the changes to the device’s Flash ROM.

•You may also use CompatiView from a reconfigured IP host (if using the IP transport proto­col), or anywhere on your network (if using the IPX transport protocol). Instructions for
these two methods are given in Chapter 4 - CompatiView Software Installation.

With CompatiView, basic IP parameters can be set using the TCP/IP Routing: Ethernet 0:0

Dialog Box. Use the Save to/Device option under the File menu to save the changes.

After you have set these IP parameters and saved the changes, you can use Telnet to access the
server from any node on your IP network. Invo ke t he Telnet client on your local ho st w ith the
IP address of the server you wish to manage.

Chapter 6 - Basic Configuration Guide 22

Chapter 6 - Basic Configuration Guide

This chapter briefly discusses the major parameters that must be set in order to use the
IntraPort Enterprise-2 VPN Access Server.

Detailed information on the meaning of the server’s parameters is provided in the Compati-

V iew Management Softwar e Refer ence Guid e and the Text-Based Conf iguratio n and Comma nd
Line Management Refer ence Guide . You should use this list as a starting point to look up more

specific information in the other documents.
There are a number of parameter settings which are optional, in the sense that they are not

required for all installations. These settings are not covered in this chapter.
In this chapter:

CV = CompatiView
TB = Text-Based Configuration

v

Note: This Basic Configuration Guide does not include information on setting up packet

filters. See the CompatiView Management Software Reference Guide or Text-Based Config-
uration and Command Line Management Reference Guide regard i ng IP, IPX and AppleTalk
packet filters for more information.

The IntraPort Enterprise-2 can be set up in two different ways. One is to configure it using both
Ethernet ports to operate in parallel with your existing firewall and serve as the IPSec comp o­nent of your security system. In this setup, Ethernet 0:0 serves as an IP, IPX and AppleTalk
router port, while Ethernet 1:0 receives and sends only IPSec packets. The other option is to
set up the server behind your firewall using Ethernet 0:0 only.

Ethernet Interface Confi guration

IP Settings for Dual-Ethernet Setups

If setting up the IntraPort 2/2+ in parallel with a firewall, you need to set some basic IP param­eters for the two Ethernet interfaces.

• IP address (default = 198.41.12.1)

• IP subnet mask (default = 255.255.255.0)

• IP broadcast address (default = 198.41.12.255)

• RIP 1, RIP 2, OSPF (Open Shortest Path First), or BGP (Border Gateway Protocol)

for Ethernet 0:0 only

• IPSec Gateway which is the equivalent of a default gateway for the IPSec interface
(Ethernet 1:0)

CV: Use the TCP/IP Routing: Ethernet 0:0 Dialog Box to set the IP address, subnet mask,

broadcast address and IP routing protocol for Ethernet 0:0. To set parameters for OSPF
or BGP, refer to the CompatiView Management Software Reference Guide.

Use the IP Connection Dialog Box to set address parameters for Ethernet 1:0. Ethernet
1:0 does not have any other settings available because it only handles IPSec traffic and
does not do routing.

Use the IPSec Gateway Dialog Box (under Global/IPSec Gateway) to set the IPSec
Gateway address. The IPSec Gateway must be on the same IP network as Ethernet 1:0.

TB: Use the configure command and set the IPAddress, SubnetMask and IPBroadcast

keywords, and either the RIPVersion keyword or the OSPFEnabled keyword, in the
IP Ethernet 0:0 section. To set additional parameters for OSPF or to configure BGP,
refer to the Text-Based Configuration and Command Line Management Reference
Guide.

Chapter 6 - Basic Configuration Guide 23

Use the configure command and set the IPAddress, SubnetMask and IPBroadcast
keywords in the IP Ethernet 1:0 section. No other keywords should be configured for
this section.

Use the configure command and set the IPSecGateway keyword in the General
section.

IP Settings for Single-Ethernet Setups

If setting up the IntraPort 2/2+ behind a firewall, you need to set some basic IP parameters for
Ethernet 0:0. Ethernet 1:0 is not used and should not be connected to anything.

• IP address (default = 198.41.12.1)

• IP subnet mask (default = 255.255.255.0)

• IP broadcast address (default = 198.41.12.255)

• RIP 1, RIP 2, OSPF (Open Shortest Path First), or BGP (Border Gateway Protocol)

for Ethernet 0:0 only

• IP gateway for Ethernet 0:0.

CV: Use the TCP/IP Routing: Ethernet 0:0 Dialog Box to set the IP address, subnet mask,

broadcast address and IP ro ut ing pro to col fo r Ethernet 0:0. To s et addit i onal p a rameters
for OSPF or to configure BGP, refer to the CompatiView Management Software Refer­ence Guide.

Use the IP Static Routing Dialog Box (under Global/IP Static Routes) to set an IP
gateway.

TB:Use the configure command and set the IPAddress, SubnetMask and IPBroadcast

keywords, and either the RIPVersion keyword or the OSPFEnabled keyword, in the
IP Ethernet 0:0 section. To set additional parameters for OSPF or to configure BGP,
refer to the Text-Based Configuration and Command Line Management Reference
Guide.

Use the edit config command and set an IP gateway, in the IP Static section.

v

Note: The gateway address would typically be an interface on a firewall. It must be on the

same TCP/IP network as Ethernet 0:0. With this setup, you must configure the firewall to
allow

:

•UDP port 500 (ISAKMP)

•Protocol number 51, which is the AH (Authentication Header) protocol packet type

- and/or -

•Protocol number 50, which is the ESP (Encapsulating Security Payload) protocol packet type

IPX Protocol

Required for IPX

Generally, there are no required changes from the shipping Ethernet configuration for IPX.
The Ethernet interface will autoconfigure to use the two most common IPX frame types, and
will automatically adapt to conditions on the Ethernet.

Suggested for IPX

You may want to set your ow n n etwo rk n umb ers , rat her than using the autoconfigured values.
You may also want to turn off unused frame types.

CV: Use the IPX Routing: Ethernet 0:0 Dialog Box.
TB: Use configure and set keywords in the IPX Ethernet 0:0 section.

Chapter 6 - Basic Configuration Guide 24

AppleTalk Protocol

Required for AppleTalk

Generally, there are no required changes from the shipping Ethernet configuration for Apple­Talk. The Ethernet interface will autoconfigure to use AppleTalk Phase 2, and will adapt to
conditions on the Ethernet.

Suggested for AppleTalk

You may want to set your ow n n etwo rk n umb ers , rat her than using the autoconfigured values.
You may also want to use more meaningful zone names.

CV: Use the AppleTalk Routing: Ethernet 0:0 Dialog Box.
TB: Use configure and set keywords in the AppleTalk Phase 2 Ethernet 0:0 section.

Configuring the Server for LAN-to-LAN Tunnels

Required for LAN-to-LAN Tunnel Configurations

LAN-to-LAN tunneling requires that you set parameters for a VPN port on each end of a
tunnel, so yo u must repeat this setup on the remote end.

• Partner IP address

• Bind To interface

CV: Add a VPN Port using the File menu and selecting VPN Port/Add VPN Port. Then use

the Tunnel Partner: VPN port number Dialog Box for the port(s) you created to set these
parameters.

TB: Use configure and set the Partner and BindTo keywords in the Tunnel Partner VPN

port number section.

Suggested for LAN-to-LAN Tunnel Configurations

It is recommended that you also set authentication and encryption parameters for each tunnel.
CV: Use the Tunnel Partner: VPN port number Dialog Box for the port you created to set

these parameters.

TB: Use configure and set keywords in the Tunnel Partner VPN port number section.

Configuring the Server for IP and IPX Client Tunnels

T o configure the IntraPort Enter prise-2 for IP and IPX client tunnels, each user must be enter ed
into the VPN user database or a RADIUS server database and assigned a tunnel configuration.

Required for Client Tunnel Configurations

These are the basic parameters for a tunnel configuration:

• Name of configuration

• Bind To port

• Local IP Net and/or Local IPX Network

• Reachable IP networks

CV: Use the VPN Group Configuration Dialog Box to create and name a tunnel configura-

tion. Use the General tab to set the Bind To port. Use the IP Connection tab to set the
Local IP Net and add IP network numbers and masks which will be reachable via the
tunnel configuration. Use the IPX Connection tab to set the Local IPX Network.

TB: Use the configure command and create and name a VPN Group Name section. Then

set the BindTo, LocalIPNet and/or LocalIPXNet, and IPNet keywords in that section.

v

Note: The IP network or subnet specified as the Local IP Netwo rk o r su bnet must not

conflict with networks specified in other VPN Group configurations/VPN Groups or with any
other IP address within the server.

Chapter 6 - Basic Configuration Guide 25

Suggested for Client Tunnel Configurations

You may want to add or change protection suites, set up filters for the tunnel, set a backup
device, etc.

CV: Use the IKE Configuration, IPX Filters, IP Filters and/or Rollover tabs in the VPN

Group Configuration Dialog Box.

TB: Use the configure command and set keywords in the VPN Group Name section.

VPN User Database

If you are using a RADIUS server for user authentication (either alone or through an
ACE/Server), you will need to set up VPN users on those servers. If not, then you must enter
the following information for each user into the VPN user database:

• User name

• Configuration name

• Shared key

CV: Use the VPN User Dialog Box.
TB: Use the edit config command and set parameters in the VPN Users section.

Setting up RADIUS Authentication

If you are using a RADIUS server for user authentication, you must set up the IntraPort Enter­prise-2 to communicate with a RADIUS server and also set some special parameters in the
RADIUS server itself

Setting the IntraPort Enterprise-2 for a RADIUS Server

Just a few basic settings are required for the IntraPort Enterprise-2 to communicate with a
RADIUS server:

• Primary server IP address

• Secret

• VPN password attribute number

• VPN group attribute number

CV: Use the RADIUS Configuration Dialog Box.
TB: Use the configure command and set the PrimAddress, Secret, VPNPassword and

VPNGroupInfo keywords in the RADIUS section.

RADIUS Server User Authentication Settings

In order for client authentication an d accounting to be do ne on a RADIUS server, the RADIUS
server must be configured with four pieces of data for each user.

• User name

• Login password

• Group configuration

• Tunnel secret

The user name is kept in the User-Name attribute in the RADIUS server and the login pass­word is kept in the Password attribute. The group configuration is kept in attribute number 77
of the RADIUS database, and the tunnel secret is kept in attribute number 69. These two
attribute numbers must be configured in the RADIUS server’s dictionary file.

The RADIUS server will also log the real IP address of the client and the IP address assigned
to the client by the IntraPort Enterprise-2 as it begins to account for the client.

To use this

feature, the two attribute numbers for these two IP address strings must also be configured in
the RADIUS server’s dictionary file and in the RADIUS section of the IntraPort’s configura­tion.

Chapter 6 - Basic Configuration Guide 26

The following is an example for a Livingston RADIUS server dictionary file:

ATTRIBUTEClient-Real-IP66 string
ATTRIBUTEClient-Assigned-IP67 string
ATTRIBUTEVPN-Password69 string
ATTRIBUTEVPN-GroupInfo77 string

The following is a sample RADIUS user database entry from a Livingston RADIUS server:

User-Name = corpauser
Password = "radiuslogin"
VPN-Password = "abc"
VPN-GroupInfo = "CorporateA"

After making and saving these changes, you must restart the RADIUS server in order for it to
recognize the new settings.

v

Note: Refer to the user manual for your RADIUS server for the exact format of dictionary

and user database entries.

v

Note: Although MacRADIUS servers offer a GUI, the custom attribute settings will require

that you enter users in the Users text file. See the user manual for your server for more infor­mation on exporting, editing and importing the Users text file.

In addition to the RADIUS server settings, the user name, login password and tunnel secret
must match the settings for each user in the User Properties window of the VPN Client. The
group configuration must match one of the VPN group configurations in the IntraPort Enter­prise-2’s configuration.

Setting up SecurID Authentication

If you are using Securi ty Dynamic’s ACE/Server software for user authentication, y ou must set
up the IntraPort Enterprise-2 to communicate with the ACE/Server.

The Security Dynamics ACE/Server software performs dynamic two-factor SecurID authenti­cation. Dynamic two-factor authentication combines something the user knows – a memo­rized personal identification number (PIN) – with something the user possesses – a SecurID
token which generates an unpredictable code every 60 seconds. This combination of PIN and
SecurID tokencode represents a one-time PASSCODE and is transmitted to the ACE/Server
software for verification. See Appendix C for information on how to obtain ACE/Server soft­ware and SecurID tokens.

To use ACE/Server software with the IntraPort Enterpris e-2, you will need th e following:

• ACE/Server software running on a supported platform (see the ACE/Server Installa­tion Guide or README document for a current list of ACE/Server-supported plat-

forms and other server requirements)

• The VPN Client software, which functions as an ACE/Agent, running on a supported
platform

• SecurID tokens, distributed to appropriate personnel who will use them to access the
ACE/Server-protected ACE Agents, including the VPN Client

Chapter 6 - Basic Configuration Guide 27

Setting the IntraPort Enterprise-2 for an ACE/Server

Just a few basic settings are required for the IntraPort Enterprise-2 to communicate with an
ACE/Server.

• SecurID on

• Encryption method

• ACE/Server IP address

• Enable SecurID for a group of IntraPort users

CV: Use the SecurID Configuration Dialog Box to turn on SecurID, set the encryption

method and set the ACE/Server IP address, then use the SecurID tab in the VPN Group
Configuration window to enable SecurID for a group of users.

TB: Use the configure command and set the Enabled, EncryptMeth and PrimaryServer

keywords in the SecurID section, then set the SecurIDRequired keyword in a VPN
Group Name section.

ACE/Server Settings

To configure the ACE/Server for communication with the IntraPort Enterprise-2, consult the
ACE/Server Installation Guide. You should consult the ACE/Server Administration Manual
on the ACE/Server CD-ROM for instru ctions on adding an d removing users in the ACE/Server
database .

v

Note: The IntraPort Enterprise-2 should be configured as a communication server in the

Client Type pull-down menu in the ACE/Server’s Add Client dialog box (under Client/Add
Client).

v

Note: The first time the IntraPort Enterprise-2 contacts the ACE/Server, they exchange a

secret based in part on the IntraPort’s IP address. After the first exchange, the Sent Node
Secret checkbox in the ACE/Server’s Add Client dialog box (which can be accessed using the
Add Client option under the Client menu) will be checked. The checkbox will be grayed out
until this initial exchange has taken place. Any major changes to the IntraPort Enterprise-2’s
configuration (such as changing its IP address) will mean that the IntraPort and the
ACE/Server will no longer be able to communicate. To get around this, simply uncheck the
Sent Node Secret checkbox on the ACE/Server and issue the reset securid secret command in
the IntraPort. Remember to save the changes to both devices. The two devices will do a new
secret exchange and will be able to communicate again.

Saving a Configuration File to Flash ROM

Once a configuration is complete, you can save it to the server’s Flash ROM. Until saved, all
changes are made in a separate buffer and the server’s interfaces continue to run as before the
changes were made.

CV: Use the Save to/Device option from the File menu.
TB: Use the save command.

Chapter 7 - Shipping Defaults 28

Chapter 7 - Shipping Defaults

Default Password

• letmein

Ethernet Interfaces

IP Defaults

• Ethernet 0:0 is on

• Address: 198.41.12.1

• Subnet mask: 255.255.255.0

• Broadcast address: 198.41.12.255

• Mode: Routed

• Ethernet 1:0 is off

IPX Defaults

• Ethernet 0:0 is on

• Mode: Routed

• 802.3 on, autoseeding

• 802.2 on, autoseeding

• Type II off

• 802.2 SNAP off

• Ethernet 1:0 is off

AppleTalk Defaults

• Ethernet 0:0 is on

• Mode: Routed

• Phase II on, autoseeding

• Ethernet 1:0 is off

Chapter 8 - LED Patterns and Test Switch Settings 29

Chapter 8 - LED Patterns and Test Switch Settings

IntraPort Enterpri se-2 LED Patterns

The IntraPort Enterprise-2 VPN Access Server uses a number of light patterns on its front LED
bars to indicate operating conditions.

v

Note: Any continuous flashing pattern not noted in this chapter may be caused by a hard-

ware failure. Please call Compatible Systems’ Technical Support if your server shows a hard­ware failure.

Over Temp

The server is above the proper operating temperature. The filter needs changi ng. See Appendix

D for instructions.

Sys Ready

The server booted properly without detecting any failures.

General Indicators

Ethernet Traffic Indicators

TX: Ethernet transmit packet
RX: Ethernet receive packet

Load % Indicators

These lights indicate the load on the DES card.

Ethernet Lights Load Lights Indication

5 flashing 20 flashing Server stacks starting up.

3&4 flashing 40&60 flashing No OS loaded. Running from ROM.

1&4 flashing 40&100 flashing Erasing OS in Flash ROM.

5 flashing 20,40&60 flashing Erasing config in Flash ROM.

Scanning from the outside toward the center Flash ROM erase due to switch setting five or six is

complete. Set switch to zero and cycle power.

Chapter 8 - LED Patterns and Test Switch Settings 30

IntraPort Enterprise-2 Switch Settings

M Caution: Settings marked with an asterisk may erase your Flash ROM. Please do not use
these settings without first contacting Compatible Systems’ Technical Support.

0 Normal Operation
1Unused*
2Unused*
3 Run Boot ROM Downloader
4Unused*
5 Erase Flash ROM (OS and Configuration)
6 Erase Flash ROM (Configuration Only)
7Unused*
8Unused*
9 Allow letmein password for 5 minutes after powerup

Appendix A - Connector and Cable Pin Outs 31

Appendix A - Connector and Cable Pin Outs

Pin Outs for DB-25 Male to DB-25 Female Console Cable

The cable supplied with the IntraPort Enterprise-2 is twenty-five conductors, straight through.
Connections on the console interface follow the standard RS-232C pin outs.

Appendix B - Downloading Software From Compatible Systems 32

Appendix B - Downloading Software From Compatible
Systems

The latest versions of operating software for all Compatible Systems products are available at
our Web site. The latest version of CompatiView management software is also available.

To download software, follow the instructions below:

1. Use your browser to access http://www.compatible.com/, and find the link on our
home page to “Software Downloads.”

2. Select the product and software version you wan t, and click on the app ropr ia te file to
download it.

v

Note: These files are also accessible directly via Anonymous FTP at

ftp.compatible.com/files/.

Appendix C - Security Dynamics ACE/Server Information 33

Appendix C - Security Dynamics ACE/Server Information

ACE/Server software and SecurID tokens can be purchased directly from Security Dynamics
Technologies, Inc. Use the following information to contact Security Dynamics for more
information:

Security Dynamics Technologies, Inc.
20 Crosby Drive
Bedford, MA 01730, U.S.A.
800-SECURID (800-732-8743 or 888-732-8743)
To telephone from outside the U.S.: 781-687-7000
E-mail: [e-mail]
Web site: http://www.securitydynamics.com

Appendix D - When the “Over Temp” Light Comes On 34

Appendix D - When the “Over Temp” Light Comes On

The Intraport Enterprise-2 is designed to operate reliably in a normal computer room, and
requires no special environmental control. If operating within its published temperature and
humidity specifications (0° to 45° C, up to 95% relative humidity, non-condensing, at 40° C)
in a normal computer room, no periodic maintenance is required. If, however, the “Over
Temp” light illuminates, it indicates that the internal circuitry is operating above its specified
temperature range. If this happens, perform the following check sequence:

1. V erify that the server is installed properly in an environment in which the air tempera­ture around the server is within the specified limits.

2. Verify that air flow to the front and left side of the s erv er (as v iewed fr om th e fro nt o f
the unit) is unrestricted.

3. If the above checks do not indicate a problem, it is probable that the air filter inside
the chassis is clogged and must be cleaned or replaced. Follow the procedure outlined
next to clean and replace the dust filter.

Appendix D - When the “Over Temp” Light Comes On 35

Replacing or Cleaning t he Intraport Enterprise-2 Air Filter

Under normal operation, the air filter do es not r equire period ic mainten ance. The filter should
be replaced only when an excessive amount of dirt and dust has collected over an extended
period of time. A replacement filter is supplied with the unit to minimize the unit’s down time
when the filter is replaced.

Before attempting to change or clean the filter, the unit must be removed from its mounting in
an equipment rack or on a wall. Changing or cleaning the filter is a simple process.

Figure 10. Removing the Chassis Cover and Filter

1. Remove the front three vertically aligned screws and the middle three horizontally
aligned screws from each side of the chassis, as illustrated in Figure 10.

2. Remove th e top panel from t he chassis.

3. Remove the filter from its slot.

4. Put the supplied replacement filter in the slot. The used filter may be washed in
warm, soapy water and used again once it is completely dry.

5. Replace the top panel.

6. Fasten the top to the chassis with the screws you removed in Step 1.

7. If the chassis was removed from an equipment rack, return it to its mounting, follow­ing the instructions as outlined in Chapter 2 - Mounting Instructions.

v

Note: If either of the supplied filters is worn out or cannot be thoroughly cleaned, you may

order a replacement filter from Compatible Systems Corporation at the number in the front of
this manual.

Appendix E - Terms and Conditions 36

Appendix E - Terms and Conditions

Compatible Systems Corporation (Comp a tible Systems) offers to sell only on the condition
that Customer’s acceptance is expressly limited to Compatible Systems’ terms an d conditions
of sale. Compatible Systems’ acceptance of any order from Customer is expressly made
conditional on assent to these terms and conditions of sale unless otherwise specifically agreed
to in writing by Compatible Systems. In the absence of such an agreement, commencement of
performance or delivery shall be for Customer ’s convenience only and shall not be construed
as an acceptance of Compatible Systems’ terms and conditions. If a contract is not earlier
formed by mutual agreement in writing, Customer’s acceptance of any goods or services shall
be deemed acceptance of the terms and conditions stated herein.

1. Warranty. Compatible Systems warrants to the Customer and to all persons who purchase
Products from the Cust om er during the Warranty terms (“subsequent purchasers”), that, for an
unlimited period from the date (the “shippi ng date”) on which Compatible Systems ships the
Products to the Customer: (a) the Product meets, in all material res pects, all specifications
published by Compatible Systems for such Products as of the shipping date; (b) the Products
are free from all material defects in materials and workmanship under normal use and service;
and (c) that as a result of the purchas e of the Prod ucts from C ompatible Systems, the Customer
will have good title to the Products, free and clear of all liens and encumbrances.

Compatible Systems’ obligations pursuant to this Warranty, and the sole remedies of the
Customer and of any subsequent purchaser, shall be limited to the repair or replacement, in
Compatible Systems’ sole discretion, of any of the Products that do not conform to this
Warranty.

This W arr anty shall be invalidated if the Products (a) have not been installed, handled, or used
in accordance with Compatible Systems’ recommended procedures; (b) have been damaged
through the negligence or abuse of the Customer or of any subsequent purchasers; (c) are
damaged by causes external to the Products, including (without limitation) shipping damage,
power or air conditioning failure, or accident or catastrophe of any nature; and (d) have been
subjected to repairs or attempted repairs by any person other than Compatible Systems (or an
authorized Compatible Systems service technician).

To obtain service under this Warranty, the Customer (or subsequent purchaser, if applicable)
must follow the procedures outlined below, under “Product Return Policy.”

THE WARRANTIES SET FORTH IN THESE TERMS AND CONDITIONS ARE IN LIEU
OF ALL OTHER WARRANTIES, EXPRESSED OR IMPLIED. WITHOUT LIMITATION
ON THE GENERALITY OF THE FOREGOING SENTENCE, COMPATIBLE SYSTEMS
EXPRESSLY DISCLAIMS AND EXCLUDES ALL IMPLIED WARRANTIES OF
MERCHANTIBILITY AND OF FITNESS (GENERALLY OR FOR A PARTICULAR
PURPOSE).

2. Shipments. All delivery indications are estimated and are dependent in part upon prompt
receipt of all necessary information to service an order . Comp atible Systems shall not be liable
for any premium transportation or other costs or losses incurred by Customer as a result of
Compatible Systems’ inability to deliver Product in accordance with Customer’s requeste d
delivery dates. All shipments by Compatible Systems are made F.O.B. factory (Boulder,
Colorado); risk of loss shall pass to Customer at point of shipment. Unless specified by the
Customer, Compatible Systems will select the mode of transportation for each order.
Compatible Systems reserves the right to make deliv eri e s in installments. Partial shipments
are subject to the terms of payment noted below. Compatible Systems reserves the right to
allocate inventory and production if such allocation becomes necessary.

Appendix E - Terms and Conditions 37

3. Payment Terms. Payment shall be made prior to shipment or upon delivery, unless
otherwise agreed to in writing. Payment shall not constitute acceptance of the goods.

4. Force Majeure. All orders accepted by Compatible Systems are subject to postpo nement or
cancellation for any cause beyond the reasonable control of Compatible Systems, including
without limitation: inability to obtain necessary materials and components; strikes, labor
disturbances, and other unavailability of workers; fire, flood, and other acts of God; war, riot,
civil insurrection, and other disturbances; production or engineering difficulties; and
governmental regulations, orders, directives, and restrictions.

5. Product Return Policy. Prior to shipping any Product to Compatible Systems, the Customer
must contact Compatible Systems Technical Support (by letter or telephone) with the
following information: (a) reason for return; (b) quantity, description, and model number, and
(if applicable) serial number of each item being returned; (c) original Compatible Systems
Sales Agreement number; and (d) any special instructions. Upon receipt of this information,
Compatible Systems will issue an RMA (“Return Material Authorization”) number and any
required U.S. Customs identification to assure correct identification of the Customer and to
insure prompt and accurate processing.

6. Limitation of Remedies. Compatible Systems’ liability for all claims brought pursuant to or
in connection with this agreement, including the purported breach hereof , shall be limited: (a)
in the case of claims for breach of warranty, to compliance with the repair or replacement
provisions of the warranty, and (b) in all other cases (including any claim that the warranty
failed of its essential purpose), to actual damages of the Customer (or, if appropriate, of the
subsequent purchaser). IN NO EVENT SHALL COMPATIBLE SYSTEMS BE LIABLE
FOR ANY SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES ARISING OUT
OF THE SALE, USE, INSTALLATION OR OPERATION OF THE PRODUCTS,
WHETHER A CLAIM IS BASED ON STRICT LIABILITY, BREACH OF WARRANTY,
NEGLIGENCE, OR ANY OTHER CAUSE WHATSOEVER, WHETHER OR NOT
SIMILAR. This limitation on remedies shall apply even if Compatibl e Systems is advised of
the possibility and nature of any special, consequential, or incidental damages .

7. Governing Law; Merger. This agreement and all Terms and Conditions hereof shall be
governed by, and construed in accordance with the internal laws of the State of Colorado.
Except as superseded by a separate written contract signed by both Compatible Systems and
the Customer, superseding all prior negotiations or offers, written or oral, this agreement may
be amended only in writing, signed by an authorized officer of Compatible Systems.