While the information in this manual has been compiled with great care, it may not be deemed an assurance of product
characteristics. LANCOM Systems shall be liable only to the degree specified in the terms of sale and delivery.
The reproduction and distribution of the documentation and software included with this product is subject to written permission by LANCOM Systems. We reserve the right to make any alterations that arise as the result of technical development.
Trademarks
Windows
®
, Windows XP® and Microsoft® are registered trademarks of Microsoft, Corp.
The LANCOM Systems logo and the name LANCOM are registered trademarks of LANCOM Systems GmbH. All other names
mentioned may be trademarks or registered trademarks of their respective owners.
Subject to change without notice. No liability for technical errors or omissions.
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit http://www.openssl.org/
With the LANCOM router, you have chosen a powerful router that lets you
easily and conveniently provide individual computers or an entire local network with high-speed Internet access. Dial-in connections and LAN to LAN
couplings can be realized depending on the LANCOM model via ISDN or VPN.
Model variants
This user manual applies to the following models of the LANCOM router which
are different in hard and software equipment:
The sections of the documentation that refer only to a range of models are
marked either in the corresponding text itself or with appropriate comments
placed beside the text.
In the other parts of the documentation, all described models have been classified under the general term LANCOM router.
EN
Security settings
For a carefree use of your device, we recommend to carry out all security settings (e.g. Firewall, encryption, access protection, charge lock), which are not
already activated at the time of purchase of your device. The LANconfig wizard
’Check Security Settings’ will support you accomplishing this. Further information regarding this topic can be found in chapter ’Security settings’
→page 66.
We ask you additionally to inform you about technical developments and
actual hints to your product on our Web page www.lancom.de
, and to down-
load new software versions if necessary.
User manual and reference manual
The documentation of your device consists of two parts: the user manual and
the reference manual.
You are now reading the user manual. It contains all information you need to
start your LANCOM router. It also contains the most important technical specification for the device.
The reference manual can be found on the CD as an Acrobat (PDF) document.
It is designed as a supplement to the user manual and goes into detail on topics that apply to a variety of devices. These include for example:
Systems design of the LCOS operating system
Configuration
Management
Diagnosis
EN
Security
Routing and WAN functions
Firewall
Quality of Service (QoS)
Virtual Private Networks (VPN)
Virtual Local Networks (VLAN)
Wireless networks (WLAN)
LANCAPI
Further server services (DHCP, DNS, charge management)
This documentation was compiled …
...by several members of our staff from a variety of departments in order to
ensure you the best possible support when using your LANCOM product.
In case you encounter any errors, or just want to issue critics or enhancements, please do not hesitate to send an email directly to:
info@lancom.de
Our online services ( www.lancom.de) are available to you around the
clock should you have any queries regarding the topics discussed in
this manual or require any further support. In addition support from
LANCOM Systems is also available to you. Telephone numbers and
The models LANCOM 800+, LANCOM DSL/I-10+ and LANCOM DSL/I-1611
Office are fully-featured routers that therefore also can be used in combination with the integrated firewall for providing secure Internet access to a complete local network (LAN).
The VPN option, which is either integrated already or can be activated subsequently, enables the LANCOM DSL/I-1611 Office to act as powerful dynamic
VPN gateway for external offices or mobile users.
The LANCOM router models offer each an ISDN connector and partially an DSL
connector (LANCOM DSL/I-10+ and LANCOM DSL/I-1611 Office). The ISDN
line can be used as back-up for the DSL connection (LANCOM DSL/I-10+ and
LANCOM DSL/I-1611 Office), for remote management of the router, as basis
for the office communication via LANCAPI or for establishing dynamic VPN
connections to remote sites with dynamic IP addresses (LANCOM DSL/I-1611
Office only).
EN
1.1How does DSL work?
Since the late 1980s, scientists have been working on the idea of using conventional telephone lines for video and multimedia applications.
High speed via standard telephone lines
Their approach was based on the use of telephone lines only for the distance
between the subscriber and the next local exchange. From the switching
center, the data is then transferred via high-speed connections to the desired
destination or target network (i.e. the Internet). This minimization of the telephone line distance used permits considerably higher transfer rates than
would be possible when relying solely on the telephone network.
All DSL technologies, of which ADSL is the most common, are based on this
concept. Thanks to their high transfer speeds, DSL connections are well-suited
for Internet access.
Ideal for Internet surfers
The ADSL version of DSL was designed for applications in which the user
receives high volumes of data but only transmits relatively small volumes. A
typical example for this would be access to the world wide web (www). Only
EN
a few commands (mouse clicks) are required to initiate the download of very
large volumes of data such as graphics, texts, audio or video files. The user
typically only sends very small amounts of data across the Internet connection.
With an ADSL connection, a user can download at up to 8 Mbps (“downstream”) and upload at up to 800 Kbps (“upstream”). These maximum rates
can be reduced as required by the ADSL provider. A typical access plan might
specify, for example, between 1000 and 3000 Kbps download and 128 up to
384 Kbps upload speed.
All services via a single cable—thanks to the splitter
With ADSL, all traditional telephony applications (telephone, fax, answering
machine, PBX) can still be used without restrictions. So-called splitters make
this possible. Splitters are devices that separate the telephone line's “voice
frequencies” from the “data frequencies” and ensure that the signals are forwarded to the appropriate networks. Voice signals are passed on to the existing telephone network, while data signals are forwarded to their destinations
(i.e. Internet providers) via high-bandwidth network connections.
A splitter is also used at the subscriber end to permit ADSL modems/routers
and conventional telephone equipment to be used at the same time.
In some models the ADSL modem is integrated directly in the router.LANCOM
800+, LANCOM DSL/I-1611 Office or LANCOM DSL/I-10+ are connected to
the splitter using a separate ADSL modem.
Telephone
network
Internet
Switching node
Splitter
DSL access
multiplexer
ADSL provider
LANCOM 800+, LANCOM DSL/I-1611 Office or LANCOM DSL/I-10+
can also utilize other broadband connections (e.g. cable modem) that
offer a 10/100Base-Tx- Ethernet connector over PPPoE, PPTP or plain
Ethernet (with or without DHCP).
1.2Which use does VPN offer?
Splitter
ADSL
modem
Tele phone
EN
Router
Subscriber
For LANCOM DSL/I1611 Office only
A VPN (Virtual Private Network) can be used to set up cost-effective, public
IP networks, for example via the ultimate network: the Internet.
The model LANCOM DSL/I-1611 Office from LCOS-Version 3.32
upwards is equipped with 5 channels by default. The additional
LANCOM VPN Option can extend VPN support to 25 active tunnels.
While this may sound unspectacular at first, in practice it has profound effects.
To illustrate this, let's first look at a typical corporate network without VPN
technology. In the second step, we will see how this network can be optimized
by the deployment of VPN.
First, let's have a look at a typical network structure that can be found in this
form or similar forms in many companies:
EN
Head Office
LAN
LAN
Subsidiary
ISDNISDN
Workstation in
remote access,
e.g. homework
Internet
The corporate network is based on the internal network (LAN) in the headquarters. This LAN is connected to the outside world in three ways:
A subsidiary is connected to the LAN, typically using a leased line.
PCs dial into the central network via modem or ISDN connections (Remote
Access Service – RAS).
The central LAN has a connection to the Internet so that its users can
access the Web, and send and receive e-mail.
All connections to the outside world are based on dedicated lines, i.e.
switched or leased lines. Dedicated lines are very reliable and secure. On the
other hand, they involve high costs. In general, the costs for dedicated lines
are dependent on the distance. Especially in the case of long-distance connections, keeping an eye out of cost-effective alternatives can be worthwhile.
The appropriate hardware must be available in the headquarters for every
type of required connection (analog dial-up, ISDN, leased lines). In addition
to the original investment costs, ongoing costs are also incurred for the
administration and maintenance of this equipment.
Networking via the Internet
The following structure results when using the Internet instead of direct connections :
LAN
Head Office
LAN
Subsidiary
Internet
Workstation in remote
access
All participants have fixed or dial-up connections to the Internet. Expensive
dedicated lines are no longer needed.
All that is required is the Internet connection of the LAN in the headquar-
ters. Special switching devices or routers for dedicated lines to individual
participants are superfluous.
EN
The subsidiary also has its own connection to the Internet.
The RAS PCs connect to the headquarters LAN via the Internet.
The Internet is available virtually everywhere and typically has low access
costs. Significant savings can thus be achieved in relation to switched or dedicated connections, especially over long distances.
The physical connection no longer exists directly between two participants;
instead, the participants rely on their connection to the Internet. The access
technology used is not relevant in this case: ideally is the use of broadband
technologies such as DSL (Digital Subscriber Line). But also a conventional
ISDN line can be used.
The technologies of the individual participants do not have to be compatible
to one another, as would be the case for conventional direct connections. A
single Internet access can be used to establish multiple simultaneous logical
connections to a variety of remote stations.
The resulting savings and high flexibility makes the Internet (or any other IP
EN
network) an outstanding backbone for a corporate network.
1.3Firewall
The integrated Stateful Inspection Firewall ensures an effective protection
against undesired intrusion in your network by permitting only incoming data
traffic as reaction to outgoing data traffic. The router’s IP masquerading function hides all workstations of the LAN behind a single public IP address. The
actual identities (IP addresses) of the individual workstations remain concealed. Firewall filters of the router permit specific IP addresses, protocols and
ports to be blocked. With MAC address filters it is also possible to specifically
monitor the access of workstations in the LAN to the IP routing function of the
device.
LAN
Internet
Firewall
LANCOM
Further important features of the Firewall are
Intrusion Detection
Break-in attempts into the local network or on the central Firewall are recognized, repelled and logged by the Intrusion Detection system (IDS) of
the LANCOM router. Thereby it can be selected between logging within
the device, email notification, SNMP trap or SYSLOG alarms.
Attacks from the Internet can be break- in attempts as well as attacks with
the aim of blocking the accessibility and functionality of individual
services. Therefore a LANCOM router is equipped with appropriate protective mechanisms, which recognize well-known hacker attacks and which
guarantee the functionality.
Quality-of-Service / Traffic management
The generic term Quality-of-Service (brief: QoS) summarizes the functions
of the LANCOM which guarantee certain service qualities. The advantage
is that the QoS functions can take place by means of the existing powerful
classification methods of the Firewall (e.g. limitation of subnetworks,
single workstations or certain services).
Guaranteed minimum bandwidths give priority to enterprise critical applications, VoIP PBX installations or certain user groups.
EN
More details about the function of the Stateful Inspection Firewall of
your LANCOM router can be found in the reference manual on the
LANCOM CD.
1.4What does a router do?
The following sections describe the functionality of routers in general.
The functions supported by your device are listed in the table ’What
can your LANCOM router do?’ →page 17.
Routers connect LANs at different locations and individual PCs to form a Wide
Area Network (WAN). With the appropriate rights, any computer in this WAN
can access other computers and services of the complete WAN (as with 'PC 1'
accessing 'Server A' in the remote LAN in the diagram).
Connecting a LAN to the Internet does not technically differ from coupling two
LANs. The only difference is that it is not just a handful of computers behind
the Internet provider's router. Instead, it is the net of the networks - the public
Internet.
1.4.1Bridgehead to the WAN
All routers have at least two connections:
EN
at least one for the LAN
at least one for WAN connections
In addition to LAN connectivity (10/100 Mbps Ethernet), several models also
offer an integrated switch. For the connecting to the WAN, the routers use
ISDN, xDSL/cable or ADSL connectors. Several devices contain additionally a
wireless network card and can thus integrate also stations of WLANs (Wireless
LANs) into the routing.
The router's task is to transfer data from the local network to the target network via a suitable WAN connection. Data is also transferred from the WAN
to the desired recipients in the LAN.
1.4.2Areas of deployment for routers
Routers are mainly used for the following applications:
Internet access for a LAN (e.g. via DSL or ISDN)
The Internet consists of countless large and small networks that are interconnected into the world's largest WAN via routers. The router links all the
workstation computers on your local area network to the global Internet.
Security functions such as IP masquerading protect your LAN against
unauthorized access from outside.
LAN to LAN coupling (via VPN or ISDN)
LAN to LAN coupling links individual LANs to form one large network,
even if this means crossing continents. A typical example: A branch office
is to be connected to the LAN of the headquarters. In principle, you can
connect LANs in two ways:
Not possible with
all LANCOM
devices.
High-speed coupling via VPN
16
The fastest and most economical LAN to LAN links are possible with
VPN (Virtual Private Network) technology, as VPN uses the Internet as
the basis for its communications. The fast xDSL connection of the
router comes into its own here. The precondition: a VPN gateway with
access to the Internet is required on either side of the network interconnection.
VPN tunnel via the
Internet
VPN gateways
Conventional via ISDN
Without VPN, a LAN to LAN interconnection can alternatively be realized via ISDN. In this case, an intelligent line management and
sophisticated filter mechanisms keeps connection costs low.
EN
1.5What can your LANCOM router do?
Applications
Remote access to the company network (via VPN or ISDN)
The work of many office workers in modern organizations is less and less
dependent on any definite location—the most important factor here is
unimpaired access to shared and freely available information.
Remote Access Service (RAS) is the magic word here. Employees working
from home or field staff can dial into the company network via VPN or
ISDN. When working with remote access via ISDN, the router protects the
company network: the call back function only grants access to known and
registered users.
The following table contains a direct comparison of the properties and functions of your devices with other models:
IPX router (via ISDN), e.g. for coupling of Novell networks or dialling into
Novell networks
NetBIOS proxy for coupling of Microsoft peer-to-peer networks via ISDN
DHCP and DNS server (for LAN and WAN)
800+
LANCOM
LANCOM
DSL/I-10+
I-1611 Office
LANCOM DSL/
N:N mapping for routing networks using the same IP address ranges via
VPN
Bridge function for coupling networks via ISDN connection
LANCAPI server for the operating with office applications as fax or
answering machine via ISDN interface
WAN connection
Connection for DSL or cable modem
ISDN S0 bus in multi device-mode or in point-to-point mode with automatic D-channel protocol identification. Supports static and dynamic
channel bundling per MLPPP and BACP as well as Stac data compression
(Hi/fn) and can be used for establishing dynamic VPN connections to
remote sites with dynamic IP addresses (LANCOM DSL/I-1611 Office
only).
LAN connection
Integrated 3-port auto- mode-switch (10/100 Mbps) with private mode,
whereby the ports are concealed from one another.
Fast Ethernet LAN port
Security functions
IPSec encryption in external software (VPN client)
IP masquerading (NAT, PAT) to hide all workstations of the LAN behind
one common public IP address.
Stateful Inspection Firewall
Firewall filters for a selective locking of IP addresses, protocols and ports
MAC address filter control e.g. the access of LAN workstations to IP routing functions
Configuration protection to block “brute force attacks“
Configuration
Configuration with LANconfig or with web browser, additionally terminal
mode for Telnet or other terminal programs, SNMP interface and TFTP
server function.
Remote configuration via ISDN (with ISDN-PPP connections e.g. via Windows network and dial-up connections)
Serial configuration interface
Chapter 1: Introduction
800+
LANCOM
LANCOM
DSL/I-10+
I-1611 Office
LANCOM DSL/
EN
Callback function with PPP authentication mechanisms for restriction to
fixed ISDN telephone numbers
FirmSafe with firmware versions for absolutely secure software upgrades
Optional software extensions
ISDN leased line option
LANCOM VPN Option with 25 active tunnels for protection of network
couplings
LANCOM Service Option with 25 active tunnels for protection of network
couplings
This chapter will assist you to quickly install hardware and software. First,
check the package contents and system requirements. The device can be
installed and configured quickly and easily if all prerequisites are fulfilled.
2.1Package contents
EN
Please check the package contents for completeness before starting the
installation. In addition to the device itself, the package should contain the
following accessories:
800+
LANCOM
Power adapter
LAN connector cable (green plugs)
WAN connector cable (dark blue plugs)
ISDN connector cable (light blue plugs)
Connector cable for the configuration interface
LANCOM CD
Printed documentation
LANCOM
DSL/I-10+
I-1611 Office
LANCOM DSL/
If anything is missing, please contact your retailer or the address stated on the
delivery slip of the unit.
2.2System preconditions
Computers that connect to a LANCOM router must meet the following minimum requirements:
Operating system that supports TCP/IP, e.g. Windows XP, Windows Mil-
lennium Edition (Me), Windows 2000, Windows 98, Windows 95, Windows NT, Linux, BSD Unix, Apple Mac OS, OS/2, BeOS.
The LANtools and the LANCAPI functions also require a Windows
operating system. A web browser is required for access to WEBconfig.
2.3Introducing the LANCOM router
This section introduces your device. We will give you an overview of all status
displays, connections and switches.
While the information in this section is useful for the installation of the
device, it is not absolutely essential. You may therefore skip this section for the time being and go straight forward to ’Hardware installation’ →page 28.
Chapter 2: Installation
EN
2.3.1Status displays
The front and the rear panels (LANCOM DSL/I-10+) of the unit feature a series
The various LANCOM router models have different numbers of indicators on
the front panel depending on their functionality.
Meanings of the LEDs
In the following sections we will use different terms to describe the behaviour
of the LEDs:
Blinking means, that the LED is switched on or off at regular intervals in
the respective indicated colour.
Flashing means, that the LED lights up very briefly in the respective col-
our and stay then clearly longer (approximately 10x longer) switched off.
Inverse flashing means the opposite. The LED lights permanently in the
respective colour and is only briefly interrupted.
Flickering means, that the LED is switched on and off in irregular inter-
This LED flashes once when powering-up your device. After the self-test either
an error is indicated by a flashing, or the device starts and the LED lights constantly.
offDevice off
redflashing
once
redblinkingConstant flashing indicates time or charge limit exceeded.
redDevice is ready for use
Indicates the status of the ISDN-S
offnot connected or no S0 voltage (many ISDN connections dis-
greenblinkinginitializing (establishing contact with the connection point)
Self-test when powering up
Other flashing types indicate boot errors
connection:
0
able the S
voltage after a certain, inactive time)
0
greenready for use
greenPower offLED on, but Power-LED off: device in boot monitoring
ISDN Chan1
Status of the first logical ISDN B channel (in router as well as in CAPI operation):
offno connection established
red blinkingincoming call
greenblinkingoutgoing call
22
(S
bus activated, TEI existing and D channel protocol checked)
green/redshort red flashesindication of received data packets
ISDN Chan2
ISDN-1+2
WAN- Rx/Tx
WAN- Link
WAN- Chan
Status of the second logical ISDN B channel (meaning see ISDN Chan1)
Indicates, whether the actual ISDN connection is a static or a dynamic channel
bundling.
offno bundled connection active
greenstatic or dynamic channel bundling connection active
This yellow LED indicates the data transfer via the WAN connection (via DSL
or cable modem).
This green LED indicates that the Ethernet connection between LANCOM
router and the DSL resp. cable modem is operational.
This LED indicates the status of the WAN connection (via DSL or cable modem)
to the provider. The connection to the provider normally requires a login with
username and password. With time-dependent connecting rates arise
charges during this time. The meanings of the LED in detail:
offno active connection
EN
LAN-Rx/Tx
LAN-Coll
LAN-Link
LAN-Fast
Security-VPN
redestablishing connection (login)
greenConnection established (login successful)
Data packet from the device to the LAN or from the LAN sent to the device
Sending collision
The connection to the LAN is established and ready for use
The LAN speed is 100 Mbps
In VPN gateway operation, the LED provides the VPN status information:
This LED indicates that the device is operational. After the device has been
switched on, it will flash green for the duration of the self-test. After the selftest, either an error is output by a flashing red light code or the device starts
and the LED remains lit green.
offDevice off
greenblinkingSelf-test when powering up
greenconstantly onDevice ready for use
red/
green
redblinkingTime or connect-charge reached
blinking alternatelyDevice insecure: configuration password not assigned
The power LED flashes red/green in alternation until a configuration
password has been specified. Without a configuration password, the
configuration data of the LANCOM is insecure. Under normal circumstances, you would assign a configuration password during the basic
configuration (see instructions in the following chapter). For information about a later assignment of the configuration password see the
section ’Security settings’ →page 66.
Online
The Online LED indicates the overall status of all WAN ports:
offNo active connection
greenflashingEstablishing first connection
greeninverse flashingEstablishing further connection
greenconstantly onAt least one connection established
redconstantly onError establishing the previous connection
24
Loading...
+ 56 hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.