Compliance Information ................................................................................................................................ 5
Radio and TV Interference ...............................................................................................................................5
CE Notice .........................................................................................................................................................5
FCC Part 68 .....................................................................................................................................................5
Industry Canada Notice ....................................................................................................................................6
Service ..............................................................................................................................................................6
About this guide ............................................................................................................................................. 7
Typographical conventions used in this document.................................................................................................. 9
General conventions .........................................................................................................................................9
1 General Information...................................................................................................................................... 11
Model 3201/3241 G.SHDSL Router Modem overview ........................................................................................12
General attributes ............................................................................................................................................12
G.SHDSL Characteristics (Models 3201 and 3241) .......................................................................................12
Protocol support .............................................................................................................................................13
PPP Support ...................................................................................................................................................13
Front Panel Status LEDs .......................................................................................................................................14
Rear panel connectors and switches .................................................................................................................14
Power input connector ....................................................................................................................................15
External AC universal power supply ..........................................................................................................15
External 48 VDC power supply ................................................................................................................15
Console port (outlined in red) .........................................................................................................................16
Ethernet port (outlined in green) ....................................................................................................................16
Line port (outlined in yellow) .........................................................................................................................16
Model 3201 G.SHDSL Integrated Access Device User Guide
What you will need .........................................................................................................................................22
Identify the connectors and attach the cables ..................................................................................................22
IP address Quick Start modification ................................................................................................................23
Router/Bridge Status LEDs .......................................................................................................................24
Web Operation and Configuration .................................................................................................................24
PC Configuration .....................................................................................................................................24
Web Browser .............................................................................................................................................24
Two stand-alone units directly connected..............................................................................................................29
IP Configurations..................................................................................................................................................80
DHCP Server and Relay .................................................................................................................................81
Configuring the router ..........................................................................................................................................86
Configuring the security interfaces.........................................................................................................................87
Deleting a Firewall Policy ...............................................................................................................................88
Enabling the Firewall.............................................................................................................................................89
Intrusion Detection System (IDS) .........................................................................................................................91
Creating an Ethernet Transport.............................................................................................................................96
Creating a DSL Link .............................................................................................................................................96
Central Side Configuration .............................................................................................................................97
Remote Side Configuration .............................................................................................................................97
Creating an ATM Routable Link...........................................................................................................................98
2
3
Model 3201 G.SHDSL Integrated Access Device User Guide
Contents
Remote side configuration ..............................................................................................................................98
Central side configuration ...............................................................................................................................98
Creating a route for Remote and Central PCs........................................................................................................99
Remote side configuration ..............................................................................................................................99
Central side configuration ...............................................................................................................................99
8 Monitoring Status ....................................................................................................................................... 103
Status LEDs.........................................................................................................................................................104
9 Diagnostics and Software Upgrades ............................................................................................................ 105
Out-of-warranty service ...........................................................................................................................110
Returns for credit ....................................................................................................................................110
Return for credit policy ...........................................................................................................................111
A Specifications .............................................................................................................................................. 113
General Characteristics ........................................................................................................................................114
Protocol Support .................................................................................................................................................115
Compliance Standard Requirements....................................................................................................................116
Australia Specific .....................................................................................................................................116
Power and Power Supply Specifications...............................................................................................................117
B Cable Recommendations ............................................................................................................................ 119
C Physical Connectors ................................................................................................................................... 121
Model 3201 G.SHDSL Integrated Access Device User Guide
RJ-11 non-shielded port ......................................................................................................................................122
RJ-45 non-shielded RS-232 console port (EIA-561)............................................................................................122
Power input.........................................................................................................................................................122
D Command Line Interface (CLI) Operation ................................................................................................ 123
Local (VT-100 emulation) ............................................................................................................................124
Using the Console .........................................................................................................................................125
Administering user accounts................................................................................................................................126
Adding new users ..........................................................................................................................................126
Setting user passwords ...................................................................................................................................127
Changing user settings ..................................................................................................................................127
Controlling user access ............................................................................................................................128
To establish the DSL link ........................................................................................................................128
4
1.
Compliance Information
and TV
Radio
The Model 3201 or 3241 generates and uses radio frequency energy, and if not installed and used properlythat is, in strict accordance with the manufacturer’s instructions-may cause interference to radio and television
reception. The Models 3201 and 3241 have been tested and found to comply with the limits for a Class A
computing device in accordance with specifications in Subpart B of Part 15 of FCC rules, which are designed
to provide reasonable protection from such interference in a commercial installation. However, there is no
guarantee that interference will not occur in a particular installation. If the Model 3201 or 3241 does cause
interference to radio or television reception, which can be determined by disconnecting the unit, the user is
encouraged to try to correct the interference by one or more of the following measures: moving the computing
equipment away from the receiver, re-orienting the receiving antenna and/or plugging the receiving equipment
into a different AC outlet (such that the computing equipment and receiver are on different branches).
CE Notice
The CE symbol on your Patton Electronics equipment indicates that it is in compliance with the Electromagnetic Compatibility (EMC) directive and the Low Voltage Directive (LVD) of the European Union (EU). A
Certificate of Compliance is available by contacting Technical Support.
FCC Part 68
Interference
The Model 3201 is not intended to be connected to the public
telephone network.
You are required to request service from the telephone company before you connect the Model 3201 or
3241 to a network. When you request service, you must provide the telephone company with the following data.
— The required Universal Service Order code (USOC) jack: RJ-11C
— The make, model number, Ringer Equivalence Number (REN), and FCC Registration number of the
Model 3201 or 3241.
The REN helps you determine the number of devices you can connect to your telephone line and still have
all of those devices ring when your number is called. In most, but not all, areas, the sum of the RENs of all
devices should not exceed five (5.0). To be certain of the number of devices you can connect to your line,
you should call your local telephone company to determine the maximum REN.
— The Facility Interface Code: 02LS2
— The Service Order Code(s) (SOC): 9.0F
— REN No.: 0.2
2. Your telephone company may make changes to its facilities, equipment, operations, or procedures that
could affect the proper functioning of your equipment. The telephone company will notify in advance of
such changes to give you an opportunity to maintain uninterrupted telephone service.
5
4.
5.
3.
Compliance Information
Model 3201 G.SHDSL Integrated Access Device User Guide
If your Model 3201 or 3241 causes harm to the telephone network, the telephone company may temporarily discontinue your service. If possible, they will notify you in advance, but if advance notice is not
practical, you will be notified as soon as possible and will be informed of your right to file a complaint with
the FCC.
If you experience trouble with the Model 3201 or 3241, please contact Patton Electronics Company for
service or repairs. Repairs should be performed only by Patton Electronics Co.
You are required to notify the telephone company when you disconnect the Model 3201 or 3241 from the
network.
Industry Canada Notice
Note
This equipment meets the applicable Industry Canada Terminal
Equipment Technical Specifications. This is confirmed by the registration number. The abbreviation, IC , before the registration number
signifies that registration was performed based on a Declaration of
conformity indicating that Industry Canada technical specifications
were met. It does not imply that Industry Canada approved the
equipment.
Service
All warranty and non-warranty repairs must be returned freight prepaid and insured to Patton Electronics. All
returns must have a Return Materials Authorization number on the outside of the shipping container. This
number may be obtained from Patton Electronics Technical Services at:
• Tel: +1 (301) 975-1007
• Email: support@patton.com
• URL: http://www.patton.com
Note
Packages received without an RMA number will not be accepted.
6
About this guide
This guide describes installing and configuring a Patton Electronics Model 3201 or 3241 G.SHDSL Router
modem. The instructions in this guide are based on the following assumptions:
• The router modem will connect to another router modem or DSLAM
• There is a LAN connected to the Ethernet port of the router modem
• Users will be connected to remote router modems
Audience
This guide is intended for the following users:
• Operators
• Installers
• Maintenance technicians
Structure
This guide contains the following chapters and appendices:
• Chapter 1 provides information about router modem features and capabilities
• Chapter 2 contains an overview describing router modem operation
• Chapter 4 describes configuring the router modem for typical applications
• Chapter 5 describes configuring the router modem for specialized applications
• Chapter 6 describes configuring security for the router modem
• Chapter 7 describes configuring for network address translation (NAT)
• Chapter 8 contains definitions for the LED status indicators
• Chapter 9 describes router modem diagnostics
• Appendix A contains specifications for the router modems
• Appendix B provides cable recommendations
• Appendix C describes the router modem’s ports
• Appendix D describes how to use the command line interface (CLI)
For best results, read the contents of this guide before you install the router modem.
7
About this guide
Model 3201 G.SHDSL Integrated Access Device User Guide
Precautions
Notes and cautions, which have the following meanings, are used throughout this guide to help you become
aware of potential Router modem problems. Warnings relate to personal injury issues, and Cautions refer to
potential property damage.
Note
Calls attention to important information.
The shock hazard symbol and WARNING heading indicate a potential electric
shock hazard. Strictly follow the warning instructions to avoid injury caused
by electric shock.
The alert symbol and WARNING heading indicate a potential safety hazard.
Strictly follow the warning instructions to avoid personal injury.
The shock hazard symbol and CAUTION heading indicate a
potential electric shock hazard. Strictly follow the instructions to
avoid property damage caused by electric shock.
The alert symbol and CAUTION heading indicate a potential hazard. Strictly follow the instructions to avoid property damage.
Factory default parameters
The Model 3201/R G.SHDSL router modem has the following factory default parameters.
• Ethernet IP address: 192.168.200.10/24
• WAN Connection: PPPoH Routed
• WAN IP address: 10.1.1.1
• Autonegotiate the G.SHDSL speed.
The Models 3201/I/CP and 3201/I/CO bridge modems have the following factory default parameters.
• Ethernet IP Address:
— 192.168.200.10 (for the CP version)
— 192.168.200.11 (for the CO version)
• Autonegotiate the G.SHDSL speed.
8
9
Model 3201 G.SHDSL Integrated Access Device User Guide
Typographical conventions used in this document
This section describes the typographical conventions and terms used in this guide.
General conventions
The procedures described in this manual use the following text conventions:
Table 1. General conventions
ConventionMeaning
Futura bold type
Italicized Futura type
Futura type
Garamond bold type
< >
Are you ready?
% dir *.*
Indicates the names of menu bar options.
Indicates the names of options on pull-down menus.
Indicates the names of fields or windows.
Indicates the names of command buttons that execute an action.
Angle brackets indicate function and keyboard keys, such as <SHIFT>,
<CTRL>, <C>, and so on.
All system messages and prompts appear in the Courier font as the
system would display them.
Bold Courier font indicates where the operator must type a response or
command
About this guide
Mouse conventions
The following conventions are used when describing mouse actions:
Table 2. Mouse conventions
ConventionMeaning
Left mouse button
Right mouse buttonThis button refers the secondary or rightmost mouse button (unless you have
PointThis word means to move the mouse in such a way that the tip of the pointing
ClickMeans to quickly press and release the left or right mouse button (as instructed in
Double-clickMeans to press and release the same mouse button two times quickly
DragThis word means to point the arrow and then hold down the left or right mouse but-
This button refers to the primary or leftmost mouse button (unless you have
changed the default configuration).
changed the default configuration).
arrow on the screen ends up resting at the desired location.
the procedure). Make sure you do not move the mouse pointer while clicking a
mouse button.
ton (as instructed in the procedure) as you move the mouse to a new location.
When you have moved the mouse pointer to the desired location, you can release
the mouse button.
About this guide
Model 3201 G.SHDSL Integrated Access Device User Guide
10
Chapter 1General Information
Chapter contents
Model 3201/3241 G.SHDSL Router Modem overview ........................................................................................12
General attributes ............................................................................................................................................12
G.SHDSL Characteristics (Models 3201 and 3241) .......................................................................................12
Protocol support .............................................................................................................................................13
PPP Support ...................................................................................................................................................13
Front Panel Status LEDs .......................................................................................................................................14
Rear panel connectors and switches .................................................................................................................14
Power input connector ....................................................................................................................................15
External AC universal power supply ..........................................................................................................15
External 48 VDC power supply ................................................................................................................15
Console port (outlined in red) .........................................................................................................................16
Ethernet port (outlined in green) ....................................................................................................................16
Line port (outlined in yellow) .........................................................................................................................16
11
1 • General InformationModel 3201 G.SHDSL Integrated Access Device User Guide
Model 3201/3241 G.SHDSL Router Modem overview
The Patton Models 3201 and 3241 router modems are G.SHDSL routers/bridges for delivering basic and
advanced IP services from the wide-area network to a local 10/100Base-T Ethernet LAN.
G.SHDSL offers an alternative, standards based DSL transmission medium. It offers connection speeds of 2.3
Mbps (Model 3201) or 4.6 Mbps (Model 3241) in each direction over a single twisted-pair (TP). Supporting
100 or more users, the router modems are optimized for users in a small office, as an enterprise tele-working
solution or for multimedia high-speed Internet access. Local and remote web-based management ensures easy
setup and continuous trouble-free operation.
The following sections describe Model 3201 and 3241 features and capabilities:
• General attributes, see page 12
• G.SHDSL Characteristics (Model 3201/3241), see page 12
• Ethernet, see page 12
• Protocol support, see page 13
• PPP support, see page 13
• ATM protocols, see page 13
• Management, see page 13
• Security, see page 13
General attributes
• Compact low-cost plug-and-play router
• 10/100 Ethernet
• Comprehensive hardware diagnostics, works with any operating system, easy maintenance and effortless
installation.
• Built-in web configuration.
• Simple software upgrade using FTP into FLASH memory.
• Eight front panel LEDs indicate Power, DSL WAN, Ethernet LAN speed and status.
• Convenient and standard RJ connectors for Ethernet, Line, and Console.
G.SHDSL Characteristics (Models 3201 and 3241)
• 2.3 Mbps (Model 3201) or 4.6 Mbps (Model 3241) speed over 2 wires.
• DTE rates:
- Model 3201: 144 kbps to 2.32 Mbps, nx64k with n=3 to 36
- Model 3241: 144 kbps to 4.6 Mbps, nxz64k n=3 to 72.
• Distance from 24,900 feet (7,589 m) at 144kbps (192 kbps line rate) to 10,200 feet (3,109 m) at 2.3 mbps
on 26 AWG (0.4 mm) wire
• CO and CP modes supported
• EOC Management channel for remote end-to-end management.
• DNS Relay with primary and secondary Name Server selection.
• NAT (RFC 3022) with Network Address Port Translation (NAPT), MultiNat with 1:1, Many:1,
Many:Many mapping, Port/IP redirection and mapping.
PPP Support
• Point-to-Point Protocol over HDLC
• PPPoA (RFC 2364) Point-to-Point Protocol over ATM.
• PPPoE (RFC 2516) Client for autonomous network connection. Eliminates the requirement of installing
client software on a local PC and allows sharing of the connection across a LAN.
• User configurable PPP PAP (RFC 1661) or CHAP (RFC 1994) authentication..
ATM Protocols
• Multiprotocol over ATM AAL5 and Multiprotocol Bridged encapsulation RFC 2684 (Formerly RFC
1483) and RFC 1577 Classical IP over ATM. Default RFC-1483 route mode. Logical Link Control
(LLC)/ Subnetwork Access Protocol (SNAP) encapsulation. Default VC mux mode.
• ATM UNI 3.0, 3.1, and 4.0 signaling ATM QoS with UBR, CBR, nrt-VBR, and rt-VBR.
• Peak cell rate shaping on a per-VCC basis up to 32 active VCCs across VPI 0-255, VCI 0-65525. Single
default PVC: 8/35 with PCR=5,500 cells.
Management
• User selectable ATM, PPP, or HDLC WAN datalink connection.
• Web-Based configuration via embedded web server
• CLI menu for configuration, management, and diagnostics.
• Local/Remote CLI (VT-100 or Telnet).
• SNMPv1 (RFC 1157) MIB II (RFC 1213)
• Logging via SYSLOG, and VT-100 console. Console port set at 9600 bps 8/N/1 settings no flow control.
• EOC access for End-To-End management, configuration, and control.
Security
• Packet filtering firewall for controlled access to and from LAN/WAN.
• DoS Detection/protection.
• Password protected system.
• Access list for up to 5 hosts/networks which are allowed to access management system SNMP/HTTP/TEL-
NET.
• Logging or SMTP on events: POST, POST errors, line/DSL, PPP/DHCP, IP.
Model 3201/3241 G.SHDSL Router Modem overview13
1 • General InformationModel 3201 G.SHDSL Integrated Access Device User Guide
Front Panel Status LEDs
The DiamondLink routers have all status LEDs on the front panel of the unit, and all electrical connections are
located on the rear panel.
Figure 1. Model 3201
The status LEDs from left to right are (see table 3 for LED descriptions):
• Power
• WAN Link, Tx, and Rx
• Ethernet Link, 100M, Tx, and Rx
Table 3. Status LED descriptions
PowerYellow
WAN
(DSL)
Ethernet LinkYellow
LinkYellow
TXYellow
RXYellow
100M Yellow
TXYellow
RXYellow
ON
indicates that power is applied.
2 Hz flash
1 Hz flash
8 Hz flash
Solid yellow:
2 Hz flash:
8 Hz flash:
No indication:
Flashing:
Flashing:
On:
On:
Flashing:
Flashing:
occurs during POST
occurs for non-fatal error.
on all LEDs for fatal POST outcome or critical error.
connected
training
DSL error
no signal detected.
when transmitting data from the unit to the WAN.
when receiving data from the WAN to the unit.
Ethernet is linked.
100 Mbps Ethernet is selected.
when data is transmitted from the unit to the LAN.
when data is received from the LAN.
Rear panel connectors and switches
On the rear panel from left to right are the following:
• Power input connector
• Console Port
• Ethernet connector
• MDI-X switch
• Line connector
Off
indicates that no power is applied.
14Front Panel Status LEDs
Model 3201 G.SHDSL Integrated Access Device User Guide 1 • General Information
Power input connector
The router modem comes with an AC or DC power supply. (see “Power and Power Supply Specifications” on
page 117)
• The power connection to the router modem is a 2.5 mm barrel receptacle with the center conductor posi-
tive (see figure 2).
• 5 VDC, 1 A
5 VDC
Figure 2. Power connection barrel receptacle 5 VDC diagram
External AC universal power supply
For additonal specifications, see “Power and Power Supply Specifications” on page 117.
• Output from power supply: 5 VDC, 2 A
• Input to power supply: universal input 100–240 VAC 50/60 Hz 0.3A
An approved external power supply that incorporates a disconnect device must be used and positioned within easy reach of
the operator’s position.
Connect the equipment to a 5 VDC source that is electrically isolated from the AC source. The 5 VDC source is to be reliably
connected to earth.
External 48 VDC power supply
Refer to see “Power and Power Supply Specifications” on page 117 for additonal specifications.
• Input
- Rated voltage: 36–60 VDC
- Rated current: 0.25 A DC
- 3-pin locking connector, 3.5 mm pitch
- Transient over-voltage protection, 100VDC at 2 ms
• Output
- Rated voltage: 5 VDC ± 5%, 5W
- Rated current; 1 A DC
- 6-inch cable terminated with 2.5 mm barrel plug, center positive
Connect the equipment to a 30–60 VDC source that is electrically isolated from the AC source. The 30–60 VDC source is to
be reliably connected to earth.
Front Panel Status LEDs15
1 • General InformationModel 3201 G.SHDSL Integrated Access Device User Guide
Console port (outlined in red)
The unshielded RJ-45 RS-232 console DCE port (EIA-561) with the pin-out listed in the following table:
Shielded RJ-45 10Base-T/100Base-TX Ethernet port using pins 1,2,3, & 6. See MDI-X switch for hub or transceiver configuration.The following table defines conditions that occur when the MDI-X switch is in the out position.
The Model 3201 modem operates as a bridge or a router and has two ports for communication:
• The Ethernet port—Connects to the LAN side of the connection
• The Line port—Provides the G.SHDSL transmission connection between the CPE and CO DSL modem
The modem provides all layer 2 and layer 3 protocols required for end-to-end-link communication.
When configuring the 3201, questions must be answered so the 3201 functions as desired. For example, when
a router or bridge module needs to be activated, some questions would be:
• Is a default gateway required?
• Which encapsulation technique is best for this application: PPPoA, Frame Relay, PPPoE or another?
These decisions can be made and implemented more easily if the Model 3201’s fundamental architecture is
understood. Also, while configuring the Model 3201 via a browser using the built-in HTTP server is very intuitive, an understanding of the architecture is essential when using the command-line interface (CLI) commands.
The fundamental building blocks comprise a router or bridge, interfaces, and transports. The router and bridge
each have interfaces. A transport provides the path between an interface and an external connection. For example, the Ethernet transport attaches to an Internet Protocol (IP) interface. A transport consists of layer 2 and
everything below it. Creating a transport and attaching it to a bridge or router’s interface enables data to be
bridged or routed. The supported transports are PPPoA, PPPoE, Frame Relay, RFC 1483 (Multiprotocol
Encapsulation over ATM AAL5), IPoA, PPPoH, and Ethernet.
Configuring an interface and transport for the router or bridge requires naming the interface and transport before
attaching them. When using the built-in HTTP server web browser, this is done automatically. But when configuring the Model 3201 via CLI commands through the RS-232 control port, it must be done manually.
Model 3201 modems can connect over an ATM PVC or HDLC transport.
The PVC requires the configuration of the virtual path identifier (VPI) and virtual circuit identifier (VCI). The
VPI can be any integer between 0–4095 inclusive. The general rule for the VCI is an integer between 1–65,535
inclusive. Examples in this manual use a VCI of 600 or above. The main restriction in choosing a VCI is that
VCIs below 32 are reserved for such predefined functions as ILMI. The VCI values of 600 and above used in
this manual are also above the range used by many signaling implementations for SVCs.
The HDLC is a packet-based transmission across the DSL Link.
Several ATM connections are offered to address a variety of user applications. Although they all use RFC1483
as the transport mechanism between the two 3201 modems, WAN services may use different PPP applications,
such as PPPoE routed, PPPoA routed, or PPPoA bridged. Each one has its advantages and disadvantages.
Applications Overview
The Model 3201 is used for bridged or routed applications.
NoteIn bridged applications the 3201 modem functions transparently on layer 2 to
provide MAC level bridging for Ethernet networks. The bridging is between
Ethernet and the DSL link between the two 3201 modems. The devices
attached to each 3201 are on the same subnet. The number of attached devices
and the size of the filter table are configurable. No IP address is necessary unless
18Product Overview
Model 3201 G.SHDSL Integrated Access Device User Guide 2 • Product Overview
the administrator desires management through a web browser. Then an IP
address is necessary for the administrator to access the 3201 modem.
In a typical bridged configuration, the DSL bridge is transparent to the network. It bridges the DSL line to
the Ethernet line, making both sides appear as a single subnet. However, it may still be beneficial to provide an
IP address to the DSL modem for management. In the bridged configuration it is not necessary for the Ethernet port to have an IP address.
DSL
Modem
Subnet 1Subnet 1
DSL
Figure 3. Bridged Application
DSL
Modem
In a typical routed configuration, the DSL router is treated as a separate device on the network that receives
packets from the PC and DSLAM. The Ethernet and DSL networks are configured as separate IP subnets. The
PC must have the DSL router set up as its default gateway.
DSL
Modem
Subnet 1
Subnet 2
DSLAM
Figure 4. Routed Application
Internet
Model 3201 applications are divided as follows:
• Connecting two stand-alone Model 3201 Bridge/Routers back-to-back using PPPoH Bridged or PPPoH
Routed. PPPoH Bridged can be considered as Ethernet extension since the same logical LAN exists at both
ends of the 3201s and only bridging is required. PPPoH is network extension in the more general sense
since a different logical network is on each end of the 3201s.
• Connecting the Model 3201 bridge/routers as a CPE device to a DSLAM. They can be configured for
bridged or routed mode.
– The bridged modes commonly used to connect to a DSLAM are RFC1483, HDLC (PPPoH), and
PPPoA.
– The routed modes are RFC1483, HDLC (PPPoH), PPPoA, IPoA and PPPoE.
For more information about router modem applications, refer to Chapter 4, “Basic Application Configurations” on page 27 and Chapter 5, “Specialized Configurations” on page 79.
What you will need .........................................................................................................................................22
Identify the connectors and attach the cables ..................................................................................................22
IP address Quick Start modification ................................................................................................................23
Router/Bridge Status LEDs .......................................................................................................................24
Web Operation and Configuration .................................................................................................................24
PC Configuration .....................................................................................................................................24
Web Browser .............................................................................................................................................24
If you are already familiar with Model 3201/3241 Router Modem installation and configuration, this chapter
will enable you to finsh the job quickly. Installation consists of the following:
• Preparing for the installation (see section “What you will need”)
• Hooking up cables, verifying that the unit will power up, and running a HyperTerminal session (see section
“Identify the connectors and attach the cables”)
• Changing the IP address from the factory default setting (see section “IP address Quick Start modification”
on page 23)
• Launching a web browser in preparation for configuring the modem (see “Web Operation and Configura-
tion” on page 24)
What you will need
• Model 3201 or 3241 G.SHDSL Router Modem
• External power supply for Model 3201 or 3241 (included)
• Ethernet cable with RJ45 plugs on each end (included)
• DB9-RJ45 Adapter (included)
• RJ45/RJ45 straight-through cable for connecting to control port (included)
• PC computer with HyperTerminal or equivalent VT-100 emulation program, or an ASCII (“dumb”) terminal.
Identify the connectors and attach the cables
All connectors are on the rear panel of the DiamondLink with the exception of the power connection. The
Console port is Red, the Ethernet port is Green, and the Line is Yellow.
Do the following:
1. Connect the DB9-RJ45 adapter to the DB-9 serial port on the PC or dumb terminal. Use the RJ45-RJ45
straight-through cable between the adapter and the red marked RJ45 port on the modem.
2. Do NOT connect the router modem to the Ethernet LAN now.
3. On the PC, start a HyperTerminal session at 9600 bps, 8 data bits, 1 stop bit, and no parity.
4. Power up the router modem.
5. Type “superuser” for Login:, and press Enter.
6. Then type “superuser” for the password, press Enter.
22Hardware installation
Model 3201 G.SHDSL Integrated Access Device User Guide 3 • Quick Start Installation
7. A message will display, “Login Successful.” By typing the character “?”, all the commands will be dis-
played. Any command’s parameters may be seen by entering the command followed by a space and a question mark.
→
ethernet ?
add
delete
set
show
list
clear
[The following parameters appear]
IP address Quick Start modification
The first parameter to change is the IP address from the default IP address of 192.168.200.10 (for the CP
units) or 192.168.200.11 (for CO units) to your selected IP address. Follow these steps. Comments are in
brackets […].
→
ip list interfaces <enter>
IP Interfaces:
ID | Name | IP Address | DHCP | Transport
Two stand-alone units directly connected..............................................................................................................29
The basic applications are divided according to whether the application is bridged or routed.
The bridged applications are RFC 1483 Bridged, PPPoA Bridged, and HDLC Bridged.
The routed applications are RFC 1483, PPPoA, IPoA, PPPoE, and HDLC.
Another way of organizing the applications is according to the type of encapsulation: PPP, RFC 1483, or Frame Relay. PPP encapsulation is available as PPPoA bridged or routed and PPPoE. RFC 1483 and Frame Relay can
be configured for bridged and routed connections.
The following table shows the parameters that can be configured via the HTTP server using a web browser.
Routed WAN ServicesBridged WAN Services
Web Page ParameterRFC
DescriptionXXXXXXXX
VPIXXXXXXdefault = 0
VCIXXXXXXdefault = 35
EncapsulationLLCVcMuxLLCLLC or VcMux
Use DHCPXXX
WAN IP addressXXXdefault mask = 255.255.255.0
LLC header X
HDLC headerONON
No authenticationXXX
PAPXXX
CHAPXXX
User NameXXX
PasswordXXX
WAN IP address
(Client modem for PPPoA)
Access ConcentratorX
HDLC EncapsulationXX
PPPoA IPoA PPPoE PPPoH RFC
1483
X
(0.0.0.0)
for client
PPPoA PPPoH Comments
1483
Local IP Mask = 255.255.255.0
28Introduction
Model 3201 G.SHDSL Integrated Access Device User Guide 4 • Basic Application Configurations
Two stand-alone units directly connected
Ethernet Extension (HDLC - PPPoH Bridged)
Model 3201 (Remote) Configuration Steps (PPPoH Bridged)
From the command line interface (CLI) via the RS-232 control port,
→
ip list interfaces
One IP interface is called ip1 with an IP address of 192.168.1.1
Let’s change the IP address so it is in the same subnet as both PCs. For example, to 192.168.100.2
→
ip set interface ip1 ipaddress 192.168.100.2 255.255.255.0
1. Now you can bring up the web-page management system on your browser by entering the IP address of
the 3201.
2. On the Menu, go to
Configuration, then to WAN Connections. Delete the factory default WAN services already
defined.
Click on
Create a new service in the main window, select PPPoH_Bridged and click on the Configure button.
3. In the Description field, enter the description you wish. In this example, it is called PPPoH Bridged.
G.SHDSL in the Configuration Menu, then the submenu Configuration.
Leave Terminal Type as Remote.
Change Interface Type to
hdlc. Click on the Configure button.
In the Action submenu under G.SHDSL, change Action to
Return to Action, select
Start and click on Action.
Network Extension (HDLC—PPPoH Routed)
Deactivate, then click on Action.
Model 3201 (Remote) Configuration Steps (PPPoH Routed)
From the command line interface (CLI) via the RS-232 control port,
→
ip list interfaces
One IP interface was called ip1 with an IP address of 192.168.1.1 Change it to an IP address which is in the
same subnet as the Desktop PC. For example, to 192.168.100.2. The default IP mask is 255.255.255.0.
→
ip set interface ip1 ipaddress 192.168.100.2 255.255.255.0
32Two stand-alone units directly connected
Model 3201 G.SHDSL Integrated Access Device User Guide 4 • Basic Application Configurations
1. Now you can bring up the web-page management system on your browser by entering the IP address of
the 3201.
Click on
is “hdlc.” If changed, then click on
Click on
2. On the Menu, go to
G.SHDSL in the Configuration Menu > Configuration > verify that Terminal Type is Central and Interface Type
Configure.
Action > Select deactivate for Action > Click on the Action button.
Configuration, then to WAN Connections
Delete both default WAN services already defined.
Click on
Create a new service in the main window, select PPPoH_Routed and click on the Configure button.
In the Description field, enter the description you wish. In this example, it is called PPPoH Routed.
G.SHDSL in the Configuration Menu, then the submenu Status. The Modem State should be “deacti-
vated.” (If not, go to the Action and change it to deactivate.)
Then in the Action submenu under G.SHDSL, change Action to Start, then click on
Action.
DSLAM Connections with remote CPE units
Bridged application configurations to a DSLAM
Three bridged services are offered, RFC 1483 Bridged, PPPoA Bridged, and HDLC Bridged.
The configurations show a desktop on one end and a laptop on the other. The laptop and its Model 3201
would be replaced with a DSLAM.
RFC 1483 Bridged Configuration.
No additional IP addresses are needed other than the IP address chosen earlier. In fact, if you are configuring and
managing the model 3201 only from the CLI (Command Line Interface), an IP address is not needed at all. The
limitation of no IP address precludes the user from doing web management of the 3201 since management is
done via the Ethernet port.
As in the PPPoA Bridged application, both sides of the RFC 1483 bridged connection are on the same subnet.
38DSLAM Connections with remote CPE units
Model 3201 G.SHDSL Integrated Access Device User Guide 4 • Basic Application Configurations
Model 3201 (Remote) Configuration Steps (RFC 1483 Bridged)
From the command line interface (CLI) via the RS-232 control port,
→
ip list interfaces
One IP interface is called ip1 with an IP address of 192.168.1.1
Change the IP address so it is in the same subnet as both PCs. For example, to 192.168.100.2
→
ip set interface ip1 ipaddress 192.168.100.2 255.255.255.0
1. Now you can bring up the web-page management system on your browser by entering the IP address of
the 3201.
2. On the Menu, go to Configuration, then to WAN Connections. Delete the factory default WAN services
already defined.
Click on
Create a new service in the main window, select RFC_1483_Bridged and click on the Configure button.
In the Description field, enter the description you wish. In this example, it is called RFC 1483 B.
Leave VCI as 35 and Encapsulation Method as LLC/SNAP. Then click on
3. Go to
G.SHDSL in the Configuration Menu, then the submenu Configuration.
Change Terminal Type to Remote and Interface Type to atm. Click on the Configure button.
In the Action submenu under G.SHDSL, change Action to
Return to Action, select
Start and click on Action.
Deactivate, then click on Action.
Model 3201 (Central) Configuration Steps (RFC 1483 Bridged)
Although the some parametric values may vary from the desktop’s Model 3201, the process is identical.
From the command line interface (CLI) via the RS-232 control port,
→
ip list interfaces
One IP interface is called ip1 with an IP address of 192.168.1.1
Change the IP address so it is in the same subnet as both PCs. For example, to 192.168.100.3
→
ip set interface ip1 ipaddress 192.168.100.3 255.255.255.0
1. Now you can bring up the web-page management system on your browser by entering the IP address of
the 3201.
2. On the Menu, go to Configuration, then to WAN Connections. Delete the factory default WAN services
already defined.
Click on
Create a new service in the main window, select RFC_1483_Bridged and click on the Configure button.
In the Description field, enter the description you wish. In this example, it is called RFC 1483 B.
Leave VCI as 35 and Encapsulation Method as LLC/SNAP. Then click on
Apply.
3. Go to G.SHDSL in the Configuration Menu, then the submenu Configuration.
Leave Terminal Type as Remote, but change Interface Type to atm. Click on the
40DSLAM Connections with remote CPE units
Configure button.
Model 3201 G.SHDSL Integrated Access Device User Guide 4 • Basic Application Configurations
In the Action submenu under G.SHDSL, change Action to Deactivate, then click on Action.
Return to Action, select Start and click on Action.
PPPoH Bridged Configuration
Model 3201 (Remote) Configuration Steps (PPPoH Bridged)
From the command line interface (CLI) via the RS-232 control port,
→
ip list interfaces
One IP interface is called ip1 with an IP address of 192.168.1.1 Change the IP address so it is in the same subnet as both PCs. For example, to 192.168.100.2
→
ip set interface ip1 ipaddress 192.168.100.2 255.255.255.0
1. Now you can bring up the web-page management system on your browser by entering the IP address of
the 3201.
2. On the Menu, go to
Configuration, then to WAN Connections. Delete the factory default WAN services
already defined.
Click on
DSLAM Connections with remote CPE units41
Create a new service in the main window, select PPPoH_Bridged and click on the Configure button.
The user data for transmission is in the form of IP packets but encapsulated in a PPP packet, transmitted and
received through a PPP session to the connection. The PPP packets are encapsulated according to RFC 2364 for
transmission over the ATM link. The packets are de-encapsulated on the receive side so that the IP data can be
delivered to the end user.
Model 3201 (Remote) Configuration Steps (PPPoA Bridged)
From the command line interface (CLI) via the RS-232 control port,
→
ip list interfaces
One IP interface is called ip1 with an IP address of 192.168.1.1
Change the IP address so it is in the same subnet as both PCs. For example, to 192.168.100.2
→
ip set interface ip1 ipaddress 192.168.100.2 255.255.255.0
1. Now you can bring up the web-page management system on your browser by entering the IP address of
the 3201.
2. On the Menu, go to Configuration, then to WAN Connections. Delete the factory default WAN services
already defined.
Click on
Create a new service in the main window, select PPPoA_Bridged and click on the Configure button.
In the Description field, enter the description you wish. In this example, it is called PPPoA Bridged.
44DSLAM Connections with remote CPE units
Model 3201 G.SHDSL Integrated Access Device User Guide 4 • Basic Application Configurations
– VPI = 0
– VCI = 300
– LLC header mode = off
– HDLC header mode = off
– No authentication
– Leave User name and Password blank.
Click on
Apply.
3. Go to G.SHDSL in the Configuration Menu, then the submenu Configuration.
Change Terminal Type to Remote and Interface Type to atm. Click on the
In the Action submenu under G.SHDSL, change Action to
Return to Action, select
Start and click on Action.
Deactivate, then click on Action.
Configure button.
Model 3201 (Central)Configuration Steps (PPPoA Bridged)
From the command line interface (CLI) via the RS-232 control port,
→
ip list interfaces
One IP interface is called ip1 with an IP address of 192.168.1.1
Change the IP address so it is in the same subnet as both PCs. For example, to 192.168.100.3
→
ip set interface ip1 ipaddress 192.168.100.3 255.255.255.0
1. Now you can bring up the web-page management system on your browser by entering the IP address of
the 3201.
2. On the Menu, go to Configuration, then to WAN Connections. Delete the factory default WAN services
already defined.
Click on
Create a new service in the main window, select PPPoA_Bridged and click on the Configure button.
In the Description field, enter the description you wish. In this example, it is called PPPoA Bridged.
3. Go to G.SHDSL in the Configuration Menu, then the submenu Configuration.
Leave Terminal Type as Central.
Change Interface Type to atm. Click on the
In the Action submenu under G.SHDSL, change Action to Deactivate, then click on
Return to Action, select
Start and click on Action.
Configure button.
Action.
Routed application configurations to a DSLAM
Five routed WAN services are offered, RFC 1483, PPPoH, IPoA, PPPoA, and PPPoE Routed.
RFC 1483 Routed
RFC 1483 provides the simplest method of connecting end stations over an ATM network. User data in the
form of Ethernet packets is encapsulated into AAL-5 PDUs for transport over ATM. RFC 1483 provides no
authentication and configuration that would be provided by PPP.
Model 3201 (Remote) Configuration Steps (RFC 1483 Routed)
From the command line interface (CLI) via the RS-232 control port,
→
ip list interfaces
One IP interface was called ip1 with an IP address of 192.168.1.1 Change it to an IP address which is in the
same subnet as the Desktop PC. For example, to 192.168.100.2. The default IP mask is 255.255.255.0.
→
ip set interface ip1 ipaddress 192.168.100.2 255.255.255.0
46DSLAM Connections with remote CPE units
Model 3201 G.SHDSL Integrated Access Device User Guide 4 • Basic Application Configurations
1. Now you can bring up the web-page management system on your browser by entering the IP address of
the 3201.
Click on G.SHDSL in the Configuration Menu > Configuration > verify that Terminal Type is Central
and Interface Type is atm. If changed, then click on
Configure.
Click on Action > Select deactivate for Action > Click on the Action button.
2. On the Menu, go to Configuration, then to WAN Connections.
Delete both default WAN services already defined.
Click on
Create a new service in the main window, select RFC 1483 Routed and click on the Configure button.
In the Description field, enter the description you wish. In this example, it is called RFC 1483 Routed.
Change the configuration parameters to match the following.
Description:RFC 1483 Routed
– VPI:0
– VCI:35
– Encapsulation Method: LLC/SNAP
– WAN IP Address:192.168.164.2
Click on
Configure.
3. Configuration Menu > Configuration > IP Routes > Click on Create new Ip V4 Route > Create the gate-
way to the remote 3201 by entering the WAN IP address of the remote 3201, in this example, enter
192.168.164.3 in the Gateway field > OK
48DSLAM Connections with remote CPE units
Model 3201 G.SHDSL Integrated Access Device User Guide 4 • Basic Application Configurations
The other fields should be:
– Destination:0.0.0.0
– Gateway:192.168.164.3
– Mask:0.0.0.0
– Cost:1
– Interface:[blank]
4. Go to G.SHDSL in the Configuration Menu, then the submenu Status. The Modem State should be
“deactivated.” (If not, go to the Action and change it to deactivate.)
Then in the Action submenu under G.SHDSL, change Action to
Start, then click on Action.
Model 3201 (Central) Configuration Steps (RFC 1483 Routed)
From the command line interface (CLI) via the RS-232 control port,
→
ip list interfaces
→
pppoh clear transports
One IP interface was called ip1 with an IP address of 192.168.1.1
One IP interface was called ip1 with an IP address of 192.168.1.1 Change it to an IP address which is in the
same subnet as the Desktop PC. For example, to 192.168.100.2. The default IP mask is 255.255.255.0.
→
ip set interface ip1 ipaddress 192.168.100.2 255.255.255.0
1. Now you can bring up the web-page management system on your browser by entering the IP address of
the 3201.
Click on G.SHDSL in the Configuration Menu > Configuration > verify that Terminal Type is Central
and Interface Type is hdlc. If changed, then click on
Configure.
Click on Action > Select deactivate for Action > Click on the Action button.
2. On the Menu, go to Configuration, then to WAN Connections
Delete both default WAN services already defined.
Click on
Create a new service in the main window, select PPPoH_Routed and click on the Configure button.
In the Description field, enter the description you wish. In this example, it is called PPPoH Routed.
– Description:PPPoH Routed
– Interface:1
– WAN IP address: 192.168.164.2
– LLC Header Mode:off
– HDLC Header Mode:ON
– No authentication
54DSLAM Connections with remote CPE units
Model 3201 G.SHDSL Integrated Access Device User Guide 4 • Basic Application Configurations
– Username:[blank]
– Password:[blank]
Click on
Configure.
3. Go to Configuration Menu > Configuration > WAN connections > Edit (for PPPoH Routed service) >
Edit ‘IP Interface’ > Ipaddr: [enter the WAN IP Address, in this example = 192.168.164.2] > Click on
Change.
This routed application is very similar to the PPPoA Bridged application. The user data for transmission is in
the form of IP packets but encapsulated in a PPP packet, transmitted and received through a PPP session to the
connection. The PPP packets are encapsulated according to RFC 2364 for transmission over the ATM link.
The packets are de-encapsulated on the receive side so that the IP data can be delivered to the end user.
The Central (Model 3201) end functions as a local ISP which will authenticate the Remote user (Model
3201). The CPE side, with Remote and 3201-A, may represent a home PC which is connecting to a centralized PPP server (Local and 3201—B).
Since this is a routed application, there are differences to be noted. Referring to the application diagram, three
unique subnets exist. The Ethernet LAN on the 3201 and Remote side, the Ethernet LAN on the 3201 and
Central side, and lastly, the subnet of the ATM’s PVC link between the two modems, 3201-A and 3201-B.
The 3201-B and Local end (the Central side) may also be a DSLAM.
Model 3201 (Remote—Client) Configuration Steps (PPPoA Routed)
1. From the command line interface (CLI) via the RS-232 control port,
→
ip list interfaces
One IP interface was called ip1 with an IP address of 192.168.1.1 Change it to an IP address which is in
the same subnet as the Desktop PC. For example, to 192.168.100.2. The default IP mask is
255.255.255.0.
→
ip set interface ip1 ipaddress 192.168.100.2 255.255.255.0
60DSLAM Connections with remote CPE units
Model 3201 G.SHDSL Integrated Access Device User Guide 4 • Basic Application Configurations
Now you can bring up the web-page management system on your browser by entering the IP address of
the 3201.
Click on G.SHDSL in the Configuration Menu > Configuration > verify that Terminal Type is Central
and Interface Type is atm. If changed, then click on
Configure.
Click on Action > Select deactivate for Action > Click on the
Action button.
2. On the Menu, go to Configuration, then to WAN Connections
Delete both default WAN services already defined.
Click on
Create a new service in the main window, select PPPoA Routed and click on the Configure button.
In the Description field, enter the description you wish. In this example, it is called PPPoA Routed.
Change the configuration parameters to match the following.
Verify or change if necessary the following Options parameters.
– Ipaddr:0.0.0.0
– Mask:0.0.0.0
– Dhcp:false
– MTU:1500
– Enabled:true
Click on the
Change button if changes were made.
6. There is no gateway created in the IP routes submenu. Upon connecting, the server will provide this infor-
mation while setting up the PPP connection.
7. Go to G.SHDSL in the Configuration Menu, then the submenu Status. The Modem State should be
“deactivated.” (If not, go to the Action and change it to deactivate.)
Then in the Action submenu under G.SHDSL, change Action to Start, then click on
Action.
Model 3201 (Central—Server) Configuration Steps (PPPoA Routed)
Configuration via the web-pages has a bug which will be fixed. However the 3201 as servers functions properly
via CLI configuration.
The following configuration is via the browser (web-pages). At the moment, do not use this method of configuration.
1. From the command line interface (CLI) via the RS-232 control port,
→
ip list interfaces
One IP interface was called ip1 with an IP address of 192.168.1.1 Change it to an IP address which is in
the same subnet as the Desktop PC. For example, to 192.168.172.3. The default IP mask is
255.255.255.0.
→
ip set interface ip1 ipaddress 192.168.172.3 255.255.255.0
64DSLAM Connections with remote CPE units
Model 3201 G.SHDSL Integrated Access Device User Guide 4 • Basic Application Configurations
Now you can bring up the web-page management system on your browser by entering the IP address of
the 3201.
Click on G.SHDSL in the Configuration Menu> Configuration > verify that Terminal Type is Central and
Interface Type is atm. If changed, then click on
Configure.
Click on Action > Select deactivate for Action > Click on the
2. On the Menu, go to Configuration, then to WAN Connections
Delete both default WAN services already defined.
Click on
Create a new service in the main window, select PPPoA Routed and click on the Configure button.
In the Description field, enter the description you wish. In this example, it is called PPPoA Routed.
Change the configuration parameters to match the following.
– Description:PPPoA Routed
– VPI:0
– VCI:800
– WAN IP Address:192.168.164.2
– LLC Header Mode:off
– HDLC Header Mode:off
NoteThe following items are for dial-out service only, for when a remote is
establishing a connection with a server.
• CHAP
• User Name: [leave blank]
• Passwood: [leave blank]
66DSLAM Connections with remote CPE units
Model 3201 G.SHDSL Integrated Access Device User Guide 4 • Basic Application Configurations
Click on Configure.
3. In the Configuration Menu, click on Configuration then > WAN Connections > Edit (for the WAN Ser-
vice ppp1) > Edit ‘PPP’ and verify or change the following parameters on the Edit PPP webpage.
Parameters in red italics are those requiring changes from the default configuration.
7. From the Configuration Menu, click on Configuration > Authentication > Create a new user > enter the
information for the following parameters in the webpage Details for the new user. One of these authentication records is created for each remote end user connecting to the Server.
– Username:fred
– Password:fredspass
– May dialin:true
– Comments: [may leave blank or enter any comments for this user.]
Click on the Create button.
8. Go to G.SHDSL in the Configuration Menu, then the submenu Status. The Modem State should be
“deactivated.” (If not, go to the Action and change it to deactivate.)
Then in the Action submenu under G.SHDSL, change Action to Start, then click on
Action.
IPoA Routed (RFC 1577)
User data in the form of IP packets is encapsulated into AAL-5 PDUs for transport over ATM. The fact that
the user data is routed at an IP layer instead of bridged at a MAC layer allows the source and destination to be
on different subnets. A notable drawback of IPoA is the lack of authentication and configuration that would be
provided by PPP.
Model 3201 (Remote) Configuration Steps (IPoA Routed)
From the command line interface (CLI) via the RS-232 control port,
→
ip list interfaces
One IP interface was called ip1 with an IP address of 192.168.1.1 Change the IP address so it is in the same
subnet as both PCs. For example, to 192.168.100.2. The default IP mask is 255.255.255.0.
→
ip set interface ip1 ipaddress 192.168.100.2 255.255.255.0
72DSLAM Connections with remote CPE units
Model 3201 G.SHDSL Integrated Access Device User Guide 4 • Basic Application Configurations
1. Now you can bring up the web-page management system on your browser by entering the IP address of
the 3201.
2. On the Menu, go to Configuration, then to WAN Connections. Delete the factory default WAN services
already defined.
Click on
Create a new service in the main window, select IPoA_Routed and click on the Configure button.
In the Description field, enter the description you wish. In this example, it is called IPoA Routed.
Model 3201 (Central) Configuration Steps (IPoA Routed)
From the command line interface (CLI) via the RS-232 control port:
→
ip list interfaces
One IP interface was called ip1 with an IP address of 192.168.1.1 Change the IP address so it is in the same
subnet as both PCs. For example, to 192.168.172.3. The default IP mask is 255.255.255.0.
→
ip set interface ip1 ipaddress 192.168.172.3 255.255.255.0
1. Now you can bring up the web-page management system on your browser by entering the IP address of
the 3201.
2. On the Menu, go to Configuration, then to WAN Connections. Delete the factory default WAN services
already defined.
Click on
Create a new service in the main window, select IPoA_Routed and click on the Configure button.
In the Description field, enter the description you wish. In this example, it is called IPoA Routed.
– VPI:0
– VCI:700
– WAN IP address: 192.168.164.3
Click on
Apply.
76DSLAM Connections with remote CPE units
Model 3201 G.SHDSL Integrated Access Device User Guide 4 • Basic Application Configurations
3. Returning to the 3201 Configuration Menu, click on Configuration, then IP Routes.
Click on “Create new Ip V4 Route.”
– Destination:0.0.0.0
– Gateway:192.168.164.2
– Mask:0.0.0.0
– Cost:1
– Interface:[leave blank]
Click on
OK.
4. Go to G.SHDSL in the Configuration Menu, then the submenu Configuration.
Leave Terminal Type as Remote.
Change Interface Type to hdlc. Click on the
Configure button.
In the Action submenu under G.SHDSL, change Action to Deactivate, then click on
IP Configurations..................................................................................................................................................80
DHCP Server and Relay .................................................................................................................................81
The router can be configured to use the RIP routing protocol, version 1 or 2, for accepting and sending RIP
packets.
Router
RIP and RIPv2
Static Route
1. Click on > Configuration, then > IP Routes on the Configuration Menu.
2. On the main web page entitled “Edit Routes,” click on
Create new Ip V4 Route.
3. Enter the destination IP address in the Value field of “Destination.”
4. Enter the IP address of the gateway which is the WAN IP address of the device on the other end of the
DSL link in the Value field of “Gateway.”
5. Enter the appropriate netmask in the Value field of “Netmask.”
6. Leave Cost as “1.”
7. “Interface” is an ASCII field which you may leave blank or fill in for your identification.
8. Click
OK.
9. Add additional static routes using the same procedure.
80IP Configurations
Model 3201 G.SHDSL Integrated Access Device User Guide 5 • Specialized Configurations
DHCP Server and Relay
The DHCP Server or Relay are simply configured via the web page management pages.
1. Go to > Configuration Menu > Configuration > DHCP Server and the DHCP Server page is displayed.
At the bottom of the web page are three options for the DHCP Server Mode: Disabled, DHCP server
(default), and DHCP Relay Agent.
2. Click on Configure on the DHCP Server web page to change the configuration for any of the DHCP param-
eters.
The three categories of configuration parameters on this web page are the Address Range of the DHCP
Server, the Lease Times in seconds, the selection of Domain Name Servers (if desired), and whether to use
the router as the default gateway.
3. Clicking on Advanced Options offers additional options for configuration. They are displayed in the following
figure.
4. The router modem may be used as a DHCP Relay Agent if desired. Go to > Configuration Menu > Con-
figuration > DHCP Server. Select DHCP Relay Agent at the bottom of the web page and click on Configure. The DHCP Relay agent page is displayed.
5. Enter the DHCP server’s IP address and click on
Apply.
The router is now ready to operate as a DHCP Relay agent.
DNS Client
The DNS client provides a method for retrieving a list of IP addresses for a host name as well as acquiring the
host name for a given IP address. The DNS client will cache any results from the name server which reduces
network traffic.
1. Enter the DNS Servers by entering the IP address in the field next to the Add button.
2. Click on
Add.
More than one DNS Server may be added.
An alternative is to create a domain search list. The DNS Client uses this list when a user asks for the IP
address list for an incomplete domain name. There may be up to a maximum of 6 incomplete domain names
in the search list.
Enter the domain name and click on
82IP Configurations
Add to add it to the list.
Model 3201 G.SHDSL Integrated Access Device User Guide 5 • Specialized Configurations
DNS Relay Mode
In the DNS Relay web page, up to 10 DNS server addresses may be added to utilize the DNS servers already
being used by the network.
1. Select
2. Click on
Enabled.
Configure.
3. Enter the DNS server address in the field following DNS server IP address:
4. Click on Apply.
5. Repeat to add more DNS server addresses, not to exceed the maximum of 10.
Configuring the router ..........................................................................................................................................86
Configuring the security interfaces.........................................................................................................................87
Deleting a Firewall Policy ...............................................................................................................................88
Enabling the Firewall.............................................................................................................................................89
Intrusion Detection System (IDS) .........................................................................................................................91
85
6 • SecurityModel 3201 G.SHDSL Integrated Access Device User Guide
Introduction
Security provides the ability to setup and enforce security policies. The policies define the types of traffic permitted to pass through a gateway, either inbound, outbound, or both, and from which origins the traffic may
be allowed to enter.
Within the security configuration is a stateful firewall. A stateful firewall utilizes a security mechanism to maintain information concerning the packets it receives. This information is used for deciding dynamically whether
or not a packet may pass through.
Port filters are rules that determine how a packet should be handled. The rules define the protocol type, the
range of source and destination port numbers and an indication whether the packet is allowed or not.
Security triggers are used with applications that require and create separate sessions. The most common example is FTP. An FTP client establishes a connection to a server using port 21, but data transfers are done on a
separate connection or port. The port number, and who makes the connection, can vary depending on the
FTP client. To allow FTP to work without triggers, you would need to set up port filters allowing the correct
port numbers through. This is a significant security risk.
This risk can be avoided by using security triggers. Triggers tell the security mechanism to expect these secondary sessions and how to handle them. Rather than allowing a range of port numbers, triggers handle the situation dynamically, opening the secondary sessions only when appropriate. The triggers work without needing to
understand the application protocol or reading the payload of the packet, although this does happen when
using NAT.
Triggering allows you to set up a trigger for different application protocols that use multiple sessions. The timeout between sessions and whether or not session chaining are allowed are configurable. Session chaining is not
needed for FTP but is for NetMeeting.
See Chapter 7, “NAT (Network Address Translation)” on page 95.
Configuring the router
The configuration of security assumes that the 3201/Router modem already has a valid IP address for the
Ethernet port so that the user may access the modem via the web page. If the IP address is still the factory
default, go to the section in Chapter 3 entitled IP Address Quick Start Modification.
In this example the WAN transport between the two 3201/Router modems will be IPoA.
1. Click on WAN Connections under Configuration on the 3201’s Menu.
2. Click on Create a New Service.
3. Select IPoA Routed and click on the Configure button.
4. For this example, enter IPoA Security Firewall in the Description field.
5. VPI remains at 0. Change VCI to be 100.
6. Click on WAN IP address and enter 192.168.101.1 in the adjacent box. The default IP mask is
255.255.255.0.
7. Click on Apply.
86Introduction
Model 3201 G.SHDSL Integrated Access Device User Guide 6 • Security
The next step in configuring the router is adding the default gateway route. Since the WAN IP address of the
3201 modem at the CO site is 192.168.101.2, this will be the gateway for the 3201 modem at the CPE site,
the modem we are currently configuring.
1. Click on IP Routes under Configuration on the 3201 modem’s Menu.
2. Click on Create a New IP Route.
3. Enter 192.168.101.2 in the box adjacent to Gateway.
4. Leave Destination and Netmask both as 0.0.0.0 because this is the gateway default route.
5. Click on Create and the route will be entered.
6. The default gateway can be verified by clicking on IP Routes under Status in the menu.
Configuring the security interfaces
The interfaces and routes have been configured on the 3201 Router modem which will function as the firewall.
The Ethernet side of the 3201 will be configured to be an internal security interface whereas the WAN side is
configured as an external security interface since it is on “public” side of the modem connection.
1. Click on Security under Configuration on the 3201 modem’s menu.
2. Under Security Interfaces, click on Add Interface.
3. Select Name of the WAN port (ipoa-0) and Interface Type to be external. Click on Apply.
Configuring the security interfaces87
6 • SecurityModel 3201 G.SHDSL Integrated Access Device User Guide
4. Add one more security interface by repeating step 2.
5. Select Name of the LAN port (ip1) and Interface Type to be internal. Click on Apply.
Now the Firewall policies will be added between the security interfaces. Only one Firewall policy, called etoi, is
added between the external and internal interfaces.
1. Under Policies, Triggers and Intrusion Devices on the Security page, click on Firewall Policy
Configuration.
2. In the Current Firewall Policies page, click on New Policy.
3. Select the parameters so the policy applies between interface of types: external
internal.
Also Validators will block traffic. This blocks all hosts.
4. Click on Apply.
Deleting a Firewall Policy
To delete a Firewall Policy, follow these Command Line Interface (CLI) commands via the Console port.
→
firewall list policies
88Configuring the security interfaces
Model 3201 G.SHDSL Integrated Access Device User Guide 6 • Security
Firewall Policies:
ID | Name | Type 1 | Type 2 | Validator Allow Only
At this point, both security and the firewall can be enabled and the network is secure. All the interfaces which
have been defined are protected: all traffic blocked between the internal and external interfaces.
1. Return to the Security page.
2. Under Security State select Enabled for Security and click on Change State.
3. Then select Enabled for the Firewall and click on Change State.
The network is now secure. All the interfaces which have been defined are protected and all traffic is blocked
between different the different interface types. That is, all traffic is blocked between the external and internal
interfaces.
The next section describes how to configure the Firewall for allowing certain types of data transfer to occur
between the PC’s on different networks.
Firewall Portfilters
Next, we configure the Firewall to permit certain types of data transfer between the PCs on the different networks. This is done by the implementation of Firewall portfilters. Portfilters are individual rules that determine
what kind of traffic can pass between two interface types.
For the Transport Type below, the different types are:
Transport Type Abbreviation
1ICMP
2IGMP
3GGP
4IP
6TCP
8EGP
9IGP
17UDP
46RSVP
47GRE
89OSPFIGP
92MTP
Enabling the Firewall89
6 • SecurityModel 3201 G.SHDSL Integrated Access Device User Guide
Transport Type Abbreviation
94IPIP
To allow pings between the two PCs:
1. From the Configuration Menu, > Configuration > Security > Firewall Policy Configuration > Port Filters >
Add Raw IP Filter
2. Enter 1 (for ICMP) in Transport Type.
3. Both Inbound and Outbound should be allowed.
4. Click on Apply.
You can now ping between the two networks
Security Triggers
Security triggers are used to allow an application to open a secondary port in order to transport data. The most
common example is FTP. This procedure is to set up a trigger on the Firewall to have an FTP session from PC
A to PC B, but not the reverse.
1. First, create an outbound-only portfilter for FTP and add it to the item0 policy.
2. Following the path given in step 1 for the ping portfilter, click on Add TCP Filter.
3. The Port Range is entered as 21 for both Start and End.
4. Set Inbound as Block, but Outbound as Allow.
5. Click on Apply.
90Security Triggers
Model 3201 G.SHDSL Integrated Access Device User Guide 6 • Security
After configuring the FTP portfilter, you can open an ftp session from Remote to Local, however you can issue
ftp commands (e.g., login, cd, etc.) but transfer data (e.g., ls, dir, get, put commands). The portfilter allows an
ftp control channel but does not allow the use of a secondary data channel for passing data by ftp.
To enable the ftp data channel, add a trigger which will open a secondary channel only when data is being
passed. This prevents the need to open too many ports which offer a security risk.
1. From the Configuration Menu, > Configuration > Security > Firewall Trigger Configuration > New Trig-
ger.
2. Set the parameters as follows:
– Transport Type = tcp
– Port Number Start = 21
– Port Number End = 21
– Allow Multiple Hosts = Block
– Max Activity Interval = 3000
– Enable Session Chaining = Block
– Enable UDP Session Chaining = Block
– Binary Address Replacement = Block
– Address Translation Type = none
3. Click on Apply.
You should now be able to use ftp commands to pass data between Remote and Local.
Intrusion Detection System (IDS)
The security feature in the 3201 Router modem provides protection from a number of attacks. Some attacks
cause a host to be blacklisted (i.e., no traffic from that host is accepted under any circumstances) for a period of
time. Other attacks are simply logged. The subsequent table is a summary of the attacks detected.
6 • SecurityModel 3201 G.SHDSL Integrated Access Device User Guide
Table 4:
Attack NameProtocol
WinNukeTCPyes
Xmas Tree ScanTCPyes
IMAP SYN/FIN Scan TCPyes
SmurfICMPIf victim protection set
SYN/FIN/RST Flood TCPIf scanning threshold
Net Bus ScanTCPyes
Back Orifice ScanUDPyes
Attacking Host
Blacklisted?
exceeded
1. To enable IDS, click on Enabled for “Intrusion Detection Enabled” on the “Security Interface Configura-
tion” page. Then click on Change State(s).
2. Click on Configure Intrusion Detection.
3. You may choose which of the parameters to configure and for which value.
– Use Blacklist:Default = 10 minutes when enabled.
If IDS has detected an intrusion an external host, access to the network is denied for ten minutes.
– Use Victim Protection:Default = Disabled.
Enables Victim Protection. Victim Protection protects the victim from an attempted spoofing attack.
Web spoofing allows an attacker to create a ‘shadow’ copy of the world wide web (WWW). All access to
the shadow Web goes through the attacker’s machine, so the attacker can monitor all of the victim’s
activities and send false data to or from the victim’s machine. When enabled, packets destined for the
victim host of a spooking style attack are blocked.
– DOS Attack Block Duration:Default = 1800 seconds (30 minutes).
A Denial of Service (DOS) attack is an attempt by an attacker to prevent legitimate users from using a
service. If a DOS attack is detected, all suspicious hosts are blocked by the firewall for a set time limit
Sets the duration for blocking all suspicious hosts. The firewall detects when the system is being scanned
by a suspicious host attempting to identify any open ports.
– Maximum TCP Open Handshaking Count:Default = 100
Sets the maximum number of unfinished TCP handshaking sessions per second that are allowed by a
92Intrusion Detection System (IDS)
Model 3201 G.SHDSL Integrated Access Device User Guide 6 • Security
firewall before a SYN Flood is detected. SYN Flood is a DOS attack. When establishing normal TCP
connections, three packets are exchanged: (1) A SYN (synchronize) packet is sent from the host to the
network server. (2) A SYN/ACK packet is sent from the network server to the host. (3) An Ack
(acknowledge) packet is sent from the host to the network server. If the host sends unreachable source
addresses in the SYN packet, the server sends the SYN/ACK packets to the unreachable addresses and
keeps resending them. This creates a backlog queue of unacknowledged SYN/ACK packets. Once the
queue is full, the system will ignore all incoming SYN request and no legitimate TCP connections can
be established.
– Once the maximum number of unfinished TCP handshaking sessions is reached, an attempted DOS
attack is detected. The firewall blocks the suspected attacker for the time limit specified in the DOS
Attack Block Duration parameter.
– Maximum Ping Count:Default = 15
Sets the maximum number of pings per second that are allowed by the firewall before an Echo Storm is
detected. Echo Storm is a DOS attack. An attacker sends oversized ICMP datagrams to the system using
the ‘ping’ command. This can cause the system to crash, freeze, or reboot, resulting in denial of service
to legitimate users.
– Maximum ICMP Count:Default = 100
Sets the maximum number of ICMP packets per second that are allowed by the firewall before an ICMP
Flood is detected. An ICMP Flood is a DOS attack. The attacker tries to flood the network with ICMP
packets in order to prevent transmission of legitimate network traffic.
4. After selecting the chosen parameters, click on Apply.
Intrusion Detection System (IDS)93
6 • SecurityModel 3201 G.SHDSL Integrated Access Device User Guide
Creating an Ethernet Transport.............................................................................................................................96
Creating a DSL Link .............................................................................................................................................96
Central Side Configuration .............................................................................................................................97
Remote Side Configuration .............................................................................................................................97
Creating an ATM Routable Link...........................................................................................................................98
Remote side configuration ..............................................................................................................................98
Central side configuration ...............................................................................................................................98
Creating a route for Remote and Central PCs........................................................................................................99
Remote side configuration ..............................................................................................................................99
Central side configuration ...............................................................................................................................99
Network Address Translation (NAT) provides unlimited local host addresses, enabling users to connect to the
Internet without having to provide a new address for each and every host. An encryption capability helps keep
actual addresses confidential. This chapter describes how to configure for NAT.
Creating an Ethernet Transport
1. From Console on the Remote unit configure the following:
→
ip set interface ip1 ipaddress 192.168.100.11 255.255.255.0
→
system config save
2. From Console on the Central unit configure the following:
→
ip set interface ip1 ipaddress 209.49.110.130 255.255.255.0
→
system config save
Now you should be able to reach the unit through the Ethernet port from the local side using Telnet or the
WWW interface. This instructions in this procedure are intended for the WWW interface.
Creating a DSL Link
You will need the following to create a DSL link:
• One Model 3201 unit configured as Remote
• One Model 3201 unit configured as Central
96Introduction
Model 3201 G.SHDSL Integrated Access Device User Guide 7 • NAT (Network Address Translation)
• DSL data rates should be the same for Remote and Central units
Central Side Configuration
From the WWW interface, do the following:
1. Click on
GSHDSL.
2. Click on Configuration.
3. Change the intended DSL Data Rate to the maximum rate desired.
4. Change Terminal Type to Central.
5. Scroll to the bottom of the page and click on Configure.
6. Click on (GSHDSL) Action.
7. Set to start and click on Action.
8. Save the configuration.
Remote Side Configuration
From the WWW interface, do the following:
1. Click on
GSHDSL.
2. Click on Configuration.
3. Change the intended DSL Data Rate to the maximum rate desired.
4. Scroll to the bottom of the page and click on Configure.
5. Save the configuration.
Confirm that the DSL link is working properly by verifying that the DSL WAN LED is lit.