ZyXEL Communications P-312 User Manual

Prestige 312

Broadband Security Gateway

User’s Guide

Version 3.20

November 2000

P312 Broadband Security Gateway

Prestige 312

Broadband Security Gateway

Copyright

Copyright © 2000 by ZyXEL Communications Corporation.
The contents of this publication may not be reproduced in any part or as a whole, transcribed, stored in a

retrieval system, translated into any language, or transmitted in any form or by any means, electronic,
mechanical, magnetic, optical, chemical, photocopying, manual, or otherwise, without the prior written
permission of ZyXEL Communications Corporation.

Published by ZyXEL Communications Corporation. All rights reserved.

Disclaimer

ZyXEL does not assume any liability arising out of the application or use of any products, or software
described herein. Neither does it convey any license under its patent rights nor the patent rights of others.
ZyXEL further reserves the right to make changes in any products described herein without notice. This
publication is subject to change without notice.

Trademarks

Trademarks mentioned in this publication are used for identification purposes only and may be properties of
their respective owners.

ii Copyright

P312 Broadband Security Gateway

Federal Communications Commission (FCC) Interference Statement

This device complies with Part 15 of FCC rules. Operation is subject to the following two conditions:
This device may not cause harmful interference.
This device must accept any interference received, including interference that may cause undesired

operations.
This equipment has been tested and found to comply with the limits for a CLASS B digital device pursuant to

Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful
interference in a commercial environment. This equipment generates, uses, and can radiate radio frequency
energy, and if not installed and used in accordance with the instructions, may cause harmful interference to
radio communications.

If this equipment does cause harmful interference to radio/television reception, which can be determined by
turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of
the following measures:

Reorient or relocate the receiving antenna.
Increase the separation between the equipment and the receiver.
Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.
Consult the dealer or an experienced radio/TV technician for help.

Notice 1

Changes or modifications not expressly approved by the party responsible for compliance could void the
user's authority to operate the equipment.

Notice 2

Shielded RS-232 cables are required to be used to ensure compliance with FCC Part 15, and it is the
responsibility of the user to provide and use shielded RS-232 cables.

FCC Statement iii

P312 Broadband Security Gateway

Information for Canadian Users

The Industry Canada label identifies certifi ed equi pme nt. This certification means that the equipment meet s
certain telecommunications network protective, operation, and safety requirements. The Industry Canada
does not guarantee that the equipment will operate to a user's satisfaction.

Before installing this equipment, users should ensure that it is permissible to be connected to the facilities of
the local telecommunications company. The equipment must also be installed using an acceptable method
of connection. In some cases, the company's inside wiring associated with a single line individual service
may be extended by means of a certified connector assembly. The customer should be aware that the
compliance with the above conditions may not prevent degradation of service in some situations.

Repairs to certified equipment should be made by an authorized Canadian maintenance facility designated
by the supplier. Any repairs or alterations made by the user to this equipment, or equipment malfunctions,
may give the telecommunications company cause to request the user to disconnect the equipment.

For their own protection, users should ensure that the electrical ground connections of the power utility,
telephone lines, and internal metallic water pipe system, if present, are connected together. This precaution
may be particularly important in rural areas.

Caution

Users should not attempt to make such connectio ns themselves, but should contact the appropri ate
electrical inspection authority, or electrician, as appropriate.

Note

This digital apparatus does not exceed the class A limits for radio noise emissions from digital apparatus set
out in the radio interference regulations of Industry Canada.

iv

Canadian Users

P312 Broadband Security Gateway

Declaration of Conformity

We, the Manufacturer/Importer,

ZyXEL Communications Corp.

No. 6, Innovation Rd. II,

Science-Based Industrial Park,

Hsinchu, Taiwan, 300 R.O.C

declare that the product

Prestige 312

(reference to the specification under which conformity is declared)

is in conformity with

Standard

• EN 55022

• EN 61000-3-2

• EN 61000-3-3

• EN 61000-4-2

• EN 61000-4-3

• EN 61000-4-4

• EN 61000-4-5

• EN 61000-4-6

• EN 61000-4-8

• EN 61000-4-11

Standard Item

Radio disturbance characteristics – Limits and method of
measurement.

Disturbance in supply system caused by household appliances
and similar electrical equipment “Harmonics”.

Disturbance in supply system caused by household appliances
and similar electrical equipment “Voltage fluctuations”.

Electrostatic discharge immunity test – Basic EMC Publication 1995
Radiated, radio-frequency, electromagnetic field immunity test 1996
Electrical fast transient / burst immunity test - Basic EMC

Publication
Surge immunity test 1995
Immunity to conducted disturbances, induced by radio-frequency

fields

Voltage dips, short interruptions and voltage variations immunity
tests

Version

1994

1995

1995

1995

1996

1993
1994

Warranty

v

P312 Broadband Security Gateway

vi

CE Doc

P312 Broadband Security Gateway

ZyXEL Limited Warranty

ZyXEL warrants to the original end user (purchaser) that this product is free from any defects in materials or
workmanship for a period of up to two years from the date of purchase. During the warranty period, and upon
proof of purchase, should the product have indications of failure due to faulty workmanship and/or materials,
ZyXEL will, at its discretion, repair or replace the defective products or components without charge for either
parts or labor, and to whatever extent it shall deem necessary to restore the product or components to
proper operating condition. Any replacement will consist of a new or re-manufactured functionally equivalent
product of equal value, and will be solely at the discretion of ZyXEL. This warranty shall not apply if the
product is modified, misused, tampered with, damaged by an act of God, or subjected to abnormal working
conditions.

Note

Repair or replacement, as provided under this warranty, is the exclusive remedy of the purchaser. This
warranty is in lieu of all other warranties, express or implied, including any implied warranty of
merchantability or fitness for a particular use or purpose. ZyXEL shall in no event be held liable for indirect or
consequential damages of any kind of character to the purchaser.

To obtain the services of this warranty, contact ZyXEL's Service Center; refer to the separate Warranty Card
for your Return Material Authorization number (RMA). Products must be returned Postage Prepaid. It is
recommended that the unit be insured when shipped. Any returned products without proof of purchase or
those with an out-dated warranty will be repaired or replaced (at the discretion of ZyXEL) and the customer
will be billed for parts and labor. All repaired or replaced products will be shipped by ZyXEL to the
corresponding return address, Postage Paid (USA and territories only). If the customer desires some other
return destination beyond the U.S. borders, the customer shall bear the cost of the return shipment. This
warranty gives you specific legal rights, and you may also have other rights that vary from state to state.

Please register your Prestig e (fast , eas y online reg ist rat io n at www.zyxel.com) for free
product updates and information.

Warranty

vii

P312 Broadband Security Gateway

Customer Support

When you contact your customer support representative please have the following information ready:

♦

Prestige Model and serial number.

♦ Information in Menu 24.2.1 –System Information.
♦ Warranty Information.
♦ Date you received your Prestige.
♦ Brief description of the problem and the steps you took to solve it

Method

Region

Worldwide

North

America

EMAIL – Support Telephone Web Site

EMAIL – Sales Fax FTP Site

[e-mail]
[e-mail]

[e-mail] [phone] ftp.europe.zyxel.com
[e-mail] [phone]

[e-mail] [phone] ftp.zyxel.com

[phone] www.zyxel.com

www.europe.zyxel.com

www.zyxel.com

800-255-4101

Regular Mail

ZyXEL Communications

Corp., 6 Innovation Road II,

Science-Based Industrial

Park, HsinChu, Taiwan.

ZyXEL Communications Inc.,

1650 Miraloma Avenue,

Placentia, CA 92870, U.S.A.

Scandinavia

Austria

Germany

viii

[e-mail] [phone] www.zyxel.dk
[e-mail] [phone] ftp.zyxel.dk
[e-mail] [phone]

[e-mail]

[e-mail]

[e-mail] [phone] ftp.europe.zyxel.com

0810-1-ZyXEL
0810-1-99935

[phone]

[phone]
0180-5213247

Tech Support hotline

0180-5099935

RMA/Repair hotline

www.zyxel.at

ftp.zyxel.at

Note: for Austrian users with *.at
domain only!

www.zyxel.de

ZyXEL Communications A/S,

Columbusvej 5, 2860

Soeborg, Denmark.

ZyXEL Communications

Services GmbH.,

Thaliastrasse 125a/ 2/2/ 4,

A-1160 Vienna, Austria

ZyXEL Deutschland GmbH.,

Adenauerstr. 20/A4, D-5 214 6

Wuerselen, German y.

Customer Support

P312 Broadband Security Gateway

Table of Contents

Table of Contents........................................................................................................................... ix

List of Figures ...............................................................................................................................xvi

List Of Tables..............................................................................................................................xxiii

Customer Support.........................................................................................................................viii

Preface.......................................................................................................................................xxvii

Getting Started...................................................................................................................................I

Chapter 1 Getting to Know Your Prestige......................................................................................1-1

1.1 The Prestige 312 Broadband Security Gateway......................................................................... 1-1

1.2 Features of The Prestige 312...................................................................................................... 1-1

1.3 Applications for Prestige 312..................................................................................................... 1-3

1.3.1 Broadband Internet Access via Cable or xDSL Modem.....................................................1-3

Chapter 2 Hardware Installation & Initial Setup.............................................................................2-1

2.1 Front Panel LEDs and Back Panel Ports.................................................................................... 2-1

2.1.1 Front Panel LEDs............................................................................................................... 2-1

2.2 Prestige 312 Rear Panel and Connections .................................................................................. 2-2

2.3 Additional Installation Requirements.........................................................................................2-3

2.4 Housing ...................................................................................................................................... 2-4

2.5 Power Up Your Prestige............................................................................................................. 2-4

2.6 Navigating the SMT Interface.................................................................................................... 2-5

2.6.1 Main Menu......................................................................................................................... 2-6

2.6.2 System Management Terminal Interface Summary ........................................................... 2-6

2.7 Changing the System Password..................................................................................................2-7

2.7.1 Resetting the Prestige......................................................................................................... 2-7

2.8 General Setup............................................................................................................................. 2-8

2.8.1 Dynamic DNS .................................................................................................................... 2-8

2.8.2 Configuring Dynamic DNS................................................................................................ 2-9

2.9 WAN Setup .............................................................................................................................. 2-10

2.10 LAN Setup................................................................................................................................ 2-11

Table Of Contents ix

P312 Broadband Security Gateway

2.10.1 LAN Port Filter Setup.......................................................................................................2-12

Chapter 3 Internet Access.............................................................................................................3-1

3.1 TCP/IP and DHCP for LAN .......................................................................................................3-1

3.1.1 Factory LAN Defaults......................................................................................................... 3-1

3.1.2 IP Address and Subnet Mask ..............................................................................................3-1

3.1.3 Private IP Addresses ...........................................................................................................3-2

3.1.4 RIP Setup ............................................................................................................................3-2

3.1.5 DHCP Configuration...........................................................................................................3-3

3.1.6 IP Multicast.........................................................................................................................3-3

3.1.7 IP Alias................................................................................................................................3-4

3.2 TCP/IP and DHCP Ethernet Setup..............................................................................................3-4

3.2.1 IP Alias Setup......................................................................................................................3-7

3.3 Internet Access Setup..................................................................................................................3-8

3.3.1 Ethernet Encapsulation........................................................................................................3-8

3.3.2 PPTP Encapsulation............................................................................................................3-9

3.3.3 Configuring the PPTP Client.............................................................................................3-10

3.3.4 PPPoE Encapsulation........................................................................................................3-10

3.4 Basic Setup Complete...............................................................................................................3-12

Advanced Applications ....................................................................................................................II

Chapter 4 Remote Node Setup .....................................................................................................4-1

4.1 Remote Node Profile...................................................................................................................4-1

4.1.1 Ethernet Encapsulation........................................................................................................4-1

4.1.2 PPPoE Encapsulation..........................................................................................................4-3

4.1.3 PPTP Encapsulation............................................................................................................4-4

4.2 Editing TCP/IP Options (with Ethernet Encapsulation)..............................................................4-6

4.2.1 Editing TCP/IP Options (with PPTP Encapsulation)..........................................................4-7

4.2.2 Editing TCP/IP Options (with PPPoE Encapsulation)........................................................4-9

4.3 Remote Node Filter.....................................................................................................................4-9

Chapter 5 IP Static Route Setup ...................................................................................................5-1

5.1 IP Static Route Setup ..................................................................................................................5-2

Chapter 6

x

Network Address Translation (NAT).............................................................................6-1

6.1 Introduction.................................................................................................................................6-1

6.1.1 NAT Definitions..................................................................................................................6-1

6.1.2 What NAT Does..................................................................................................................6-1

6.1.3 How NAT works.................................................................................................................6-2

Table Of Contents

P312 Broadband Security Gateway

6.1.4 NAT Mapping Types..........................................................................................................6-2

6.1.5 SUA (Single User Account) Versus NAT.......................................................................... 6-3

6.1.6 NAT Application................................................................................................................ 6-4

6.2 SMT Menus ................................................................................................................... ............. 6-4

6.2.1 Applying NAT in the SMT Menus..................................................................................... 6-4

6.2.2 Configuring NAT............................................................................................................... 6-6

Address Mapping Sets and NAT Server Sets:.................................................................................... 6-6

6.3 NAT Server Sets....................................................................................................................... 6-11

6.3.1 Multiple Servers behind NAT .......................................................................................... 6-11

6.3.2 Configuring a Server behind NAT ................................................................................... 6-12

6.4 Examples.................................................................................................................................. 6-13

6.4.1 Internet Access Only........................................................................................................ 6-13

6.4.2 Example 2 – Internet Access with an Inside Server......................................................... 6-15

6.4.3 Example 3 – General Case................................................................................................6-15

6.4.4 Example 4 –NAT Unfriendly Application Programs....................................................... 6-19

Advanced Management...................................................................................................................III

Chapter 7 Filter Configuration .......................................................................................................7-1

7.1 About Filtering........................................................................................................................... 7-1

7.1.1 The Filter Structure of the Prestige..................................................................................... 7-2

7.2 Configuring a Filter Set.............................................................................................................. 7-4

7.2.1 Filter Rules Summary Menu............................................................................................... 7-6

7.2.2 Configuring a Filter Rule....................................................................................................7-7

7.2.3 TCP/IP Filter Rule.............................................................................................................. 7-7

7.2.4 Generic Filter Rule........................................................................................................... 7-12

7.3 Example Filter..........................................................................................................................7-14

7.4 Filter Types and NAT............................................................................................................... 7-16

7.5 Firewall.....................................................................................................................................7-17

7.6 Applying a Filter and Factory Defaults.................................................................................... 7-17

7.6.1 LAN traffic....................................................................................................................... 7-17

7.6.2 Remote Node Filters......................................................................................................... 7-18

Chapter 8

Chapter 9

Table Of Contents xi

SNMP Configuration.....................................................................................................8-1

8.1 About SNMP.............................................................................................................................. 8-1

8.2 Configuring SNMP.....................................................................................................................8-1

System Information & Diagnosis ..................................................................................9-1

P312 Broadband Security Gateway

9.1 System Status..............................................................................................................................9-2

9.2 System Information and Console Port Speed..............................................................................9-4

9.2.1 System Information.............................................................................................................9-4

9.2.2 Console Port Speed.............................................................................................................9-5

9.3 Log and Trace.............................................................................................................................9-5

9.3.1 Viewing Error Log..............................................................................................................9-6

9.3.2 UNIX Syslog............................................................................................................... ........9-6

9.3.3 Call-Triggering Packet......................................................................................................9-10

9.4 Diagnostic.................................................................................................................................9-10

9.4.1 WAN DHCP .....................................................................................................................9-11

Chapter 10 Transferring Files ......................................................................................................10-1

10.1 Filename conventions................................................................................................................10-1

10.1.1 Firmware Development.....................................................................................................10-2

10.2 Backup Configuration...............................................................................................................10-2

10.3 Restore Configuration...............................................................................................................10-3

10.4 Upload Firmware ......................................................................................................................10-3

10.4.1 Uploading the Router Firmware........................................................................................10-3

10.4.2 Uploading Router Configuration File................................................................................10-4

10.5 TFTP File Transfer....................................................................................................................10-5

10.5.1 Example TFTP Command.................................................................................................10-6

10.6 FTP File Transfer......................................................................................................................10-7

10.6.1 Using the FTP command from the DOS Prompt...............................................................10-8

Chapter 11 System Maintenance & Information..........................................................................11-1

11.1 Command Interpreter Mode......................................................................................................11-1

11.2 Call Control Support.................................................................................................................11-2

11.2.1 Budget Management .........................................................................................................11-2

11.2.2 Call History.......................................................................................................................11-3

11.3 Time and Date Setting...............................................................................................................11-4

11.3.1 How often does the Prestige update the time?...................................................................11-4

11.4 Remote Management Setup ......................................................................................................11-6

11.5 Boot Commands........................................................................................................................11-7

Chapter 12 Telnet Configuration and Capabilities .......................................................................12-1

12.1 About Telnet Configuration...................................................................................................... 12-1

xii

Table Of Contents

P312 Broadband Security Gateway

12.2 Telnet Under NAT.................................................................................................................... 12-1

12.3 Telnet Capabilities.................................................................................................................... 12-1

12.3.1 Single Administrator ........................................................................................................ 12-1

12.3.2 System Timeout................................................................................................................ 12-2

12.4 Telnet Under the Firewall......................................................................................................... 12-2

Firewall and Content Filters............................................................................................................IV

Chapter 13 What is a Firewall......................................................................................................13-1

13.1 Types of Firewalls.................................................................................................................... 13-1

13.1.1 Packet Filtering Firewalls.................................................................................................13-1

13.1.2 Application-level Firewalls .............................................................................................. 13-1

13.1.3 Stateful Inspection firewalls............................................................................................. 13-2

13.2 Introduction to ZyXEL’s Firewall............................................................................................ 13-2

13.3 Denial of Service...................................................................................................................... 13-3

13.3.1 Basics................................................................................................................................13-3

13.3.2 Types of DoS attacks........................................................................................................ 13-4

13.4 Stateful Inspection.................................................................................................................... 13-6

13.4.1 Stateful Inspection Process............................................................................................... 13-7

13.4.2 Stateful Inspection & the Prestige.................................................................................... 13-8

13.4.3 TCP Security ....................................................................................................................13-8

13.4.4 UDP/ICMP Security......................................................................................................... 13-9

13.4.5 Upper Layer Protocols...................................................................................................... 13-9

13.5 Guidelines For Enhancing Security With Your Firewall..........................................................13-9

13.5.1 Security In General......................................................................................................... 13-10

Chapter 14

Introducing the Prestige Firewall ..............................................................................14-1

14.1 SMT Menus .................................................................................................................. ............ 14-1

14.1.1 View Firewall Log............................................................................................................ 14-2

14.1.2 Attack Types..................................................................................................................... 14-2

14.2 The Big Picture – Filtering, Firewall and NAT........................................................................ 14-5

14.3 Packet Filtering Vs Firewall..................................................................................................... 14-6

14.3.1 Packet Filtering:................................................................................................................14-6

14.3.2 Firewall:............................................................................................................................14-7

Chapter 15

15.1 Web Configurator Login and Welcome Screens...................................................................... 15-1

15.2 Enabling the Firewall ............................................................................................................... 15-2

Table Of Contents xiii

Introducing the Prestige Web Configurator...............................................................15-1

P312 Broadband Security Gateway

15.3 E-Mail.......................................................................................................................................15-3

15.3.1 What are Alerts?................................................................................................................15-3

15.3.2 What are Logs? .................................................................................................................15-4

15.3.3 SMTP Error Messages ......................................................................................................15-6

15.3.4 Example E-Mail Log......................................................................................................... 15-6

15.4 Attack Alert...............................................................................................................................15-7

15.4.1 Threshold Values: .............................................................................................................15-8

15.4.2 Half-Open Sessions ...........................................................................................................15-8

Chapter 16

16.1 Rules Overview.........................................................................................................................16-1

16.2 Rule Logic Overview................................................................................................................16-1

16.3 Connection Direction................................................................................................................16-3

16.4 Services Supported....................................................................................................................16-4

16.5 Rule Summary...........................................................................................................................16-6

16.6 Timeout...................................................................................................................................16-12

Chapter 17

Creating Custom Rules.............................................................................................16-1

16.2.1 Rule Checklist...................................................................................................................16-1

16.2.2 Security Ramifications......................................................................................................16-2

16.2.3 Key Fields For Configuring Rules....................................................................................16-2

16.3.1 LAN to WAN Rules..........................................................................................................16-3

16.3.2 WAN to LAN Rules..........................................................................................................16-3

16.5.1 Creating/Editing Firewall Rules........................................................................................16-8

16.5.2 Source & Destination Addresses.....................................................................................16-10

16.6.1 Factors Influencing Choices for Timeout Values:...........................................................16-12

Custom Ports ............................................................................................................17-1

17.1 Introduction...............................................................................................................................17-1

17.2 Creating/Editing A Custom Port...............................................................................................17-2

Chapter 18

18.1 Log Screen................................................................................................................................18-1

Chapter 19 Example Firewall Rules ............................................................................................19-1

19.1 Examples...................................................................................................................................19-1

Chapter 20

xiv

Logs ..........................................................................................................................18-1

19.1.1 Example 1 - Firewall Rule To Allow Web Service From The Internet.............................19-1

19.1.2 Example 2 – Small Office With Mail, FTP and Web Servers...........................................19-6

19.1.3 Example 3: DHCP Negotiation and Syslog Connection from the Internet .....................19-11

Content Filtering........................................................................................................20-1

Table Of Contents

P312 Broadband Security Gateway

20.1 Restrict Web Features...............................................................................................................20-1

20.1.1 ActiveX ............................................................................................................................20-1

20.1.2 Java................................................................................................................................... 20-1

20.1.3 Cookies............................................................................................................................. 20-2

20.1.4 Web Proxy........................................................................................................................ 20-2

20.2 Blocking URLs......................................................................................................................... 20-2

20.3 Content Filtering Using the PWC............................................................................................. 20-2

Troubleshooting, Appendices, Glossary and Index......................................................................V

Chapter 21 Troubleshooting ........................................................................................................21-1

21.1 Problems Starting Up the Prestige............................................................................................ 21-1

21.2 Problems with the LAN Interface............................................................................................. 21-2

21.3 Problems with the WAN interface............................................................................................21-2

21.4 Problems with Internet Access................................................................................................. 21-3

21.5 Problems with the Firewall....................................................................................................... 21-3

Appendix A PPPoE ......................................................................................................................E

Appendix B PPTP ......................................................................................................................G

Appendix C Hardware Specifications............................................................................................I

Appendix D Important Safety Instructions....................................................................................J

Appendix E Firewall CLI Commands...........................................................................................K

Appendix F Power Adapter Specs...............................................................................................P

Glossary of Terms.......................................................................................................................... R

Index............................................................................................................................................CC

Table Of Contents xv

P312 Broadband Security Gateway

List of Figures

Figure 1-1 Secure Internet Access via Cable............................................................................................1-3

Figure 1-2 Secure Internet Access via DSL..............................................................................................1-4

Figure 2-1 Front Panel.............................................................................................................................2-1

Figure 2-2 Prestige 312 Rear Panel and Connections...............................................................................2-2

Figure 2-3 Initial Screen ...........................................................................................................................2-4

Figure 2-4 P assword Screen .....................................................................................................................2-5

Figure 2-5 Prestige 312 Main Menu........................................................................................................2-6

Figure 2-6 Menu 23 - System Security.....................................................................................................2-7

Figure 2-7 Menu 1 – General Setup..........................................................................................................2-8

Figure 2-8 Configure Dynamic DNS........................................................................................................2-9

Figure 2-9 Menu 2 – WAN Setup...........................................................................................................2-11

Figure 2-10 Menu 3 - LAN Setup.............................................................................................................2-12

Figure 2-11 Menu 3.1 – LAN Port Filter Setup........................................................................................2-12

Figure 3-1 Physical Network....................................................................................................................3-4

Figure 3-2 Partitioned Logical Networks .................................................................................................3-4

Figure 3-3 Menu 3 - LAN Setup (10/100 Mbps Ethernet) .......................................................................3-5

Figure 3-4 Menu 3.2 – TCP/IP and DHCP Ethernet Setup ......................................................................3-5

Figure 3-5 Menu 3.2.1 - IP Alias Setup....................................................................................................3-7

Figure 3-6 Menu 4 – Internet Access Setup (Ethernet) ............................................................................3-8

Figure 3-7 Internet Access Setup (PPTP)...............................................................................................3-10

Figure 3-8 Internet Access Setup (PPPoE).............................................................................................3-11

Figure 4-1 Menu 11.1 Remote Node Profile for Ethernet Encapsulation.................................................4-1

Figure 4-2 Menu 11.1 Remote Node Profile for PPPoE Encapsulation ...................................................4-3

Figure 4-3 Remote Node Profile for PPTP Encapsulation .......................................................................4-5

Figure 4-4 Remote Node Network Layer Options...................................................................................4-6

xvi List Of Figures

P312 Broadband Security Gateway

Figure 4-5 Remote Node Network Layer Options.................................................................................. 4-8

Figure 4-6 Remote Node Filter (Ethernet Encapsulation)...................................................................... 4-10

Figure 4-7 Remote Node Filter (PPPoE or PPTP Encapsulation).......................................................... 4-10

Figure 5-1 Example of Static Routing Topology..................................................................................... 5-1

Figure 5-2 Menu 12 - IP Static Route Setup............................................................................................ 5-2

Figure 5-3 Menu 12. 1 - Edit IP Static Route .......................................................................................... 5-2

Figure 6-1 How NAT Works................................................................................................................... 6-2

Figure 6-2 NAT Application .................................................................................................................... 6-4

Figure 6-3 Applying NAT for Internet Access......................................................................................... 6-5

Figure 6-4 Applying NAT to the Remote Node.......................................................................................6-5

Figure 6-5 Menu 15 NAT Setup............................................................................................................... 6-6

Figure 6-6 Menu 15.1 Address Mapping Sets ......................................................................................... 6-7

Figure 6-7 SUA Address Mapping Rules................................................................................................ 6-7

Figure 6-8 First Set in Menu 15.1.1......................................................................................................... 6-9

Figure 6-9 Editing an Individual Rule in a Set...................................................................................... 6-10

Figure 6-10 Multiple Servers Behind NAT.............................................................................................. 6-12

Figure 6-11 Menu 15.2 – NAT Server Setup ........................................................................................... 6-13

Figure 6-12 NAT Example 1................................................................................................................... 6-14

Figure 6-13 Internet Access & NAT Example........................................................................................ 6-14

Figure 6-14 NAT Example 2................................................................................................................... 6-15

Figure 6-15 Specifying an Inside Sever.................................................................................................. 6-15

Figure 6-16 NAT - Example 3 ................................................................................................................ 6-16

Figure 6-17 Example 3 – Menu 11.3 ...................................................................................................... 6-17

Figure 6-18 Example 3 – Menu 15.1.1.1................................................................................................ 6-17

Figure 6-19 Example 3 Final Menu 15.1.1............................................................................................. 6-18

Figure 6-20 Example 3 – Menu 15.2...................................................................................................... 6-18

Figure 6-21 NAT Example 4.................................................................................................................... 6-19

List Of Figures xvii

P312 Broadband Security Gateway

Figure 6-22 Example 4- Menu 15.1.1.1 - Address Mapping Rule............................................................6-20

Figure 6-23 Example 4 - Menu 15.1.1 - Address Mapping Rules............................................................6-20

Figure 7-1 Outgoing Packet Filtering Process..........................................................................................7-1

Figure 7-2 Filter Rule Process..................................................................................................................7-3

Figure 7-4 Menu 21 – Filter and Firewall Setup.......................................................................................7-4

Figure 7-5 Menu 21.1 - Filter Set Configuration......................................................................................7-4

Figure 7-6 NetB IOS_WAN Filter Rules Summary...................................................................................7-5

Figure 7-7 NetBIOS _LAN Filter Rules Summary ..................................................................................7-5

Figure 7-8 TEL_FTP_WEB_WAN Filter Rules Summary ......................................................................7-5

Figure 7-9 Menu 21.1.1.1 - TCP/IP Filter Rule........................................................................................7-8

Figure 7-10 Executing an IP Filter ...........................................................................................................7-11

Figure 7-11 Menu 21.4.1.1 - Generic Filter Rule.....................................................................................7-12

Figure 7-12 Telnet Filter Example............................................................................................................7-14

Figure 7-13 Example Filter – Menu 21.1.1.1 ...........................................................................................7-15

Figure 7-14 Example Filter Rules Summary – Menu 21.1.3....................................................................7-16

Figure 7-15 Protocol and Device Filter Sets.............................................................................................7-17

Figure 7-16 Filtering LAN Traffic............................................................................................................7-18

Figure 7-17 Filtering Remote Node Traffic..............................................................................................7-18

Figure 8-1 Menu 22 - SNMP Configuration.............................................................................................8-1

Figure 9-1 Menu 24 - System Maintenance..............................................................................................9-1

Figure 9-2 Menu 24.1 - System Maintenance – Status.............................................................................9-2

Figure 9-3 Menu 24.2 – System Information and Console Port Speed....................................................9-4

Figure 9-4 Menu 24.2.1 System Maintenance - Information....................................................................9-4

Figure 9-5 Menu 24.2.2 – System Maintenance – Change Console Port Speed.....................................9-5

Figure 9-6 Examples of Error and Information Messages........................................................................9-6

Figure 9-7 Examples of Error and Information Messages........................................................................9-6

Figure 9-8 Menu 24.3.2 - System Maintenance – UNIX Syslog..............................................................9-7

xviii List Of Figures

P312 Broadband Security Gateway

Figure 9-9 Call-Triggering Packet Example.......................................................................................... 9-10

Figure 9-10 Menu 24.4 - System Maintenance - Diagnostic....................................................................9-11

Figure 9-11 WAN & LAN DHCP............................................................................................................ 9-12

Figure 10-1 Menu 24.5 - System Maintenance - Backup Configuration ................................................. 10-2

Figure 10-2 Menu 24.6 - System Maintenance - Restore Configuration................................................. 10-3

Figure 10-3 Menu 24.7 - System Maintenance - Upload Firmware......................................................... 10-3

Figure 10-4 Menu 24.7.1 - System Maintenance - Upload Router Firmware.......................................... 10-4

Figure 10-5 Menu 24.7.2 - System Maintenance - Upload Router Configuration File............................ 10-5

Figure 10-6 Telnet into Menu 24.7.1 ....................................................................................................... 10-7

Figure 10-7 Telnet into Menu 24.7.2 - System Maintenance................................................................... 10-8

Figure 10-8 FTP Session Example........................................................................................................... 10-9

Figure 11-1 Command Mode in Menu 24.................................................................................................11-1

Figure 11-2 Valid Commands ...................................................................................................................11-1

Figure 11-3 Call Control...........................................................................................................................11-2

Figure 11-4 Budget Management ............................................................................................................11-2

Figure 11-5 Call History..........................................................................................................................11-3

Figure 11-6 System Maintenance – Time and Date Setting.....................................................................11-5

Figure 11-7 Menu 24.11 - Remote Management Control.........................................................................11-6

Figure 11-8 Option to Enter Debug Mode................................................................................................11-7

Figure 11-9 Boot Module Commands ......................................................................................................11-8

Figure 12-1 Telnet Configuration on a TCP/IP Network......................................................................... 12-1

Figure 13-1 Prestige Firewall Application............................................................................................... 13-3

Figure 13-2 Three-Way Handshake......................................................................................................... 13-4

Figure 13-3 SYN Flood ........................................................................................................................... 13-5

Figure 13-4 Smurf Attack........................................................................................................................ 13-6

Figure 13-5 Stateful Inspection................................................................................................................ 13-7

Figure 14-1 SMT Main Menu.................................................................................................................. 14-1

List Of Figures xix

P312 Broadband Security Gateway

Figure 14-2 Menu 21 - Filter and Firewall Setup.....................................................................................14-1

Figure 14-3 Menu 21.2 – Firewall Setup..................................................................................................14-2

Figure 14-4 View Firewall Log ................................................................................................................14-4

Figure 14-5 Big Picture - Filtering, Firewall and NAT.............................................................................14-6

Figure 15-1 Login screen as seen in Netscape.......................................................................................... 15-1

Figure 15-2 Prestige Web Configurator Welcome Screen ........................................................................15-2

Figure 15-3 Enabling the Firewall............................................................................................................15-3

Figure 15-4 E-Mail Screen .......................................................................................................................15-4

Figure 15-5 E-Mail Log............................................................................................................................15-7

Figure 15-6 Attack Alert...........................................................................................................................15-9

Figure 16-1 LAN to WAN Traffic............................................................................................................ 16-3

Figure 16-2 WAN to LAN Traffic............................................................................................................ 16-4

Figure 16-3 Firewall Rules Summary – First Screen................................................................................16-6

Figure 16-4 Creating/Editing A Firewall Rule.........................................................................................16-9

Figure 16-5 Adding/Editing Source & Destination Addresses...............................................................16-11

Figure 16-6 Timeout Screen...................................................................................................................16-13

Figure 17-1 Custom Ports.........................................................................................................................17-1

Figure 17-2 Creating/Editing A Custom Port........................................................................................... 17-3

Figure 18-1 Log Screen............................................................................................................................18-1

Figure 19-1 Activate The Firewall............................................................................................................19-2

Figure 19-2 Example 1 – E-Mail Screen..................................................................................................19-3

Figure 19-3 Example 1 – Configuring A Rule.......................................................................................... 19-4

Figure 19-4 Example 1: Destination Address for Traffic Originating From The Internet........................19-5

Figure 19-5 Example 1 - Rule Summary Screen......................................................................................19-6

Figure 19-6 Send Alerts When Attacked..................................................................................................19-7

Figure 19-7 Configuring A POP Custom Port..........................................................................................19-8

Figure 19-8 Example 2 - Local Network Rule 1 Configuration...............................................................19-9

xx List Of Figures

P312 Broadband Security Gateway

Figure 19-9 Example 2 - Local Network Rule Summary.................................................................. 19-10

Figure 19-10 Example 2 - Internet to Local Network Rule Summary..................................................19-11

Figure 19-11 Custom Port for Syslog.................................................................................................. 19-12

Figure 19-12 Syslog Rule Configuration............................................................................................. 19-13

Figure 19-13 Example 3 Rule Summary.............................................................................................. 19-14

Figure 20-1 Content Filtering Screen.................................................................................................... 20-3

List Of Figures xxi

P312 Broadband Security Gateway

List Of Tables

Table 2- 1 LED functions ........................................................................................................................2-1

Table 2- 2 Main Menu Commands.......................................................................................................... 2-5

Table 2-3 Main Menu Summary............................................................................................................. 2-6

Table 2-4 General Setup Menu Field...................................................................................................... 2-9

Table 2-5 Configure Dynamic DNS Menu Fields ................................................................................2-10

Table 2-6 WAN Setup Menu Fields...................................................................................................... 2-11

Table 3-1 LAN DHCP Setup Menu Fields.............................................................................................. 3-6

Table 3-2 LAN TCP/IP Setup Menu Fields............................................................................................ 3-6

Table 3-3 IP Alias Setup Menu Fields.................................................................................................... 3-7

Table 3-4 Internet Access Setup Menu Fields ........................................................................................3-9

Table 3-5 New Fields in Menu 4 (PPTP) screen .................................................................................... 3-10

Table 3-6 New Fields in Menu 4 (PPPoE) screen ..................................................................................3-12

Table 4-1 Fields in Menu 11.1.................................................................................................................. 4-2

Table 4-2 Fields in Menu 11.1 (PPPoE Encapsulation Specific).............................................................. 4-4

Table 4-3 Fields in Menu 11.1 (PPTP Encapsulation)............................................................................. 4-5

Table 4-4 Remote Node Network Layer Options Menu Fields............................................................... 4-6

Table 4-5 Remote Node Network Layer Options Menu Fields............................................................... 4-8

Table 5-1 IP Static Route Menu Fields................................................................................................... 5-3

Table 6-1 NAT Definitions...................................................................................................................... 6-1

Table 6-2 NAT Mapping Types ............................................................................................................... 6-3

Table 6-3 Applying NAT in Menus 4 & 11.3 ..........................................................................................6-6

Table 6-4 SUA Address Mapping Rules..................................................................................................6-8

Table 6-5 Menu 15.1.1............................................................................................................................. 6-9

Table 6-6 Menu 15.1.1.1 – configuring an individual rule.................................................................... 6-10

Table 6-7 Services & Port numbers...................................................................................................... 6-13

Table 7-1 Abbreviations Used in the Filter Rules Summary Menu........................................................ 7-6

List of Tables xxiii

P312 Broadband Security Gateway

Table 7-2 Abbreviations Used If Filter Type Is IP..................................................................................7-7

Table 7-3 Abbreviations Used If Filter Type Is GEN..............................................................................7-7

Table 7-4 TCP/IP Filter Rule Menu Fields..............................................................................................7-8

Table 7-5 Generic Filter Rule Menu Fields...........................................................................................7-13

Table 8-1 SNMP Configuration Menu Fields .........................................................................................8-2

Table 9-1 System Maintenance - Status Menu Fields .............................................................................9-3

Table 9-2 Fields in System Maintenance.................................................................................................9-5

Table 9-3 System Maintenance Menu Syslog Parameters.......................................................................9-7

Table 9-4 System Maintenance Menu Diagnostic.................................................................................9-12

Table 10- 1 Filename Conventions...........................................................................................................10-2

Table 10-2 Third Party TFTP Clients –General fields.............................................................................10-6

Table 10-3 Third Party FTP Clients –General fields...............................................................................10-9

Table 11-1 Budget Management .............................................................................................................11-3

Table 11-2 Call History Fields ................................................................................................................11-4

Table 11-3 Time and Date Setting Fields................................................................................................11-5

Table 11-4 Menu 24.11 - Remote Management Control.........................................................................11-7

Table 13-1 Common IP Ports..................................................................................................................13-4

Table 14-1 ICMP Commands That Trigger Alerts..................................................................................14-3

Table 14-2 Legal NetBIOS Commands...................................................................................................14-3

Table 14-3 Legal SMTP Commands.......................................................................................................14-3

Table 14-4 View Firewall Log.................................................................................................................14-5

Table 15- 1 E-Mail...................................................................................................................................15-5

Table 15- 2 SMTP Error Messages ..........................................................................................................15-6

Table 15- 3 Attack Alert.........................................................................................................................15-10

Table 16- 1 Services Supported................................................................................................................16-5

Table 16-2 Firewall Rules Summary – First Screen................................................................................16-7

Table 16-3 Creating/Editing A Firewall Rule..........................................................................................16-9

Table 16-4 Adding/Editing Source & Destination Addresses...............................................................16-11

xxiv List of Tables

P312 Broadband Security Gateway

Table 16- 5 Timeout Menu.................................................................................................................... 16-14

Table 17- 1 Custom Ports ........................................................................................................................ 17-2

Table 17-2 Creating/Editing A Custom Port........................................................................................... 17-4

Table 18- 1 Log Screen............................................................................................................................ 18-2

Table 20-1 Content Filtering Fields........................................................................................................ 20-3

Table 21-1 Troubleshooting the Start-Up of your Prestige..................................................................... 21-1

Table 21-2 Troubleshooting the LAN Interface...................................................................................... 21-2

Table 21-3 Troubleshooting the WAN interface.....................................................................................21-2

Table 21- 4 Troubleshooting Internet Access.......................................................................................... 21-3

List of Tables xxv

P312 Broadband Security Gateway

Preface

About Your Router

Congratulations on your purchase of the Prestige 312 Broadband Security Gateway.

Don’t forget to register your Prestige (fast, easy online registration at www.zyxel.com) for
free future product updates and information.

The Prestige 312 is a dual Ethernet Broadband Security Gateway integrated with robust firewall solutions
and network management features that allows access to the Internet via Cable/ADSL modem or broadband
router. It is designed for:

!

Home offices and small businesses with Cable, xDSL and wireless modem via Ethernet port as Internet
access media.

!

Multiple office/department connections via access devices.

!

E-commerce/EDI applications.
Your Prestige 312 is easy to install and to configure.
The Prestige Web Configurator (PWC) is a web-based utility that allows you to access the Prestige’s
manageme nt settings and configur e the firewa ll. Most functions of the Prestige 312 are also software
configurable via the SMT (System Management Terminal) interface. The SMT is a menu-driven interface
that you can access from a terminal emulator through the console port or over a telnet connection.

Note: You can configure most features of the P312 via SMT but we recommend you

configure the firewall using the Prestige Web Configurator.

About This User's Manual

This manual is designed to guide you through the SMT configuration of your Prestige 312 for its various
applications.

Structure of this Manual

This manual is structured as follows:
Part I. Getting Started (Chapters 1-3) is structured as a step-by-step guide to help you connect, install

and setup your Prestige to operate on your network and access the Internet.
Part II. Advanced Applications (Chapters 4 - 6) describe the advanced applications of your Prestige,

such as Remote Node Setup IP Static routes and NAT.
Part III. Advanced Management (Chapters 7 - 12) provides information on Prestige Filtering, System

Information and Diagnosis, Transferring Files and Telnet.
Part IV. Firewall (Chapters 13 - 20) describes types of firewalls, how to configure your Prestige firewall

using the Prestige Web Configurator, as well as types of Denial of Services (DoS) attacks and Content

Filtering.
Part V. Troubleshooting (Chapter 21) provides information about solving common problems as well as

some Appendices, a Glossary and an Index.

Preface xxvii

P312 Broadband Security Gateway

Regardless of your particular application, it is important that you follow the steps outlined in Chapters 1-2 to
connect your Prestige to your LAN. You can then refer to the appropriate chapters of the manual, depending
on your applications.

Related Documentation

"

Supporting CD

More detailed information about the Prestige and examples of its use can be found in our included
disk (as well as on the zyxel.com web site). This CD contains information on config urin g your
Prestige for Internet Access, a General FAQ, an Advanced FAQ, Applications Notes,
Troubleshooting, Reference CI Commands as well as bundled software.

" Read Me First

Our Read Me Fir s t is designed to help you get your Pr estige up and running rig ht away. It contains a
detailed easy to follow connection diagram, Prestige default settings, handy checklists, information
on setting up your PC, and information on configuring your Prestige for Internet access.

"

Packing List Card

Finally, you should have a Packing List Card, which lists all items that should have come with your
Prestige.

" ZyXEL Web and FTP Server Sites

You can access release notes for firmware upgrades and other information at ZyXEL web and FTP
server sites. Refer to the Customer Support page in this User’s Guide for more information.

Syntax Conventions

• “Enter” means for you to type one or more characters and press the carriage return. “Select” or

“Choose” means for you to select one from the predefined choices.

• The SMT menu titles and labels are in Bold Times font. The choices of a menu item are in Bold Arial
font. A single keystroke is in Arial font and enclosed in square brackets, for instance, [ENTER] means
the Enter, or carriage return, key; [ESC] means the Escape key.

• For brevity’s sake, we will use “e.g.” as a shorthand for “for instance” and “i.e.” for “that is” or “in other
words” throughout this manual.

xxviii Preface

Getting Started

Part I:

Getting Started

Chapters 1-3 are structured as a step-by-step guide to help you connect, install and setup your

Prestige to operate on your network and access the Internet.

I

P312 Broadband Security Gateway

Chapter 1

Getting to Know Your Prestige

This chapter introduces the main features and applications of the Prestige.

1.1 The Prestige 312 Broadband Security Gateway

The Prestige 312 is a dual Ethernet Broadband Security Gateway integrated with a robust firewall and
network management features designed for home offices and small businesses to access the Internet via
Cable/ADSL modem or broadband router. By integrating NAT and firewall capability, ZyXEL’s Prestige
312 provides not only ease of installation and Internet access, but also a complete security solution to protect
your Intranet and efficiently manage data traffic on your network. The Prestige Web Configurator is a breeze
to operate and totally independent of the operating system platform you use.

1.2 Features of The Prestige 312

The following are the essential features of the Prestige 312.

Firewall

Firewall with Stateful Inspection and DoS (Denial of Service) protection. By default, when the firewall is
activated all incoming traffic from the WAN to the LAN is blocked. The Prestige firewall supports TCP/UDP
inspection, DoS (Denial of Services) detection and prevention, real time alerts, reports and logs.

Note: You can configure most features of the P312 via SMT but we recommend you

configure the firewall and Content Filters using the Prestige Web Configurator.

Content Filtering

The Prestige can block web features such as ActiveX controls, Java applets, cookies as well as disable web
proxies. The Prestige can also block specific URLs by using the keyword feature.

Packet Filtering

The Packet Filtering mechanism blocks unwanted traffic from entering/leaving your network.

PPPoE

PPPoE facilitates the interaction of a host with a broadband modem to achieve access to high-speed data
networks via a familiar "dial-up networking" user interface.

PPTP Encapsulation

Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a
remote client to a private server, creating a Virtual Private Network (VPN) using a TCP/IP-based network.
PPTP supports on-demand, multi-protocol, and virtual private networking over public networks, such as the
Internet. The Prestige supports one PPTP server connection at any given time.

Getting to Know Your Prestige 1-1

P312 Broadband Security Gateway

Dynamic DNS Support

With Dynamic DNS support, you can have a static hostname alias for a dynamic IP address, allowing the
host to be more easily accessible from various locations on the Internet. You must register for this service
with a Dynamic DNS client to use this service.

IP Multicast

Traditionally, IP packets are transmitted in two ways - unicast or broadcast. Multicast is a third way to
deliver IP packets to a group of hosts. IGMP (Internet Group Management Protocol) is the protocol used to
support multicast groups. The latest version is version 2 (see RFC 2236). Both versions 1 and 2 are
supported by the Prestige.

IP Alias

IP Alias allows you to partition a physical network into logical networks over the same Ethernet interface.
The Prestige supports three logical LAN interfaces via its single physical Ethernet interface with the Prestige
itself as the gateway for each LAN network.

SNMP

SNMP (Simple Network Management Protocol) is a protocol used for exchanging management information
between network devices. SNMP is a member of TCP/IP protocol suite. Your Prestige supports SNMP agent
functionality, which allows a manager station to manage and monitor the Prestige through the network. The
Prestige supports SNMP version one (SNMPv1).

Auto-negotiating 10/100Mbps Ethernet

The LAN interface automatically detects if it’s on a 10 or a 100 Mbps Ethernet.

Network Address Translation (NAT)

NAT (Network Address Translation - NAT, RFC 1631) allows the translation of an Internet Protocol address
used within one networ k to a different IP address known wit hin another network.

DHCP (Dynamic Host Configuration Protocol)

The Prestige supports DHCP Server and Client (RFC 2131 and RFC 2132). The Prestige's DHCP server
capability allows you to automatically assign TCP/IP settings to a workstation on your LAN. The Prestige's
DHCP client capability allows it to get automatically its IP address from the ISP on the WAN.

Full Network Management

This feature allows you to access SMT (System Management Terminal) through the console port or telnet
connection.

RoadRunner Support

In addition to standard cable modem services, the Prestige supports Time Warner’s RoadRunner Service.

Time and Date Setting

This new feature (Menu 24.10) allows you to get the current time and date from an external server when you
power up your Prestige. The real time is then displayed in the Prestige error logs and firewall logs. If you do

1-2 Getting to Know Your Prestige

P312 Broadband Security Gateway

not choose a time service protocol that your timeserver will send when the Prestige powers up you can enter
the time manually but each time the system is booted, the time & date will be reset to 1/1/1970 0:0:0.

Logging and Tracing

The Prestige has the following features:

♦ Built-in message logging and packet tracing.
♦ Unix syslog facility support.

Upgrade Prestige Firmware via LAN

The firmware of the Prestige 312 can be upgraded via the LAN.

Embedded FTP and TFTP Servers

The Prestige’s embedded FTP and TFTP Servers enable fast firmware upgrade as well as configuration file
backup and restoration.

1.3 Applications for Prestige 312

1.3.1 Broadband Internet Access via Cable or xDSL Modem

A cable modem or xDSL modem can connect to the Prestige 312 for broadband Internet access via Ethernet
port on the modem. It provides not only the high speed Internet access but secured internal network
protection and management as well.

Figure 1-1 Secure Internet Access via Cable

Getting to Know Your Prestige 1-3

P312 Broadband Security Gateway

Figure 1-2 Secure Internet Access via DSL

You can also use your xDSL modem in the bridge mode for always-on Internet access and high speed data
transfer.

1-4 Getting to Know Your Prestige

P312 Broadband Security Gateway

Hardware Installation & Initial Setup

This chapter shows you how to connect the hardware and perform the initial setup.

2.1 Front Panel LEDs and Back Panel Ports

2.1.1 Front Panel LEDs

The LEDs on the front panel indicate the operational status of the Prestige.

Figure 2-1 Front Panel

The following table describes the LED functions:

Chapter 2

Table 2-1 LED functions

LEDs Function Indicator

Status

PWR Power Green On The power adapter is connected to the Prestige.
SYS System

10M LAN LAN

Hardware Installati on & Initia l Setup 2-1

Green Off The 10M LAN is not connected.

Active Description

Off The system is not ready or failed.
On The system is ready and running.
Flashing The system is rebooting.

On The Prestige is connected to a 10M LAN.
Flashing The 10M LAN is sending/receiving packets.
Off The 100M LAN is not connected.100M LAN Orange
On The Prestige is connected to a 100Mbps LAN.

P312 Broadband Security Gateway

LEDs Function Indicator

Status

WAN WAN Green

Active Description

Flashing The 100M LAN is sending/receiving packets.
Off The WAN Link is not ready, or has failed.
On The WAN Link is ok.
Flashing The 10M WAN link is sending/receiving packets.

2.2 Prestige 312 Rear Panel and Connections

The following figure shows the rear panel of your Prestige 312 and the connection diagram.

Figure 2-2 Prestige 312 Rear Panel and Connections

This section outlines how to connect your Prestige 312 to the LAN and the WAN. In the case of connecting
a Cable Modem you must connect the coaxial cable from your cable service to the threaded coaxial cable

2-2 Hardware Installation & Initia l Se tup

P312 Broadband Security Gateway

connector on the back of the cable modem. Connect an xDSL Modem to the xDSL Wall Jack. Please also
see Appendix C for important safety instructions on making connections to the Prestige.

Step 1. Connecting the Console Port

For the initial configuration of your Prestige, you need to use terminal emulator software on a workstatio n
and connect it to the Prestige through the console port. Connect the 9-pin end of the console cable to the
console port of the Prestige and the other end (choice of 9-pin or 25-pin, depending on your computer) end
to a serial port (COM1, COM2 or other COM port) of your workstation. You can use an extension RS-232
cable if the enclosed one is too short. After the initial setup, you can modify the configuration remotely
through telnet connections.

Step 2. Connecting the Prestige to the Broadband Modem

Step 2a. Connecting the Prestige to the Cable Modem

Connect the WAN port (silver) on the Prestige to the Ethernet port on the cable modem
using the cable that came with your cable modem. The Ethernet port on the cable modem
is sometimes labeled "PC" or "Workstation".

OR

Step 2b. Connecting the Prestige to the xDSL Modem

Connect the WAN port (silver) on the Prestige to the Ethernet port on the xDSL modem
using the cable that came with your xDSL modem.

Step 3. Connecting the Prestige to the LAN

If you have more than one PC, you must use an external hub. Connect the 10/100M LAN port (gold) on the
Prestige to a port on the hub using a straight through Ethernet cable. If you only have one PC, you can
connect the Prestige to the PC directly without a hub. For a single PC, connect the 10/100M LAN port on
the Prestige to the Network Adapter on the PC using a crossover cable (red tag).

Step 4. Connecting the Power Adapter to your Prestige
Connect the power adapter to the port labeled POWER on the rear panel of your Prestige.
Caution: To prevent damage to the Prestige, first make sure you have the correct AC

power adapter. Please see the Appendices for AC power adapter specifications for your
region.

Step 5. Grounding the Prestige

If you want to ground the Prestige then connect a grounded wire to the F.G. (Frame Ground) of the
Prestige.

2.3 Additional Installation Requirements

In addition to the contents of your package, there are other hardware and software requirements you need
before you can install and use your Prestige. These requirements include:

1. A computer with an Ethernet NIC (Network Interface Card) installed.

2. A computer equipped with communications software configured to the following parameters:
♦ VT100 terminal emulation.

Hardware Installati on & Initia l Setup 2-3

P312 Broadband Security Gateway

♦ 9600 Baud.
♦ No parity, 8 Data bits, 1 Stop bit, Flow Control set to None.

3. A cable/xDSL modem and an ISP account.
After the Prestige is properly set up, you can make future changes to the configuration through telnet
connections.

2.4 Housing

Your Prest ige's ventilated housi ng has clip-out legs that fit snugly into grooves, enablin g compact, sturdy
stacking with airflow between route rs. You shou ld not stack more than 4

routers for maximum stability.

2.5 Power Up Your Prestige

At this point, you should have connected the console port, the LAN port, the WAN port and the power port
to the appropriate devices or lines. Plug the power adapter into a wall outlet. The Power LED should be on.
The SYS LED will come on after the system tests are complete. The WAN LED and one of the LAN LEDs
come on immediately after the SYS LED comes on, if connections have been made to the LAN and WAN
ports.

Initial Screen

When you power on your Prestige, it performs several internal tests as well a s line initialization.
After the tests, the Prestige asks you to press [

Copyright (c) 1994 - 2000 ZyXEL Communications Corp.
initialize ch =0, ethernet address: 00:a0:c5:41:51:61
initialize ch =1, ethernet address: 00:a0:c5:41:51:62
Press ENTER to continue...

] to continue, as shown.

Enter

Figure 2-3 Initial Screen

Entering Passwo rd

The login screen appears after you press [Enter], prompting you to enter the password, as shown below.
For your first login, enter the default password 1234. As you type the password, the screen displays an (X)
for each character you type.
Please note that if there is no activity for longer than 5 minutes after you log in, your Prestige will
automatically log you out and will display a blank screen. If you see a blank screen, press [Enter] to bring
up the login screen again.

2-4 Hardware Installation & Initia l Se tup

P312 Broadband Security Gateway

Enter Password : XXXX

Figure 2-4 Password Screen

2.6 Navigating the SMT Interface

The SMT (System Management Terminal) is the interface that you use to configure your Prestige.
Several operations that you should be familiar with before you attempt to modify the configuration are
listed in the table below.

Table 2-2 Main Menu Commands

Operation Keystrokes Description

Move down to
another menu

Move up to a
previous menu

Move to a “hidden”
menu

Move the cursor

Enter information Fill in, or

Required fields

N/A fields <N/A> Some of the fields in the SMT will show a <N/A>. This symbol

Save your
configuration

Exit the SMT

[ENTER] To move forward to a submenu, type in the number of the

desired submenu and press [ENTER].

[Esc] Press the [Esc] key to move back to the previous menu.

Press the [SPACE
BAR] to change
No to Yes then
press [ENTER].
[ENTER]

[Up]/[Down] arrow
keys

Press the [SPACE
BAR] to toggle

?

<

[ENTER] Save your configuration by pressing [ENTER] at the message

Type 99, then
press [ENTER].

or

>

Fields beginning with “Edit” lead to hidden menus and have a
default setting of No. Press the [SPACE BAR] to change No to
Yes, then press [ENTER] to go to a “hidden” menu.

Within a menu, press [ENTER] to move to the next field. You can
also use the [Up]/[Down] arrow keys to move to the previous and
the next field, respectively.

You need to fill in two types of fields. The first requires you to
type in the appropriate information. The second allows you to
cycle through the available choices by pressing the [Space] bar.

All fields with the symbol <?> must be filled in order be able to
save the new configuration.

refers to an option that is Not Applicable.

[Press ENTER to confirm or ESC to cancel]. Saving the data on
the screen will take you, in most cases to the previous menu.

Type 99 at the Main Menu prompt and press [ENTER] to exit the
SMT interface.

Hardware Installati on & Initia l Setup 2-5

P312 Broadband Security Gateway

2.6.1 Main Menu

After you enter the password, the SMT displays the Prestige 312 Main Menu, as shown below.

Copyright (c) 1994 - 2000 ZyXEL Communications Corp.

Prestige 312 Main Menu

Getting Started Advanced Management

1. General Setup

2. WAN Setup

3. LAN Setup

4. Internet Access Setup

Advanced Applications

11. Remote Node Setup

12. Static Routing Setup

15. NAT Setup

Enter Menu Selection Number:

21. Filter and Firewall Setup

22. SNMP Configuration

23. System Password

24. System Maintenance

26. Schedule Setup

99. Exit

Figure 2-5 Prestige 312 Main Menu

2.6.2 System Management Terminal Interface Summary

Table 2-3 Main Menu Summary

# Menu Title Description

1 General Setup Use this menu to set up general information.
2 WAN Setup Use this menu to set up the WAN.
3 LAN Setup Use this menu to set up the LAN.

4 Internet Access Setup A quick and easy way to set up Internet connection.
11 Remote Node Setup Use this menu to set up the remote node.
12 Static Routing Setup Use this menu to set up static route.
15 NAT Setup

Use this menu to configure N AT

.

21 Filter and Firewall Setup Use this menu to set up filters as well as activate/deactivate the firewall.
22 SNMP Configuration Use this menu to set up SNMP related parameters.
23 System Password Use this menu to setup a new password.
24 System Maintenance This menu provides system status, diagnostics, firmware upload, etc.
26 Schedule Setup Use this menu to schedule outgoing calls.

2-6 Hardware Installation & Initia l Se tup

P312 Broadband Security Gateway

99 Exit To exit from SMT and return to a blank screen.

2.7 Changing the System Password

The first thing your should do before anything else is to change the default system password by following
the steps below.
Step 1. Enter 23 in the Main Menu to open Menu 23 - System Password as shown below.

Menu 23 - System Password

Old Password= ?
New Password= ?
Retype to confirm= ?

Enter here to CONFIRM or ESC to CANCEL:

Figure 2-6 Menu 23 - System Security

Step 2. Enter your existing password and press [Enter].
Step 3. Enter your new system password and pre ss [Enter].
Step 4. Re-type your new s ystem passwo rd for confirmation and press [Enter].

Note that as you type a password, the screen displays a (X) for each character you type.

2.7.1 Resetting the Prestige

If you have forgotten your password or for some reason cannot access the SMT menu you will need to
reinstall the configuration file. Uploading the configuration file replaces the current configuration file with
the default configuration file, you will lose all configurations that you had before and the speed of the
console port will be reset to the default of 9600bps with 8 data bit, no parity and 1 stop bit (8n1). The
password will be reset to the default of 1234, also.
Turn off the Prestige and begin a Terminal session with the current console port settings. Turn on the
Prestige again. When you see the message "Press Any key to enter Debug Mode within 3 seconds", press
any key to enter debug mode. You should already have downloaded the correct file from your nearest
ZyXEL FTP site. See Chapter 9 for more information on how to transfer the configuration file to your
Prestige.

Hardware Installati on & Initia l Setup 2-7

P312 Broadband Security Gateway

2.8 General Setup

Menu 1 - General Setup contains administrative and system-related information. The fields for General
Setup are as shown next. System Name is for identification purposes. However, because some ISPs check
this name you should enter your PC’s “Computer Name” (Start -> Settings -> Control Panel -> Network.
Click the Identification tab, note the entry for the Computer name” field). It is the domain name that will be
propagated to the DHCP clients on the LAN. If you leave this blank, the domain name obtained by DHCP
from the ISP is used. While you must enter the ho st name (System Na me) on each individual machine, the
domain name can be assigned from the Prestige via DHCP.

2.8.1 Dynamic DNS

Dynamic DNS allows you to update your current dynamic IP address wit h one or many dynamic DNS
services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.) or access your FTP server or Web
site on your own computer using a DNS-like address (e.g. myhost.dhs.org, where myhost is a name of your
choice) which will never change instead of using your IP address that changes each time you reconnect.
Your friends or relatives will always be able to call you even if they don’t know your IP address.
First of all, you need to have registered a dynamic DNS account with www.dyndns.org. This is for people
with a dynamic IP from their ISP or DHCP server that would still like to have a DNS name.
To use this service, you must register with the Dynamic DNS client. The Dynamic DNS Client service
provider will give you a password or key. The Prestige at the time of writing supports www.ddns.org and

www.dyndns.org clients. You can apply to either of these clients for Dynamic DNS service.

DYNDNS Wildcard

Enabling the wildcard feature for your host causes *.yourhost. dyndns.org to be aliased to the same IP
address as yourhost.d yndns.org. This feature is useful if you want to b e able to use fo r example
www.yourhost.dyndns.org and still reach your hostname.
To enter Menu 1 and fill in the required information, follow these steps:

Step 1. Enter 1 in the Main Menu to open Menu 1 – General Setup.
Step 2. The Menu 1 - General Setup screen appears, as shown below. Fill in the required fields.

Menu 1 - General Setup

System Name= xxx
Domain Name=zyxel.com.tw
Edit Dynamic DNS= No

Press ENTER to Confirm or ESC to Cancel:

Figure 2-7 Menu 1 – General Setup

2-8 Hardware Installation & Initia l Se tup

P312 Broadband Security Gateway

Table 2-4 General Setup Menu Field

Field Description Example

System Name Choose a descriptive name for identification purposes. It is

P312
recommended you enter your computer’s “Computer name” in this
field. This name can be up to 30 alphanumeric characters long.
Spaces are not allowed, but dashes “-” and underscores "_" are
accepted.

Domain Name Enter the domain name (if you know it) here. If you leave this field

zyxel.com.tw
blank, the ISP may assign a domain name via DHCP. You can go to
Menu 24.8 and type "sys domainname" to see the current domain
name used by your router.

If you want to clear this field just press the [SPACE BAR]. The
domain name entered by you is given priority over the ISP assigned
domain name.

Edit Dynamic
DNS

Press the [SPACE BAR] to select Yes or No (default). Select Yes to
configure Menu 1.1 – Configure Dynamic DNS discussed next.

2.8.2 Configuring Dynamic DNS

To configure Dynamic DNS, go to M e nu 1 – General Setup and press select Yes in the Edit Dynamic
DNS field.
Pressing [ENTER] takes you to Me nu 1.1– Configure Dynamic DNS as shown next.

Menu 1.1 - Configure Dynamic DNS

Service Provider = WWW.DynDNS.ORG
Active= Yes
Host= me.ddns.org
EMAIL= mail@mailserver
User= username
Password= ******
Enable Wildcard= No

Press ENTER to confirm or ESC to cancel:

Figure 2-8 Configure Dynamic DNS

Follow the instructions in the next table to configure Dynamic DNS parameters.

Hardware Installati on & Initia l Setup 2-9

P312 Broadband Security Gateway

Table 2-5 Configure Dynamic DNS Menu Fields

Field Description Example

Service
Provider

Active
Host Enter the domain name assigned to your Prestige by your

EMAIL Enter your e-mail address.
User Enter your user name.
Password Enter the password assigned to you.
Enable

Wildcard

Enter the name of your Dynamic DNS client.

Press [SPACE BAR] to toggle between Yes or No. Yes

Dynamic DNS provider.

Your Prestige supports DYNDNS Wildcard. Press [SPACE
BAR] to toggle between Yes or No This field is N/A when you
choose DDNS client as your service provider.

www.ddns.org

me.ddns.org

mail@mailserver

Yes

The IP address will be updated when you reconfigure Menu 1 or perform DHCP client renewal.

Please note that:

♦

The Prestige supports basic DDNS, i.e., insecure login and password.

♦

If you have a private WAN IP address, then you can not use this service.

2.9 WAN Setup

This section describes how to configure the WAN using Menu 2 – WAN (10Mbps Ethernet) Setup. Fro m
the Main Menu, enter 2 to open Menu 2.

We recommend you configure this menu even if your ISP presently does not require

2-10 Hardware Installati on & Initia l Se tup

MAC address authentication.

P312 Broadband Security Gateway

MAC Address:
Assigned By=IP address attached on LAN
IP Address= 192.168.1.12

Press Space Bar to Toggle

Press ENTER to Confirm or ESC to Cancel:

Menu 2 - WAN Setup

Figure 2-9 Menu 2 – WAN Setup

The MAC address field allows users to configure the WAN port's MAC Address by either using the factory
default or cloning the MAC address from a workstation on your LAN. Once it is successfully configured,
the address will be copied to the rom file (ZyNOS configuration file). It will not change unless you change
the setting in Menu 2 or up load a different rom fi le.
The following table contains instructions on how to configure your WAN setup.

Table 2-6 WAN Setup Menu Fields

Field Description Examples

MAC Address
Assigned By

IP Address This field is applicable only if you choose IP Address attached on

Press the [SPACEBAR] to choose either of the two methods of
assigning a MAC Address. Choose Factory Default to select the
factory assigned default MAC Address. Choose IP Address attached
on LAN to use the MAC Address of that workstation whose IP you
give in the following field.

LAN method. Enter the IP address of the workstation on the LAN
whose MAC you are cloning.

Factory

Default

2.10 LAN Setup

This section describes how to configur e the LAN using Menu 3 – LAN Setup (10/100 Mbps Ethernet).
From the Main M enu, enter 3 to open Menu 3.

Hardware Installati on & Initia l Setup 2-11

P312 Broadband Security Gateway

Menu 3 - LAN Setup

1. LAN Port Filter Setup

2. TCP/IP and DHCP Setup

Enter Menu Selection Number:

Figure 2-10 Menu 3 - LAN Setup

2.10.1 L AN Port Filter Setup

This menu allows you to specify the filter sets that you wish to apply to the LAN traffic. You seldom need
to filter the LAN traffic, however, the filter sets may be useful to block certain packets, reduce traffic and
prevent security breaches.

Menu 3.1 – LAN Port Filter Setup

Input Filter Sets:
protocol filters= 2
device filters=
Output Filter Sets:
protocol filters=
device filters=

Press ENTER to Confirm or ESC to Cancel:

Figure 2-11 Menu 3.1 – LAN Port Filter Setup

Menu 3.2 is discussed in the next chapter. Please read on.

2-12 Hardware Installati on & Initia l Se tup

P312 Broadband Security Gateway

Chapter 3

Internet Access

This chapter shows you how to configure the LAN as well as the WAN of your Prestige for Internet

access.

3.1 TCP/IP and DHCP for LAN

The Prestige has built-in DHCP server capability that assigns IP ad dresses and DNS servers to systems that
support DHCP client capability.

3.1.1 Factory LAN Defaults

The LAN parameters of the Prestige are preset in the factory with the following values:

1. IP address of 192.168.1.1 with subnet mask of 255.255.255.0 (24 bits)

2. DHCP server enabled with 32 client IP addresses starting from 192.168.1.33.

These parameters should work for the majority of installations. If the parameters are satisfactory, you can
skip to section 3.2 to enter the DNS server address(es) if your ISP gives you explicit DNS server address(es).
If you wish to change the factory defaults or to learn more about TCP/IP, please read on.

3.1.2 IP Address and Subnet Mask

Similar to the houses on a street that share a common street name, the machines on a LAN share one
common network number, also.
Where you obtain your network numbe r depends o n your parti cular situation. If the ISP or your network
administrator assigns you a block of registered IP addresses, follow their instructions in selecting the IP
addresses and the subnet mask.
If the ISP di d not explici t ly give you an IP network number, t hen most li kely you have a single user account
and the ISP will assign you a dynamic IP address when the connection is established. If this is the case, it is
recommended that you select a network number from 192.168.0.0 to 192.168.255.0 and you must enable the
Network Address Translation feature of the Prestige. The Internet Assigned Number Authority (IANA)
reserved this block of addresses specifically for private use; please do not use any other number unless you
are told otherwise. Let’s say you select 192.168.1.0 as the network number; which covers 254 individual
addresses, from 192.168.1.1 to 192.168.1.254 (zero and 255 are reserved). In other words, the first 3 numbers
specify the network number while the last number identifies an individual workstation on that network.
Once you have decided on the network number, pick an IP address that is easy to remember, e.g.,

192.168.1.1, for your Prestige, but make sure that no other device on your network is using that IP.

Internet Access 3-1

P312 Broadband Security Gateway

The subnet mask specifies the network number portion of an IP address. Your Prestige will compute the
subnet mask automatically based on the IP address that you entered. You don’t need to change the subnet
mask computed by the Prestige unless you are instructed to do otherwise.

3.1.3 Private IP Addresses

Every machine on the Internet must have a unique address. If your networks are isolated from the Internet,
e.g., only between your two branch offices, you can assign any IP addresses to the hosts without problems.
However, the Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of IP
addresses specifically for private networks:

10.0.0.0 - 10.255.255.255

172.16.0.0 - 172.31.255.255

192.168.0.0 - 192.168.255.255

You can obtain your IP address from the IANA, from an ISP, or assigned from a private network. If you
belong to a small organization and your Internet access is through an ISP, the ISP can provide you with the
Internet addresses for your local networks. On the other hand, if you are part of a much larger organization,
you should consult your network administrator for the appropriate IP addresses.

Regardless of your particular situation, do not create an arbitrary IP address; always

follow the guidelines above. For more information on address assignment, please refer

to RFC 1597, Address Allocati on for Private Internets and RFC 1466, Guidelines for

Management of IP Address Space.

3.1.4 RIP Setup

RIP (Routing Information Protocol, RFC1058 and RFC 1389) allows a router to exchange routing
information with other routers. The RIP Direction field controls the sending and receiving of RIP packets.
When set to Both or Out Only, the Prestige will broadcast its routing table periodically. When set to Both
or In Only, it will incorporate the RIP information that it receives; when set to None, it will not send any
RIP packets and will ignore any RIP packets received.
The Version field controls the format and the broadcasting method of the RIP packets that the Prestige
sends (it recognizes both formats when receiving). RIP-1 is universally supported; but RIP-2 carries more
information. RIP-1 is probably adequate for most networks, unless you have an unusual network topology.
Both RIP-2B and RIP-2M sends the routing data in RIP-2 format; the difference being that RIP-2B uses
subnet broadcasting while RIP-2M uses multicasting. Multicasting can reduce the load on non-router
machines since they generally do not listen to the RIP multicast address and so will not receive the RIP
packets. However, if one router uses multicasting, then all routers on your network must use multicasting,
also.
By default, RIP direction is set to Both and the Version set to RIP-1.

3-2 Internet Access

P312 Broadband Security Gateway

3.1.5 DHCP Configuration

DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows the individual clients
(workstati ons) to obtain the TCP/IP configuration a t start-up from a server. You can configure the Prestige as
a DHCP server or disable it. When configured as a server, the Prestige provides the TCP/IP configuration for
the clients. If set to None, DHCP service will be disabled and you must have another DHCP sever on your
LAN, or else the workstation must be manually configured.

IP Pool Setup

The Prestige is pre-configured with a pool of 32 IP addresses starting from 192.168.1.33 to 192.168.1.64.
This configuration leaves 31 IP addresses (excluding the Prestige itself) in the lower range for other server
machines, e.g., server for mail, FTP, telnet, web, etc., that you may have.

DNS Server Address

DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice versa,
e.g., the IP address of www.zyxel.com is 204.217.0.2. The DNS server is extremely important because
without it, you must know the IP address of a machine before you can access it.
There are two ways that an ISP disseminates the DNS server addresses. The first is for an ISP to tell a
customer the DNS server addresses, usually in the form of an information sheet, when you sign up. If your
ISP does give you the DNS server addresses, enter them in the DNS Server fields in DHCP Setup. The
second is to leave this field blank, i.e., 0.0.0.0 – in this case the Prestige acts as a DNS proxy.

Example of network properties for LAN servers with fixed IP#:

Choose an IP:
Netmask: 255.255.255.0
Gateway (or default route): 192.168.1.1 (Prestige LAN IP)
DNS server: 192.168.1.1
Domain: (optional)

192.168.1.2 - 192.168.1.32; 192.168.1.65 - 192.168.1.254.

3.1.6 IP Multicast

Traditionally, IP packets are transmitted in one of either two ways - Unicast (1 sender – 1 recipient) or
Broadcast (1 sender – everybody on the network). Multicast is a third way to deliver IP packets to a group of
hosts on the network - not everybody.
IGMP (Internet Group Multicast Protocol) is a session-layer protocol used to establish membership in a
Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement over
version 1 (RFC 1112) but IGMP version 1 is still in wide use. If you would like to read more detailed
information about interoperability between IGMP version 2 and version 1, please see sections 4 and 5 of
RFC 2236. The class D IP address is used to identify host groups and can be in the range 224.0.0.0 to

239.255.255.255. The address 224.0.0.0 is not assigned to any group and is used by IP multicast computers.

Internet Access 3-3

P312 Broadband Security Gateway

The address 224.0.0.1 is used for query messages and is assigned to the permanent group of all IP hosts
(including gateways). All hosts must join the 224.0.0.1 group in order to participate in IGMP. The address

224.0.0.2 is assigned to the multicast routers group.
The Prestige supports both IGMP version 1 (IGMP-v1) and IGMP version 2 (IGMP-v2). At start up, the
Prestige queries all directly connected networks to gather group membership. After that, the Prestige
periodically updates this information. IP Multicasting can be enabled/disabled on the Prestige LAN and/or
WAN interfaces using menus 3.2 (LAN) and 11.3 (WAN). Select None to disable IP Multicasting on these
interfaces.

3.1.7 IP Alias

IP Alias allows you to partition a physical network into different logical networks over the same Ethernet
interface. The Prestige supports three logical LAN interfaces via its single physical Ethernet interface with
the Prestige itself as the gateway for each LAN network.

Figure 3-1 Physical Network ! Figure 3-2 Partitioned Logical Networks

Use menu 3.2.1 to configure IP Alias on your Prestige.

3.2 TCP/IP and DHCP Ethernet Setup

From the Main Menu, enter 3 to open Menu 3 - LAN Setup (10/100 Mbps Ethernet) to configure TCP/IP
(RFC 1155) and DHCP Ethernet setup.

3-4 Internet Access

P312 Broadband Security Gateway

Menu 3 – LAN Setup

1. LAN Port Filter Setup

2. TCP/IP and DHCP Setup

Enter Menu Selection Number:

Figure 3-3 Menu 3 - LAN Setup (10/100 Mbps Ethernet)

To edit the TCP/IP and DHCP configuration, enter 2 to open Menu 3.2 - TCP/IP and DHCP Ethernet
Setup

as shown next.

Menu 3.2 - TCP/IP and DHCP Ethernet Setup

DHCP Setup:

DHCP= Server
Client IP Pool Starting Address= 192.168.1.33
Size of Client IP Pool= 32
Primary DNS Server= 0.0.0.0
Secondary DNS Server= 0.0.0.0

TCP/IP Setup:

IP Address= 192.68.1.1
IP Subnet Mask= 255.255.255.0
RIP Direction= Both

Multicast= None
Edit IP Alias= No

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

Version= RIP-1

Figure 3-4 Menu 3.2 – TCP/IP and DHCP Ethernet Setup

First address

in the IP Pool

Size of the IP

Pool

IP addresses

of the DNS

servers

This is the IP

address of the

Prestige.

Internet Access 3-5

P312 Broadband Security Gateway

Follow the instructions in the following table on how to configure the DHCP fields.

Table 3-1 LAN DHCP Setup Menu Fields

Field Description Example

DHCP=

Client IP Pool
Starting Address

Size of Client IP Pool This field specifies the size, or count, of the IP address pool. 32

Primary DNS
Server
Secondary DNS
Server

This field enables/disables the DHCP server. If it is set to Server,
your Prestige will act as a DHCP server. If set to None, DHCP
service will be disabled and you must have another DHCP sever
on your LAN, or else the workstation must be manually
configured. When DHCP is set to Server, the following four items
need to be set.

This field specifies the first of the contiguous addresses in the IP
address pool.

Enter the IP addresses of the DNS servers. The DNS servers are
passed to the DHCP clients along with the IP address and the
subnet mask. Leave these entries at 0.0.0.0 if they are provided
by a WAN DHCP server.

Server (default)

192.168.1.33

Follow the instructions in the following table to configure TCP/IP parameters for the LAN port.

Table 3-2 LAN TCP/IP Setup Menu Fields

None

Field Description Example

TCP/IP Setup

IP Address Enter the IP address of your Prestige in dotted decimal notation 192.168.1.1

(default)

IP Subnet Mask Your Prestige will automatically calculate the subnet mask based

on the IP address that you assign. Unless you are implementing
subnetting, use the subnet mask computed by the Prestig e

RIP Direction

Version

Multicast IGMP (Internet Group Multicast Protocol) is a session-layer protocol

Press the [SPACE BAR] to select the RIP direction from Both/In

Only/Out Only/None.

Press the [SPACE BAR] to select the RIP version from RIP-1/RIP­2B/RIP-2M.

used to establish membership in a Multicast group. The Prestige
supports both IGMP version 1 (IGMP-v1) and IGMP-v2. Press the
space bar to enable IP Multicasting or select None (default) to
disable it.

255.255.255.0

Both

(default)

RIP-1

(default)

None

3-6 Internet Access

P312 Broadband Security Gateway

p

Field Description Example

Edit IP Alias The Prestige supports three logical LAN interfaces via its single

physical Ethernet interface with the Prestige itself as the gateway for

Yes

No (default)

each LAN network. Press the space bar to toggle No to Yes, then
press [ENTER] to bring you to menu 3.2.1

When you have completed this menu, press [Enter] at the prompt [Press ENTER to Confirm…] to save
your configuration, or press [Esc] at any time to cancel.

3.2.1 IP Alias Setup

You must use Menu 3.2 to co nfigure the first network and move the cursor to the Edit IP Alias field and
press [SPACE BAR] to choose Yes and press [ENTER] to configure the second and third network.
Pressing [Ent er] opens M enu 3.2.1 - IP Alias Setup, as shown next.

Menu 3.2.1 - IP Alias Setup

IP Alias 1= No
IP Address= N/A
IP Subnet Mask= N/A
RIP Direction= N/A
Version= N/A
Incoming protocol filters= N/A
Outgoing protocol filters= N/A
IP Alias 2= No
IP Address= N/A
IP Subnet Mask= N/A
RIP Direction= N/A
Version= N/A
Incoming protocol filters= N/A
Outgoing protocol filters= N/A

Enter here to CONFIRM or ESC to CANCEL:

Press S

ace Bar to Toggle.

Figure 3-5 Menu 3.2.1 - IP Alias Setup

Follow the instructions in the following table to configure IP Alias parameters.

Table 3-3 IP Alias Setup Menu Fields

Field Description Example

IP Alias
IP Address Enter the IP address of your Prestige in dotted decimal notation
IP Subnet

Mask

Choose Yes to configure the LAN network for the Prestige. Yes

192.168.2.1

Your Prestige will automatically calculate the subnet mask based

255.255.255.0

on the IP address that you assign. Unless you are implementing
subnetting, use the subnet mask computed by the Prestige

Internet Access 3-7

P312 Broadband Security Gateway

RIP Direction

Press the space bar to select the RIP direction from None, Both/In

None

Only/Out Only.

Version

Press the space bar to select the RIP version from RIP-1/RIP-

RIP-1

2B/RIP-2M.

Incoming
Protocol Filters

Outgoing
Protocol Filters

Enter the filter set(s) you wish to apply to the incoming traffic
between this node and the Prestige.

Enter the filter set(s) you wish to apply to the outgoing traffic
between this node and the Prestige.

When you have completed this menu, press [Enter] at the prompt [Press ENTER to Confirm…] to save
your configuration, or press [Esc] at any time to cancel.

3.3 Internet Access Setup

You will see three different Menu 4 screens depending on whether you chose Ethernet, PPTP or PPPoE

Encapsulation.

3.3.1 Ethernet Encapsulation

You must choose the Ethernet option when the WAN port is used as a regular Ethernet. The PPPoE choice
is for a dial-up connection using PPPoE. If you choose Ethernet in Menu 4 you will see the next screen.

Menu 4 - Internet Access Setup

ISP's Name= ChangeMe
Encapsulation= Ethernet
Service Type= Standard
My Login= N/A
My Password= N/A
Login Server IP= N/A

IP Address Assignment= Dynamic
IP Address= N/A
IP Subnet Mask= N/A
Gateway IP Address= N/A
Network Address Translation= Full Feature

Press ENTER to Confirm or ESC to Cancel:

Figure 3-6 Menu 4 – Internet Access Setup (Ethernet)

3-8 Internet Access

P312 Broadband Security Gateway

The following table describes this screen.

Table 3-4 Internet Access Setup Menu Fields

Field Description

ISP’s Name

Encapsulation Press the [SPACE BAR] and the press [ENTER] to choose Ethernet. The

Service Type Press the [SPACE BAR] to select Standard, RR-Toshiba (RoadRunner

Note: xDSL users must choose the Standard option only. The Server IP, My Login IP and My
Password fields are not applicable in this case.

My Login Name
My Password
Login Server IP

IP Address Assignment If your ISP did not assign you a fixed IP address, select Dynamic, otherwise

IP Address Enter the (fixed) IP address assigned to you by your ISP (Static IP Address

IP Subnet Mask
Gateway IP Address
Network Address

Translation

Enter the name of your Internet Service Provider, e.g., myISP. This
information is for identification purposes only.

encapsulation method influences your choices for IP Address.

Toshiba authentication method) or RR-Manager (RoadRunner Manager
authentication method). Choose a RoadRunner flavor if your ISP is Time
Warner's RoadRunner; otherwise choose Standard.

Enter the login name given to you by your ISP.
Enter the password associated with the login name above.
The Prestige will find the RoadRunner Server IP if this field is left blank. If it

does not, then you must enter the authentication server IP address.

select Static and enter the IP address & subnet mask in the following fields.

Assignment is selected in the previous field).
Enter the subnet mask associated with your static IP.
Enter the gateway IP address associated with your static IP.
Please see the NAT chapter for a more detailed discussion on the

Address Translation feature. The choices are Full Feature, None and SUA

Only.

Network

3.3.2 PPTP Encapsulation

Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of data from a
remote client to a private server, creating a Virtual Private Network (VPN) using TCP/IP-based networks
PPTP supports on-demand, multi-protocol, and virtual private networking over public networks, such as the
Internet.

The Prestige supports only one PPTP se rver connection at any given time.

Internet Access 3-9

P312 Broadband Security Gateway

3.3.3 Configuring the PPTP Client

To configure a PPTP client, you must configure the My Login and Password fields for a PPP connection and
the PPTP parameters for a PPTP connection.

After configuring the User Name and Password for PPP connection, press [SPACE BAR] in the
Encapsulation field in Menu 4 -Internet Access Setup to choose PPTP as your encapsulation option. This
brings up the following screen.

Menu 4 - Internet Access Setup

ISP's Name= ChangeMe
Encapsulation= PPTP
Service Type= N/A
My Login= username

My Password= ******
Idle Timeout= 100

IP Address Assignment= Dynamic

IP Address= N/A
IP Subnet Mask= N/A
Gateway IP Address=N/A

Network Address Translation= SUA Only

Press ENTER to Confirm or ESC to Cancel:

Figure 3-7 Internet Access Setup (PPTP)

The following table contains instructions about the new fields when you choose PPTP in the Encapsulation
field in M e nu 4.

Table 3-5 New Fields in Menu 4 (PPTP) screen

Field Description Examples

Encapsulation

Press the [SPACE BAR] and then press [ENTER] to

choose

PPTP

PPTP. The encapsulation method influences your choices for

IP Address.

Idle Timeout

This value specifies the time in seconds that elapses before
the Prestige automatically disconnects from the PPTP server.

100

(default)

3.3.4 PPPoE Encapsulation

The Prestige supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF Draft standard (RFC

2516) specifying how a personal computer (PC) interacts with a broadband modem (i.e. xDSL, cable,
wireless, etc.) connection.

3-10 Internet Access

P312 Broadband Security Gateway

For the service provider, PPPoE offers an access and authentication method that works with existing access
control systems (e.g., Radius). For the user, PPPoE provides a login & authentication method that the
existing Microsoft Dial-Up Networking software can activate, and therefore requires no new learning or
procedures for Windows users.

One of the benefits of PPPoE is the ability to let end users access one of multiple network services, a function
known as dynamic service selection. This enables the service provider to easily create and offer new IP
services for specific users.

Operationally, PPPoE saves significant effort for both the end user and ISP/carrier, as it requires no specific
configuration of the broadband modem at the customer site.

By implementing PPPoE directly on the Prestige rather than individual PC’s, the machines on the LAN do
not need PPPoE software installed, since the Prestige does that part of the task. Further, with NAT, all of the
LAN’s machines will have access.

If you enable PPPoE in Menu 4, you will see the next screen. For more information on PPPoE, please see the
Appendices.

Menu 4 - Internet Access Setup

ISP's Name= ChangeMe
Encapsulation= PPPoE
Service Name=
My Login=
My Password= ********
Idle Timeout= 100

IP Address Assignment= Dynamic
IP Address= N/A
IP Subnet Mask= N/A
Gateway IP Address= N/A
Network Address Translation= Full Feature

Press ENTER to Confirm or ESC to Cancel:

Figure 3-8 Internet Access Setup (PPPoE)

Internet Access 3-11

P312 Broadband Security Gateway

Table 3-6 New Fields in Menu 4 (PPPoE) screen

Field Description Examples

Encapsulation Press the [SPACE BAR] and then press [ENTER] to choose PPPoE.

The encapsulation method influences your choices for IP Address.

Service Name

Idle Timeout

Enter the PPPoE service name provided to you. PPPoE uses a
service name to identify and reach the PPPoE server.

This value specifies the time in seconds that elapses before the
Prestige automatically disconnects from the PPPoE server.

PPPoE

poellc

100

(default)

3.4 Basic Setup Complete

Well Done! You have successfully connected, installed and set up your Prestige to operate on your network
as well as access the Internet.

Please note that when the firewall is activated, the default policy allows all

communications to the Internet that originate from the LAN, and blocks all traffic to

You may deactivate the firewall in menu 21.2 or via the Prestige Web Configurator. You may also define
additional Policy rules and sets or modify existing ones but please exercise extreme cautio n in doing so. See
Part 4 for more information on the firewall.

the LAN that originates from the Internet.

3-12 Internet Access

Advanced Applications

Part II:

Advanced Applications

Advanced Applications (Chapters 4-6) describe the advanced applications of your Prestige, such

as Remote Node Setup IP Static routes and NAT.

II

P312 Broadband Security Gateway

Chapter 4

Remote Node Setup

This chapter shows you how to configure a remote node.

A remote node is required for placing calls to a remote gateway. A remote node represents both the remote
gateway and t he network b ehind it across a WAN connection. Note that when you use Menu 4 to set up
Internet access, you are actually configuring a remote node. We will show you how to configure Menu 11.1

Remote Node Profile, Menu 11.3 - Remote Node Network Layer Options and Menu 11.5 - Remote
Node Filter.

4.1 Remote Node Profile

From the Main Menu, select menu option 11 to open Menu 11.1 - Remote Node Profile. There are two
variations of this menu depending on whether you choose Ethernet Encapsulation or PPPoE

Encapsulation.

4.1.1 Ethernet Encapsulation

You must choose the Ethernet option when the WAN port is used as a regular Ethernet. The first Menu

11.1 screen you see is for Ethernet Encapsulation shown next.

Menu 11.1 - Remote Node Profile

Rem Node Name= ChangeMe Route= IP
Active= Yes

Encapsulation= Ethernet Edit IP= No
Service Type= Standard Session Options:
Service Name= N/A Edit Filter Sets= No
Outgoing=
My Login= N/A
My Password= N/A
Server IP= N/A

Press ENTER to Confirm or ESC to Cancel:

Figure 4-1 Menu 11.1 Remote Node Profile for Ethernet Encapsulation

Remote Node Setup 4-1

P312 Broadband Security Gateway

Table 4-1 Fields in Menu 11.1

Field Description Examples

Rem Node Name

Active Press the [SPACE BAR] to toggle between Yes and No and

Encapsulation Ethernet is the default encapsulation. Press the [SPACE

Service Type Press the [SPACE BAR] to select from Standard, RR-

Service Name

Outgoing: My
Login

Outgoing: My
Password

Server IP

Route

Edit IP

Session Options:
Edit Filter sets

Enter a descriptive name for the remote node. This field can
be up to eight characters.

activate (deactivate) the remote node.

BAR] if you wish to change to PPPoE enc ap sul ation.

Toshiba (RoadRunner Toshiba authentication method) or
RR-Manager (RoadRunner Manager authentication

method). Choose one of the RoadRunner methods if your
ISP is Time Warner's RoadRunner; otherwise choose
Standard.

This is valid only when you have chosen PPPoE
encapsulation. If you are using PPPoE encapsulation, then
type the name of your PPPoE service here.

This field is applicable for PPPoE encapsulation only. Enter
the login name assigned by your ISP when the Prestige
calls this remote node. Some ISPs append this field to the
Service Name field above (e.g.,
PPPoE server.

Enter the password assigned by your ISP when the Prestige
calls this remote node. Valid for PPPoE encapsulation only.

This field is valid for RoadRunner service type only. The
Prestige will find the RoadRunner Server IP automatically if
this field is left blank. If it does not, then you must enter the
authentication server IP address here.

This field refers to the protocol that will be routed by your
Prestige – IP only for the P312.

This field leads to a “hidden” menu. Press the [SPACE BAR]
to select Yes and press [ENTER] to go to Menu 11.3 -
Remote Node Network Layer Options.

This field leads to another “hidden” menu Use the [SPACE
BAR] to toggle this field to Yes and press [ENTER] to open
Menu 11.5 to edit the filter sets. See the Remote Node Filter
section for more details.

jim@poellc

) to access the

LAoffice

Yes

Ethernet

Standard

poellc

jim

*****

IP

Yes

Yes

4-2 Remote Node Setup

P312 Broadband Security Gateway

4.1.2 PPPoE Encapsulation

The Prestige supports PPPoE (Point-to-Point Protocol over Ethernet). You can only use PPPoE
encapsulation when you’re using the Prestige with an xDSL modem as the WAN device. If you change the
Encapsulation to PPPoE, then you will see the next screen. Please see the Appendices for more
information on PPPoE.

Menu 11.1 - Remote Node Profile

Rem Node Name= ChangeMe Route= IP
Active= Yes

Encapsulation= PPPoE Edit IP= No
Service Type= Standard Telco Option:
Service Name= Allocated Budget(min)= 0
Outgoing= Period(hr)= 0
My Login= Schedules=
My Password= ******** Nailed-Up Connection= No
Authen= CHAP/PAP

Press ENTER to Confirm or ESC to Cancel:

Figure 4-2 Menu 11.1 Remote Node Profile for PPPoE Encapsulation

Session Options:
Edit Filter Sets= No
Idle Timeout(sec)= 100

Outgoing Authentication Protocol

Generally speaking, you should employ the strongest authentication protocol possible, for obvious reasons.
However, some vendor’s implementation includes specific authentication protocol in the user profile. It
will disconnect if the negotiated protocol is different from that in the user profile, even when the negotiated
protocol is stronger than specified. If you encounter the case where the peer disconnects right after a
successful authentication, please make sure that you specify the correct authentication protocol when
connecting to such an implementation.

Nailed-Up Connection

A nailed-up connection is a dial-up line where the connection is always up regardless of traffic demand.
The Prestige does two things when you specify a nailed-up connection. The first is that idle ti meout i s
disabled. The second is that the Prestige will try to bring up the connection when turned on and whenever
the connection is down. A nailed-up connection can be very expensive for obvious reasons.
Do not specify a nailed-up connection unless your telephone company offers flat-rate service or you need a
constant connection and the cost is of no concern.
The following table describes the fields not already described in Table 4-1 already.

Remote Node Setup 4-3

P312 Broadband Security Gateway

Table 4-2 Fields in Menu 11.1 (PPPoE Encapsulation Specific)

Field Description Examples

Authen This field sets the authentication protocol used for

outgoing calls.
Options for this field are:
CHAP/PAP - Your Prestige will accept either CHAP or

PAP when requested by this remote node.
CHAP - accept CHAP only.
PAP - accept PAP only.

Telco Option:
Allocated Budget

Period(hr)

Nailed-Up
Connection

Idle Timeout

The field sets a ceiling for outgoing call time for this
remote node. The default for this field is 0 meaning no
budget control.

This field is the time period that the budget should be
reset. For example, if we are allowed to call this remote
node for a maximum of 10 minutes every hour, then the
Allocated Budget is (10 minutes) and the Period(hr) is
1 (hour).

This field specifies if you want to make the connection to
this remote node a nailed-up connection. For more
details please refer to the next section.

This value specifies the idle time (i.e., the length of time
there is no traffic from the Prestige to the remote node)
in seconds that can elapse before the Prestige
automatically disconnects the PPPoE connection. This

option only applies when the Prestige initiates the call.

CHAP/PAP

10

1

100 seconds
(default)

4.1.3 PPTP Encapsulation

If you change the Encapsulation to PPTP in Menu 11.1, then you will see the next screen. Please see the
appendix for information on PPTP.

4-4 Remote Node Setup

P312 Broadband Security Gateway

Menu 11.1 - Remote Node Profile

Rem Node Name= ChangeMe Route= IP
Active= Yes

Encapsulation= PPTP Edit IP= No
Service Type= Standard Telco Option:
Service Name=N/A Allocated Budget(min)= 0
Outgoing= Period(hr)= 0
My Login= Schedules=
My Password= ******** Nailed-up Connections=
Authen= CHAP/PAP

PPTP : Edit Filter Sets= No
IP Addr= Idle Timeout(sec)= 100
Server IP Addr=
Connection ID/Name=

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

Session Options:

Figure 4-3 Remote Node Profile for PPTP Encapsulation

The next table shows how to configure fields in Menu 11.1 not previously discussed above.

Table 4-3 Fields in Menu 11.1 (PPTP Encapsulation)

Field Description Examples

Encapsulation Toggle the space bar to choose PPTP. You must also go to

PPTP

Menu 11.3 to check the IP Address setting once you have

selected the encapsulation method.

IP Addr(ess)
Server IP

Enter the IP address of the WAN Ethernet port.
Enter the IP address of the ANT modem.

10.0.0.140

10.0.0.138

Addr(ess)
Connection

ID/Name

Enter the connection ID or connection name in the ANT. It
must follow the “c:id” and “n:name” format.

N:My ISP

This field is optional and depends on the requirements of your
xDSL Modem.

Schedules

You can apply up to four schedule sets here. For more details
please refer to the Call Schedule Setup chapter.

Nailed-Up
Connection

This field specifies if you want to make the connection to this
remote node a nailed-up connection.

Remote Node Setup 4-5

P312 Broadband Security Gateway

4.2 Editing TCP/IP Options (with Ethernet Encapsulation)

Move the cursor to the Edit IP field in Me nu 11.1, then press the [SPACE BAR] to toggle and set the
value to Yes. Press [Enter]

IP Address Assignment= Dynamic
IP Address= N/A
IP Subnet Mask= N/A
Gateway IP Addr= N/A

Single User Account= Yes
Metric= N/A
Private= N/A
RIP Direction= None
Version= N/A
Multicast= None

Enter here to CONFIRM or ESC to CANCEL:
Press Space Bar to Toggle

The next table gives you instructions about configuring remote node network layer options.

Table 4-4 Remote Node Network Layer Options Menu Fields

Field Description Example

IP Address
Assignment

IP Address If you have a Static IP Assignment, enter the IP address assigned

IP Subnet
Mask

Gateway IP
Addr

Network
Address
Translation

Metric This field is valid only for PPTP/ PPPoE encapsulation. The metric

to open Menu 11.3 - Network Layer Options.

Menu 11.3 - Remote Node Network Layer Options

Figure 4-4 Remote Node Network Layer Options

If your ISP did not assign you an explicit IP address, select
Dynamic; otherwise select Static and enter the IP address & subnet
mask in the following fields.

to you by your ISP.
If you have a Static IP Assignment, enter the subnet mask

assigned to you.
If you have a Static IP Assignment, enter the gateway IP address

assigned to you.
Use the [SPACE BAR] to toggle between Full Feature, None, SUA

Only. See the NAT chapter for a full discussion on this feature.

represents the “cost” of transmission for routing purposes. IP routing
uses hop count as the measurement of cost, with a minimum of 1 for
directly connected networks. Enter a number that approximates the
cost for this link. The number need not be precise, but it must be

Dynamic

SUA Only

3

4-6 Remote Node Setup

P312 Broadband Security Gateway

Field Description Example

between 1 and 15. In practice, 2 or 3 is usually a good number.

Private

RIP Press the [SPACE BAR] to select the RIP direction from Both/

Version Press the [SPACE BAR] to select the RIP version from RIP-1/RIP-

Multicast

Once you have completed filling in the Network Layer Options Menu, press [Enter] to return to
Menu 11. Press [Enter] at the message [Press ENTER to Confirm...] to save your configuration, or
press [Esc] at any time to cancel.

This field is valid only for PPTP/ PPPoE encapsu lat io n.

parameter determines if the Prestige will include the route to this
remote node in its RIP broadcasts. If set to Yes, this route is kept
private and not included in RIP broadcast. If No, the route to this
remote node will be propagated to other hosts through RIP
broadcasts.

None/In Only/Out Only. Please see section 3.1.4 for more
information on RIP. The default for RIP on the WAN side is None. It
is recommended you do not change this setting.

2B/RIP-2M and None.
IGMP (Internet Group Multicast Protocol) is a session-layer protocol

used to establish membership in a Multicast group. The Prestige
supports both IGMP version 1 (IGMP-v1) and IGMP-v2. Press the
space bar to enable IP Multicasting or select None to disable it. See
the previous Part for more information on this feature.

This

Yes

None

IGMP-v2

4.2.1 Editing TCP/IP Options (with PPTP Encapsulation)

Make sure that Encapsulation is set to PPTP in Menu 11.1. Then move the cursor to the Edit IP field in
Menu 11.1, press the [SPACE BAR] to toggle No to Yes. Press [Enter]
Layer Options.

Remote Node Setup 4-7

to open Menu 11.3 - Network

P312 Broadband Security Gateway

Menu 11.3 - Remote Node Network Layer Options

IP Address Assignment= Dynamic
Rem IP Address= N/A
Rem Subnet Mask= N/A
My WAN Addr= 0.0.0.0

Network Address Translation= Full Feature
Metric= 1
Private= No
RIP Direction= None
Version= N/A

Enter here to CONFIRM or ESC to CANCEL:
Press Space Bar to Toggle.

Multicast= None

Figure 4-5 Remote Node Network Layer Options

The next table gives you instructions about configuring remote node network layer options.

Table 4-5 Remote Node Network Layer Options Menu Fields

Field Description Example

IP Address
Assignment

Rem IP
Address

Rem IP Subnet
Mask

My WAN Addr

Network
Address
Translation

Metric

If your ISP did not assign you an explicit IP address, select Dynamic;
otherwise select Static and enter the IP address & subnet mas k in the
following fields.

If you have a Static IP Assignment, enter the IP address assigned to
the remote node.

If you have a Static IP Assignment, enter the subnet mask assigned to
the remote node.

Some implementations, especially the UNIX derivatives, require the
WAN link to have a separate IP network number from the LAN and
each end must have a unique address within the WAN network number.
If this is the case, enter the IP address assigned to the WAN port of
your Prestige.

Note that this is the address assigned to your local Prestige, not the
remote router.

Use the [SPACE BAR] to toggle between Full Feature, None, SUA
Only. See the NAT chapter for a full discussion on this feature.

The metric represents the “cost” of transmission for routing purposes.
IP routing uses hop count as the measurement of cost, with a minimum
of 1 for directly connected networks. Enter a number that approximates
the cost for this link. The number need not be precise, but it must be

Dynamic

SUA Only

1 to 15

4-8 Remote Node Setup

P312 Broadband Security Gateway

between 1 and 15. In practice, 2 or 3 is usually a good number.

Private

RIP Press the [SPACE BAR] to select the RIP direction from Both/

Version Press the [SPACE BAR] to select the RIP version from RIP-1/RIP-

Multicast

Once you have completed filling in the Network Layer Options Menu, press [Enter] to return to Menu 11.
Press [Enter] at the message [Press ENTER to Confirm...] to save your configuration, or press [Esc] at
any time to cancel.

This parameter determines if the Prestige will include the route to this
remote node in its RIP broadcasts. If set to Yes, this route is kept
private and not included in RIP broadcast. If No, the route to this
remote node will be propagated to other hosts through RIP broadcasts.

None/In Only/Out Only and None.

2B/RIP-2M.

IGMP (Internet Group Multicast Protocol) is a session-layer protocol
used to establish membership in a Multicast group. The Prestige
supports both IGMP version 1 (IGMP-v1) and IGMP-v2. Press the
space bar to enable IP Multicasting or select None to disable it. See the
previous Part for more information on this feature.

Yes/No

None

(default)

RIP-1

None

4.2.2 Editing TCP/IP Options (with PPPoE Encapsulation)

Make sure that Encapsulation is set to PPPoE in Menu 11.1. Then move the cursor to the Edit IP field in
Menu 11.1, press the [SPACE BAR] to toggle No to Yes. Press [Enter]
Layer Options. The menu and fields are the same as described for PPTP encapsulation above.

to open Menu 11.3 - Network

4.3 Remote Node Filter

Move the cursor to the field Edit Filter Sets in Menu 11.1, then press the [SPACE BAR] to toggle and set
the value to YES. Press [ENTER] to open Menu 11.5 – Remote Node Filter.
Use Menu 11.5 to specify the filter set(s) to apply to the incoming and outgoing traffic between this remote
node and the Prestige and to prevent certain packets from triggering calls. You can specify up to 4 filter sets
separated by a comma, e.g., 1, 5, 9, 12, in each filter field. Note that spaces are accepted in this field. For
more information on defining the filters, please refer to the chapter on filters. Note that for PPPoE or
PPTP encapsulation, you can also specify remote node call filter sets.

Remote Node Setup 4-9

P312 Broadband Security Gateway

Menu 11.5 - Remote Node Filter

Input Filter Sets:
protocol filters= 3
device filters=
Output Filter Sets:
protocol filters= 1
device filters=

Figure 4-6 Remote Node Filter (Ethernet Encapsulation)

Menu 11.5 - Remote Node Filter

Enter here to CONFIRM or ESC to CANCEL:

Enter here to CONFIRM or ESC to CANCEL:

Input Filter Sets:
protocol filters= 3
device filters=
Output Filter Sets:
protocol filters= 1
device filters=
Call Filter Sets:
protocol filters= 1
device filters=

Figure 4-7 Remote Node Filter (PPPoE or PPTP Encapsulation)

4-10 Remote Node Setup

P312 Broadband Security Gateway

Chapter 5

IP Static Route Setup

This chapter shows you how to configure static routes with your Prestige.

Static routes tell the Prestige routing information that it cannot learn automatically through other means.
This can arise in cases where RIP is disabled on the LAN.
Each remote node specifies only the network to which the gateway is directly connected, and the Prestige
has no knowledge of the networks beyond. For instance, the Pre stige knows about network N2 in the
following diagram through remote node Router 1. However, the Prestige is unable to route a packet to
network N3 because it doesn’t know that there is a route through the same remote node Router 1 (via
gateway Router 2). The static routes are for you to tell the Prestige about the networks beyond the remote
nodes.

Figure 5-1 Example of Static Routing Topology

IP Static Route Setup 5-1

P312 Broadband Security Gateway

5.1 IP Static Route Setup

You configure IP static routes in Menu 1 2. 1, by selecting one of the IP static routes as shown below. Enter
12 from the Main Menu.

Menu 12 - IP Static Route Setup

1. ________

2. ________

3. ________

4. ________

5. ________

6. ________

7. ________

8. ________

Enter selection number:

Figure 5-2 Menu 12 - IP Static Route Setup

Now, enter the index number of one of the static routes you want to configure.

Menu 12.1 - Edit IP Static Route

Route #: 1
Route Name= ?
Active= No
Destination IP Address= ?
IP Subnet Mask= ?
Gateway IP Address= ?
Metric= 2
Private= No

Press ENTER to CONFIRM or ESC to CANCEL:

Figure 5-3 Menu 12. 1 - Edit IP Static Route

`The following table describes the IP Static Rout e Menu fields.

5-2 IP Static Route Setup

P312 Broadband Security Gateway

Table 5-1 IP Static Route Menu Fields

Field Description

Route # This is the index number of the static route that you chose in Menu 12.
Route Name Enter a descriptive name for this route. This is for identification purposes only.
Active This field allows you to activate/deactivate this static route.
Destination IP

Address

IP Subnet Mask Enter the IP subnet mask for this destination.
Gateway IP

Address

Metric Metric represents the “cost” of transmission for routing purposes. IP routing uses hop

Private This parameter determines if the Prestige will include the route to this remote node in

Once you have completed filling in this menu, press [Enter] at the message [Press ENTER to Confirm…]
to save your configuration, or press [Esc] to cancel.

This parameter specifies the IP network address of the final destination. Routing is
always based on network number. If you need to specify a route to a single host, use
a subnet mask of 255.255.255.255 in the subnet mask field to force the network
number to be identical to the host ID.

Enter the IP address of the gateway. The gateway is an immediate neighbor of your
Prestige that will forward the packet to the destination. On the LAN, the gateway must
be a router on the same segment as your Prestige; over the WAN, the gateway must
be the IP address of one of the Remote Nodes.

count as the measurement of cost, with a minimum of 1 for directly connected
networks. Enter a number that approximates the cost for this link. The number need
not be precise, but it must be between 1 and 15. In practice, 2 or 3 is usually a good
number.

its RIP broadcasts. If set to Yes, this route is kept private and not included in RIP
broadcast. If No, the route to this remote node will be propagated to other hosts
through RIP broadcasts.

IP Static Route Setup 5-3

P312 Broadband Security Gateway

Chapter 6

Network Address Translation (NAT)

This chapter discusses how to configure NAT on the Prestige.

6.1 Introduction

NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a host in a
packet, e.g., the source address of an outgoing packet, used within one network to a different IP address
known within another network.

6.1.1 NAT Definitions

Inside/outside denotes where a host is located relative to the Prestige, e.g., the workstations of your
subscribers are the inside hosts, while the web servers on the Internet are the outside hosts. Global/local
denotes the IP address of a host in a packet as the packet traverses across a router, e.g., the local address
refers to the IP address of a host when the packet is in the local network, while the global address refers to
the IP address of the host when the same packet is travelling in the WAN side. Note that inside/outside
refers to the location of a host, while global/local refers to the IP address of a host used in a packet. Thus,
an inside local address (ILA) is the IP address of an inside host in a packet when the packet is still in the
local network, while an inside global address (IGA) is the IP address of the same inside host when the
packet is on the WAN side. The following table summarizes this information.

Table 6-1 NAT Definitions

Term Definition

Inside This refers to the host on the LAN.

Outside This refers to the host on the WAN.

Local This refers to the packet address (source or destination) as the packet travels on the LAN.

Global This refers to the packet address (source or destination) as the packet travels on the WAN.

Please note that the IP address (either local or global) of an outside host is never

changed.

6.1.2 What NAT Does

In the simplest form, NAT changes the source IP address in a packet received from a subscriber (the inside
local address) to another (the inside global address) before forwarding the packet to the WAN side. When
the response comes back, NAT translates the destination address (the inside global address) back the inside
local address before forwarding it to the original inside host. Note that the IP address (either local or global)
of an outside host is never changed.
The global IP addresses for the inside hosts can be either static or dynamically assigned by the ISP. In
addition, you can designate servers, e.g., a web server and a telnet server, on your local network and make

NAT 6-1

P312 Broadband Security Gateway

them accessible to the outside world. If you do not define any servers (for Many-to-One and Many-to-Many
Overload mapping – see below), NAT offers the additional benefit of firewall protection. If no server is
defined in these cases, all incoming inquiries will be filtered out by your Prestige, thus preventing intruders
from probing your network. For more information on IP address translation, refer to RFC 1631, The IP

Network Address Translator (NAT).

6.1.3 How NAT works

Each packet has two addresses – a source address and a destination address. For outgoing packets, the ILA
(Inside Local Address) is the source address on the LAN, and the IGA (Inside Global Address) is the source
address on the WAN. For incoming packets, the ILA is the destination address on the LAN, and the IGA is
the destination address on the WAN. NAT maps private (local) IP addresses to globally unique ones
required for communication with hosts on other networks. It replaces the original IP source address (and
TCP or UDP source port numbers for Many-to-One and Many-to-Many Overload NAT mapping) in each
packet and then forwards it to the Internet. The Prestige keeps track of the original addresses and port
numbers so incoming reply packets can have their original values restored. The following diagram
illustrates this.

Figure 6-1 How NAT Works

6.1.4 NAT Mapping Types

NAT supports five types of IP/port mapping. They are:

1. One to One: In One-to-One mode, the Prestige maps one local IP address to one global IP address.

6-2 NAT

P312 Broadband Security Gateway

2. Many to One: In Many-to-One mode, the Prestige maps multiple local IP addresses to one global IP

address. This is equivalent to SUA (i.e., PAT, port address translation), ZyXEL’s Sin gle User Account
feature that previous ZyXEL routers supported (the SUA Only option in today’s routers).

3. Many to Many Overload: In Many-to-Many Overload mode, the Prestige maps the multiple local IP

addresses to shared global IP addresses.

4. Many to Many No Overload: In Many-to-Many No Overload mode, the Prestige maps the each local IP

addresses to unique global IP addresses.

5. Server: This type allows you to specify inside servers of different services behind the NAT to be

accessible to the outside world.

Port numbers do not change for One-to-One and Many-to-Many-No Overload NAT

The following table summarizes these types.

Table 6-2 NAT Mapping Types

Type IP Mapping SMT abbreviation

One-to-One ILA1!" IGA1 1:1
Many-to-One (SUA/PAT) ILA1!" IGA1

Many-to-Many Overload ILA1!" IGA1

Many-to-Many No Overload ILA1!" IGA1

Server Server 1 IP!" IGA1

mapping types.

M:1
ILA2!" IGA1
…

M:M Ov
ILA2!" IGA2
ILA3!" IGA1
ILA4!" IGA2
…

M:M No Ov
ILA2!" IGA2
ILA3!" IGA3
…

Server
Server 2 IP!" IGA1
Server 3 IP!" IGA1

6.1.5 SUA (Single User Account) Versus NAT

SUA (Single User Account) in previous ZyNOS versions is a subset of NAT that supports two types of
mapping, Many-to-One and Server. See section 6.2.3 for a detailed description of the NAT set for SUA.
The Prestige now has Full Feature NAT support to map global IP addresses to local IP addresses of
clients or servers using all mapping types as outlined in Table 6-2. The Prestige supports NAT sets on a

NAT 6-3

P312 Broadband Security Gateway

remote node basis. They are reusable, but only one set is allowed for each remote node. The Prestige
supports 2 sets since there is only one remote node. The second set (SUA Only option in Menu 15.1) is a
convenient, pre-configured, read only Many-to-1 port mapping set, sufficient for most purposes (see section

6.4 for some examples) and helpful to people already familiar with SUA in previous ZyNOS versions.

6.1.6 NAT Application

The following figure illustrates a possible NAT application, where three inside LANs (logical LANs using
IP Alias) behind the Prestige can “talk” to three distinct Internet destinations. More examples follow at the
end of this chapter.

Figure 6-2 NAT Application

6.2 SMT Menus

6.2.1 Applying NAT in the SMT Menus

You apply NAT via menus 4 or 11.3 as displayed next. The next figure how you apply NAT for Internet
access in Menu 4. Enter 4 from the Main Menu to go to Menu 4 - Internet Access Setup.

6-4 NAT

P312 Broadband Security Gateway

Menu 4 - Internet Access Setup

ISP's Name= ChangeMe
Encapsulation= Ethernet
Service Type= Standard
My Login= N/A
My Password= N/A
Login Server IP= N/A

IP Address Assignment= Dynamic
IP Address= N/A
IP Subnet Mask= N/A
Gateway IP Address= N/A
Network Address Translation= SUA Only

Press ENTER to Confirm or ESC to Cancel:

Figure 6-3 Applying NAT for Internet Access

This figure shows how you apply NAT to the remote node in Menu 11.1.

Step 1. Enter 11 from the Main Menu.
Step 2. Move the cursor to the Edit IP field, press the [SPACEBAR] to toggle the default No to Yes,

then press [ENTER] to bring up Menu 11.3 - Remote Node Network Layer Options.

Menu 11.3 - Remote Node Network Layer Options

IP Address Assignment= Dynamic
IP Address= N/A
IP Subnet Mask= N/A
Gateway IP Addr= N/A

Network Address Translation= Full Feature
Metric= N/A
Private= N/A
RIP Direction= None
Version= N/A
Multicast= None

Figure 6-4 Applying NAT to the Remote Node

The following table describes the options for Network Address Translation.

NAT 6-5

P312 Broadband Security Gateway

Table 6-3 Applying NAT in Menus 4 & 11.3

Field Options Description

Network
Address
Translation

Full Feature

None

SUA Only

When you select this option the SMT will use
Address Mapping Set 1 (Menu 15.1 – see section

6.2.3 for further discussion). You can config ure any
of the 5 mapping types described in Table 6-2.

NAT is disabled when you select this option.
When you select this option the SMT will use

Address Mapping Set 255 (Menu 15.1 – see section

6.2.3). It is a convenient, pre-configured, read only
Many-to-1 port mapping set, sufficient for most
purposes and helpful to people already familiar with
SUA in previous ZyNOS versions. Note that there is
also a Server type whose IGA is 0.0.0.0 in this set.

6.2.2 Configuring NAT

To configure NAT, enter 15 from the Main Menu to bring up the following screen.

Menu 15 – NAT Setup

1. Address Mapping Sets

2. NAT Server Setup

Enter Menu Selection Number:

Figure 6-5 Menu 15 NAT Setup

6.2.3 Address Mapping Sets and NAT Server Sets:

Use the Address Mapping Sets menus and submenus to create the mapping table used to assign global
addresses to machines on the LAN. Each remote node must specify which NAT Address Mapping Set to
use. The Prestige has one remote node and so allows you to configure only 1 NAT Address Mapping Set.
You can see two NAT Address Mapping sets in Menu 15.1. You can only configure Set 1. Set 255 is used
for SUA. When you select Full Feature in menu 4 or 11.3, the SMT will use Set 1, which supports all
mapping types as outlined in Table 6-2. When you select SUA Only, the SMT will use the pre-configured
Set 255 (read only) – see section 6.1.4.
The NAT Server set is a list of LAN side servers mapped to external ports. To use this set (one set for the
Prestige), a server rule must be set up inside the NAT Address Mapping set. Please see section 6.3 for
further information on these menus.
Enter 1 to bring up Menu 15.1 – Address Mapping Sets.

6-6 NAT

P312 Broadband Security Gateway

Menu 15.1 - Address Mapping Sets

1. NAT_SET

255. SUA (read only)

Enter Menu Selection Number:

Figure 6-6 Menu 15.1 Address Mapping Sets

Let’s look first at Option 255. Option 255 is equivalent to SUA in previous ZyXEL routers (see section

6.1.4). The fields in this menu cannot be changed. Entering 255 brings up this screen.

Menu 15.1.255 - Address Mapping Rules

Set Name= SUA

Idx Local Start IP Local End IP Global Start IP Global End IP Type

--- --------------- --------------- --------------- --------------- ------

1. 0.0.0.0 255.255.255.255 0.0.0.0 M-1

2. 0.0.0.0 Server

3.

4.

5.

6.

7.

8.

9.

10.

Press ENTER to Confirm or ESC to Cancel:

Figure 6-7 SUA Address Mapping Rules

The following table explains the fields in this screen.

Please note that the fields in this menu are read-only. The Type, Local and Global

Start/End IPs are normally (not for this read-only menu) configured in Menu 15.1.1.1

(described later) and the values are displayed here.

NAT 6-7

P312 Broadband Security Gateway

Table 6-4 SUA Address Mapping Rules

Field Description Options/Example

Set Name This is the name of the set you selected in Menu

15.1 or enter the name of a new set you want to

create.
Idx This is the index or rule number.
Local Start IP
Local End IP

Global Start IP This is the starting global IP address (IGA). If you

Global End IP This is the ending global IP address (IGA).
Type These are the mapping types discussed above

Local Start IP is the starting local IP address (ILA)

Figure 6-1

(see

IP address (ILA). If the rule is for all local IPs, then

the Start IP is 0.0.0.0 and the End IP is

255.255.255.255.

have a dynamic IP, enter 0.0.0.0 as the Global

Start IP.

(see Table 6-2

multiple servers of different types behind NAT to

this machine. See section 6.4.3 below for some

examples.

). Local End IP is the ending local

). Type Server allows us to specify

SUA

1

0.0.0.0

255.255.255.255

0.0.0.0

N/A

Server

Note: For all Local and Global IPs, the End IP address must begin after the IP Start

address.

Now let’s look at Option 1 in Menu 15.1. Enter 1 to bring up this menu. We’ll just look at the differences
from the previous menu. Note that, this screen is not read only, so we have extra Action and Select Rule
fields. Note also that the [?] in the Set Name field means that this is a required field and you must enter a
name for the set.

Please note that if the Set Name field is left blank, the entire set will be deleted.

6-8 NAT

P312 Broadband Security Gateway

Menu 15.1.1 - Address Mapping Rules

Set Name= NAT_SET

Idx Local Start IP Local End IP Global Start IP Global End IP Type

--- --------------- --------------- --------------- --------------- ------

1.
2

3.

4.

5.

6.

7.

8.

9.

10.

Action= Edit Select Rule=

Press ENTER to Confirm or ESC to Cancel:

Figure 6-8 First Set in Menu 15.1.1

The Type, Local and Global Start/End IPs are configured in Menu 15.1.1.1 (described

later) and the values are displayed here.

Ordering Your Rules

Ordering your rules is important because the Prestige applies the rules in the order that you specify. When a
rule matches the current packet, the Prestige takes the corresponding action and the remaining rules are
ignored. If t here are an y empty rule s before your new configured rule, your confi gured rule will be pushe d
up by that number of empty rules. For example, if you have already configured rules 1 to 6 in your current
set and now you configure rule number 9. In the set summary screen, the new rule will be rule 7, not 9.
Now if you delete rule 4, rules 5 to 7 will be pushed up by 1 rule, so as old rule 5 becomes rule 4, old rule 6
becomes rule 5 and old rule 7 becomes rule 6.
The description of the other fields is as described above. The Type, Local and Global Start/End IPs are
configured in Menu 15.1.1.1 (described later) and the values are displayed here.

Table 6-5 Menu 15.1.1

Field Description Option

Set Name

Action

Enter a name for this set of rules. This is a required
field. Please note that if this field is left blank, the
entire set will be deleted.

There are 4 actions. The default is Edit. Edit means
you want to edit a selected rule (see following field).
Insert Before means to insert a rule before the rule
selected. The rules after the selected rule will then be

Edit

Insert Before

Delete and

Save Set

NAT 6-9

P312 Broadband Security Gateway

moved down by one rule. Delete means to delete the
selected rule and then all the rules after the selected
one will be advanced one rule. Save Set means to
save the whole set (note when you choose this action,
the Select Rule item will be disabled).

Select Rule

When you choose Edit, Insert Before or Delete in the
previous field the cursor jumps to this field to allow you
to select the rule to apply the action in question.

N.B.: Save Set in the Action field means to save the whole set. You must do this if you

make any changes to the set – including deleting a rule. No changes to the set take

Be careful when ordering your rules as each rule is executed in turn beginning from

Selecting Edit in the Action field and then selecting a rule brings up the following menu, Menu 15.1.1.1

place until this action is taken.

rule 1.

Address Mapping Rule in which you can edit an individual rule and configure the Type, Local and Global
Start/End IPs displayed in Menu 15.1.1.

Menu 15.1.1.1 Address Mapping Rule

Type= One-to-One

Local IP:
Start=

End = N/A

Global IP:
Start=
End = N/A

-

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

Figure 6-9 Editing an Individual Rule in a Set

The following table describes the fields in this screen.

Table 6-6 Menu 15.1.1.1 – configuring an individual rule

Field Description Option/Example

Type Press the [SPACEBAR] to toggle through a

total of 5 types. These are the mapping
types discussed above (see

Table 6-2

).
Type Server allows us to specify multiple
servers of different types behind NAT to this
machine. See section 6.4.3 below for some

One-to-One

Many-to-One

Many-to-Many

Overload

Many-to-Many No

Overload

6-10 NAT

P312 Broadband Security Gateway

Field Description Option/Example

examples.

Local IP

Global IP

Note: For all Local and Global IPs, the End IP address must begin after the IP Start

address, i.e., you cannot have an End IP address beginning before the Start IP

Only local IP fields are N/A for server;
Global IP fields MUST be set for
Server.

Start This is the starting local IP address (ILA).

End This is the ending local IP address (ILA). If

the rule is for all local IPs, then put the Start
IP as 0.0.0.0 and the End IP as

255.255.255.255. This field is N/A for One-
to-One and Server types.

Start This is the starting global IP address (IGA).

If you have a dynamic IP, enter 0.0.0.0 as
the Global IP Start. Note that Global IP
Start can be set to 0.0.0.0 only if the types
are Many-to-One or Server.

End This is the ending global IP address (IGA).

This field is N/A for One-to-One, Many -to-
One and Server types.

address.

and Server

0.0.0.0

255.255.255.255

0.0.0.0

172.16.23.55

6.3 NAT Server Sets

A NAT server set is a list of inside servers (behind NAT on the LAN) that you can make visible to the
outside world. Menu 15.2 – NAT Server Sets is used to configure these servers. If you’re using Ethernet
Encapsulation with either RR-Manager or RR-Toshiba Service Type port 12 set to 1025 (non-editable)
as displayed in Figure 6-11.

6.3.1 Multiple Servers behind NAT

If you wish, you can make inside servers for different services, e.g., web or FTP, visible to the outside
users, even though NAT makes your whole inside network appear as a single machine to the outside world.
A service is identified by the port number, e.g., web service is on port 80 and FTP on port 21.
As an example (see the following figure), if you have a web server at 192.168.1.36 and an FTP server

192.168.1.33, then you need to specify for port 80 (web) the server at IP address 192.168.1.36 and for port
21 (FTP) another at IP address 192.168.1.33.
Please note that a server can support more than one service, e.g., a server can provide both FTP and DNS
service, while another provides only web service.

NAT 6-11

P312 Broadband Security Gateway

Figure 6-10 Multiple Servers Behind NAT

6.3.2 Configuring a Server behind NAT

Follow the steps below to configure a server behind NAT:

Step 1. Enter 15 in the main menu to go to Menu 15 – NAT Setup.
Step 2. Enter 2 to go to Menu 15.2 - NAT Server Setup.
Step 3. Enter the service port number in the Port # field and the inside IP address of the server in the IP

Address field.

Step 4. Press [ENTER] at the “Press ENTER to confirm …” prompt to save your configuration after

you define all t he servers or press ESC at any time to cancel.

Note: If you’re using Ethernet Encapsulation with either RR-Manager or RR-Toshiba

Service Type, then the SMT does not allow you to cha nge the port 1025 entry.

The most often used port numbers are shown in the following table. Please refer to RFC 1700 for further
information about port numbers. Please also refer to our included disk for more examples and details on
NAT.

6-12 NAT

P312 Broadband Security Gateway

Menu 15.2 - NAT Server Setup

----

Port #

1

Default

.

2.21 192.168.1.33

3.23 192.168.1.34

4.25 192.168.1.35

5.80 192.168.1.36

6. 0 0.0.0.0

7. 0 0.0.0.0

8. 0 0.0.0.0

9. 0 0.0.0.0

10. 0 0.0.0.0

11. 0 0.0.0.0

12. 1025 RR Reserved

Press ENTER to Confirm or ESC to Cancel:

IP Address

---------------

0.0.0.0

Figure 6-11 Menu 15.2 – NAT Server Setup

Table 6-7 Services & Port numbers

Services Port Number

FTP (File Transfer Protocol) 21
Telnet 23
SMTP (Simple Mail Transfer Protocol) 25
DNS(Domain Name System) 53
HTTP (Hyper Text Transfer protocol or WWW, Web) 80
PPTP (Point-to-Point Tunneling Protocol) 1723

6.4 Examples

6.4.1 Internet Access Only

In our Internet access example, we only need one rule where all our ILAs (Inside Local addresses) map to
one dynamic IGA (Inside Global Address) assigned by our ISP.

NAT 6-13

P312 Broadband Security Gateway

Figure 6-12 NAT Example 1

ISP's Name= ChangeMe
Encapsulation= Ethernet
Service Type= Standard
My Login= N/A
My Password= N/A
Login Server IP= N/A

IP Address Assignment= Dynamic
IP Address= N/A
IP Subnet Mask= N/A
Gateway IP Address= N/A
Network Address Translation= SUA Only

Menu 4 - Internet Access Setup

Press ENTER to Confirm or ESC to Cancel:

Figure 6-13 Internet Access & NAT Example

From Menu 4 shown above, simply choose the SUA Only option from the Network Address Translation
field. This is the Many-to-One mapping discussed in section 6.1.4. The SUA Only read only option from
the Network Address Translation field in Menus 4 and 11.3 is specifically pre-configured to handle this
case.

6-14 NAT

P312 Broadband Security Gateway

6.4.2 Example 2 – Internet Access with an Inside Server

Figure 6-14 NAT Example 2

In this case, we do exactly as above (use the convenient pre-configured SUA Only set) and also go to
Menu 15.2 to specify the Inside Server behind the NAT as shown in the next figure.

Menu 15.2 - NAT Server Setup

Port #

---­ 1

Default

.

2.0 0.0.0.0

3.0 0.0.0.0

4.0 0.0.0.0

5.0 0.0.0.0

6. 0 0.0.0.0

7. 0 0.0.0.0

8. 0 0.0.0.0

9. 0 0.0.0.0

10. 0 0.0.0.0

11. 0 0.0.0.0

12. 1025 RR Reserved

IP Address

---------------

192.168.1.10

Press ENTER to Confirm or ESC to Cancel:

Figure 6-15 Specifying an Inside Sever

6.4.3 Example 3 – General Case

In this example, we have 3 IGAs from our ISP. W e have many dep artments b ut two have their own FTP
server. All departments share the same router. We want to reserve 1 IGA for each department with an FTP

NAT 6-15

P312 Broadband Security Gateway

server and the other IGA is used by all. We want to map the FTP servers to the first two of our IGAs and
the other LAN traffic to the remaining IGA. We also want to map out third IGA to an inside web server and
mail server. We need to configure 4 rules, 2 bi-directional and 2 one directional as follows.
Rule 1. We map our first IGA to our first inside FTP server for FTP traffic in both directions (1: 1

mapping, giving both local and global IP addresses).

Rule 2. We map our second IGA to our second inside FTP server for FTP traffic in both directions (1: 1

mapping, giving both local and global IP addresses).

Rule 3. We map our other outgoing LAN traffic to IGA3 (Many : 1 mapping).
Rule 4. We also map our third IGA to our web server and mail server on the LAN. Type Server

allows us to specify multiple servers, of different types, to other machines behind NAT on the
LAN.

Our situation looks somewhat like this:

Figure 6-16 NAT - Example 3

Step 1. In this case we need to configure Address Mapping Set 1 from Menu 15.1 - Address Mapping

Sets. Therefore we must choose the Full Feature option from the Network Address
Translation field (in Menu 4 or Menu 11.3) in Figure 6-17.

Step 2. Then enter 15 from the Main Menu.
Step 3. Enter 1 to configure the Address Mapping Sets.
Step 4. Choose 1 to begin configuring this new set. Enter a Set Name, choose the Edit Action and then

select 1 from Select Rule field. Press [ENTER] to confirm.

6-16 NAT

P312 Broadband Security Gateway

Step 5. Select Type= as One-to-One (direct mapping for packets going both ways), and enter the local

Start IP as 192.168.1.10 (the IP address of FTP Server 1), the global Start IP as 10.132.50.1

(our first IGA). (See Figure 6-18)

Step 6. Repeat the previous step for rules 2 to 4 as outlined above.
Step 7. When finished, Menu 15.1.1 should look like as shown in Figure 6-19.

Menu 11.3 - Remote Node Network Layer Options

IP Address Assignment= Dynamic
IP Address= N/A
IP Subnet Mask= N/A
Gateway IP Addr= N/A

Network Address Translation= Full Feature
Metric= N/A
Private= N/A
RIP Direction= None
Version= N/A

Figure 6-17 Example 3 – Menu 11.3

The following figure shows how to configure the first rule.

Menu 15.1.1.1 Address Mapping Rule

Type= One-to-One

Local IP:
Start= 192.168.1.10

End = N/A

Global IP:
Start= 10.132.50.1
End = N/A

Press ENTER to Confirm or ESC to Cancel:

Press Space Bar to Toggle.

Figure 6-18 Example 3 – Menu 15.1.1.1

NAT 6-17

P312 Broadband Security Gateway

When we have configured all four rules, Menu 15.1.1 should look as follows.

Menu 15.1.1 - Address Mapping Rules

Set Name= Example3

Idx Local Start IP Local End IP Global Start IP Global End IP Type

--- --------------- --------------- --------------- --------------- ------

1. 192.168.1.10 10.132.50.1 1-1
2 192.168.1.11 10.132.50.2 1-1

3. 0.0.0.0 255.255.255.255 10.132.50.3 M-1

4. 10.132.50.3 Server

5.

6.

7.

8.

9.

10.

Action= Edit Select Rule=

Press ENTER to Confirm or ESC to Cancel:

Figure 6-19 Example 3 Final Menu 15.1.1

Now we configure our IGA3 to map to our web server and mail server on the LAN.

Step 8. Enter 15 from the Main Menu.
Step 9. Now enter 2 from this menu and configure it as shown in Figure 6-20.

Menu 15.2 - NAT Server Setup

----

Port #

1

Default

.

2.80 192.168.1.21

3.25 192.168.1.20

4.0 0.0.0.0

5.0 0.0.0.0

6. 0 0.0.0.0

7. 0 0.0.0.0

8. 0 0.0.0.0

9. 0 0.0.0.0

10. 0 0.0.0.0

11. 0 0.0.0.0

12. 1025 RR Reserved

Press ENTER to Confirm or ESC to Cancel:

IP Address

---------------

0.0.0.0

Figure 6-20 Example 3 – Menu 15.2

6-18 NAT

P312 Broadband Security Gateway

6.4.4 Example 4 –NAT Unfriendly Application Programs

Some applications do not support NAT Mapping using TCP or UDP port address translation. In this case it
is better to use Many-to-Many No Overload mapping as port numbers do not change for Many-to-Many
No Overload (and One-to-One) NAT mapping types. The following figure illustrates this.

Figure 6-21 NAT Example 4

Other applications, e.g., gaming programs are NAT unfriendly because they embed

addressing informati on in the da ta stre am. The se applications still won’t wor k

through NAT even when using One-to-One and Many-to-Many No Overload mapping

Follow the steps outlined in example 3 above to configure these two menus as follows.

types.

NAT 6-19

P312 Broadband Security Gateway

Menu 15.1.1.1 Address Mapping Rule

Type= Many-to-Many No Overload

Local IP:
Start= 192.168.1.10
End = 192.168.1.12

Global IP:
Start= 10.132.50.1
End = 10.132.50.3

Press ENTER to Confirm or ESC to Cancel:

Figure 6-22 Example 4- Menu 15.1.1.1 - Address Mapping Rule

After you’ve configured this menu, you should see the following screen.

Menu 15.1.1 - Address Mapping Rules

Set Name= Example4

Idx Local Start IP Local End IP Global Start IP Global End IP Type

--- --------------- --------------- --------------- --------------- ------

1. 192.168.1.10 192.168.1.12 10.132.50.1 10.132.50.3 M-M No Ov

2.

3.

4.

5.

6.

7.

8.

9.

10.

Action= Edit Select Rule=

Press ENTER to Confirm or ESC to Cancel:

Figure 6-23 Example 4 - Menu 15.1.1 - Address Mapping Rules

6-20 NAT

Advanced Management

Part III:

Advanced Management

Chapters 7 - 12 provide information on Prestige filtering, System Information and Diagnosis,

Transferring Files and Telnet.

III

P312 Broadband Security Gateway

Chapter 7

Filter Configuration

This chapter shows you how to create and apply filter(s).

7.1 About Filtering

Your Prestige uses filters to decide whether to allow passage of a data packet and/or to make a call. There
are two types of filter applications: data filtering and call filtering. Filters are subdivided into device and
protocol filters, which are discussed later.
Data filtering screens the data to determine if the packet should be allowed to pass. Data filters are divided
into incoming and outgoing filters, depending on the direction of the packet relative to a port. Data filtering
can be applied on either the WAN side or the LAN side. Call filtering is used to determine if a packet
should be allowed to trigger a call. Remote node call filtering is only applicable when using PPPoE
encapsulation. Outgoing packets must undergo data filtering before they encounter call filtering as shown in
the following figure.

Call Filtering

Outgoing

Packet

Data
Filtering

Match MatchMatch

Drop

packet

No

match

Call Filters

Drop packet
if line not up

Built-in

default

No

match

Or Or

Send packet

but do not reset

Idle Timer

User-defined

Call Filters

(if applicable)

Drop packet
if line not up

Send packet

but do not reset

Idle Timer

No

match

Active Data

Initiate call

if line not up

Send packet

and reset

Idle Timer

Figure 7-1 Outgoing Packet Filtering Process

For incoming packets, your Prestige applies data filters only. Packets are pro cessed depending upon
whether a match is found. The following sections describe how to configure filter sets.

Filters 7-1

P312 Broadband Security Gateway

7.1.1 The Filter Structure of the Prestige

A filter set consists of one or more filter rules. Usually, you would group related rules, e.g., all the rules for
NetBIOS, into a single set and give it a descriptive name. The Prestige allows you to configure up to twelve
filter sets with six rules in each set, for a total of 72 filter rules in the system. You cannot mix device filter
rules and protocol filter rules within the same set. You can apply up to four filter sets to a particular port to
block multiple types of packets. With each filter set having up to six rules, you can have a maximum of 24
rules active for a single port.
Three sets of factory default filter rules have been configured in Menu 21 to prevent NetBIOS traffic from
triggering calls and to prevent incoming telnetting. A summary of their filter rules is shown in the figures
that follow.
The following diagram illustrates the logic flow when executing a filter rule. See also Figure 7-10 for the
logic flow when executing an IP filter.

7-2 Filters

Filter Set

P312 Broadband Security Gateway

Start

Packet into

filter

Fetch First

Filter Set

Fetch Next

Filter Set

Yes

Next Filter Set

Available?

No

No

Fetch Next

Filter Rule

Yes

Next filter

Rule

Available?

Check

Next
Rule

Fetch First
Filter Rule

No

Active?

Execute

Filter Rule

Drop

Yes

Forward

Accept PacketDrop Packet

Figure 7-2 Filter Rule Process

You can apply up to four filter sets to a particular port to block multiple types of packets. With each filter
set having up to six rules, you can have a maximum o f 24 rules active for a single port.

Filters 7-3

P312 Broadband Security Gateway

7.2 Configuring a Filter Set

To configure a filter set, follow the procedure below. For more information on Menus 21.2 and 21.3, please

see Part 4.

Step 1. Select option 21. Filter Set Configuration from the Main Menu to open Menu 21 .

Menu 21 - Filter and Firewall Setup

1. Filter Setup

2. Firewall Setup

3. View Firewall Log

Enter Menu Selection Number:

Figure 7-4 Menu 21 – Filter and Firewall Setup

Step 2. Enter 1 to b ring up the following menu.

Menu 21.1 - Filter Set Configuration

Filter Filter
Set # Comments Set # Comments

------ ----------------- ------ ----------------­ 1 NetBIOS_WAN 7 _______________
2 NetBIOS_LAN 8 _______________
3 TEL_FTP_WEB_WAN 9 _______________
4 --------------- 10 _______________
5 _______________ 11 _______________
6 _______________ 12 _______________

Enter Filter Set Number to Configure= 0

Edit Comments= N/A

Press ENTER to Confirm or ESC to Cancel:

Figure 7-5 Menu 21.1 - Filter Set Configuration

Step 3. Select the filter set you wish to configure (no. 1-12) and press [Enter]

.

Step 4. Enter a descriptive name or comment in the Edit Comments field and press [Enter].
Step 5. Press [Enter] at the message: [Press ENTER to confirm] to op en M enu 21.1.1 - Filter Rules

Summary.

7-4 Filters

P312 Broadband Security Gateway

Menu 21.1.1 - Filter Rules Summary

# A Type Filter Rules M m n

- - ---- -------------------------------------------- --------- - - ­ 1 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=137 N D N
2 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=138 N D N
3 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=139 N D N
4 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=137 N D N
5 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=138 N D N
6 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=139 N D F

Enter Filter Rule Number (1-6) to Configure:

Press ENTER to Confirm or ESC to Cancel:

Figure 7-6 NetBIOS_WAN Filter Rules Summary

Menu 21.1.2 - Filter Rules Summary

# A Type Filter Rules M m n

- - ---- -------------------------------------------- --------- - - ­ 1 Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=53 N D F
2 Y
3 Y
4 Y
5 Y
6 Y

Enter Filter Rule Number (1-6) to Configure:

Figure 7-7 NetBIOS _LAN Filter Rules Summary

Menu 21.3 - Filter Rules Summary

# A Type Filter Rules M m n

- - ---- --------------------------------------------------------------- - - ­ 1 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=23 N D N
2 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=21 N D N
3 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=80 N D F
4 N
5 N
6 N

Enter Filter Rule Number (1-6) to Configure:

Figure 7-8 TEL_FTP_WEB_WAN Filter Rules Summary

Filters 7-5