Prestige 334
Broadband Router with Firewall
User’s Guide
Version 3.60
12/2004
Prestige 334 User’s Guide
Copyright
Copyright © 2004 by ZyXEL Communications Corporation.
The contents of this publication may not be reproduced in any part or as a whole, transcribed,
stored in a retrieval system, translated into any language, or transmitted in any form or by any
means, electronic, mechanical, magnetic, optical, chemical, photocopying, manual, or
otherwise, without the prior written permission of ZyXEL Communications Corporation.
Published by ZyXEL Communications Corporation. All rights reserved.
Disclaimer
ZyXEL does not assume any liability arising out of the application or use of any products, or
software described herein. Neither does it convey any license under its patent rights nor the
patent rights of others. ZyXEL further reserves the right to make changes in any products
described herein without notice. This publication is subject to change without notice.
Trademarks
ZyNOS (ZyXEL Network Operating System) is a registered trademark of ZyXEL
Communications, Inc. Other trademarks mentioned in this publication are used for
identification purposes only and may be properties of their respective owners.
Copyright 2
Prestige 334 User’s Guide
Federal Communications
Commission (FCC) Interference
Statement
This device complies with Part 15 of FCC rules. Operation is subject to the following two
conditions:
• This device may not cause harmful interference.
• This device must accept any interference received, including interference that may cause
undesired operations.
This equipment has been tested and found to comply with the limits for a Class B digital
device pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable
protection against harmful interference in a commercial environment. This equipment
generates, uses, and can radiate radio frequency energy, and if not installed and used in
accordance with the instructions, may cause harmful interference to radio communications.
If this equipment does cause harmful interference to radio/television reception, which can be
determined by turning the equipment off and on, the user is encouraged to try to correct the
interference by one or more of the following measures:
• Reorient or relocate the receiving antenna.
• Increase the separation between the equipment and the receiver.
• Connect the equipment into an outlet on a circuit different from that to which the receiver
is connected.
• Consult the dealer or an experienced radio/TV technician for help.
Notice 1
Changes or modifications not expressly approved by the party responsible for compliance
could void the user's authority to operate the equipment.
Certifications
Go to www.zyxel.com
1 Select your product from the drop-down list box on the ZyXEL home page to go to that
product's page.
2 Select the certification you wish to view from this page
3 Federal Communications Commission (FCC) Interference Statement
Prestige 334 User’s Guide
ZyXEL Limited Warranty
ZyXEL warrants to the original end user (purchaser) that this product is free from any defects
in materials or workmanship for a period of up to two years from the date of purchase. During
the warranty period, and upon proof of purchase, should the product have indications of failure
due to faulty workmanship and/or materials, ZyXEL will, at its discretion, repair or replace the
defective products or components without charge for either parts or labor, and to whatever
extent it shall deem necessary to restore the product or components to proper operating
condition. Any replacement will consist of a new or re-manufactured functionally equivalent
product of equal value, and will be solely at the discretion of ZyXEL. This warranty shall not
apply if the product is modified, misused, tampered with, damaged by an act of God, or
subjected to abnormal working conditions.
Note
Repair or replacement, as provided under this warranty, is the exclusive remedy of the
purchaser. This warranty is in lieu of all other warranties, express or implied, including any
implied warranty of merchantability or fitness for a particular use or purpose. ZyXEL shall in
no event be held liable for indirect or consequential damages of any kind of character to the
purchaser.
To obtain the services of this warranty, contact ZyXEL's Service Center for your Return
Material Authorization number (RMA). Products must be returned Postage Prepaid. It is
recommended that the unit be insured when shipped. Any returned products without proof of
purchase or those with an out-dated warranty will be repaired or replaced (at the discretion of
ZyXEL) and the customer will be billed for parts and labor. All repaired or replaced products
will be shipped by ZyXEL to the corresponding return address, Postage Paid. This warranty
gives you specific legal rights, and you may also have other rights that vary from country to
country.
Safety Warnings
1 To reduce the risk of fire, use only No. 26 AWG or larger telephone wire.
2 Do not use this product near water, for example, in a wet basement or near a swimming
pool.
3 Avoid using this product during an electrical storm. There may be a remote risk of
electric shock from lightening.
ZyXEL Limited Warranty 4
Prestige 334 User’s Guide
5 ZyXEL Limited Warranty
Prestige 334 User’s Guide
Customer Support
Please have the following information ready when you contact customer support.
• Product model and serial number.
• Warranty Information.
• Date that you received your device.
• Brief description of the problem and the steps you took to solve it.
METHOD
LOCATION
WORLDWIDE
NORTH
AMERICA
GERMANY
FRANCE
SPAIN
DENMARK
NORWAY
SWEDEN
FINLAND
SUPPORT E-MAIL TELEPHONE
SALES E-MAIL FAX FTP SITE
support@zyxel.com.tw +886-3-578-3942 www.zyxel.com
sales@zyxel.com.tw +886-3-578-2439 ftp.zyxel.com
support@zyxel.com +1-800-255-4101
+1-714-632-0882
sales@zyxel.com +1-714-632-0858 ftp.us.zyxel.com
support@zyxel.de +49-2405-6909-0 www.zyxel.de ZyXEL Deutschland GmbH.
sales@zyxel.de +49-2405-6909-99
info@zyxel.fr +33 (0)4 72 52 97 97 www.zyxel.fr Z yX E L F r an c e
+33 (0)4 72 52 19 20
support@zyxel.es +34 902 195 420 www.zyxel.es Z yX E L C o m m un i c a t i o n s
sales@zyxel.es +34 913 005 345
support@zyxel.dk +45 39 55 07 00 www.zyxel.dk Z y X E L C o m m u n i c a t i o n s A / S
sales@zyxel.dk +45 39 55 07 07
support@zyxel.no +47 22 80 61 80 www.zyxel.no Z y X E L C o m m u n i c a t i o n s A / S
sales@zyxel.no +47 22 80 61 81
support@zyxel.se +46 31 744 7700 www.zyxel.se ZyXEL Communications A/S
sales@zyxel.se +46 31 744 7701
support@zyxel.fi +358 9 4780 8411 www.zyxel.fi Z yXEL Com mu n ications Oy
sales@zyxel.fi +358 9 4780 8448
A
WEB SITE
REGULAR MAIL
ZyXEL Communications Corp.
www.europe.zyxel.com
ftp.europe.zyxel.com
www.us.zyxel.com ZyXEL Communications Inc.
6 Innov ati on Road II
Sc ience Park
Hs inchu 3 00
Ta iw a n
1130 N. Miller St.
Ana hei m
CA 92806- 2001
U.S.A.
Adenauerstr. 20/A2 D-52146
Wuerselen
Germany
1 rue des Ve rg er s
Ba t. 1 / C
69760 Limonest
France
A l e j a n d r o V i l l e g a s 3 3
1 º , 2 8 0 4 3 M a d r i d
Spain
Col um bu sv ej 5
2860 Soeborg
Denmark
Ni ls Hansens vei 13
0667 Oslo
Norway
Sjöporten 4, 41764 Göteborg
Sweden
Mal mi nk aa ri 10
00700 Helsinki
Finland
Customer Support 6
Prestige 334 User’s Guide
a. “+” is the (prefix) number you enter to make an international telephone call.
7 Customer Support
Prestige 334 User’s Guide
Table of Contents
Copyright .................................................................................................................. 2
Federal Communications Commission (FCC) Interference Statement ............... 3
ZyXEL Limited Warranty.......................................................................................... 4
Customer Support.................................................................................................... 6
Preface .................................................................................................................... 30
Chapter 1
Getting to Know Your Prestige ............................................................................. 32
1.1 Prestige Internet Security Gateway Overview ....................................................32
1.2 Prestige Features ...............................................................................................32
1.2.1 Physical Features .....................................................................................32
1.2.1.1 10/100M Auto-negotiating Ethernet/Fast Ethernet Interface(s) .......32
1.2.1.2 Auto-crossover 10/100 Mbps Ethernet Interface(s) .........................32
1.2.1.3 4-Port Switch ...................................................................................32
1.2.1.4 Time and Date .................................................................................32
1.2.1.5 Reset Button ...................................................................................33
1.2.2 Non-Physical Features .............................................................................33
1.2.2.1 Trend Micro Security Services ........................................................33
1.2.2.2 IPSec VPN Capability ......................................................................33
1.2.2.3 Firewall ............................................................................................33
1.2.2.4 Content Filtering ..............................................................................33
1.2.2.5 Brute-Force Password Guessing Protection ...................................33
1.2.2.6 Packet Filtering ...............................................................................33
1.2.2.7 Universal Plug and Play (UPnP) .....................................................34
1.2.2.8 Call Scheduling ...............................................................................34
1.2.2.9 PPPoE .............................................................................................34
1.2.2.10 PPTP Encapsulation .....................................................................34
1.2.2.11 Dynamic DNS Support ..................................................................34
1.2.2.12 IP Multicast ....................................................................................34
1.2.2.13 IP Alias ..........................................................................................34
1.2.2.14 SNMP ............................................................................................35
1.2.2.15 Network Address Translation (NAT) ..............................................35
1.2.2.16 Traffic Redirect ..............................................................................35
Table of Contents 8
Prestige 334 User’s Guide
1.3 Applications for the Prestige ..............................................................................36
1.3.1 Secure Broadband Internet Access via Cable or DSL Modem .................36
1.3.2 VPN Application ........................................................................................36
Chapter 2
Introducing the Web Configurator........................................................................ 38
2.1 Web Configurator Overview ...............................................................................38
2.2 Accessing the Prestige Web Configurator .........................................................38
2.3 Resetting the Prestige ........................................................................................39
2.3.1 Procedure To Use The Reset Button ........................................................39
2.3.2 Navigating the Prestige Web Configurator ...............................................39
2.3.3 Navigation Panel .......................................................................................40
1.2.2.17 Port Forwarding .............................................................................35
1.2.2.18 DHCP (Dynamic Host Configuration Protocol) ..............................35
1.2.2.19 Full Network Management ............................................................35
1.2.2.20 RoadRunner Support ....................................................................35
1.2.2.21 Logging and Tracing ......................................................................35
1.2.2.22 Upgrade Prestige Firmware via LAN .............................................36
1.2.2.23 Embedded FTP and TFTP Servers ...............................................36
Chapter 3
Wizard Setup .......................................................................................................... 44
3.1 Wizard Setup Overview ......................................................................................44
3.2 Wizard Setup: General Setup and System Name ..............................................44
3.2.1 Domain Name ...........................................................................................44
3.3 Wizard Setup: Screen 2 .....................................................................................45
3.3.1 Ethernet ....................................................................................................45
3.3.2 PPPoE Encapsulation ...............................................................................47
3.3.3 PPTP Encapsulation .................................................................................48
3.4 Wizard Setup: Screen 3 .....................................................................................50
3.4.1 WAN IP Address Assignment ...................................................................50
3.4.2 IP Address and Subnet Mask ...................................................................50
3.4.3 DNS Server Address Assignment .............................................................51
3.4.4 WAN MAC Address ..................................................................................51
3.5 Basic Setup Complete ........................................................................................53
Chapter 4
System Screens ..................................................................................................... 56
4.1 System Overview ...............................................................................................56
4.2 Configuring General Setup .................................................................................56
4.3 Dynamic DNS .....................................................................................................58
4.3.1 DynDNS Wildcard .....................................................................................58
4.4 Configuring Dynamic DNS .................................................................................58
9 Table of Contents
Prestige 334 User’s Guide
4.5 Configuring Password ........................................................................................60
4.6 Configuring Time Setting ....................................................................................60
Chapter 5
LAN Screens........................................................................................................... 64
5.1 LAN Overview ....................................................................................................64
5.2 DHCP Setup .......................................................................................................64
5.2.1 IP Pool Setup ............................................................................................64
5.2.2 System DNS Servers ................................................................................64
5.3 LAN TCP/IP ........................................................................................................64
5.3.1 Factory LAN Defaults ................................................................................64
5.3.2 IP Address and Subnet Mask ...................................................................65
5.3.3 RIP Setup .................................................................................................65
5.3.4 Multicast ....................................................................................................65
5.4 Configuring IP ....................................................................................................66
5.5 Configuring Static DHCP ....................................................................................69
5.6 Configuring IP Alias ............................................................................................70
Chapter 6
WAN Screens.......................................................................................................... 72
6.1 WAN Overview ...................................................................................................72
6.2 TCP/IP Priority (Metric) ......................................................................................72
6.3 Configuring Route ..............................................................................................72
6.4 Configuring WAN ISP .........................................................................................73
6.4.1 Ethernet Encapsulation .............................................................................73
6.4.2 PPPoE Encapsulation ...............................................................................74
6.4.3 PPTP Encapsulation .................................................................................77
6.5 Configuring WAN IP ...........................................................................................78
6.6 Configuring WAN MAC .......................................................................................81
6.7 Traffic Redirect ...................................................................................................82
6.8 Configuring Traffic Redirect ................................................................................83
Chapter 7
Network Address Translation (NAT) Screens...................................................... 86
7.1 NAT Overview ....................................................................................................86
7.1.1 NAT Definitions .........................................................................................86
7.1.2 What NAT Does ........................................................................................87
7.1.3 How NAT Works .......................................................................................87
7.1.4 NAT Application ........................................................................................88
7.1.5 NAT Mapping Types .................................................................................89
7.2 Using NAT ..........................................................................................................90
7.2.1 SUA (Single User Account) Versus NAT ..................................................90
7.3 SUA Server ........................................................................................................90
Table of Contents 10
Prestige 334 User’s Guide
7.3.1 Default Server IP Address ........................................................................91
7.3.2 Port Forwarding: Services and Port Numbers ..........................................91
7.3.3 Configuring Servers Behind SUA (Example) ............................................92
7.4 Configuring SUA Server ....................................................................................93
7.5 Configuring Address Mapping ............................................................................95
7.5.1 Configuring Address Mapping ..................................................................96
7.6 Trigger Port Forwarding .....................................................................................98
7.6.1 Trigger Port Forwarding Example .............................................................98
7.6.2 Two Points To Remember About Trigger Ports .........................................99
7.7 Configuring Trigger Port Forwarding ..................................................................99
Chapter 8
Static Route Screens ........................................................................................... 102
8.1 Static Route Overview ......................................................................................102
8.2 Configuring IP Static Route ..............................................................................102
8.2.1 Configuring Route Entry .........................................................................103
Chapter 9
UPnP...................................................................................................................... 106
9.1 Universal Plug and Play Overview ..................................................................106
9.1.1 How Do I Know If I'm Using UPnP? ........................................................106
9.1.2 NAT Traversal .........................................................................................106
9.1.3 Cautions with UPnP ................................................................................106
9.2 UPnP and ZyXEL .............................................................................................107
9.3 Configuring UPnP ............................................................................................107
9.4 Installing UPnP in Windows Example ..............................................................108
9.4.1 Installing UPnP in Windows Me ..............................................................109
9.4.2 Installing UPnP in Windows XP .............................................................. 110
9.5 Using UPnP in Windows XP Example ............................................................. 111
9.5.1 Auto-discover Your UPnP-enabled Network Device ............................... 112
9.5.2 Web Configurator Easy Access ..............................................................113
9.5.3 Web Configurator Easy Access ..............................................................114
Chapter 10
Trend Micro Security Services ............................................................................ 116
10.1 Trend Micro Security Service Overview .........................................................116
10.2 Configuring Service Settings ..........................................................................116
10.3 Virus Protection ..............................................................................................118
10.4 Configuring Virus Protection .......................................................................... 118
10.5 Parental Controls ...........................................................................................120
10.6 Parental Controls Configuration .....................................................................120
10.6.1 Parental Controls Statistics ...................................................................124
11 Table of Contents
Prestige 334 User’s Guide
Chapter 11
Firewall.................................................................................................................. 126
11.1 Introduction .....................................................................................................126
11.1.1 What is a Firewall? ................................................................................126
11.1.2 Stateful Inspection Firewall. ..................................................................126
11.1.3 About the Prestige Firewall ...................................................................126
11.1.4 Guidelines For Enhancing Security With Your Firewall .........................127
11.2 Firewall Settings Screen .................................................................................127
11.3 The Firewall, NAT and Remote Management ................................................129
11.3.1 LAN-to-WAN rules .................................................................................129
11.3.2 WAN-to-LAN rules .................................................................................129
11.4 Services .........................................................................................................130
Chapter 12
Content Filtering ................................................................................................. 134
12.1 Introduction to Content Filtering .....................................................................134
12.2 Restrict Web Features ...................................................................................134
12.3 Days and Times .............................................................................................134
12.4 Configure Content Filtering ............................................................................134
Chapter 13
Remote Management Screens ............................................................................ 138
13.1 Remote Management Overview .....................................................................138
13.1.1 Remote Management Limitations .........................................................138
13.1.2 Remote Management and NAT ............................................................139
13.1.3 System Timeout ...................................................................................139
13.2 Configuring WWW ..........................................................................................139
13.3 Configuring Telnet ..........................................................................................140
13.4 Configuring TELNET ......................................................................................141
13.5 Configuring FTP .............................................................................................142
13.6 SNMP .............................................................................................................143
13.6.1 Supported MIBs ....................................................................................144
13.6.2 SNMP Traps .........................................................................................144
13.6.3 Configuring SNMP ................................................................................144
13.7 Configuring DNS ............................................................................................146
13.8 Configuring Security .......................................................................................147
Chapter 14
Introduction to IPSec ........................................................................................... 150
14.1 VPN Overview ................................................................................................150
14.1.1 IPSec ....................................................................................................150
14.1.2 Security Association .............................................................................150
14.1.3 Other Terminology ................................................................................150
Table of Contents 12
Prestige 334 User’s Guide
14.1.4 VPN Applications ..................................................................................151
14.2 IPSec Architecture .........................................................................................151
14.2.1 IPSec Algorithms ..................................................................................152
14.2.2 Key Management ..................................................................................152
14.3 Encapsulation .................................................................................................152
14.3.1 Transport Mode ....................................................................................153
14.3.2 Tunnel Mode .........................................................................................153
14.4 IPSec and NAT ...............................................................................................153
Chapter 15
VPN Screens....................................................................................................... 156
15.1 VPN/IPSec Overview .....................................................................................156
15.2 IPSec Algorithms ............................................................................................156
15.2.1 AH (Authentication Header) Protocol ....................................................156
15.2.2 ESP (Encapsulating Security Payload) Protocol ..................................156
15.3 My IP Address ................................................................................................157
15.4 Secure Gateway Address ..............................................................................157
15.4.1 Dynamic Secure Gateway Address ......................................................158
15.5 Summary Screen ...........................................................................................158
15.6 Keep Alive ......................................................................................................160
15.7 NAT Traversal ................................................................................................160
15.7.1 NAT Traversal Configuration .................................................................160
15.7.2 Remote DNS Server .............................................................................161
15.8 ID Type and Content ......................................................................................162
15.8.1 ID Type and Content Examples ............................................................163
15.9 Pre-Shared Key ..............................................................................................163
15.10 Editing VPN Rules ........................................................................................164
15.11 IKE Phases ..................................................................................................167
15.11.1 Negotiation Mode ................................................................................168
15.11.2 Diffie-Hellman (DH) Key Groups .........................................................168
15.11.3 Perfect Forward Secrecy (PFS) ..........................................................168
15.12 Configuring Advanced IKE Settings .............................................................169
15.13 Manual Key Setup ........................................................................................174
15.13.1 Security Parameter Index (SPI) ..........................................................175
15.14 Configuring Manual Key ...............................................................................175
15.15 Viewing SA Monitor ......................................................................................178
15.16 Configuring Global Setting ...........................................................................179
15.17 Telecommuter VPN/IPSec Examples ...........................................................180
15.17.1 Telecommuters Sharing One VPN Rule Example ..............................180
14.1.3.1 Encryption ...................................................................................150
14.1.3.2 Data Confidentiality .....................................................................151
14.1.3.3 Data Integrity ...............................................................................151
14.1.3.4 Data Origin Authentication ..........................................................151
13 Table of Contents
Prestige 334 User’s Guide
15.17.2 Telecommuters Using Unique VPN Rules Example ...........................181
15.18 VPN and Remote Management ...................................................................182
Chapter 16
Centralized Logs .................................................................................................. 184
16.1 View Log ........................................................................................................184
16.2 Log Settings ...................................................................................................186
Chapter 17
Maintenance ......................................................................................................... 190
17.1 Maintenance Overview ...................................................................................190
17.2 Status Screen .................................................................................................190
17.2.1 System Statistics ...................................................................................192
17.3 DHCP Table Screen .......................................................................................192
17.4 F/W Upload Screen ........................................................................................193
17.4.1 Preparing your Prestige for Firmware Upload ......................................194
17.5 Configuration Screen .....................................................................................196
17.5.1 Backup Configuration ...........................................................................196
17.5.2 Restore Configuration ..........................................................................197
17.5.3 Back to Factory Defaults .......................................................................198
17.6 Restart Screen ...............................................................................................198
Chapter 18
Introducing the SMT ............................................................................................200
18.1 SMT Introduction ............................................................................................200
18.1.1 Procedure for SMT Configuration via Telnet .........................................200
18.1.2 Entering Password ................................................................................200
18.1.3 Prestige SMT Menu Overview ..............................................................201
18.2 Navigating the SMT Interface .........................................................................201
18.2.1 System Management Terminal Interface Summary ..............................203
18.3 Changing the System Password ....................................................................204
Chapter 19
Menu 1 General Setup ......................................................................................... 206
19.1 General Setup ................................................................................................206
19.2 Procedure To Configure Menu 1 ....................................................................206
19.2.1 Procedure to Configure Dynamic DNS .................................................208
Chapter 20
Menu 2 WAN Setup .............................................................................................. 210
20.1 Introduction to WAN .......................................................................................210
20.2 WAN Setup .....................................................................................................210
Table of Contents 14
Prestige 334 User’s Guide
Chapter 21
Menu 3 LAN Setup ...............................................................................................212
21.1 LAN Setup ......................................................................................................212
21.1.1 General Ethernet Setup ........................................................................212
21.2 Protocol Dependent Ethernet Setup ..............................................................213
21.3 TCP/IP Ethernet Setup and DHCP ................................................................213
21.3.1 IP Alias Setup .......................................................................................215
Chapter 22
Internet Access .................................................................................................... 218
22.1 Introduction to Internet Access Setup ............................................................218
22.2 Ethernet Encapsulation ..................................................................................218
22.3 Configuring the PPTP Client ..........................................................................220
22.4 Configuring the PPPoE Client ........................................................................221
22.5 Basic Setup Complete ....................................................................................222
Chapter 23
Remote Node Configuration ............................................................................... 224
23.1 Introduction to Remote Node Setup ...............................................................224
23.2 Remote Node Profile Setup ...........................................................................224
23.2.1 Ethernet Encapsulation .........................................................................224
23.2.2 PPPoE Encapsulation ...........................................................................226
23.2.2.1 Outgoing Authentication Protocol ................................................226
23.2.2.2 Nailed-Up Connection .................................................................227
23.2.3 PPTP Encapsulation .............................................................................227
23.3 Edit IP .............................................................................................................228
23.4 Remote Node Filter ........................................................................................230
23.4.1 Traffic Redirect Setup ...........................................................................231
Chapter 24
Static Route Setup ............................................................................................... 234
24.1 IP Static Route Setup .....................................................................................234
Chapter 25
Network Address Translation (NAT)................................................................... 236
25.1 Using NAT ......................................................................................................236
25.1.1 SUA (Single User Account) Versus NAT ..............................................236
25.2 Applying NAT .................................................................................................236
25.3 NAT Setup ......................................................................................................238
25.3.1 Address Mapping Sets ..........................................................................239
25.3.1.1 User-Defined Address Mapping Sets ..........................................240
25.3.1.2 Ordering Your Rules ....................................................................241
25.4 Configuring a Server behind NAT ..................................................................243
15 Table of Contents
Prestige 334 User’s Guide
25.5 General NAT Examples ..................................................................................244
25.5.1 Example 1: Internet Access Only ..........................................................245
25.5.2 Example 2: Internet Access with an Inside Server ...............................245
25.5.3 Example 3: Multiple Public IP Addresses With Inside Servers .............246
25.5.4 Example 4: NAT Unfriendly Application Programs ...............................250
25.6 Configuring Trigger Port Forwarding .............................................................252
Chapter 26
Enabling the Firewall ........................................................................................... 254
26.1 Remote Management and the Firewall ..........................................................254
26.2 Access Methods .............................................................................................254
26.3 Enabling the Firewall ......................................................................................254
Chapter 27
Filter Configuration.............................................................................................. 256
27.1 Introduction to Filters ......................................................................................256
27.1.1 The Filter Structure of the Prestige .......................................................257
27.2 Configuring a Filter Set ..................................................................................258
27.2.1 Configuring a Filter Rule .......................................................................260
27.2.2 Configuring a TCP/IP Filter Rule ..........................................................260
27.2.3 Configuring a Generic Filter Rule .........................................................263
27.3 Example Filter ................................................................................................265
27.4 Filter Types and NAT ......................................................................................267
27.5 Firewall Versus Filters ....................................................................................268
27.6 Applying a Filter ............................................................................................268
27.6.1 Applying LAN Filters .............................................................................268
27.6.2 Applying Remote Node Filters ..............................................................269
Chapter 28
SNMP Configuration ............................................................................................ 270
28.1 About SNMP ..................................................................................................270
28.2 Supported MIBs ............................................................................................271
28.3 SNMP Configuration ......................................................................................271
28.4 SNMP Traps ...................................................................................................272
Chapter 29
System Information and Diagnosis .................................................................... 274
29.1 System Status ................................................................................................274
29.2 System Information ........................................................................................276
29.2.1 System Information ...............................................................................276
29.2.2 Console Port Speed ..............................................................................277
29.3 Log and Trace ................................................................................................278
29.3.1 Syslog Logging .....................................................................................278
Table of Contents 16
Prestige 334 User’s Guide
29.3.2 Call-Triggering Packet ..........................................................................281
29.4 Diagnostic ......................................................................................................282
29.4.1 WAN DHCP ..........................................................................................283
Chapter 30
Firmware and Configuration File Maintenance ................................................. 286
30.1 Filename Conventions ...................................................................................286
30.2 Backup Configuration .....................................................................................287
30.2.1 Backup Configuration ...........................................................................287
30.2.2 Using the FTP Command from the Command Line ..............................288
30.2.3 Example of FTP Commands from the Command Line .........................289
30.2.4 GUI-based FTP Clients .........................................................................289
30.2.5 TFTP and FTP over WAN Management Limitations .............................289
30.2.6 Backup Configuration Using TFTP .......................................................290
30.2.7 TFTP Command Example ....................................................................290
30.2.8 GUI-based TFTP Clients ......................................................................291
30.3 Restore Configuration ....................................................................................291
30.3.1 Restore Using FTP ...............................................................................291
30.3.2 Restore Using FTP Session Example ..................................................293
30.4 Uploading Firmware and Configuration Files .................................................293
30.4.1 Firmware File Upload ............................................................................293
30.4.2 Configuration File Upload .....................................................................294
30.4.3 FTP File Upload Command from the DOS Prompt Example ................294
30.4.4 FTP Session Example of Firmware File Upload ...................................295
30.4.5 TFTP File Upload ..................................................................................295
30.4.6 TFTP Upload Command Example ........................................................296
29.3.1.1 CDR ............................................................................................279
29.3.1.2 Packet triggered ..........................................................................279
29.3.1.3 Filter log .....................................................................................280
29.3.1.4 PPP log ......................................................................................280
29.3.1.5 Firewall log ..................................................................................281
Chapter 31
System Maintenance............................................................................................ 298
31.1 Command Interpreter Mode ...........................................................................298
31.1.1 Command Syntax .................................................................................298
31.1.2 Command Usage ..................................................................................299
31.2 Call Control Support .......................................................................................299
31.2.1 Budget Management ............................................................................299
31.2.2 Call History ...........................................................................................300
31.3 Time and Date Setting ....................................................................................301
31.3.1 Resetting the Time ................................................................................304
17 Table of Contents
Prestige 334 User’s Guide
Chapter 32
Remote Management ........................................................................................... 306
32.1 Remote Management .....................................................................................306
32.1.1 Remote Management Limitations .........................................................307
Chapter 33
Call Scheduling .................................................................................................... 310
33.1 Introduction to Call Scheduling ......................................................................310
Chapter 34
VPN/IPSec Setup .................................................................................................. 314
34.1 VPN/IPSec Overview .....................................................................................314
34.2 IPSec Summary Screen .................................................................................315
34.3 IKE Setup .......................................................................................................321
34.4 Manual Setup .................................................................................................323
34.4.0.1 Active Protocol ............................................................................324
34.4.0.2 Security Parameter Index (SPI) ..................................................324
Chapter 35
SA Monitor ............................................................................................................ 326
35.1 SA Monitor Overview .....................................................................................326
35.2 Using SA Monitor ...........................................................................................326
Appendix A
Troubleshooting................................................................................................... 330
35.3 Problems with the Password ..........................................................................331
35.4 Problems with Remote Management .............................................................331
Appendix B
PPPoE ................................................................................................................... 332
Appendix C
PPTP......................................................................................................................334
Appendix D
NetBIOS Filter Commands .................................................................................. 338
Appendix E
Log Descriptions.................................................................................................. 340
Appendix F
Setting up Your Computer’s IP Address............................................................ 342
Appendix G
Brute-Force Password Guessing Protection..................................................... 354
Table of Contents 18
Prestige 334 User’s Guide
Appendix H
TMSS ..................................................................................................................... 356
Appendix I
Triangle Route ...................................................................................................... 360
19 Table of Contents
Prestige 334 User’s Guide
List of Figures
Figure 1 Secure Internet Access via Cable, DSL or Wireless Modem ................................ 36
Figure 2 VPN Application .................................................................................................... 37
Figure 3 Change Password Screen .................................................................................... 39
Figure 4 The MAIN MENU Screen of the Web Configurator ............................................... 40
Figure 5 Wizard 1: General Setup ....................................................................................... 45
Figure 6 Wizard 2: Ethernet Encapsulation ......................................................................... 46
Figure 7 Wizard 2: PPPoE Encapsulation ........................................................................... 48
Figure 8 Wizard 2: PPTP Encapsulation ............................................................................. 49
Figure 9 Wizard 3: WAN Setup ........................................................................................... 52
Figure 10 Wizard Finish ...................................................................................................... 54
Figure 11 System General Setup ....................................................................................... 57
Figure 12 DDNS .................................................................................................................. 59
Figure 13 Password ............................................................................................................ 60
Figure 14 Time Setting ........................................................................................................ 61
Figure 15 LAN IP ................................................................................................................. 67
Figure 16 Static DHCP ........................................................................................................ 70
Figure 17 IP Alias ................................................................................................................ 71
Figure 18 WAN: Route ........................................................................................................ 73
Figure 19 Ethernet Encapsulation ....................................................................................... 74
Figure 20 PPPoE Encapsulation ......................................................................................... 76
Figure 21 PPTP Encapsulation ........................................................................................... 77
Figure 22 WAN: IP .............................................................................................................79
Figure 23 MAC Setup .......................................................................................................... 81
Figure 24 Traffic Redirect WAN Setup ................................................................................ 82
Figure 25 Traffic Redirect LAN Setup ................................................................................. 83
Figure 26 WAN: Traffic Redirect .......................................................................................... 83
Figure 27 How NAT Works .................................................................................................. 88
Figure 28 NAT Application With IP Alias ............................................................................. 89
Figure 29 Multiple Servers Behind NAT Example ............................................................... 93
Figure 30 SUA/NAT Setup .................................................................................................. 94
Figure 31 Address Mapping ................................................................................................ 95
Figure 32 Address Mapping Edit ......................................................................................... 97
Figure 33 Trigger Port Forwarding Process: Example ........................................................ 98
Figure 34 Trigger Port .........................................................................................................99
Figure 35 Example of Static Routing Topology ................................................................... 102
Figure 36 Static Route .........................................................................................................103
List of Figures 20
Prestige 334 User’s Guide
Figure 37 Static Route: Edit ................................................................................................ 104
Figure 38 Configuring UPnP ............................................................................................... 108
Figure 39 Service Settings .................................................................................................. 117
Figure 40 Virus Protection ................................................................................................... 119
Figure 41 Parental Controls License Status ........................................................................ 121
Figure 42 Parental Controls ................................................................................................ 122
Figure 43 Parental Controls Statistics ................................................................................. 125
Figure 44 Firewall: Settings ................................................................................................. 128
Figure 45 Firewall Rule Directions ...................................................................................... 129
Figure 46 Firewall: Service .................................................................................................. 131
Figure 47 Content Filter ...................................................................................................... 135
Figure 48 Remote Management: WWW ............................................................................. 140
Figure 49 Telnet Configuration on a TCP/IP Network ......................................................... 141
Figure 50 Remote Management: Telnet .............................................................................. 141
Figure 51 Remote Management: FTP ................................................................................. 142
Figure 52 SNMP Management Model ................................................................................. 143
Figure 53 Remote Management: SNMP ............................................................................. 145
Figure 54 Remote Management: DNS ................................................................................ 146
Figure 55 Security ............................................................................................................... 147
Figure 56 Encryption and Decryption .................................................................................. 151
Figure 57 IPSec Architecture .............................................................................................. 152
Figure 58 Transport and Tunnel Mode IPSec Encapsulation .............................................. 153
Figure 59 IPSec Summary Fields ....................................................................................... 158
Figure 60 VPN: Summary ................................................................................................... 159
Figure 61 NAT Router Between IPSec Routers .................................................................. 160
Figure 62 VPN Host using Intranet DNS Server Example .................................................. 161
Figure 63 Mismatching ID Type and Content Configuration Example ................................ 163
Figure 64 VPN: Rule Setup (Basic) ..................................................................................... 164
Figure 65 Two Phases to Set Up the IPSec SA .................................................................. 167
Figure 66 VPN IKE: Advanced ............................................................................................ 170
Figure 67 Setup: Manual ..................................................................................................... 176
Figure 68 SA Monitor .......................................................................................................... 179
Figure 69 VPN: Global Setting ............................................................................................ 180
Figure 70 Telecommuters Sharing One VPN Rule Example ............................................... 181
Figure 71 Telecommuters Using Unique VPN Rules Example ........................................... 182
Figure 72 View Logs ........................................................................................................... 185
Figure 73 Log Settings ........................................................................................................ 187
Figure 74 Maintenance Status ............................................................................................ 191
Figure 75 Maintenance System Statistics ........................................................................... 192
Figure 76 Maintenance DHCP Table ................................................................................... 193
Figure 77 Maintenance Firmware Upload ........................................................................... 194
Figure 78 Upgrade Tool ....................................................................................................... 195
Figure 79 Upload Warning .................................................................................................. 195
21 List of Figures
Prestige 334 User’s Guide
Figure 80 Network Temporarily Disconnected .................................................................... 195
Figure 81 Maintenance Configuration ................................................................................. 196
Figure 82 Configuration Restore Successful ....................................................................... 197
Figure 83 Temporarily Disconnected ................................................................................... 197
Figure 84 Configuration Restore Error ................................................................................ 198
Figure 85 Factory Defaults .................................................................................................. 198
Figure 86 System Restart ................................................................................................... 199
Figure 87 Login Screen ....................................................................................................... 201
Figure 88 SMT Menu Overview .......................................................................................... 201
Figure 89 SMT Main Menu .................................................................................................. 203
Figure 90 Menu 23 System Password ................................................................................ 204
Figure 91 Menu 1 General Setup. ....................................................................................... 207
Figure 92 Menu 1.1 Configure Dynamic DNS .................................................................... 208
Figure 93 Menu 2 WAN Setu .............................................................................................. 210
Figure 94 Menu 3 LAN Setup .............................................................................................. 212
Figure 95 Menu 3.1 LAN Port Filter Setup. ......................................................................... 212
Figure 96 Menu 3.2 TCP/IP and DHCP Ethernet Setup ..................................................... 213
Figure 97 Physical Network & Partitioned Logical Networks .............................................. 215
Figure 98 Menu 3.2.1: IP Alias Setup ................................................................................. 215
Figure 99 Menu 4 Internet Access Setup ............................................................................ 219
Figure 100 Internet Access Setup (PPTP) ......................................................................... 221
Figure 101 Internet Access Setup (PPPoE) ........................................................................ 222
Figure 102 Menu 11.1 Remote Node Profile for Ethernet Encapsulation ............................ 225
Figure 103 Menu 11.1 Remote Node Profile for PPPoE Encapsulation .............................. 226
Figure 104 Menu 11.1 Remote Node Profile for PPTP Encapsulation ................................ 228
Figure 105 Menu 11.3 Remote Node Network Layer Options for Ethernet Encapsulation . 229
Figure 106 Menu 11.5: Remote Node Filter (Ethernet Encapsulation) ................................ 231
Figure 107 Menu 11.5: Remote Node Filter (PPPoE or PPTP Encapsulation) ................... 231
Figure 108 Menu 11.6: Traffic Redirect Setup .................................................................... 232
Figure 109 Menu 12 IP Static Route Setup ........................................................................ 234
Figure 110 Menu12.1 Edit IP Static Route .......................................................................... 235
Figure 111 Menu 4 Applying NAT for Internet Access ......................................................... 237
Figure 112 Menu 11.3 Applying NAT to the Remote Node .................................................. 238
Figure 113 Menu 15 NAT Setup .......................................................................................... 239
Figure 114 Menu 15.1 Address Mapping Sets .................................................................... 239
Figure 115 Menu 15.1.255 SUA Address Mapping Rules .................................................. 240
Figure 116 Menu 15.1.1 First Set ........................................................................................ 241
Figure 117 Menu 15.1.1.1 Editing/Configuring an Individual Rule in a Set ......................... 243
Figure 118 Menu 15.2.1 NAT Server Setup ........................................................................ 244
Figure 119 Multiple Servers Behind NAT Example ............................................................. 244
Figure 120 NAT Example 1 ................................................................................................. 245
Figure 121 Menu 4 Internet Access & NAT Example ......................................................... 245
Figure 122 NAT Example 2 ................................................................................................. 246
List of Figures 22
Prestige 334 User’s Guide
Figure 123 Menu 15.2.1 Specifying an Inside Server ......................................................... 246
Figure 124 NAT Example 3 ................................................................................................. 247
Figure 125 NAT Example 3: Menu 11.3 .............................................................................. 248
Figure 126 Example 3: Menu 15.1.1.1 ............................................................................... 249
Figure 127 Example 3: Final Menu 15.1.1 .......................................................................... 249
Figure 128 Example 3: Menu 15.2 ...................................................................................... 250
Figure 129 NAT Example 4 ................................................................................................. 251
Figure 130 Example 4: Menu 15.1.1.1 Address Mapping Rule. .......................................... 251
Figure 131 Example 4: Menu 15.1.1 Address Mapping Rules ............................................ 252
Figure 132 Menu 15.3 Trigger Port Setup ........................................................................... 253
Figure 133 Menu 21.2 Firewall Setup ................................................................................. 255
Figure 134 Outgoing Packet Filtering Process .................................................................... 256
Figure 135 Filter Rule Process ............................................................................................ 258
Figure 136 Menu 21: Filter and Firewall Setup ................................................................... 259
Figure 137 Menu 21.1: Filter Set Configuration .................................................................. 259
Figure 138 Menu 21.1.1.1 TCP/IP Filter Rule. .................................................................... 261
Figure 139 Executing an IP Filter ........................................................................................ 263
Figure 140 Menu 21.1.4.1 Generic Filter Rule .................................................................... 264
Figure 141 Telnet Filter Example ........................................................................................ 265
Figure 142 Example Filter: Menu 21.1.3.1 .......................................................................... 266
Figure 143 Example Filter Rules Summary: Menu 21.1.3 .................................................. 267
Figure 144 Protocol and Device Filter Sets ......................................................................... 268
Figure 145 Filtering LAN Traffic .......................................................................................... 269
Figure 146 Filtering Remote Node Traffic ........................................................................... 269
Figure 147 SNMP Management Model ............................................................................... 270
Figure 148 Menu 22 SNMP Configuration .......................................................................... 272
Figure 149 Menu 24 System Maintenance ......................................................................... 274
Figure 150 Menu 24.1 System Maintenance : Status ......................................................... 275
Figure 151 Menu 24.2 System Information and Console Port Speed ............................... 276
Figure 152 Menu 24.2.1 System Maintenance : Information ............................................. 277
Figure 153 Menu 24.2.2 System Maintenance : Change Console Port Speed ................... 278
Figure 154 Menu 24.3.2 System Maintenance : Syslog Logging ........................................ 278
Figure 155 Call-Triggering Packet Example ........................................................................ 282
Figure 156 Menu 24.4 System Maintenance : Diagnostic ................................................... 283
Figure 157 LAN & WAN DHCP ........................................................................................... 283
Figure 158 Telnet in Menu 24.5 ........................................................................................... 288
Figure 159 FTP Session Example ...................................................................................... 289
Figure 160 Telnet into Menu 24.6. ....................................................................................... 292
Figure 161 Restore Using FTP Session Example ............................................................... 293
Figure 162 Telnet Into Menu 24.7.1 Upload System Firmware ........................................... 294
Figure 163 Telnet Into Menu 24.7.2 System Maintenance . ................................................ 294
Figure 164 FTP Session Example of Firmware File Upload ............................................... 295
Figure 165 Command Mode in Menu 24 ............................................................................. 298
23 List of Figures
Prestige 334 User’s Guide
Figure 166 Valid Commands ............................................................................................... 299
Figure 167 Menu 24.9 System Maintenance : Call Control ................................................. 299
Figure 168 Budget Management ......................................................................................... 300
Figure 169 Menu 24.9.2 - Call History ................................................................................ 301
Figure 170 Menu 24: System Maintenance ....................................................................... 302
Figure 171 Menu 24.10 System Maintenance: Time and Date Setting ............................... 303
Figure 172 Menu 24.11 – Remote Management Control .................................................... 307
Figure 173 Menu 26 Schedule Setup .................................................................................. 310
Figure 174 Menu 26.1 Schedule Set Setup ....................................................................... 311
Figure 175 Applying Schedule Set(s) to a Remote Node (PPPoE) .................................... 312
Figure 176 VPN SMT Menu Tree ........................................................................................ 314
Figure 177 Menu 27 VPN/IPSec Setup ............................................................................... 315
Figure 178 Menu 27 ............................................................................................................ 315
Figure 179 Menu 27.1.1 IPSec Setup ................................................................................. 318
Figure 180 Menu 27.1.1.1 IKE Setup .................................................................................. 322
Figure 181 Menu 27.1.1.2 Manual Setup ............................................................................ 324
Figure 182 Menu 27.2 SA Monitor ...................................................................................... 327
Figure 183 Single-Computer per Router Hardware Configuration ...................................... 333
Figure 184 Prestige as a PPPoE Client .............................................................................. 333
Figure 185 Transport PPP frames over Ethernet ............................................................... 334
Figure 186 PPTP Protocol Overview .................................................................................. 335
Figure 187 Example Message Exchange between Computer and an ANT ........................ 336
Figure 188 WIndows 95/98/Me: Network: Configuration ..................................................... 343
Figure 189 Windows 95/98/Me: TCP/IP Properties: IP Address ......................................... 344
Figure 190 Windows 95/98/Me: TCP/IP Properties: DNS Configuration ............................ 345
Figure 191 Windows XP: Start Menu .................................................................................. 346
Figure 192 Windows XP: Control Panel .............................................................................. 346
Figure 193 Windows XP: Control Panel: Network Connections: Properties ....................... 347
Figure 194 Windows XP: Local Area Connection Properties .............................................. 347
Figure 195 Windows XP: Advanced TCP/IP Settings ......................................................... 348
Figure 196 Windows XP: Internet Protocol (TCP/IP) Properties ......................................... 349
Figure 197 Macintosh OS 8/9: Apple Menu ........................................................................ 350
Figure 198 Macintosh OS 8/9: TCP/IP ................................................................................ 351
Figure 199 Macintosh OS X: Apple Menu ........................................................................... 351
Figure 200 Macintosh OS X: Network ................................................................................. 352
Figure 201 Enable TMSS ................................................................................................... 356
Figure 202 TMSS Welcome Screen .................................................................................... 357
Figure 203 Download ActiveX Control ................................................................................ 357
Figure 204 Home Network Security Services Dashboard ................................................... 358
Figure 205 Ideal Setup ........................................................................................................ 360
Figure 206 “Triangle Route” Problem .................................................................................. 361
Figure 207 IP Alias .............................................................................................................. 362
Figure 208 Gateways on the WAN Side .............................................................................. 362
List of Figures 24
Prestige 334 User’s Guide
25 List of Figures
Prestige 334 User’s Guide
List of Tables
Table 1 Screens Summary ................................................................................................. 41
Table 2 Wizard 2: Ethernet Encapsulation ......................................................................... 46
Table 3 Wizard 2: PPPoE Encapsulation ........................................................................... 48
Table 4 Wizard 2: PPTP Encapsulation ............................................................................. 49
Table 5 Private IP Address Ranges ................................................................................... 50
Table 6 Example of Network Properties for LAN Servers with Fixed IP Addresses ........... 52
Table 7 Wizard 3: WAN Setup ............................................................................................ 52
Table 8 System General Setup .......................................................................................... 57
Table 9 DDNS .................................................................................................................... 59
Table 10 Password .............................................................................................................60
Table 11 Time Setting .........................................................................................................61
Table 12 LAN IP ................................................................................................................. 67
Table 13 Static DHCP ......................................................................................................... 70
Table 14 IP Alias ................................................................................................................ 71
Table 15 WAN: Route ......................................................................................................... 73
Table 16 Ethernet Encapsulation ....................................................................................... 74
Table 17 PPPoE Encapsulation ......................................................................................... 76
Table 18 PPTP Encapsulation ............................................................................................ 77
Table 19 WAN: IP ............................................................................................................... 79
Table 20 Traffic Redirect .................................................................................................... 83
Table 21 NAT Definitions .................................................................................................... 86
Table 22 NAT Mapping Types ............................................................................................ 90
Table 23 Services and Port Numbers ................................................................................. 92
Table 24 SUA/NAT Setup ................................................................................................... 94
Table 25 Address Mapping ................................................................................................. 95
Table 26 Address Mapping Edit ......................................................................................... 97
Table 27 Trigger Port .......................................................................................................... 99
Table 28 Static Route .........................................................................................................103
Table 29 Static Route: Edit ................................................................................................. 104
Table 30 Configuring UPnP ................................................................................................ 108
Table 31 Service Settings ................................................................................................... 117
Table 32 Virus Protection ................................................................................................... 119
Table 33 Parental Controls ................................................................................................. 122
Table 34 Parental Controls Statistics .................................................................................. 125
Table 35 Firewall: Settings ................................................................................................. 128
Table 36 Firewall: Service .................................................................................................. 131
List of Tables 26
Prestige 334 User’s Guide
Table 37 Content Filter .......................................................................................................135
Table 38 Remote Management: WWW .............................................................................. 140
Table 39 Remote Management: Telnet .............................................................................. 141
Table 40 Remote Management: FTP ................................................................................. 142
Table 41 SNMP Traps ........................................................................................................ 144
Table 42 Remote Management: SNMP .............................................................................. 145
Table 43 Remote Management: DNS ................................................................................ 146
Table 44 Security ................................................................................................................ 147
Table 45 VPN and NAT ...................................................................................................... 154
Table 46 AH and ESP ........................................................................................................ 157
Table 47 VPN: Summary .................................................................................................... 159
Table 48 Local ID Type and Content Fields ....................................................................... 162
Table 49 Peer ID Type and Content Fields ........................................................................ 162
Table 50 Matching ID Type and Content Configuration Example ....................................... 163
Table 51 VPN: Rule Setup (Basic) ..................................................................................... 164
Table 52 VPN IKE: Advanced ............................................................................................ 171
Table 53 Rule Setup: Manual ............................................................................................. 176
Table 54 SA Monitor ...........................................................................................................179
Table 55 VPN: Global Setting ............................................................................................. 180
Table 56 Telecommuter and Headquarters Configuration Example ................................... 181
Table 57 View Logs ............................................................................................................185
Table 58 Log Settings .........................................................................................................187
Table 59 Maintenance Status ............................................................................................. 191
Table 60 Maintenance System Statistics ............................................................................ 192
Table 61 Maintenance DHCP Table ................................................................................... 193
Table 62 Maintenance Restore Configuration .................................................................... 197
Table 63 Main Menu Commands ....................................................................................... 202
Table 64 Main Menu Summary .......................................................................................... 203
Table 65 Menu 1 General Setup ........................................................................................ 207
Table 66 Menu 1.1 Configure Dynamic DNS ..................................................................... 208
Table 67 Menu 2 WAN Setup ............................................................................................. 210
Table 68 DHCP Ethernet Setup Fields ............................................................................... 213
Table 69 Menu 3.2: LAN TCP/IP Setup Fields ................................................................... 214
Table 70 Menu 3.2.1: IP Alias Setup .................................................................................. 215
Table 71 Internet Access Setup (Ethernet ......................................................................... 219
Table 72 New Fields in Menu 4 (PPTP) Screen ................................................................. 221
Table 73 New Fields in Menu 4 (PPPoE) screen ............................................................... 222
Table 74 Menu 11.1 Remote Node Profile for Ethernet Encapsulation .............................. 225
Table 75 Fields in Menu 11.1 (PPPoE Encapsulation Specific) ......................................... 227
Table 76 Menu 11.1 Remote Node Profile for PPTP Encapsulation .................................. 228
Table 77 Remote Node Network Layer Options ................................................................. 229
Table 78 Menu 11.6: Traffic Redirect Setup ....................................................................... 232
Table 79 Menu12.1 Edit IP Static Route ............................................................................. 235
27 List of Tables
Prestige 334 User’s Guide
Table 80 Applying NAT in Menus 4 & 11.3 ......................................................................... 238
Table 81 SUA Address Mapping Rules .............................................................................. 240
Table 82 Menu 15.1.1 First Set .......................................................................................... 242
Table 83 Menu 15.1.1.1 Editing/Configuring an Individual Rule in a Set ........................... 243
Table 84 Menu 15.3 Trigger Port Setup ............................................................................. 253
Table 85 Abbreviations Used in the Filter Rules Summary Menu ...................................... 259
Table 86 Rule Abbreviations Used ..................................................................................... 260
Table 87 TCP/IP Filter Rule ................................................................................................ 261
Table 88 Generic Filter Rule Menu Fields .......................................................................... 264
Table 89 Menu 22 SNMP Configuration ............................................................................. 272
Table 90 SNMP Traps ........................................................................................................ 272
Table 91 Ports and Permanent Virtual Circuits ................................................................... 273
Table 92 System Maintenance: Status Menu Fields .......................................................... 275
Table 93 Menu 24.2.1 System Maintenance : Information ................................................. 277
Table 94 Menu 24.3.2 System Maintenance : Syslog and Accounting .............................. 278
Table 95 System Maintenance Menu Diagnostic ............................................................... 283
Table 96 Filename Conventions ......................................................................................... 287
Table 97 General Commands for GUI-based FTP Clients ................................................. 289
Table 98 General Commands for GUI-based TFTP Clients ............................................... 291
Table 99 Menu 24.9.1 - Budget Management .................................................................... 300
Table 100 Call History Fields .............................................................................................. 301
Table 101 Time and Date Setting Fields ............................................................................ 303
Table 102 Menu 24.11 – Remote Management Control ..................................................... 307
Table 103 Menu 26.1 Schedule Set Setup ......................................................................... 311
Table 104 Menu 27.1 IPSec Summary ............................................................................... 315
Table 105 Menu 27.1.1 IPSec Setup .................................................................................. 318
Table 106 Menu 27.1.1.1 IKE Setup .................................................................................. 322
Table 107 Active Protocol: Encapsulation and Security Protocol ....................................... 324
Table 108 Menu 27.1.1.2 Manual Setup ............................................................................ 324
Table 109 Menu 27.2 SA Monitor ....................................................................................... 327
Table 110 Troubleshooting ................................................................................................. 330
Table 111 Troubleshooting the Password ........................................................................... 331
Table 112 Troubleshooting Telnet ....................................................................................... 331
Table 113 NetBIOS Filter Default Settings ......................................................................... 339
Table 114 System Error logs .............................................................................................. 340
Table 115 System Maintenance Logs ................................................................................ 340
Table 116 UPnP Logs ......................................................................................................... 341
Table 117 ICMP Type and Code Explanations ................................................................... 341
Table 118 Brute-Force Password Guessing Protection Commands .................................. 354
List of Tables 28
Prestige 334 User’s Guide
29 List of Tables
Prestige 334 User’s Guide
Preface
Congratulations on your purchase of the Prestige 334 Broadband Router with Firewall. This
manual is designed to guide you through the configuration of your Prestige for its various
applications.
Note: Use the web configurator, System Management Terminal
(SMT) or command interpreter interface to configure your Prestige.
Not all features can be configured through all interfaces.
This manual may refer to the Prestige 334 or Broadband Router with Firewall as the Prestige.
Note: Register your product online to receive e-mail notices of
firmware upgrades and information at www.zyxel.com
products, or at www.us.zyxel.com
for North American products.
for global
About This User's Guide
This User’s Guide is designed to guide you through the configuration of your Prestige using
the web configurator or the SMT. The web configurator parts of this guide contain
background information on features configurable by web configurator. The SMT parts of this
guide contain background information solely on features not configurable by web configurator
Note: Use the web configurator, System Management Terminal
(SMT) or command interpreter interface to configure your
Prestige. Not all features can be configured through all
interfaces.
Related Documentation
• Supporting Disk
Refer to the included CD for support documents.
• Compact Guide
The Compact Guide is designed to help you get up and running right away. They contain
connection information and instructions on getting started.
• Web Configurator Online Help
Embedded web help for descriptions of individual screens and supplementary
information.
• ZyXEL Glossary and Web Site
Please refer to www.zyxel.com for an online glossary of networking terms and additional
support documentation.
Preface 30
Prestige 334 User’s Guide
User Guide Feedback
Help us help you! E-mail all User Guide-related comments, questions or suggestions for
improvement to techwriters@zyxel.com.tw or send regular mail to The Technical Writing
Team, ZyXEL Communications Corp., 6 Innovation Road II, Science-Based Industrial Park,
Hsinchu, 300, Taiwan. Thank you!
Syntax Conventions
• “Enter” means for you to type one or more characters. “Select” or “Choose” means for
you to use one predefined choices.
• The SMT menu titles and labels are in Bold Times New Roman font. Predefined field
choices are in Bold Arial font. Command and arrow keys are enclosed in square
brackets. [ENTER] means the Enter, or carriage return key; [ESC] means the Escape key
and [SPACE BAR] means the Space Bar.
• Mouse action sequences are denoted using a comma. For example, “click the Apple icon,
Control Panels and then Modem” means first click the Apple icon, then point your
mouse pointer to Control Panels and then click Modem.
• For brevity’s sake, we will use “e.g.,” as a shorthand for “for instance”, and “i.e.,” for
“that is” or “in other words” throughout this manual.
Graphics Icons Key
Prestige Computer Notebook computer
Server DSLAM Firewall
Modem Switch Router
31 Preface
Prestige 334 User’s Guide
CHAPTER 1
Getting to Know Your Prestige
This chapter introduces the main features and applications of the Prestige.
1.1 Prestige Internet Security Gateway Overview
The Prestige is the ideal secure gateway for all data passing between the Internet and LAN’s.
By integrating NAT, firewall, media bandwidth management and VPN capability, ZyXEL’s
Prestige is a complete security solution that protects your Intranet and efficiently manages data
traffic on your network.
The embedded web configurator is easy to operate.
1.2 Prestige Features
The following sections describe Prestige features.
1.2.1 Physical Features
1.2.1.1 10/100M Auto-negotiating Ethernet/Fast Ethernet Interface(s)
This auto-negotiation feature allows the Prestige to detect the speed of incoming transmissions
and adjust appropriately without manual intervention. It allows data transfer of either 10 Mbps
or 100 Mbps in either half-duplex or full-duplex mode depending on your Ethernet network.
1.2.1.2 Auto-crossover 10/100 Mbps Ethernet Interface(s)
These interfaces automatically adjust to either a crossover or straight-through Ethernet cable.
1.2.1.3 4-Port Switch
A combination of switch and router makes your Prestige a cost-effective and viable network
solution. You can add up to four computers to the Prestige without the cost of a hub. Add more
than four computers to your LAN by using a hub.
1.2.1.4 Time and Date
The Prestige allows you to get the current time and date from an external server when you turn
on your Prestige. You can also set the time manually.
Chapter 1 Getting to Know Your Prestige 32
Prestige 334 User’s Guide
1.2.1.5 Reset Button
The Prestige reset button is built into the rear panel. Use this button to restore the factory
default password to 1234; IP address to 192.168.1.1, subnet mask to 255.255.255.0 and DHCP
server enabled with a pool of 32 IP addresses starting at 192.168.1.33.
1.2.2 Non-Physical Features
1.2.2.1 Trend Micro Security Services
Trend Micro Security Services (TMSS) are a range of services including virus protection
and parental controls,
access the Internet via broadband routers. Computers that are connected to the Internet via
broadband connection increase the risk of attacks such as viruses, hackers, spyware and spam.
When TMSS is enabled you can configure how often the TMSS Web page displays and select
the computers in your network that you want this service to apply.
1.2.2.2 IPSec VPN Capability
designed to address the security needs of computers on a network that
Establish a Virtual Private Network (VPN) to connect with business partners and branch
offices using data encryption and the Internet to provide secure communications without the
expense of leased site-to-site lines. The Prestige VPN is based on the IPSec standard and is
fully interoperable with other IPSec-based VPN products.
1.2.2.3 Firewall
The Prestige is a stateful inspection firewall with DoS (Denial of Service) protection. By
default, when the firewall is activated, all incoming traffic from the WAN to the LAN is
blocked unless it is initiated from the LAN. The Prestige firewall supports TCP/UDP
inspection, DoS detection and prevention, real time alerts, reports and logs.
1.2.2.4 Content Filtering
The Prestige can also block access to web sites containing keywords that you specify. You can
define time periods and days during which content filtering is enabled and include or exclude a
range of users on the LAN from content filtering.
1.2.2.5 Brute-Force Password Guessing Protection
The Prestige has a special protection mechanism to discourage brute-force password guessing
attacks on the Prestige’s management interfaces. You can specify a wait-time that must expire
before entering a fourth password after three incorrect passwords have been entered. Please
see the appendices for details about this feature.
1.2.2.6 Packet Filtering
The packet filtering mechanism blocks unwanted traffic from entering/leaving your network.
33 Chapter 1 Getting to Know Your Prestige
1.2.2.7 Universal Plug and Play (UPnP)
Using the standard TCP/IP protocol, the Prestige and other UPnP enabled devices can
dynamically join a network, obtain an IP address and convey its capabilities to other devices
on the network.
1.2.2.8 Call Scheduling
Configure call time periods to restrict and allow access for users on remote nodes.
1.2.2.9 PPPoE
PPPoE facilitates the interaction of a host with an Internet modem to achieve access to highspeed data networks via a familiar "dial-up networking" user interface.
1.2.2.10 PPTP Encapsulation
Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of
data from a remote client to a private server, creating a Virtual Private Network (VPN) using a
TCP/IP-based network.
Prestige 334 User’s Guide
PPTP supports on-demand, multi-protocol and virtual private networking over public
networks, such as the Internet. The Prestige supports one PPTP server connection at any given
time.
1.2.2.11 Dynamic DNS Support
With Dynamic DNS (Domain Name System) support, you can have a static hostname alias for
a dynamic IP address, allowing the host to be more easily accessible from various locations on
the Internet. You must register for this service with a Dynamic DNS service provider.
1.2.2.12 IP Multicast
Deliver IP packets to a specific group of hosts using IP multicast. IGMP (Internet Group
Management Protocol) is the protocol used to support multicast groups. The latest version is
version 2 (see RFC 2236); the Prestige supports both versions 1 and 2.
1.2.2.13 IP Alias
IP Alias allows you to partition a physical network into logical networks over the same
Ethernet interface. The Prestige supports three logical LAN interfaces via its single physical
Ethernet LAN interface with the Prestige itself as the gateway for each LAN network.
Chapter 1 Getting to Know Your Prestige 34
Prestige 334 User’s Guide
1.2.2.14 SNMP
SNMP (Simple Network Management Protocol) is a protocol used for exchanging
management information between network devices. SNMP is a member of the TCP/IP
protocol suite. Your Prestige supports SNMP agent functionality, which allows a manager
station to manage and monitor the Prestige through the network. The Prestige supports SNMP
version one (SNMPv1) and version two (SNMPv2).
1.2.2.15 Network Address Translation (NAT)
Network Address Translation (NAT) allows the translation of an Internet protocol address
used within one network (for example a private IP address used in a local network) to a
different IP address known within another network (for example a public IP address used on
the Internet).
1.2.2.16 Traffic Redirect
Traffic Redirect forwards WAN traffic to a backup gateway on the LAN when the Prestige
cannot connect to the Internet, thus acting as an auxiliary backup when your regular WAN
connection fails.
1.2.2.17 Port Forwarding
Use this feature to forward incoming service requests to a server on your local network. You
may enter a single port number or a range of port numbers to be forwarded, and the local IP
address of the desired server.
1.2.2.18 DHCP (Dynamic Host Configuration Protocol)
DHCP (Dynamic Host Configuration Protocol) allows the individual client computers to
obtain the TCP/IP configuration at start-up from a centralized DHCP server. The Prestige has
built-in DHCP server capability, enabled by default, which means it can assign IP addresses,
an IP default gateway and DNS servers to all systems that support the DHCP client.
1.2.2.19 Full Network Management
The embedded web configurator is an all-platform web-based utility that allows you to easily
access the Prestige’s management settings and configure the firewall. Most functions of the
Prestige are also software configurable via the SMT (System Management Terminal)
interface. The SMT is a menu-driven interface that you can access over a telnet connection.
1.2.2.20 RoadRunner Support
In addition to standard cable modem services, the Prestige supports Time Warner’s
RoadRunner Service.
1.2.2.21 Logging and Tracing
• Built-in message logging and packet tracing.
35 Chapter 1 Getting to Know Your Prestige
• Unix syslog facility support.
• Firewall logs.
• Content filtering logs.
1.2.2.22 Upgrade Prestige Firmware via LAN
The firmware of the Prestige can be upgraded via the LAN (refer to Maintenance- F/W
Upload Screen).
1.2.2.23 Embedded FTP and TFTP Servers
The Prestige’s embedded FTP and TFTP Servers enable fast firmware upgrades as well as
configuration file backups and restoration.
1.3 Applications for the Prestige
Here are some examples of what you can do with your Prestige.
Prestige 334 User’s Guide
1.3.1 Secure Broadband Internet Access via Cable or DSL Modem
You can connect a cable modem, DSL or wireless modem to the Prestige for broadband
Internet access via an Ethernet or a wireless port on the modem. The Prestige guarantees not
only high speed Internet access, but secure internal network protection and traffic management
as well.
Figure 1 Secure Internet Access via Cable, DSL or Wireless Modem
1.3.2 VPN Application
Prestige VPN is an ideal cost-effective way to connect branch offices and business partners
over the Internet without the need (and expense) for leased lines between sites.
Chapter 1 Getting to Know Your Prestige 36
Prestige 334 User’s Guide
Figure 2 VPN Application
37 Chapter 1 Getting to Know Your Prestige
Introducing the Web
This chapter describes how to access the Prestige web configurator and provides an overview
of its screens.
2.1 Web Configurator Overview
The embedded web configurator allows you to manage the Prestige from anywhere through a
browser such as Microsoft Internet Explorer or Netscape Navigator. Use Internet Explorer 6.0
and later or Netscape Navigator 7.0 and later versions with JavaScript enabled. It is
recommended that you set your screen resolution to 1024 by 768 pixels. The screens you see
in the web configurator may vary somewhat from the ones shown in this document due to
differences between individual Prestige models or firmware versions.
Prestige 334 User’s Guide
CHAPTER 2
Configurator
2.2 Accessing the Prestige Web Configurator
1 Make sure your Prestige hardware is properly connected and prepare your computer/
computer network to connect to the Prestige (refer to the Quick Start Guide).
2 Launch your web browser.
3 Type "192.168.1.1" as the URL.
4 Type "1234" (default) as the password and click Login. In some versions, the default
password appears automatically - if this is the case, click Login.
5 You should see a screen asking you to change your password (highly recommended) as
shown next. Type a new password (and retype it to confirm) and click Apply or click
Ignore.
Chapter 2 Introducing the Web Configurator 38
Prestige 334 User’s Guide
Figure 3 Change Password Screen
You should now see the MAIN MENU screen)
Note: The management session automatically times out when
the time period set in the Administrator Inactivity Timer field
expires (default five minutes). Simply log back into the Prestige
if this happens to you
2.3 Resetting the Prestige
If you forget your password or cannot access the web configurator, you will need to use the
RESET button at the back of the Prestige to reload the factory-default configuration file. This
means that you will lose all configurations that you had previously and the password will be
reset to “1234”.
2.3.1 Procedure To Use The Reset Button
1 Make sure the PWR LED is on (not blinking).
2 Press the RESET button for ten seconds or until the PWR LED begins to blink and then
release it. When the PWR LED begins to blink, the defaults have been restored and the
Prestige restarts.
2.3.2 Navigating the Prestige Web Configurator
The following summarizes how to navigate the web configurator from the SITE MAP screen.
• Click WIZARD for initial configuration including general setup, ISP parameters for
Internet Access and WAN IP/DNS Server/MAC address assignment.
• Click a link under ADVANCED to configure advanced Prestige features.
39 Chapter 2 Introducing the Web Configurator
Prestige 334 User’s Guide
• Click to view the web configurator in the language of your choice.
• Click LOGOUT at any time to exit the web configurator.
• Click MAINTENANCE to view information about your Prestige or upgrade
configuration/firmware files. Maintenance includes Status (Statistics), DHCP Ta bl e, F/
W (firmware) Upload, Configuration (Backup, Restore, Defaults) and Restart.
Figure 4 The MAIN MENU Screen of the Web Configurator
2.3.3 Navigation Panel
After you enter the password, use the sub-menus on the navigation panel to configure Prestige
features.
Chapter 2 Introducing the Web Configurator 40
Prestige 334 User’s Guide
The following table describes the sub-menus.
Table 1 Screens Summary
LINK TAB FUNCTION
WIZARD SETUP Use these screens for initial configuration including general
SYSTEM General This screen contains administrative and system-related
LAN IP Use this screen to configure LAN DHCP, TCP/IP settings and to
WAN Route This screen allows you to configure route priority.
SUA/NAT SUA Server Use this screen to configure servers behind the Prestige.
STATIC ROUTE IP Static Route Use this screen to configure IP static routes.
FIREWALL Settings Use this screen to activate/deactivate the firewall and log packets
CONTENT
FILTERING
setup, ISP parameters for Internet Access and WAN IP/DNS
Server/MAC address assignment.
information.
DDNS Use this screen to set up dynamic DNS.
Password Use this screen to change your password.
Time Zone Use this screen to change your Prestige’s time and date.
enable Any IP.
Static DHCP Use this screen to assign IP addresses on the LAN to specific
individual computers based on their MAC Addresses.
IP Alias Use this screen to partition your LAN interface into subnets.
WAN ISP Use this screen to change your Prestige’s WAN ISP settings.
WAN IP Use this screen to change your Prestige’s WAN IP settings.
WAN MAC Use this screen to change your Prestige’s WAN MAC settings.
Traffic Redirect Use this screen to configure your traffic redirect properties and
parameters.
Address
Mapping
Trigger Port Use this screen to change your Prestige’s trigger port settings.
Services Use this screen to enable service blocking.
Filter This screen allows you to block sites containing certain keywords
Use this screen to configure network address translation
mapping rules.
related to firewall rules.
in the URL and set the days and times for the Prestige to perform
content filtering.
41 Chapter 2 Introducing the Web Configurator
Prestige 334 User’s Guide
Table 1 Screens Summary
LINK TAB FUNCTION
REMOTE MGMT TELNET Use this screen to configure through which interface(s) and from
which IP address(es) users can use Telnet to manage the
Prestige.
FTP Use this screen to configure through which interface(s) and from
which IP address(es) users can use FTP to access the Prestige.
WWW Use this screen to configure through which interface(s) and from
SNMP Use this screen to configure your Prestige’s settings for Simple
DNS Use this screen to configure through which interface(s) and from
Security Use this screen to change your anti-probing settings.
VPN Summary Use this screen to view the rule summary.
Rule Setup Use this screen to configure VPN connections.
SA Monitor Use this screen to display and manage active VPN connections.
Global Setting Use this screen to allow NetBIOS packets through the VPN
UPnP UPnP Use this screen to enable UPnP on the Prestige.
TMSS Service Settings Use this screen to decide which computers in the network you
Antivirus
Protection
Parental
Controls
LOGS View Log Use this screen to view the logs for the categories that you
Log Settings Use this screen to change your Prestige’s log settings.
MAINTENANCE Status This screen contains administrative and system-related
DHCP Table This screen displays DHCP (Dynamic Host Configuration
Any IP Use this screen to allow a computer to access the Internet
F/W Upload Use this screen to upload firmware to your Prestige.
Configuration Use this screen to backup and restore the configuration or reset
Restart This screen allows you to reboot the Prestige without turning the
LOGOUT Click this label to exit the web configurator.
which IP address(es) users can use HTTP to manage the
Prestige.
Network Management Protocol management.
which IP address(es) users can send DNS queries to the
Prestige.
connections.
can apply TMSS.
This screen allows you to check the computers in your network
for Trend Micro Internet Security.
This screen allows a parent (LAN administrator) to control a LAN
user's Internet access privileges by blocking specified website
categories.
selected.
information.
Protocol) related information and is READ-ONLY.
without changing the network settings of the computer, when the
IP addresses of the computer and the Prestige are not in the
same subnet.
the factory defaults to your Prestige.
power off.
Chapter 2 Introducing the Web Configurator 42
Prestige 334 User’s Guide
43 Chapter 2 Introducing the Web Configurator
Prestige 334 User’s Guide
CHAPTER 3
Wizard Setup
This chapter provides information on the Wizard Setup screens in the web configurator.
3.1 Wizard Setup Overview
The web configurator’s setup wizard helps you configure your device to access the Internet.
The second screen has three variations depending on what encapsulation type you use. Refer
to your ISP checklist in the Quick Start Guide to know what to enter in each field. Leave a
field blank if you don’t have that information.
3.2 Wizard Setup: General Setup and System Name
General Setup contains administrative and system-related information. System Name is for
identification purposes. However, because some ISPs check this name you should enter your
computer's "Computer Name".
• In Windows 95/98 click Start, Settings, Control Panel, Network. Click the
Identification tab, note the entry for the Computer Name field and enter it as the System
Name.
• In Windows 2000, click Start, Settings and Control Panel and then double-click
System. Click the Network Identification tab and then the Properties button. Note the
entry for the Computer name field and enter it as the System Name.
• In Windows XP, click Start, My Computer, View system information and then click
the Computer Name tab. Note the entry in the Full computer name field and enter it as
the Prestige System Name.
3.2.1 Domain Name
The Domain Name entry is what is propagated to the DHCP clients on the LAN. If you leave
this blank, the domain name obtained by DHCP from the ISP is used. While you must enter
the host name (System Name) on each individual computer, the domain name can be assigned
from the Prestige via DHCP.
Click Next to configure the Prestige for Internet access.
Chapter 3 Wizard Setup 44
Prestige 334 User’s Guide
Figure 5 Wizard 1: General Setup
3.3 Wizard Setup: Screen 2
The Prestige offers three choices of encapsulation. They are Ethernet, PPP over Ethernet or
PPTP.
3.3.1 Ethernet
Choose Ethernet when the WAN port is used as a regular Ethernet.
45 Chapter 3 Wizard Setup
Figure 6 Wizard 2: Ethernet Encapsulation
Prestige 334 User’s Guide
The following table describes the labels in this screen.
Table 2 Wizard 2: Ethernet Encapsulation
LABEL DESCRIPTION
ISP Parameters for Internet Access
Encapsulation You must choose the Ethernet option when the WAN port is used as a regular
Ethernet. Otherwise, choose PPP over Ethernet or PPTP for a dial-up connection.
Service Type Choose from Standard, Tels tra (RoadRunner Telstra authentication method), RR-
User Name Type the user name given to you by your ISP.
Password Type the password associated with the user name above.
Login Server IP
Address
Login Server This field only applies when you select Telia Login in the Service Type field. Type
Relogin Every
(min)
Back Click Back to return to the previous screen.
Next Click Next to continue.
Manager (Roadrunner Manager authentication method), RR-Toshiba
(Roadrunner Toshiba authentication method) or Telia Login.
The following fields are not applicable (N/A) for the Standard service type.
Type the authentication server IP address here if your ISP gave you one.
the domain name of the Telia login server, for example “login1.telia.com”.
This field only applies when you select Telia Login in the Service Type field. The
Telia server logs the Prestige out if the Prestige does not log in periodically. Type
the number of minutes from 1 to 59 (30 default) for the Prestige to wait between
logins.
Chapter 3 Wizard Setup 46
Prestige 334 User’s Guide
3.3.2 PPPoE Encapsulation
Point-to-Point Protocol over Ethernet (PPPoE) functions as a dial-up connection. PPPoE is an
IETF (Internet Engineering Task Force) draft standard specifying how a host personal
computer interacts with a broadband modem (for example DSL, cable, wireless, etc.) to
achieve access to high-speed data networks.
For the service provider, PPPoE offers an access and authentication method that works with
existing access control systems (for instance, Radius). For the user, PPPoE provides a login
and authentication method that the existing Microsoft Dial-Up Networking software can
activate, and therefore requires no new learning or procedures for Windows users.
One of the benefits of PPPoE is the ability to let end users access one of multiple network
services, a function known as dynamic service selection. This enables the service provider to
easily create and offer new IP services for specific users.
Operationally, PPPoE saves significant effort for both the subscriber and the ISP/carrier, as it
requires no specific configuration of the broadband modem at the subscriber’s site.
By implementing PPPoE directly on the Prestige (rather than individual computers), the
computers on the LAN do not need PPPoE software installed, since the Prestige does that part
of the task. Furthermore, with NAT, all of the LAN's computers will have Internet access.
Refer to the appendix for more information on PPPoE.
47 Chapter 3 Wizard Setup
Figure 7 Wizard 2: PPPoE Encapsulation
Prestige 334 User’s Guide
The following table describes the labels in this screen.
Table 3 Wizard 2: PPPoE Encapsulation
LABEL DESCRIPTION
ISP Parameter for Internet Access
Encapsulation Choose PPP over Ethernet from the pull-down list box. PPPoE forms a dial-up
connection.
Service Name Type the name of your service provider.
User Name Type the user name given to you by your ISP.
Password Type the password associated with the user name above.
Nailed-Up
Connection
Idle Timeout Type the time in seconds that elapses before the router automatically disconnects
Next Click Next to continue.
Back Click Back to return to the previous screen.
Select Nailed-Up Connection if you do not want the connection to time out.
from the PPPoE server. The default time is 100 seconds.
3.3.3 PPTP Encapsulation
Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables transfers of data
from a remote client to a private server, creating a Virtual Private Network (VPN) using TCP/
IP-based networks.
PPTP supports on-demand, multi-protocol, and virtual private networking over public
networks, such as the Internet.
Chapter 3 Wizard Setup 48
Prestige 334 User’s Guide
Refer to the appendix for more information on PPTP.
Figure 8 Wizard 2: PPTP Encapsulation
Note: The PRESTIGE supports one PPTP server connection at
any given time.
The following table describes the fields in this screen
Table 4 Wizard 2: PPTP Encapsulation
LABEL DESCRIPTION
ISP Parameters for Internet Access
Encapsulation Select PPTP from the drop-down list box.
User Name Type the user name given to you by your ISP.
Password Type the password associated with the User Name above.
Nailed-Up
Connection
Idle Timeout Type the time in seconds that elapses before the router automatically disconnects
PPTP Configuration
My IP Address Type the (static) IP address assigned to you by your ISP.
My IP Subnet Mask Type the subnet mask assigned to you by your ISP (if given).
Server IP Address Type the IP address of the PPTP server.
49 Chapter 3 Wizard Setup
Select Nailed-Up Connection if you do not want the connection to time out.
from the PPTP server. The default is 100 seconds.
Table 4 Wizard 2: PPTP Encapsulation
LABEL DESCRIPTION
Prestige 334 User’s Guide
Connection ID/
Name
Back Click Back to return to the previous screen.
Next Click Next to continue.
Enter the connection ID or connection name in this field. It must follow the "c:id"
and "n:name" format. For example, C:12 or N:My ISP.
This field is optional and depends on the requirements of your ISP.
3.4 Wizard Setup: Screen 3
The fifth wizard screen allows you to configure WAN IP address assignment, DNS server
address assignment and the WAN MAC address.
3.4.1 WAN IP Address Assignment
Every computer on the Internet must have a unique IP address. If your networks are isolated
from the Internet, for instance, only between your two branch offices, you can assign any IP
addresses to the hosts without problems. However, the Internet Assigned Numbers Authority
(IANA) has reserved the following three blocks of IP addresses specifically for private
networks.
Table 5 Private IP Address Ranges
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
You can obtain your IP address from the IANA, from an ISP or have it assigned by a private
network. If you belong to a small organization and your Internet access is through an ISP, the
ISP can provide you with the Internet addresses for your local networks. On the other hand, if
you are part of a much larger organization, you should consult your network administrator for
the appropriate IP addresses.
Note: Regardless of your particular situation, do not create an
arbitrary IP address; always follow the guidelines above. For
more information on address assignment, please refer to RFC
1597, Address Allocation for Private Internets and RFC 1466,
Guidelines for Management of IP Address Space.
3.4.2 IP Address and Subnet Mask
Similar to the way houses on a street share a common street name, so too do computers on a
LAN share one common network number.
Chapter 3 Wizard Setup 50
Prestige 334 User’s Guide
Where you obtain your network number depends on your particular situation. If the ISP or
your network administrator assigns you a block of registered IP addresses, follow their
instructions in selecting the IP addresses and the subnet mask.
If the ISP did not explicitly give you an IP network number, then most likely you have a single
user account and the ISP will assign you a dynamic IP address when the connection is
established. The Internet Assigned Number Authority (IANA) reserved this block of addresses
specifically for private use; please do not use any other number unless you are told otherwise.
Let's say you select 192.168.1.0 as the network number; which covers 254 individual
addresses, from 192.168.1.1 to 192.168.1.254 (zero and 255 are reserved). In other words, the
first three numbers specify the network number while the last number identifies an individual
computer on that network.
Once you have decided on the network number, pick an IP address that is easy to remember,
for instance, 192.168.1.1, for your Prestige, but make sure that no other device on your
network is using that IP address.
The subnet mask specifies the network number portion of an IP address. Your Prestige will
compute the subnet mask automatically based on the IP address that you entered. You don't
need to change the subnet mask computed by the Prestige unless you are instructed to do
otherwise.
3.4.3 DNS Server Address Assignment
Use DNS (Domain Name System) to map a domain name to its corresponding IP address and
vice versa, for instance, the IP address of www.zyxel.com is 204.217.0.2. The DNS server is
extremely important because without it, you must know the IP address of a computer before
you can access it.
The Prestige can get the DNS server addresses in the following ways.
1 The ISP tells you the DNS server addresses, usually in the form of an information sheet,
when you sign up. If your ISP gives you DNS server addresses, enter them in the DNS
Server fields in DHCP Setup.
2 If the ISP did not give you DNS server information, leave the DNS Server fields in
DHCP Setup set to 0.0.0.0 for the ISP to dynamically assign the DNS server IP addresses.
3.4.4 WAN MAC Address
Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address
is assigned at the factory and consists of six pairs of hexadecimal characters, for example,
00:A0:C5:00:00:02.
51 Chapter 3 Wizard Setup
Prestige 334 User’s Guide
You can configure the WAN port's MAC address by either using the factory default or cloning
the MAC address from a computer on your LAN. Once it is successfully configured, the
address will be copied to the "rom" file (ZyNOS configuration file). It will not change unless
you change the setting or upload a different "rom" file.
Table 6 Example of Network Properties for LAN Servers with Fixed IP Addresses
Choose an IP address 192.168.1.2-192.168.1.32; 192.168.1.65-192.168.1.254.
Subnet mask 255.255.255.0
Gateway (or default route) 192.168.1.1(Prestige LAN IP)
The fifth wizard screen varies according to the type of encapsulation that you select in the
third wizard screen.
Figure 9 Wizard 3: WAN Setup
The following table describes the labels in this screen
Table 7 Wizard 3: WAN Setup
LABEL DESCRIPTION
WAN IP Address Assignment
Get automatically from
ISP
Use fixed IP address Select this option If the ISP assigned a fixed IP address.
My WAN IP Address Enter your WAN IP address in this field if you selected Use Fixed IP
My WAN Subnet Mask Type your IP subnet mask in this field when you selected Use Fixed IP
Chapter 3 Wizard Setup 52
Select this option If your ISP did not assign you a fixed IP address. This is
the default selection.
Address.
Address.
Prestige 334 User’s Guide
Table 7 Wizard 3: WAN Setup
LABEL DESCRIPTION
Gateway IP Address Type the IP address of the gateway. The gateway is an immediate
System DNS Server Address Assignment (if applicable)
DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice
versa. The DNS server is extremely important because without it, you must know the IP address of a
computer before you can access it. The Prestige uses a system DNS server (in the order you specify
here) to resolve domain names for VPN, DDNS and the time server.
First DNS Server
Second DNS Server
Third DNS Server
WAN MAC Address The MAC address field allows you to configure the WAN port's MAC
Factory Default Select this option to use the factory assigned default MAC Address.
Spoof this Computer's
MAC address - IP Address
Back Click Back to return to the previous screen.
Next Click Next to continue.
neighbour of your Prestige that will forward the packet to the destination.
The gateway must be a router on the same segment as your Prestige's
LAN or WAN port.
Select From ISP if your ISP dynamically assigns DNS server information
(and the Prestige's WAN IP address). The field to the right displays the
(read-only) DNS server IP address that the ISP assigns.
Select User-Defined if you have the IP address of a DNS server. Enter the
DNS server's IP address in the field to the right.
Select None if you do not want to configure DNS servers. If you do not
configure a system DNS server, you must use IP addresses when
configuring VPN, DDNS and the time server.
Address by either using the factory default or cloning the MAC address
from a computer on your LAN.
Select this option and enter the IP address of the computer on the LAN
whose MAC you are cloning. Once it is successfully configured, the
address will be copied to the rom file (ZyNOS configuration file). It will not
change unless you change the setting or upload a different rom file. It is
advisable to clone the MAC address from a computer on your LAN even if
your ISP does not presently require MAC address authentication.
3.5 Basic Setup Complete
Click Back to return to the previous screen or click Finish to complete and save the wizard
setup.
53 Chapter 3 Wizard Setup
Prestige 334 User’s Guide
Figure 10 Wizard Finish
Well done! You have successfully set up your Prestige to operate on your network and access
the Internet.
Chapter 3 Wizard Setup 54
Prestige 334 User’s Guide
55 Chapter 3 Wizard Setup
This chapter provides information on the System screens.
4.1 System Overview
See the Wizard Setup chapter for more information on the next few screens.
4.2 Configuring General Setup
Click SYSTEM to open the General screen.
Prestige 334 User’s Guide
CHAPTER 4
System Screens
Chapter 4 System Screens 56
Prestige 334 User’s Guide
Figure 11 System General Setup
The following table describes the labels in this screen.
Table 8 System General Setup
LABEL DESCRIPTION
System Name Choose a descriptive name for identification purposes. It is recommended you
Domain Name Enter the domain name (if you know it) here. If you leave this field blank, the ISP
Administrator
Inactivity Timer
System DNS Servers (if applicable)
DNS (Domain Name System) is for mapping a domain name to its corresponding IP address and vice
versa. The DNS server is extremely important because without it, you must know the IP address of a
computer before you can access it. The Prestige uses a system DNS server (in the order you specify
here) to resolve domain names for VPN, DDNS and the time server.
First DNS Server
Second DNS Server
Third DNS Server
enter your computer’s “Computer name” in this field (see the Wizard Setup
chapter for how to find your computer’s name). This name can be up to 30
alphanumeric characters long. Spaces are not allowed, but dashes “-” and
underscores "_" are accepted.
may assign a domain name via DHCP.
The domain name entered by you is given priority over the ISP assigned domain
name.
Type how many minutes a management session (either via the web configurator
or SMT) can be left idle before the session times out. The default is 5 minutes.
After it times out you have to log in with your password again. Very long idle
timeouts may have security risks. A value of "0" means a management session
never times out, no matter how long it has been left idle (not recommended).
Select From ISP if your ISP dynamically assigns DNS server information (and the
Prestige's WAN IP address). The field below displays the (read-only) DNS server
IP address that the ISP assigns.
Select User-Defined if you have the IP address of a DNS server. Enter the DNS
server's IP address in the field below. If you chose User-Defined, but leave the IP
address set to 0.0.0.0, User-Defined changes to None after you click Apply. If
you set a second choice to User-Defined, and enter the same IP address, the
second User-Defined changes to None after you click Apply.
Select None if you do not want to configure DNS servers. If you do not configure
a system DNS server, you must use IP addresses when configuring VPN, DDNS
and the time server.
57 Chapter 4 System Screens
Table 8 System General Setup
LABEL DESCRIPTION
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
4.3 Dynamic DNS
Dynamic DNS allows you to update your current dynamic IP address with one or many
dynamic DNS services so that anyone can contact you (in NetMeeting, CU-SeeMe, etc.). You
can also access your FTP server or Web site on your own computer using a domain name (for
instance myhost.dhs.org, where myhost is a name of your choice) that will never change
instead of using an IP address that changes each time you reconnect. Your friends or relatives
will always be able to call you even if they don't know your IP address.
First of all, you need to have registered a dynamic DNS account with www.dyndns.org. This is
for people with a dynamic IP from their ISP or DHCP server that would still like to have a
domain name. The Dynamic DNS service provider will give you a password or key.
Prestige 334 User’s Guide
4.3.1 DynDNS Wildcard
Enabling the wildcard feature for your host causes *.yourhost.dyndns.org to be aliased to the
same IP address as yourhost.dyndns.org. This feature is useful if you want to be able to use,
for example, www.yourhost.dyndns.org and still reach your hostname.
Note: If you have a private WAN IP address, then you cannot
use Dynamic DNS.
4.4 Configuring Dynamic DNS
To change your Prestige’s DDNS, click SYSTEM, then the DDNS tab. The screen appears as
shown.
Chapter 4 System Screens 58
Prestige 334 User’s Guide
Figure 12 DDNS
The following table describes the labels in this screen.
Table 9 DDNS
LABEL DESCRIPTION
Active Select this check box to use dynamic DNS.
Service Provider Select the name of your Dynamic DNS service provider.
DDNS Type Select the type of service that you are registered for from your Dynamic DNS
service provider.
Host Names 1~3 Enter the host names in the three fields provided. You can specify up to two
host names in each field separated by a comma (",").
User Enter your user name.
Password Enter the password assigned to you.
Enable Wildcard Select the check box to enable DynDNS Wildcard.
Off Line This option is available when CustomDNS is selected in the DDNS Type
Edit Update IP Address:
Server Auto Detect Select this option to update the IP address of the host name(s) automatically
User Specify Select this option to update the IP address of the host name(s) to the IP
IP Addr Enter the IP address if you select the User Specify option.
field. Check with your Dynamic DNS service provider to have traffic
redirected to a URL (that you can specify) while you are off line.
by the DDNS server. It is recommended that you select this option.
address specified below. Use this option if you have a static IP address.
59 Chapter 4 System Screens
Table 9 DDNS
LABEL DESCRIPTION
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
4.5 Configuring Password
To change your Prestige’s password (recommended), click SYSTEM, then the Password tab.
The screen appears as shown. This screen allows you to change the Prestige’s password.
Figure 13 Password
Prestige 334 User’s Guide
The following table describes the labels in this screen.
Table 10 Password
LABEL DESCRIPTION
Old Password Type the default password or the existing password you use to access the
New Password Type the new password in this field.
Retype to Confirm Type the new password again in this field.
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
system in this field.
4.6 Configuring Time Setting
To change your Prestige’s time and date, click SYSTEM, then the Time Setting tab. The
screen appears as shown. Use this screen to configure the Prestige’s time based on your local
time zone.
Chapter 4 System Screens 60
Prestige 334 User’s Guide
Figure 14 Time Setting
The following table describes the labels in this screen.
Table 11 Time Setting
LABEL DESCRIPTION
Use Time Server
when Bootup
Time Server
Address
Current Time This field displays the time of your Prestige.
New Time This field displays the last updated time from the time server.
Current Date This field displays the date of your Prestige.
Select the time service protocol that your time server sends when you turn on
the Prestige. Not all time servers support all protocols, so you may have to
check with your ISP/network administrator or use trial and error to find a protocol
that works.
The main difference between them is the format.
Daytime (RFC 867) format is day/month/year/time zone of the server.
Time (RFC 868) format displays a 4-byte integer giving the total number of
seconds since 1970/1/1 at 0:0:0.
The default, NTP (RFC 1305), is similar to Time (RFC 868).
Select None to enter the time and date manually.
Enter the IP address or URL (up to 20 extended ASCII characters in length) of
your time server. Check with your ISP/network administrator if you are unsure of
this information.
Each time you reload this page, the Prestige synchronizes the time with the time
server.
When you select None in the Time Protocol field, enter the new time in this
field and then click Apply.
Each time you reload this page, the Prestige synchronizes the time with the time
server.
61 Chapter 4 System Screens
Prestige 334 User’s Guide
Table 11 Time Setting
LABEL DESCRIPTION
New Date This field displays the last updated date from the time server.
When you select None in the Time Protocol field, enter the new date in this
field and then click Apply.
Time Zone Choose the Time Zone of your location. This will set the time difference between
your time zone and Greenwich Mean Time (GMT).
Daylight Savings Select this option if you use daylight savings time. Daylight saving is a period
Start Date Enter the month and day that your daylight-savings time starts on if you selected
End Date Enter the month and day that your daylight-savings time ends on if you selected
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
from late spring to early fall when many countries set their clocks ahead of
normal local time by one hour to give more daytime light in the evening.
Daylight Savings.
Daylight Savings.
Chapter 4 System Screens 62
Prestige 334 User’s Guide
63 Chapter 4 System Screens
This chapter describes how to configure LAN settings.
5.1 LAN Overview
Local Area Network (LAN) is a shared communication system to which many computers are
attached. The LAN screens can help you configure a LAN DHCP server, manage IP addresses,
and partition your physical network into logical networks.
5.2 DHCP Setup
Prestige 334 User’s Guide
CHAPTER 5
LAN Screens
DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows individual
clients to obtain TCP/IP configuration at start-up from a server. You can configure the Prestige
as a DHCP server or disable it. When configured as a server, the Prestige provides the TCP/IP
configuration for the clients. If DHCP service is disabled, you must have another DHCP server
on your LAN, or else the computer must be manually configured.
5.2.1 IP Pool Setup
The Prestige is pre-configured with a pool of 32 IP addresses starting from 192.168.1.33 to
192.168.1.64. This configuration leaves 31 IP addresses (excluding the Prestige itself) in the
lower range for other server computers, for instance, servers for mail, FTP, TFTP, web, etc.,
that you may have.
5.2.2 System DNS Servers
Refer to the IP Address and Subnet Mask section in the Wizard Setup chapter.
5.3 LAN TCP/IP
The Prestige has built-in DHCP server capability that assigns IP addresses and DNS servers to
systems that support DHCP client capability.
5.3.1 Factory LAN Defaults
The LAN parameters of the Prestige are preset in the factory with the following values:
Chapter 5 LAN Screens 64
Prestige 334 User’s Guide
• IP address of 192.168.1.1 with subnet mask of 255.255.255.0 (24 bits)
• DHCP server enabled with 32 client IP addresses starting from 192.168.1.33.
These parameters should work for the majority of installations. If your ISP gives you explicit
DNS server address(es), read the embedded web configurator help regarding what fields need
to be configured.
5.3.2 IP Address and Subnet Mask
Refer to the IP Address and Subnet Mask section in the Wizard Setup chapter for this
information.
5.3.3 RIP Setup
RIP (Routing Information Protocol, RFC 1058 and RFC 1389) allows a router to exchange
routing information with other routers. RIP Direction controls the sending and receiving of
RIP packets. When set to Both or Out Only, the Prestige will broadcast its routing table
periodically. When set to Both or In Only, it will incorporate the RIP information that it
receives; when set to None, it will not send any RIP packets and will ignore any RIP packets
received.
RIP Version controls the format and the broadcasting method of the RIP packets that the
Prestige sends (it recognizes both formats when receiving). RIP-1 is universally supported;
but RIP-2 carries more information. RIP-1 is probably adequate for most networks, unless you
have an unusual network topology.
Both RIP-2B and RIP-2M send routing data in RIP-2 format; the difference being that RIP-
2B uses subnet broadcasting while RIP-2M uses multicasting. Multicasting can reduce the
load on non-router machines since they generally do not listen to the RIP multicast address
and so will not receive the RIP packets. However, if one router uses multicasting, then all
routers on your network must use multicasting, also.
By default, RIP Direction is set to Both and RIP Version to RIP-1.
5.3.4 Multicast
Traditionally, IP packets are transmitted in one of either two ways - Unicast (1 sender - 1
recipient) or Broadcast (1 sender - everybody on the network). Multicast delivers IP packets to
a group of hosts on the network - not everybody and not just 1.
IGMP (Internet Group Multicast Protocol) is a network-layer protocol used to establish
membership in a Multicast group - it is not used to carry user data. IGMP version 2 (RFC
2236) is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in wide use. If
you would like to read more detailed information about interoperability between IGMP
version 2 and version 1, please see sections 4 and 5 of RFC 2236. The class D IP address is
used to identify host groups and can be in the range 224.0.0.0 to 239.255.255.255. The address
65 Chapter 5 LAN Screens
224.0.0.0 is not assigned to any group and is used by IP multicast computers. The address
224.0.0.1 is used for query messages and is assigned to the permanent group of all IP hosts
(including gateways). All hosts must join the 224.0.0.1 group in order to participate in IGMP.
The address 224.0.0.2 is assigned to the multicast routers group.
The Prestige supports both IGMP version 1 (IGMP-v1) and IGMP version 2 (IGMP-v2). At
start up, the Prestige queries all directly connected networks to gather group membership.
After that, the Prestige periodically updates this information. IP multicasting can be enabled/
disabled on the Prestige LAN and/or WAN interfaces in the web configurator (LAN; WA N ).
Select None to disable IP multicasting on these interfaces.
5.4 Configuring IP
Click LAN to open the IP screen.
Prestige 334 User’s Guide
Chapter 5 LAN Screens 66
Prestige 334 User’s Guide
Figure 15 LAN IP
The following table describes the labels in this screen.
Table 12 LAN IP
LABEL DESCRIPTION
DHCP Server DHCP (Dynamic Host Configuration Protocol, RFC 2131 and RFC 2132) allows
IP Pool Starting
Address
Pool Size This field specifies the size, or count of the IP address pool.
DNS Servers Assigned by DHCP Server
The Prestige passes a DNS (Domain Name System) server IP address (in the order you specify here)
to the DHCP clients. The Prestige only passes this information to the LAN DHCP clients when you
select the DHCP Server check box. When you clear the DHCP Server check box, DHCP service is
disabled and you must have another DHCP sever on your LAN, or else the computers must have their
DNS server addresses manually configured.
individual clients (computers) to obtain TCP/IP configuration at startup from a
server. Leave the DHCP Server check box selected unless your ISP instructs
you to do otherwise. Clear it to disable the Prestige acting as a DHCP server.
When configured as a server, the Prestige provides TCP/IP configuration for the
clients. If not, DHCP service is disabled and you must have another DHCP server
on your LAN, or else the computers must be manually configured. When set as a
server, fill in the following four fields.
This field specifies the first of the contiguous addresses in the IP address pool.
67 Chapter 5 LAN Screens
Table 12 LAN IP
LABEL DESCRIPTION
Prestige 334 User’s Guide
First DNS Server
Second DNS Server
Third DNS Server
LAN TCP/IP
IP Address Type the IP address of your Prestige in dotted decimal notation 192.168.1.1
IP Subnet Mask The subnet mask specifies the network number portion of an IP address. Your
RIP Direction RIP (Routing Information Protocol, RFC1058 and RFC 1389) allows a router to
RIP Version The RIP Version field controls the format and the broadcasting method of the
Multicast Select IGMP V-1 or IGMP V-2 or None. IGMP (Internet Group Multicast Protocol)
Windows Networking (NetBIOS over TCP/IP): NetBIOS (Network Basic Input/Output System) are TCP
or UDP broadcast packets that enable a computer to connect to and communicate with a LAN. For
some dial-up services such as PPPoE or PPTP, NetBIOS packets cause unwanted calls. However it
may sometimes be necessary to allow NetBIOS packets to pass through to the WAN in order to find a
computer on the WAN.
Select From ISP if your ISP dynamically assigns DNS server information (and
the Prestige's WAN IP address). The field to the right displays the (read-only)
DNS server IP address that the ISP assigns.
Select User-Defined if you have the IP address of a DNS server. Enter the DNS
server's IP address in the field to the right. If you chose User-Defined, but leave
the IP address set to 0.0.0.0, User-Defined changes to None after you click
Apply. If you set a second choice to User-Defined, and enter the same IP
address, the second User-Defined changes to None after you click Apply.
Select DNS Relay to have the Prestige act as a DNS proxy. The Prestige's LAN
IP address displays in the field to the right (read-only). The Prestige tells the
DHCP clients on the LAN that the Prestige itself is the DNS server. When a
computer on the LAN sends a DNS query to the Prestige, the Prestige forwards
the query to the Prestige's system DNS server (configured in the SYSTEM
General screen) and relays the response back to the computer. You can only
select DNS Relay for one of the three servers; if you select DNS Relay for a
second or third DNS server, that choice changes to None after you click Apply.
Select None if you do not want to configure DNS servers. If you do not configure
a DNS server, you must know the IP address of a computer in order to access it.
(factory default).
Prestige will automatically calculate the subnet mask based on the IP address
that you assign. Unless you are implementing subnetting, use the subnet mask
computed by the Prestige 255.255.255.0.
exchange routing information with other routers. The RIP Direction field controls
the sending and receiving of RIP packets. Select the RIP direction from Both/In
Only/Out Only/None. When set to Both or Out Only, the Prestige will broadcast
its routing table periodically. When set to Both or In Only, it will incorporate the
RIP information that it receives; when set to None, it will not send any RIP
packets and will ignore any RIP packets received. Both is the default.
RIP packets that the Prestige sends (it recognizes both formats when receiving).
RIP-1 is universally supported but RIP-2 carries more information. RIP-1 is
probably adequate for most networks, unless you have an unusual network
topology. Both RIP-2B and RIP-2M sends the routing data in RIP-2 format; the
difference being that RIP-2B uses subnet broadcasting while RIP-2M uses
multicasting. Multicasting can reduce the load on non-router machines since they
generally do not listen to the RIP multicast address and so will not receive the
RIP packets. However, if one router uses multicasting, then all routers on your
network must use multicasting, also. By default, RIP direction is set to Both and
the Version set to RIP-1.
is a network-layer protocol used to establish membership in a Multicast group - it
is not used to carry user data. IGMP version 2 (RFC 2236) is an improvement
over version 1 (RFC 1112) but IGMP version 1 is still in wide use. If you would
like to read more detailed information about interoperability between IGMP
version 2 and version 1, please see sections 4 and 5 of RFC 2236.
Chapter 5 LAN Screens 68
Prestige 334 User’s Guide
Table 12 LAN IP
LABEL DESCRIPTION
Allow between LAN
and WAN
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
Select this check box to forward NetBIOS packets from the LAN to the WAN and
from the WAN to the LAN. If your firewall is enabled with the default policy set to
block WAN to LAN traffic, you also need to enable the default WAN to LAN
firewall rule that forwards NetBIOS traffic.
Clear this check box to block all NetBIOS packets going from the LAN to the
WAN and from the WAN to the LAN.
5.5 Configuring Static DHCP
This table allows you to assign IP addresses on the LAN to specific individual computers
based on their MAC Addresses.
Every Ethernet device has a unique MAC (Media Access Control) address. The MAC address
is assigned at the factory and consists of six pairs of hexadecimal characters, for example,
00:A0:C5:00:00:02.
To change your Prestige’s Static DHCP settings, click LAN, then the Static DHCP tab. The
screen appears as shown.
69 Chapter 5 LAN Screens
Figure 16 Static DHCP
The following table describes the labels in this screen.
Prestige 334 User’s Guide
Table 13 Static DHCP
LABEL DESCRIPTION
# This is the index number of the Static IP table entry (row).
MAC Address Type the MAC address (with colons) of a computer on your LAN.
IP Address This field specifies the size, or count of the IP address pool.
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
5.6 Configuring IP Alias
IP Alias allows you to partition a physical network into different logical networks over the
same Ethernet interface. The Prestige supports three logical LAN interfaces via its single
physical Ethernet interface with the Prestige itself as the gateway for each LAN network.
To change your Prestige’s IP Alias settings, click LAN, then the IP Alias tab. The screen
appears as shown.
Chapter 5 LAN Screens 70
Prestige 334 User’s Guide
Figure 17 IP Alias
The following table describes the labels in this screen.
Table 14 IP Alias
LABEL DESCRIPTION
IP Alias 1,2 Select the check box to configure another LAN network for the Prestige.
IP Address Enter the IP address of your Prestige in dotted decimal notation.
IP Subnet Mask Your Prestige will automatically calculate the subnet mask based on the IP
address that you assign. Unless you are implementing subnetting, use the subnet
mask computed by the Prestige.
RIP Direction RIP (Routing Information Protocol, RFC1058 and RFC 1389) allows a router to
exchange routing information with other routers. The RIP Direction field controls
the sending and receiving of RIP packets. Select the RIP direction from Both/In
Only/Out Only/None. When set to Both or Out Only, the Prestige will broadcast
its routing table periodically. When set to Both or In Only, it will incorporate the
RIP information that it receives; when set to None, it will not send any RIP
packets and will ignore any RIP packets received.
RIP Version The RIP Version field controls the format and the broadcasting method of the
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
RIP packets that the Prestige sends (it recognizes both formats when receiving).
RIP-1 is universally supported but RIP-2 carries more information. RIP-1 is
probably adequate for most networks, unless you have an unusual network
topology. Both RIP-2B and RIP-2M sends the routing data in RIP-2 format; the
difference being that RIP-2B uses subnet broadcasting while RIP-2M uses
multicasting. Multicasting can reduce the load on non-router machines since they
generally do not listen to the RIP multicast address and so will not receive the RIP
packets. However, if one router uses multicasting, then all routers on your
network must use multicasting, also. By default, RIP direction is set to Both and
the Version set to RIP-1.
71 Chapter 5 LAN Screens
This chapter describes how to configure WAN settings.
6.1 WAN Overview
See the Wizard Setup chapter for more information on the fields in the WAN screens.
6.2 TCP/IP Priority (Metric)
The metric represents the "cost of transmission". A router determines the best route for
transmission by choosing a path with the lowest "cost". RIP routing uses hop count as the
measurement of cost, with a minimum of "1" for directly connected networks. The number
must be between "1" and "15"; a number greater than "15" means the link is down. The
smaller the number, the lower the "cost".
Prestige 334 User’s Guide
CHAPTER 6
WAN Screens
The metric sets the priority for the Prestige’s routes to the Internet. If the routes have the same
metric, the Prestige uses the following pre-defined priorities:
1 WA N: designated by the ISP or a static route (see the IP Static Route Setup chapter)
2 Traffic Redirect (see the Configuring Traffic Redirect section )
For example, if WA N has a metric of "1" and Traffic Redirect has a metric of "2", the WAN
connection acts as the primary default route. If the WA N route fails to connect to the Internet,
the Prestige tries Traffic Redirect next.
6.3 Configuring Route
Click WA N to open the Route screen.
Chapter 6 WAN Screens 72
Prestige 334 User’s Guide
Figure 18 WAN: Route
The following table describes the labels in this screen.
Table 15 WAN: Route
LABEL DESCRIPTION
WAN Traffic
Redirect
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
The default WAN connection is "1' as your broadband connection via the WAN port
should always be your preferred method of accessing the WAN. The default priority
of the routes is WAN and then Traffic Redirect.
6.4 Configuring WAN ISP
To change your Prestige’s WAN ISP settings, click WA N , then the WA N I S P tab. The screen
differs by the encapsulation.
6.4.1 Ethernet Encapsulation
The screen shown next is for Ethernet encapsulation.
73 Chapter 6 WAN Screens
Figure 19 Ethernet Encapsulation
The following table describes the labels in this screen.
Table 16 Ethernet Encapsulation
Prestige 334 User’s Guide
LABEL DESCRIPTION
Encapsulation You must choose the Ethernet option when the WAN port is used as a regular
Service Type Choose from Standard, Tel str a (RoadRunner Telstra authentication method),
User Name Type the user name given to you by your ISP.
Password Type the password associated with the user name above.
Retype to Confirm Type the password again to make sure that you have entered it correctly.
Login Server IP
Address
Login Server This field only applies when you select Telia Login in the Service Type field.
Relogin Every(min) This field only applies when you select Telia Login in the Service Type field. The
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
Ethernet.
RR-Manager (Roadrunner Manager authentication method), RR-Toshiba
(Roadrunner Toshiba authentication method) or Telia Login.
The following fields do not appear with the Standard service type.
Type the authentication server IP address here if your ISP gave you one.
Type the domain name of the Telia login server, for example “login1.telia.com”.
Telia server logs the Prestige out if the Prestige does not log in periodically. Type
the number of minutes from 1 to 59 (30 default) for the Prestige to wait between
logins.
6.4.2 PPPoE Encapsulation
The Prestige supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an IETF Draft
standard (RFC 2516) specifying how a personal computer (PC) interacts with a broadband
modem (DSL, cable, wireless, etc.) connection. The PPP over Ethernet option is for a dialup connection using PPPoE.
Chapter 6 WAN Screens 74
Prestige 334 User’s Guide
For the service provider, PPPoE offers an access and authentication method that works with
existing access control systems (for example Radius). PPPoE provides a login and
authentication method that the existing Microsoft Dial-Up Networking software can activate,
and therefore requires no new learning or procedures for Windows users.
One of the benefits of PPPoE is the ability to let you access one of multiple network services,
a function known as dynamic service selection. This enables the service provider to easily
create and offer new IP services for individuals.
Operationally, PPPoE saves significant effort for both you and the ISP or carrier, as it requires
no specific configuration of the broadband modem at the customer site.
By implementing PPPoE directly on the Prestige (rather than individual computers), the
computers on the LAN do not need PPPoE software installed, since the Prestige does that part
of the task. Furthermore, with NAT, all of the LANs’ computers will have access.
The screen shown next is for PPPoE encapsulation.
75 Chapter 6 WAN Screens
Figure 20 PPPoE Encapsulation
The following table describes the labels in this screen.
Prestige 334 User’s Guide
Table 17 PPPoE Encapsulation
LABEL DESCRIPTION
ISP Parameters for Internet Access
Encapsulation The PPP over Ethernet choice is for a dial-up connection using PPPoE. The
Prestige supports PPPoE (Point-to-Point Protocol over Ethernet). PPPoE is an
IETF Draft standard (RFC 2516) specifying how a personal computer (PC) interacts
with a broadband modem (i.e. xDSL, cable, wireless, etc.) connection.
Operationally, PPPoE saves significant effort for both the end user and ISP/carrier,
as it requires no specific configuration of the broadband modem at the customer
site. By implementing PPPoE directly on the router rather than individual
computers, the computers on the LAN do not need PPPoE software installed, since
the router does that part of the task. Further, with NAT, all of the LAN's computers
will have access.
Service Name Type the PPPoE service name provided to you. PPPoE uses a service name to
identify and reach the PPPoE server.
User Name Type the User Name given to you by your ISP.
Password Type the password associated with the User Name above.
Retype to Confirm Type your password again to make sure that you have entered is correctly.
Nailed-Up
Connection
Idle Timeout This value specifies the time in seconds that elapses before the router automatically
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
Select Nailed-Up Connection if you do not want the connection to time out.
disconnects from the PPPoE server.
Chapter 6 WAN Screens 76
Prestige 334 User’s Guide
6.4.3 PPTP Encapsulation
Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables secure transfer of
data from a remote client to a private server, creating a Virtual Private Network (VPN) using
TCP/IP-based networks.
PPTP supports on-demand, multi-protocol and virtual private networking over public
networks, such as the Internet.
The screen shown next is for PPTP encapsulation.
Figure 21 PPTP Encapsulation
The following table describes the labels in this screen.
Table 18 PPTP Encapsulation
LABEL DESCRIPTION
ISP Parameters for Internet Access
Encapsulation Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables
secure transfer of data from a remote client to a private server, creating a
Virtual Private Network (VPN) using TCP/IP-based networks. PPTP supports
on-demand, multi-protocol, and virtual private networking over public
networks, such as the Internet. The Prestige supports only one PPTP server
connection at any given time.
To configure a PPTP client, you must configure the User Name and
Password fields for a PPP connection and the PPTP parameters for a PPTP
connection.
User Name Type the user name given to you by your ISP.
Password Type the password associated with the User Name above.
77 Chapter 6 WAN Screens
Prestige 334 User’s Guide
Table 18 PPTP Encapsulation
LABEL DESCRIPTION
Retype to Confirm Type your password again to make sure that you have entered is correctly.
Nailed-up Connection Select Nailed-Up Connection if you do not want the connection to time out.
Idle Timeout This value specifies the time in seconds that elapses before the Prestige
PPTP Configuration
My IP Address Type the (static) IP address assigned to you by your ISP.
My IP Subnet Mask Your Prestige will automatically calculate the subnet mask based on the IP
Server IP Address Type the IP address of the PPTP server.
Connection ID/Name Type your identification name for the PPTP server.
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
automatically disconnects from the PPTP server.
address that you assign. Unless you are implementing subnetting, use the
subnet mask computed by the Prestige.
6.5 Configuring WAN IP
To change your Prestige’s WAN IP settings, click WA N, then the WAN I P tab. This screen
varies according to the type of encapsulation you select.
If your ISP did not assign you a fixed IP address, click Get automatically from ISP
(Default);otherwise click Use fixed IP Address and enter the IP address in the field provided.
Chapter 6 WAN Screens 78
Prestige 334 User’s Guide
Figure 22 WAN: IP
The following table describes the labels in this screen.
Table 19 WAN: IP
LABEL DESCRIPTION
WAN IP Address Assignment
Get automatically from
ISP
Use fixed IP address Select this option If the ISP assigned a fixed IP address.
My WAN IP Address Enter your WAN IP address in this field if you selected Use Fixed IP Address.
My WAN IP Subnet
Mask (Ethernet only)
Remote IP Address Enter the Remote IP Address (if your ISP gave you one) in this field.
Gateway/Remote IP
Address
Select this option If your ISP did not assign you a fixed IP address. This is the
default selection.
Type your network's IP subnet Mask.
Enter the gateway IP address (if your ISP gave you one) in this field if you
selected Use Fixed IP Address.
79 Chapter 6 WAN Screens
Table 19 WAN: IP
LABEL DESCRIPTION
Prestige 334 User’s Guide
Network Address
Translation
Metric (PPPoE and
PPTP only)
Private (PPPoE and
PPTP only)
RIP Direction RIP (Routing Information Protocol) allows a router to exchange routing
RIP Version The RIP Version field controls the format and the broadcasting method of the
Network Address Translation (NAT) allows the translation of an Internet
protocol address used within one network (for example a private IP address
used in a local network) to a different IP address known within another network
(for example a public IP address used on the Internet).
Choose None to disable NAT.
Choose SUA Only if you have a single public IP address. SUA (Single User
Account) is a subset of NAT that supports two types of mapping: Many-to-One
and Server.
Choose Full Feature if you have multiple public IP addresses. Full Feature
mapping types include: One-to-One, Many-to-One (SUA/PAT), Many-to-
Many Overload, Many- One-to-One and Server. When you select Full
Feature you must configure at least one address mapping set!
For more information about NAT refer to the NAT chapter in this User's Guide.
This field sets this route's priority among the routes the Prestige uses.
The metric represents the "cost of transmission". A router determines the best
route for transmission by choosing a path with the lowest "cost". RIP routing
uses hop count as the measurement of cost, with a minimum of "1" for directly
connected networks. The number must be between "1" and "15"; a number
greater than "15" means the link is down. The smaller the number, the lower
the "cost".
This parameter determines if the Prestige will include the route to this remote
node in its RIP broadcasts. If set to Yes, this route is kept private and not
included in RIP broadcast. If No, the route to this remote node will be
propagated to other hosts through RIP broadcasts.
information with other routers. The RIP Direction field controls the sending
and receiving of RIP packets.
Choose Both, None, In Only or Out Only.
When set to Both or Out Only, the Prestige will broadcast its routing table
periodically.
When set to Both or In Only, the Prestige will incorporate RIP information that
it receives.
When set to None, the Prestige will not send any RIP packets and will ignore
any RIP packets received.
By default, RIP Direction is set to Both.
RIP packets that the Prestige sends (it recognizes both formats when
receiving).
Choose RIP-1, RIP-2B or RIP-2M.
RIP-1 is universally supported; but RIP-2 carries more information. RIP-1 is
probably adequate for most networks, unless you have an unusual network
topology. Both RIP-2B and RIP-2M sends the routing data in RIP-2 format; the
difference being that RIP-2B uses subnet broadcasting while RIP-2M uses
multicasting. Multicasting can reduce the load on non-router machines since
they generally do not listen to the RIP multicast address and so will not receive
the RIP packets. However, if one router uses multicasting, then all routers on
your network must use multicasting, also. By default, the RIP Version field is
set to RIP-1.
Chapter 6 WAN Screens 80
Prestige 334 User’s Guide
Table 19 WAN: IP
LABEL DESCRIPTION
Multicast Choose None (default), IGMP-V1 or IGMP-V2. IGMP (Internet Group Multicast
Windows Networking (NetBIOS over TCP/IP):
NetBIOS (Network Basic Input/Output System) are TCP or UDP broadcast packets that enable a
computer to connect to and communicate with a LAN. For some dial-up services such as PPPoE or
PPTP, NetBIOS packets cause unwanted calls. However it may sometimes be necessary to allow
NetBIOS packets to pass through to the WAN in order to find a computer on the WAN.
Allow between WAN
and LAN
Allow Trigger Dial Select this option to allow NetBIOS packets to initiate calls.
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
Protocol) is a network-layer protocol used to establish membership in a
Multicast group - it is not used to carry user data. IGMP version 2 (RFC 2236)
is an improvement over version 1 (RFC 1112) but IGMP version 1 is still in
wide use. If you would like to read more detailed information about
interoperability between IGMP version 2 and version 1, please see sections 4
and 5 of RFC 2236.
Select this check box to forward NetBIOS packets from the LAN to the WAN
and from the WAN to the LAN. If your firewall is enabled with the default policy
set to block WAN to LAN traffic, you also need to enable the default WAN to
LAN firewall rule that forwards NetBIOS traffic.
Clear this check box to block all NetBIOS packets going from the LAN to the
WAN and from the WAN to the LAN.
6.6 Configuring WAN MAC
To change your Prestige’s WAN MAC settings, click WA N, then the WAN MAC tab. The
screen appears as shown.
Figure 23 MAC Setup
The MAC address screen allows users to configure the WAN port's MAC address by either
using the factory default or cloning the MAC address from a computer on your LAN. Choose
Factory Default to select the factory assigned default MAC Address.
81 Chapter 6 WAN Screens
Otherwise, click Spoof this computer's MAC address - IP Address and enter the IP address
of the computer on the LAN whose MAC you are cloning. Once it is successfully configured,
the address will be copied to the rom file (ZyNOS configuration file). It will not change unless
you change the setting or upload a different ROM file.
address prior to hooking up the WAN Port.
6.7 Traffic Redirect
Traffic redirect forwards WAN traffic to a backup gateway when the Prestige cannot connect
to the Internet through its normal gateway. Connect the backup gateway on the WAN so that
the Prestige still provides firewall protection.
Figure 24 Traffic Redirect WAN Setup
Prestige 334 User’s Guide
It is recommended that you clone the MAC
The following network topology allows you to avoid triangle route security issues (see the
Appendices) when the backup gateway is connected to the LAN. Use IP alias to configure the
LAN into two or three logical networks with the Prestige itself as the gateway for each LAN
network. Put the protected LAN in one subnet (Subnet 1 in the following figure) and the
backup gateway in another subnet (Subnet 2). Configure a LAN to LAN/Prestige firewall rule
that forwards packets from the protected LAN (Subnet 1) to the backup gateway (Subnet 2).
Chapter 6 WAN Screens 82
Prestige 334 User’s Guide
Figure 25 Traffic Redirect LAN Setup
6.8 Configuring Traffic Redirect
To change your Prestige’s Traffic Redirect settings, click WA N , then the Traffic Redirect
tab. The screen appears as shown.
Figure 26 WAN: Traffic Redirect
The following table describes the labels in this screen.
Table 20 Traffic Redirect
LABEL DESCRIPTION
Active Select this check box to have the Prestige use traffic redirect if the normal WAN
connection goes down.
Backup
Gateway IP
Address
83 Chapter 6 WAN Screens
Type the IP address of your backup gateway in dotted decimal notation. The Prestige
automatically forwards traffic to this IP address if the Prestige's Internet connection
terminates.
Prestige 334 User’s Guide
Table 20 Traffic Redirect
LABEL DESCRIPTION
Metric This field sets this route's priority among the routes the Prestige uses.
The metric represents the "cost of transmission". A router determines the best route
for transmission by choosing a path with the lowest "cost". RIP routing uses hop count
as the measurement of cost, with a minimum of "1" for directly connected networks.
The number must be between "1" and "15"; a number greater than "15" means the link
is down. The smaller the number, the lower the "cost".
Check WAN IP
Address
Fail Tolerance Type the number of times your Prestige may attempt and fail to connect to the Internet
Period
(seconds)
Timeout
(seconds)
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
Configuration of this field is optional. If you do not enter an IP address here, the
Prestige will use the default gateway IP address. Configure this field to test your
Prestige's WAN accessibility. Type the IP address of a reliable nearby computer (for
example, your ISP's DNS server address). If you are using PPTP or PPPoE
Encapsulation, type "0.0.0.0" to configure the Prestige to check the PVC (Permanent
Virtual Circuit) or PPTP tunnel.
before traffic is forwarded to the backup gateway.
Type the number of seconds for the Prestige to wait between checks to see if it can
connect to the WAN IP address (Check WAN IP Address field) or default gateway.
Allow more time if your destination IP address handles lots of traffic.
Type the number of seconds for your Prestige to wait for a ping response from the IP
Address in the Check WAN IP Address field before it times out. The WAN connection
is considered "down" after the Prestige times out the number of times specified in the
Fail Tolerance field. Use a higher value in this field if your network is busy or
congested.
Chapter 6 WAN Screens 84
Prestige 334 User’s Guide
85 Chapter 6 WAN Screens
Network Address Translation
This chapter discusses how to configure NAT on the Prestige.
7.1 NAT Overview
NAT (Network Address Translation - NAT, RFC 1631) is the translation of the IP address of a
host in a packet. For example, the source address of an outgoing packet, used within one
network is changed to a different IP address known within another network.
Prestige 334 User’s Guide
CHAPTER 7
(NAT) Screens
7.1.1 NAT Definitions
Inside/outside denotes where a host is located relative to the Prestige. For example, the
computers of your subscribers are the inside hosts, while the web servers on the Internet are
the outside hosts.
Global/local denotes the IP address of a host in a packet as the packet traverses a router. For
example, the local address refers to the IP address of a host when the packet is in the local
network, while the global address refers to the IP address of the host when the same packet is
traveling in the WAN side.
Note that inside/outside refers to the location of a host, while global/local refers to the IP
address of a host used in a packet. Thus, an inside local address (ILA) is the IP address of an
inside host in a packet when the packet is still in the local network, while an inside global
address (IGA) is the IP address of the same inside host when the packet is on the WAN side.
The following table summarizes this information.
Table 21 NAT Definitions
TERM DESCRIPTION
Inside This refers to the host on the LAN.
Outside This refers to the host on the WAN.
Local This refers to the packet address (source or destination) as the packet travels on the LAN.
Global This refers to the packet address (source or destination) as the packet travels on the
WAN.
Chapter 7 Network Address Translation (NAT) Screens 86
Prestige 334 User’s Guide
7.1.2 What NAT Does
In the simplest form, NAT changes the source IP address in a packet received from a
subscriber (the inside local address) to another (the inside global address) before forwarding
the packet to the WAN side. When the response comes back, NAT translates the destination
address (the inside global address) back to the inside local address before forwarding it to the
original inside host. Note that the IP address (either local or global) of an outside host is never
changed.
The global IP addresses for the inside hosts can be either static or dynamically assigned by the
ISP. In addition, you can designate servers (for example a web server and a telnet server) on
your local network and make them accessible to the outside world. If you do not define any
servers (for Many-to-One and Many-to-Many Overload mapping), NAT offers the additional
benefit of firewall protection. With no servers defined, your Prestige filters out all incoming
inquiries, thus preventing intruders from probing your network. For more information on IP
address translation, refer to RFC 1631, The IP Network Address Translator (NAT).
Note: NAT never changes the IP address (either local or global)
of an outside host.
7.1.3 How NAT Works
Each packet has two addresses – a source address and a destination address. For outgoing
packets, the ILA (Inside Local Address) is the source address on the LAN, and the IGA (Inside
Global Address) is the source address on the WAN. For incoming packets, the ILA is the
destination address on the LAN, and the IGA is the destination address on the WAN. NAT
maps private (local) IP addresses to globally unique ones required for communication with
hosts on other networks. It replaces the original IP source address (and TCP or UDP source
port numbers for Many-to-One and Many-to-Many Overload NAT mapping) in each packet
and then forwards it to the Internet. The Prestige keeps track of the original addresses and port
numbers so incoming reply packets can have their original values restored. The following
figure illustrates this.
87 Chapter 7 Network Address Translation (NAT) Screens
Figure 27 How NAT Works
7.1.4 NAT Application
The following figure illustrates a possible NAT application, where three inside LANs (logical
LANs using IP Alias) behind the Prestige can communicate with three distinct WAN
networks. More examples follow at the end of this chapter.
Prestige 334 User’s Guide
Chapter 7 Network Address Translation (NAT) Screens 88
Prestige 334 User’s Guide
Figure 28 NAT Application With IP Alias
7.1.5 NAT Mapping Types
NAT supports five types of IP/port mapping. They are:
• One to One: In One-to-One mode, the Prestige maps one local IP address to one global
IP address.
• Many to One: In Many-to-One mode, the Prestige maps multiple local IP addresses to
one global IP address. This is equivalent to SUA (i.e., PAT, port address translation),
ZyXEL’s Single User Account feature (the SUA Only option).
• Many-to-Many Overload: In Many-to-Many Overload mode, the Prestige maps the
multiple local IP addresses to shared global IP addresses.
• Many One-to-One: In Many-One-to-One mode, the Prestige maps each local IP address
to a unique global IP address.
• Server: This type allows you to specify inside servers of different services behind the
NAT to be accessible to the outside world.
Note: Port numbers do not change for One-to-One and Many
One-to-One NAT mapping types.
89 Chapter 7 Network Address Translation (NAT) Screens
Prestige 334 User’s Guide
The following table summarizes these types.
Table 22 NAT Mapping Types
TYPE IP MAPPING SMT ABBREVIATION
One-to-One ILA1ÅÆ IGA1 1-1
Many-to-One (SUA/PAT) ILA1ÅÆ IGA1
ILA2ÅÆ IGA1
…
Many-to-Many Overload ILA1ÅÆ IGA1
ILA2ÅÆ IGA2
ILA3ÅÆ IGA1
ILA4ÅÆ IGA2
…
Many One-to-One ILA1ÅÆ IGA1
ILA2ÅÆ IGA2
ILA3ÅÆ IGA3
…
Server Server 1 IPÅÆ IGA1
Server 2 IPÅÆ IGA1
Server 3 IPÅÆ IGA1
M-1
M-M Ov
M-1-1
Server
7.2 Using NAT
Note: You must create a firewall rule in addition to setting up
SUA/NAT, to allow traffic from the WAN to be forwarded
through the Prestige.
7.2.1 SUA (Single User Account) Versus NAT
SUA (Single User Account) is a ZyNOS implementation of a subset of NAT that supports two
types of mapping, Many-to-One and Server. The Prestige also supports Full Feature NAT to
map multiple global IP addresses to multiple private LAN IP addresses of clients or servers
using mapping types. Select either SUA Only or Full Feature in the WAN IP screen.
7.3 SUA Server
A SUA server set is a list of inside (behind NAT on the LAN) servers, for example, web or
FTP, that you can make visible to the outside world even though SUA makes your whole
inside network appear as a single computer to the outside world.
Chapter 7 Network Address Translation (NAT) Screens 90
Prestige 334 User’s Guide
You may enter a single port number or a range of port numbers to be forwarded, and the local
IP address of the desired server. The port number identifies a service; for example, web
service is on port 80 and FTP on port 21. In some cases, such as for unknown services or
where one server can support more than one service (for example both FTP and web service),
it might be better to specify a range of port numbers. You can allocate a server IP address that
corresponds to a port or a range of ports.
Many residential broadband ISP accounts do not allow you to run any server processes (such
as a Web or FTP server) from your location. Your ISP may periodically check for servers and
may suspend your account if it discovers any active services at your location. If you are
unsure, refer to your ISP.
7.3.1 Default Server IP Address
In addition to the servers for specified services, NAT supports a default server IP address. A
default server receives packets from ports that are not specified in this screen
Note: If you do not assign a Default Server IP Address, the
Prestige discards all packets received for ports that are not
specified in this screen or remote management.
7.3.2 Port Forwarding: Services and Port Numbers
A NAT server set is a list of inside (behind NAT on the LAN) servers, for example, web or
FTP, that you can make accessible to the outside world even though NAT makes your whole
inside network appear as a single machine to the outside world.
Use the SUA Server page to forward incoming service requests to the server(s) on your local
network. You may enter a single port number or a range of port numbers to be forwarded, and
the local IP address of the desired server. The port number identifies a service; for example,
web service is on port 80 and FTP on port 21. In some cases, such as for unknown services or
where one server can support more than one service (for example both FTP and web service),
it might be better to specify a range of port numbers.
In addition to the servers for specified services, NAT supports a default server. A service
request that does not have a server explicitly designated for it is forwarded to the default
server. If the default is not defined, the service request is simply discarded.
Note: Many residential broadband ISP accounts do not allow
you to run any server processes (such as a Web or FTP server)
from your location. Your ISP may periodically check for servers
and may suspend your account if it discovers any active
services at your location. If you are unsure, refer to your ISP.
91 Chapter 7 Network Address Translation (NAT) Screens
Prestige 334 User’s Guide
The most often used port numbers are shown in the following table. Please refer to RFC 1700
for further information about port numbers. Please also refer to the Supporting CD for more
examples and details on SUA/NAT.
Table 23 Services and Port Numbers
SERVICES PORT NUMBER
ECHO 7
FTP (File Transfer Protocol) 21
SMTP (Simple Mail Transfer Protocol) 25
DNS (Domain Name System) 53
Finger 79
HTTP (Hyper Text Transfer protocol or WWW, Web) 80
POP3 (Post Office Protocol) 110
NNTP (Network News Transport Protocol) 119
SNMP (Simple Network Management Protocol) 161
SNMP trap 162
PPTP (Point-to-Point Tunneling Protocol) 1723
7.3.3 Configuring Servers Behind SUA (Example)
Let's say you want to assign ports 21-25 to one FTP, Telnet and SMTP server (A in the
example), port 80 to another (B in the example) and assign a default server IP address of
192.168.1.35 to a third (C in the example). You assign the LAN IP addresses and the ISP
assigns the WAN IP address. The NAT network appears as a single host on the Internet
Chapter 7 Network Address Translation (NAT) Screens 92
Prestige 334 User’s Guide
Figure 29 Multiple Servers Behind NAT Example
7.4 Configuring SUA Server
Note: If you do not assign a Default Server IP Address, the
Prestige discards all packets received for ports that are not
specified in this screen or remote management.
Click SUA/NAT to open the SUA Server screen.
Refer to Table 23 for port numbers commonly used for particular services.
93 Chapter 7 Network Address Translation (NAT) Screens
Figure 30 SUA/NAT Setup
Prestige 334 User’s Guide
The following table describes the labels in this screen.
Table 24 SUA/NAT Setup
LABEL DESCRIPTION
Default Server In addition to the servers for specified services, NAT supports a default server. A
# Number of an individual SUA server entry.
Active Select this check box to enable the SUA server entry. Clear this checkbox to
Name Enter a name to identify this port-forwarding rule.
Star t Port Enter a port number here. To forward only one port, enter it again in the End Port
End Port
Server IP
Address
Apply Click Apply to save your changes back to the Prestige.
Reset Click Reset to begin configuring this screen afresh.
default server receives packets from ports that are not specified in this screen.
If you do not assign a Default Server IP Address, the Prestige discards all packets
received for ports that are not specified in this screen or remote management.
disallow forwarding of these ports to an inside server without having to delete the
entry.
field. To specify a range of ports, enter the last port to be forwarded in the End Port
field.
Enter the inside IP address of the server here.
Chapter 7 Network Address Translation (NAT) Screens 94
Prestige 334 User’s Guide
7.5 Configuring Address Mapping
Ordering your rules is important because the Prestige applies the rules in the order that you
specify. When a rule matches the current packet, the Prestige takes the corresponding action
and the remaining rules are ignored. If there are any empty rules before your new configured
rule, your configured rule will be pushed up by that number of empty rules. For example, if
you have already configured rules 1 to 6 in your current set and now you configure rule
number 9. In the set summary screen, the new rule will be rule 7, not 9. Now if you delete rule
4, rules 5 to 7 will be pushed up by 1 rule, so old rules 5, 6 and 7 become new rules 4, 5 and 6.
To change your Prestige’s Address Mapping settings, click SUA/NAT, then the Address
Mapping tab. The screen appears as shown.
Figure 31 Address Mapping
The following table describes the labels in this screen.
Table 25 Address Mapping
LABEL DESCRIPTION
Local Start IP This refers to the Inside Local Address (ILA), which is the starting local IP address. If
Local End IP This is the end Inside Local Address (ILA). If the rule is for all local IP addresses, then
Global Start IP This refers to the Inside Global IP Address (IGA). 0.0.0.0 is for a dynamic IP address
Global End IP This is the end Inside Global Address (IGA).
95 Chapter 7 Network Address Translation (NAT) Screens
the rule is for all local IP addresses, then this field displays 0.0.0.0 as the Local Start
IP address. Local IP addresses are N/A for Server port mapping.
this field displays 255.255.255.255 as the Local End IP address. This field is N/A for
One-to-One and Server mapping types.
from your ISP with Many-to-One and Server mapping types.
This field is N/A for One-to-One, Many-to-One and Server mapping types.
Table 25 Address Mapping
LABEL DESCRIPTION
Type 1. One-to-One mode maps one local IP address to one global IP address. Note that
port numbers do not change for the One-to-one NAT mapping type.
2. Many-to-One mode maps multiple local IP addresses to one global IP address.
This is equivalent to SUA (i.e., PAT, port address translation), ZyXEL's Single User
Account feature that previous ZyXEL routers supported only.
3. Many-to-Many Overload mode maps multiple local IP addresses to shared global
IP addresses.
4. Many One-to-One mode maps each local IP address to unique global IP
addresses.
5. Server allows you to specify inside servers of different services behind the NAT to
be accessible to the outside world.
Insert Click Insert to insert a new mapping rule before an existing one.
Edit Click Edit to go to the Address Mapping Rule screen.
Delete Click Delete to delete an address mapping rule.
7.5.1 Configuring Address Mapping
Prestige 334 User’s Guide
To edit an address mapping rule, select the radio button of a rule and click the Edit button to
display the screen shown next.
Chapter 7 Network Address Translation (NAT) Screens 96
Prestige 334 User’s Guide
Figure 32 Address Mapping Edit
The following table describes the labels in this screen.
Table 26 Address Mapping Edit
LABEL DESCRIPTION
Type Choose the port mapping type from one of the following.
1. One-to-One: One-to-one mode maps one local IP address to one global IP
address. Note that port numbers do not change for One-to-one NAT mapping
type.
2. Many-to-One: Many-to-One mode maps multiple local IP addresses to one
global IP address. This is equivalent to SUA (i.e., PAT, port address translation),
ZyXEL's Single User Account feature.
3. Many-to-Many Overload: Many-to-Many Overload mode maps multiple local
IP addresses to shared global IP addresses.
4. Many One-to-One: Many One-to-one mode maps each local IP address to
unique global IP addresses.
5. Server: This type allows you to specify inside servers of different services
behind the NAT to be accessible to the outside world.
Local Start IP This is the starting Inside Local IP Address (ILA). Local IP addresses are N/A for
Server port mapping.
Local End IP This is the end Inside Local IP Address (ILA). If your rule is for all local IP
Global Start IP This is the starting Inside Global IP Address (IGA). Enter 0.0.0.0 here if you have
Global End IP This is the ending Inside Global IP Address (IGA). This field is N/A for One-to-
Apply Click Apply to save your changes back to the Prestige.
Cancel Click Cancel to return to the previous screen and not save your changes.
addresses, then enter 0.0.0.0 as the Local Start IP address and
255.255.255.255 as the Local End IP address.
This field is N/A for One-to-One and Server mapping types.
a dynamic IP address from your ISP.
One, Many-to-One and Server mapping types.
97 Chapter 7 Network Address Translation (NAT) Screens
7.6 Trigger Port Forwarding
Some services use a dedicated range of ports on the client side and a dedicated range of ports
on the server side. With regular port forwarding you set a forwarding port in NAT to forward a
service (coming in from the server on the WAN) to the IP address of a computer on the client
side (LAN). The problem is that port forwarding only forwards a service to a single LAN IP
address. In order to use the same service on a different LAN computer, you have to manually
replace the LAN computer's IP address in the forwarding port with another LAN computer's IP
address,
Trigger port forwarding solves this problem by allowing computers on the LAN to
dynamically take turns using the service. The Prestige records the IP address of a LAN
computer that sends traffic to the WAN to request a service with a specific port number and
protocol (a "trigger" port). When the Prestige's WAN port receives a response with a specific
port number and protocol ("incoming" port), the Prestige forwards the traffic to the LAN IP
address of the computer that sent the request. After that computer’s connection for that service
closes, another computer on the LAN can use the service in the same manner. This way you do
not need to configure a new IP address each time you want a different LAN computer to use
the application.
Prestige 334 User’s Guide
7.6.1 Trigger Port Forwarding Example
The following is an example of trigger port forwarding.
Figure 33 Trigger Port Forwarding Process: Example
1 Jane requests a file from the Real Audio server (port 7070).
2 Port 7070 is a “trigger” port and causes the Prestige to record Jane’s computer IP address.
The Prestige associates Jane's computer IP address with the "incoming" port range of
6970-7170.
3 The Real Audio server responds using a port number ranging between 6970-7170.
4 The Prestige forwards the traffic to Jane’s computer IP address.
5 Only Jane can connect to the Real Audio server until the connection is closed or times
out. The Prestige times out in three minutes with UDP (User Datagram Protocol), or two
hours with TCP/IP (Transfer Control Protocol/Internet Protocol).
Chapter 7 Network Address Translation (NAT) Screens 98
Prestige 334 User’s Guide
7.6.2 Two Points To Remember About Trigger Ports
1 Trigger events only happen on data that is going coming from inside the Prestige and
going to the outside.
2 If an application needs a continuous data stream, that port (range) will be tied up so that
another computer on the LAN can’t trigger it.
7.7 Configuring Trigger Port Forwarding
To change your Prestige’s trigger port settings, click SUA/NAT and the Trigger Port tab. The
screen appears as shown.
Note: Only one LAN computer can use a trigger port (range) at
a time
Figure 34 Trigger Port
The following table describes the labels in this screen.
Table 27 Trigger Port
LABEL DESCRIPTION
# This is the rule index number (read-only).
Name Type a unique name (up to 15 characters) for identification purposes. All characters
are permitted - including spaces.
99 Chapter 7 Network Address Translation (NAT) Screens
Loading...