Link IPSec, 130 | Netopia 2200 manual

Link: IPSec

When you click on the IPSec link, the IPSec conﬁguration screen appears.

Your Gateway can support two mechanisms for IPSec tunnels:

•IPSec PassThrough supports Virtual Private Network (VPN) clients running on LAN- connected computers. Normally, this feature is enabled.

You can disable it if your LAN-side VPN client includes its own NAT interoperability option.

Uncheck the Enable IPSec Passthrough checkbox.

•SafeHarbour VPN IPSec is a keyed feature that you must purchase. (See “Install Keys” on page 184.) It enables Gateway-terminated VPN support.

130

Image 130

Netopia 2200 manual Link IPSec, 130

Contents

Netopia Software User Guide Copyright Table of Contents Expert Mode Security 146 Basic Troubleshooting Command Line Interface 221 Table of Contents Glossary Overview of Major Capabilities Index Introduction What’s New About Netopia Documentation Intended Audience General Command Line InterfaceDocumentation Conventions Internal Web Interface Bold terminal type User-entered text face Organization Word About Example ScreensPage Basic Mode Setup Important Safety Instructions Power Supply Installation Achtung Wichtige SicherheitshinweiseBewahren Sie diese Anweisungen auf Setting up the Netopia Gateway Microsoft Windows Then go to Step Macintosh MacOS 8 or higher or Mac OS Proceed to Conﬁguring the Netopia Gateway on Conﬁguring the Netopia Gateway MiAVo Vdsl and Ethernet WAN models Quickstart Click the Connect to the Internet button PPPoE Quickstart Configuring the Netopia Gateway Netopia Gateway Status Indicator Lights Home Page Basic Mode DNS Link Manage My Account Link Status Details Link Enable Remote Management Link Expert Mode Link Update Firmware Link Factory Reset Accessing the Expert Web Interface Open the Web ConnectionPage Home Page Expert Mode Summary Information Home Page InformationField Status and/or Description Dhcp Navigating the Web Interface ToolbarLink Breadcrumb Trail Restart Button Restart Link Alert Symbol Help Button Help Button Conﬁgure ConﬁgureLink Quickstart Click Connect to the Internet Link LAN Configure Page Wireless supported models Privacy Configure Page Advanced Page About Closed System Mode Page Examples WPA Version Allowed Multiple SSIDs Wireless MAC Authorization Page Configure Use Radius Server Advanced Network Conﬁguration page appears IP Gateway WAN IP InterfacesOther WAN Options Available Encapsulation types Available Multiplexing types Sustained Cell Rate SCR Class Transmit Priority Comments Link Advanced Link IP Static Routes IP Static Route Entry page appearsPage Link IP Static ARP Link Pinholes TCP Tips for making Pinhole Entries Gateway Pinhole Conﬁguration Procedure. Use the following steps Page Configure Link IPMaps Ple static 192.168.1.1 IPMaps Block DiagramNetopia Gateway WAN Interface LAN Interface 192.168.1.2 Link Default Server Internet Gateway NAT LAN STN #2 Configure Page Link Differentiated Services Page QoS Setting TOS Bit Value Behavior Link DNS Link Dhcp Server Configure Link Radius Server Link Snmp Page Link Igmp Internet Group Management Protocol Page Configure Link UPnP 100 Link LAN Management 101 Link Advanced Ethernet Bridge 102 Conﬁguring for Bridge Mode 103 Enable Concurrent Bridging/Routing checkbox 104 105 Link Vlan 106 107 108 Enable Multiple Wireless IDs onVlan Port Conﬁguration screen appears 109 110 Link Syslog Parameters 111 112 113 Administration Related Log MessagesLog Event Messages System Log Messages 114 Access-related Log MessagesDSL Log Messages most common 115 Mented packet Link Software Hosting Link Internal Servers116 117 List of Supported Games and Software 118 FTP Rename a UserPC 119 Link Clear Options 120 Link Time Zone 121 Button Security Security122 Link Passwords 123 124 125 Conﬁguring for a BreakWater SettingLink Firewall Use a Netopia Firewall 126 Tips for making your BreakWater Basic Firewall Selection 127Basic Firewall Background BreakWater Setting ClearSailing SilentRunning LANdLocked 128 129 Link IPSec 130 SafeHarbour IPSec VPN 131 132 Conﬁguring a SafeHarbour VPN IPSec Tunnel Details Parameter Setup Worksheet 133 134 Parameter Descriptions on page 136 as required 135 Make the Tunnel Details entries Parameter Descriptions 136Field Description 137 PAT Address 138 Soft MBytes 139 Link Stateful Inspection Stateful Inspection Firewall installation procedure140 Exposed Addresses 141 142 143 Stateful Inspection Options 144 145 Open Ports in Default Stateful Inspection InstallationPort Protocol Description LAN Private WAN Public Interface Basic IP packet components Firewall TutorialGeneral ﬁrewall terms 146 Basic protocol types 147 148 Example TCP/UDP Ports TCP Port ServiceFirewall design rules Firewall Logic 149 Implied rules 150 Example ﬁlter set What it means Filter basics151 Example network 152 Example ﬁltersExample 153 Link Packet Filter 154 How ﬁlter sets work What’s a ﬁlter and what’s a ﬁlter set?155 156 How individual ﬁlters workFilter priority ﬁltering rule 157Parts of a ﬁlter Port numbers 158Port number comparisons Other ﬁlter attributes 159Putting the parts together 160 Filtering example #1 161 162 Filtering example #2 Design guidelines An approach to using ﬁlters163 Adding a ﬁlter set Working with IP Filters and Filter Sets164 Adding ﬁlters to a ﬁlter set 165 166 Netopia Router 167 168 Enter the Source Mask for the source IP address 169 Viewing ﬁlters Modifying ﬁlters Deleting a ﬁlter set170 Deleting ﬁlters Associating a Filter Set with an Interface 171 172 TOS ﬁeld matching Policy-based Routing using Filtersets173 174 175 Link Security Log Using the Security Monitoring Log176 177 178 Timestamp Background Button Install Install179 Link Install Software 180 Netopia ﬁrmware Image File Required Files181 Click the Install Software button 182 183 Verify the Netopia Firmware Release Obtaining Software Feature Keys Link Install KeysUse Netopia Software Feature Keys Procedure Install a New Feature Key File 185 To check your installed features 186 187 Link Install Certiﬁcate 188 189 190 Basic Troubleshooting 191 Action Status Indicator Lights192 Ethernet 193 Ethernet 1, 2, 3 Wireless 194 195 DSL Sync 196 197 Special patterns 198 LAN 1, 2, 3 199 DSL Sync Front View 200 LED Function Summary Matrix 201 Active 202EN Link Unlit Link Factory Reset Switch 203 3347W/3357W 3397GP2247NWG 2240N Advanced Troubleshooting 205 Home 206 207 Status of Connection Button Troubleshoot Expert Mode208 Link System Status 209 Link Ports Ethernet 210 Link Ports DSL 211 Link IP Interfaces 212 Link DSL Circuit Conﬁguration 213 Link System Log Entire 214 Link Diagnostics 215 Link Network Tools 216 217 218 If Ping is not successful, possible causes are 219 220 Command Line Interface 221 Overview 222 223 Command Verbs Status and/or DescriptionKeywords Ending a CLI Session Starting and Ending a CLI SessionLogging 224 Saving Settings Using the CLI Help FacilityAbout Shell Commands Shell Command Shortcuts Shell Commands Common Commands Download -cert serveraddress ﬁlename conﬁrm DiagnoseDownload serveraddress ﬁlename conﬁrm 227 Loglevel level Install serveraddress ﬁlename conﬁrmLicense key 228 Netstat -r Netstat229 Reset crash Reset arpReset atm Reset dhcp server Reset security-log Reset ipmapReset log Reset wan-users all ip-address Show crash Show featuresShow conﬁg Show dhcp agent Show ip ipsec Show ip igmpShow ip interfaces Show ip ﬁrewall Show log Show wireless allShow wireless clients MACaddress Show memory all Who Upload serveraddress ﬁlename conﬁrmView conﬁg 235 WAN Commands Config Mode Prompt About Config CommandsNavigating the Config Hierarchy Netopia-3000/9437188 top quit 238 Set ip ethernet a Entering Commands in Config ModeSet ip ethernet a ipaddress 239 Step Mode a CLI Conﬁguration Technique Guidelines Config CommandsDisplaying Current Gateway Settings 240 Validating Your Conﬁguration 241 Config Commands DSL Commands Set atm vcc n vpi 0 Set atm vcc n qos sustained-cell-rate 1 ...nSet atm vcc n qos max-burst-size 1 ...n Set atm vcc n vci 0 Set bridge sys-bridge on off Bridging SettingsSet atm vccn pppoe-sessions 1 Set bridge concurrent-bridging-routing on off Set bridge ethernet option on off Set bridge table-timeout 30Dhcp Settings Set bridge dsl vccn option on off Set dhcp lease-time lease-time Set dhcp start-address ipaddressSet dhcp end-address ipaddress Set dhcp server-address ipaddress Set dmt metallic-termination auto disabled alwayson DMT SettingsSet dmt wiringMode auto tipring AA1 Set dmt autoConﬁg off on Set dns domain-name domain-name Domain Name System SettingsSet dns proxy-enable Set dns primary-address ipaddress Set igmp robustness value Igmp SettingsSet igmp snooping off on Set igmp query-intvl value Set ip option on off IP SettingsSet ip arp-timeout 60 Set ip dsl vccn address ipaddress Set ip dsl vccn addr-mapping on off Set ip dsl vccn restriction admin-disabled noneSet ip dsl vccn netmask netmask Set ip dsl vccn rip-send off v1 v2 v1-compat v2-MD5 Set ip ethernet a address ipaddress Set ip dsl vccn rip-receive Off v1 v2 v1-compat v2-MD5Set ip ethernet a option on off Set ip ethernet a broadcast broadcastaddress Set ip ethernet a rip-send Off v1 v2 v1-compat v2-MD5 Set ip ethernet a restrictions none admin-disabledSet ip ethernet a netmask netmask 253 Set ip gateway interface ip-address ppp-vccn Set ip ethernet a rip-receive off v1 v2 v1-compat v2-MD5Set ip gateway option on off Set ip ip-ppp vccn option on off Set ip ip-ppp vccn peer-address ipaddress Set ip ip-ppp vccn restriction admin-disabled noneSet ip ip-ppp vccn address ipaddress Set ip ip-ppp vccn addr-mapping on off Set ip ip-ppp vccn rip-receive off v1 v2 v1-compat v2-MD5 Set ip ip-ppp vccn rip-send off v1 v2 v1-compat v2-MD5256 Set ip ipsec-passthrough off on Set ip static-arp ip-addressipaddressSet ip igmp-forwarding off on 257 Set diffserv lohi-ratio 60 100 percent Set ip prioritize off onSet diffserv option off on 258 259 Set ip static-routes destination-networknetaddress Set ip sip-passthrough on off260 Delete ip static-routes destination-network netaddress 261 IPMaps Settings Network Address Translation NAT Default Settings Set pinhole name name Set nat-default host-hardware-address MACaddressNetwork Address Translation NAT Pinhole Settings Set pinhole name name protocol-select tcp udp PPPoE /PPPoA Settings Set ppp module vccn protocol-compression on off Set ppp module vccn mru integerSet ppp module vccn magic-number on off Set ppp module vccn lcp-echo-requests on off Set ppp module vccn terminate-max integer Set ppp module vccn restart-timer integerSet ppp module vccn conﬁgure-max integer Set ppp module vccn connection-type instant-on always-on Ethernet Port Settings Set ppp module vccn port-authentication username usernameSet ppp module vccn port-authentication password password Command Line Interface Preference Settings Set preference more lines 268 Set servers telnet-tcp 1 Port Renumbering SettingsSet servers web-http 1 269 Set security ipsec tunnels name Security SettingsSet security ipsec option off on off 270 Set security ipsec tunnels name 123 tun-enable on on off 271 Set security ipsec tunnels name 123 IKE-mode DH-group 1 1 2 272 Set security ipsec tunnels name 123 nat-enable on off Set security ipsec tunnels name 123 xauth enable off onSet security ipsec tunnels name 123 xauth password password Set security ipsec tunnels name 123 xauth username username Set security ipsec tunnels name 123 remote-id idvalue Set security ipsec tunnels name 123 local-id idvalue274 275 Set security state-insp tcp-timeout 30 276 Set security state-insp xposed-addr exposed-address# n Set security state-insp udp-timeout 30277 Packet Filtering Settings 278 279 280 281 Snmp Settings Set system name name System SettingsSet snmp notify type v1-trap v2-trap inform 283 Set system log-size 10240 Set system idle-timeout telnet 1...120 http 1Set system username administrator name user name Set system persistent-log off on Sleep Contact-email string@domainname location string Set system password admin user285 286 Set system zerotouch redirect-url redirection-URL Set system zerotouch option on off287 Syslog 289 Set security state-insp eth B option on Wireless Settings supported models Set wireless multi-ssid option on off Set wireless mode both-b-and-g b-only g-only291 292 Set wireless tx-power full medium fair low minimal Set wireless no-bridging off on293 Set wireless network-id privacy default-keyid Set wireless network-id privacy pre-shared-key string294 Example 40bit key 02468ACE02 295Example 256bit key Set radius radius-secret sharedsecret Set wireless mac-auth option on offSet radius radius-name servernamestring Set radius alt-radius-name servernamestring Set vlan name string Set radius radius-port portnumber297 298 To make the Vlan vlan1 routable add the port lan-uplink Set dslf-lanmgmt option off on Set upnp option on off299 300 301 Vdsl Settings 302 Vdsl Parameter Defaults 303 304 Vdsl Parameters Accepted Values 305 Parameter 306 Etsi M2 CAB 307 308 309 310 Glossary 311 312 313 314 315 316 Ethernet crossover cable. See crossover cable 317 318 319 320 321 322 323 324 325 326 Description 327 328 Software and protocols North America Agency approvals329 International Manufacturer’s Declaration of Conformance 330 331 Declaration for Canadian users Telecommunication installation cautions Important Safety InstructionsAustralian Safety Information 332 CFR Part 68 Information 333 Electrical Safety Advisory 334 Overview of Major Capabilities 335 Instant-On PPP Wide Area Network TerminationPPPoE/PPPoA Point-to-Point Protocol over Ethernet/ATM 336 DNS Proxy Simpliﬁed Local Area Network SetupDhcp Dynamic Host Conﬁguration Protocol Server 337 Embedded Web Server DiagnosticsManagement 338 339 Remote Access ControlPassword Protection Network Address Translation NAT Netopia Gateway 340 Internal Servers Netopia Advanced Features for NAT341 Pinholes 342 Default ServerCombination NAT Bypass Conﬁguration IP-Passthrough 343VPN IPSec Pass Through Stateful Inspection Firewall 344VPN IPSec Tunnel Termination SSL Certiﬁcate Support Index 345 346 NAT 255, 262 347 NTP 348 349 350