Manuals / Netopia / Computer Equipment / Network Router

Netopia 2200 manual SafeHarbour IPSec VPN, 131

Models: 2200

1 351

Download 351 pages 59.91 Kb

Page 131

Image 131

Security

SafeHarbour IPSec VPN

SafeHarbour VPN IPSec Tunnel provides a single, encrypted tunnel to be terminated on the Gateway, making a secure tunnel available for all LAN- connected users. This imple- mentation offers the following:

•Eliminates the need for VPN client software on individual PCs.

•Reduces the complexity of tunnel conﬁguration.

•Simpliﬁes the ongoing maintenance for secure remote access.

If you have purchased the SafeHarbour IPSec feature key, the IPSec conﬁguration screen offers additional options.

131

Page 131

Image 131

Netopia 2200 manual SafeHarbour IPSec VPN, 131

Contents

Netopia Software User Guide Copyright Table of Contents Expert Mode Security 146 Basic Troubleshooting Command Line Interface 221 Table of Contents Glossary Overview of Major Capabilities Index What’s New IntroductionIntended Audience About Netopia DocumentationInternal Web Interface Command Line InterfaceDocumentation Conventions GeneralBold terminal type User-entered text face Word About Example Screens OrganizationPage Basic Mode Setup Power Supply Installation Important Safety InstructionsBewahren Sie diese Anweisungen auf Wichtige SicherheitshinweiseAchtung Microsoft Windows Setting up the Netopia GatewayThen go to Step Macintosh MacOS 8 or higher or Mac OS Proceed to Conﬁguring the Netopia Gateway on Conﬁguring the Netopia Gateway Click the Connect to the Internet button MiAVo Vdsl and Ethernet WAN models QuickstartPPPoE Quickstart Configuring the Netopia Gateway Netopia Gateway Status Indicator Lights Home Page Basic Mode DNS Link Manage My Account Link Status Details Link Enable Remote Management Link Expert Mode Link Update Firmware Link Factory Reset Open the Web Connection Accessing the Expert Web InterfacePage Home Page Expert Mode Field Status and/or Description Home Page InformationSummary Information Dhcp Link Breadcrumb Trail ToolbarNavigating the Web Interface Button Restart RestartLink Alert Symbol Button Help HelpLink Quickstart ConﬁgureButton Conﬁgure Click Connect to the Internet Link LAN Configure Page Wireless supported models Privacy Configure Page Advanced Page About Closed System Mode Page WPA Version Allowed ExamplesMultiple SSIDs Wireless MAC Authorization Page Configure Use Radius Server Advanced Network Conﬁguration page appears Other WAN Options WAN IP InterfacesIP Gateway Available Multiplexing types Available Encapsulation typesSustained Cell Rate SCR Transmit Priority Comments ClassLink Advanced IP Static Route Entry page appears Link IP Static RoutesPage Link Pinholes Link IP Static ARPTCP Tips for making Pinhole Entries Gateway Pinhole Conﬁguration Procedure. Use the following steps Page Configure Link IPMaps Ple static 192.168.1.2 IPMaps Block DiagramNetopia Gateway WAN Interface LAN Interface 192.168.1.1Link Default Server NAT LAN STN #2 Internet GatewayConfigure Page Link Differentiated Services Page QoS Setting TOS Bit Value Behavior Link Dhcp Server Link DNSConfigure Link Radius Server Link Snmp Page Link Igmp Internet Group Management Protocol Page Configure 100 Link UPnP101 Link LAN Management102 Link Advanced Ethernet Bridge103 Conﬁguring for Bridge Mode104 Enable Concurrent Bridging/Routing checkbox105 106 Link Vlan107 Vlan Port Conﬁguration screen appears Enable Multiple Wireless IDs on108 109 110 111 Link Syslog Parameters112 System Log Messages Administration Related Log MessagesLog Event Messages 113DSL Log Messages most common Access-related Log Messages114 Mented packet 115116 Link Internal ServersLink Software Hosting List of Supported Games and Software 117FTP 118119 Rename a UserPC120 Link Clear Options121 Link Time Zone122 SecurityButton Security 123 Link Passwords124 Use a Netopia Firewall Conﬁguring for a BreakWater SettingLink Firewall 125126 Basic Firewall Background 127Tips for making your BreakWater Basic Firewall Selection 128 BreakWater Setting ClearSailing SilentRunning LANdLocked129 130 Link IPSec131 SafeHarbour IPSec VPNConﬁguring a SafeHarbour VPN 132133 IPSec Tunnel Details Parameter Setup WorksheetParameter Descriptions on page 136 as required 134Make the Tunnel Details entries 135Field Description 136Parameter Descriptions PAT Address 137Soft MBytes 138139 140 Stateful Inspection Firewall installation procedureLink Stateful Inspection 141 Exposed Addresses142 143 144 Stateful Inspection OptionsPort Protocol Description LAN Private WAN Public Interface Open Ports in Default Stateful Inspection Installation145 146 Firewall TutorialGeneral ﬁrewall terms Basic IP packet components147 Basic protocol typesFirewall Logic Example TCP/UDP Ports TCP Port ServiceFirewall design rules 148Implied rules 149Example ﬁlter set 150Example network Filter basics151 What it meansExample Example ﬁlters152 153 154 Link Packet Filter155 What’s a ﬁlter and what’s a ﬁlter set?How ﬁlter sets work Filter priority How individual ﬁlters work156 Parts of a ﬁlter 157ﬁltering rule Port number comparisons 158Port numbers Putting the parts together 159Other ﬁlter attributes Filtering example #1 160161 Filtering example #2 162163 An approach to using ﬁltersDesign guidelines 164 Working with IP Filters and Filter SetsAdding a ﬁlter set 165 Adding ﬁlters to a ﬁlter setNetopia Router 166167 Enter the Source Mask for the source IP address 168Viewing ﬁlters 169Deleting ﬁlters Deleting a ﬁlter set170 Modifying ﬁlters171 Associating a Filter Set with an Interface172 173 Policy-based Routing using FiltersetsTOS ﬁeld matching 174 175 176 Using the Security Monitoring LogLink Security Log 177 Timestamp Background 178179 InstallButton Install 180 Link Install Software181 Required FilesNetopia ﬁrmware Image File 182 Click the Install Software buttonVerify the Netopia Firmware Release 183Procedure Install a New Feature Key File Link Install KeysUse Netopia Software Feature Keys Obtaining Software Feature Keys185 186 To check your installed features187 188 Link Install Certiﬁcate189 190 191 Basic TroubleshootingEthernet Status Indicator Lights192 ActionEthernet 1, 2, 3 193194 WirelessDSL Sync 195196 Special patterns 197LAN 1, 2, 3 198DSL Sync 199200 Front View201 LED Function Summary MatrixLink 202EN Link Unlit Active203 Factory Reset Switch2240N 3397GP2247NWG 3347W/3357W205 Advanced Troubleshooting206 HomeStatus of Connection 207208 Expert ModeButton Troubleshoot 209 Link System Status210 Link Ports Ethernet211 Link Ports DSL212 Link IP Interfaces213 Link DSL Circuit Conﬁguration214 Link System Log Entire215 Link Diagnostics216 Link Network Tools217 If Ping is not successful, possible causes are 218219 220 221 Command Line Interface222 OverviewKeywords Command Verbs Status and/or Description223 224 Starting and Ending a CLI SessionLogging Ending a CLI SessionShell Command Shortcuts Using the CLI Help FacilityAbout Shell Commands Saving SettingsCommon Commands Shell Commands227 DiagnoseDownload serveraddress ﬁlename conﬁrm Download -cert serveraddress ﬁlename conﬁrm228 Install serveraddress ﬁlename conﬁrmLicense key Loglevel level229 NetstatNetstat -r Reset dhcp server Reset arpReset atm Reset crashReset wan-users all ip-address Reset ipmapReset log Reset security-logShow dhcp agent Show featuresShow conﬁg Show crashShow ip ﬁrewall Show ip igmpShow ip interfaces Show ip ipsecShow memory all Show wireless allShow wireless clients MACaddress Show log235 Upload serveraddress ﬁlename conﬁrmView conﬁg WhoWAN Commands Navigating the Config Hierarchy About Config CommandsConfig Mode Prompt 238 Netopia-3000/9437188 top quit239 Entering Commands in Config ModeSet ip ethernet a ipaddress Set ip ethernet a240 Guidelines Config CommandsDisplaying Current Gateway Settings Step Mode a CLI Conﬁguration Technique241 Validating Your ConﬁgurationDSL Commands Config CommandsSet atm vcc n vci 0 Set atm vcc n qos sustained-cell-rate 1 ...nSet atm vcc n qos max-burst-size 1 ...n Set atm vcc n vpi 0Set bridge concurrent-bridging-routing on off Bridging SettingsSet atm vccn pppoe-sessions 1 Set bridge sys-bridge on offSet bridge dsl vccn option on off Set bridge table-timeout 30Dhcp Settings Set bridge ethernet option on offSet dhcp server-address ipaddress Set dhcp start-address ipaddressSet dhcp end-address ipaddress Set dhcp lease-time lease-timeSet dmt autoConﬁg off on DMT SettingsSet dmt wiringMode auto tipring AA1 Set dmt metallic-termination auto disabled alwaysonSet dns primary-address ipaddress Domain Name System SettingsSet dns proxy-enable Set dns domain-name domain-nameSet igmp query-intvl value Igmp SettingsSet igmp snooping off on Set igmp robustness valueSet ip dsl vccn address ipaddress IP SettingsSet ip arp-timeout 60 Set ip option on offSet ip dsl vccn rip-send off v1 v2 v1-compat v2-MD5 Set ip dsl vccn restriction admin-disabled noneSet ip dsl vccn netmask netmask Set ip dsl vccn addr-mapping on offSet ip ethernet a broadcast broadcastaddress Set ip dsl vccn rip-receive Off v1 v2 v1-compat v2-MD5Set ip ethernet a option on off Set ip ethernet a address ipaddress253 Set ip ethernet a restrictions none admin-disabledSet ip ethernet a netmask netmask Set ip ethernet a rip-send Off v1 v2 v1-compat v2-MD5Set ip ip-ppp vccn option on off Set ip ethernet a rip-receive off v1 v2 v1-compat v2-MD5Set ip gateway option on off Set ip gateway interface ip-address ppp-vccnSet ip ip-ppp vccn addr-mapping on off Set ip ip-ppp vccn restriction admin-disabled noneSet ip ip-ppp vccn address ipaddress Set ip ip-ppp vccn peer-address ipaddress256 Set ip ip-ppp vccn rip-send off v1 v2 v1-compat v2-MD5Set ip ip-ppp vccn rip-receive off v1 v2 v1-compat v2-MD5 257 Set ip static-arp ip-addressipaddressSet ip igmp-forwarding off on Set ip ipsec-passthrough off on258 Set ip prioritize off onSet diffserv option off on Set diffserv lohi-ratio 60 100 percent259 260 Set ip sip-passthrough on offSet ip static-routes destination-networknetaddress 261 Delete ip static-routes destination-network netaddressNetwork Address Translation NAT Default Settings IPMaps SettingsSet pinhole name name protocol-select tcp udp Set nat-default host-hardware-address MACaddressNetwork Address Translation NAT Pinhole Settings Set pinhole name namePPPoE /PPPoA Settings Set ppp module vccn lcp-echo-requests on off Set ppp module vccn mru integerSet ppp module vccn magic-number on off Set ppp module vccn protocol-compression on offSet ppp module vccn connection-type instant-on always-on Set ppp module vccn restart-timer integerSet ppp module vccn conﬁgure-max integer Set ppp module vccn terminate-max integerCommand Line Interface Preference Settings Set ppp module vccn port-authentication username usernameSet ppp module vccn port-authentication password password Ethernet Port Settings268 Set preference more lines269 Port Renumbering SettingsSet servers web-http 1 Set servers telnet-tcp 1270 Security SettingsSet security ipsec option off on off Set security ipsec tunnels name271 Set security ipsec tunnels name 123 tun-enable on on off272 Set security ipsec tunnels name 123 IKE-mode DH-group 1 1 2Set security ipsec tunnels name 123 xauth username username Set security ipsec tunnels name 123 xauth enable off onSet security ipsec tunnels name 123 xauth password password Set security ipsec tunnels name 123 nat-enable on off274 Set security ipsec tunnels name 123 local-id idvalueSet security ipsec tunnels name 123 remote-id idvalue 275 276 Set security state-insp tcp-timeout 30277 Set security state-insp udp-timeout 30Set security state-insp xposed-addr exposed-address# n 278 Packet Filtering Settings279 280 281 Snmp Settings 283 System SettingsSet snmp notify type v1-trap v2-trap inform Set system name nameSet system persistent-log off on Set system idle-timeout telnet 1...120 http 1Set system username administrator name user name Set system log-size 10240285 Set system password admin userSleep Contact-email string@domainname location string 286 287 Set system zerotouch option on offSet system zerotouch redirect-url redirection-URL Syslog Set security state-insp eth B option on 289Wireless Settings supported models 291 Set wireless mode both-b-and-g b-only g-onlySet wireless multi-ssid option on off 292 293 Set wireless no-bridging off onSet wireless tx-power full medium fair low minimal 294 Set wireless network-id privacy pre-shared-key stringSet wireless network-id privacy default-keyid Example 256bit key 295Example 40bit key 02468ACE02 Set radius alt-radius-name servernamestring Set wireless mac-auth option on offSet radius radius-name servernamestring Set radius radius-secret sharedsecret297 Set radius radius-port portnumberSet vlan name string To make the Vlan vlan1 routable add the port lan-uplink 298299 Set upnp option on offSet dslf-lanmgmt option off on 300 301 302 Vdsl Settings303 Vdsl Parameter DefaultsVdsl Parameters Accepted Values 304Parameter 305Etsi M2 CAB 306307 308 309 310 311 Glossary312 313 314 315 Ethernet crossover cable. See crossover cable 316317 318 319 320 321 322 323 324 325 326 327 DescriptionSoftware and protocols 328International Agency approvals329 North America330 Manufacturer’s Declaration of ConformanceDeclaration for Canadian users 331332 Important Safety InstructionsAustralian Safety Information Telecommunication installation cautions333 CFR Part 68 Information334 Electrical Safety Advisory335 Overview of Major Capabilities336 Wide Area Network TerminationPPPoE/PPPoA Point-to-Point Protocol over Ethernet/ATM Instant-On PPP337 Simpliﬁed Local Area Network SetupDhcp Dynamic Host Conﬁguration Protocol Server DNS Proxy338 DiagnosticsManagement Embedded Web ServerNetwork Address Translation NAT Remote Access ControlPassword Protection 339340 Netopia GatewayPinholes Netopia Advanced Features for NAT341 Internal ServersCombination NAT Bypass Conﬁguration Default Server342 VPN IPSec Pass Through 343IP-Passthrough SSL Certiﬁcate Support 344VPN IPSec Tunnel Termination Stateful Inspection Firewall345 Index346 347 NAT 255, 262348 NTP349 350