Administrator’s Handbook Embedded Software Version 7.7.
Administrator’s Handbook Copyright Copyright © 2007 by Motorola, Inc. All rights reserved. No part of this publication may be reproduced in any form or by any means or used to make any derivative work (such as translation, transformation or adaptation) without written permission from Motorola, Inc. Motorola reserves the right to revise this publication and to make changes in content from time to time without obligation on the part of Motorola to provide notification of such revision or change.
Copyright remains Eric Young's, and as such any Copyright notices in the code are not to be removed. If this package is used in a product, Eric Young should be given attribution as the author of the parts of the library used. This can be in the form of a textual message at program startup or in documentation (online or textual) provided with the package. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1.
Administrator’s Handbook RSA Data Security, Inc. makes no representations concerning either the merchantability of this software or the suitability of this software for any particular purpose. It is provided “as is” without express or implied warranty of any kind. These notices must be retained in any copies of any part of this documentation and/or software. Portions of this software are based in part on the work of the following: Copyright (c) 1989 Carnegie Mellon University. All rights reserved.
Table of Contents CHAPTER 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 What’s New in 7.7.4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 About Motorola Netopia® Documentation . . . . . . . . . . . . . . . . 15 Intended Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Documentation Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . 15 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Administrator’s Handbook Home Page - Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Toolbar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Navigating the Web Interface . . . . . . . . . . . . . . . . . . . . . . . . . 43 Breadcrumb Trail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Restart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 IGMP (Internet Group Management Protocol) . . . . . . . . . . . . . . . . . . 100 UPnP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 LAN Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 Ethernet Bridge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Administrator’s Handbook Example 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 Example 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 Example 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 Packet Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 What’s a filter and what’s a filter set?. . . . . . . . . . . . . . . . . . . . . . .
CHAPTER 5 Advanced Troubleshooting . . . . . . . . . . . . . . . . . . . . . 207 Home Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 Expert Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210 System Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 Ports: Ethernet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 Ports: DSL . . . .
Administrator’s Handbook IP Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259 Common Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259 ARP Timeout Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259 DSL Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259 Ethernet LAN Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Example 2: . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313 VoIP settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316 Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320 UPnP settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 DSL Forum settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321 TR-064 . .
Administrator’s Handbook North America . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344 International . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344 Regulatory notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344 European Community. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344 Manufacturer’s Declaration of Conformance . . . . . . . . . . . . . 344 United States . . . . . . .
CHAPTER 1 Introduction What’s New in 7.7.4 New in Motorola Netopia® Embedded Software Version 7.7.4 are the following features: • Internet Group Management Protocol (IGMP) Version 3 support. See “IGMP (Internet Group Management Protocol)” on page 100. • TR-101 Support: • Concurrent support for PPPoE and IPoE connections on the WAN. See “WAN” on page 67. • Multiple LAN IP Subnet support. See “LAN” on page 49. • Additional DHCP range support.
Administrator’s Handbook • Provide Bandwidth Management using Weighted Fair Queueing. • • • • 14 See “Queue Configuration” on page 271. New CLI command for disabling Dying Gasp. See “DMT Settings” on page 254. Ethernet in the First Mile Operations Administration and Maintenance (802.3ah EFM OAM) Support. See “802.3ah Ethernet OAM Settings” on page 284. IP multicast to layer 2 unicast mapping. See “IGMP Settings” on page 257.
About Motorola Netopia® Documentation ☛ NOTE: This guide describes the wide variety of features and functionality of the Motorola Netopia® Gateway, when used in Router mode. The Motorola Netopia® Gateway may also be delivered in Bridge mode. In Bridge mode, the Gateway acts as a pass-through device and allows the workstations on your LAN to have public addresses directly on the Internet. Motorola, Inc.
Administrator’s Handbook terminal bold terminal Computer display text Italic Italic type indicates the complete titles of manuals.
Organization This guide consists of nine chapters, including a glossary, and an index. It is organized as follows: • Chapter 1, “Introduction” — Describes the Motorola Netopia® document suite, the purpose of, the audience for, and structure of this guide. It gives a table of conventions. • Chapter 2, “Basic Mode Setup” — Describes how to get up and running with your Motorola Netopia® • • • • • • • • Gateway.
Administrator’s Handbook 18
CHAPTER 2 Basic Mode Setup Most users will find that the basic Quickstart configuration is all that they ever need to use. This section may be all that you ever need to configure and use your Motorola Netopia® Gateway. The following instructions cover installation in Router Mode.
Administrator’s Handbook Important Safety Instructions POWER SUPPLY INSTALLATION Connect the power supply cord to the power jack on the Motorola Netopia® Gateway. Plug the power supply into an appropriate electrical outlet. ☛ CAUTION: Depending on the power supply provided with the product, either the direct plug-in power supply blades, power supply cord plug or the appliance coupler serves as the mains power disconnect.
Wichtige Sicherheitshinweise NETZTEIL INSTALLIEREN Verbinden Sie das Kabel vom Netzteil mit dem Power-Anschluss an dem Motorola Netopia® Gateway. Stecken Sie dann das Netzteil in eine Netzsteckdose. ☛ Achtung: Abhängig von dem mit dem Produkt gelieferten Netzteil, entweder die direkten Steckernetzgeräte, Stecker vom Netzkabel oder der Gerätekoppler dienen als Hauptspannungsunterbrechung. Es ist wichtig, dass das Steckernetzgerät, Steckdose oder Gerätekoppler frei zugänglich sind.
Administrator’s Handbook Setting up the Motorola Netopia® Gateway Refer to your Quickstart Guide for instructions on how to connect your Motorola Netopia® gateway to your power source, PC or local area network, and your Internet access point, whether it is a dedicated DSL outlet or a DSL or cable modem. Different Motorola Netopia® Gateway models are supplied for any of these connections. Be sure to enable Dynamic Addressing on your PC. Perform the following: Microsoft Windows: Step 1.
c. Windows Vista is set to obtain an IP address automatically by default. You may not need to configure it at all. To check, open the Networking Control Panel and select Internet Protocol Version 4 (TCP/IPv4). Click the Properties button. The Internet Protocol Version 4 (TCP/IPv4) Properties window should appear as shown. If not, select the radio buttons shown above, and click the OK button.
Administrator’s Handbook Macintosh MacOS 8 or higher or Mac OS X: Step 1. Access the TCP/IP or Network control panel. a. MacOS follows a path like this: Apple Menu -> Control Panels -> TCP/IP Control Panel b. Mac OS X follows a path like this: Apple Menu -> System Preferences -> Network Then go to Step 2. Step 2. Select Built-in Ethernet Step 3. Select Configure Using DHCP Step 4. Close and Save, if prompted. Proceed to “Configuring the Motorola Netopia® Gateway” on page 25.
Configuring the Motorola Netopia® Gateway 1. Run your Web browser application, such as Firefox or Microsoft Internet Explorer, from the computer connected to the Motorola Netopia® Gateway. Enter http://192.168.1.254 in the Location text box. The Admin Password page appears. Access to your Motorola Netopia® device can be controlled through two access control accounts, Admin or User. • The Admin, or administrative user, performs all configuration, management or maintenance operations on the Gateway.
Administrator’s Handbook Once a connection is established, your browser is redirected to your service provider’s home page or a registration page on the Internet. ☛ NOTE: For MiAVo Series (3397GP) models, skip the rest of this section. Congratulations! Your configuration is complete. You can skip to “Home Page - Basic Mode” on page 31.
PPPoE Quickstart For a PPPoE connection, your browser will display a different series of web pages: The browser then displays the Quickstart web page. 3. Enter the username and password supplied by your Internet Service Provider. Click the Connect to the Internet button. Once you enter your username and password here, you will no longer need to enter them whenever you access the Internet. The Motorola Netopia® Gateway stores this information and automatically connects you to the Internet.
Administrator’s Handbook Set up the Motorola Netopia® Pocket Gateway Your Motorola Netopia® 3342N/3352N Pocket Gateway comes with its own installation wizard. • If you are using Windows 98, insert the CD. • If you are using Windows XP, Windows 2000, Windows NT or Windows Vista, you don’t even need the CD. Follow these easy setup steps: 1. 2. 3. 4. Plug the Motorola Netopia® Pocket Gateway into a USB port on your PC.
5. The Wizard displays a success message when the settings are configured. The Motorola Netopia® Installation Wizard will then launch your web browser and display the Welcome page where you configure your Motorola Netopia® Pocket Gateway.
Administrator’s Handbook Motorola Netopia® Gateway Status Indicator Lights Colored LEDs on your Motorola Netopia® Gateway indicate the status of various port activity. Different Gateway models have different ports for your connections and different indicator LEDs. The Quickstart Guide accompanying your Motorola Netopia® Gateway describes the behavior of the various indicator LEDs.
Home Page - Basic Mode After you have performed the basic Quickstart configuration, any time you log in to your Motorola Netopia® Gateway you will access the Motorola Netopia® Gateway Home Page. You access the Home Page by typing http://192.168.1.254 in your Web browser’s location box. The Basic Mode Home Page appears. ☛ VoIP-enabled Gateways also display VoIP phone information, as well.
Administrator’s Handbook The Home Page displays the following information in the center section: Item Serial Number Software Release Description This is the unique serial number of your Gateway. This is the version number of the current embedded software in your Gateway. Warranty Date This is the date that your Gateway was installed and enabled.
Link: Manage My Account You can change your ISP account information for the Motorola Netopia® Gateway. You can also manage other aspects of your account on your service provider’s account management Web site. Click on the Manage My Account link. The Manage My Account page appears. If you have a PPPoE account, enter your username, and then your new password. Confirm your new password. For security, your actual passwords are not displayed on the screen as you type.
Administrator’s Handbook Link: Status Details If you need to diagnose any problems with your Motorola Netopia® Gateway or its connection to the Internet, you can run a sophisticated diagnostic tool. It checks several aspects of your physical and electronic connection and reports its results on-screen. This can be useful for troubleshooting, or when speaking with a technical support technician. Click on the Status Details link. The Diagnostics page appears.
Link: Enable Remote Management This link allows you to authorize a remotely-located person, such as a support technician, to directly access your Motorola Netopia® Gateway. This is useful for fixing configuration problems when you need expert help. You can limit the amount of time such a person will have access to your Gateway. This will prevent unauthorized individuals from gaining access after the time limit has expired. Click the Enable Rmt Mgmt link. The Enable Remote Management page appears.
Administrator’s Handbook Link: Expert Mode Most users will find that the basic Quickstart configuration is all that they ever need to use. Some users, however, may want to do more advanced configuration. The Motorola Netopia® Gateway has many advanced features that can be accessed and configured through the Expert Mode pages. Click the Expert Mode link to display the Expert Mode Confirmation page.
Link: Update Firmware ☛ NOTE: (This link is not available on the 3342/3352 models, since firmware updates must be upgraded via the USB host driver. 3342N/3352N models do support this feature.) Periodically, the embedded firmware in your Gateway may be updated to improve the operation or add new features. Your gateway includes its own onboard installation capability. Your service provider may inform you when new firmware is available, or you can check for yourself. Click the Update Firmware link.
Administrator’s Handbook Link: Factory Reset In some cases, you may need to clear all the configuration settings and start over again to program the Motorola Netopia® Gateway. You can perform a factory reset to do this. Click on Factory Reset to reset the Gateway back to its original factory default settings. ☛ NOTE: Exercise caution before performing a Factory Reset. This will erase any configuration changes that you may have made and allow you to reprogram your Gateway.
CHAPTER 3 Expert Mode Using the Expert Mode Web-based user interface for the Motorola Netopia® 2200-, 3300- and 7000-series Gateway you can configure, troubleshoot, and monitor the status of your Gateway. Accessing the Expert Web Interface Open the Web Connection Once your Gateway is powered up, you can use any recent version of the best-known web browsers such as Netscape Navigator or Microsoft Internet Explorer from any LAN-attached PC or workstation. The procedure is: 1. 2.
Administrator’s Handbook You are challenged to confirm your choice. Click OK. The Home Page opens in Expert Mode.
Home Page - Expert Mode The Home Page is the summary page for your Motorola Netopia® Gateway. The toolbar at the top provides links to controlling, configuring, and monitoring pages. Critical configuration and operational status is displayed in the center section. Home Page - Information The Home page’s center section contains a summary of the Gateway’s configuration settings and operational status.
Administrator’s Handbook Status Data Rate (Kbps) Local Address Peer Address Connection Type NAT WAN Users Wide Area Network may be Waiting for DSL (or other waiting status), Up or Down Once connected, displays DSL speed rate, Downstream and Upstream IP address assigned to the WAN port. The IP address of the gateway to which the connection defaults. If doing DHCP, this info will be acquired. If doing PPP, this info will be negotiated. May be either Instant On or Always On. On or Off.
Toolbar The toolbar is the dark blue bar at the top of the page containing the major navigation buttons. These buttons are available from almost every page, allowing you to move freely about the site.
Administrator’s Handbook Restart Button: Restart The Restart button on the toolbar allows you to restart the Gateway at any time. You will be prompted to confirm the restart before any action is taken. The Restart Confirmation message explains the consequences of and reasons for restarting the Gateway.
Link: Alert Symbol The Alert symbol appears in the upper right corner if you make a database change; one in which a change is made to the Gateway’s configuration. The Alert serves as a reminder that you must Save the changes and Restart the Gateway before the change will take effect. You can make many changes on various pages, and even leave the browser for up to 5 minutes, but if the Gateway is restarted before the changes are applied, they will be lost.
Administrator’s Handbook Help Button: Help Context-sensitive Help is provided in your Gateway. The page shown here is displayed when you are on the Home page or other transitional pages. To see a context help page example, go to Security -> Passwords, then click Help.
Configure Button: Configure The Configuration options are presented in the order of likelihood you will need to use them. Quickstart is typically accessed during the hardware installation and initial configuration phase. Often, these settings should be changed only in accordance with information from your Service Provider. LAN and WAN settings are available to fine-tune your system.
Administrator’s Handbook A brief message is displayed while the Gateway attempts to establish a connection. 3. When the connection succeeds, your browser will display your Service Provider’s home page. If you encounter any problems connecting, refer to the chapters “Basic Troubleshooting” on page 193 or “Advanced Troubleshooting” on page 207.
Link: LAN * Enable Interface: Enables all LAN-connected computers to share resources and to connect to the WAN. The Interface should always be enabled unless you are instructed to disable it by your Service Provider during troubleshooting. * IP Address: The LAN IP Address of the Gateway. The IP Address you assign to your LAN interface must not be used by another device on your LAN network. * IP Netmask: Specifies the subnet mask for the TCP/IP network connected to the virtual circuit.
Administrator’s Handbook • IGMP Forwarding: The default setting is Disabled. If you check this option, it will enable Internet Group • • • • Management Protocol (IGMP) multicast forwarding. IGMP allows a router to determine which host groups have members on a given network segment. See “IGMP (Internet Group Management Protocol)” on page 100 for more information.
☛ Note: You need not use this screen if you have only a single Ethernet IP subnet. This screen displays seven rows of editable columns. All seven row labels are always visible, regardless of the number of subnets configured. • To add an IP subnet, select one of the rows, and click the Edit button. Check the Enabled checkbox and click the Submit button. The screen expands to allow you to enter subnet information.
Administrator’s Handbook • DHCP Server: Your Gateway can provide network configuration information to computers on your LAN, using the Dynamic Host Configuration Protocol (DHCP). If you already have a DHCP server on your LAN, you should turn this service off. If you want the Gateway to provide this service, click the Server Mode pull-down menu, choose Server, then configure the range of IP addresses that you would like the Gateway to hand out to your computers.
Wireless (supported models) If your Gateway is a wireless model (such as a 3347W) you can enable or disable the wireless LAN (WLAN) by clicking the Wireless link. Wireless functionality is enabled by default. If you uncheck the Enable Wireless checkbox, the Wireless Options are disabled, and the Gateway will not provide or broadcast any wireless LAN services. SSID (Network ID): The SSID is preset to a number that is unique to your unit.
Administrator’s Handbook Privacy • Off - No Privacy provides no encryption on your wireless LAN data. • WPA-802.1x provides RADIUS server authentication support. • WPA-PSK provides Wireless Protected Access, the most secure option for your wireless network. This mechanism provides the best data protection and access control. The Pre Shared Key is a passphrase shared between the Router and the clients and is used to generate dynamically changing keys.
You select a single key for encryption of outbound traffic. The WEP-enabled client must have an identical key of the same length, in the identical slot (1 – 4) as the Gateway, in order to successfully receive and decrypt the traffic. Similarly, the client also has a ‘default’ key that it uses to encrypt its transmissions. In order for the Gateway to receive the client’s data, it must likewise have the identical key of the same length, in the same slot.
Administrator’s Handbook Advanced If you click the Advanced link, the advanced 802.11 Wireless Settings page appears. Note: This page displays different options depending on which form of Privacy or other options you have enabled. You can then configure: Operating Mode: The pull-down menu allows you to select and lock the Gateway into the wireless transmission mode you want. For compatibility with clients using 802.11b (up to 11 Mbps transmission) and 802.11g (up to 20+ Mbps), select Normal (802.11b + g).
France, Spain and Japan will differ. Channel selection can have a significant impact on performance, depending on other wireless activity close to this Gateway. Channel selection is not necessary at the client computers; the clients will scan the available channels seeking access points using the same SSID as the client. AutoChannel Setting: For 802.11G models, AutoChannel is a feature that allows the Motorola Netopia® Gateway to determine the best channel to broadcast automatically.
Administrator’s Handbook ☛ NOTE: While clients may also have a passphrase feature, these are vendor-specific and may not necessarily create the same keys. You can passphrase generate a set of keys on one, and manually enter them on the other to get around this. Block Wireless Bridging: Check the checkbox to block wireless clients from communicating with other wireless clients on the LAN side of the Gateway. • WEP - Manual allows you to enter your own encryption keys manually.
Encryption Key #1 – #4: The encryption keys. You enter keys using hexadecimal digits. For 40/64bit encryption, you need ten digits; 26 digits for 128bit, and 58 digits for 256bit WEP. Hexadecimal characters are 0 – 9, and a – f. Examples: • 40bit: 02468ACE02 • 128bit: 0123456789ABCDEF0123456789 • 256bit: 592CA140F0A238B0C61AE162F592CA140F0A238B0C61AE162F21A09C Use WEP encryption key (1 – 4) #: Specifies which key the Gateway will use to encrypt transmitted traffic. The default is key #1.
Administrator’s Handbook The screen expands to allow you to name each additional Wireless ID, and specify a Privacy mode for each one.
Privacy modes available from the pull-down menu for the multiple SSIDs are: WPA-PSK, WPA-802.1x, or Off-No Privacy. WEP can also be selected on the additional SSIDs as long as it is not used on the primary SSID. WEP can only be used on one SSID, so any others will not have WEP available. These additional Wireless IDs are “Closed System Mode” Wireless IDs that will not be shown by a client scan, and therefore must be manually configured at the client.
Administrator’s Handbook WiFi Multimedia WiFi Multimedia is an advanced feature that allows you to prioritize various types of data travelling over the wireless network. Certain types of data that are sensitive to delays, such as voice or video, must be prioritized ahead of other, less delay-sensitive types, such as email. WiFi Multimedia currently implements wireless Quality of Service (QoS) by transmitting data depending on Diffserv priority settings.
The screen expands. Router EDCA Parameters (Enhanced Distributed Channel Access) govern wireless data from your Gateway to the client; Client EDCA Parameters govern wireless data from the client to your Gateway. ☛ NOTE: It is not recommended that you modify these settings without direct knowledge or instructions to do so. Modifying these settings inappropriately could seriously degrade network performance. • AIFs: (Arbitration Interframe Spacing) the wait time in milliseconds for data frames.
Administrator’s Handbook be accepted onto the wireless LAN. All unlisted addresses will be blocked, in addition to the listed addresses with Allow disabled. To enable Wireless MAC Authentication, click the MAC Authorization link. When the Wireless MAC Authentication screen appears, check the Enable Wireless MAC Authorization checkbox: The screen expands as follows: Click the Add button. The Authorized Wireless MAC Address Entry screen appears.
are added to the Authorized list. Your entry will be added to a list of up to 32 authorized addresses as shown: You can continue to Add, Edit, or Delete addresses to the list by clicking the respective buttons. After your first entry, the Alert icon will appear in the upper right corner of your screen. When you are finished adding addresses to the list, click the Alert icon, and Save your changes and restart the Gateway.
Administrator’s Handbook • RADIUS Server Addr/Name: The default RADIUS server name or IP address that you want to use. • RADIUS Server Secret: The RADIUS secret key used by this server. The shared secret should have the same characteristics as a normal password. • RADIUS Server Port: The port on which the RADIUS server is listening, typically, the default 1812. Click the Submit button.
Link: WAN When you click the WAN link, the WAN IP configuration page appears. This page varies depending on the WAN interface of your Motorola Netopia® Gateway. WAN IP Interfaces: Your IP interfaces are listed. PPP over Ethernet interface Click the PPP over Ethernet link to configure it. The WAN IP Interface page appears. Enable Interface: You can disable the interface by unchecking the checkbox. However, doing so will disable all ability for your LAN users to connect to the WAN using the Gateway.
Administrator’s Handbook Restrictions: This setting determines the types of traffic the Gateway accepts from the WAN. Admin Disabled means that Gateway traffic is accepted but administrative commands are ignored. None means that all traffic is accepted. When PPP is enabled, Admin Disabled is the default. DHCP/PPPoE/PPPoA Autosensing: The pull-down menu allows you to select an autosensing feature, or to disable it.
Advanced: If you click the Advanced link, the Advanced WAN IP Interface configuration page appears. Local Address: If this value is 0.0.0.0, the Gateway will acquire its IP address from your ISP. Otherwise this address is assigned to the virtual PPP interface. Peer Address: Address of the server on the Service Provider side of the ppp link. This peer will attempt to negotiate the local IP address if IP Address = 0.0.0.0. If the remote peer does not accept the IP address, the link will not come up.
Administrator’s Handbook LCP Settings: Authentication: Select Off, PAP and/or CHAP, PAP only, or CHAP only from the pull-down menu. The settings for port authentication on the Gateway must match the authentication expected by the remote system. The username and passwords are available on the WAN IP Interfaces page. MRU: Specifies the Maximum Receive Unit for the PPP Interface. Magic Number: Enables or disables LCP magic number negotiation.
The WAN IP Interface page appears. Enable Interface: You can disable the interface by unchecking the checkbox. However, doing so will disable all ability for your LAN users to connect to the WAN using the Gateway. Obtain IP Address Automatically: Your service provider may tell you that the WAN IP Address for your Gateway is static. In this case, disable this checkbox and enter the IP Address and IP Netmask from your Service Provider in the appropriate fields.
Administrator’s Handbook Address Mapping (NAT): Specifies whether you want the Gateway to use network address translation (NAT) when communicating with remote routers. NAT lets you conceal details of your network from remote routers. By default, address mapping is enabled. Restrictions: This setting determines the types of traffic the Gateway accepts from the WAN. Admin Disabled means that Gateway traffic is accepted but administrative commands are ignored. None means that all traffic is accepted.
WAN Ethernet and VDSL Gateways To allow for concurrent PPPoE and IPoE support on WAN Ethernet Gateways, including VDSL units, PPPoE with IPoE is available on the PPPoE configuration page. Checking the checkbox will provide this concurrent support. When you enable PPPoE with IPoE, the additional WAN interface becomes available for configuration. ☛ NOTE: Enabling pppoe-with-ipoe disables support for multiple PPPoE sessions.
Administrator’s Handbook Your Motorola Netopia® ADSL Gateway supports VPI/VCI autodetection by default. If VPI/VCI autodetection is enabled, the ATM Circuits page displays VPI/VCI = 0. If you configure a new ATM VPI/VCI pair, upon saving and restarting, autodetection is disabled and only the new VPI/VCI pair configuration will be enabled. VPI/VCI Autodetection consists of eight static VPI/VCI pair configurations. These are 0/35, 8/35, 0/32, 8/32, 1/35, 1/1, 1/32, 2/32.
Once the VCCs have been configured, the WAN IP Interfaces screen displays the additional interface which you can then configure as required.
Administrator’s Handbook ATM Traffic Shaping: You can prioritize delay-sensitive data by configuring the Quality of Service (QoS) characteristics of the virtual circuit. Click the ATM Traffic Shaping link. You can choose UBR (Unspecified Bit Rate), CBR (Constant Bit Rate), or VBR (Variable Bit Rate) from the pull-down menu and set the Peak Cell Rate (PCR) in the editable field. UBR (Unspecified Bit Rate) guarantees no minimum transmission rate. Cells are transmitted on a “best effort” basis.
Class PCR SCR MBS Transmit Priority Comments UBR X N/A N/A Low PCR is a cap CBR X N/A N/A High PCR is a guaranteed rate VBR X X X High PCR > SCR. SCR is a guaranteed rate. PCR is a cap.
Administrator’s Handbook Link: Advanced Selected Advanced options are discussed in the pages that follow. Many are self-explanatory or are dictated by your service provider.
Link: IP Static Routes A static route identifies a manually configured pathway to a remote network. Unlike dynamic routes, which are acquired and confirmed periodically from other routers, static routes do not time out. Consequently, static routes are useful when working with PPP, since an intermittent PPP link may make maintenance of dynamic routes problematic. When you click the Static Routes link, the IP Static Routes page appears. You can configure as many as 32 static IP routes for the Gateway.
Administrator’s Handbook • RIP Advertise: From the pull-down menu, choose how the static route should be advertised via RIP: • Split Horizon: Do not advertise route if the gateway is on the same subnet. • Always: Advertise route in all RIP messages. • Never: Do not advertise route. Click the Submit button. The Alert icon page, when you are finished. will appear, so that you can switch to the Save Changes Once you save your changes, you will be returned to the IP Static Routes entry screen.
Link: IP Static ARP Your Gateway maintains a dynamic Address Resolution Protocol (ARP) table to map IP addresses to Ethernet (MAC) addresses. It populates this ARP table dynamically, by retrieving IP address/MAC address pairs only when it needs them. Optionally, you can define static ARP entries to map IP addresses to their corresponding Ethernet MAC addresses. Unlike dynamic ARP table entries, static ARP table entries do not time out. The IP address cannot be 0.0.0.0.
Administrator’s Handbook Link: Pinholes Pinholes allow you to transparently route selected types of network traffic, such as FTP requests or HTTP (Web) connections, to a specific host behind the Gateway. Creating a pinhole allows access traffic originating from a remote connection (WAN) to be sent to the internal computer (LAN) that is specified in the Pinhole page. Pinholes are common for applications like multiplayer online games.
☛ TIPS for making Pinhole Entries: 1. If the port forwarding feature is required for Web services, ensure that the embedded Web server’s port number is re-assigned PRIOR to any Pinhole data entry. 2. Enter data for one Pinhole at a time. 3. Use a unique name for each Pinhole. If you choose a duplicate name, it will overwrite the previous information without warning. A diagram of this LAN example is: Gateway my-webserver Internet 192.168.1.1 WAN Ethernet Interface 210.219.41.
Administrator’s Handbook Pinhole Configuration Procedure. Use the following steps: 1. From the Configure toolbar button -> Advanced link, select the Internal Servers link. Since Port Forwarding is required for this example, the Motorola Netopia® embedded Web server is configured first. ☛ NOTE: The two text boxes, Web (HTTP) Server Port and Telnet Server Port, on this page refer to the port numbers of the Motorola Netopia® Gateway’s embedded administration ports.
6. Click on the Add or Edit more Pinholes link. Click the Add button. Add the next Pinhole. Type the specific data for the second Pinhole. 7. Click on the Add or Edit more Pinholes link. Click the Add button. Add the next Pinhole. Type the specific data for the third Pinhole. ☛ NOTE: Note the following parameters for the “my-games” Pinhole: 1. The Protocol ID is UDP. 2. The external port is specified as a range. 3. The Internal port is specified as the lower range entry.
Administrator’s Handbook 8. Click on the Add or Edit more Pinholes link. Review your entries to be sure they are correct. Click the Alert icon. 10. Click the Save and Restart link to complete the entire Pinhole creation task and ensure that the parameters are properly saved. 9. ☛ NOTE: REMEMBER: When you have re-assigned the port address for the embedded Web server, you can still access this facility. Use the Gateway’s WAN address plus the new port number.
Link: IPMaps IPMaps supports one-to-one Network Address Translation (NAT) for IP addresses assigned to servers, hosts, or specific computers on the LAN side of the Motorola Netopia® Gateway. A single static or dynamic (DHCP) WAN IP address must be assigned to support other devices on the LAN. These devices utilize Motorola Netopia®’s default NAT/PAT capabilities.
Administrator’s Handbook IPMaps Block Diagram The following diagram shows the IPMaps principle in conjunction with existing Motorola Netopia® NAT operations: Motorola Netopia® Gateway Static IP Addresses for IPMaps Applications WAN Interface LAN Interface 192.168.1.1 NAT/PAT Table 143.137.50.37 143.137.50.36 143.137.50.37 192.168.1.1 143.137.50.36 192.168.1.2 192.168.1.2 143.137.50.35 ... 192.168.1.3 ... 143.137.50.
Link: Default Server This feature allows you to: • Direct your Gateway to forward all externally initiated IP traffic (TCP and UDP protocols only) to a default host on the LAN. Enable it for certain situations: – Where you cannot anticipate what port number or packet protocol an in-bound application might use. For example, some network games select arbitrary port numbers when a connection is opened. – When you want all unsolicited traffic to go to a specific LAN host. • Configure for IP Passthrough.
Administrator’s Handbook Internet Gateway LAN STN #3 192.168.1.3 WAN Ethernet Interface 210.219.41.20 LAN Ethernet Interface NAT LAN STN #2 192.168.1.2 NAT protected Embedded Web Server 210.219.41.20 (Port 80 default) NAT Default Server NAT Default Server 192.168.1.1 You can also use the LAN-side address of the Gateway, 192.168.1.x to access the web and telnet server. NAT Combination Application.
• DHCP address serving can automatically serve the WAN IP address to a LAN computer. When DHCP is used for addressing the designated passthrough PC, the acquired or configured WAN address is passed to DHCP, which will dynamically configure a single-servable-address subnet, and reserve the address for the configured MAC address. This dynamic subnet configuration is based on the local and remote WAN address and subnet mask.
Administrator’s Handbook Link: Differentiated Services When you click the Differentiated Services link, the Differentiated Services configuration screen appears. Differentiated Services (Diffserv) allow your Gateway to make Quality of Service (QoS) decisions about what path Internet traffic, such as Voice over IP (VoIP), should travel across your network.
• To define a custom flow, click the Add button. The Custom Flow Entry screen appears. • Name – Enter a name in this field to label the flow. • Protocol – Select the protocol from the pull-down menu: TCP (default), UDP, ICMP, or Other. “Other” is appropriate for setting up flows on protocols with nonstandard port definitions. IPSEC and PPTP are common examples. • Numerical Protocol – If you select “Other” protocol, this field appears for you to provide its actual protocol number, with a range of 0 – 255.
Administrator’s Handbook • Quality of Service (QoS) – This is the Quality of Service setting for the flow, based on the TOS bit information. Select Expedite, Assure, or Off (default) from the pull-down menu. The following table outlines the TOS bit settings and behavior: QoS Setting 94 TOS Bit Value Behavior Off TOS=000 This custom flow is disabled. You can activate it by selecting one of the two settings below. This setting allows you to pre-define flows without actually activating them.
Link: DNS Your Service Provider may maintain a Domain Name server. If you have the information for the DNS servers, enter it on the DNS page. If your Gateway is configured to use DHCP to obtain its WAN IP address, the DNS information is automatically obtained from that same DHCP Server.
Administrator’s Handbook Link: DHCP Server Your Gateway can provide network configuration information to computers on your LAN, using the Dynamic Host Configuration Protocol (DHCP). If you already have a DHCP server on your LAN, you should turn this service off. If you want the Gateway to provide this service, select Server from the Server Mode pull-down menu, then configure the range of IP addresses that you would like the Gateway to hand out to your computers.
Link: RADIUS Server RADIUS servers allow external authentication of users by means of a remote authentication database. The remote authentication database is maintained by a Remote Authentication Dial-In User Service (RADIUS) server. In conjunction with Wireless User Authentication, you can use a RADIUS server database to authenticate users seeking access to the wireless services, as well as the authorized user list maintained locally within the Gateway.
Administrator’s Handbook Link: SNMP When you click the SNMP link, the SNMP configuration page appears. The Simple Network Management Protocol (SNMP) lets a network administrator monitor problems on a network by retrieving settings on remote network devices. The network administrator typically runs an SNMP management station program on a local host to obtain information from an SNMP agent. In this case, the Motorola Netopia® Gateway is an SNMP agent.
The Notification Type pull-down menu allows you to configure the type of SNMP notifications that will be generated: • v1 Trap – This selection will generate notifications containing an SNMPv1 Trap Protocol Data Unit (PDU) • v2 Trap – This selection will generate notifications containing an SNMPv2 Trap PDU • Inform – This selection will generate notifications containing an SNMPv2 InformRequest PDU. To send SNMP traps, you must add IP addresses for each trap receiver you want to have. Click the Add button.
Administrator’s Handbook Link: IGMP (Internet Group Management Protocol) Multicasting is a method for transmitting large amounts of information to many, but not all, computers over an internet. One common use is to distribute real time voice, video, and data services to the set of computers which have joined a distributed conference. Other uses include updating the address books of mobile computer users in the field, or sending out company newsletters to a distribution list.
The IGMP page appears. You can set the following options: •IGMP Snooping – checking this checkbox enables the • • • • • • Motorola Netopia® Gateway to “listen in” to IGMP traffic. The Gateway discovers multicast group membership for the purpose of restricting multicast transmissions to only those ports which have requested them. This helps to reduce overall network traffic from streaming media and other bandwidth-intensive IP multicast applications.
Administrator’s Handbook Link: UPnP Universal Plug and Play (UPnP™) is a set of protocols that allows a PC to automatically discover other UPnP devices (anything from an internet gateway device to a light switch), retrieve an XML description of the device and its services, control the device, and subscribe to real-time event notification. By default, UPnP is enabled on the Motorola Netopia® Gateway.
Link: LAN Management TR-064 is a LAN-side DSL Gateway configuration specification. It is an extension of UPnP. It defines more services to locally manage the Motorola Netopia® Gateway. While UPnP allows open access to configure the Gateway's features, TR-064 requires a password to execute any command that changes the Gateway's configuration. TR-064 is enabled by default. To disable it: • Uncheck the Enabled checkbox, and click the Submit button.
Administrator’s Handbook Link: Ethernet Bridge The Motorola Netopia® Gateway can be used as a bridge, rather than a router. A bridge is a device that joins two networks. As an Internet access device, a bridge connects the home computer directly to the service provider’s network equipment with no intervening routing functionality, such as Network Address Translation. Your home computer becomes just another address on the service provider’s network.
Configuring for Bridge Mode 1. 2. 3. Browse into the Motorola Netopia® Gateway’s web interface. Click on the Configure button in the upper Menu bar. Click on the LAN link. The LAN page appears. 4. In the box titled LAN IP Interface (Ethernet 100BT): Make note of the Ethernet IP Address and subnet mask. You can use this address to access the router in the future. 5. 6. Click on the Advanced link in the left-hand links toolbar. Under the heading of Services, click on the Ethernet Bridge link.
Administrator’s Handbook b. Click Submit. At this point you should be ready to do the final save on the configuration changes you have made. The yellow Alert symbol will appear beneath the Help button on the right-hand end of the menu bar. Click on the Alert symbol and you will see whether your changes have been validated. 11. If you are satisfied with the changes you have made, click Save and Restart in the Save Database box to Apply changes and restart Gateway. 10.
Link: VLAN When you click the VLAN link the VLANs page appears. Overview A Virtual Local Area Network (VLAN) is a network of computers or other devices that behave as if they are connected to the same wire even though they may be physically located on different segments of a LAN. You set up VLANs by configuring the Gateway software rather than hardware. This makes VLANs very flexible. VLANs behave like separate and independent networks. Beginning with Version 7.7.4, VLANs are now strictly layer 2 entities.
Administrator’s Handbook - WAN-side VLAN with Multiple WAN IPoE interface support and IP interface-to-VLAN binding - LAN-side VLAN with IP interface-to-VLAN binding - Inter-VLAN routing • Bridged VLANs - these VLANs are used to bridge traffic from LAN to WAN • Prioritization per VLAN and per port Ethernet Switching/Policy Setup Before you configure any VLANs, the unconfigured Gateway is set up as a router composed of a LAN switch, a WAN switch, and a router in the middle, with LAN and WAN IP interfaces co
An example of multiple VLANs, using a Motorola Netopia® Gateway with VGx managed switch technology, is shown below: A VLAN Model Combining Bridging and Routing To configure VLANs check the Enable checkbox. To create a VLAN select a list item from the main VLAN page and click the Edit button.
Administrator’s Handbook The VLAN Entry page appears. Check the Enable checkbox, and enter a descriptive name for the VLAN. You can create up to 16 VLANs, and you can also restrict any VLAN, and the computers on it, from administering the Gateway. • VLAN Name – A descriptive name for the VLAN. • Type – LAN or WAN Port(s) can be enabled on the VLAN. You can choose a type designation as follows: By-Port: indicates that the VLAN is port-based.
• VLAN ID – If you select Global as the VLAN Type, the VLAN ID field appears for you to enter a VID. This must be a unique identifying number between 1 and 4094. (A VID of zero (0) is permitted on the Ethernet WAN port only.) • Admin Restricted – If you want to prevent administrative access to the Gateway from this VLAN, check the checkbox. • 802.
Administrator’s Handbook Tag – Packets transmitted from this port through this VLAN must be tagged with the VLAN VID. Packets received through this port destined for this VLAN must be tagged with the VLAN VID by the source. The Tag option is only available on Global type ports. Priority – Use any 802.1p priority bits in the VLAN header to prioritize packets within the Gateway’s internal queues, according to DiffServ priority mapping rules. See “Differentiated Services” on page 92 for more information.
• When you select an IP interface, the screen expands to allow you to configure Inter-Vlan-Groups. Inter-VLAN groups allow VLANs in the group to route traffic to the others; ungrouped VLANs cannot route traffic to each other. • Click the Submit button. • When you are finished, click the Alert icon in the upper right-hand corner of the screen, and in the resulting screen, click the Save link.
Administrator’s Handbook You can Edit, Clear, Enable, or Disable your VLAN entries by returning to the VLANs page, and selecting the appropriate entry from the displayed list. • When you are finished, click the Alert icon in the upper right-hand corner of the screen, and in the resulting screen, click the Save and Restart link. To view the settings for each VLAN, select the desired VLAN from the list and click the Details button.
The screen expands to display the VLAN settings.
Administrator’s Handbook Example The following is a simple example of how you might configure some VLANs: You want to configure a 3347NWG-VGx Gateway with two SSIDs (see “Multiple SSIDs” on page 59 for more information) for two VLANs, allowing both access to the Internet. One SSID will be in the same VLAN as the four ports of the Ethernet Switch, so that those two networks can communicate. The second VLAN will be for the other SSID.
In this case, select all the physical Ethernet ports: eth0.1 through eth0.4, and wireless ssid1. Select ip-eth-a, the IP interface for the group. This will be Inter-Vlan-Group #1. Check the Group-1 checkbox. These ports will be able to communicate with each other. 5. 6. Click the Submit button. In the VLAN page, select VLAN #2 in the VLANs list, and click the Edit button. The VLAN Name must be given another unique name. For example, call it Network B.
Administrator’s Handbook 7. 8. Click the Submit button. In the Port Configuration for VLAN: 2 page, you add the Port Interfaces you want associated with the VLAN. Select the ip-eth-a port interface and check the ssid2 port interface. Make this VLAN a member of Inter-Vlan-Group Group-2. Click the Submit button. 10. Next, create a VLAN to provide the Inter-Vlan-Groups access to the Internet (WAN). 9. For example, call it WAN VLAN.
Check the vcc1 checkbox, select the ip-vcc1 IP interface, and check the Inter-Vlan-Group Group-1 and Group-2 checkboxes. Members of Groups 1 and 2 will now be able to communicate with the Internet (WAN), but not with each other. 11. Once you have finished with the configuration of the VLANs, click the Alert icon in the upper right hand corner. This will validate that the settings are legal for your network. 12. Click the Save and Restart link.
Administrator’s Handbook Link: VoIP (supported models only) Voice-over-IP (VoIP) refers to the ability to make voice telephone calls over the Internet. This differs from traditional phone calls that use the Public Switched Telephone Network (PSTN). VoIP calls use an Internet protocol, Session Initiation Protocol (SIP), to transmit sound over a network or the Internet in the form of data packets. Certain Motorola Netopia® Gateway models have two separate voice ports for connecting telephone handsets.
SIP Line Entry Registration Interval (in secs) Length of time the VoIP registration will be valid before it will be renewed. Default is 1 hour. Registrar Server Registration Server name or IP address. Registrar Port Registration Server port. Default is 5060. Proxy Server Proxy server name or IP address.
Administrator’s Handbook SIP Line Entry Proxy Port Proxy server port, if required. Default is 5060. Outbound Proxy Server Outbound Proxy server name or IP address, if required. Outbound Proxy Port Outbound Proxy server port, if required. Default is 5060. User Display Name Name of this phone’s user to be displayed on the Home page. Example: “Jacob Q. Smith” SIP User Name Registration user ID. Example: “jqsmith” SIP User Password Registration user password.
The Home page for a VoIP-enabled Gateway with both phone lines registered is shown below.
Administrator’s Handbook Link: System The System Name defaults to your Gateway's factory identifier combined with its serial number. Some cable-oriented Service Providers use the System Name as an important identification and support parameter. The System Name can be 1 – 255 characters long; it can include embedded spaces and special characters. The Log Message Level alters the severity at which messages are collected in the Gateway's system log.
Link: Syslog Parameters You can configure a UNIX-compatible syslog client to report a number of subsets of the events entered in the Gateway’s WAN Event History. Syslog sends log-messages to a host that you specify. To enable syslog logging, click on the Syslog Parameters link. Check the Syslog checkbox. The screen expands. • Syslog: Enable syslog logging in the system. • Syslog Host Name/IP Address: Enter the name or the IP Address of the host that should receive sys• • • • log messages.
Administrator’s Handbook Log Event Messages Administration Related Log Messages 1. administrative access attempted: This log-message is generated whenever the user attempts to access the router's management interface. 2. administrative access authenticated and allowed: This log-message is generated whenever the user attempts to access the router's management interface and is successfully authenticated and allowed access to the management interface. 3.
DSL Log Messages (most common): 5. PPP: Channel up Dialout Profile name: This log message is generated when a PPP channel comes up. 6. PPP- down: This log message is generated when a PPP channel goes down. The reason for the channel going down is displayed as well. Access-related Log Messages 1. permitted: This log-message is generated whenever a packet is allowed to traverse router-interfaces or allowed to access the router itself. 2.
Administrator’s Handbook Access-related Log Messages 128 13. dropped - reassembly timeout: This log-message is generated whenever packets, traversing the router or destined to the router itself, are dropped because of reassembly timeout. 14. dropped - illegal size: This log-message is generated whenever packets, traversing the router or destined to the router itself, are dropped during reassembly because of illegal packet size in a fragment.
Link: Internal Servers Your Gateway ships with an embedded Web server and support for a Telnet session, to allow ease of use for configuration and maintenance. The default ports of 80 for HTTP and 23 for Telnet may be reassigned. This is necessary if a pinhole is created to support applications using port 80 or 23. See “Pinholes” on page 82. for more information on Pinhole configuration.
Administrator’s Handbook Link: Software Hosting Software Hosting allows you to host internet applications when NAT is enabled. User(PC) specifies the machine on which the selected software is hosted. You can host different games and software on different PCs. To select the games or software that you want to host for a specific PC, highlight the name(s) in the box on the left side of the screen. Click the Add button to select the software that will be hosted.
List of Supported Games and Software Age of Empires, v.1.0 Age of Empires: The Rise of Rome, v.1.0 Age of Wonders Asheron's Call Baldur's Gate Battlefield Communicator Buddy Phone Calista IP Phone CART Precision Racing, v 1.0 Citrix Metaframe/ICA Client Close Combat for Windows 1.0 Close Combat: A Bridge Too Far, v 2.0 Close Combat III: The Russian Front, v 1.0 Combat Flight Sim: WWII Europe Series, v 1.0 Combat Flight Sim 2: WWII Pacific Thr, v 1.
Administrator’s Handbook Roger Wilco Rogue Spear ShoutCast Server SMTP SNMP SSH server StarCraft Starfleet Command StarLancer, v 1.0 Telnet TFTP Tiberian Sun: Command and Conquer Timbuktu Total Annihilation Ultima Online Unreal Tournament Server Urban Assault, v 1.
Link: Backup The purpose of Backup is to provide a recovery mechanism in the event that the primary connection fails. A failure can be either line loss, for example by central site switch failure or physical cable breakage, or loss of end-to-end connectivity. Detection of one of these failures causes the Gateway to switch from using the primary DSL WAN connection to an alternate gateway on the Ethernet LAN.
Administrator’s Handbook Once Backup is configured, a new field appears in the Home Page. If your DSL WAN link fails, you can switch to your Backup Gateway by clicking the Force Backup button. Automatic options If you select automatic as your Backup option, the screen expands to allow you to enter additional information. •Failure Timeout (minutes 1-10) – Enter the number of minutes you want the system to wait before the backup port becomes enabled in the event of primary line failure.
• From the pull-down menu, select the Interface Type to which you want to direct the backup connection. If you have defined multiple VCCs, you can choose a secondary one. Otherwise, to backup to an IP device on the LAN, choose IP Address. The screen expands to allow you to enter an IP address of your Backup Gateway. Click the Submit button; click the Alert icon, and in the resulting page, click the Save and Restart link. Once Backup is configured, a new field appears in the Home Page.
Administrator’s Handbook Link: Ethernet MAC Override (Only available on models with Ethernet WAN interfaces, such as the 338X-series or VDSL Gateways.) Your Gateway comes with its own MAC (Media Access Control) address, also called the Hardware Address, a 12 character number unique for each LAN-connected device. Your Service Provider, particularly cable service providers, may instruct you to override the default MAC address.
Link: Clear Options To restore the factory configuration of the Gateway, choose Clear Options. You may want to upload your configuration to a file before performing this function. You can do this using the upload command via the command-line interface. See the upload command on page 238. Clear Options does not clear feature keys or affect the software image. You must restart the Gateway for Clear Options to take effect.
Administrator’s Handbook Link: Time Zone When you click the Time Zone link, the Time Zone page appears. You can set your local time zone by selecting the number of hours your time zone is distant from Greenwich Mean Time (GMT +12 – -12) from the pull-down menu. This allows you to set the time zone for access controls and in general.
Security Button: Security The Security features are available by clicking on the Security toolbar button. Some items of this category do not appear when you log on as User.
Administrator’s Handbook Link: Passwords Access to your Gateway may be controlled through two optional user accounts, Admin and User. When you first power up your Gateway, you create a password for the Admin account. The User account does not exist by default. As the Admin, a password for the User account can be entered or existing passwords changed. Create and Change Passwords.
• It can have up to eight alphanumeric characters. • It is case-sensitive. 4. Enter your new password again in the Confirm Password field. You confirm the new password to verify that you entered it correctly the first time. 5. When you are finished, click the Submit button to store your modified configuration in the Motorola Netopia® unit’s memory. Password changes are automatically saved, and take effect immediately.
Administrator’s Handbook Link: Firewall Use a Motorola Netopia® Firewall BreakWater Basic Firewall. BreakWater delivers an easily selectable set of pre-configured firewall protection levels. For simple implementation these settings (comprised of three levels) are readily available through Motorola Netopia®’s embedded web server interface. BreakWater Basic Firewall’s three settings are: • ClearSailing ClearSailing, BreakWater's default setting, supports both inbound and outbound traffic.
4. Click on the radio button to select the protection level you want. Click Submit. Changing the BreakWater setting does not require a restart to take effect. This makes it easy to change the setting “on the fly,” as your needs change.
Administrator’s Handbook To protect LAN users and their network from these types of attacks, BreakWater offers three levels of increasing protection. The following tables indicate the state of ports associated with session types, both on the WAN side and the LAN side of the Gateway. This table shows how inbound traffic is treated. Inbound means the traffic is coming from the WAN into the WAN side of the Gateway.
☛ NOTE: The Gateway’s WAN DHCP client port in SilentRunning mode is enabled. This feature allows end users to continue using DHCP-served IP addresses from their Service Providers, while having no identifiable presence on the Internet.
Administrator’s Handbook Link: IPSec When you click on the IPSec link, the IPSec configuration screen appears. Your Gateway can support two mechanisms for IPSec tunnels: • IPSec PassThrough supports Virtual Private Network (VPN) clients running on LAN-connected computers. Normally, this feature is enabled. You can disable it if your LAN-side VPN client includes its own NAT interoperability option. Uncheck the Enable IPSec Passthrough checkbox.
SafeHarbour IPSec VPN SafeHarbour VPN IPSec Tunnel provides a single, encrypted tunnel to be terminated on the Gateway, making a secure tunnel available for all LAN- connected users. This implementation offers the following: • Eliminates the need for VPN client software on individual PCs. • Reduces the complexity of tunnel configuration. • Simplifies the ongoing maintenance for secure remote access.
Administrator’s Handbook Configuring a SafeHarbour VPN Use the following procedure to configure your SafeHarbour tunnel. 1. Obtain your configuration information from your network administrator. The tables “Parameter Descriptions” on page 151 describe the various parameters that may be required for your tunnel. Not all of them need to be changed from the defaults for every VPN tunnel. Consult with your network administrator. 2.
Table 1: IPSec Tunnel Details Parameter Setup Worksheet Parameter Name Peer Internal Network Peer Internal Netmask NAT Enable PAT Address Negotiation Method Local ID Type Local ID Address/Value Local ID Mask Remote ID Type Remote ID Address/Value Remote ID Mask Pre-Shared Key Type Pre-Shared Key DH Group PFS Enable SA Encrypt Type SA Hash Type Invalid SPI Recovery Soft MBytes Soft Seconds Hard MBytes Hard Seconds IPSec MTU Xauth Enable Xauth Username Xauth Password Motorola Netopia® Gateway Peer Gateway
Administrator’s Handbook 3. Be sure that you have SafeHarbour VPN enabled. SafeHarbour is a keyed feature. See “Install Key” on page 187. for information concerning installing Motorola Netopia® Software Feature Keys. 4. Check the Enable SafeHarbour IPSec checkbox. Checking this box will automatically display the SafeHarbour IPSec Tunnel Entry parameters. Enter the initial group of tunnel parameters. Refer to your Setup Worksheet and the “Parameter Descriptions” on page 151 as required. 5.
Parameter Descriptions The following tables describe SafeHarbour’s parameters that are used for an IPSec VPN tunnel configuration: Table 2: IPSec Configuration page parameters Field Description Name The Name parameter refers to the name of the configured tunnel. This is mainly used as an identifier for the administrator. The Name parameter is an ASCII value and is limited to 31 characters. The tunnel name does not need to match the peer gateway.
Administrator’s Handbook Table 3: IPSec Tunnel Details page parameters 152 Local ID Mask If Aggressive mode is selected as the Negotiation Method, and Subnet as the Local ID Type, this field appears. This is the local (Gateway-side) subnet mask. Remote ID Type If Aggressive mode is selected as the Negotiation Method, this option appears. Selection options are: IP Address, Subnet, Hostname, ASCII. Remote ID Address/Value If Aggressive mode is selected as the Negotiation Method, this field appears.
Table 3: IPSec Tunnel Details page parameters IPSec MTU Some ISPs require a setting of e.g. 1492 (or other value). The default 1500 is the most common and you usually don’t need to change this unless otherwise instructed. Accepted values are from 100 – 1500. This is the starting value that is used for the MTU when the IPSec tunnel is installed. It specifies the maximum IP packet length for the encapsulated AH or ESP packets sent by the router.
Administrator’s Handbook Link: Stateful Inspection All computer operating systems are vulnerable to attack from outside sources, typically at the operating system or Internet Protocol (IP) layers. Stateful Inspection firewalls intercept and analyze incoming data packets to determine whether they should be admitted to your private LAN, based on multiple criteria, or blocked. Stateful inspection improves security by tracking data packets over a period of time, examining incoming and outgoing packets.
• DoS Detect: If you check this checkbox, the Gateway will monitor packets for Denial of Service attacks. • Exposed Addresses: The hosts specified in Exposed Addresses will be allowed to receive inbound traffic even if there is no corresponding outbound traffic. This is active only if NAT is disabled on a WAN interface. • Stateful Inspection Options: Enable and configure stateful inspection on a WAN interface.
Administrator’s Handbook You can add more exposed addresses by clicking the Add more Exposed Addresses link. A list of previously configured exposed addresses appears. Click the Add button to add a new range of exposed addresses. You can edit a previously configured range by clicking the Edit button, or delete the entry entirely by clicking the Delete button. All configuration changes will trigger the Alert Icon. Click on the Alert icon.
Stateful Inspection Options Stateful Inspection Parameters are active on a WAN interface only if you enable them on your Gateway. • Stateful Inspection: To enable stateful inspection on this WAN interface, check the checkbox. • Default Mapping to Router: This is disabled by default. This option will allow the router to respond to traffic received on this interface, for example, ICMP Echo requests.
Administrator’s Handbook Firewall Tutorial General firewall terms ☛ Note: Breakwater Basic Firewall (see “BreakWater Basic Firewall” on page 142) does not make use of the packet filter support and can be used in addition to filtersets Filter rule: A filter set is comprised of individual filter rules. Filter set: A grouping of individual filter rules. Firewall: A component or set of components that restrict access between a protected network and the Internet, or between two networks.
UDP: User Datagram Protocol. Unlike TCP, UDP does not guarantee reliable, sequenced packet delivery. If data does not reach its destination, UDP does not retransmit the data. RFC 768 is the specification for UDP. There are many more ports defined in the Assigned Addresses RFC. The table that follows shows some of these port assignments.
Administrator’s Handbook Allow FTP access; Deny FTP access; Deny all other packets. and a packet goes through these rules destined for FTP, the packet would forward through the first filter rule (WWW), match the second rule (FTP), and the packet is allowed through. Even though the next rule is to deny all FTP traffic, the FTP packet will never make it to this rule. Implied rules With a given set of filter rules, there is an Implied rule that may or may not be shown to the user.
Filter basics In the source or destination IP address fields, the IP address that is entered must be the network address of the subnet. A host address can be entered, but the applied subnet mask must be 32 bits (255.255.255.255). Netopia Embedded Software Version 7.7.4 has the ability to compare source and destination TCP or UDP ports.
Administrator’s Handbook This incoming IP packet has a source IP address that matches the network address in the Source IP Address field in Netopia Embedded Software Version 7.7.4. This will not forward this packet. Example 2 Filter Rule: 200.1.1.0 (Source IP Network Address) 255.255.255.128 (Source IP Mask) Forward = No (What happens on match) Incoming packet has the source address of 200.1.1.184.
Link: Packet Filter When you click the Packet Filter link the Filter Sets screen appears. Security should be a high priority for anyone administering a network connected to the Internet. Using packet filters to control network communications can greatly improve your network’s security. The Packet Filter engine allows creation of a maximum of eight Filter Sets. Each Filter Set can consist of many rules. There can be a maximum of 32 filter rules in the system.
Administrator’s Handbook How filter sets work A filter set acts like a team of customs inspectors. Each filter is an inspector through which incoming and outgoing packages must pass. The inspectors work as a team, but each inspects every package individually. Each inspector has a specific task. One inspector’s task may be to examine the destination address of all outgoing packages.
How individual filters work As described above, a filter applies criteria to an IP packet and then takes one of three actions: • Forwards the packet to the local or remote network • Blocks (discards) the packet • Ignores the packet A filter forwards or blocks a packet only if it finds a match after applying its criteria. When no match occurs, the filter ignores the packet. A filtering rule The criteria are based on information contained in the packets.
Administrator’s Handbook By matching on a port number, a filter can be applied to selected TCP or UDP services, such as Telnet, FTP, and World Wide Web.
Putting the parts together When you display a filter set, its filters are displayed as rows in a table: The table’s columns correspond to each filter’s attributes: • • • • • • • #: The filter’s priority in the set. Filter number 1, with the highest priority, is first in the table. Fwd: Shows whether the filter forwards (Yes) a packet or discards (No) it when there’s a match. Src-IP: The packet source IP address to match. Src-Mask: The packet source subnet mask to match.
Administrator’s Handbook • The host 199.211.211.17 is the source of the Telnet packets you want to block, while the destination address is any IP address. How these IP addresses are masked determines what the final match will be, although the mask is not displayed in the table that displays the filter sets (you set it when you create the filter). In fact, since the mask for the destination IP address is 0.0.0.0, the address for Destination IP address could have been anything.
Filtering example #2 Suppose a filter is configured to block all incoming IP packets with the source IP address of 200.233.14.0, regardless of the type of connection or its destination. The filter would look like this: This filter blocks any packets coming from a remote network with the IP network address 200.233.14.0. The 0 at the end of the address signifies any host on the class C IP network 200.233.14.0. If, for example, the filter is applied to a packet with the source IP address 200.233.14.
Administrator’s Handbook An approach to using filters The ultimate goal of network security is to prevent unauthorized access to the network without compromising authorized access. Using filter sets is part of reaching that goal. Each filter set you design will be based on one of the following approaches: • That which is not expressly prohibited is permitted. • That which is not expressly permitted is prohibited.
Working with IP Filters and Filter Sets To work with filters and filter sets, begin by accessing the filter set pages. ☛ NOTE: Make sure you understand how filters work before attempting to use them. Read the section “Packet Filter” on page 163. The procedure for creating and maintaining filter sets is as follows: 1. Add a new filter set. See Adding a filter set, below. 2. Create the filters for the new filter set. See “Adding filters to a filter set” on page 172. 3.
Administrator’s Handbook will appear in the upper right corner of the web page. It will remain until all of your changes are entered and validated. You need not immediately restart the Gateway until your filter set is complete. See “Associating a Filter Set with an Interface” on page 176. Adding filters to a filter set There are two kinds of filters you can add to a filter set: input and output. Input filters check packets received from the Internet, destined for your network.
The Filter Set page appears. ☛ Note: There are two Add buttons in this page, one for input filters and one for output filters. In this section, you’ll learn how to add an input filter to a filter set. Adding an output filter works exactly the same way, providing you keep the different source and destination perspectives in mind.
Administrator’s Handbook 1. To add a filter, click the Add button under Input Rules. The Input Rule Entry page appears. 2. If you want the filter to forward packets that match its criteria to the destination IP address, check the Forward checkbox. If Forward is unchecked, packets matching the filter’s criteria will be discarded. 3. Enter the Source IP address this filter will match on. You can enter a subnet or a host address. 4. Enter the Source Mask for the source IP address.
11. When you are finished configuring the filter, click the Submit button to save the filter in the filter set. Viewing filters To display the table of input or output filters, select the Filter Set Name in the Filter Set page and click the Add or Edit button. The table of filters in the filtersets appears. Modifying filters To modify a filter, select a filter from the table and click the Edit button. The Rule Entry page appears.
Administrator’s Handbook Associating a Filter Set with an Interface Once you have created a filter set, you must associate it with an interface in order for it to be effective. Depending on its application, you can associate it with either the WAN (usually the Internet) interface or the LAN. To associate an filter set with the LAN, return to the Filter Sets page. Click the Ethernet 100BT link. The Ethernet 100BT page appears.
Policy-based Routing using Filtersets Netopia Embedded Software Version 7.7.4 offers the ability to route IP packets using criteria other than the destination IP address. This is called policy-based routing. You specify the routing criteria and routing information by using IP filtersets to determine the forwarding action of a particular filter. You specify a gateway IP address, and each packet matching the filter is routed according to that gateway address, rather than by means of the global routing table.
Administrator’s Handbook Example: You want packets with the TOS low latency bit to go through VC 2 (via gateway 127.0.0.3 – the Motorola Netopia® Gateway will use 127.0.0.x, where x is the WAN port + 1) instead of your normal gateway. You would set up the filter as shown here. ☛ NOTE: Default Forwarding Filter If you create one or more filters that have a matching action of forward, then action on a packet matching none of the filters is to block any traffic.
Link: Security Log Security Monitoring is a keyed feature. See page 187 for information concerning installing Motorola Netopia® Software Feature Keys. Security Monitoring detects security-related events, including common types of malicious attacks, and writes them to the security log file. Using the Security Monitoring Log You can view the Security Log at any time. Use the following steps: 1. 2. 3. 4. 5. Click the Security toolbar button. Click the Security Log link.
Administrator’s Handbook Your Netopia Gateway has detected and successfully blocked an event that could have compromised the security of your network. Please refer to your customer documentation for a description of the logged event.
When the Security Log contains no entries, this is the response: The security log is empty. Timestamp Background During bootup, to provide better log information and to support improved troubleshooting, a Motorola Netopia® Gateway acquires the National Institute of Standards and Technology (NIST) Universal Coordinated Time (UTC) reference signal, and then adjusts it for your local time zone.
Administrator’s Handbook Install Button: Install From the Install toolbar button you can Install new Operating System Software and Feature Keys as updates become available. On selected models, you can install a Secure Sockets Layer (SSL V3.0) certificate from a trusted Certification Authority (CA) for authentication purposes. If this feature is available on your Gateway, the Install Certificate link will appear in the Install page as shown. Otherwise, it will not appear.
Link: Install Software (This link is not available on the 3342/3352 models, since firmware updates must be upgraded via the USB host driver. 3342N/3352N models are upgradeable by this procedsure.) This page allows you to install an updated release of the Motorola Netopia® Firmware. Updating Your Gateway’s Motorola Netopia® Firmware Version. You install a new operating system image in your unit from the Install Operating System Software page.
Administrator’s Handbook When you download your firmware upgrade from the Motorola Netopia® website, be sure to download the latest User Guide PDF files. These are also posted on the Motorola Netopia® website in the Documentation Center. Confirm Motorola Netopia® Firmware Image Files The Motorola Netopia® firmware Image file is specific to the model and the product identification number. 1. 2. Confirm that you have received the appropriate Motorola Netopia® Firmware Image file.
When the image has been installed, a success message displays. 5. When the success message appears, click the Restart button and confirm the Restart when you are prompted. Your Motorola Netopia® Gateway restarts with its new image. Verify the Motorola Netopia® Firmware Release To verify that the Motorola Netopia® firmware image has loaded successfully, use the following steps: 1. Open a web connection to your Motorola Netopia® Gateway from the computer on your LAN and return to the Home page.
Administrator’s Handbook 2. Verify your Motorola Netopia® firmware release, as shown on the Home Page. This completes the upgrade process.
Link: Install Key You can obtain advanced product functionality by employing a software Feature Key. Software feature keys are specific to a Gateway's serial number. Once the feature key is installed and the Gateway is restarted, the new feature's functionality becomes enabled. Use Motorola Netopia® Software Feature Keys Motorola Netopia® Gateway users obtain advanced product functionality by installing a software feature key.
Administrator’s Handbook 4. Click the Install Key button. 5. Click the Restart toolbar button. The Confirmation screen appears.
6. Click the Restart the Gateway link to confirm. To check your installed features: 7. 8. Click the Install toolbar button. Click the list of features link. The System Status page appears with the information from the features link displayed below. You can check that the feature you just installed is enabled.
Administrator’s Handbook Link: Install Certificate Secure Sockets Layer (SSL) is a protocol for transmitting private information over the Internet. SSL uses two keys to encrypt data: a public key known to everyone and a private or secret key known only to the recipient of the message. Netopia Embedded Software Version 7.7.4 uses SSL certificates for TR-069 support. SSL certificates are issued by trusted Certification Authorities (CAs). The CA digitally signs each certificate.
The Install Certificate page appears. 2. 3. 4. Browse to the location where you have saved your certificate and select the file, or type the full path. Click the Install Certificate button. Restart your Gateway.
Administrator’s Handbook 192
CHAPTER 4 Basic Troubleshooting This section gives some simple suggestions for troubleshooting problems with your Gateway’s initial configuration. Before troubleshooting, make sure you have • read the Quickstart Guide; • plugged in all the necessary cables; and • set your PC’s TCP/IP controls to obtain an IP address automatically.
Administrator’s Handbook Status Indicator Lights The first step in troubleshooting is to check the status indicator lights (LEDs) in the order outlined below. Motorola Netopia® Gateway 2210 status indicator lights Power LED 194 Ethernet DSL Internet Action Power Green when power is on. Red if device malfunctions. Flashes Red when new embedded software is being installed. Ethernet Solid green when connected. Flash green when there is activity on the LAN. DSL Solid green when trained.
Motorola Netopia® Gateway 2240N/2241N status indicator lights Power LED Ethernet USB DSL Internet Action Power Green when power is on. Red if device malfunctions. Flashes Red when new embedded software is being installed. Ethernet Solid green when connected. Flash green when there is activity on the LAN. USB (Model 2241N only) Solid green when connected. Flash green when there is activity on the LAN. DSL Solid green when trained. Blinking green when no line is attached or when training.
Administrator’s Handbook Motorola Netopia® Gateway 2246N status indicator lights Power LED 196 Ethernet 1, 2, 3, 4 DSL Internet Action Power Green when power is on. Red if device malfunctions. Flashes Red when new embedded software is being installed. Ethernet 1, 2, 3, 4 Solid green when connected. Flash green when there is activity on the LAN. DSL Solid green when trained. Blinking green when no line is attached or when training. Internet Solid green when Broadband device is connected.
Motorola Netopia® Gateway 2247NWG status indicator lights Power LED Ethernet 1, 2, 3, 4 Wireless DSL Internet Action Power Green when power is on. Red if device malfunctions. Flashes Red when new embedded software is being installed. Ethernet 1, 2, 3, 4 Solid green when connected. Flash green when there is activity on the LAN. Wireless Flashes green when there is activity on the wireless LAN. Off if driver fails to initialize, or if wireless is disabled. DSL Solid green when trained.
Administrator’s Handbook Motorola Netopia® Gateway 3340(N), 3341(N), 3351(N) status indicator lights Ethernet Link Ethernet Traffic DSL Traffic DSL Sync USB Active Power LED Ethernet Link Ethernet Traffic Solid green when connected. Flashes green when there is activity on the LAN. DSL Traffic Blinks green when traffic is sent/received over the WAN. DSL Sync Blinking green with no line attached or training, solid green when trained with the DSL line.
Motorola Netopia® Gateway 3342/3342N, 3352/3352N status indicator lights USB: Solid green when USB is connected otherwise, not lit DSL: Blinking green with no line attached or training, solid green when trained with the DSL line. ☛ Special patterns: • Both LEDs are off during boot (power on boot or warm reboot). • When the 3342/3352 successfully boots up, both LEDs flash green once. • Both LEDs are off when the Host OS suspends the device, (e.g.
Administrator’s Handbook Motorola Netopia® Gateway 3346(N), 3356(N) status indicator lights LAN 1, 2, 3, 4 DSL Sync Power LED Power DSL Sync LAN 1, 2, 3, 4 200 Action Green when power is on. Red if device malfunctions. Flashes Red when new embedded software is being installed. Blinking green with no line attached or training, solid green when trained with the DSL line. Solid green when connected; Flash green when there is activity on the LAN.
Motorola Netopia® Gateway 3347W, 3347(N)WG status indicator lights Wireless Link LAN 1, 2, 3, 4 DSL Sync Power LED Power DSL Sync Ethernet 1, 2, 3, 4 Wireless Link Action Green when power is on. Red if device malfunctions. Flashes Red when new embedded software is being installed. Solid green when trained. Blinking green when no line is attached or when training. Flashes green for DSL traffic. Solid green when connected. Flash green when there is activity on the LAN.
Administrator’s Handbook Motorola Netopia® Gateway MiAVo status indicator lights Wireless Ethernet 1, 2, 3, 4 DSL Power LED Power DSL (DSL 1 & 2: ADSL2+ models only) Ethernet 1, 2, 3, 4 Wireless 202 Action Green when power is on. Red if device malfunctions. Flashes Red when new embedded software is being installed. Solid green when trained. Blinking green when no line is attached or when training. Flashes green for DSL traffic. Solid green when connected. Flash green when there is activity on the LAN.
Motorola Netopia® Gateway 7346/56-series MiAVo status indicator lights Power LED Ethernet 1, 2, 3, 4 DSL Action Power Green when power is on. Red if device malfunctions. Flashes Red when new embedded software is being installed. Ethernet 1, 2, 3, 4 Solid green when connected. Flash green when there is activity on the LAN. DSL Solid green when trained. Blinking green when no line is attached or when training. Flashes green for DSL traffic.
Administrator’s Handbook LED Function Summary Matrix Unlit Power USB Active DSL Sync DSL Traffic Ethernet Traffic Ethernet Link Flashing Green Solid Red Flashing Red No power Power on N/A System failure Installing new embedded software No signal USB port connected to PC Activity on the USB cable N/A N/A No signal DSL line synched with the DSLAM Attempting to train with DSLAM N/A N/A No signal N/A Activity on the DSL cable N/A N/A No signal N/A Activity on the Ethernet port N/A N/
1. Make sure you have Ethernet drivers installed on the PC. 2. Make sure the PC’s TCP/IP Properties for the Ethernet Network Control Panel is set to EN Traffic Unlit USB Active Unlit DSL Traffic Unlit Wireless Link obtain an IP address via DHCP. 3. Make sure the PC has obtained an address in the 192.168.1.x range. (You may have changed the subnet addressing.) 4. Make sure the PC is configured to access the Internet over a LAN. 5.
Administrator’s Handbook Factory Reset Switch (not supported on some models; 3342/3342N/3352/3352N models do not have a reset switch) Lose your password? This section shows how to reset the Motorola Netopia® Gateway so that you can access the configuration screens once again. ☛ NOTE: Keep in mind that all of your settings will need to be reconfigured. If you don't have a password, the only way to access the Motorola Netopia® Gateway is the following: 1.
CHAPTER 5 Advanced Troubleshooting Advanced Troubleshooting can be accessed from the Gateway’s Web UI. Point your browser to http://192.168.1.254. The main page displays the device status. (If this does not make the Web UI appear, then do a release and renew in Windows networking to see what the Gateway address really is.
Administrator’s Handbook Home Page The home page displays basic information about the Gateway. This includes the ISP Username, Connection Status, Device Address, Remote Gateway Address, DNS-1, and DNS-2. If you are not able to connect to the Internet, verify the following: Item Description Local WAN IP Address This is the negotiated address of the Gateway’s WAN interface. This address is usually dynamically assigned.
Item Description Device Gateway This is the negotiated address of the remote router. Make sure this is a valid address. If this is not the correct address, go to Expert Mode and verify the address has not been manually assigned. Primary DNS/ Secondary DNS These are the negotiated DNS addresses. Make sure they are valid DNS addresses. (Secondary DNS is optional, and may validly be blank (0.0.0.0).
Administrator’s Handbook Button: Troubleshoot Expert Mode Expert Mode has advanced troubleshooting tools that are used to pinpoint the exact source of a problem. Clicking the Troubleshoot tab displays a page with links to System Status, Network Tools, and Diagnostics. • System Status: Displays an overall view of the system and its condition. • Network Tools: Includes NSLookup, Ping and TraceRoute.
Link: System Status In the system status screen, there are several utilities that are useful for troubleshooting. Some examples are given in the following pages.
Administrator’s Handbook Link: Ports: Ethernet The Ethernet port selection shows the traffic sent and received on the Ethernet interface. There should be frames and bytes on both the upstream and downstream sides. If there are not, this could indicate a bad Ethernet cable or no Ethernet connection.
Link: Ports: DSL The DSL port selection shows the state of the DSL line, whether it is up or down and how many times the Gateway attempted to train. The state should indicate ‘up’ for a working configuration. If it is not, check the DSL cable and make sure it is plugged in correctly and not connected to a micro filter.
Administrator’s Handbook Link: IP: Interfaces The IP interfaces selection shows the state and configuration information for your IP LAN and WAN interfaces. Below is an example: IP interfaces: Ethernet 100BT: ( up broadcast default rip-send v1 rip-receive v1 ) inet 192.168.1.1 netmask 255.255.255.0 broadcast 192.168.1.255 physical address 00-16-cb-39-a9-78 mtu 1500 PPP over Ethernet vcc1: ( up address-mapping broadcast default admin-disabled rip-send v1 rip-receive v1 ) inet 10.1.2.34 netmask 255.255.255.
Link: DSL: Circuit Configuration The DSL Circuit Configuration screen shows the traffic sent and received over the DSL line as well as the trained rate (upstream and downstream) and the VPI/VCI. Verify traffic is being sent over the DSL line. If not, check the cabling and make sure the Gateway is not connected to a micro filter. Also verify the correct PVC is listed, which should be 0/35 (some providers use other values, such as 8/35. Check with your provider).
Administrator’s Handbook Link: System Log: Entire The system log shows the state of the WAN connection as well as the PPPoE session. Verify that the PPPoE session has been correctly established and there are no failures. If there are error messages, go to the WAN configuration and verify the settings.
Link: Diagnostics The diagnostics section tests a number of different things at the same time, including the DSL line, the Ethernet interface and the PPPoE session.
Administrator’s Handbook Link: Network Tools Three test tools are available from this page. • NSLookup - converts a domain name to its IP address and vice versa. • Ping - tests the “reachability” of a particular network destination by sending an ICMP echo request and waiting for a reply. • TraceRoute - displays the path to a destination by showing the number of hops and the router addresses of these hops. 1.
ping www.grosso.com Pinging 192.150.14.120 from local address 143.137.199.8 (timer gran. 100 ms)... Ping size: 100 Ping count: 5 ICMP echo reply from 192.150.14.120, 200 ms ICMP echo reply from 192.150.14.120, 100 ms No ping response. ICMP echo reply from 192.150.14.120, 100 ms ICMP echo reply from 192.150.14.120, 100 ms --- 192.150.14.120 ping statistics --5 packets transmitted, 4 packets received, 20% packet loss Result: The host was reachable with four out of five packets sent.
Administrator’s Handbook Below are some specific tests: Action If PING is not successful, possible causes are: From the Gateway's Network Tools page: Ping the internet default gateway IP address DSL is down, DSL or ATM settings are incorrect; Gateway’s IP address or subnet mask are wrong; gateway router is down. Ping an internet site by IP address Gateway’s default gateway is incorrect, Gateway’s subnet mask is incorrect, site is down.
Example: Show the path to the grosso.com site. traceroute www.grosso.com Traceroute to 192.150.14.120 from address 143.137.199.8 (timer gran. 100 ms)... 30 hops max, 56 byte packets 1 143.137.199.254 100 ms 100 ms 0 ms 2 143.137.50.254 100 ms 0 ms 0 ms 3 143.137.137.254 100 ms 0 ms 100 ms 4 141.154.96.161 0 ms 0 ms 100 ms 5 141.154.8.13 0 ms 100 ms 0 ms 6 4.24.92.97 0 ms 100 ms 0 ms 7 4.24.4.225 100 ms 0 ms 100 ms 8 4.24.7.121 0 ms 0 ms 100 ms 9 4.24.7.113 0 ms 100 ms 0 ms 10 4.24.6.
Administrator’s Handbook 222
CHAPTER 6 Command Line Interface The Motorola Netopia® Gateway operating software includes a command line interface (CLI) that lets you access your Motorola Netopia® Gateway over a telnet connection. You can use the command line interface to enter and update the unit’s configuration settings, monitor its performance, and restart it.
Administrator’s Handbook Overview The CLI has two major command modes: SHELL and CONFIG. Summary tables that list the commands are provided below. Details of the entire command set follow in this section.
CONFIG Commands Command Verbs delete help save script set validate view Status and/or Description Delete configuration list data Help command option Save configuration data Print configuration data Set configuration data Validate configuration settings View configuration data Keywords ata atm backup bridge dhcp dmt diffserv dns dslf-cpewan dslf-lanmgnt dynamic-dns ethernet ethernet-MAC-override igmp ip ip-maps nat-default pinhole ppp wan-over-ether preferences queue radius security servers snmp system upnp vdsl
Administrator’s Handbook Starting and Ending a CLI Session Open a telnet connection from a workstation on your network. You initiate a telnet connection by issuing the following command from an IP host that supports telnet, for example, a personal computer running a telnet application such as NCSA Telnet. telnet You must know the IP address of the Motorola Netopia® Gateway before you can make a telnet connection to it. By default, your Motorola Netopia® Gateway uses 192.168.1.
About SHELL Commands You begin in SHELL mode when you start a CLI session. SHELL mode lets you perform the following tasks with your Motorola Netopia® Gateway: • Monitor its performance • Display and reset Gateway statistics • Issue administrative commands to restart Motorola Netopia® Gateway functions SHELL Prompt When you are in SHELL mode, the CLI prompt is the name of the Motorola Netopia® Gateway followed by a right angle bracket (>).
Administrator’s Handbook SHELL Commands Common Commands arp nnn.nnn.nnn.nnn Sends an Address Resolution Protocol (ARP) request to match the nnn.nnn.nnn.nnn IP address to an Ethernet hardware address. clear [yes] Clears the configuration settings in a Motorola Netopia® Gateway. If you do not use the optional yes qualifier, you are prompted to confirm the clear command. clear_certificate Removes an SSL certificate that has been installed.
You can include one or more of the following arguments with the download command. If you omit arguments, the console prompts you for this information. • The server_address argument identifies the IP address of the TFTP server from which you want to copy the Motorola Netopia® Gateway configuration file. • The filename argument identifies the path and name of the configuration file on the TFTP server. • If you include the optional confirm keyword, the download begins as soon as all information is entered.
Administrator’s Handbook • 1 or low – Low-level informational messages or greater; includes trivial status messages. • 2 or medium – Medium-level informational messages or greater; includes status messages that can help monitor network traffic. • 3 or high – High-level informational messages or greater; includes status messages that may be significant but do not constitute errors. • 4 or warning – Warnings or greater; includes recoverable error conditions and useful operator information.
reset arp Clears the Address Resolution Protocol (ARP) cache on your unit. reset atm Resets the Asynchronous Transfer Mode (ATM) statistics. reset cdmode This command will set up one boot flag so that the next time a 3342N/3352N restarts or reboots (power cycle), the Gateway will boot into CD-ROM mode instead of Gateway mode. This command is only for the 3342N/3352N. If the Gateway is not a 3342N/3352N this command does nothing but returns the message: "CD mode is not supported on this platform.
Administrator’s Handbook reset security-log Clears the security monitoring log to make room to capture new entries. reset wan-users [all | ip-address] This function disconnects the specified WAN User to allow for other users to access the WAN. This function is only available if the number of WAN Users is restricted and NAT is on. Use the all parameter to disconnect all users. If you logon as Admin you can disconnect any or all users. If you logon as User, you can only disconnect yourself.
show crash Displays the most recent crash information, if any, for your Motorola Netopia® Gateway. show dhcp agent Displays DHCP relay-agent leases. show dhcp server leases Displays the DHCP leases stored in RAM by your Motorola Netopia® Gateway. show diffserv Displays the Differentiated Services and QoS values configured in the Motorola Netopia® Gateway. show dslf device-association Displays LAN devices that conform with the TR111 Gateway requirement.
Administrator’s Handbook 10/100 Ethernet 3 Port Status: Link up Duplex: Full-duplex not Speed: 100BASE-X Transmit OK : Transmit unicastpkts : Receive OK : Receive unicastpkts : Tx Octets : Rx Octets : active 3309 31 5588 1976 31 1976 10/100 Ethernet 4 Port Status: Link down Transmit OK : Transmit unicastpkts : Receive OK : Receive unicastpkts : Tx Octets : Rx Octets : 0 0 0 0 0 0 show etheroam ah Displays OAM internal information, such as OAM mode, state, configurations, events and OAM statistics.
show ip firewall Displays firewall statistics. show ip lan-discovery Displays the LAN Host Discovery Table of hosts on the wired or wireless LAN, and whether or not they are currently online. show ip routes Displays the IP routes stored in your Motorola Netopia® Gateway. show ip state-insp Displays whether stateful inspection is enabled on an interface or not, exposed addresses and blocked packet statistics because of stateful inspection. show ipmap Displays IPMap table (NAT).
Administrator’s Handbook show status Displays the current status of a Motorola Netopia® Gateway, the device's hardware and software revision levels, a summary of errors encountered, and the length of time the Motorola Netopia® Gateway has been running since it was last restarted. Identical to the status command. show summary Displays a summary of WAN, LAN, and Gateway information. show vlan Displays detail of VLAN status and statistics.
SumPort : 00000000-00000000 ==== segment 8 port masks ==== PortPort : 00000000-00000000 GlobalPort : 00000000-00000000 SumPort : 00000000-00000000 ==== segment 9 port masks ==== PortPort : 00000000-00000000 GlobalPort : 00000000-00000000 SumPort : 00000000-00000000 ==== segment 10 port masks ==== PortPort : 00000000-00000000 GlobalPort : 00000000-00000000 SumPort : 00000000-00000000 ==== vlan active segment ==== Type : 1 Index : 1 Vid : 1 PortMask : 00001006-00000001 SwitchMask : 00000004 WirelessMask : 000
Administrator’s Handbook ==== vlan namePtr portType portIndex ifId ==== vlan namePtr portType portIndex ifId ==== vlan namePtr portType portIndex ifId active link ==== : ethernet0/1 : 3 : 3 : 91 active link ==== : ethernet0/2 : 3 : 4 : 92 active link ==== : ethernet0/3 : 3 : 5 : 93 show wireless [all] Shows wireless status and statistics. show wireless clients [ MAC_address ] Displays details on connected clients, or more details on a particular client if the MAC address is added as an argument.
who Displays the names of the current shell and PPP users. WAN Commands atmping vccn [ segment | end-to-end ] Lets you check the ATM connection reachability and network connectivity. This command sends five Operations, Administration, and Maintenance (OAM) loopback calls to the specified vpi/vci destination. There is a five second total timeout interval. Use the segment argument to ping a neighbor switch. Use the end-to-end argument to ping a remote end node.
Administrator’s Handbook show ppp [{ stats | lcp | ipcp }] Displays information about open PPP links. You can display a subset of the PPP statistics by including an optional stats, lcp, or ipcp argument for the show ppp command. start ppp vccn Opens a PPP link on the specified virtual circuit. About CONFIG Commands You reach the configuration mode of the command line interface by typing configure (or any truncation of configure, such as con or config) at the CLI SHELL prompt.
• Jumping to the top node — You can jump to the top level from anywhere in the CONFIG hierarchy by entering the top command. • Moving from one subnode to another — You can move from one subnode to another by entering a partial path that identifies how far back to climb. • Moving from any subnode to any other subnode — You can move from any subnode to any other subnode by entering a partial path that starts with a top-level CONFIG command.
Administrator’s Handbook Displaying Current Gateway Settings You can use the view command to display the current CONFIG settings for your Motorola Netopia® Gateway. If you enter the view command at the top level of the CONFIG hierarchy, the CLI displays the settings for all enabled functions. If you enter the view command at an intermediate node, you see settings for that node and its subnodes.
CONFIG Commands This section describes the keywords and arguments for the various CONFIG commands. Remote ATA Configuration Commands Motorola Netopia® firmware supports configuration of a maximum of four Motorola Netopia® ATA profiles, which are stored in the Gateway’s configuration database. When a Motorola Netopia® ATA is discovered, the Gateway compares the MAC address of the ATA with one of the existing profiles stored in the database.
Administrator’s Handbook set ata profile [ 0... 3 ] ata-static-wan-gateway ip_addr Specifies a static gateway WAN IP address for the specified profile. set ata profile [ 0... 3 ] ata-proxy-server ip_addr Specifies a SIP proxy server hostname or IP address for the specified profile. set ata profile [ 0... 3 ] ata-proxy-port port Specifies a SIP proxy server port, typically 5060, for the specified profile. set ata profile [ 0...
DSL Commands ATM Settings. You can use the CLI to set up each ATM virtual circuit. set atm option {on | off } Enables the WAN interface of the Motorola Netopia® Gateway to be configured using the Asynchronous Transfer Mode (ATM) protocol. set atm [vcc n] option {on | off } Selects the virtual circuit for which further parameters are set. Up to eight VCCs are supported; the maximum number is dependent on your Motorola Netopia® Operating System tier and the capabilities that your Service Provider offers.
Administrator’s Handbook set atm [vcc n] vpi { 0 ... 255 } Select the virtual path identifier (vpi) for VCC n. Your Service Provider will indicate the required vpi number. set atm [vcc n] vci { 0 ... 65535 } Select the virtual channel identifier (vci) for VCC n. Your Service Provider will indicate the required vci number. set atm [vccn] encap { ppp-vcmux | ppp-llc | ether-llc | ip-llc | ppoe-vcmux | pppoe-llc } Select the encapsulation mode for VCC n.
Common Commands set bridge sys-bridge {on | off } Enables or disables bridging services in the Motorola Netopia® Gateway. You must enable bridging services within the Motorola Netopia® Gateway before you can enable bridging for a specific interface. set bridge concurrent-bridging-routing {on | off } Enables or disables Concurrent Bridging/Routing. set bridge dhcp-filterset "string" Assigns a filterset named string to the bridge configuration.
Administrator’s Handbook DHCP Settings As a Dynamic Host Control Protocol (DHCP) server, your Motorola Netopia® Gateway can assign IP addresses and provide configuration information to other devices on your network dynamically. A device that acquires its IP address and other TCP/IP configuration settings from the Motorola Netopia® Gateway can use the information for a fixed period of time (called the DHCP lease).
set dhcp range [ 2... 8 ] start-address ip_address Specifies the starting IP address of DHCP range n when subnet n option is on. See “Additional subnets” on page 262. set dhcp range [ 2... 8 ] end-address ip_address Specifies the ending IP address of DHCP range n when subnet n option is on. See “Additional subnets” on page 262. set dhcp reserved ip-address x.x.x.x mac-address y-y-y-y-y-y If you selected server, reserves the specified IP address from the DHCP pool to the specified MAC address.
Administrator’s Handbook 250 Option Data Format Data Size (bytes) Can Configure 23 Unsigned 1 byte integer 1 Yes 24 Unsigned 4 byte integer 4 Yes 25 Unsigned 2 byte integer list Multiples of 2 Yes 26 Unsigned 2 byte integer 2 Yes 27 Flag 1 Yes 28 IP address 4 Yes 29 - 31 Flag 1 Yes 32 IP address 4 Yes 33 IP address and mask list Multiples of 8 Yes 34 Flag 1 Yes 35 Unsigned 4 byte integer 4 Yes 36 Flag 1 Yes 37 Unsigned 1 byte integer 1 Yes 38 Unsign
Data Size (bytes) Can Configure Option Data Format 77 Pascal string list (length byte + data) N Yes 78 - 79 Complex N No 80 Empty 0 No 81 Complex N No 82 Sub-option list N Yes 83 Complex N No 84 Undefined ?? Yes 85 IP address list Multiples of 4 Yes 86 - 87 Unicode String Multiples of 2 Yes 88 Encoded DN list N Yes 89 IP address list Multiples of 4 Yes 90 Complex N No 91 - 97 Undefined/Weakly defined ?? Yes 98 String (up to 100 characters) N Yes 99
Administrator’s Handbook DHCP Option Filtering Beginning with Firmware Version 7.7, support for DHCP option filtering is provided via the filterset settings. set dhcp filterset name "string" rule n type [ dhcp-option | hw-address | requested-option ] Specifies a DHCP filterset named string as one of three possible types: The rule can either specify an option and option contents, dhcp-option; a client hardware address range, hw-address; or an option the client is requesting, requested-option.
set dhcp filterset name "string" rule n match-pool ip_address Specifies the start IP address of the range within a DHCP pool where that range will be used to allocate an address if the wildcard matches. The value 0.0.0.0 means regular processing; 255.255.255.255 means discard. set dhcp filterset name "string" rule n absent-pool ip_address Specifies the start IP address of the range within a DHCP pool where that range will be used to allocate an address if the option in the DHCP packet is not present.
Administrator’s Handbook DMT Settings DSL Commands set dmt dsl-annex-support [ off | on ] This controls whether other annex support (just as Annex M) is enabled. Default is off. set dmt type [ lite | dmt | ansi | multi | adsl2 | adsl2+ | readsl2 | adsl2anxm | adsl2+anxm ] Selects the type of Discrete Multitone (DMT) asynchronous digital subscriber line (ADSL) protocol to use for the WAN interface.
Domain Name System Settings Domain Name System (DNS) is an information service for TCP/IP networks that uses a hierarchical naming system to identify network domains and the hosts associated with them. You can identify a primary DNS server and one secondary server. Common Commands set dns domain-name domain-name Specifies the default domain name for your network.
Administrator’s Handbook Dynamic DNS Settings Dynamic DNS support allows you to use the free services of www.dyndns.org. Dynamic DNS automatically directs any public Internet request for your computer's name to your current dynamically-assigned IP address. This allows you to get to the IP address assigned to your Gateway, even though your actual IP address may change as a result of a PPPoE connection to the Internet. set dynamic-dns option [ off | dyndns.org ] set dynamic-dns ddns-host-name myhostname.
IGMP Settings NOTE: IGMP Version 3 is supported beginning with Firmware Version 7.7. See “IGMP (Internet Group Management Protocol)” on page 100 for detailed explanation. You can set the following options: • IGMP Snooping – enables the Motorola Netopia® Gateway to “listen in” to IGMP traffic. The Gateway • • • • • discovers multicast group membership for the purpose of restricting multicast transmissions to only those ports which have requested them.
Administrator’s Handbook determines that only a single wireless client is interested in the stream, it will once again unicast the stream. set igmp snooping [ off | on ] Enables IGMP Snooping. set igmp robustness value Sets IGMP robustness range: from 2 – 255. The default is 2. set igmp query-intvl value Sets the query-interval range: from 10 seconds – 600 seconds, The default is 125 seconds.
set igmp wireless-m2u [ on | off ] This command allows you enable or disable wireless multicast-to-unicast if igmp snooping is set to on. set igmp log-enable [ on | off ] If set to on, all IGMP messages on both the LAN and the WAN will be logged. Default is off. IP Settings You can use the command line interface to specify whether TCP/IP is enabled, identify a default Gateway, and to enter TCP/IP settings for the Motorola Netopia® Gateway LAN and WAN ports.
Administrator’s Handbook set ip dsl vccn netmask netmask Specifies the subnet mask for the TCP/IP network connected to the virtual circuit. The subnet mask specifies which bits of the 32-bit binary IP address represents network information. The default subnet mask for most networks is 255.255.255.0 (Class C subnet mask). set ip dsl vccn restrictions { admin-disabled | none } Specifies restrictions on the types of traffic the Motorola Netopia® Gateway accepts over the DSL virtual circuit.
set ip dsl vccn rip-send { off | v1 | v2 | v1-compat | v2-MD5 } Specifies whether the Motorola Netopia® Gateway should use Routing Information Protocol (RIP) broadcasts to advertise its routing tables to other routers. RIP Version 2 (RIP-2) is an extension of the original Routing Information Protocol (RIP-1) that expands the amount of useful information in the RIP packets.
Administrator’s Handbook set ip ethernet A netmask netmask Specifies the subnet mask for the local Ethernet interface. The subnet mask specifies which bits of the 32bit binary IP address represent network information. The default subnet mask for most networks is 255.255.255.0 (Class C subnet mask).
set ip ethernet A subnet n address ip_address Specifies an IP address for the subnet n, when subnet n option is on. set ip ethernet A subnet n netmask netmask Specifies the subnet mask for the subnet n, when subnet n option is on. Default IP Gateway Settings set ip gateway option { on | off } Specifies whether the Motorola Netopia® Gateway should send packets to a default Gateway if it does not know how to reach the destination host.
Administrator’s Handbook set ip ip-ppp [vccn] peer-address ip_address Specifies the IP address of the peer on the other end of the PPP link. If you specify an IP address other than 0.0.0.0, your Motorola Netopia® Gateway will not negotiate the remote peer's IP address. If the remote peer does not accept the address in the ip_address argument as its IP address (typically because it has been configured with another IP address), the link will not come up. The default value for the ip_address argument is 0.0.
set ip ip-ppp [vccn] rip-receive { off | v1 | v2 | v1-compat | v2-MD5 } Specifies whether the Motorola Netopia® Gateway should use Routing Information Protocol (RIP) broadcasts to update its routing tables with information received from other routers on the other side of the PPP link. If you specify v2-MD5, you must also specify a rip-receive-key. Keys are ASCII strings with a maximum of 31 characters, and must match the other router(s) keys for proper operation of MD5 support.
Administrator’s Handbook Static ARP Settings Your Motorola Netopia® Gateway maintains a dynamic Address Resolution Protocol (ARP) table to map IP addresses to Ethernet (MAC) addresses. Your Motorola Netopia® Gateway populates this ARP table dynamically, by retrieving IP address/MAC address pairs only when it needs them. Optionally, you can define static ARP entries to map IP addresses to their corresponding Ethernet MAC addresses. Unlike dynamic ARP table entries, static ARP table entries do not time out.
Differentiated Services (DiffServ) set diffserv option [ off | on ] Turns the DiffServ option off (default) or on. on enables the service and IP TOS bits are used, even if no flows are defined. Consequently, if the end-point nodes provide TOS settings from an application that can be interpreted as one of the supported states, the Gateway will handle it as if it actively marked the TOS field itself. ☛ NOTE: The Gateway itself will not override TOS bit settings made by the endpoints.
Administrator’s Handbook set diffserv custom-flows name name protocol [ TCP | UDP | ICMP | other ] direction [ outbound | inbound | both ] start-port [ 0 - 65535 ] end-port [ 0 - 65535 ] inside-ip inside-ip-addr inside-ip-mask inside-ip-netmask outside-ip outside-ip-addr outside-ip-mask outside-ip-netmask qos [ off | assure | expedite | network-control ] Defines or edits a custom flow. Select a name for the custom-flow from the set command.
Packet Mapping Configuration set diffserv qos [ network-control-queue | expedite-queue | assured-queue | best-effort-queue ] queue_name Specifies the Diffserv QoS queue mapping associations. • queue_name - the basic queue name to which classified packets are directed.
Administrator’s Handbook set set set set set set set set set set set set 270 diffserv diffserv diffserv diffserv diffserv diffserv diffserv diffserv diffserv diffserv diffserv diffserv qos qos qos qos qos qos qos qos qos qos qos qos dscp-map-20 dscp-map-21 dscp-map-22 dscp-map-23 dscp-map-24 dscp-map-25 dscp-map-26 dscp-map-27 dscp-map-28 dscp-map-29 dscp-map-30 dscp-map-31 best-effort best-effort best-effort expedite network-control network-control network-control network-control network-control netw
Queue Configuration Beginning with Firmware Version 7.7.4, the queuing characteristics of all “N” and “-02” model Gateway’s WAN interface can now be configured for: • strict priority queuing (as currently) • weighted fair queuing • rate-limiting funnel ☛ Note: The configuration mechanism is designed to be flexible enough to accommodate complex queuing requirements. Configurations not supported by the Gateway will be flagged during configuration verification.
Administrator’s Handbook set queue name queue_name option [ on | off ] type [ basic | wfq | priority | funnel ] Creates a queue named queue_name and assigns a type: • • • • basic – Basic Queue wfq – Weighted Fair Queue priority – Priority Queue funnel – Funnel Queue Basic Queue set queue name basic_queue_name option [ on | off ] set queue name basic_queue_name type basic Specifies the Basic Queue named basic_queue_name attributes. Basic queues have one input and one output.
Weighted Fair Queue set queue name wfq option [ on | off ] set queue name wf_queue_name type wfq set queue name wf_queue_name weight-type [ relative | bps ] set queue name wf_queue_name entry n input input_queue_name set queue name wf_queue_name entry n weight weight set queue name wf_queue_name entry n share-bw [ on | off ] set queue name wf_queue_name entry n default-input queue_name Specifies the attributes of the Weighted Fair Queue named wf_queue_name.
Administrator’s Handbook Priority Queue set queue name priority_queue_name option [ off | on ] set queue name priority_queue_name type priority set queue name priority_queue_name default-input queue_name A priority queue can contain up to 8 input queues. For each input queue, the following is configured: set queue name priority_queue_name entry n input input_queue_name set queue name priority_queue_name entry n priority priority_value Specifies the Priority Queue named priority_queue_name attributes.
Funnel Queue A funnel queue is used to limit the rate of the transmission below the actual line rate: set queue name funnel_queue_name option [ on | off ] set queue name funnel_queue_name type funnel set queue name funnel_queue_name input input_queue_name set queue name funnel_queue_name bps bps Specifies the Funnel Queue named funnel_queue_name attributes.
Administrator’s Handbook SIP Passthrough set ip sip-passthrough [ on | off ] Turns Session Initiation Protocol application layer gateway client passthrough on or off. The default is on. Session Initiation Protocol, is a signaling protocol for Internet conferencing, telephony, presence, events notification and instant messaging. RTSP Passthrough set ip ethernet B rtsp-passthrough [ off | on ] Turns Real Time Streaming Protocol application layer gateway client passthrough on or off.
set ip static-routes destination-network net_address interface { ip-address | ppp-vccn } Specifies the interface through which the static route is accessible. set ip static-routes destination-network net_address gateway-address gate_address Specifies the IP address of the Gateway for the static route. The default Gateway must be located on a network connected to the Motorola Netopia® Gateway configured interface.
Administrator’s Handbook Network Address Translation (NAT) Default Settings NAT default settings let you specify whether you want your Motorola Netopia® Gateway to forward NAT traffic to a default server when it doesn’t know what else to do with it. The NAT default host function is useful in situations where you cannot create a specific NAT pinhole for a traffic stream because you cannot anticipate what port number an application might use.
set pinhole name name protocol-select { tcp | udp } Specifies the type of protocol being redirected. set pinhole name name external-port-start [ 0 - 49151 ] Specifies the first port number in the range being translated. set pinhole name name external-port-end [ 0 - 49151 ] Specifies the last port number in the range being translated. set pinhole name name internal-ip internal-ip Specifies the IP address of the internal host to which traffic of the specified type should be transferred.
Administrator’s Handbook set ppp module [vccn] magic-number { on | off } Enables or disables LCP magic number negotiation. set ppp module [vccn] protocol-compression { on | off } Specifies whether you want the Motorola Netopia® Gateway to compress the PPP Protocol field when it transmits datagrams over the PPP link. set ppp module [vccn] lcp-echo-requests { on | off } Specifies whether you want your Motorola Netopia® Gateway to send LCP echo requests.
set ppp module [vccn] connection-type { instant-on | always-on } Specifies whether a PPP connection is maintained by the Motorola Netopia® Gateway when it is unused for extended periods. If you specify always-on, the Motorola Netopia® Gateway never shuts down the PPP link. If you specify instant-on, the Motorola Netopia® Gateway shuts down the PPP link after the number of seconds specified in the time-out setting (below) if no traffic is moving over the circuit.
Administrator’s Handbook PPPoE with IPoE Settings Ethernet WAN platforms set wan-over-ether pppoe [ on | off ] Enables or disables PPPoE on the Ethernet WAN interface. set wan-over-ether pppoe-with-ipoe [ on | off ] Enables or disables the PPPoE with IPoE support on Ethernet WAN, including VDSL, platforms when pppoe option is set to on. When pppoe-with-ipoe is set to on, an additional interface, “ethernet C,” becomes available.
ADSL platforms You must configure two VCCs with the same VPI/VCI to enable concurrent PPPoE and IPoE support, and you will need to configure the individual settings for each interface for proper operation. set atm vcc n encap pppoe-llc Specifies that the VCC will allow a second VCC with the same VPI/VCI values as the first. pppoe-llc denotes this special case.
Administrator’s Handbook 802.3ah Ethernet OAM Settings 802.3ah Ethernet in the First Mile (EFM) Operations Administration and Maintenance (OAM) is a group of network management functions that provide network fault indication, performance information, and diagnosis using special-purpose Ethernet OAM frames. These are exchanged between your Gateway and service provider Access Node (AN) devices for network fault management, performance analysis and fault isolation.
Command Line Interface Preference Settings You can set command line interface preferences to customize your environment. set preference verbose { on | off } Specifies whether you want command help and prompting information displayed. By default, the command line interface verbose preference is turned off. If you turn it on, the command line interface displays help for a node when you navigate to that node.
Administrator’s Handbook Port Renumbering Settings If you use NAT pinholes to forward HTTP or telnet traffic through your Motorola Netopia® Gateway to an internal host, you must change the port numbers the Motorola Netopia® Gateway uses for its own configuration traffic.
Security Settings Security settings include the Firewall, Packet Filtering, Stateful Inspection, and IPSec parameters. Some of the security functionality is keyed. Firewall Settings (for BreakWater Firewall) set security firewall option [ ClearSailing | SilentRunning | LANdLocked ] The 3 settings for BreakWater are discussed in detail on page page 142.
Administrator’s Handbook set security ipsec tunnels name "123" dest-int-network ip-address Specifies the IP address of the destination computer or internal network. set security ipsec tunnels name "123" dest-int-netmask netmask Specifies the subnet mask of the destination computer or internal network. The subnet mask specifies which bits of the 32-bit IP address represents network information. The default subnet mask for most networks is 255.255.255.0 (class C subnet mask).
set security ipsec tunnels name "123" IKE-mode isakmp-SA-encrypt (DES) { DES | 3DES } See page 146 for details about SafeHarbour IPsec tunnel capability. set security ipsec tunnels name "123" IKE-mode ipsec-mtu mtu_value The Maximum Transmission Unit is a link layer restriction on the maximum number of bytes of data in a single transmission. The maximum allowable value (also the default) is 1500, and the minimum is 100.
Administrator’s Handbook set security ipsec tunnels name "123" local-id-type { IP-address | Subnet | Hostname | ASCII } Specifies the NAT local ID type for the specified IPsec tunnel, when Aggressive Mode is set. set security ipsec tunnels name "123" local-id id_value Specifies the NAT local ID value as specified in the local-id-type for the specified IPsec tunnel, when Aggressive Mode is set.
Internet Key Exchange (IKE) Settings The following four IPsec parameters configure the rekeying event.
Administrator’s Handbook Stateful Inspection Stateful inspection options are accessed by the security state-insp tag. set security state-insp [ ip-ppp | dsl ] vccn option [ off | on ] set security state-insp ethernet [ A | B ] option [ off | on ] Sets the stateful inspection option off or on on the specified interface. This option is disabled by default. Stateful inspection prevents unsolicited inbound access when NAT is disabled.
set security state-insp xposed-addr exposed-address# "n" Allows you to add an entry to the specified list, or, if the list does not exist, creates the list for the stateful inspection feature. xposed-addr settings only apply if NAT is off. Example: set security state-insp xposed-addr exposed-address# (?): 32 32 has been added to the xposed-addr list. Sets the exposed list address number.
Administrator’s Handbook Packet Filtering Settings Packet Filtering has two parts: • Create/Edit/Delete Filter Sets, create/edit/delete rules to a Filter Set. • Associate a created Filter Set with a WAN or LAN interface See “Packet Filter” on page 163 for more information. set security pkt-filter filterset filterset-name [ input_filter | output_filter ] index forward [ on | off ] Creates or edits a filter rule, specifying whether packets will be forwarded or not.
set security pkt-filter filterset filterset-name [ input_filter | output_filter ] index dest-ip ip_addr Specifies the destination IP address to match packets (where the packet is going). set security pkt-filter filterset filterset-name [ input_filter | output_filter ] index dest-mask mask Specifies the destination IP mask to match packets (where the packet is going).
Administrator’s Handbook set security pkt-filter filterset filterset-name [ input_filter | output_filter ] index dst-compare [ nc | ne | lt | le | eq | gt | ge ] Sets the destination compare operator action for the specified filter rule. dst-compare only displays when the protocol is TCP or UDP.
SNMP Settings The Simple Network Management Protocol (SNMP) lets a network administrator monitor problems on a network by retrieving settings on remote network devices. The network administrator typically runs an SNMP management station program on a local host to obtain information from an SNMP agent such as the Motorola Netopia® Gateway. set snmp community read name Adds the specified name to the list of communities associated with the Motorola Netopia® Gateway.
Administrator’s Handbook System Settings You can configure system settings to assign a name to your Motorola Netopia® Gateway and to specify what types of messages you want the diagnostic log to record. set system name name Specifies the name of your Motorola Netopia® Gateway. Each Motorola Netopia® Gateway is assigned a name as part of its factory initialization.
set system ftp-server option [ off | on ] Enables or disables a simple FTP server in the Gateway. If enabled, the Gateway will accept binary embedded software images (‘.bin’) files or command line configuration files.
Administrator’s Handbook set system heartbeat option { on | off } protocol [ udp | tcp ] port-client [ 1 - 65535 ] ip-server [ ip_address | dns_name ] port-server [ 1 - 65535 ] url-server ("server_name") number [ 1 – 1073741823 ] interval (00:00:00:20) sleep (00:00:30:00) contact-email ("string@domain_name") location ("string"): The heartbeat setting is used in conjunction with the configuration server to broadcast contact and location information about your Gateway.
Zero Touch refers to automatic configuration of your Motorola Netopia® Gateway. The Motorola Netopia® Gateway has default settings such that initial connection to the Internet will succeed. If the zerotouch option is set to on, HTTP requests to any destination IP address except the IP address(es) of the configured redirection URL(s) will access a redirection server. DNS traffic will not be blocked. Other traffic from the LAN to all destinations will be dropped.
Administrator’s Handbook Default syslog installation procedure 1. Access the router via telnet from the private LAN. DHCP server is enabled on the LAN by default. 2. The product’s stateful inspection feature must be enabled in order to examine TCP, UDP and ICMP packets destined for the router or the private hosts. This can be done by entering the CONFIG interface.
Wireless Settings (supported models) set wireless option ( on | off ) Administratively enables or disables the wireless interface. set wireless network-id ssid { network_name } Specifies the wireless network id for the Gateway. A unique ssid is generated for each Gateway. You must set your wireless clients to connect to this exact id, which can be changed to any 32-character string. set wireless auto-channel mode { off | at-startup | continuous } Specifies the wireless AutoChannel Setting for 802.
Administrator’s Handbook set wireless multi-ssid {second-ssid | third-ssid | fourth-ssid } name Specifies a descriptive name for each SSID. when multi-ssid option is set to on. set wireless multi-ssid second-ssid-privacy { off | WEP | WPA-PSK | WPA-802.1x } set wireless multi-ssid third-ssid-privacy { off | WEP | WPA-PSK | WPA-802.1x } set wireless multi-ssid fourth-ssid-privacy { off | WEP | WPA-PSK | WPA-802.
set wireless multi-ssid second-ssid-wepkey { hexadecimal digits } set wireless multi-ssid third-ssid-wepkey { hexadecimal digits } set wireless multi-ssid fourth-ssid-wepkey { hexadecimal digits } Specifies a WEP key for the multiple SSIDs, when second-, third-, or fourth-ssid-privacy is set to WEP. For 40/64bit encryption, you need 10 digits; 26 digits for 128bit, and 58 digits for 256bit WEP. Valid hexadecimal characters are 0 – 9, a – f.
Administrator’s Handbook Wireless Multi-media (WMM) Settings Router EDCA Parameters (Enhanced Distributed Channel Access) govern wireless data from your Gateway to the client; Client EDCA Parameters govern wireless data from the client to your Gateway. set wireless wmm option [ off | on ] Enables or disables wireless multi-media settings option, which allows you to fine tune WiFi Multimedia Quality of Service (QoS) by transmitting data depending on Diffserv priority settings.
set wireless wmm router-edca background { aifs 1... 255 } set wireless wmm router-edca background { cwmin value } set wireless wmm router-edca background { cwmax value } Sets values for Gateway WMM background parameters. set wireless wmm client-edca voice { aifs 1... 255 } set wireless wmm client-edca voice { cwmin value } set wireless wmm client-edca voice { cwmax value } set wireless wmm client-edca voice { txoplimit 0... 9999 } Sets values for client WMM voice parameters.
Administrator’s Handbook Wireless Privacy Settings set wireless network-id privacy option { off | WEP | WPA-PSK | WPA-802.1x } Specifies the type of privacy enabled on the wireless LAN. off = no privacy; WEP = WEP encryption; WPAPSK = Wireless Protected Access/Pre-Shared Key; WPA-802.1x = Wireless Protected Access/802.1x authentication. See “Wireless” on page 53 for a discussion of these options. WPA provides Wireless Protected Access, the most secure option for your wireless network.
set wireless network-id privacy encryption-key1 { hexadecimal digits } set wireless network-id privacy encryption-key2 { hexadecimal digits } set wireless network-id privacy encryption-key3 { hexadecimal digits } set wireless network-id privacy encryption-key4 { hexadecimal digits } The encryption keys. Enter keys using hexadecimal digits. For 40/64bit encryption, you need 10 digits; 26 digits for 128bit, and 58 digits for 256bit WEP. Valid hexadecimal characters are 0 – 9, a – f.
Administrator’s Handbook RADIUS Server Settings set radius radius-name "server_name_string" Specifies the default RADIUS server name or IP address. set radius radius-secret "shared_secret" Specifies the RADIUS secret key used by this server. The shared secret should have the same characteristics as a normal password. set radius alt-radius-name "server_name_string" Specifies an alternate RADIUS server name or IP address to be used if the primary server is unreachable.
VLAN Settings You can create up to 8 VLANs, and you can also restrict any VLAN, and the computers on it, from administering the Gateway. See “VLAN” on page 107 for more information. set vlan name name Sets the descriptive name for the VLAN. If no name is specified, displays a selection list of node names to select for editing. Once a new VLAN name is specified, presents the list of VLAN characteristics to define. set vlan name name type [ by-port | global ] Specifies VLAN type: by-port or global.
Administrator’s Handbook 802.1p priority bit field for tagged IP packets transmitted from this port for this VLAN. All mappings between Ethernet 802.1p and IP-TOS are made via diffserv dscp-map settings. set vlan name name ports port port-pbits [ 0 - 7 ] Specifies the 802.1p priority bit for this port associated with the specified VLAN. If you set this to a value greater than 0, all packets of this port with unmarked priority bits (pbits) will be re-marked to this priority.
option (off) [ off | on ]: vcc1 option (off) [ off | on ]: • Assign an IP interface: ip-vcc1 option (off) [ off | on ]: ip-eth-a option (off) [ off | on ]: on ipsec-mgmt1 option (off) [ off | on ]: Netopia-3000/9437188 (vlan)>> Example 2: • An example of a “Triple-Play” setup: set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set vlan vlan vlan vlan vlan vlan vlan vlan vlan vl
Administrator’s Handbook set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set set 314 vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vla
set set set set set set set set set set set set vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan vlan name name name name name name name name name name name name "Video_31" "Video_31" "Video_31" "Video_31" "Video_31" "Video_31" "Video_31" "Video_31" "Video_31" "Video_31" "Video_31" "Video_31" ports eth1 tag on ports eth1 priority off ports eth1 promote off ports eth1 port-pbits 0 ip-interfaces ip-ppp-a option off ip-interfaces ip-eth-b option off ip-interfaces ip-eth-c option off ip-interfaces ip-
Administrator’s Handbook VoIP settings (supported models only) Voice-over-IP (VoIP) refers to the ability to make voice telephone calls over the Internet. This differs from traditional phone calls that use the Public Switched Telephone Network (PSTN). VoIP calls use an Internet protocol, Session Initiation Protocol (SIP), to transmit sound over a network or the Internet in the form of data packets. Certain Motorola Netopia® Gateway models have two separate voice ports for connecting telephone handsets.
set voip phone [ 0 | 1 ] sip-user-display-name name Specifies the user name that is displayed on the web UI Home page, or other caller-id displays for the specified phone. set voip phone [ 0 | 1 ] sip-user-name username Specifies the user name that authenticates the user to SIP for the specified phone. set voip phone [ 0 | 1 ] sip-user-password password Specifies the password that authenticates the user to SIP for the specified phone.
Administrator’s Handbook set voip phone [ 0 | 1 ] codec G726_40 priority [ 1 | 2 | 3 | 4 | 5 | 6 | 7 | none ] Assigns a priority to the G726-40 codec, a common audio media type implementation at 40 kbit/s. set voip phone [ 0 | 1 ] sip-advanced-setting sip-dtmf-mode [ inband | rfc2833 | info ] sip-dtmf-mode – sets the Dual Tone Multi-Frequency Mode: • inband: sends the DTMF digits as a normal inband tone. • rfc2833: sends the DTMF digits as an event as part of the RTP packet header information.
set voip phone [ 0 | 1 ] sip-advanced-setting call-feature call-waiting-option [ off | on ] call-waiting-option – enables or disables call waiting. set voip phone [ 0 | 1 ] sip-advanced-setting call-feature call-conferencing-option [ off | on ] call-conferencing-option – enables or disables 3-way call conferencing.
Administrator’s Handbook set voip phone [ 0 | 1 ] sip-advanced-setting dsp-settings vad-setting [ vad-cn | vad-std-sid | vad-suppress-sid ] When vad-option is set to on: • vad-cn – enables Voice Activity Detection/Comfort Noise Generation. When speech is not present, the CNG algorithm generates a noise signal at the level sent from the transmit side. • vad-std-sid – enables Voice Activity Detection with standard Silence Insertion Descriptor support.
set set set set set set set set set set set set set set set set set set set set voip voip voip voip voip voip voip voip voip voip voip voip voip voip voip voip voip voip voip voip phone: phone: phone: phone: phone: phone: phone: phone: phone: phone: phone: phone: phone: phone: phone: phone: phone: phone: phone: phone: 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 codec G711U priority 2 codec G729A priority 3 codec G726_16 priority 4 codec G726_24 priority 5 codec G726_32 priority 6 codec G726_40 priority 7 si
Administrator’s Handbook TR-069 DSL Forum CPE WAN Management Protocol (TR-069) provides services similar to UPnP and TR-064. The communication between the Motorola Netopia® Gateway and management agent in UPnP and TR-064 is strictly over the LAN, whereas the communication in TR-069 is over the WAN link for some features and over the LAN for others. TR-069 allows a remote Auto-Config Server (ACS) to provision and manage the Motorola Netopia® Gateway.
Backup IP Gateway Settings The purpose of Backup is to provide a recovery mechanism in the event that the primary connection fails. Should the primary WAN connection fail, traffic would be automatically redirected through your alternate gateway device to maintain Internet connectivity. See “Backup” on page 133 for more information. set backup option [ disabled | manual | automatic ] Specifies whether backup to an IP gateway is disabled or enabled as manual or automatic. Default is disabled.
Administrator’s Handbook set ip backup-gateway default ip_address Specifies the ip address of the default gateway.
VDSL Settings ☛ CAUTION! These settings are for very advanced users and lab technicians. Exercise extreme caution when modifying any of these settings.
Administrator’s Handbook VDSL Parameter Defaults Parameter 326 Default Meaning pbo-k2_3 0x00 VDSL system power back-off k2_3 line-type 0x81 VDSL port line type(auto=0x80, vdsl=0x81, vdsl_etsi=0x82) us-max-inter-delay 0x04 VDSL port upstream max inter delay ds-max-inter-delay 0x04 VDSL port downstream max inter delay us-target-noise-margin 0x0C VDSL port upstream target noise margin ds-target-noise-margin 0x0C VDSL port downstream target noise margin min-noise-margin 0x0A VDSL port m
VDSL Parameters Accepted Values Parameter Accepted Values sys-option Bit[0]: NTR_DISABLE Bit[1]: ALW_MARGIN_ADJUST. 1: the SNR margin for the optional band is reduced by up to 2.5 dB, but never below a minimum of 4 dB. Bit[2]: SUPPORT_INI Bit[4]: TLAN Enable Bit[5]: PBO Weak mode Enable (Applicable only when PBO Bit[3]=0. Bit[6]: ADSL_SAFE_MODE Enable Bit[7]: TLAN_SAFE_MODE Enable (Applicable only when TLAN Enable Bit[4] is set.
Administrator’s Handbook VDSL Parameters Accepted Values Parameter psd-mask-level 0x00 -- default mask (old gains from before) 0x01 -- ANSI M1 CAB 0x02 -- ANSI M2 CAB 0x03 -- ETSI M1 CAB 0x04 -- ETSI M2 CAB 0x05 -- ITU-T Annex F (Japan) 0x06 - ANSI M1 Ex 0x07 - ANSI M2 Ex 0x08 -- ETSI M1 Ex 0x09 - ETSI M2 Ex 0x0A - RESERVED 0x0B - PSD_K (Korean M1 FTTCab -59dBm/Hz) pbo-k1_1 K1 and K2 parameters allow the user more flexibility in using Upstream Power Back-Off (UPBO) on CPE modem.
VDSL Parameters Accepted Values Parameter Accepted Values port-bandplan BP1_998_3 (0x00) BP2_998_3 (0x01) BP998_3B_8_5M (0x01) BP3_998_4 (0x02) BP998_4B_12M (0x02) BP4_997_3 (0x03) BP997_3B_7_1M (0x03) BP5_997_3 (0x04) BP6_997_4 (0x05) BP997_4B_7_1M (0x05) BP7_MXU_3 (0x06) FLEX_3B_8_5M (0x06) BP8_MXU_2 (0x07) BP9_998_2 (0x08) BP10_998_2 (0x09) BP998_2B_3_8M (0x09) BP11_998_2 (0x0A) BP12_998_2 (0x0B) BP13_MXU_3 (0x0C) BP14_MXU_3 (0x0D) BP15_MXU_3 (0x0E) BP16_997_4B_4P (0x0F) BP17_998_138_4400 (0x10) BP18_
Administrator’s Handbook VDSL Parameters Accepted Values Parameter 330 Accepted Values band-mod Bit 0, 1: Tx Cfg band 1- All tones on 2- All tones below 640 Khz are turned off 3- All tones below 1.1 Mhz are turned off Bit 2,3: Not used Bit 4,5: Rx Cfg band 1- All tones on 2- All tones below 640 Khz are turned off 3- All tones below 1.1 Mhz are turned off Bit 6, 7:Optional band 0- No Optional band 1- ANNEX_A_6_32 ( ie. 25KHz to 138 KHz) 2- ANNEX_B_32_64 (ie. 138 KHz to 276 KHz) 3- ANNEX_B_6_64 (ie.
CHAPTER 7 Glossary 10Base-T. IEEE 802.3 specification for Ethernet that uses unshielded twisted pair (UTP) wiring with RJ-45 eight-conductor plugs at each end. Runs at 10 Mbps. 100Base-T. IEEE 802.3 specification for Ethernet that uses unshielded twisted pair (UTP) wiring with RJ-45 eight-conductor plugs at each end. Runs at 100 Mbps. -----A----ACK. Acknowledgment. Message sent from one network device to another to indicate that some event has occurred. See NAK. access rate.
Administrator’s Handbook asynchronous communication. Network system that allows data to be sent at irregular intervals by preceding each octet with a start bit and following it with a stop bit. Compare synchronous communication. Auth Protocol. Authentication Protocol for IP packet header. The three parameter values are None, Encapsulating Security Payload (ESP) and Authentication Header (AH). -----B----backbone.
compression. Operation performed on a data set that reduces its size to improve storage or transmission rate. CPIP. Carrier Pigeon Internet Protocol. RFC 1149 - Standard for the transmission of IP datagrams on avian carriers. The IP datagram is printed, on a small scroll of paper, in hexadecimal, with each octet separated by whitestuff and blackstuff. The scroll of paper is wrapped around one leg of the avian carrier. A band of duct tape is used to secure the datagram's edges.
Administrator’s Handbook domain name. Name identifying an organization on the Internet. Domain names consists of sets of characters separated by periods (dots). The last set of characters identifies the type of organization (.GOV, .COM, .EDU) or geographical location (.US, .SE). domain name server. Network computer that matches host names to IP addresses in response to Domain Name System (DNS) requests. Domain Name System (DNS).
-----F----FCS. Frame Check Sequence. Data included in frames for error control. flow control. Technique using hardware circuits or control characters to regulate the transmission of data between a computer (or other DTE) and a modem (or other DCE). Typically, the modem has buffers to hold data; if the buffers approach capacity, the modem signals the computer to stop while it catches up on processing the data in the buffer. See CTS, RTS, xon/xoff. fragmentation.
Administrator’s Handbook -----I----IGMP. Internet Group Management Protocol allows a router to determine which host groups have members on a given network segment. IKE. Internet Key Exchange protocol provides automated key management and is a preferred alternative to manual key management as it provides better security. Manual key management is practical in a small, static environment of two or three sites. Exchanging the key is done through manual means.
-----M----magic number. Random number generated by a router and included in packets it sends to other routers. If the router receives a packet with the same magic number it is using, the router sends and receives packets with new random numbers to determine if it is talking to itself. MD5. A 128-bit, message-digest, authentication algorithm used to create digital signatures. It computes a secure, irreversible, cryptographically strong hash value for a document. Less secure than variant SHA-1. metric.
Administrator’s Handbook -----P----packet. Logical grouping of information that includes a header and data. Compare frame, datagram. PAP. Password Authentication Protocol. Security protocol within the PPP protocol suite that prevents unauthorized access to network services. See RFC 1334 for PAP specifications. Compare CHAP. parity. Method of checking the integrity of each character received over a communication channel. Peer External IP Address.
-----R----repeater. Device that regenerates and propagates electrical signals between two network segments. Also known as a hub. RFC. Request for Comment. Set of documents that specify the conventions and standards for TCP/IP networking. RIP. Routing Information Protocol. Protocol responsible for distributing information about available routes and networks from one router to another. RJ-11. Four-pin connector used for telephones. RJ-45. Eight-pin connector used for 10BaseT (twisted pair Ethernet) networks.
Administrator’s Handbook Soft MBytes. Setting the Soft MBytes parameter forces the renegotiation of the IPSec Security Associations (SAs) at the configured Soft MByte value. The value can be configured between 1 and 1,000,000 MB and refers to data traffic passed. If this value is not achieved, the Hard MBytes parameter is enforced. Soft Seconds. Setting the Soft Seconds parameter forces the renegotiation of the IPSec Security Associations (SAs) at the configured Soft Seconds value.
the same levels of Quality of Service, authentication, and service segmentation previously provided by traditional DSL networks. twisted pair. Cable consisting of two copper strands twisted around each other. The twisting provides protection against electromagnetic interference. -----U----UTP. Unshielded twisted pair cable. -----V----VDSL. Very high rate Digital Subscriber Line.
Administrator’s Handbook 342
CHAPTER 8 Technical Specifications and Safety Information Description Dimensions: Smart Modems: 13.5 cm (w) x 13.5 cm (d) x 3.5 cm (h); 5.25” (w) x 5.25” (d) x 1.375” (h) Wireless Models: 19.5 cm (w) x 17.0 cm (d) x 4.0 cm (h); 7.6” (w) x 6.75” (d) x 1.5” (h) 3342/3342N/3352/3352N: 8.5 cm (w) x 4.5 cm (d) x 2 cm (h); 3.375” (w) x 1.75” (d) x .875” (h) 2200-Series Modems: 1.06"(2.69 cm) H, 4.36" (11.07 cm) W, 5.71"(14.50 cm) L 2200-Series Wireless Models: 1.2"(3.0cm) H, 8.7" (22.0 cm) W, 5.2"(13.
Administrator’s Handbook Management/configuration methods: HTTP (Web server), Telnet, SNMP, TR-069 DSL Forum CPE WAN Management Protocol Diagnostics: Ping, event logging, routing table displays, statistics counters, web-based management, traceroute, nslookup, and diagnostic commands. Agency approvals North America Safety Approvals: ■ United States – UL 60950, Third Edition ■ Canada – CSA: CAN/CSA-C22.2 No.
case the user may be required to take adequate measures. Adequate measures include increasing the physical distance between this product and other electrical devices. Changes or modifications to this unit not expressly approved by the party responsible for compliance could void the user’s authority to operate the equipment. United States. This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules.
Administrator’s Handbook Users should ensure for their own protection that the electrical ground connections of the power utility, telephone lines, and internal metallic water pipe system, if present, are connected together. This precaution may be particularly important in rural areas. Caution Users should not attempt to make such connections themselves, but should contact the appropriate electric inspection authority, or electrician, as appropriate.
47 CFR Part 68 Information FCC Requirements 1. The Federal Communications Commission (FCC) has established Rules which permit this device to be directly connected to the telephone network. Standardized jacks are used for these connections. This equipment should not be used on party lines or coin phones. 2.
Administrator’s Handbook h) This equipment not intended to be repaired by the end user. In case of any problems, please refer to the troubleshooting section of the Product User Manual before calling Motorola Technical Support. i) Connection to party line service is subject to state tariffs. Contact the state public utility commission, public service commission or corporation commission for information.
Original SSLeay License /Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) All rights reserved. This package is an SSL implementation written by Eric Young (eay@cryptsoft.com). The implementation was written so as to conform with Netscape’s SSL. This library is free for commercial and non-commercial use as long as the following conditions are adhered to. The following conditions apply to all code found in this distribution, be it the RC4, RSA, lhash, DES, etc., code; not just the SSL code.
Administrator’s Handbook LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Portions of this software are based in part on the work of the following: Copyright (C) 1990, RSA Data Security, Inc. All rights reserved. <> License to copy and use this software is granted provided that it is identified as the “RSA Data Security, Inc.
CHAPTER 9 Overview of Major Capabilities The Motorola Netopia® Gateway offers simplified setup and management features as well as advanced broadband router capabilities. The following are some of the main features of the Motorola Netopia® Gateway: • “Wide Area Network Termination” on page 351 The Gateway combines an ADSL modem with an Internet router. It translates protocols used on the Internet to protocols used by home personal computers and eliminates the need for special desktop software (i.e.
Administrator’s Handbook 3. The unit sends the scrambled challenge back to the peer. PAP, a less robust method of authentication, sends a username and password to a PPP server to be authenticated. PAP’s username and password pair are not encrypted, and are therefore sent “unscrambled”. Instant-On PPP You can configure your Gateway for one of two types of Internet connections: • Always On • Instant On These selections provide either an uninterrupted Internet connection or an as-needed connection.
DNS Proxy Domain Name System (DNS) provides end users with the ability to look for devices or web sites by typing their names, rather than IP addresses. For web surfers, this technology allows you to enter the URL (Universal Resource Locator) as text to surf to a desired website. The Motorola Netopia® DNS Proxy feature allows the LAN-side IP address of the Gateway to be used for proxying DNS requests from hosts on the LAN to the DNS Servers configured in the gateway.
Administrator’s Handbook TraceRoute - displays the path to a destination by showing the number of hops and the router addresses of these hops. The system log also provides diagnostic information. ☛ NOTE: Your Service Provider may request information that you acquire from these various diagnostic tools. Individual tests may be performed at the command line. (See “Command Line Interface” on page 223.).
• When NAT is OFF, a Motorola Netopia® Gateway acts as a traditional TCP/IP router, all LAN computers/ devices are exposed to the Internet. A diagram of a typical NAT-enabled LAN follows: Motorola Netopia® Gateway Internet LAN Ethernet Interface WAN Ethernet Interface NAT NAT-protected LAN stations Embedded Admin Services: HTTP-Web Server and Telnet Server Port ☛ NOTE: 1. The default setting for NAT is ON. 2. Motorola Netopia® uses Port Address Translation (PAT) to implement the NAT facility. 3.
Administrator’s Handbook Pinholes This feature allows you to: • Transparently route selected types of network traffic using the port forwarding facility. FTP requests or HTTP (Web) connections are directed to a specific host on your LAN. • Setup multiple pinhole paths. Up to 32 paths are supported • Identify the type(s) of traffic you want to redirect by port number.
VPN IPSec Pass Through This Motorola Netopia® service supports your independent VPN client software in a transparent manner. Motorola Netopia® has implemented an Application Layer Gateway (ALG) to support multiple PCs running IP Security protocols. This feature has three elements: 1. 2. 3. On power up or reset, the address mapping function (NAT) of the Gateway’s WAN configuration is turned on by default.
Administrator’s Handbook Stateful Inspection Firewall Stateful inspection is a security feature that prevents unsolicited inbound access when NAT is disabled. You can configure UDP and TCP “no-activity” periods that will also apply to NAT time-outs if stateful inspection is enabled on the interface. Technical details are discussed in “Expert Mode” on page 39. SSL Certificate Support On selected models, you can also install a Secure Sockets Layer (SSL V3.
Index Symbols !! command 227 A Access the GUI 39 Address resolution table 234 Administrative restrictions 264 Administrator password 39, 140, 226 Arguments, CLI 241 ARP Command 228, 239 ATA configuration 243 Authentication 281 Authentication trap 297 auto-channel mode 303 AutoChannel Setting 57, 303 B Backup 133 Bridging 246 Broadcast address 259, 261 C CLI 223 !! command 227 Arguments 241 Command shortcuts 227 Command truncation 240 Configuration mode 240 Keywords 241 Navigating 240 Prompt 227, 240 Rest
Administrator’s Handbook Community 297 Compression, protocol 280 Concurrent Bridging/Routing 105, 247 CONFIG Command List 225 Configuration mode 240 D D.
filter sets adding 171 defined 163 deleting 175 disadvantages 163 using 171 filtering example #1 167 filters actions a filter can take 165 adding to a filter set 172 defined 163 deleting 175 input 172 modifying 175 output 172 using 170, 171 viewing 175 firewall 235 FTP 278 H Hardware address 246 hijacking 340 Hop count 277 HTTP traffic 286 I ICMP Echo 230 IGMP 100 IGMP Snooping 101, 257 Install 182 Install Certificate 190 IP address 259, 261 Default 39 IP interfaces 234 IP routes 235 IP Subnets 50 IPMap t
Administrator’s Handbook L LAN Host Discovery Table 235 latency 177 LCP echo request 280 Link Install Software 182 Quickstart 47, 49, 67 Local Area Network 352 Location, SNMP 297 Log 235 Logging in 226 lost echoes 280 M Magic number 280 Memory 235 Metric 277 multi-cast forwarding 260, 283 Multiple SSIDs 59 multiple subnets 50 Multiple Wireless SSIDs Wireless 59, 303 N Nameserver 255 NAT 264, 278, 354 Traffic rules 90 NAT Default Server 356 Netmask 262 Network Address Translation 354 Network Test Tools 35
persistent-log 299 Ping 353 Ping command 230 Pinholes 278, 356 Planning 82 policy-based routing 177 Port authentication 281 port number comparisons 166 port numbers 165 Port renumbering 286 PPP 240 PPPoE 351 PPPoE with IPoE 71, 73 Primary nameserver 255 Prompt, CLI 227, 240 Protocol compression 280 Q qos max-burst-size 245 qos peak-cell-rate 245 qos service-class 245 qos sustained-cell-rate 245 quality of service 165, 177 R Restart 232 Restart command 227 Restart timer 280 Restrictions 264 RIP 261, 262 Ro
Administrator’s Handbook Set DMT commands 254 Set dns commands 255 Set ip static-routes commands 276 Set ppp module port authentication command 281 Set preference more command 285 Set preference verbose command 285 set security state-insp 292 Set servers command 286 Set servers telnet-tcp command 286 Set snmp sysgroup location command 297 Set snmp traps authentification-traps ip-address command 297 Set system diagnostic-level command 298 Set system heartbeat command 300 Set system name command 298 Set syst
System contact, SNMP 297 System diagnostics 298 system idle-timeout 299 T Telnet 226, 278 Telnet command 238 Telnet traffic 286 TFTP 278 TFTP server 229 Toolbar 43 TOS bit 165, 177 TraceRoute 218, 354 Trap 297 Trivial File Transfer Protocol 229 Truncation 240 U UPnP 102 User name 226 User password 39, 140, 226 V set atm 245 View command 242 view config 238 VLAN ID 111 VLAN Settings 311 VLANs 107 Voice-over-IP 120, 316 VoIP 120, 316 VPN IPSec Pass Through 357 IPSec Tunnel Termination 357 W Weighted Fair
Administrator’s Handbook Z Zero Touch 301 366
Motorola Netopia® 2200-, 3300- or 7000-series Motorola, Inc.
Administrator’s Handbook 368
