Chapter 2 Connecting the Router to the Internet
This chapter describes how to set up the router on your local area network (LAN) and connect to the Internet. You find out how to configure your MR814v2 Cable/DSL Wireless Router for Internet access using the Setup Wizard, or how to manually configure your Internet connection.
What You Will Need Before You Begin
You need to prepare these three things before you begin:

1. 2. 3.

Have active Internet service such as that provided by an cable or DSL broadband account. Locate the Internet Service Provider (ISP) configuration information for your DSL account. Connect the router to a cable or DSL modem and a computer as explained below.
Cabling and Computer Hardware Requirements
To use the MR814v2 router on your network, each computer must have an installed Ethernet Network Interface Card (NIC) and an Ethernet cable. If the computer will connect to your network at 100 Mbps, you must use a Category 5 (CAT5) cable such as the one provided with your router.
Computer Network Configuration Requirements
The MR814v2 includes a built-in Web Configuration Manager. To access the configuration menus on the MR814v2, your must use a Java-enabled web browser program which supports HTTP uploads such as Microsoft Internet Explorer or Netscape Navigator. NETGEAR recommends using Internet Explorer or Netscape Navigator 4.0 or above. Free browser programs are readily available for Windows, Macintosh, or UNIX/Linux. For the initial connection to the Internet and configuration of your router, you will need to connect a computer to the router which is set to automatically get its TCP/IP configuration from the router via DHCP.
Note: For help with DHCP configuration, please refer to Appendix C, Preparing Your Network.
Connecting the Router to the Internet
The cable or DSL modem broadband access device must provide a standard 10 Mbps (10BASE-T) Ethernet interface.
Internet Configuration Requirements
Depending on how your ISP set up your Internet account, you will need one or more of these configuration parameters to connect your router to the Internet: Host and Domain Names ISP Login Name and Password ISP Domain Name Server (DNS) Addresses Fixed IP Address which is also known as Static IP Address

Note: The authentication scheme is separate from the data encryption. You can
choose an authentication scheme which requires a shared key but still leave the data transmissions unencrypted. If you require strong security, use both the Shared Key and WEP encryption settings.
Set your wireless adapter according to the authentication scheme you choose for the MR814v2 router. Please refer to Authentication and WEP on page D-3 for a full explanation of each of these options, as defined by the IEEE 802.11b wireless communication standard. Encryption Strength Choices Choose the encryption strength from the drop-down list. Please refer to Overview of WEP Parameters on page D-5 for a full explanation of each of these options, as defined by the IEEE 802.11b wireless communication standard.
3-6 Wireless Configuration
Disable No encryption will be applied. This setting is useful for troubleshooting your wireless connection, but leaves your wireless data fully exposed. 64 or 128 bit WEP When 64 Bit WEP or 128 Bit WEP is selected, WEP encryption will be applied. WEP provides some degree of privacy, but can be defeated without great difficulty. If WEP is enabled, you can manually or automatically program the four data encryption keys. These values must be identical on all PCs and access points in your network.
Figure 3-8: 64 or 128 bit WEP encryption strength
There are two methods for creating WEP encryption keys: Passphrase. Enter a word or group of printable characters in the Passphrase box and click the Generate button. Manual. 64-bit WEP: Enter 10 hexadecimal digits (any combination of 0-9, a-f, or A-F). 128-bit WEP: Enter 26 hexadecimal digits (any combination of 0-9, a-f, or A-F).
Clicking the radio button selects which of the four keys will be active.
How to Set Up and Test Basic Wireless Connectivity
Follow the instructions below to set up and test basic wireless connectivity. Once you have established basic wireless connectivity, you can enable security settings appropriate to your needs.
Log in to the MR814v2 firewall at its default LAN address of http://192.168.0.1 with its default user name of admin and default password of password, or using whatever LAN address and password you have set up. Click the Wireless Settings link in the main menu of the MR814v2 firewall.
Figure 3-9: Wireless Settings menu 3.
Choose a suitable descriptive name for the wireless network name (SSID). In the SSID box, enter a value of up to 32 alphanumeric characters. The default SSID is Wireless. Note: The SSID of any wireless access adapters must match the SSID you configure in the MR814v2 Cable/DSL Wireless Router. If they do not match, you will not get a wireless connection to the MR814v2.

Note: When configuring the firewall from a wireless PC whose MAC address is not in the Trusted PC list, if you select Turn Access Control On, you will lose your wireless connection when you click on Apply. You must then access the router from a wired PC or from a wireless PC which is on the access control list to make any further changes.

Configure WEP

To configure WEP data encryption, follow these steps:
Reference Manual for the MR814v2 Cable/DSL Wireless Router 1.
Log in to the MR814v2 firewall at its default LAN address of http://192.168.0.1 with its default user name of admin and default password of password, or using whatever LAN address and password you have set up. Click the Wireless Settings link in the main menu of the MR814v2 router. In the Security Encryption menu, select the authentication and encryption strength Please refer to Overview of WEP Parameters on page D-5 for a full explanation of each of these options, as defined by the IEEE 802.11b wireless communication standard.

Figure 3-12. 4.

Wireless Settings encryption menu
You can manually or automatically program the four data encryption keys. These values must be identical on all PCs and Access Points in your network. Automatic - Enter a word or group of printable characters in the Passphrase box and click the Generate button. The four key boxes will be automatically populated with key values. Manual - Enter ten hexadecimal digits (any combination of 0-9, a-f, or A-F) Select which of the four keys will be active.
Be sure you clearly understand how the WEP key settings are configured in your wireless adapter. Wireless adapter configuration utilities such as the one included in Windows XP only allow entry of one key which must match the default key you set in the MR814v2.
Note: When configuring the router from a wireless PC, if you configure WEP settings, you will lose your wireless connection when you click on Apply. You must then either configure your wireless adapter to match the router WEP settings or access the router from a wired PC to make any further changes.
Chapter 4 Content Filtering
This chapter describes how to use the content filtering features of the MR814v2 Cable/DSL Wireless Router to protect your network. These features can be found by clicking on the Content Filtering heading in the Main Menu of the browser interface.

Using Address Reservation
When you specify a reserved IP address for a PC on the LAN, that PC will always receive the same IP address each time it access the routers DHCP server. Reserved IP addresses should be assigned to servers that require permanent IP settings. To reserve an IP address:
Click the Add button. In the IP Address box, type the IP address to assign to the PC or server. (choose an IP address from the routers LAN subnet, such as 192.168.0.X) Type the MAC Address of the PC or server. (Tip: If the PC is already present on your network, you can copy its MAC address from the Attached Devices menu and paste it here.) Click Apply to enter the reserved address into the table.
Note: The reserved address will not be assigned until the next time the PC contacts the router's DHCP server. Reboot the PC or access its IP configuration and force a DHCP release and renew. To edit or delete a reserved address entry:
Click the button next to the reserved address you want to edit or delete. Click Edit or Delete.
Using a Dynamic DNS Service
If your network has a permanently assigned IP address, you can register a domain name and have that name linked with your IP address by public Domain Name Servers (DNS). However, if your Internet account uses a dynamically assigned IP address, you will not know in advance what your IP address will be, and the address can change frequently. In this case, you can use a commercial dynamic DNS service, who will allow you to register your domain to their IP address, and will forward traffic directed at your domain to your frequently-changing IP address.
Note: If your ISP assigns a private WAN IP address (such as 192.168.x.x or 10.x.x.x), the dynamic DNS service will not work because private addresses will not be routed on the Internet.
The router contains a client that can connect to many popular dynamic DNS services. You can select one of these services and obtain an account with them. Then, whenever your ISP-assigned IP address changes, your router will automatically contact your dynamic DNS service provider, log in to your account, and register your new IP address. From the Main Menu of the browser interface, under Advanced, click on Dynamic DNS. To configure Dynamic DNS:
Register for an account with one of the dynamic DNS service providers whose names appear in the Select Service Provider box. For example, for dyndns.org, go to www.dyndns.org. Select the Use a dynamic DNS service check box. Select the name of your dynamic DNS Service Provider. Type the Host Name (or domain name) that your dynamic DNS service provider gave you. Type the User Name for your dynamic DNS account. Type the Password (or key) for your dynamic DNS account.

Reference Manual for the MR814v2 Cable/DSL Wireless Router 7.
If your dynamic DNS provider allows the use of wildcards in resolving your URL, you may select the Use wildcards check box to activate this feature. For example, the wildcard feature will cause *.yourhost.dyndns.org to be aliased to the same IP address as yourhost.dyndns.org Click Apply to save your configuration.
Configuring Static Routes
Static Routes provide additional routing information to your router. Under normal circumstances, the router has adequate routing information after it has been configured for Internet access, and you do not need to configure additional static routes. You must configure static routes only for unusual cases such as multiple routers or multiple IP subnets located on your network. From the Main Menu of the browser interface, under Advanced, click on Static Routes to view the Static Route menu, shown below.

Figure 6-4.

Static Route Summary Table
To add or edit a Static Route:
Click the Add button to open the Add/Edit Menu, shown below.
Figure 6-5. 2. 3. 4. 5. 6. 7. 8.
Static Route Entry and Edit Menu
Type a route name for this static route in the Route Name box under the table. (This is for identification purpose only.) Select Private if you want to limit access to the LAN only. The static route will not be reported in RIP. Select Active to make this route effective. Type the Destination IP Address of the final destination. Type the IP Subnet Mask for this destination. If the destination is a single host, type 255.255.255.255. Type the Gateway IP Address, which must be a router on the same LAN segment as the router. Type a number between 1 and 15 as the Metric value. This represents the number of routers between your network and the destination. Usually, a setting of 2 or 3 works, but if this is a direct connection, set it to 1. Click Apply to have the static route entered into the table.
As an example of when a static route is needed, consider the following case: Your primary Internet access is through a cable modem to an ISP. You have an ISDN router on your home network for connecting to the company where you are employed. This routers address on your LAN is 192.168.0.100. Your companys network is 134.177.0.0.
When you first configured your router, two implicit static routes were created. A default route was created with your ISP as the gateway, and a second static route was created to your local network for all 192.168.0.x addresses. With this configuration, if you attempt to access a device on the 134.177.0.0 network, your router will forward your request to the ISP. The ISP forwards your request to the company where you are employed, and the request will likely be denied by the companys firewall. In this case you must define a static route, telling your router that 134.177.0.0 should be accessed through the ISDN router at 192.168.0.100. The static route would look like Figure 6-5. In this example: The Destination IP Address and IP Subnet Mask fields specify that this static route applies to all 134.177.x.x addresses. The Gateway IP Address fields specifies that all traffic for these addresses should be forwarded to the ISDN router at 192.168.0.100. A Metric value of 1 will work since the ISDN router is on the LAN. Private is selected only as a precautionary security measure in case RIP is activated.

Testing the LAN Path to Your Router
You can ping the router from your PC to verify that the LAN path to your router is set up correctly. To ping the router from a PC running Windows 95 or later:
From the Windows toolbar, click on the Start button and select Run. In the field provided, type Ping followed by the IP address of the router, as in this example:

ping 192.168.0.1

Click on OK. You should see a message like this one:
Pinging <IP address> with 32 bytes of data
If the path is working, you see this message:
Reply from < IP address >: bytes=32 time=NN ms TTL=xxx
If the path is not working, you see this message:

Request timed out

If the path is not functioning correctly, you could have one of the following problems: Wrong physical connections Make sure the LAN port LED is on. If the LED is off, follow the instructions in LAN or WAN Port LEDs Not On on page 7-2. Check that the corresponding Link LEDs are on for your network interface card and for the hub ports (if any) that are connected to your workstation and router. Wrong network configuration Verify that the Ethernet card driver software and TCP/IP software are both installed and configured on your PC or workstation. Verify that the IP address for your router and your workstation are correct and that the addresses are on the same subnet.
Testing the Path from Your PC to a Remote Device
After verifying that the LAN path works correctly, test the path from your PC to a remote device. From the Windows run menu, type:
PING -n 10 <IP address>
where <IP address> is the IP address of a remote device such as your ISPs DNS server. If the path is functioning correctly, replies as in the previous section are displayed. If you do not receive replies: Check that your PC has the IP address of your router listed as the default gateway. If the IP configuration of your PC is assigned by DHCP, this information will not be visible in your PCs Network Control Panel. Verify that the IP address of the router is listed as the default gateway as described in Verifying TCP/IP Properties on page 4-5. Check to see that the network address of your PC (the portion of the IP address specified by the netmask) is different from the network address of the remote device. Check that your cable or DSL modem is connected and functioning.

Class A

Network Class B

Network

Class C
Figure 7-1: Three Main Address Classes
The five address classes are: Class A Class A addresses can have up to 16,777,214 hosts on a single network. They use an eight-bit network number and a 24-bit node number. Class A addresses are in this range:

1.x.x.x to 126.x.x.x.

Class B Class B addresses can have up to 65,354 hosts on a network. A Class B address uses a 16-bit network number and a 16-bit node number. Class B addresses are in this range:
128.1.x.x to 191.254.x.x.
Class C Class C addresses can have 254 hosts on a network. Class C addresses use 24 bits for the network address and eight bits for the node. They are in this range:
192.0.1.x to 223.255.254.x.
Class D Class D addresses are used for multicasts (messages sent to many hosts). Class D addresses are in this range:
224.0.0.0 to 239.255.255.255.
Class E Class E addresses are for experimental use.
This addressing structure allows IP addresses to uniquely identify each physical network and each node on each physical network. For each unique value of the network portion of the address, the base address of the range (host address of all zeros) is known as the network address and is not usually assigned to a host. Also, the top address of the range (host address of all ones) is not assigned, but is used as the broadcast address for simultaneously sending a packet to all hosts with the same network address.

Netmask

In each of the address classes previously described, the size of the two parts (network address and host address) is implied by the class. This partitioning scheme can also be expressed by a netmask associated with the IP address. A netmask is a 32-bit quantity that, when logically combined (using an AND operator) with an IP address, yields the network address. For instance, the netmasks for Class A, B, and C addresses are 255.0.0.0, 255.255.0.0, and 255.255.255.0, respectively. For example, the address 192.168.170.237 is a Class C IP address whose network portion is the upper 24 bits. When combined (using an AND operator) with the Class C netmask, as shown here, only the network portion of the address remains:

(192.168.170.237)

combined with:

(255.255.255.0)

Equals:

(192.168.170.0)

As a shorter alternative to dotted-decimal notation, the netmask may also be expressed in terms of the number of ones from the left. This number is appended to the IP address, following a backward slash (/), as /n. In the example, the address could be written as 192.168.170.237/24, indicating that the netmask is 24 ones followed by 8 zeros.

Internet Security and Firewalls
When your LAN connects to the Internet through a router, an opportunity is created for outsiders to access or disrupt your network. A NAT router provides some protection because by the very nature of the process, the network behind the router is shielded from access by outsiders on the Internet. However, there are methods by which a determined hacker can possibly obtain information about your network or at the least can disrupt your Internet access. A greater degree of protection is provided by a firewall router.
B-10 Network, Routing, Firewall, and Basics

What is a Firewall?

A firewall is a device that protects one network from another, while allowing communication between the two. A firewall incorporates the functions of the NAT router, while adding features for dealing with a hacker intrusion or attack. Several known types of intrusion or attack can be recognized when they occur. When an incident is detected, the firewall can log details of the attempt, and can optionally send email to an administrator notifying them of the incident. Using information from the log, the administrator can take action with the ISP of the hacker. In some types of intrusions, the firewall can fend off the hacker by discarding all further packets from the hackers IP address for a period of time. Stateful Packet Inspection Unlike simple Internet sharing routers, a firewall uses a process called stateful packet inspection to ensure secure firewall filtering to protect your network from attacks and intrusions. Since user-level applications such as FTP and Web browsers can create complex patterns of network traffic, it is necessary for the firewall to analyze groups of network connection states. Using Stateful Packet Inspection, an incoming packet is intercepted at the network layer and then analyzed for state-related information associated with all network connections. A central cache within the firewall keeps track of the state information associated with all network connections. All traffic passing through the firewall is analyzed against the state of these connections in order to determine whether or not it will be allowed to pass through or rejected. Denial of Service Attack A hacker may be able to prevent your network from operating or communicating by launching a Denial of Service (DoS) attack. The method used for such an attack can be as simple as merely flooding your site with more requests than it can handle. A more sophisticated attack may attempt to exploit some weakness in the operating system used by your router or gateway. Some operating systems can be disrupted by simply sending a packet with incorrect length information.

Verify the following settings as shown: Client for Microsoft Network exists Ethernet adapter is present TCP/IP is present Primary Network Logon is set to Windows logon
Click on the Properties button. The following TCP/IP Properties window will display.
By default, the IP Address tab is open on this window. Verify the following: Obtain an IP address automatically is selected. If not selected, click in the radio button to the left of it to select it. This setting is required to enable the DHCP server to automatically assign an IP address. Click OK to continue. Restart the PC. Repeat these steps for each PC with this version of Windows on your network.
Selecting Windows Internet Access Method
On the Windows taskbar, click the Start button, point to Settings, and then click Control Panel. Double-click the Internet Options icon. Select I want to set up my Internet connection manually or I want to connect through a Local Area Network and click Next. Select I want to connect through a Local Area Network and click Next. Uncheck all boxes in the LAN Internet Configuration screen and click Next. Proceed to the end of the Wizard.
Verifying TCP/IP Properties
After your PC is configured and has rebooted, you can check the TCP/IP configuration using the utility winipcfg.exe:
On the Windows taskbar, click the Start button, and then click Run.
Type winipcfg, and then click OK. The IP Configuration window opens, which lists (among other things), your IP address, subnet mask, and default gateway.
From the drop-down box, select your Ethernet adapter. The window is updated to show your settings, which should match the values below if you are using the default TCP/IP settings that NETGEAR recommends for connecting through a router or gateway: The IP address is between 192.168.0.2 and 192.168.0.254 The subnet mask is 255.255.255.0 The default gateway is 192.168.0.1
Configuring Windows NT4, 2000 or XP for IP Networking
As part of the PC preparation process, you may need to install and configure TCP/IP on each networked PC. Before starting, locate your Windows CD; you may need to insert it during the TCP/IP installation process.

1. 2. 3. 4. 5. 6. 7. 8.

On the Windows taskbar, click the Start button, point to Settings, and then click Control Panel. Double-click the Network and Dialup Connections icon. If an Ethernet adapter is present in your PC, you should see an entry for Local Area Connection. Double-click that entry. Select Properties. Verify that Client for Microsoft Networks and Internet Protocol (TCP/IP) are present. If not, select Install and add them. Select Internet Protocol (TCP/IP), click Properties, and verify that Obtain an IP address automatically is selected. Click OK and close all Network and Dialup Connections windows. Then, restart your PC.

DHCP Configuration of TCP/IP in Windows XP, 2000, or NT4
DHCP Configuration of TCP/IP in Windows XP
Locate your Network Neighborhood icon. Select Control Panel from the Windows XP new Start Menu. Select the Network Connections icon on the Control Panel. This will take you to the next step.
Now the Network Connection window displays. The Connections List that shows all the network connections set up on the PC, located to the right of the window. Right-click on the Connection you will use and choose Status.
Now you should be at the Local Area Network Connection Status window. This box displays the connection status, duration, speed, and activity statistics. Administrator logon access rights are needed to use this window. Click the Properties button to view details about the connection.
The TCP/IP details are presented on the Support tab page. Select Internet Protocol, and click Properties to view the configuration information.
Verify that the Obtain an IP address automatically radio button is selected. Verify that Obtain DNS server address automatically radio button is selected. Click the OK button. This completes the DHCP configuration of TCP/ IP in Windows XP. Repeat these steps for each PC with this version of Windows on your network.
DHCP Configuration of TCP/IP in Windows 2000
Once again, after you have installed the network card, TCP/IP for Windows 2000 is configured. TCP/IP should be added by default and set to DHCP without your having to configure it. However, if there are problems, follow these steps to configure TCP/IP with DHCP for Windows 2000.
Click on the My Network Places icon on the Windows desktop. This will bring up a window called Network and Dial-up Connections. Right click on Local Area Connection and select Properties.
The Local Area Connection Properties dialog box appears. Verify that you have the correct Ethernet card selected in the Connect using: box. Verify that at least the following two items are displayed and selected in the box of Components checked are used by this connection: Client for Microsoft Networks and Internet Protocol (TCP/IP)

Click OK.

With Internet Protocol (TCP/IP) selected, click on Properties to open the Internet Protocol (TCP/IP) Properties dialogue box. Verify that Obtain an IP address automatically is selected. Obtain DNS server address automatically is selected.
Click OK to return to Local Area Connection Properties.
Click OK again to complete the configuration process for Windows 2000. Restart the PC. Repeat these steps for each PC with this version of Windows on your network.
DHCP Configuration of TCP/IP in Windows NT4
Once you have installed the network card, you need to configure the TCP/IP environment for Windows NT 4.0. Follow this procedure to configure TCP/IP with DHCP in Windows NT 4.0.

If you do not see these values, you may need to restart your Macintosh or you may need to switch the Configure setting to a different option, then back again to Using DHCP Server.
Verifying the Readiness of Your Internet Account
For broadband access to the Internet, you need to contract with an Internet service provider (ISP) for a single-user Internet access account using a cable modem or DSL modem. This modem must be a separate physical box (not a card) and must provide an Ethernet port intended for connection to a Network Interface Card (NIC) in a computer. Your firewall does not support a USB-connected broadband modem. For a single-user Internet account, your ISP supplies TCP/IP configuration information for one computer. With a typical account, much of the configuration information is dynamically assigned when your PC is first booted up while connected to the ISP, and you will not need to know that dynamic information. In order to share the Internet connection among several computers, your firewall takes the place of the single PC, and you need to configure it with the TCP/IP information that the single PC would normally use. When the firewalls Internet port is connected to the broadband modem, the firewall appears to be a single PC to the ISP. The firewall then allows the PCs on the local network to masquerade as the single PC to access the Internet through the broadband modem. The method used by the firewall to accomplish this is called Network Address Translation (NAT) or IP masquerading.
Are Login Protocols Used?
Some ISPs require a special login protocol, in which you must enter a login name and password in order to access the Internet. If you normally log in to your Internet account by running a program such as WinPOET or EnterNet, then your account uses PPP over Ethernet (PPPoE). When you configure your router, you will need to enter your login name and password in the routers configuration menus. After your network and firewall are configured, the firewall will perform the login task when needed, and you will no longer need to run the login program from your PC. It is not necessary to uninstall the login program.
What Is Your Configuration Information?

802.11b Authentication

The 802.11b standard defines several services that govern how two 802.11b devices communicate. The following events must occur before an 802.11b Station can communicate with an Ethernet network through an access point such as the one built in to the MR814v2:
Turn on the wireless station. The station listens for messages from any access points that are in range. The station finds a message from an access point that has a matching SSID. The station sends an authentication request to the access point. The access point authenticates the station. The station sends an association request to the access point. The access point associates with the station. The station can now communicate with the Ethernet network through the access point.
An access point must authenticate a station before the station can associate with the access point or communicate with the network. The IEEE 802.11b standard defines two types of authentication: Open System and Shared Key. Open System Authentication allows any device to join the network, assuming that the device SSID matches the access point SSID. Alternatively, the device can use the ANY SSID option to associate with any available Access Point within range, regardless of its SSID.
Shared Key Authentication requires that the station and the access point have the same WEP Key to authenticate. These two authentication procedures are described below.
Open System Authentication
The following steps occur when two devices use Open System Authentication:
The station sends an authentication request to the access point. The access point authenticates the station. The station associates with the access point and joins the network.
This process is illustrated in below.
802.11b Authentication Open System Steps
1) Authentication request sent to AP 2) AP authenticates

IN TER N ET

Cable/DSL

Access Point

W LA N

LO CA L

ProSafeWirelessVPN Security Firewall

PWR TEST

FVM318

LNK ACT Enable 7 8

LNK/ACT
Client attempting to connect
3) Client connects to network

Cable or DLS modem

Figure 7-4: 802.11b open system authentication

Internet and Intranet Calling with PVX

An Application Note

October 18, 2004
2004 POLYCOM, INC. ALL RIGHTS RESERVED. POLYCOM, THE POLYCOM LOGO, PVX, VIAVIDEO, AND PEOPLE+CONTENT ARE REGISTERED TRADEMARKS OF POLYCOM, INC. IN THE UNITED STATES AND OTHER COUNTRIES. ALL OTHER TRADEMARKS ARE THE PROPERTY OF THEIR RESPECTIVE COMPANIES.
INTERNET AND INTRANET CALLING WITH PVX

Contents

Before You Begin.... 2
System Requirements.... 2 Installing PVX..... 4 Activating Your PVX Software... 4 Directory Setup.... 4
Running the Setup Wizard... 4
Setup Setup Setup Setup for for for for Calling Calling Calling Calling Within an Intranet... 5 Within a Virtual Private Network (VPN).. 5 Through a DSL or Cable Modem... 8 Through a Network Router... 8
Configuring Your Connection from the PVX Application.. 15 Testing and Troubleshooting.. 15
Software Firewalls....16 Calling Speed and Bandwidth...16 Network Issues....18 Test Call....18 Uninstall PVX.....18
Advanced Router Setup... 18

POLYCOM, INC.

PVX is an advanced conferencing software application that delivers Polycom's premium quality audio, video, and content sharing to your PC and standard USB camera. PVX brings unprecedented video conferencing technology to your desktop PC with the first software application ever offered by the industry leader. Using the industrys highest quality audio/video algorithms, PVX is the only PC application to offer both secure communications and People+Content. PVX supports most standard web cams, eliminating the need for a separate video camera. When used in conjunction with a laptop and portable USB camera, PVX provides the ultimate in portability. This application note explains how to configure PVX for the broadband connection in your office, home office, or small business. Refer to this document for the system settings that will maximize video conferencing performance without compromising your network security.

Before You Begin

System Requirements
Please make sure that your PC meets the minimum system requirements listed in the following table. If your PC does not meet the requirements, you will not be able to make PVX calls.
NOTE: If you are running on a laptop PC, be sure to have the AC power plugged in before starting Windows to ensure the CPU is running in full power mode.

Table 1 Windows

System Requirements Windows 2000 with Service Pack 4 or later Windows XP with Service Pack 1 or later

PC Processor

Polycom ViaVideo and ViaVideo II camera People Video only: 800 MHz Intel Pentium III Any Intel Pentium 4 or Intel Pentium M 1800+ Athlon XP People+Content: 1.2 GHz Intel Pentium MHz Intel Pentium M 1800+ Athlon XP
Web Cam with PC processing H.263 People Video only: 1.0 GHz Intel Pentium 3 1.2 GHz Intel Pentium MHz Intel Pentium M 1800+ Athlon XPH.264 People Video only: 1.5 GHz Intel Pentium 4 1800+ Athlon XP People+Content: 2.0 GHz Intel Pentium 4 1.4 GHz Intel Pentium M 2200+ Athlon XP (Polycom PVX requires a processor that supports the Intel SSEprocessor extensions. SSE is not supported on the Pentium II family or Athlon CPUs prior to the Athlon XP.) RAM Video Memory Hard Drive Space USB Camera supported Speakers or Headset 256 MB 8 MB 60 MB available (for Polycom PVX software) USB 1.x or 2.x web cam, ViaVideo, or ViaVideo II camera (camera is optional for view-only calls) Headphones Headset with microphone Computer speakers (external or internal) Speakers connected directly to ViaVideo Monitor Network Access Microsoft Internet Explorer Windows Media Microsoft DirectX Software SVGA (800 x 600) or higher resolution Broadband IP (64 kbps and above) Version 6.0 or later Player Version 9.0 or later Version 9.0b or later Find out the current version on your computer using the DirectX Diagnostic Tool by clicking Start > Run and entering dxdiag. Download the latest update from http://www.microsoft.com/windows/Directx/.

Installing PVX

For instructions on installing PVX, see the software CD packaging. Also refer to the PVX Release Notes.
Activating Your PVX Software
When you start PVX, the application prompts you to activate your software. You can either enter the activation codes or simply click Continue if you prefer to use the evaluation version. The evaluation version allows you to make unlimited five minute conferences. PVX will prompt you to activate your software every time it starts until a valid activation key is entered. If you would like to have a full version, please contact Polycom reseller or go to www.polycom.com to purchase PVX with an activation number.

Directory Setup

When you set up PVX, you can choose to register with the following services: Global Directory Service (GDS) - Select Register with this Server if you want to call one another using the directory in PVX. GDS is a global address book that Polycom provides on the Internet. Internet Locator Server (ILS) Select Register with this Server if your company has an ILS. Enter the name or IP address or the server in the entry field. Obtain the name of the server from your companys network administrator. In addition to calling one another using the directory, you can also make calls using the DNS name (your computer name), IP address, or an H.323 extension by using a Gatekeeper.

Running the Setup Wizard

The first time you start PVX, a wizard guides you through the initial setup. This section provides additional information you will need on some of the wizard pages to enable calling on the following types of connections:
Within an Intranet Within a Virtual Private Network (VPN) Through a DSL or cable modem (no router) Through a network router
Refer to the appropriate section for your particular connection.
If you need to change your connection setup after you have finished the setup wizard, you can do so through the PVX application. For more information, refer to Configuring Your Connection from the PVX Application in this application note.
Setup for Calling Within an Intranet
Intranet calls remain inside the firewall, so you can communicate with anyone in your office network. Enter this information in the setup wizard screens if you are setting up PVX for calling within your company network: NAT Detected dialog box: If the wizard asks whether to use the external WAN address, click No. Select Use the PCs Local IP Address to make Intranet calls.
If you need to use PVX to make external calls outside of your Intranet, please check with your network administrator. Calls outside of your Intranet require changes in the firewall settings to allow video through specific ports. Network administrators oversee firewall configurations for enabling calls to and from the Internet.
Setup for Calling Within a Virtual Private Network (VPN)
VPN is a private network that uses the public network (the Internet) for secured communication. Many offices use a virtual private network (VPN) to connect multiple locations, such as home offices and remote branch offices. With a VPN connection, users have full access to their company network, whether they are located remotely or at the central offices. Calls within your company VPN remain within the firewall, so you can communicate with anyone in your office network without configuring PVX for connecting externally to the Internet. This way, users can make calls using the directory and all other communication equipment they have in the office.

Calls outside of your VPN require changes in the firewall settings to allow video through specific ports. Please contact your network administrator.
Start your VPN client and establish a connection before starting PVX. Enter this information in the setup wizard screens:
NAT Detected dialog box: If the wizard asks whether to use the external WAN address, click No. Network Setup page: Select Use VPN or Secondary Network Adapter.

Figure 2

PVX Network Setup for VPN
When you connect to your VPN, your companys network assigns you an address. This is different from the address assigned by your router. To make calls through your VPN, you must choose the VPN as your network adapter.
After you finish the wizard, start PVX and click Setup > Network to open the Network tab. Click the Address Setup button and select your VPN connection from the Designate Network Adapter list. Click OK in Address Setup box and OK in Network Setup.
If your VPN is not listed in the network adapter list, please refer to the user manual for your VPN client to find out how to get the address manually.
Figure 3 Network Setup for VPN
When you connect to your VPN, your companys network assigns you an address. This is different from the address assigned by your router. To make calls through your VPN, you must choose the VPN as your network adapter. If your VPN is not listed in the network adapter list, please refer to the user manual for your VPN client to find out how to find the address.
Setup for Calling Through a DSL or Cable Modem
Use the following instructions for setting up PVX on a computer that accesses the Internet directly through a DSL or cable modem with no network router. Calls across the public Internet typically pass through a firewall that protects the computer from unsolicited traffic from the outside. Computers connected directly to a broadband modem often use software-based firewall. If you have firewall software installed on your computer, you may need to disable or configure the software. See the Testing and Troubleshooting section of this document for more information. Enter this information in the setup wizard screens: NAT Detected dialog box: If the wizard asks whether to use the external WAN address, click No. Network Setup page: Select Use the PCs Local IP Address.

Figure 4

PVX Network Setup for DSL or Cable Modem
Setup for Calling Through a Network Router
Network routers enable multiple computer resources to share a high-speed Internet connection such as Digital Subscriber Lines (DSL) or cable. Most routers for Small Office Home Office (SOHO) networks include a firewall to protect the network by controlling unsolicited traffic from outside the network.

To allow video conferencing traffic to pass in and out of your local network, you must open ports in the firewall or your router will block the request. Routers also provide Network Address Translation (NAT). NAT uses private internal IP addresses for the devices within the network while using a single external IP address to communicate outside the network. NAT adds an extra level of security by effectively masking the internal network behind a single external IP address. PVX supports video calls behind a firewall. In order to run PVX through a network router and firewall, you must open specific ports for video conferencing. You assign the open ports to the internal IP address (as defined by NAT) of the computer running PVX. This process is known as port forwarding or pinholing. This application note provides procedures for port forwarding on the most common routers. If you have firewall software installed on your computer in addition to the router firewall, you may need to disable or configure the software. See the Testing and Troubleshooting section of this document for more information. Enter this information in the setup wizard screens: NAT Detected dialog box: If the wizard asks whether to use the external WAN address, click Yes. Network Setup page: Select Use External (WAN) IP Address and select Use Fixed Ports (3230 and 3235).

Figure 5

PVX Network Setup for Calling Through a Router
Verify that the External (WAN) IP Address is the correct number provided by your ISP. Most routers list the external IP address on a router status page. If you need to change the IP address, finish the wizard, start PVX, Setup > Network to open the Network tab. Enter the correct and click External (WAN) IP Address and click OK. You must also configure your router before you can make calls with PVX. Please continue to the next section, Configure Router Port Forwarding.
Configure Router Port Forwarding
This section provides instructions for opening and assigning ports in the most common routers from NetGear, Linksys, and D-Link. Most other routers require similar procedures. Before you can change your router configuration, you must have the following: The IP address of your router. Consult your routers user documentation for the IP address. (Note that many routers use the default address 192.168.0.1.) Your routers administrator name and password. Consult your routers user documentation for the user name and password. (Note that many routers use the default user name admin and password blank or password.) The IP address that the NAT has assigned to your computer.

To obtain the IP address that a NAT has assigned to a specific Windows XP computer, click Start > Settings > Network Connection > LAN and select the Support tab. The Details window shows the IP address. PVX also lists the local IP address in the main window.
With any router brand or model, you will open the ports listed in the following table. Table 2 PORT 1720 3230-(optional) Router Ports to Open FUNCTION H.323 Call setup Signaling and control for audio, call, video and data/FECC T.120 Data collaboration TCP or UDP TCP TCP and UDP TCP

NetGear Routers

The following procedure applies to NetGear MR814v2 and RP614v2 routers. The screens and settings may vary slightly for different NetGear models. The procedures assume that your router is correctly configured and connected to the Internet and that your network is operational. To configure a NetGear router: 1. In a browser such as Internet Explorer, type the IP address of your router. Consult your NetGear user documentation for the IP address.

2. 3. 4. 5.

Log in to your router setup. Consult your NetGear user documentation for the user name and password. From the Advanced menu on the left of the page, select Port Forwarding. On the Port Forwarding page, select Add Custom Service. On the Ports-Custom Services page, enter the following information for the first port in Table 2. Service Name: Starting Point: Ending Point: Server IP Address: Any unique identifier such as the Function listed in Table 2. The Port listed in Table 2 or the starting value of the range listed in Table 2. The Port listed in Table 2 or the ending value of the range listed in Table 2. The IP address that the NAT has assigned to your computer.
NetGear routers automatically pass TCP and UDP traffic through the same port. You do not have to designate TCP or UDP when you open ports.

6. 7. 8.

Click Apply. Repeat steps 46 of this procedure for the remaining ports in Table 2. When you have opened and assigned all of the ports in Table 2, review the Port Forwarding page. Check that all of the ports are correct, enabled, and assigned to the correct Server IP (internal) Address.

Figure 6

Port Forwarding on NetGear Router 11

Linksys Routers

The following procedure applies to the Linksys BEFSX41 router. The screens and settings may vary slightly for different Linksys models. To configure a Linksys router: 1. 2. 3. In a browser such as Internet Explorer, type the IP address of your router. Consult your Linksys user documentation for the IP address. Log in to your router setup. Consult your Linksys user documentation for the user name and password. Locate the Port Range Forwarding page. (Depending on your router model, Port Range Forwarding may be listed in the Advanced or the Applications and Gaming menu.) On the Port Range Forwarding page, enter the following information for the first port in Table 2. Application Start End TCP/UDP Any unique identifier such as the Function listed in Table 2. The Port listed in Table 2 or the starting value of the range listed in Table 2. The Port listed in Table 2 or the ending value of the range listed in Table 2. The selection listed in Table 2. Where Table 2 lists both TCP and UDP, enter the Application twice once as TCP and once as UDP. The IP address (internal) that the NAT has assigned to your computer. Click this box.

IP Address Enabled

Repeat step 4 of this procedure for the remaining ports in Table 2. When you have opened and assigned all of the ports listed in Table 2, review the Port Range Forwarding list. Check that all of the ports are correct, enabled, and assigned to the correct IP (internal) Address as shown in the following figure.

Figure 7

Port Range Forwarding on Linksys Router

D-Link Routers

The following procedure applies to the D-Link DI-604 router. The screens and settings may vary slightly for different D-Link models. To configure a D-Link router: 1. 2. 3. 4. 5. In a browser such as Internet Explorer, type the IP address of your router. Consult your D-Link user documentation for the IP address. Log in to your router setup. Consult your D-Link user documentation for the user name and password. Select the Advanced tab. Click the Firewall button. On the Firewall page, enter the following information for each port in Table 2. Enabled Name Action Source Click this radio button. Any unique identifier such as the Function listed in Table 2. Select Allow. Interface: WAN IP Range Start: * IP Range End: (blank) Destination Interface: LAN IP Range Start: The IP address (internal) that the NAT has assigned to your computer. IP Range End: (blank) Protocol: TCP, UDP or * for both Port Range: The Port listed in Table 2 or the start and ending value of the range listed in Table 2. Schedule Always (or select a time for the port to be open).
When you have opened and assigned all of the ports listed in Table 2, review the Firewall Rules list. Check that all of the ports are correct, enabled, and assigned to the correct IP (internal) Address as shown in the following figure.

Figure 8

Firewall Rules on D-Link Router

Set up a DMZ

Some users may prefer to set up a PVX computer in a demilitarized zone (DMZ). A DMZ can be a quick way to configure PVX without opening specific ports individually. DMZ is a firewall configuration that opens all of the ports through the router to a specific computer and places the computer outside of the firewall. Other devices within the network remain within the protection of the firewall. By isolating the computer with open ports, DMZ protects the rest of the network from exposure. If outside users penetrated the security of the DMZ computer, they could not gain access to any other computers on the network. However, PVX requires only a limited number of open ports, so the advantage of opening all ports by running in a DMZ is minimal. If you choose to set up a DMZ, please refer to your routers user manual for instructions.
Configuring Your Connection from the PVX Application
If you need to change your connection settings after you finish the setup wizard, you can do so through the PVX application. To change your connection settings: 1. 2. In PVX, click Setup > Network to open the Network tab.
On the Network Setup page, configure the selections for your connection as follows. If you are setting up this type of connection: INTRANET Do the following: Select Use PCs Local Address. Click Apply. VPN Select Use VPN Address or Secondary Network Adapter** Click Address Setup. If you have already logged on to VPN, the Designate Network Adapter lists your VPN connection. Select your connection and click OK. Otherwise, select Manually Enter IP Address and enter the VPN address obtained from your VPN client. On the Setup page, click Apply. DSL or CABLE MODEM Select Use PCs Local Address. Click Apply. NETWORK ROUTER Select Use the External (WAN) IP Address. Enter your external (WAN) IP address. Your external IP address is the number provided by your ISP. Most routers list the external IP address on a router status page. Select Use Fixed Ports (3230 and 3235). Click Apply. Reboot your router.

Testing and Troubleshooting
Please refer to the PVX Release Notes for troubleshooting information including audio, video, camera, and calling issues.
If your call connects but users cannot view the incoming video (black screen), please follow these steps: 1. 2. 3. 4. If you cannot see another user, verify that his or her camera is working. If other users cannot see you, verify that your camera is working. Verify that you have correctly followed the setup instructions. Refer to this section for possible causes.

Software Firewalls

Many systems run software-only firewall packages from Microsoft or other products such as Zone Labs, Black Ice, Norton Firewall, and McAfee Firewall. Firewalls may interfere with video communications connection.

Windows XP

Users with the Windows XP operating system will not be able to place or receive video calls if the Internet Connection Firewall is enabled. To correct this: 1. 2. 3. 4. Right-click My Network Connections. Select Network Properties. In Local Area Connection Properties, select Advanced. Clear the Internet Connection Firewall option.
Users running Windows XP Service Pack 2 may experience difficulty establishing a connection to incoming calls through a firewall. If this occurs, do the following: 1. 2. 3. 4. Click Start and then choose Settings > Control Panel. Select Windows Firewall. Select Exceptions. Confirm the vvsys.exe and Windows NetMeeting check boxes are selected.

Zone Labs

If you are using the free downloadable version of Zone Labs firewall and virus protection, turn the software off while using PVX. If you are using other Zone Labs products, refer to the user documentation for blocking and unblocking ports.
Calling Speed and Bandwidth
Bandwidth rate is the connection speed, or the number of bits per second of data that can travel through a system or line. PVX is capable of up to 2 mbps. However, PVX requires 128 kbps minimum to connect a call.
It is important to note that high-speed DSL and cable services advertise bandwidth rates up to a specific speed. When a DSL or cable service claims connections up to 1.5 mbps, for example, this connection speed is a maximum and is not guaranteed. Moreover, most ISPs do not provide bi-directional bandwidth, in which the upload rate is the same as the download rate. With most DSL and cable services, downloading is much faster than uploading. Downloading speed may be up to 1.5 mbps, but uploading speed is typically in the order of 384 kbps for DSL and 256 kbps for cable. When you specify a dialing speed for PVX to use on your system, PVX uses the same specified rate for both upload and download. If any computer in the video conference cannot upload at the speed you specified, your calls may suffer from poor video quality or you may not be able to view video at all (black screen). For best results, ask your Internet Service Provider for their upstream speed, or their guaranteed bandwidth rate for uploading. Start by setting the PVX dialing speed to the minimum rate claimed by your ISP and test your connection with faster settings. To change your PVX call speed: 1. 2. In PVX, click to open the Setup page. Select H.323 from the menu on the left of the page. On the H.323 page, select the Dynamic Bandwidth option to minimize the impact of bandwidth variation. Click the call Speed button. On the Select Speeds page, select a Default Call Rate that matches your ISP upstream speed (128 kbps recommended).

Figure 9

Setting Call Speed

Network Issues

If your router ports are forwarded correctly but you still cannot view video, try setting up your router and PVX in the following order: 1. 2. 3. 4. Configure port forwarding on your router. Configure the PVX network setup. Reboot the router. Start PVX.
PVX may not function properly if more than one network connection is used simultaneously.

Test Call

Polycom offers customers global access to a variety of video conferencing equipment. Feel free to utilize these numbers to conduct testing of your video conferencing units. www.polycom.com/videotest

Uninstall PVX

If you need to uninstall PVX, insert the installation CD to start the installation wizard. From the Welcome page, select Remove.

Advanced Router Setup

The following ports are for advanced PVX features. GMS Ports: 21 (FTP) Software Updates & Provisioning 80 (HTTP) Pulling ViewStation/VS4000 info 3601 (Proprietary) (Data Traffic) GAB data 3603 - TCP Pulling ViaVideo info (since might be non-web server PC) 389 - (LDAP and ILS) 1002 - (ILS) GMS listens for connections on ports 80 and 3601 (GAB) and in the future will listen on port 3604 (ViaVideo) and other potentials later. H.323 Ports: 80 - Static TCP - HTTP Interface (optional) 389 - Static TCP - ILS Registration (LDAP) 1503 - Static TCP - T.- Static UDP - Gatekeeper discovery (Must be bidirectional) 1719 - Static UDP - Gatekeeper RAS (Must be bidirectional)
1024-65535 1024-65535 1024-65535 1024-65535
Dynamic Dynamic Dynamic Dynamic
TCP H245 UDP - RTP (Video data) UDP - RTP (Audio data) UDP RTCP (Control Information)
3604 (GMS Server Discovery)(Used by ViaVideo)(Broadcast) Accord (Polycom Network Systems) Additional Ports: 5001 Static TCP MGC Manager (5003 can be chosen instead within MGC) 21 Static TCP FTP (retrieve MGC config. Files etc.) RADVision Additional: 1820 - Gateway Signaling/Call Setup 2720 - MCU Signaling/Call Setup