adapt to dynamic protocols. The flexible nature of Stateful Inspection firewalls generally provides the best speed and transparency, however, they may lack the granular application level access control or caching that some proxies support. 4. What kind of firewall is the P-660? 1. The P-660's firewall inspects packets contents and IP headers. It is applicable to all protocols, that understands data in the packet is intended for other layers, from network layer up to the application layer. 2. The P-660's firewall performs stateful inspection. It takes into account the state of connections it handles so that, for example, a legitimate incoming packet can be matched with the outbound request for that packet and allowed in. Conversely, an incoming packet masquerading as a response to a nonexistent outbound request can be blocked. 3. The P-660's firewall uses session filtering, i.e., smart rules, that enhance the filtering process and control the network session rather than control individual packets in a session. 4. The P-660's firewall is fast. It uses a hashing function to search the matched session cache instead of going through every individual rule for a packet. 5. The P-660's firewall provides email service to notify you for routine reports and when alerts occur. 5. Why do you need a firewall when your router has packet filtering and NAT built-in? With the spectacular growth of the Internet and online access, companies that do business on the Internet face greater security threats. Although packet filter and NAT restrict access to particular computers and networks, however, for the other companies this security may be insufficient, because packets filters typically cannot maintain session state. Thus, for greater security, a firewall is considered. 6. What is Denials of Service (DoS) attack? Denial of Service (DoS) attacks are aimed at devices and networks with a connection to the Internet. Their goal is not to steal information, but to disable a device or network so users no longer have access to network resources. There are four types of DoS attacks: 1. Those that exploits bugs in a TCP/IP implementation such as Ping of Death and Teardrop. 2. Those that exploits weaknesses in the TCP/IP specification such as SYN Flood and LAND Attacks. 3. Brute-force attacks that flood a network with useless data such as Smurf attack.
4. IP Spoofing 7. What is Ping of Death attack? Ping of Death uses a 'PING' utility to create an IP packet that exceeds the maximum 65535 bytes of data allowed by the IP specification. The oversize packet is then sent to an unsuspecting system. Systems may crash, hang, or reboot. 8. What is Teardrop attack? Teardrop attack exploits weakness in the reassemble of the IP packet fragments. As data is transmitted through a network, IP packets are often broken up into smaller chunks. Each fragment looks like the original packet except that it contains an offset field. The Teardrop program creates a series of IP fragments with overlapping offset fields. When these fragments are reassembled at the destination, some systems will crash, hang, or reboot. 9. What is SYN Flood attack? SYN attack floods a targeted system with a series of SYN packets. Each packet causes the targeted system to issue a SYN-ACK response, While the targeted system waits for the ACK that follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is known as a backlog queue. SYN-ACKs are moved off the queue only when an ACK comes back or when an internal timer (which is set a relatively long intervals) terminates the TCP three-way handshake. Once the queue is full, the system will ignore all incoming SYN requests, making the system unavailable for legitimate users. 10. What is LAND attack? In a LAN attack, hackers flood SYN packets to the network with a spoofed source IP address of the targeted system. This makes it appear as if the host computer sent the packets to itself, making the system unavailable while the target system tries to respond to itself. 11 What is Brute-force attack? A Brute-force attack, such as 'Smurf' attack, targets a feature in the IP specification known as directed or subnet broadcasting, to quickly flood the target network with useless data. A Smurf hacker flood a destination IP address of each packet is the broadcast address of the network, the router will broadcast the ICMP echo request packet to all hosts on the network. If there are numerous hosts, this will create a large amount of ICMP echo request packet, the resulting ICMP traffic will not only clog up the 'intermediary' network, but will also congest the network of the spoofed source IP

Set up your workstation 1. Ethernet connection
Connect the LAN ports of all computers and the P-660 to a HUB using a straight Ethernet cable. 2. TCP/IP configuration Since the P-660 is set to DHCP server as default, so you need only to configure the workstations as the DHCP clients in the networking settings. In this case, the IP address of the computer is assigned by the P-660. The P-660 can also provide the DNS to the clients via DHCP if it is available. For this setup in Windows, we check the option 'Obtain an IP address automatically' in its TCP/IP setup. Please see the example shown below.
Set up your P-660 The following procedure shows you how to configure your P-660 as Router mode for routing traffic. We will use SMT menu to guide you through the related menu. You can use console or Telnet for finishing these configurations. 1. Configure P-660 as router mode in Menu 1 General Setup.
Menu 1 General Setup System Name= P-660 Location=
Contact Person's Name= Domain Name= Edit Dynamic DNS= No Route IP= Yes Bridge= No
2. Configure a LAN IP for the P-660 and the DHCP settings in Menu 3.2-TCP/IP Ethernet Setup. The settings except of the DNS addresses shown below are the pre-configured defaults.
Menu 3.2 - TCP/IP and DHCP Setup DHCP Setup DHCP= Server Client IP Pool Starting Address= 192.168.1.33 Size of Client IP Pool= 6 Primary DNS Server= 168.95.1.1 Secondary DNS Server= 168.95.192.1 Remote DHCP Server= N/A TCP/IP Setup: IP Address= 192.168.1.1 IP Subnet Mask= 255.255.255.0 RIP Direction= Both Version= RIP-1 Multicast= None IP Policies= Edit IP Alias= No
3. Configure for Internet setup in Menu 4-Internet Access Setup.
Menu 4 - Internet Access Setup ISP's Name= CHT Encapsulation= PPPoE Multiplexing= LLC-based VPI #= 0 VCI #= 33 ATM QoS Type= CBR Peak Cell Rate (PCR)= 0 Sustain Cell Rate (SCR)= 0 Maximum Burst Size (MBS)= 0 My Login= cso@hinet.net
My Password= ******** Idle Timeout (sec)= 0 IP Address Assignment= Dynamic IP Address= N/A Network Address Translation= SUA Only Address Mapping Set= N/A Press ENTER to Confirm or ESC to Cancel:
Encapsulation Multiplexing VPI & VCI number Single User Account IP Address Assignment IP Address
Select the correct Encapsulation type that your ISP supports. For example, RFC 1483. Select the correct Multiplexing type that your ISP supports. For example, LLC. Specify a VPI (Virtual Path Identifier) and a VCI (Virtual Channel Identifier) given to you by your ISP. Set to Yes if you only have a single IP account for sharing with local computers. Set to Dynamic if the ISP provides the IP for the P-660 dynamically. Otherwise, set to Static and enter the IP in the following IP Address field. This field can not be configured if the ISP provides the IP for the P-660 dynamically. Otherwise, enter the IP that the ISP gives to you.

3. Setup the P-660 as a DHCP Relay What is DHCP Relay? DHCP stands for Dynamic Host Configuration Protocol. In addition to the DHCP server feature, the P-660 supports the DHCP relay function. When it is configured as DHCP server, it assigns the IP addresses to the LAN clients. When it is configured as DHCP relay, it is responsible for forwarding the requests and responses negotiating between the DHCP clients and the server. See figure 1.
Setup the P-660 as a DHCP Client 1. Toggle the DHCP to Relay in menu 3.2 and enter the IP address of the DHCP server in the 'Relay Server Address' field.
Menu 3.2 - TCP/IP and DHCP Ethernet Setup DHCP Setup DHCP= Relay Client IP Pool Starting Address= N/A Size of Client IP Pool= N/A Primary DNS Server= N/A Secondary DNS Server= N/A Relay Server Address= 192.168.1.2 TCP/IP Setup: IP Address= 192.168.1.1 IP Subnet Mask= 255.255.255.0 RIP Direction= Both Version= RIP-1 Multicast= None IP Policies= Edit IP Alias= No Press ENTER to Confirm or ESC to Cancel:
4. SUA Notes Tested SUA/NAT Applications (e.g., Cu-SeeMe, ICQ, NetMeeting)
Introduction Generally, SUA makes your LAN appear as a single machine to the outside world. LAN users are invisible to outside users. However, some applications such as Cu-SeeMe, and ICQ will need to connect to the local user behind the P-660. In such case, a SUA server must be entered in menu 15.2.1 to forward the incoming packets to the true destination behind SUA. Generally, we do not need extra settings of menu 15.2.1 for an outgoing connection. But for some applications we need to configure the menu 15.2.1 to make the outgoing connection work. After the required menu 15.2.1 settings are completed the internal server or client applications can be accessed by using the P-660's WAN IP address. SUA Supporting Table The following are the required menu 15.2.1 settings for the various applications running SUA mode. ZyXEL SUA Supporting Table1 Required Settings in Menu 15.2.1 Port/IP Application Outgoing Connection HTTP FTP TELNET None None None Incoming Connection 80/client IP 21/client IP 23/client IP (and remove Telnet filter in WAN port) 110/client IP 25/client IP.

POP3 SMTP mIRC

None None None for Chat. For DCC, please set Default/Client IP

Windows PPTP ICQ 99a

1723/client IP
None for Chat. Default/client IP For DCC, please set: ICQ -> preference -> connections -> firewall and set the firewall time out to 80 seconds in firewall setting. None for Chat None None
ICQ 2000b ICQ Phone 2000b Cornell 1.1 Cu-SeeMe White Pine 3.1.2 Cu-SeeMe White Pine 4.0 Cu-SeeMe Microsoft NetMeeting 2.1 & 3.013 Cisco IP/TV 2.0.0 RealPlayer G2 VDOLive Quake1.06

Menu 15.2.1 - NAT Server Setup (Used for SUA Only) Rule Start Port No. End Port No. IP Address --------------------------------------------------1. Default Default 0.0.0.0 2. 192.168.1.33 3. 192.168.1.36
4. 5. 6. 7. 8. 9. 10. 11. 12.
Press ENTER to Confirm or ESC to Cancel:
The most often used port numbers are shown in the following table. Please refer RFC 1700 for further information about port numbers.
Service FTP Telnet SMTP DNS (Domain Name Server) www-http (Web) PPTP (Point-to-Point Tunneling Protocol) Examples

Port Number 80 1723

Internet Access Only Internet Access with an Internal Server Using Multiple Global IP addresses for clients and servers Support Non NAT Friendly Applications
1. Internet Access Only In our Internet Access example, we only need one rule where all our ILAs map to one IGA assigned by the ISP. See the following figure.
Menu 4 - Internet Access Setup ISP's Name= CHT Encapsulation= PPPoE Multiplexing= LLC-based VPI #= 0 VCI #= 33 ATM QoS Type= CBR Peak Cell Rate (PCR)= 0 Sustain Cell Rate (SCR)= 0 Maximum Burst Size (MBS)= 0 My Login= cso@hinet.net My Password= ******** Idle Timeout (sec)= 0 IP Address Assignment= Dynamic IP Address= N/A Network Address Translation= SUA Only Address Mapping Set= N/A Press ENTER to Confirm or ESC to Cancel :
From Menu 4 shown above simply choose the SUA Only option from the NAT field. This is the Many-to-One mapping discussed earlier. The SUA read only option from the NAT field in menu 4 and 11.3 is specifically pre-configured to handle this case.
2. Internet Access with an Internal Server
In this case, we do exactly as above (use the convenient pre-configured SUA Only set) and also go to Menu 15.2.1-NAT Server Setup (Used for SUA Only) to specify the Internet Server behind the NAT as shown in the NAT as shown below.
Rule Start Port No. End Port No. IP Address --------------------------------------------------1. Default Default 0.0.0.0 2. 192.168.1.33 3. 0.0.0.0 4. 0.0.0.0 5. 0.0.0.0 6. 0.0.0.0 7. 0.0.0.0 8. 0.0.0.0 9. 0.0.0.0 10. 0.0.0.0 11. 0.0.0.0 12. 0.0.0.0 Press ENTER to Confirm or ESC to Cancel:
3. Using Multiple Global IP addresses for clients and servers (One-to-One, Many-to-One, Server Set mapping types are used)
In this case we have 3 IGAs (IGA1, IGA2 and IGA3) from the ISP. We have two very busy internal FTP servers and also an internal general server for the web and mail. In this case, we want to assign the 3 IGAs by the following way using 4 NAT rules.
Rule 1 (One-to-One type) to map the FTP Server 1 with ILA1 (192.168.1.10) to IGA1. Rule 2 (One-to-One type) to map the FTP Server 2 with ILA2 (192.168.1.11) to IGA2. Rule 3 (Many-to-One type) to map the other clients to IGA3. Rule 4 (Server type) to map a web server and mail server with ILA3 (192.168.1.20) to IGA3. Type Server allows us to specify multiple servers, of different types, to other machines behind NAT on the LAN.

A filter for blocking the web service Configuration Before configuring a filter, you need to know the following information: 1. The outbound packet type (protocol & port number) 2. The source IP address Generally, the outbound packets for Web service could be as following: a. HTTP packet, TCP (06) protocol with port number 80 b. DNS packet, TCP (06) protocol with port number 53 or c. DNS packet, UDP (17) protocol with port number 53 For all workstation on the LAN, the source IP address will be 0.0.0.0. Otherwise, you have to enter an IP Address for the workstation you want to block. See the procedure for configuring this filter below. 1. Create a filter set in Menu 21, e.g., set 1 2. Create three filter rules in Menu 21.1.1, Menu 21.1.2, Menu 21.1.3 Rule 1- block the HTTP packet, TCP (06) protocol with port number 80 Rule 2- block the DNS packet, TCP (06) protocol with port number 53 Rule 3- block the DNS packet, UDP (17) protocol with port number 53
3. Apply the filter set in menu 4
1. Create a filter set in Menu 21
Menu 21 - Filter Set Configuration Filter Filter Set # Comments Set # Comments ------ ---------------------- ----------------1 Web Request 7 _______________ 2 _______________ 8 _______________ 3 _______________ 9 _______________ 4 _______________ 10 _______________ 5 _______________ 11 _______________ 6 _______________ 12 _______________ Enter Filter Set Number to Configure= 1 Edit Comments= Press ENTER to Confirm or ESC to Cancel:
2. Rule 1 for (a). http packet, TCP(06)/Port number 80
Menu 21.1.1 - TCP/IP Filter Rule Filter #: 1,1 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 6 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 80 Port # Comp= Equal Source: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= Port # Comp= None TCP Estab= No More= No Log= None Action Matched= Drop Action Not Matched= Check Next Rule Press ENTER to Confirm or ESC to Cancel:
3.Rule 2 for (b).DNS request, TCP(06)/Port number 53
Menu 21.1.2 - TCP/IP Filter Rule Filter#=1,2 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 6 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 53 Port # Comp= Equal Source: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= Port # Comp= None TCP Estab= No More= No Log= None Action Matched= Drop Action Not Matched= Check Next Rule Press ENTER to Confirm or ESC to Cancel:
4. Rule 3 for (c). DNS packet UDP(17)/Port number 53

Menu 21.1.2 - TCP/IP Filter Rule Filter#=1,3 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 17 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 53 Port # Comp= Equal Source: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= Port # Comp= None TCP Estab= No More= No Log= None Action Matched= Drop Action Not Matched= Forward Press ENTER to Confirm or ESC to Cancel:
5. After the three rules are completed, you will see the rule summary in Menu 21.
Menu 21.1 - Filter Rules Summary # A Type Filter Rules Mmn - - ---- -------------------------------------- - - 1 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0,DP=53

NDN NDN NDF

6. Apply the filter set to the 'Output Protocol Filter Set' in the remote node setup A filter for blocking a specific client Configuration 1. Create a filter set in Menu 21, e.g., set 1
Menu 21 - Filter Set Configuration Filter Set # -----Filter Comments ----------------Block a client _______________ _______________ _______________ _______________ _______________ Set # -----Comments ----------------_______________ _______________ _______________ _______________ _______________ _______________
Enter Filter Set Number to Configure= 0 Edit Comments= Press ENTER to Confirm or ESC to Cancel:
2. One rule for blocking all packets from this client
Menu 21.1.1 - TCP/IP Filter Rule Filter #: 1,1 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 0 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= Port # Comp= None Source: IP Addr= 192.168.1.5 IP Mask= 255.255.255.255 Port #= Port # Comp= None TCP Estab= N/A More= No Log= None Action Matched= Drop Action Not Matched= Forward Press ENTER to Confirm or ESC to Cancel:
Key Settings: Source IP addr.Enter the client IP in this field IP Mask.Here the IP mask is used to mask the bits of the IP address given in the 'Source IP Addr=' field, for one workstation it is 255.255.255.255. Action Matched.Set to 'Drop' to drop all the packets from this client Action Not Matched.Set to 'Forward' to allow the packets from other clients 3. Apply the filter set number '1' to the 'Output Protocol Filter Set' field in the remote node setup.

TIME: 37c060 enet0-RECV len:74 call=0 0000: [00 a0 c23 45] [c8 4c ea 63] 0010: 00 3c eb 0c e3 ea ca 84 9b 5d ca 84 0020: 9b 5c 0030: 69 6a 6b 6c 6d 6e 6f 76 0040: 68 69
2. We are now ready to configure the 'Generic Filter Rule' as below.
Menu 21.1.1 - Generic Filter Rule Filter #: 1,1 Filter Type= Generic Filter Rule Active= Yes Offset= 6 Length= 6 Mask= ffffffffffff Value= 0080c84cea63
More= No Log= None Action Matched= Drop Action Not Matched= Forward

Key Settings:

Generic Filter Ruls Set the 'Filter Type' to 'Generic Filter Rule' Active Turn 'Active' to 'Yes' Offset (in bytes) Set to '6' since the source MAC address starts at 7th octets we need to skip the first octets of the destination MAC address.
Length (in bytes) Set to '6' since MAC address has 6 octets. Mask (in hexadecimal) Specify the value that the P-660 will logically qualify (logical AND) the data in the packet. Since the Length is set to 6 octets the Mask for it should be 12 hexadecimal numbers. In this case, we intent to set to 'ffffffffffff' to mask the incoming source MAC address, [c8 4c ea 63].
Value (in hexadecimal) Specify the MAC address [c8 4c ea 63] that the P-660 should use to compare with the masked packet. If the result from the masked packet matches the 'Value', then the packet is considered matched. Action Matched= Enter the action you want if the masked packet matches the 'Value'. In this case, we will drop it. Action Not Matched= Enter the action you want if the masked packet does not match the 'Value'. In this case, we will forward it. If you want to configure more rules please select 'Check Next Rule' to start configuring the next new rule. However, please note that the 'Filter Type' must be also 'Generic Filter Rule' but not others. Because the Generic and TCPIP (IPX) filter rules must be in different filter sets.
Menu 21.1.2 - Generic Filter Rule Filter #: 1,2 Filter Type= Generic Filter Rule Active= Yes Offset= 6 Length= 6 Mask= ffffffffffff Value= 0080c810234a More= No Log= None Action Matched= Drop Action Not Matched= Forward
You can now apply it to the 'General Ethernet Setup' in Menu 3.1. Please note that the 'Generic Filter' can only be applied to the 'Device Filter' but not the 'Protocol Filter' that is used for configuring the TCPIP and IPX filters.

Rule 2-Destination port number 137 with protocol number 17 (UDP)
Menu 21.1.2 - TCP/IP Filter Rule Filter #: 1,2 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 17 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 137 Port # Comp= Equal Source: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 0 Port # Comp= None TCP Estab= N/A More= No Log= None Action Matched= Drop
Action Not Matched= Check Next Rule Press ENTER to Confirm or ESC to Cancel:
Rule 3-Destination port number 138 with protocol number 6 (TCP)
Menu 21.1.3 - TCP/IP Filter Rule Filter #: 1,3 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 6 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 138 Port # Comp= Equal Source: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 0 Port # Comp= None TCP Estab= No More= No Log= None Action Matched= Drop Action Not Matched= Check Next Rule Press ENTER to Confirm or ESC to Cancel:
Rule 4-Destination port number 138 with protocol number 17 (UDP)
Menu 21.1.4 - TCP/IP Filter Rule Filter #: 1,4 Filter Type= TCP/IP Filter Rule
Active= Yes IP Protocol= 17 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 138 Port # Comp= Equal Source: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 0 Port # Comp= None TCP Estab= N/A More= No Log= None Action Matched= Drop Action Not Matched= Check Next Rule Press ENTER to Confirm or ESC to Cancel:
Rule 5-Destination port number 139 with protocol number 6 (TCP)
Menu 21.1.5 - TCP/IP Filter Rule Filter #: 1,5 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 6 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 139 Port # Comp= Equal Source: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 0 Port # Comp= None TCP Estab= No More= No Log= None Action Matched= Drop Action Not Matched= Check Next Rule Press ENTER to Confirm or ESC to Cancel:
Rule 6-Destination port number 139 with protocol number 17 (UDP)
Menu 21.1.6 - TCP/IP Filter Rule Filter #: 1,6 Filter Type= TCP/IP Filter Rule Active= Yes IP Protocol= 17 IP Source Route= No Destination: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 139 Port # Comp= Equal Source: IP Addr= 0.0.0.0 IP Mask= 0.0.0.0 Port #= 0 Port # Comp= None TCP Estab= N/A More= No Log= None Action Matched= Drop Action Not Matched= Forward Press ENTER to Confirm or ESC to Cancel:
After the first filter set is finished, you will get the complete rules summary as below.
Menu 21.2 - Filter Rules Summary # A Type Filter Rules Mmn - - ---- --------------------------------------------- - - 1 Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=Y IP Pr=6, SA=0.0.0.0, DA=0.0.0.0, DP=Y IP Pr=17, SA=0.0.0.0, DA=0.0.0.0, DP=139

4. PPP Log Format: sdcmdSyslogSend( SYSLOG_PPPLOG, SYSLOG_NOTICE, String ); String = ppp:Proto Starting / ppp:Proto Opening / ppp:Proto Closing / ppp:Proto Shutdown Proto = LCP / ATCP / BACP / BCP / CBCP / CCP / CHAP/ PAP / IPCP /IPXCP Example:
Jul 19 11:43:25 192.168.1.1 ZyXEL Communications Corp.: ppp:LCP Starting Jul 19 11:43:29 192.168.1.1 ZyXEL Communications Corp.: ppp:IPCP Starting Jul 19 11:43:34 192.168.1.1 ZyXEL Communications Corp.: ppp:CCP Starting Jul 19 11:43:38 192.168.1.1 ZyXEL Communications Corp.: ppp:BACP Starting
Jul 19 11:43:43 192.168.1.1 ZyXEL Communications Corp.: ppp:IPCP Opening Jul 19 11:43:51 192.168.1.1 ZyXEL Communications Corp.: ppp:CCP Opening Jul 19 11:43:55 192.168.1.1 ZyXEL Communications Corp.: ppp:BACP Opening Jul 19 11:44:00 192.168.1.1 ZyXEL Communications Corp.: ppp:LCP Closing Jul 19 11:44:05 192.168.1.1 ZyXEL Communications Corp.: ppp:IPCP Closing Jul 19 11:44:09 192.168.1.1 ZyXEL Communications Corp.: ppp:CCP Closing Jul 19 11:44:14 192.168.1.1 ZyXEL Communications Corp.: ppp:BACP Closing
10. Using IP Alias What is IP Alias ?
In a typical environment, a LAN router is required to connect two local networks. The P-660 can connect three local networks to the ISP or a remote node, we call this function as 'IP Alias'. In this case, an internal router is not required. For example, the network manager can divide the local network into three networks and connect them to the Internet using P-660's single user account. See the figure below.
The P-660 supports three virtual LAN interfaces via its single physical Ethernet interface. The first network can be configured in menu 3.2 as usual. The second and third networks that we call 'IP Alias 1' and 'IP Alias 2' can be configured in menu 3.2.1-IP Alias Setup. There are three internal virtual LAN interfaces for the P-660 to route the packets from/to the three networks correctly. They are enif0 for the major network, enif0:0 for the IP alias 1 and enif0:1 for the IP alias 2. Therefore, three routes are created in the P-660 as shown below when the three networks are configured. If the P-660's DHCP is also enabled, the IP pool for the clients can be any of the three networks.

What is Call Scheduling ?
Call scheduling enables the mechanism for the P-660 to run the remote node connection according to the pre-defined schedule. This feature is just like the scheduler ina video recorder which records the program according to the specified time. Users can apply at most 4 schedule sets in Menu 11 (Remote Node Setup), and configure each schedule in Menu 26(Schedule Setup). The remote node configured with the schedule set could be "Forced On", "Forced Down", "Enable Dial-On-Demand", or "Disable Dial-On-Demand" on specified date and time.
SMT Menu for Call Scheduling
1. Edit the Schedule sets in menu 26:
Copyright (c) 1994 - 2005 ZyXEL Communications Corp. Prestige 660 Main Menu Getting Started Advanced Management 1. General Setup 21. Filter Set Configuration 2. WAN Backup Setup 22. SNMP Configuration 3. LAN Setup 23. System Password 4. Internet Access Setup 24. System Maintenance 25. IP Routing Policy Setup Advanced Applications 26. Schedule Setup 11. Remote Node Setup 12. Static Routing Setup
14. Dial-in User Setup 99. Exit 15. NAT Setup Enter Menu Selection Number:
2. Select a Schedule Set number and give it a name:
Menu 26 - Schedule Setup Schedule Schedule Set # Name Set # Name ------ ----------------- ------ ----------------1 ZyXEL 7 _______________ 2 _______________ 8 _______________ 3 _______________ 9 _______________ 4 _______________ 10 _______________ 5 _______________ 11 _______________ 6 _______________ 12 _______________ Enter Schedule Set Number to Configure= 1 Edit Name= ZyXEL Press ENTER to Confirm or ESC to Cancel:
3. The Menu 26.1 Schedule Set Setup is as follows:
Menu 26.1 Schedule Set Setup Active= Yes Start Date(yyyy-mm-dd)= 2002 - 01 - 01 How Often= Once Once: Date(yyyy-mm-dd)= 2002 - 01 - 01 Weekdays: Sunday= N/A Monday= N/A Tuesday= N/A Wednesday= N/A Thursday= N/A Friday= N/A Saturday= N/A Start Time(hh:mm)= 12 : 00 Duration(hh:mm)= 16 : 00
Action= Enable Dial-on-demand Press ENTER to Confirm or ESC to Cancel:

Setting up the Access Point with Web configurator
Key settings Select one WEP key as default key to encrypt wireless data transmission. Setting up the Station 1. Double click on the utility icon in your windows task bar or right click the utility icon then select 'Show Config Utility'.
The utility will pop up on your windows screen.
Note: If the utility icon doesn't exist in your task bar, click Start -> Programs -> IEEE802.11b WLAN Card -> IEEE802.11b WLAN Card.
2. Select the 'Encryption' tab. Select encryption type corresponding with access point. Set up 4 Keys which correspond with the WEP Keys of access point. And select on WEP key as default key to encrypt wireless data transmission.
Key settings The WEP Encryption type of station has to equal to the access point.
Check 'ASCII' field for characters WEP key or uncheck 'ASCII' field for Hexadecimal digits WEP key. Hexadecimal digits don't need to preceded by '0x'. For example, 64-bits with characters WEP key : Key1= 2e3f4 Key2= 5y7js Key3= 24fg7 Key4= 98jui 64-bits with hexadecimal digits WEP key : Key1= 123456789A Key2= 23456789AB Key3= 3456789ABC Key4= 456789ABCD

5. Site Survey

Site survey introduction Preparation Survey on site
Introduction What is Site Survey? An RF site survey is a MAP to RF contour of RF coverage in a particular facility. With wireless system it is very difficult to predict the propagation of radio waves and detect the presence of interfering signals. Walls, doors, elevator shafts, and other obstacles offer different degree of attenuation. This will cause the RF coverage pattern be irregular and hard to predict. Site survey can help us overcome these problem and even provide us a map of RF coverage of the facility. Preparation Below are the steps to complete a simple site survey with simple tools. 1. First you will need to obtain a facility diagram, such as blueprints. This is for you to mark and take record on.
2. Visually inspect the facility, walk through the facility to verify the accuracy of the diagram and mark down any large obstacle you see that may effect the RF signal such as metal shelf, metal desk, etc on the diagram. 3. Identify user's area, when doing so ask a question where is wireless coverage needed and where does not, and note and take note on the diagram this is information is needed to determine the number of AP required. 4. Determine the preliminary access point location on the facility diagram base on the service area needed, obstacles, power wall jack considerations. Survey on Site 1. With the diagram with all information you gathered in the preparation phase. Now you are ready to make the survey. 2. Install an access point at the preliminary location. 3. Use a notebook with wireless client installed and run it's utility. An utility will provide information such as connection speed, current used channel, associated rate, link quality, signal strength and etc information as shown in utility below.

<telnet|ftp|web|icmp|snmp|dns> <value>
set server access type load server information display server information
<telnet|ftp|web|snmp> <port>
set server port save server information
<telnet|ftp|web|icmp|snmp|dns> <ip>
set server secure ip addr dump spt raw data dump spt root data dump spt remote node data dump spt user data dump spt slot data save spt data display spt record size clear spt data
display system socket information
netbios disp config <0:LAN to WAN, 1:WAN to LAN, 2:LAN to DMZ, 3:IPSec passthrough, 4:Trigger Dial> <on|off> ddns debug display restart logout cpu display display CPU utilization <level> <iface name> <iface name> <iface name> enable/disable ddns service display ddns information restart ddns logout ddns display netbios filter status config netbios filter

2. Exit Related Commands

Command exit Description exit smt menu
3. Ethernet Related Commands <ch-name> : enet0, mpoa00
Command ether config driver cnt disp <name> clear <name> iface ioctl mac reg rxmod <ch_name> <num> <ch_name> <ch_name> <mac_addr> <ch_name> <ch_name> <mode> display ether driver counters clear ether driver counters send driver iface Useless in this stage. Set LAN Mac address display LAN hardware related registers set LAN receive mode. display LAN configuration information Description
P-660 series Support Notes mode: 1: turn off receiving 2: receive only packets of this interface 3: mode 2+ broadcast 5: mode 2 + multicast 6: all packets see LAN status initialize LAN see ethernet device type disp packet <level> event <ch> [on|off] sap arp mem test pncconfig mac [ch_name] <ch_name> <ip-addr> <addr> <data> [type] <ch_id> <test_id> [arg3] [arg4] <ch_name> <src_ch> <dest_ch> <ipaddr> do pnc config fake mac address set ether test packet display level turn on/off ether test event display send sap packet send arp packet to ip-addr write memory data in address do LAN test
status init version pkttest
<ch_name> <ch_name>
4. IP Related Commands <hostid> format : xxx.xxx.xxx.xxx (ip Address) <ether addr> format : xx:xx:xx:xx:xx:xx <iface> : enif0, wanif0 <gw> : gateway ip address
Command ip address loopbackaddr alias aliasdis arp status add resolve drop <iface> <hostid> ether <ether addr> <hostid> <hostid> [hardware] display ip arp status add arp information resolve ip-addr drop arp 174
Description [addr] <IP1> [IP2] <iface> <0|1> display host ip address Set loopback address.

P-660 series Support Notes address> <subnet mask> destination address and subnet mask if a packet which complies to this rule. destaddr-range <start ip address> <end ip address> Select and edit a destination address range of a packet which complies to this rule. tcp destport-single <port#> Select and edit the destination port of a packet which comply to this rule. For non-consecutive port numbers, the user may repeat this command line to enter the multiple port numbers. tcp destport-range <start port#> <end port#> Select and edit a destination port range of a packet which comply to this rule. udp destport-single <port#> Select and edit the destination port of a packet which comply to this rule. For non-consecutive port numbers, users may repeat this command line to enter the multiple port numbers. udp destport-range <start port#> <end port#> Select and edit a destination port range of a packet which comply to
P-660 series Support Notes this rule. desport-custom <desired custom port name> delete firewal l attack set <set#> e-mail Type in the desired custom port name Remove all email alert settings Reset all alert settings to defaults Remove a specified set from the firewall configuration set <set#> rule <rule#> Remove a specified rule in a set from the firewall configuration insert firewal l attack set <set#> e-mail Insert email alert settings Insert attack alert settings Insert a specified rule set to the firewall configuration set <set#> rule <rule#> Insert a specified rule in a set to the firewall configuration cli Display the choices of command list.
12. Firewall Related Command
Command sys firewall acl disp active cnt disp Display firewall log type and count. 194
Display specific ACL set # rule #, or all ACLs. Active firewall or deactivate firewall

<yes|no>

P-660 series Support Notes clear pktdump update dynamicrule tcprst rst rst113 display icmp dos smtp display ignore ignore triangle Set if firewall ignore triangle route in lan/wan/dmz/wlan Set SMTP DoS defender on/off Display SMTP DoS defender setting. Set if firewall ignore DoS in lan/wan/dmz/wlan Set TCP reset sending on/off. Set TCP reset sending for port 113 on/off. Display TCP reset sending setting. Clear firewall log count. Dump the 64 bytes of dropped packet by firewall Update firewall

13. SMT Related command

No Command sys bridge [on|off] sys routeip [on|off] sys hostname [hostname] sys display sys default Description Set system bridge on/off Set system IP routing on/off Set system name Display hostname, routing/bridge mode information in menu 1 Load All Default Settings Except LAN and DHCP. Save all the parameters which will include menu1, menu 3.2 LAN, menu 4 or menu 11 WAN, menu 12 static route, menu 15 NAT server set, menu 21 filter sets, menu 22 SNMP, menu 24.11 remote management and 3.5 Wireless LAN Set wan backup mechanism to DSL link Menu 2 or ICMP Set wan ip address <index> Set keepalive fail tolerance Set recovery interval Set ICMP timeout Menu 2 Menu 2 Menu 2 Menu 2 Comment Menu 1 Menu 1 Menu 1 Display Menu 1