Allied Telesis SwitchBlade AT-AR440S User manual

Introduction
This document describes how to configure some of the more advanced features on your AT-
AR440S ADSL router. It assumes that you have already set up basic Internet access on the router,
and are now aiming to add more facilities to the configuration.
This document complements the other documentation available for the AT-AR400 router series:
•The AR400 Series Router Quick Install Guide
•The AR400 Series Router Documentation and Tools CD-ROM, which includes the complete
AR400 Series Document Set and utilities.
•How to set up your AT-AR440S ADSL router for Internet access
What information will you find in this document?
This document provides information about:
•Firewall and NAT
•DHCP server
•DNS relay
•ISDN backup of the ADSL link
•VPN with NAT-T
•Troubleshooting - basic and advanced
Note - The latest documentation can always be downloaded from www.alliedtelesyn.com.
How To
Configure some advanced features on your AT-AR440S ADSL Router

Table of Contents
Introduction .................................................................................................................................. 1
What information will you find in this document? ....................................................... 1
1. Firewall Interfaces and NAT ................................................................................................. 3
2. Firewall Allow Rules ............................................................................................................... 8
Confirming your configuration ...................................................................................... 10
3. DHCP Server ........................................................................................................................ 11
4. DNS Relay Configuration ................................................................................................... 14
Enabling DNS Relay using the GUI ............................................................................... 15
Re-Saving the Configuration ........................................................................................... 15
5. Configuring an ISDN backup link for your main ADSL link ....................................... 16
Introduction ....................................................................................................................... 16
ISDN configuration methods ......................................................................................... 16
How the higher preference route works .................................................................... 18
Avoiding unnecessary ISDN calls at router start-up ................................................ 18
Verifying your Back-up Link ............................................................................................ 19
6. IPSEC VPN with NAT-T ...................................................................................................... 22
7. How to troubleshoot your AR440S Series ADSL connection .................................. 24
Introduction ....................................................................................................................... 24
Basic troubleshooting - initial checklist ....................................................................... 24
Advanced troubleshooting ...................................................................................................... 25
1. Checking the ADSL layer ........................................................................................... 25
2. Checking the ATM Layer ............................................................................................ 27
3. Checking the PPP Link ................................................................................................ 29
4. Checking the IP Layer ................................................................................................. 33
5. Checking the IP Routes .............................................................................................. 34
Appendix A - Typical ADSL Performance Figures to Expect .......................................... 35
Appendix B - checking if your PC is correctly configured .............................................. 36
For Windows 2000/XP ................................................................................................... 37
For Windows 95/98/ME .................................................................................................. 38

1. Firewall Interfaces and NAT 3
1. Firewall Interfaces and NAT
The PCs on your LAN use private IP addresses. Your ISP allocates, or you have statically defined, a
single public address to your router. When your PCs access the Internet via your router, the router
must substitute its public IP address into the data packets as it sends them out. This process is
called Network Address Translation (NAT). You must enable NAT on your router in order to
enable multiple PCs on your LAN to access the Internet.
Enabling
the
firewall
Also, it is very important to enable the firewall on the router to protect your LAN from attack.
If you ticked ‘enable firewall’ in the ADSL Setup GUI page, you will already have a basic firewall and
NAT configuration. You can view your current configuration either with the GUI Diagnostics
Command Line, or with the GUI Configuration > Firewall options.
To view the current firewall configuration via the Diagnostics > Command Line, use the command:
show configuration dynamic=firewall
You will get output something like this:
#
# FIREWALL configuration
#
enable firewall
create firewall policy="guilan"
enable firewall policy="guilan" icmp_f=all
add firewall policy="guilan" int=vlan1 type=private
add firewall policy="guilan" int=ppp0 type=public
add firewall poli="guilan" nat=enhanced int=vlan1 gblin=ppp0
The configuration assigns the public and private interfaces to the firewall and defines the NATing
relationships of those interfaces. If required you can view and alter your firewall settings using the
GUI.
Now, let us look, step by step, at how to achieve this:
Step 1 aSelect Configuration from the GUI’s menu on the left hand side of the screen.
bSelect Firewall > Interfaces
cThe Firewall Configuration window will open, the box next to Enable Firewall will already be
ticked.

1. Firewall Interfaces and NAT 4
Note - If you want to change any of these settings, remember to click on the blue Apply
button at the bottom of the page afterwards. The Firewall Configuration window is shown
below.
Step 2 aSelect the blue Interfaces tab at the top of the Firewall Configuration page.
bSelect the blue Modify LAN button from the next window; the Select LAN Interface(s) window
will open. This confirms your firewall private interface. Here you have the opportunity to add
other private interfaces, if required.
cSelect the Close button at the bottom of the page. You will be returned to the Firewall Interfaces
window.

1. Firewall Interfaces and NAT 5
dSelect Modify WAN from the Firewall Interfaces window.
The Select WAN Interface(s) window will open. This will confirm your firewall public interface.
Again, you have the opportunity to add other public interfaces if required.
eSelect the Close button at the bottom of the page.

1. Firewall Interfaces and NAT 6
You will be returned to the Firewall Interfaces window.
You may also wish to modify some ICMP forwarding options for security reasons.
Step 3 aSelect the TAB marked Policy Options
bFor high security you should turn off all ICMP forwarding options except those really needed, such
as Ping.

1. Firewall Interfaces and NAT 7
If you have added extra public or private interfaces to the firewall, you may wish to define NAT
relationships between them.
Step 4 aSelect Configuration > Firewall > NAT from the main menu.
The Firewall NAT LAN window will open.
bYou have the opportunity to add other NAT interface relationships if needed. Use the ADD
button and fill in the details.

2. Firewall Allow Rules 8
2. Firewall Allow Rules
You may also need to define some allow rules or ‘pinholes’ to allow externally initiated traffic of
some types. For example - you may have a Web server that you wish to allow the public to access.
Please note that allowing access to servers will normally mean you need a fixed public address
rather than dynamically assigned - or you will need a dynamic DNS domain name arrangement.
If your ADSL connection is up, the configuration below will pick up the current WAN address to be
the global IP address of your allow rule. If you need the global IP address to dynamically change to
any current WAN address, then first disconnect your ADSL line while you configure, and the global
IP parameter will take the desired value 0.0.0.0. This is effectively a ‘wild card’ value for the global IP,
and has the effect that the rule will use whatever IP address happens to have been learnt on the
WAN interface at any given time.
To define allow rules:
Step 1 aSelect Firewall > Tr a f f i c R u l e s
bSelect Add and set up the first page as shown below, and click Apply.

2. Firewall Allow Rules 9
This selects the traffic type, which we want to be HTTP (or port 80) Web traffic. Then you must
define the IP translation required.
Step 2 aSelect the IP Address Settings tab and setup the page as shown below:
Note - it is highly recommended to leave the ‘Remote IP’ settings unaltered. The purpose of
these settings is to define which addresses on the Internet will be able to access your server.
Typically, you will want all of the Internet to be able to access your server, which is what the
default setting allows.
bDefine the address of the local server in the LAN IP section.
cClick the Apply button.
Settings are then confirmed with the Firewall rule WAN to LAN window, as shown below:

2. Firewall Allow Rules 10
Confirming your configuration
You can also confirm your configuration by selecting the Diagnostics > Command Line menu
option.
Enter the command:
show configuration dynamic=fire
You should see output something like this:
#
# FIREWALL configuration
#
enable firewall
create firewall policy="guilan"
set firewall policy="guilan" max=0
enable firewall policy="guilan" icmp_f=ping
add firewall policy="guilan" int=vlan1 type=private
add firewall policy="guilan" int=ppp0 type=public
add firewall poli="guilan" nat=enhanced int=vlan1 gblin=ppp0
add firewall poli="guilan" ru=1 ac=allo int=ppp0 prot=tcp po=80
ip=192.168.1.80 gblip=<your current WAN address> gblp=80
As mentioned above, to cater for dynamically assigned WAN addresses you need the global IP
address (gblip) to read 0.0.0.0.