Allied Telesis SwitchBlade AT-AR440S User manual

Introduction
This document describes how to configure some of the more advanced features on your AT-
AR440S ADSL router. It assumes that you have already set up basic Internet access on the router,
and are now aiming to add more facilities to the configuration.
This document complements the other documentation available for the AT-AR400 router series:
•The AR400 Series Router Quick Install Guide
•The AR400 Series Router Documentation and Tools CD-ROM, which includes the complete
AR400 Series Document Set and utilities.
•How to set up your AT-AR440S ADSL router for Internet access
What information will you find in this document?
This document provides information about:
•Firewall and NAT
•DHCP server
•DNS relay
•ISDN backup of the ADSL link
•VPN with NAT-T
•Troubleshooting - basic and advanced
Note - The latest documentation can always be downloaded from www.alliedtelesyn.com.
How To
Configure some advanced features on your AT-AR440S ADSL Router

Table of Contents
Introduction .................................................................................................................................. 1
What information will you find in this document? ....................................................... 1
1. Firewall Interfaces and NAT ................................................................................................. 3
2. Firewall Allow Rules ............................................................................................................... 8
Confirming your configuration ...................................................................................... 10
3. DHCP Server ........................................................................................................................ 11
4. DNS Relay Configuration ................................................................................................... 14
Enabling DNS Relay using the GUI ............................................................................... 15
Re-Saving the Configuration ........................................................................................... 15
5. Configuring an ISDN backup link for your main ADSL link ....................................... 16
Introduction ....................................................................................................................... 16
ISDN configuration methods ......................................................................................... 16
How the higher preference route works .................................................................... 18
Avoiding unnecessary ISDN calls at router start-up ................................................ 18
Verifying your Back-up Link ............................................................................................ 19
6. IPSEC VPN with NAT-T ...................................................................................................... 22
7. How to troubleshoot your AR440S Series ADSL connection .................................. 24
Introduction ....................................................................................................................... 24
Basic troubleshooting - initial checklist ....................................................................... 24
Advanced troubleshooting ...................................................................................................... 25
1. Checking the ADSL layer ........................................................................................... 25
2. Checking the ATM Layer ............................................................................................ 27
3. Checking the PPP Link ................................................................................................ 29
4. Checking the IP Layer ................................................................................................. 33
5. Checking the IP Routes .............................................................................................. 34
Appendix A - Typical ADSL Performance Figures to Expect .......................................... 35
Appendix B - checking if your PC is correctly configured .............................................. 36
For Windows 2000/XP ................................................................................................... 37
For Windows 95/98/ME .................................................................................................. 38

1. Firewall Interfaces and NAT 3
1. Firewall Interfaces and NAT
The PCs on your LAN use private IP addresses. Your ISP allocates, or you have statically defined, a
single public address to your router. When your PCs access the Internet via your router, the router
must substitute its public IP address into the data packets as it sends them out. This process is
called Network Address Translation (NAT). You must enable NAT on your router in order to
enable multiple PCs on your LAN to access the Internet.
Enabling
the
firewall
Also, it is very important to enable the firewall on the router to protect your LAN from attack.
If you ticked ‘enable firewall’ in the ADSL Setup GUI page, you will already have a basic firewall and
NAT configuration. You can view your current configuration either with the GUI Diagnostics
Command Line, or with the GUI Configuration > Firewall options.
To view the current firewall configuration via the Diagnostics > Command Line, use the command:
show configuration dynamic=firewall
You will get output something like this:
#
# FIREWALL configuration
#
enable firewall
create firewall policy="guilan"
enable firewall policy="guilan" icmp_f=all
add firewall policy="guilan" int=vlan1 type=private
add firewall policy="guilan" int=ppp0 type=public
add firewall poli="guilan" nat=enhanced int=vlan1 gblin=ppp0
The configuration assigns the public and private interfaces to the firewall and defines the NATing
relationships of those interfaces. If required you can view and alter your firewall settings using the
GUI.
Now, let us look, step by step, at how to achieve this:
Step 1 aSelect Configuration from the GUI’s menu on the left hand side of the screen.
bSelect Firewall > Interfaces
cThe Firewall Configuration window will open, the box next to Enable Firewall will already be
ticked.

1. Firewall Interfaces and NAT 4
Note - If you want to change any of these settings, remember to click on the blue Apply
button at the bottom of the page afterwards. The Firewall Configuration window is shown
below.
Step 2 aSelect the blue Interfaces tab at the top of the Firewall Configuration page.
bSelect the blue Modify LAN button from the next window; the Select LAN Interface(s) window
will open. This confirms your firewall private interface. Here you have the opportunity to add
other private interfaces, if required.
cSelect the Close button at the bottom of the page. You will be returned to the Firewall Interfaces
window.

1. Firewall Interfaces and NAT 5
dSelect Modify WAN from the Firewall Interfaces window.
The Select WAN Interface(s) window will open. This will confirm your firewall public interface.
Again, you have the opportunity to add other public interfaces if required.
eSelect the Close button at the bottom of the page.

1. Firewall Interfaces and NAT 6
You will be returned to the Firewall Interfaces window.
You may also wish to modify some ICMP forwarding options for security reasons.
Step 3 aSelect the TAB marked Policy Options
bFor high security you should turn off all ICMP forwarding options except those really needed, such
as Ping.

1. Firewall Interfaces and NAT 7
If you have added extra public or private interfaces to the firewall, you may wish to define NAT
relationships between them.
Step 4 aSelect Configuration > Firewall > NAT from the main menu.
The Firewall NAT LAN window will open.
bYou have the opportunity to add other NAT interface relationships if needed. Use the ADD
button and fill in the details.

2. Firewall Allow Rules 8
2. Firewall Allow Rules
You may also need to define some allow rules or ‘pinholes’ to allow externally initiated traffic of
some types. For example - you may have a Web server that you wish to allow the public to access.
Please note that allowing access to servers will normally mean you need a fixed public address
rather than dynamically assigned - or you will need a dynamic DNS domain name arrangement.
If your ADSL connection is up, the configuration below will pick up the current WAN address to be
the global IP address of your allow rule. If you need the global IP address to dynamically change to
any current WAN address, then first disconnect your ADSL line while you configure, and the global
IP parameter will take the desired value 0.0.0.0. This is effectively a ‘wild card’ value for the global IP,
and has the effect that the rule will use whatever IP address happens to have been learnt on the
WAN interface at any given time.
To define allow rules:
Step 1 aSelect Firewall > Tr a f f i c R u l e s
bSelect Add and set up the first page as shown below, and click Apply.

2. Firewall Allow Rules 9
This selects the traffic type, which we want to be HTTP (or port 80) Web traffic. Then you must
define the IP translation required.
Step 2 aSelect the IP Address Settings tab and setup the page as shown below:
Note - it is highly recommended to leave the ‘Remote IP’ settings unaltered. The purpose of
these settings is to define which addresses on the Internet will be able to access your server.
Typically, you will want all of the Internet to be able to access your server, which is what the
default setting allows.
bDefine the address of the local server in the LAN IP section.
cClick the Apply button.
Settings are then confirmed with the Firewall rule WAN to LAN window, as shown below:

2. Firewall Allow Rules 10
Confirming your configuration
You can also confirm your configuration by selecting the Diagnostics > Command Line menu
option.
Enter the command:
show configuration dynamic=fire
You should see output something like this:
#
# FIREWALL configuration
#
enable firewall
create firewall policy="guilan"
set firewall policy="guilan" max=0
enable firewall policy="guilan" icmp_f=ping
add firewall policy="guilan" int=vlan1 type=private
add firewall policy="guilan" int=ppp0 type=public
add firewall poli="guilan" nat=enhanced int=vlan1 gblin=ppp0
add firewall poli="guilan" ru=1 ac=allo int=ppp0 prot=tcp po=80
ip=192.168.1.80 gblip=<your current WAN address> gblp=80
As mentioned above, to cater for dynamically assigned WAN addresses you need the global IP
address (gblip) to read 0.0.0.0.

3. DHCP Server 11
3. DHCP Server
A DHCP Server provides the convenience of PCs automatically getting an IP address when they are
plugged into your local office LAN network. The default factory configuration has a DHCP Server
pre-configured. However, you may need to change the configuration to suit your network's IP
addressing scheme.
Viewing the current DHCP Server configuration
First, you can view your current configuration either with the GUI Diagnostics > Command line or
with the GUI Configuration > DHCP Server > Configuration menu options.
To view the current firewall configuration via the Diagnostics > command line option, use the
command:
show configuration dynamic=dhcp
You will get output something like this:
#
# DHCP configuration - Post IP
#
enable dhcp
create dhcp poli="lan-dhcp" lease=259200
add dhcp poli="lan-dhcp" subn=255.255.255.0
add dhcp poli="lan-dhcp" rou=192.168.1.1
add dhcp poli="lan-dhcp" dnss=192.168.1.1
create dhcp ran="standard" poli="lan-dhcp" ip=192.168.1.100 num=50
This configuration sets the DHCP Server up to allocate addresses in the range 192.168.1.100 -
192.168.1.149 to your local PCs. It also assigns the router address as the gateway and DNS Server.
The router has a DNS Relay facility, therefore all the PCs on the LAN will send their DNS requests
to the router, which then relay the requests to the external DNS Server.

3. DHCP Server 12
Altering DHCP Server configurations
If you wish to alter this configuration, take the following steps using the GUI.
aSelect Configuration from the main side menu.
bSelect DHCP Server > Configuration.
The DHCP Server Configuration window opens.
cTo alter the DHCP policy, select the lan-dhcp policy name and click modify.
Note - Some parameters can be altered here. If you also need to change the IP range
definition you will need to add a new range definition, and then remove the old ‘standard’
range definition.

3. DHCP Server 13
After your configuration changes, you can confirm your changes are correct by selecting
Diagnostics > Command Line.
Enter the command:
show configuration dynamic=dhcp
You should also save your configuration changes.

4. DNS Relay Configuration 14
4. DNS Relay Configuration
The default factory script also enables DNS Relay. The net effect of DNS relay is that your local PCs
will make DNS queries to the router, and these queries are relayed to your ISP's Domain Name
Server, which will resolve the query and reply. This is needed to work in with the default DHCP
configuration and the PPP link dynamically assigned DNS details.
PPP dynamic assignment is often used over ADSL - if your ADSL provider uses PPPoA or PPPoEoA.
If you use other ADSL link types, DNS Relay can still work after manually configuring your DNS
addresses - refer to the figure below.
You can view your current DNS Relay configuration either with the GUI Diagnostics > Command
Line or with the GUI Configuration > Internet Protocol > General menu options.
To view the current IP configuration via the diagnostics command line, use the command:
show configuration dynamic=ip
You will get output something like this:
#
# IP configuration
#
enable ip
enable ip remote
ena ip dnsrelay
add ip int=vlan1 ip=192.168.1.1
add ip int=ppp0 ip=0.0.0.0 mask=0.0.0.0
add ip rou=0.0.0.0 mask=0.0.0.0 int=ppp0 next=0.0.0.0
In here you can observe that ‘dnsrelay’ has been enabled.

4. DNS Relay Configuration 15
Enabling DNS Relay using the GUI
If the DNS relay is currently disabled, it can be enabled using the GUI:
aSelect Internet Protocol > General from the side menu.
bTick the Enable DNS relay box as shown below.
You can see that this configuration page gives you the opportunity to enter the addressees of the
primary and secondary DNS Servers, if they are not being automatically assigned.
Re-Saving the Configuration
Now would be a good time to save your configuration work again. Select your new current file
name, assuming you already saved earlier, and then click the Continue button.

5. Configuring an ISDN backup link for your main ADSL link 16
5. Configuring an ISDN backup link for your main
ADSL link
Introduction
The configurations shown here use the CLI configuration method. If you are unsure about how to
use the CLI, refer to the AR400 User Guide available on the AR400 Documentation and Tools CD-
ROM, packaged with your router. Also available under Products and Services at http://
www.alliedtelesyn.co.uk
This discussion assumes you have already configured a main link to your ISP using an ADSL link -
such as shown in the document "How to Set-up your AT-AR440S ADSL Router for Internet Access”, for
example, your link type may be PPPoA, PPPoEoA, IPoA or RFC1483 Routed.
ISDN configuration methods
Once established, the ADSL connection to the ISP should remain up indefinitely; the connection is
'always-on'. If for some reason this connection does fail, Internet connectivity can be quickly
restored using an ISDN call configured to back up the ADSL connection.
There are two methods that can be used:
1. PPP Secondary Link
In this first method, a backup ISDN call is made to the same ISP and can be authenticated using the
same username and password. It assumes your main ADSL link uses PPP, that is, PPPoA or
PPPoEoA. (In this particular configuration example below, the service is PPPoA).
For example, the primary ADSL link is configured similarly to:
enable adsl=0
create atm=0 over=adsl0
add atm=0 chan=1
create ppp=0 over=atm0.1 lqr=off echo=on iprequest=on
username="ispallocated_username" password="ispallocated_password"
A backup PPP link can be added using the following steps:
1. Configure the ISDN call.
add isdn call=backup prec=out num=654321
2. Create the PPP secondary link over ISDN.
add ppp=0 over=isdn-backup type=secondary

5. Configuring an ISDN backup link for your main ADSL link 17
How the Secondary PPP mechanism works
The PPP module can monitor the quality of the link using either Link Quality Reporting (LQR) or
LCP Echo Request/Reply messages (echo=on). Note that many ISP's use echo, not LQR - as shown
in the configuration above.
If either method detects failure of the primary link, the PPP module will automatically activate the
secondary link and traffic is redirected over the backup link.
PPP continually attempts to re-open the primary link, and when the primary link is restored, the
backup call is deactivated and traffic is redirected over the primary link again.
2. Creating a second PPP definition over ISDN
In this second method, we set up a new separate PPP definition over the ISDN call definition, and
we set up a second default route over this back-up PPP with a higher preference value. This means
that the second route will only be used if the first route is unavailable.
Please note that this route preference solution can also be used when your main link is not using
PPP. That is, it is valid for RFC 1483 Routed or IPoA links - both define an IP interface over ATM,
with no PPP layer.
1. Configure the ISDN call
add isdn call=backup prec=out num=654321
2. Create the new PPP definition over ISDN. This PPP uses dial on demand, meaning the ISDN call
will only be activated if traffic is routed to this PPP, so we use "idle=300".
create ppp=1 idle=300 over=isdn-backup
set ppp=1 iprequest=on username="ispallocated_username"
set ppp=1 password="ispallocated_password"
set ppp=1 over=isdn-test lqr=off echo=10
3. Add the IP Interface and default route with higher preference value. (If there are two default
routes, the one with lower preference is the preferred route.)
add ip int=ppp1 ip=0.0.0.0
add ip rou=0.0.0.0 mask=0.0.0.0 int=ppp1 next=0.0.0.0 pref=500
4. Add the new interface to the firewall, and define its NAT relationship. This ensures that your
backup link is protected when used.
add firewall policy="guilan" int=ppp1 type=public
add firewall poli="guilan" nat=enhanced int=vlan1 gblin=ppp1

5. Configuring an ISDN backup link for your main ADSL link 18
How the higher preference route works
The router is configured with two default routes to the Internet. The default route via the ADSL
link has the lower preference value. Therefore, if this link is up, data will be sent down that route.
If the ADSL link goes down, then the associated IP interface and route are marked as not available.
You can see this with the command "show ip route", as shown below - the first default route has a
hash (#) by ppp0, indicating it is down.
Manager > show ip route
IP Routes
-------------------------------------------------------------------------------
Destination Mask NextHop Interface Age
DLCI/Circ. Type Policy Protocol Metrics Preference
-------------------------------------------------------------------------------
0.0.0.0 0.0.0.0 0.0.0.0 ppp0# 7556
- direct 0 static 1 360
0.0.0.0 0.0.0.0 0.0.0.0 ppp1 2463
- direct 0 static 1 500
50.50.50.5 255.255.255.255 0.0.0.0 ppp1 5529
- direct 0 interface 1 0
192.168.1.0 255.255.255.0 0.0.0.0 vlan1 7556
- direct 0 interface 1 0
-------------------------------------------------------------------------------
Even if the connection over the ADSL link uses IPoA or RFC 1483 routed, and the ADSL link goes
down, the route via that interface will be deemed inactive.
At this point, data will be sent over the higher preference default route definition, because it is now
the best route available. This route is only used if the main route is unavailable, because it has a
higher preference value. When the route is used, it causes the dial-on-demand ISDN call to be
activated, and so PPP1 will open, providing a back-up route to the Internet.
When the ADSL link is restored, the route via the ADSL interface will become active again. Data
will then prefer to use that route as it has a lower preference value. PPP1 (the ISDN call) will
disconnect after the idle period - the example above uses a 300 second idle period.
Avoiding unnecessary ISDN calls at router start-up
One point that needs to be considered in the context of this ‘alternative route’ solution is the fact
that the ADSL link typically takes up to 30 seconds to become established after the router start-up.
So, for the first 30 seconds or so after start-up, the route via the ADSL link is inactive, therefore
Internet-directed data would cause the ISDN call to be activated. If you don’t want this to occur,
then you can force the ISDN call to be ‘held down’ for the first 30 seconds or so after router start-
up. This is achieved by means of a restart trigger:
enable trigger
create trigger=1 reboot=all script=holdisdn.scp
where the contents of the file holdisdn.scp are:
disable ppp=1
wait 40
enable ppp=1

5. Configuring an ISDN backup link for your main ADSL link 19
Verifying your Back-up Link
Whichever backup method you use, you may want to confirm that your back-up ISDN call works as
expected. Start a long sequence of Echo Requests from a PC on the LAN to an Internet address.
For this to work it is likely you will also need to enable firewall ICMP forwarding for ping.
Step 1 aOn the router enter the command:
Enable firewall policy="guilan" icmp_f=ping
OR
bPinging from a command window of your PC:
ping 200.200.200.254 -t
Step 2 aAfter the first few Echo Replies have been received, disconnect the cable from the ADSL interface.
Did your back-up ISDN call come up after your ADSL link failed?
bCheck on the status of the various components of your Internet connection.
The following screen output is an example of what you may expect to see if your ADSL link has
failed and your backup ISDN call is successfully up:
show adsl=0
Manager > show adsl=0
ADSL Interface Information
---------------------------------------------------------------------------
adsl0:
Status ............. ENABLED
State .............. Connecting
Mode ............... NORMAL
Standard ........... AUTOMATIC
Bert ............... OFF
Autoretrain ........ ON
Carrier ............ FDM
Link state ......... Down
Up time ............ -
Connection ......... n/a
Rx rate ............ n/a
Tx rate ............ n/a
ATU-R SNR margin ... n/a
ATU-C SNR margin ... n/a
ATU-R Attenuation .. n/a
ATU-C Attenuation .. n/a
--------------------------------------------------------------

5. Configuring an ISDN backup link for your main ADSL link 20
show atm=0 channel=1
Manager > show atm=0 channel=1
ATM interface atm0.1
--------------------------------------------------------------------------------
Channel Number ................ 1
Channel Description ........... None
Channel Type .................. PVC
VPI ........................... 0
VCI ........................... 100
Encapsulation ................. VCMUX
Service Class ................. UBR
Configured
pcr ....................... n/a
mcr ....................... 0 Kbps
scr ....................... 0 Kbps
mbs ....................... 0 Cells
bt ....................... 0 Cells (calculated)
Actual
pcr ....................... 736 Kbps (1735 cps)
mcr ....................... 0 Kbps (0 cps)
scr ....................... 0 Kbps (0 cps)
bt ....................... 0 Cells
Attached user modules ......... PPP
L1 Interface .................. adsl0
Configured Status ............. Enabled
Link Status ................... Down
---------------------------------------------------------------
show ppp
Manager > show ppp
Name Enabled ifIndex Over CP State
-----------------------------------------------------------------------------
ppp0 YES 11 IPCP CLOSED
atm0.1 LCP STARTING
ppp1 YES 12 IPCP OPENED
isdn-backup LCP OPENED
-----------------------------------------------------------------------------
show isdn call
Manager > show isdn call
ISDN call details
Name Number Remote call State Precedence
--------------------------------------------------------------------------
backup 8358662 - (E) IN & OUT OUT
--------------------------------------------------------------------------
ISDN active calls
Index Name Interface User State Prec
------------------------------------------------------------
0 backup BRI0 03-01 ON Yes
------------------------------------------------------------