Atera CL-100 User manual

Citadel CL Series Security
and Network Appliance
User Manual
Copyright © 2001-2006 All Rights Reserved. No part of this manual, including the products and software described
in it, may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in
any form or by any means, except for documentation kept by the purchaser for backup purposes, without the
written authorization of the trademark owner. Citadel, CITADEL, Citadel CL, Citadel CL-100, Citadel CL-100W,
Citadel CL-200, and Citadel CL-200W are trademarks. All other trademarks mentioned in this manual are properties
of their respective owners.

Citadel CL Series Security and Network Appliance User Manual
ii

Table of Contents
iii
Table of Contents
Chapter 1: Introduction......................................................................... 1
"In-a-Box" Office Network ............................................................................... 1
Rock Solid Security ........................................................................................ 2
Advanced Traffic-shaping Engine ...................................................................... 2
Feature-rich Server Applications....................................................................... 2
Chapter 2: Specifications....................................................................... 3
Hardware Configuration .................................................................................. 3
IPSec VPN..................................................................................................... 3
PPTP VPN...................................................................................................... 3
Firewall & Packet Filtering ............................................................................... 3
Network Services .......................................................................... 3
WLAN-802.11b/g ........................................................................................... 4
Main Server Types ......................................................................................... 4
Management ................................................................................................. 5
Dimensions and Circumstance.......................................................................... 5
Comparison of Models..................................................................................... 5
Chapter 3: User Interface Elements and Basic Functions ...................... 6
The Home Screen........................................................................................... 6
Basic Operations ............................................................................................ 9
Chapter 4: Getting Started ...................................................................10
Basic Requirements ...................................................................................... 10
ADSL/PPPoE Connection ................................................................10
Cable/L2TP Connection..................................................................11
Connection Types (WAN)............................................................................... 11
Establishing Access to the Citadel Web Management Console.............................. 12
Connecting to the Citadel Web Management Console......................................... 14
Completing Basic Settings with the Citadel Wizard ............................................ 15
Setting Up PCs on the LAN for Internet Access ................................................. 18
Chapter 5: Configuring the Citadel .......................................................22
Interfaces ................................................................................................... 22
LAN Connection............................................................................22
WAN Connection ..........................................................................23
WAN2 and DMZ Ports....................................................................32
Wireless LAN (Citadel CL-100W and Citadel CL-200W only) ................34

Citadel CL Series Security and Network Appliance User Manual
iv
Modem Connection .......................................................................38
Load Balancing.............................................................................44
Dynamic Host Configuration Protocol (DHCP) Server ......................................... 46
Static LAN IP Allocation .................................................................48
DHCP Clients and Lease Times .......................................................49
Dynamic Domain Name Service (DDNS) .......................................................... 50
Third Party DDNS Services.............................................................50
Firewall ...................................................................................................... 52
Firewall Rules Group .....................................................................52
Firewall Rules ..............................................................................54
Network Address Translation (NAT) Configuration ............................................. 57
Port Address Translation (PAT) .......................................................57
Virtual Server ..............................................................................59
Virtual DMZ .................................................................................61
VPN Configuration ........................................................................................ 62
PPTP VPN ....................................................................................63
L2TP VPN ....................................................................................75
IPSec VPN ...................................................................................77
Quality of Service (QoS) Traffic Shaping .......................................................... 81
Profile Definition...........................................................................83
Traffic Definition...........................................................................84
Advanced Features....................................................................................... 85
Security ......................................................................................86
Diagnostics..................................................................................87
Routing.......................................................................................88
Simple Network Management Protocol (SNMP)..................................90
Email Indication ...........................................................................92
System Settings .......................................................................................... 93
Administrator Password.................................................................93
Time...........................................................................................94
Configuration Settings...................................................................95
Log Settings ................................................................................96
Upgrade......................................................................................99

Table of Contents
v
Reboot......................................................................................100
Miscellaneous ............................................................................101
USB Applications.........................................................................................102
Prerequisites to Using a USB Disk ................................................. 102
Web Camera.............................................................................. 103
Printer ......................................................................................105
Storage..................................................................................... 108
Users........................................................................................ 110
FTP Server ................................................................................111
WWW Server .............................................................................114
Mail Server................................................................................115

Citadel CL Series Security and Network Appliance User Manual
vi
Table of Figures
Figure 1: Citadel Router in a Typical Office Network Setting ........................................... 1
Figure 2: Home Screen of the Web Management Console............................................... 6
Figure 3: LAN IP Address Screen .............................................................................. 23
Figure 4: WAN IP Address Setting Screen for PPPoE/ADSL Connection ........................... 24
Figure 5: Multi-PPPoE Screen Section........................................................................ 26
Figure 6: WAN IP Address Setting Screen for DHCP Connection .................................... 27
Figure 7: DHCP Information Screen .......................................................................... 28
Figure 8: WAN IP Address Setting Screen for Static IP Connection ................................ 30
Figure 9: MAC Address Clone................................................................................... 31
Figure 10: Secondary WAN IP Address Screen............................................................ 32
Figure 11: Working Mode Screen for Choosing WAN2 or DMZ ....................................... 33
Figure 12: Wireless LAN Screen ............................................................................... 35
Figure 13: Serial Port Setup Screen .......................................................................... 38
Figure 14: Internet Connection Backup Screen ........................................................... 40
Figure 15: Remote Access Server Screen................................................................... 42
Figure 16: Load Balance Settings Screen ................................................................... 44
Figure 17: DHCP Server Screen................................................................................ 46
Figure 18: Static LAN IP Allocation Screen ................................................................. 48
Figure 19: DDNS Third Party Support Screen ─Third-Party DDNS Tab........................... 50
Figure 20: Firewall Rules Group Screen ..................................................................... 52
Figure 21: Firewall Rules Screen .............................................................................. 54
Figure 22: Port Address Translation Screen................................................................ 58
Figure 23: Multi-NAT Screen.................................................................................... 59
Figure 24: Virtual Server Screen .............................................................................. 60
Figure 25: Virtual DMZ Screen ................................................................................. 61
Figure 26: PPTP VPN Server Screen .......................................................................... 63
Figure 27: PPTP User Account Screen........................................................................ 65
Figure 28: L2TP VPN Screen .................................................................................... 75
Figure 29: IPSec VPN Screen ................................................................................... 77
Figure 30: RSA Digital Key Configuration on the IPSec VPN Screen ............................... 80

Table of Figures
vii
Figure 31: Schematic Illustration of QoS Traffic Shaping.............................................. 81
Figure 32: QoS Traffic Shaping Configuration box on the QoS Traffic Shaping Screen....... 82
Figure 33: Profile Definition on the QoS Traffic Shaping Screen..................................... 83
Figure 34: Traffic Definition on the QoS Traffic Shaping Screen..................................... 84
Figure 35: Security Screen ...................................................................................... 86
Figure 36: Diagnostics Screen.................................................................................. 87
Figure 37: Static Route Screen ................................................................................ 88
Figure 38: Dynamic Routing and Route Table Boxes.................................................... 90
Figure 39: SNMP Screen ......................................................................................... 91
Figure 40: Email Indication Screen ........................................................................... 92
Figure 41: Change Password Screen ......................................................................... 93
Figure 42: Date and Time Screen ............................................................................. 94
Figure 43: Configuration Screen............................................................................... 95
Figure 44: Log Screen ............................................................................................ 97
Figure 45: Software Upgrade Screen......................................................................... 99
Figure 46: Reboot Screen.......................................................................................100
Figure 47: Miscellaneous Settings Screen .................................................................101
Figure 48: Webcam Screen.....................................................................................103
Figure 49: Printer Screen – USB Apps Tab ................................................................106
Figure 50: Disk Management Screen........................................................................109
Figure 51: Users Screen.........................................................................................110
Figure 52: FTP Server Screen .................................................................................112
Figure 53: WWW Server Configuration Screen...........................................................114
Figure 54: Mail Server Screen.................................................................................116

Citadel CL Series Security and Network Appliance User Manual
viii

Chapter 1: Introduction
"In-a-Box" Office Network 1
Chapter 1: Introduction
The Citadel is a security and network appliance, designed to meet the specific
needs of small to medium-sized businesses. It offers an easy to install office
network, advanced security and traffic-shaping capabilities, and a broad range of
key server applications.
Figure 1: Citadel Router in a Typical Office Network Setting
"In-a-Box" Office Network
The Citadel incorporates an intuitive step-by-step wizard that completes the
initial router setup in a matter of minutes. After setup, the web interface enables
you to configure the router, view status reports, upgrade firmware, and perform
other maintenance tasks with ease.
To improve availability and reliability, the Citadel incorporates a two-tier fail-over
mechanism. All Citadel appliances support entry-level fail-over between the WAN
and the serial port. In addition, the Citadel CL-200 and Citadel CL-200W models
offer faster Internet access, VPN uptime and boosted performance by supporting
two broadband links on a single Citadel appliance. These two broadband links can
terminate at different providers to provide more bandwidth to the users and
enhance uptime. Any failure on a link automatically switches traffic to the
operational link by using the built-in fail-over mechanism. At the same time, the
built-in load balancing feature not only increases the performance of the whole
network but also optimizes network utilization.

Citadel CL Series Security and Network Appliance User Manual
2 Rock Solid Security
Rock Solid Security
A remote office network becomes part of a secure central office network by using
the Citadel's VPN features for IPSec, PPTP and firewall that utilizes stateful
inspection architecture.
The Citadel also supports a DMZ network (CL-200 and CL-200W), and the
additional WAN port can be used as a hardware DMZ port. This gives the
administrator a convenient option to leverage security policy and productivity,
especially for remote and mobile users. With the help of the DMZ setting, the
administrator may define different security zones on a network to house different
hosts. Hosts such as web server and mail-relay, for example, may be placed in a
relatively open zone-DMZ, while an internal network could be reinforced with the
strictest security rules.
Advanced Traffic-shaping Engine
The Citadel Traffic-shaping engine helps users manage the network traffic in a
precise manner. Bandwidth consumption is adjusted to the actual applications in
use, and network utilization is finely tuned to the specific components of the
network.
Feature-rich Server Applications
The Citadel is equipped with one USB port, which is designed to be used for a
wide range of server applications. It can serve as a print server, an FTP, Web,
and Email server, and even as an online monitoring system with an optional Web
camera.

Chapter 2: Specifications
Hardware Configuration 3
Chapter 2: Specifications
Hardware Configuration
•1 WAN (10/100Mbps auto-sensing Ethernet) for CL-100 and CL-100W
•2 WAN (10/100Mbps auto-sensing Ethernet) for CL-200 and CL-200W
•4 LAN (10/100Mbps auto-sensing Ethernet)
•1 Serial (RS232), DB9 connector
•1 USB
IPSec VPN
•ESP and AH payloads
•168-bit 3DES encryption
•Hashes HMAC - MD5 and SHA-1 authentication
•IKE/ISAKMP Diffie-Hellman key exchange
•Site-to-Site (initiate and terminate)
•Free Dynamic DNS IPSec support
PPTP VPN
•PPTP server (v2)
•MPPE 40 to 128-bit RC4 encryption
•PAP/CHAP/MS CHAPv2 authentication
Firewall & Packet Filtering
•Stateful firewall
•Connection tracking and packet inspection
•Filters/Software DMZ
•DoS Attack Prevention
Network Services
•DHCP Server, Client
•WAN Clone (MAC address clone)
•PPPoE Client

Citadel CL Series Security and Network Appliance User Manual
4 WLAN-802.11b/g
•L2TP Client
•NAT- Static or Dynamic
•NAPT/PAT- Port forwarding
•NAT traversal
•Connection sharing
•Local and remote logging
•DDR - Dial on Demand
•Remote Dial-in
•Fail-over and high availability
•Dynamic DNS
•IP aliases
•NTP client and server
•NetMeeting, MSN, Games, and so on, pass-through
•Static and dynamic routing
•RIP v1 & v2
WLAN-802.11b/g
•DSSS (Direct Sequence Spread Spectrum)
•Various data rate: 1Mbps/2Mbps/5.5Mbps/11Mbps/54Mbps
•External Antennas x 2
•Transmission Range: (Depends on environment)
Indoor: 130ft (40m)
Semi Open: 330ft (100m)
Outdoor: 1500ft (457m)
•Working frequency:
2.412 – 2.462GHz (North America)
2.412 -- 2.484GHz (Japan)
2.412 – 2.472GHz (Europe ETSI)
•WEP
Main Server Types
•Print server
•WWW server (external USB disk required)
•FTP server (external USB disk required)

Chapter 2: Specifications
Management 5
•Email server (external USB disk required)
•RAS (Remote Access Server)
Management
•Easy management via a web browser
•HTTP, Telnet
•SNMP v1 & v2
•Status LEDs
•Reset Button
•Unlimited user
Dimensions and Circumstance
•Dimensions: 215 x 138 x 32mm (8.5"x5.4"x1.3")
•Power: 110V to 240VAC, 12W
•Weight: 0.5kg (1lb)
•Operating temperature: 0° to 40C° (32°F to 104°F)
•Storage temperature: -20°C to 70°C (-4°F to 158°F)
•Humidity: 10 to 90%, non-condensing
Comparison of Models
Models CL-100 CL-100W CL-200 CL-200W
WAN 1 1 2 2
WLAN AP
(802.11b/g) No √No √
Fail-over and
Load-Balancing Basic Basic Advanced Advanced
DMZ Software Software Hardware Hardware
Specifications and features are subject to change without notice.

Citadel CL Series Security and Network Appliance User Manual
6 The Home Screen
Chapter 3: User Interface Elements and Basic Functions
This chapter describes the user interface elements of the Citadel's Web
Management Console and its basic functions.
The Home Screen
When you log on to the Citadel, the Home screen of the Web Management
Console appears.
Figure 2: Home Screen of the Web Management Console
The System Information box on the Home screen summarizes the configuration
of the Citadel and includes a table at the bottom of the screen with all current
connections.

Chapter 3: User Interface Elements and Basic Functions
The Home Screen 7
You configure the Citadel by selecting from the main menu options in the
navigation pane on the left side of the Web Management Console screen. For the
required initial configuration, you may also use the Citadel Wizard, located at
top of the Home screen.
Below is a table that summarizes the functions of each of the main menu options
and a reference to a detailed explanation in this user manual:
Menu Option Description
Interface Configuring the Citadel's WAN, LAN, WLAN, WAN2 or
DMZ, as well as an external modem to serve as a
back-up Internet connection and a remote access
server, and load balancing.
See Interfaces, page 22.
DHCP Server Configuring the Citadel's DHCP server to automatically
assign an IP address, a default gateway, and DNS
servers to hosts running a DHCP client.
See Dynamic Host Configuration Protocol (DHCP)
Server, page 46.
DDNS Using the Citadel's free Dynamic Domain Name
Service (DDNS) and configuring the router to use
third-party DDNS services.
See Dynamic Domain Name Service (DDNS), page 50.
Firewall Implementing the firewall by building rules, organized
in logical groups.
See Firewall, page 52.
NAT Configuring Network Address Translation (NAT) to
enable a local LAN IP address access the Internet with
a WAN port address.
Configuring virtual servers so that public servers on
the local network/DMZ may be accessible from the
Internet.
See Network Address Translation (NAT) Configuration,
page 57.
PPTP VPN Configuring the Citadel to act as a PPTP VPN server.
See PPTP VPN, page 63.
L2TP VPN Configuring the Citadel to act as an L2TP client in
order to connect to a third-party L2TP server to
establish a VPN connection. Usually used as a
broadband cable network Internet dialer.
See L2TP VPN, page 75.

Citadel CL Series Security and Network Appliance User Manual
8 The Home Screen
Menu Option Description
IPSEC VPN Configuring the Citadel to establish an IPSec VPN that
securely connects two different sites over the Internet.
See IPSec VPN, page 77.
QoS Configuring Quality of Service (QoS) traffic shaping in
order to ensure a high performance level of selected
types of traffic, even when the Internet connection is
loaded.
See Quality of Service (QoS) Traffic Shaping, page 81.
Advanced Configuring advanced features, such as security,
diagnostics, routing, SNMP, and email indication.
See Advanced, page 85.
System Configuring basic settings such as the system date
and time, password, log messages, and more.
See System Settings, page 93.
USB Apps Configuring a range of server applications such as
printer, FTP, Web, and Mail as well as an online
monitoring system with an optional Web camera.
See USB Applications, page 102.
When you select a menu option in the navigation pane, the corresponding
configuration screen appears on the right side of the screen. If there are separate
parts to configure, such as in the Interfaces and USB Apps tab, there are also
tabs along the top right side of the screen.
➣ To display a configuration screen
•Select the required menu option in the navigation pane. The corresponding
configuration screen appears.

Chapter 3: User Interface Elements and Basic Functions
Basic Operations 9
Basic Operations
There are basic operations necessary for completing the configuration of the
Citadel appliance. These include changing, editing, and deleting configurations, as
well as enabling and disabling functions. You perform these basic operations
through clearly defined buttons located on the configuration screens.
The table below lists the different buttons available on the configuration screens
and explains the functionality of each button.
Button Description
Add Adds a group of settings to a list.
Apply Saves the settings configured up to this point on the
configuration screen.
Always click Apply before continuing with the
configuration.
Note: After applying settings, the new settings
replace the default settings.
Cancel Cancels all changes to the configuration.
Change Changes a previous setting to a new setting.
Delete Deletes a selection in a list.
Edit Edits an existing configuration.
Modify Saves the changes to an edited configuration.
Next Continues to the next screen.
Previous Goes back to the previous screen.
Refresh Updates a list of configurations.
Restore Restores the factory default settings to the Citadel.
Upload Loads a previously saved file to the Citadel.

Citadel CL Series Security and Network Appliance User Manual
10 Basic Requirements
Chapter 4: Getting Started
This chapter includes information and procedures to get the Atera Citadel up and
running in your office network. It includes the following sections:
•Basic Requirements, page 10.
•Connection Types (WAN), page 11.
•Establishing Access to the Citadel Web Management Console, page 12.
•Connecting to the Citadel Web Management Console, page 14
•Completing Basic Settings with the Citadel Wizard, page 15.
•Setting Up PCs on the LAN for Internet Access, page 18.
Basic Requirements
The general basic requirements for running the Atera Citadel are as follows:
•Supported operating systems:
•Microsoft Windows (95/98/Me/2000/XP)
•Linux
•MAC
•SUN Solaris
•Ethernet network interface card
•TCP/IP and an Internet browser
•Administrator network privileges
•(For Citadel models with AP-support) An 802.11g (up to 54Mbps) or an
802.11b (up to 11Mbps) Wireless LAN adapter for Wireless LAN clients
ADSL/PPPoE Connection
The specific requirements for a PPPoE/ADSL are as follows:
•Username and password for the PPPoE account (Provided by the ISP)
•External xDSL (ADSL) modem with an Ethernet port (RJ-45)
•ADSL-enabled phone line
•Network Interface Card (NIC) for each personal computer (PC)
•PCs with a Web browser (Internet Explorer 4.0 or higher, or Netscape
Navigator 4.7 or higher)

Chapter 4: Getting Started
Connection Types (WAN) 11
Cable/L2TP Connection
The specific requirements for a Cable/L2TP connection are as follows:
•IP address or domain name of the ISP's LNS (L2TP Network Server) (Provided
by the ISP)
•Username and password for the L2TP account (Provided by the ISP)
•Cable modem with an Ethernet port (RJ-45)
•Network Interface Card (NIC) for each personal computer (PC)
•PCs with a Web browser (Internet Explorer 4.0 or higher, or Netscape
Navigator 4.7 or higher)
Connection Types (WAN)
The Citadel supports the three following ways to connect to the Internet through
its WAN/WAN2 port:
•PPPoE
•DHCP
•Static IP
The table below summarizes the different connection types and when to use
them. By default, the WAN port is set to the DHCP connection type.
Connection Type Use it when you have…
PPPoE •An xDSL Internet connection, such as ADSL/VDSL,
via an xDSL modem, which is usually attached to
the WAN port.
•A direct broadband Ethernet connection to access
the Internet, and a client-end dial-up (virtual PPPoE
dial-up) program is used to authenticate users.
DHCP (Default) •A cable Internet connection with the WAN interface
configured as DHCP. An L2TP client is configured as
well (from the L2TP VPN tab –> L2TP Client) in
order to establish an authenticated connection to
the Internet.
•A direct broadband Ethernet connection, which gets
an IP address dynamically from a DHCP server
residing at your ISP site, and a web user account
authentication procedure is required.
•An xDSL Internet connection, which gets an IP
address dynamically from a DHCP server residing at
your ISP site, and no user account authentication
procedure is required.

Citadel CL Series Security and Network Appliance User Manual
12 Establishing Access to the Citadel Web Management Console
Connection Type Use it when you have…
Static IP •A direct broadband Ethernet connection, and you
need to manually enter the IP address.
•An xDSL Internet connection, and you need to
manually enter the IP address.
Establishing Access to the Citadel Web Management
Console
The Citadel needs an IP address suitable for the LAN before connecting to the
network.
There are built-in default network settings for the LAN:
•IP address: 192.168.1.1
•Subnet mask: 255.255.255.0
Important Note: If you use the default LAN settings, make sure that no
other devices on the LAN hold the default IP address
(192.168.1.1).
The following procedure assumes that you are using the built-in default settings
for the LAN.
➣ To establish PC access to the Citadel Web Management Console
1Connect the supplied power cord to the Citadel.
2Connect the Citadel's LAN port directly to the PC's NIC using a straight-
through cable.
3To modify the PC's network settings to enable it to communicate with the
Citadel, do one of the following:
•If you are running Windows XP, click Start -> Settings -> Control Panel
and then double-click Network Connections.
•If you are running Windows 95/98/Me, click Start -> Settings ->
Control Panel and then double-click Network.
4Right-click a Local Area Connection icon and then click Properties.
Note: If there is more than one existing network connection, choose the
network corresponding to the NIC to which the Citadel is
connected.