Lancom 1751 UMTS User manual

LANCOM 1751 UMTS
110584_LC-1751-UMTS-MANUAL-EN.book Page 1 Tuesday, February 26, 2008 5:16 PM

© 2008 LANCOM Systems GmbH, Wuerselen (Germany). All rights reserved.
While the information in this manual has been compiled with great care, it may not be deemed an assurance of product
characteristics. LANCOM Systems shall be liable only to the degree specified in the terms of sale and delivery.
The reproduction and distribution of the documentation and software included with this product is subject to written per-
mission by LANCOM Systems. We reserve the right to make any alterations that arise as the result of technical develop-
ment.
All explanations and documents for registration of the products you find in the appendix of this documentation, if they
were present at the time of printing.
Trademarks
Windows®, Windows Vista™, Windows XP®and Microsoft®are registered trademarks of Microsoft, Corp.
The LANCOM Systems logo, LCOS and the name LANCOM are registered trademarks of LANCOM Systems GmbH. All other
names mentioned may be trademarks or registered trademarks of their respective owners.
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit http://www.openssl.org/.
This product includes cryptographic software written by Eric Young ([e-mail]).
This product includes software developed by the NetBSD Foundation, Inc. and its contributors.
Subject to change without notice. No liability for technical errors or omissions.
LANCOM Systems GmbH
Adenauerstr. 20/B2
52146 Wuerselen
Germany
www.lancom.eu
Wuerselen, Februar 2008
110584/0208
110584_LC-1751-UMTS-MANUAL-EN.book Page 2 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Preface
3
EN
Preface
Thank you for your confidence in us!
With its integrated UMTS/HSxPA modem, the ADSL2+ router LANCOM 1751
UMTS sets standards in flexibility and redundancy. Should a standard DSL
connection fail at a site, branch office or subsidiary, automatic compensation
is provided by a broadband UMTS/HSxPA or EDGE backup connection. Alter-
natively the ISDN interface can be used as a further backup line or for remote
access. Along with this unique level of high availability, the LANCOM 1751
UMTS is equipped as standard with 5 VPN channels (optionally 25), an inte-
grated ADSL2+ modem and four separately configurable switch ports, so offe-
ring a huge variety of professional applications.
The SIM-card holder is easily accessible via the back cover and, by connecting
an external UMTS antenna, indoor reception can be greatly improved. A real
highlight: Anti-theft by ISDN self-callback and location determination by GPS!
Security settings
To maximize the security available from your product, we recommend that you
undertake all of the security settings (e.g. firewall, encryption, access protec-
tion) that were not already activated when you purchased the product. The
LANconfig Wizard 'Security Settings' will help you with this task. Further infor-
mation is also available in the chapter 'Security settings'.
We would additionally like to ask you to refer to our Internet site
www.lancom.eu for the latest information about your product and technical
developments, and also to download our latest software versions.
User manual and reference manual
The documentation of your device consists of the following parts:
Installation guide
User manual
Reference manual
You are now reading the user manual. It also contains all of the important
technical specifications.
The reference manual can be found on the LANCOM product CD as an Acrobat
(PDF) document. It is designed as a supplement to the user manual and goes
into detail on topics that apply to a variety of models. These include, for
example:
110584_LC-1751-UMTS-MANUAL-EN.book Page 3 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Preface
4
EN
The system design of the operating system LCOS
Configuration
Management
Diagnosis
Security
Routing and WAN functions
Firewall
Quality of Service (QoS)
Virtual Private Networks (VPN)
Virtual Local Networks (VLAN)
Backup solutions
LANCAPI
Further server services (DHCP, DNS, charge management)
This documentation was created by …
... several members of our staff from a variety of departments in order to
ensure you the best possible support when using your LANCOM product.
In case you encounter any errors, or just want to issue critics enhancements,
please do not hesitate to send an email directly to:
[email protected]
Our online services www.lancom.eu are available to you around the
clock should you have any queries regarding the topics discussed in
this manual or require any further support. The area 'Support' will
help you with many answers to frequently asked questions (FAQs).
Furthermore, the knowledgebase offers you a large reserve of infor-
mation. The latest drivers, firmware, utilities and documentation are
constantly available for download.
In addition, LANCOM support is available. For telephone numbers and
110584_LC-1751-UMTS-MANUAL-EN.book Page 4 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Preface
5
EN
contact addresses of LANCOM support, please see the enclosed leaf-
let or the LANCOM Systems website.
Information symbols
Very important instructions. Failure to observe this may result in damage.
Important instruction that should be observed.
Additional information that may be helpful but which is not required.
110584_LC-1751-UMTS-MANUAL-EN.book Page 5 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Contents
6
EN
Contents
1 Introduction 9
1.1 Various backup strategies 9
1.1.1 Backup via mobile-telephony lines 9
1.1.2 Backup via ISDN direct dial connection 11
1.1.3 Backup with VRRP 11
1.2 Location verification via ISDN or GPS 12
1.3 What can your LANCOM do? 13
2 Installation 16
2.1 Package content 16
2.2 System requirements 16
2.3 Status displays, interfaces 17
2.3.1 Status displays 17
2.3.2 Device connectors 22
2.4 Hardware installation 24
2.5 Software installation 25
2.5.1 Starting the software setup 25
2.5.2 Which software should I install? 26
3 Basic configuration 27
3.1 Which information is necessary? 27
3.1.1 TCP/IP settings 27
3.1.2 Configuration protection 29
3.2 Instructions for LANconfig 29
3.3 Instructions for WEBconfig 30
3.4 TCP/IP settings to workstation PCs 35
3.5 Location verification by ISDN or GPS 36
3.5.1 GPS location verification 36
3.5.2 ISDN location verification 36
3.5.3 Configuring location verification 36
110584_LC-1751-UMTS-MANUAL-EN.book Page 6 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Contents
7
EN
4 Security settings 42
4.1 Tips for handling keys 42
4.2 The security settings wizard 42
4.2.1 Wizard for LANconfig 43
4.2.2 Wizard for WEBconfig 43
4.3 The security checklist 44
5 Setting up Internet access 47
5.1 The Internet Connection Wizard 49
5.1.1 Instructions for LANconfig 49
5.1.2 Instructions for WEBconfig 50
5.2 The Firewall Wizard 50
5.2.1 LANconfig Wizard 51
5.2.2 Configuration under WEBconfig 51
6 Connecting two networks 52
7 Providing dial-in access 54
8 Setting up the UMTS profile 56
8.1 Internet access 56
8.2 VPN site coupling 59
8.3 Other settings 61
8.3.1 Choosing the mobile telephone network 61
8.3.2 Activate UMTS/GPRS profile 62
8.3.3 UMTS/HSxPA only or automatic UMTS/HSxPA/GPRS
selection 63
8.3.4 Set up a time limit 64
9 Troubleshooting 65
9.1 No DSL connection is established 65
9.2 DSL data transfer is slow 65
9.3 Unwanted connections under Windows XP 66
110584_LC-1751-UMTS-MANUAL-EN.book Page 7 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Contents
8
EN
10 Appendix 67
10.1 Performance and characteristics 67
10.2 Contact assignment 68
10.2.1 ADSL interface 68
10.2.2 ISDN S0interface 69
10.2.3 Ethernet interface 10/100Base-TX 69
10.2.4 Configuration interface (Outband) 70
10.3 70
10.4 Declaration of conformity 70
11 Index 71
110584_LC-1751-UMTS-MANUAL-EN.book Page 8 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Chapter 1: Introduction
9
EN
1Introduction
Networked cooperation between several offices or even between continents
has become an everyday part of modern business. The paths of communica-
tion between headquarters, subsidiaries and field workers increasingly rely
upon public infrastructures. VPN has become established as the de facto stan-
dard for cost-effective and secure enterprise communications over the Inter-
net.
However, many of important elements in these network structures remain sus-
ceptible to failure which could have severe consequences for business opera-
tions:
The Internet-access cable between the site and the provider could fail;
after damage from construction work, for example.
Provider's network  may be disturbed or even fail.
LANCOM UMTS Routers of the type LANCOM 1751 UMTS are equipped with
a UMTS modem and an ISDN interface to offer two integrated options for
establishing alternative connections. The LCOS operating system provides a
range of security and backup functions to protect your multi-site network
from disturbances of this type.
1.1 Various backup strategies
1.1.1 Backup via mobile-telephony lines
Backup solutions that rely on ISDN or analog telephone lines are the most
common method used today to ensure high availability of data lines such as
those between branch offices and computer centers in large company net-
HEADQUARTER
VPN GATEWAY SERVER
NTBA
VPN ROUTER
INTERNET
ISDN
NETWORK
BRANCH OFFICE
ADSL
UMTS
NETWORK
LAN

110584_LC-1751-UMTS-MANUAL-EN.book Page 9 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Chapter 1: Introduction
10
EN
works. The standard Internet connection is typically provided via an inexpen-
sive DSL connection and a backup line in the form of an ISDN/analog line
takes up the data traffic if the normal line should be disturbed.
As an alternative to this ISDN/analog backup scenario, mobile telephony con-
nections can also be used to ensure the availability of data connections. If an
Internet connection is operated via a LANCOM 1751 UMTS, then any interrup-
tion to the ADSL line can be immediately substituted by the mobile-telephony
line. The LANCOM 1751 UMTS supports all current mobile technologies:
GPRS, EDGE, UMTS and HSxPA.
Advantages of mobile-telephony backup over ISDN/analog:
Faster than ISDN/analog: Data throughput is far higher with UMTS/HSxPA.
HEADQUARTER
VPN GATEWAY SERVERUMTS ROUTER
INTERNET
BRANCH OFFICE
ADSL
UMTS
NETWROK
LAN
The various mobile telephony technologies in overview:
GPRS: General Packet Radio Service, technology for packet-orientated data transfer in GSM
networks. Achieves in practice data-transfer speeds of up to 56 kbps.
EDGE: Enhanced Data Rates for GSM Evolution is technology that increases data rates over
GPRS by using an additional method of modulation. EDGE acheives theoretical data rates
of up to 384 kbps downstream and ca. 110 kbps upstream. EDGE is widely available in
many countries and offers an interesting alternative to UMTS.
UMTS: The Universal Mobile Telecommunications System is also known as the third-gene-
ration mobile-telecommunications standard (3G). The first version of UMTS reaches down-
load rates of 384 kbps.
HSxPA: High Speed Downlink Packet Access (HSDPA) and High Speed Uplink Packet Access
(HSUPA) are protocol additions to UMTS. Various versions of HSDPA achieve download rates
of up to 14.6 Mbps, HSUPA reaches upload rates of up to 5.8 Mbps.
Actual available bandwidths depend on the version supported by the network operator and on
the UMTS modem in use.
110584_LC-1751-UMTS-MANUAL-EN.book Page 10 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Chapter 1: Introduction
11
EN
More secure than ISDN or analog: If physical damage should be the cause
of ADSL-line failure then the ISDN/analog line will generally have been
damaged at the same time because both methods use the same physical
cable.
Cheaper than ISDN: Depending on the tariff, monthly running costs for
mobile telephony can be significantly lower than the costs for an ISDN
connection. As actual downtimes of ADSL connections typically add up to
just a few hours a year, the relatively high connection costs for mobile
telephony are simply not relevant. According to needs, billing can be
based on data volume instead of time.
1.1.2 Backup via ISDN direct dial connection
In the case that a branch office is connected to the headquarters via a VPN
connection, it may well be worthwhile for the Internet-based VPN connection
to be backed up by a direct ISDN dial-in connection in addition to the UMTS/
HSxPA backup. Should the provider's network or the Internet connection to
the headquarters fail, then data transmission can be continued over the ISDN
coupling.
1.1.3 Backup with VRRP
A sophisticated backup system for protection against router hardware failure
can be implemented with VRRP. Two or more routers are installed in a net-
work, one of which can replace the other in case of device failure. In addition
to normal VRRP, LANCOM devices can link the backup event triggering func-
tion to the availability of a data connection. With this additional feature,
LANCOM devices with more than one WAN interface (e.g. DSL and UMTS/
HSxPA interface) can be implemented flexibly in backup solutions. The backup
event is triggered for example, when the default route is no longer available
HEADQUARTER
VPN GATEWAY SERVERUMTS ROUTER
INTERNET
BRANCH OFFICE
ADSL
ISDN
NETWORK
LAN
110584_LC-1751-UMTS-MANUAL-EN.book Page 11 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Chapter 1: Introduction
12
EN
via the DSL interface. The device's UMTS/HSxPA interface can take its place
further along in the backup chain should the the backup router also fail.
Further information on backup solutions using VRRP are available in
the LCOS reference manual.
1.2 Location verification via ISDN or GPS
In large-scale installations with unsupervised routers, there is a risk that the
devices could be stolen and then operated at another location. If the devices
have been configured for RAS access, LAN coupling or VPN connections, a
thief could gain access from a different location to a protected network.
Location verification can prevent the misuse of a router: Each time it is swit-
ched on, the router carries out a check to make sure that it is installed at the
intended location. Only after confirming its location will the router start trans-
ferring payload data over its WAN interfaces.
Two methods of location verification are available:
Via an ISDN telephone call to itself the device can test whether it is con-
nected to the expected ISDN telephone line.
Prerequisites for successful ISDN location verification:
The device must be reachable from the public ISDN telephone net-
work.
The device needs two free B channels for the duration of the check. If
just one channel is free, e.g. one channel at a point-to-multipoint
connection with two B channels is being used for a telephone call,
then the device cannot make a call to itself via ISDN.
UMTS
NETWORK
HEADQUARTER
VPN GATEWAY SERVERPC UMTS ROUTER
INTERNET
BRANCH OFFICE
ADSL
ISDN
NETWORK
VPN ROUTER
110584_LC-1751-UMTS-MANUAL-EN.book Page 12 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Chapter 1: Introduction
13
EN
By means of GPS location determination the device can compare the
actual geographical coordinates with the set values. A tolerance of a few
meters is necessary.
Prerequisites for successful GPS location verification:
A suitable GPS antenna must be connected to the AUX connector.
The GPS signal must be of sufficient strength at the location.
A SIM card for mobile telephone service is inserted and the device is
connected to a cellular network.
1.3 What can your LANCOM do?
The following table shows the properties and functions of your device
LANCOM
1751 UMTS
Applications
Internet Access ✔
LAN to LAN coupling via VPN ✔
LAN to LAN coupling via ISDN ✔
RAS server (via VPN) ✔
RAS server (via ISDN) ✔
IP router ✔
NetBIOS proxy for coupling of Microsoft peer-to-peer networks via ISDN ✔
DHCP and DNS server (for LAN and WAN) ✔
Advanced Routing and Forwarding (ARF networks) 8
N:N mapping for coupling networks using the same IP address ranges ✔
Configuring LAN ports as additional WAN ports ✔
Policy-based routing for policy-based selection of target routes ✔
Load-balancing for bundling of multiple DSL channels 4 channels
Backup solutions and load balancing with VRRP ✔
110584_LC-1751-UMTS-MANUAL-EN.book Page 13 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Chapter 1: Introduction
14
EN
PPPoE Server ✔
WAN RIP ✔
Layer 2 QoS tagging ✔
802.1p ✔
NAT Traversal (NAT-T) ✔
DMZ with configurable IDS checks ✔
ISDN leased lines ✔
LANCAPI server to provide office applications such as fax or answering
machine via the ISDN interface. ✔
WAN connections
Integrated ADSL modem (with ADSL2+) ✔
Integrated UMTS/HSxPA modem (GPRS, EGDE, UMTS, HSxPA) ✔
ISDN S0bus in multi device-mode or in point-to-point mode with automatic
D-channel protocol identification. Supports static and dynamic channel bun-
dling per MLPPP and BACP as well as Stac data compression (Hi/fn)
✔
LAN connection
Separate FastEthernet LAN ports, individually switchable, e.g. as LAN switch
or separate DMZ ports; auto crossover.
Alternatively switchable as a WAN interface.
4
Security functions
IPSec encryption via external software (VPN client) ✔
5 integrated VPN tunnels for secure network connections ✔
IPSec encryption in hardware (optional; activated with the VPN-25 option) ✔
IP masquerading (NAT, PAT) to conceal individual LAN workstations behind a
single public IP address. ✔
Stateful-inspection firewall ✔
Firewall filter for blocking individual IP addresses, protocols and ports ✔
LANCOM
1751 UMTS
110584_LC-1751-UMTS-MANUAL-EN.book Page 14 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Chapter 1: Introduction
15
EN
MAC address filter regulates, for example, LAN-workstation access to the IP
routing function ✔
Protection of the configuration from brute-force attacks. ✔
Anti-theft with verification via or ISDN or GPS. ✔
Configuration
Configuration with LANconfig or via web browser; additional terminal mode
for Telnet or equivalent terminal programs; SNMP interface and TFTP server
function.
✔
1-Click-VPN wizard for easiest setup of RAS access and site-to-site LAN cou-
pling via VPN ✔
Remote configuration via ISDN (with ISDN PPP connections, e.g. via Win-
dows Dial-Up Networking). ✔
Serial configuration interface ✔
Call-back function with PPP authentication mechanisms allowing only prede-
fined ISDN call numbers ✔
FirmSafe for no-risk firmware updates ✔
Optional software extensions
LANCOM VPN Option with 25 active tunnels for secure network coupling;
includes activation of the hardware accelerator ✔
Optional hardware extensions
19" Rackmount-Adapter ✔
LANCOM
1751 UMTS
110584_LC-1751-UMTS-MANUAL-EN.book Page 15 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Chapter 2: Installation
16
EN
2 Installation
2.1 Package content
Before beginning with the installation, please check that nothing is missing
from your package. Along with the LANCOM UMTS Router the box should
contain the following accessories:
Should anything be missing, please take up immediate contact to your dealer
or to the address on the delivery note supplied with your device.
2.2 System requirements
Computers that connect to a LANCOM must meet the following minimum
requirements:
Operating system that supports TCP/IP, e.g. Windows Vista™,
Windows XP, Millennium Edition (Me), Windows 2000, Windows 98,
Linux, BSD Unix, Apple Mac OS, OS/2.
The LANtools also require a Windows operating system. A web brow-
ser under any operating system provides access to WEBconfig.
LANCOM
1751 UMTS
12 V DC power adapter ✔
LAN cable (green connectors) ✔
ADSL connector cable (transparent connectors) ✔
ISDN connector cable (light-blue connectors) ✔
Connector cable for the configuration interface ✔
Two 2-dBi dipole UMTS/GPRS antennas (850-960 Mhz and
1700-2220 Mhz) with SMA connector ✔
GPS antenna with SMA connector and 5 m cable ✔
LANCOM CD ✔
Printed documentation ✔
110584_LC-1751-UMTS-MANUAL-EN.book Page 16 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Chapter 2: Installation
17
EN
2.3 Status displays, interfaces
2.3.1 Status displays
Meanings of the LEDs
In the following sections we will use different terms to describe the behaviour
of the LEDs:
Blinking means, that the LED is switched on or off at regular intervals in
the respective indicated colour.
Flashing means, that the LED lights up very briefly in the respective
colour and stay then clearly longer (approximately 10x longer) switched
off.
Inverse flashing means the opposite. The LED lights permanently in the
respective colour and is only briefly interrupted.
Flickering means, that the LED is switched on and off in irregular inter-
vals.
Front side
The LANCOM UMTS Routers have status displays on the front panel.
Top
The two top-mounted LEDs enable the main function status to be assessed
even if the device is positioned vertically.
LANCOM 1751 UMTS
Power
ADSL Status
Online UMT Status ETH 1 ETH 2
ADSL Data
UMTS Data VPN ETH 3 ETH 4
ISDN Status
ISDN Data

    
Power
Online
110584_LC-1751-UMTS-MANUAL-EN.book Page 17 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Chapter 2: Installation
18
EN
Power This LED provides information on the device's operating state. After being
switched on, it blinks green during the self-test. The LED then shines con-
stantly to indicate operational readiness, unless an error is detected as indi-
cated by a code blinked in red.
The power LED blinks alternately in red/green until a configuration
password has been set. Without a configuration password, the confi-
guration data in the LANCOM are unprotected. Normally you would
set a configuration password during the basic configuration (instruc-
tions in the following chapter). Information about setting a configu-
ration password at a later time is available in the section 'The Security
Wizard'.
Off Device switched off
Green Blinking Self-test after power-up
Green On (perma-
nently) Device operational
Red/green Blinking alterna-
tely Device insecure: Configuration password not set
Red Blinking Time or charge limit on online connections has been
reached
Red Blinking The device is locked because location verification was
not successful
110584_LC-1751-UMTS-MANUAL-EN.book Page 18 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Chapter 2: Installation
19
EN
Online The online LED displays the general status of all WAN interfaces:
ADSL status Information on connection status at the ADSL connector:
The power LED is blinking and no connection can be
made?
If the power LED blinks red and no WAN connections can be
established, there is no cause for concern. This merely means
that a pre-set charge or time limit has been reached.
There are three ways to remove the lock:
Reset the toll protection.
Increase the limit.
Deactivate the lock completely (set limit to '0').
LANmonitor shows you when a charge or time limit has been reached. To reset the toll protec-
tion, activate the context menu (right-mouse click) Reset charge and time limits. The charge
settings are defined in LANconfig under Management Costs (these settings are only avai-
lable if the 'Complete configuration display' is activated under Tools Options).
With WEBconfig, resetting the toll protection and all parameters are found under Expert con-
figuration Setup Charges.
Power
Power
Signal that a
charge or time
limit has been
reached
Off No active connection
Green Flashing Opening the first connection
Green Inverse flashing Opening an additional connection
Green On (perma-
nently) At least one connection is established
Red On (perma-
nently) Error establishing the last connection
Off Interface deactivated
Green Blinking/flashing Handshake/training
Green Permanently Synchronization successful
Red Flickering Error (CRC error, framing error, etc.)
Red On (permanently) No synchronization, searching for remote station
Red/
orange Blinking Hardware error
110584_LC-1751-UMTS-MANUAL-EN.book Page 19 Tuesday, February 26, 2008 5:16 PM

LANCOM 1751 UMTS
Chapter 2: Installation
20
EN
ADSL data Information on data traffic at the ADSL connector:
ISDN status Information on connection status at the ISDN S0connector:
If the ISDN status LED goes off automatically, this does not indicate
an error at the S0bus. It is in fact because several ISDN connections
and PBXs switch the S0bus into power-saving mode after a certain
period of inactivity. When needed, the S0bus automatically reactiva-
tes and the ISDN status LED illuminates in green.
ISDN Data Status display for both ISDN B channels:
Off No logical connection
Green Blinking Opening the first connection
Green Inverse flashing Opening an additional connection
Green Permanently At least one logical connection is established
Green Inverse flickering Data traffic (send or receive)
Off Not connected or no S0voltage (no error message)
Green Blinking D-channel initialization (establishing contact to provider)
Green On (perma-
nently) D-channel operational
Red Flickering D-channel error
Red On (perma-
nently) D-channel activation failed
off No connection established
green Blinking Dialling
green Flashing Establishing first connection
green Inverse flashing Establishing further connection
green Constantly on Connection established via B channel
green Flickering Data traffic (send or receive)
110584_LC-1751-UMTS-MANUAL-EN.book Page 20 Tuesday, February 26, 2008 5:16 PM