Nortel C251 User manual

Conti vity251 ABOT Deployment Version 1.0 April 26, 2004
Technical Configuration Guide
Contivity 251 ABOT
Deployment using Web GUI
Version 1.0

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
Abstract
Thisdocumentdetailsa methodologyforusing Web GUItoeffectivelyand economically
deploy Contivity251 ABOT connectionsto their central office.
Revision Control
No Date Version Revised by Remarks
1 4/1/2004 draft Shangli Lu Initial Draft
2 4/26/2004 V1.0 Shangli Lu Reflected comments from reviewing
Copyright © 2004 Nortel Networks
All rightsreserved. January2004
Theinformation in thisdocumentissubjecttochange withoutnotice. The statements,
configurations, technical data, and recommendationsinthisdocumentarebelievedtobe
accurate and reliable,but are presented without expressor implied warranty. Usersmust take
full responsibility for theirapplicationsofanyproductsspecified in thisdocument. The
information in thisdocument isproprietary to Nortel NetworksInc.
The softwaredescribed in thisdocumentisfurnished under alicense agreementandmaybe
used onlyin accordance with the termsof thatlicense.
Trademarks
NortelNetworks, the Nortel Networkslogo, theGlobemark, Unified Networks, and Contivityare
trademarksof Nortel Networks.
Adobeand AcrobatReader are trademarksof AdobeSystemsIncorporate.
All other productnames, companynames,marks, logos, and symbolsare trademarksof their
respectiveowners.

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
Table of Contents
TU1.UT TUINTRODUCTIONUT............................................................................................................5
TU1.1UT TUC200- CONTIVITY GATEWAY ABOT TOPOLOGYUT ..................................................................5
TU1.2UT TUTARGET AUDIENCESUT ......................................................................................................6
TU1.3UT TUCONTIVITY 251 BRIEFUT.....................................................................................................6
TU1.4UT TUWHY ABOT?UT ...............................................................................................................7
TU1.5UT TUC200 CLIENT EMULATIONUT ...............................................................................................7
TU1.6UT TUADSL BRIEFUT .................................................................................................................8
TU2.UT TUDEPLOYMENT METHODUT ..............................................................................................9
TU2.1UT TUPLANNING YOUR VPN NETWORKUT......................................................................................9
TU2.2UT TUSELECT CONTIVITY SWITCHESUT..........................................................................................9
TU2.2.1UT TUSelect Contivity Secure IP Services GatewayUT ..............................................................9
TU2.2.2UT TUSelect C251 modelUT............................................................................................... 10
TU2.2.3UT TUIn areas where ADSL service is not availableUT ........................................................... 10
TU2.3UT TUGATHERING INFORMATION FROM ISPUT .............................................................................. 10
TU2.3.1UT TUVPI & VCIUT ......................................................................................................... 10
TU2.3.2UT TUStatic IP address for Contivity Gateway in COUT.......................................................... 11
TU2.4UT TUDEFINE A SCHEME FOR PRE-SHARED KEYSUT ........................................................................ 11
TU2.5UT TUDEFINE A SCHEME FOR ABOT INITIATORIDUT ..................................................................... 11
TU2.6UT TUDEFINE A SCHEME FOR BOIP ADDRESSESUT......................................................................... 12
TU2.7UT TUMINIMUM SOFTWARE REQUIREMENTUT................................................................................ 12
TU2.8UT TUMINIMUM LAB REQUIREMENTUT ....................................................................................... 12
TU2.9UT TUCONFIGURING CONTIVITY GATEWAY INCOUT...................................................................... 12
TU2.10UT TUPREPARE C251 CONFIGURATION FILESIN COLABUT .......................................................... 12
TU2.11UT TUC251 FACTORY DEFAULTSAND MINIMUM CHANGESUT ....................................................... 13
TU2.11.1UT TUReset to factory defaultUT......................................................................................... 14
TU2.11.2UT TUUsing the Reset ButtonUT ......................................................................................... 14
TU2.11.3UT TUUploading a Configuration File via Console PortUT...................................................... 14
TU2.12UT TUPROVIDE END-USERS WITH INSTRUCTIONSUT.................................................................... 14
TU2.13UT TUDOWNLOADINGCONFIGURATIONFILES FROM COLAB TO REMOTE C251UT ............................ 15
TU3.UT TUCONTIVITY C251 DEPLOYMENT EXAMPLEUT............................................................... 16
TU3.1UT TUABC VPN DEPLOYMENTTASKSUT..................................................................................... 16
TU3.2UT TUNETWORK PLANNINGUT.................................................................................................... 16
TU3.3UT TUABC VPN TOPOLOGYUT .................................................................................................. 17
TU3.4UT TUORDER EQUIPMENT AND SERVICESUT .................................................................................. 17
TU3.5UT TUSETUPCOLABUT........................................................................................................... 18
TU3.6UT TUCONFIGURE CONTIVITY GATEWAY 1100UT .......................................................................... 19
TU3.6.1UT TUConfigure IP address & DHCP for C1100:UT .............................................................. 19
TU3.6.2UT TUConfigure User Group for C1100UT ........................................................................... 20
TU3.6.3UT TUConfigure Branch Office Group for C1100UT............................................................... 23
TU3.7UT TUPRE-BUILD CONFIGURATION FILE FOR BOC251_OFFICE_6UT................................................... 25
TU3.7.1UT TUStartup with “Wizard Setup”UT ................................................................................. 26
TU3.7.2UT TUChanging VPI& VCIUT ........................................................................................... 27
TU3.7.3UT TUChanging LAN IP addresses and DHCP server IP.UT .................................................... 29
TU3.7.4UT TUPower OFF and Power OnC251UT ........................................................................... 30
TU3.7.5UT TUTest ATM and Internet connectionUT .......................................................................... 31
TU3.7.6UT TUConfigure VPN Client TunnelUT ................................................................................ 32
TU3.7.7UT TUCheck VPN Client Tunnel statusUT............................................................................. 35
TU3.7.8UT TUTest VPN Client TunnelUT ........................................................................................ 39
TU3.7.9UT TUConfigure VPN ABOTUT .......................................................................................... 41
TU3.7.10UT TUActivate VPN ABOT TunnelUT .................................................................................. 43
TU3.7.11UT TUTest VPN ABOT TunnelUT........................................................................................ 44

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
TU3.7.12UT TUEvent Log on C251UT .............................................................................................. 44
TU3.7.13UT TUVPN-SA MonitorUT................................................................................................. 45
TU3.7.14UT TUABOT Session status on C1100UT .............................................................................. 45
TU3.7.15UT TUEvent Log on C1100UT ............................................................................................ 46
TU3.7.16UT TUPing BO-6 LAN from C1100 LANUT........................................................................... 47
TU3.8UT TUSAVE CONFIGURATION FILE AND RENAME ITUT ..................................................................... 49
TU3.9UT TUREPEATTHE PROCEDURE TO THE REST OF BOUT .................................................................... 49
TU3.10UT TUPREPARE CONFIGURATION FILESFOR BOUSING DIFFERENT VPI/VCIUT ................................. 49
TU3.10.1UT TUChange VPI& VCI number before savingUT................................................................ 49
TU3.10.2UT TUHow to change VPI& VCI numberUT......................................................................... 50
TU3.11UT TUSTART DEPLOYMENTUT................................................................................................ 50
TU3.11.1UT TUBO Office-6 deployment, setup User ClientUT .............................................................. 51
TU3.11.2UT TUDownload the configuration file to BO Office-6UT ........................................................ 51
TU3.11.3UT TURepeat the procedure to the rest BOsUT ...................................................................... 52
TU4.UT TUREFERENCE DOCUMENTATION:UT ............................................................................... 53
TU5.UT TUAPPENDIX A: TERMINOLOGYUT.................................................................................... 54
List of Figures
TUFigure 1: C200 series ABOT Deployment ScenarioUT..........................................................................5
TUFigure 2 C251 Front ViewUT ..........................................................................................................6
TUFigure 3 C251 Rear ViewUT ...........................................................................................................6
TUFigure 4: ABC VPN TopologyUT ................................................................................................... 17
TUFigure 5: ABC CompanyCO LABUT .............................................................................................. 18
TUFigure 6: ConfigureC1100 from Factory DefaultUT.......................................................................... 19T

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
1. Introduction
Thisdocumentproposesa method for using the Web GUItoeffectivelyand economicallydeploy
large quantitiesofAsymmetricBranch OfficeTunnels(ABOT) between Contivity251 (C251)
switcheslocatedin variousbranch officestoa Contivitygatewayin a Central Office (CO). See
Figure 1 for topology.
Themethod takesthe advantage of the unique feature of “Client Emulation”in C200 seriesto
allownon-technical end-usersto create IPSec VPNuser tunnelsbetween C251 and Contivity
gatewayin CO.The user tunnelsarethenused bytechnical personal in COtogain controlsof
remote C251 for furtherdownloadingprepared configurationfilesinorder to complete the
complex ABOT configurations.
For simplicity, the termsof “Contivity” and “Contivity Secure IP ServicesGateway” are used
interchangeablyin thisdocument.
1.1 C200- Contivity Gateway ABOT Topology
Figure 1: C200 series ABOTDeployment Scenario
Internet
Contivit
y
Gateway
CO
NOC
C251
Home Office
C221
SOHO
C251
Remote
offi ce
C251
SOHO
C221
Remote
offi ce
C251
SOHO
C251
Remote
offi ce

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
1.2 Target Audiences
The targetaudiencesare networkdesigners, networkdeployment engineers, installation
engineers, salesengineersfor Enterprisesor Carriers, networkplanners, and those whoare
interestedin using the Web GUIto configureor deployABOT for Contivity 200 seriesunits.
1.3 Contivity 251 brief
Contivity 251 (C251)istheideal VPNover high-speed Internet access solution forSOHOand
small branch office. Itiscapable of terminating IPSecat CO Contivityandare ideal for provider
provisioned networksor large enterprise deployments
C251 supportsup to five VPNBranch OfficeTunnel (BOT) connectionssimultaneously, and
integratesfourhigh-speed 10/100MbpsLAN portsand one high-speed ADSL portinto a single
package.The ADSL port supportsdownstream transmission ratesup to 8Mbpsand upstream
transmission ratesup to 832Kbps.
C251 support two typesof VPN connection: BranchOffice Tunnel (BOT)andContivity Client
tunnel.TheBOT supportsfull VPN rules, while Contivity Clientsupportsa simple VPN rule.
C251 VPNisbased on IPSecstandard and isfullyinteroperablewithother IPSec-basedVPN
product.
For full feature description, refer to NTP“Contivity251VPNSwitch User’sGuide” from Nortel
Customer Support Web
Figure 2 C251 Front View
Figure 3 C251RearView

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
1.4 Why ABOT?
C251 supportsboth Asymmetric Branch OfficeTunnel (ABOT) and Peer-to-Peer BOT. Peer-to-
Peer BOT usemain mode for IKEphase 1 exchange, andmainmode can onlybeusedifboth
VPN switcheshave fixed public IP addresses. Sincethe C251’spublicinterface IPaddressis
normallydynamicallyassignedby ISP DHCP server, Peer-to-peer branch tunnels are not
applicable.
ABOT issuitable fora BOT witha fixed IPaddresson one end while adynamicallyassignedIP
addresson theother end.To make ABOT connection work, theend with adynamicIPaddress
must beconfiguredastheinitiatorandthe other end with fixedIPaddressconfiguredasthe
responder.Inour case, the C251 must beconfigured as“Aggressive”mode to behave asan
“initiator”, and the ContivityGatewayin COmust be configured asthe “responder”. InABOT
tunnel,only the Initiator (C251) can bringup the tunnel.
1.5 C200 Client Emulation
The Contivity 200 serieshave a unique feature called“Client Emulation”. Since thisfeature
allowsa C200toactasa user toestablish aVPN tunnel to a remote ContivityGateway,itisalso
called “Hard Client”. HardClientusesthe IPSecprotocol and supportsa simpleVPN rule.It
provideseasy configuration,and can be setup by non-technical endusers. Then, CO technical
personalscan use client tunnel connection togain remote control and perform further
configurationson C200,e.g. ABOT,firewall,NAT andetc.
By default, the Client Emulation isconfigured asa “ManualTunnel” and requiresuser intervention
to “Connect” thetunnel.Onrelease V2.1, the Client Emulation supports“ondemand” tunnelingas
well. In “on demand” mode, the client tunnel isautomatically created whenever trafficdemandsa
tunnel connection and the userintervention isnot required. Bothmodesare initiatedonlyon
C200 side.
To enable “On-Demand”mode,go to VPNmenu, selecta client rule, then select“Advance” to
open the windowbelow,and checkthe “On Demand ClientTunnel”.
C200 allowsonlyone active Contivity Client ata time.Thatis, when Clienttunnel isactivated,all
other VPN connectionsmust bedeactivated.
In the “ClientEmulation” configuration, there isa many-to-one NAT filter from the C200 private
LAN to the remote privateLAN behind CO Contivitygateway.Many-to-Onemode mapsmultiple
private IP addresseson C200LAN to theIPaddressassigned byCO Contivity gateway.Thisis

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
equivalentto251'sSingle User Account feature (SUA).Therefore, traffic sent fromthe Contivity
Gateway private networkto the C200private networkdoesnotmake it furtherthan the C200
assigned address.
In ClientEmulation configuration,the CO siteisable tomanage C200butisnot able to manage
C200’sprivateLAN since M:1 NAT inbound traffic cannotestablish connectionswithoutport
forwardingenabled. For full VPN capabilities, users should setup BranchOffice Tunnels, either
ABOT or staticBOT.
1.6 ADSL brief
ADSL (Asymmetric Digital Subscriber Line) isa proven technology thattakesthe advantage of
standard copperloopstelephone linestoprovide high-speed Internet“alwayson” access. ADSL
hasitsdownstream capacityhigher than itsupstream capacity.E.g. Contivity251 ADSL supports
downstream ratesup to 8Mbpsand upstream ratesup to 832Kbps.
ADSLuses signal frequenciesabove those usedby voice or fax, so the data signal doesnot
interfere with telephone signal.
In SOHOsite,datatrafficand voice trafficare separated by splitters. On COsite,they are
separated bya Digital Subscriber Line AccessMultiplexer (DSLAM) switch. Voice trafficisthen
sent toPSTN, while data trafficissent to ATM backbone connecting to ISP andInternet.
The diagram belowillustratesthe keyelementsof ADSL.
Figure 4 ADSL Major Components
DSLAM
splite
Internet
ATM or F
R
splite
ISP
PST
N
SOH
O
Phone
wi r
e
fax phone
PC
Contivity251
Or ADSL Modem
C
O
8M
0.8M

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
2. Deployment Method
ABOT support full setsof VPN feature. But ConfiguringABOT requirestechnical experiencesand
resources. The proposed deploymentmethodusesClientEmulation feature asafirst step stone
to establish aVPN connection betweena C251 inbranchofficeanda gatewayin CO.ABOT
configuration filesare prepared in a CObytechniciansthendownloadtothe C251 in remote
branch office over the ClientEmulationVPN connections.
Configuring “ClientEmulation”issimple andcan be done byanynon-technical resourceswithout
requiring on-sitetechnical support.Therefore, C200 seriescanbedirectly shipped from
manufacturestoend usersusing factorydefaultconfigurationwithout requiring special staging
services.
Thisdeploymentmethodiscoveredin the following steps:
•Planning your VPN network
•Selecting Contivity hardware.
•Obtaining networkdata from ISP
•Preparing C251 ABOT configuration files(rom-0) for all sites
•Providing remoteend-userswith simple instructionsto setup& start C251 Client tunnel.
•Downloadingpreparedconfigurationfile from COto remote C251 over clienttunnel.The
C251 will auto-reboot toactivatetheABOT configuration.
•Testingthe ABOT tunnel using PING.
Thismethodisassumingthat COtechnical resourceshave taken training classesof Nortel
Contivity products.
2.1 Planning your VPN Network
Before deployment,the VPNnetworkshouldbe planned first. Networkplanning includesvarious
tasks such asdeterminingNetworktopology, networksize, branch officelocations, COlocation,
Contivity VPN devicemodels, bandwidthrequirement, encryption type, NAT, and etc.
The followingquestionsshouldbe answeredfor planning deployment of ABOT connections:
•How many remotebranch office (BO) sitesare planned?
•What typeof Internetaccess servicesisavailable in theremoteBO?
•What typeof Contivity Gatewayin COisrequired to support the current VPN
requirement,e.g.number of tunnels, bandwidth,interface, andetc?
•Do you consider future growing (more BOs will join in nearfuture?)
•What typesof C200are selected, C251 orC221? (Consider the typesof serviceavailable
ina BO area,e.g. ADSL? CableModem? SatelliteInternet access?)
•What types of IP address scheme will be used for your VPN?
•What types of “initiator ID” scheme will be used for your VPN?
•Draw a Networktopologyprior to the deployment.
2.2 Select Contivity Switches
2.2.1 Select ContivitySecure IP Services Gateway
The following Contivityproductscan beused asGatewaysin CO.
•Contivity 1000 series(1010,1050,1100): Up to30 VPNtunnels
•Contivity 600:Up to 50 VPN tunnels

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
•Contivity 1700 series(1700 and 1740): Up to 500VPN tunnels
•Contivity 2700: Up to2000VPN tunnels
•Contivity 5000: Up to5000VPN tunnels
If Contivity200 seriesisplanned tobe used in CO,thismethodisnotapplicable, since C200
Hard Client cannot connectto C200 gateway.Thus, manually configuring isrequired.
2.2.2 Select C251 model
Refer to the following information to select suitable C251 modelsfor locationswhere ADSL
servicesare available.
CA251: Annex A
•ADSL over analog phone service
•Tone6~31 (25 ~138 KHz)
•Multi-mode, G.DMT, ANSI T1.413, G.Lite
•Used throughout North, South and Central America, Asia and portions of
Europe.
CB251: Annex B
•ADSL over ISDN,
•Tone29~63 ( 125 ~270KHz)
•Multi-mode, G.DMT, ETSI
•Used mostly in Europe
CU251: U-R2
•ADSL over ISDN
•Tone29~63 ( 125 ~270KHz)
•Multi-mode, G.DMT, ETSI
•Used in Germanywith Deutsche Telecom
2.2.3 In areas where ADSL service is not available
In theareaswhere ADSL serviceisnotavailable, consider using C221over satellite-based
Internet service orover Broadband High speedinternet access service. E.g. DIRECWAYprovide
satellite-based Internet serviceanywherein the continental U.S.
2.3 Gathering Information from ISP
2.3.1 VPI& VCI
The Virtual Path Identifier (VPI) and Virtual Circuit Identifier (VCI) for ISP ATM backbone are the
most importantinformation to enter to geta C251ADSL working.Each ADSL serviceprovider
usesa set of these two numbers.
Below are a list of the ADSL service Providersand their corresponding VPI/VCI numbersfor
configuring ADSLModemsto workon their Networks. Users should alwayscontact with their
service providersfor the updated information.

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
•DSL Extreme 0/35
•BellSouth8/35
•Earthlink 0/35
•Covad0/35
•Ameritech 0/35
•WorldCom 0/35
•New Edge 0/38
•SouthWestern Bell 0/35
•Pac Bell 0/35
•Verizon0/35
•Sprint8/35
•US West/Qwest 0/32
2.3.2 Static IP address for Contivity Gatewayin CO
A staticIPisa fixed IP that your ISPguaranteed you. AdynamicIPisnot fixed, anditis
dynamically assignedby your ISPeach time youlogin.
A fixed IP address should be purchased from your ISPfor the ContivityGateway publicinterface.
Since thispublicinterface IPaddresswill beconfigured inall C200,a dynamically assigned IP
addressisnot suitable.
2.4 Define a Scheme for Pre-shared keys
A pre-shared keyidentifiesa communicating partyduring a phase 1 IKEnegotiation. BothABOT
connection and Client tunnel connection require pre-shared keys. Plan your “key” scheme,and
generate keysfor each branch office.
2.5 Define a Scheme for ABOT Initiator ID
With aggressive negotiationmode, the C251 uses“Initiator ID” toestablish ABOT to remote
gateway.The “InitiatorID” on theC251 isconfigured in the “content” field asa DNSdomainname
or E-mail address. The DNSdomain name or E-mail addressin the “Local IDType”fieldisused
only for identification purposesand doesnotneed to bea real domain name or e-mail address.
If you select “IP” asyour “Local IDType”, you must create an Initiator IDthat conformsto the rigid
IP formatin order to be acceptedby C251.The IPaddressisused onlyasanID andneedsnotto
bea real address.
Since C251 allowsitsDNS domain name orE-mail addressto haveupto31 characters, it
providesnetworkdesignersa flexibilityto compose variousidentifications. When using special
characters, make sure they are accepted by both CO and BO. This ID will be used in the event
log bythe COgateway during communication,anditisimportant to plana scheme and make the
ID meaningful for future troubleshooting,logging, andaccounting.
Each C251 must have auniqueID. Duplicated ID will be rejectedby gateway from connection.

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
2.6 Define a Scheme for BO IP addresses
Determine the private IPnetworkaddressesfortheLANoneach site. Private IPaddressescan
be selected from:
•10.x.x.x
•172.16.x.x-172-31.x.x
•192.168.x.x
Ensure each BO LAN isassigned witha unique IP addressto simplify configuration task.
Reserve 192.168.1.0/24 for usingonlyby C221 factory-default configuration to avoid potential
addressconflicts.
Private LANaddressbehindCO gateway shouldnot use reserved 192.168.1.0/24.
Define subnetsize for each site. 8bitssubnet with amaskof 255.255.255.0 iscommonlyused
anditiseasy to configure and allowsup to 254hosts.
2.7 Minimum software requirement
To use thismethod,theminimum requirementof softwarefor C251 isV2.1.If you are currently
running V2.0, upgradeittoV2.1.
2.8 Minimum LAB requirement
The minimum requirementsfor successful deploymentsare:
CO gatewayisable to accessto Internetand hasa fixed IP assigned byISP
PCswith Microsoft WindowsandInternet Explorer
C251 isabletoaccessto the Internet viaADSLconnection.
CO technical personal weretrained to have knowledge of Nortel Contivityproducts.
If your budgetallows, you may want tobuilda controlledlab environment tosimulateADSL ISP.
To doso, youmay need to purchase aDSLAM switch, and routerswith ATM interfaces.
2.9 Configuring Contivity Gateway in CO
The minimum requirementsfor configuring COContivityGatewayare:
•Upgrade Contivity Gateway software to be 4.80and above
•Configure privateandpublicinterfacesof ContivityGateway.
•Configure atleast one usergroup forC251Client connection
•Configure Branch Officegroups. One connectionper remote C251. Organizegroupsand
connectionsand name them to suit your organization needs.
•Configure IPaddressespoolsfor C251 Hard Clientaddressassignment.
•Configure Contivity forInternetaccess, and test the connection by surfing internet.
2.10 Prepare C251 configuration files in CO Lab

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
1. Make sure that the C251 isreset to factory default.
2. Change C251VPI/VCI to thenumber providedby ISP,and test DSL connecton.
3. Change theC251 LAN with plannedIPaddressand subnet.
4. Configure the C251 with:
One client tunnel (inactive).
OneBO tunnel (active).
5. Test the configuration to ensure thatboth ABOT and Client tunnelsare able to be
established.
6. Savethe configuration file to local computerdiskwith a unique file name. Suggest that
thefile nameisbound with BOlocation.
7. Repeat theabove proceduresfor eachC251 and remotesite.
2.11 C251 Factory Defaults and minimum changes
The C251isshipped with a default factory configuration,and the defaultparametersworkwith
the majorityof ADSL ISP installations, but theymay require minimum changesfor working with
some ISPs.
With the default configuration, C251’s DHCP server on its private interface is enabledand the
addressrangesfrom 192.168.1.3 to 192.168.1.254/24.The C251hasa defaultmanagement
interface addressof 192.168.1.1/24 witha defaultpassword of “setup”. PCsconnecting to the
C251 privateinterface will be assigned an IP addressin the same subnetifthey have dynamic
addressing configured.
The factory default configuration has the DHCP client enabled on the public interface. When
connecting to an ISP,a dynamic public IPaddresswill be assigned byISP.Thisdefault
configuration allowsend usersto accessto the Internetin a plugandplay fashion.
The C251hard clientisdesigned asa 3DES client,and uses3DES/SHA to connect to the CO
Contivity user group.Thismethodisthemost secure algorithm of SAoffered in thisrelease.
The C251hasa default WAN setting asfollowing.The WAN default setting workswith most
ADSL ISPproviders. The VPI/VCInumber may slightlydiffer from providers.
•Routing mode
•LLC multiplex
•ENET ENCAP encapsulation
•VPI/VCI as 8/35
URouting mode
Routing mode isthedefault setting,and should alwaysbe used for building VPN network
regardlesswho isyour ISP.Selecting “bridge mode” may allow you to accessto Internet, butnot
allow you to establish VPN connection toContivitygateway.
UENET ENCAP Encapsulation
Be sure touse the encapsulation method compatible with your ISP.
The C251 supports various encapsulation methods, and the default mode of “ENET ENCAP” will
workwith almost all the ISP providers. “ENET ENCAP”methodistheMAC Encapsulated Routing
LinkProtocol implemented with the IP networkprotocol. IP packetsare routed between the
Ethernetinterfaceand the WANinterface andthen formatted so thattheycan be understoodina
bridged environment. For instance,it encapsulatesrouted Ethernetframesintobridged ATM
cells. ENET ENCAP requiresthat you specifya gateway IP addressin theEthernet
Encapsulation Gateway field.

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
ULLC-based Multiplexing
LLC-basedmultiplexingisthe default factory setting and carriesmultiple protocolsoveroneVC,
anditisused bymost ISPs.
UVPIand VCI
The default factory setting of VPI/VCIis0/35.Besure touse the correctVirtual Path Identifier
(VPI) and Virtual Channel Identifier (VCI) numbersassigned to you.
2.11.1Reset tofactorydefault
It is important to make sure that your C251 isin factory default setting before starting
configurations, since themethodisbasedon the assumption that yourc251 isconfigured with
default factory setting.If youare not sure,use thefollowing waysto resetit.
2.11.2Using the Reset Button
•Make sure the SYSLEDison (not blinking).
•Pressthe RESET buttonfor about five seconds, and then release it.The SYSLED
beginsto blink, and then reboot.The defaultsfactory settingisrestored when the
Contivity 251bootsup.
2.11.3Uploading a Configuration File via Console Port
Download the default configuration file from http://www.nortelnetworks.com/index.html, unzip it
andsave itina folder.
•Turn off the Contivity 251,begina terminal emulation software session and turn on the
Contivity 251again. When yousee the message "PressAny key to enter Debug Mode
within 3 seconds", pressany key to enter debugmode.
•Enter"atlc" after"Enter Debug Mode" message.
•Wait for "Starting XMODEM upload" message before activating Xmodem upload on your
terminal.Thisisan example Xmodem configuration upload using HyperTerminal.
•ClickTransfer, thenSend File to displaythe following screen.
2.12 Provide End-Users with Instructions
Provide the remote end-userswith very simple instructionsforhow establishing theinitial
connection,anddistribute the instructionsby FAX, phone,ormail.
Theinstructionsforsetting up the C251 Client should contain the following minimum information:
•ISP VPI/VCI numbersand howto configure
•How to configure Client Emulation
•Username (configuredin gatewayuser-group)
•Password (pre-shared key)
•CO gateway IP address
•Press“Connect” buttonto start Clientconnection
•How to use PING command for validation test.
Addadditional information for schedulingand contactnumbers. Theend users shouldhave
Contivity 251 QuickStart Guideshipped to them for references.

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
2.13 Downloading Configuration Files from CO lab to
remote C251
When the C251 hard client connectionisestablished,COTechniciansdownload the pre-built
configuration file to the remote C251 using the GUI “maintenance->Restore” tool or
using FTP command.
When the downloadiscompleted, the remoteC251 will activate the new configuration file and
reboot automatically. Afterrebooting, aPing from the C251 tothe Contivity gateway will bring up
theABOT tunnel.Verify the connectionby bi-directionpings.
Repeat the sameprocedure for each site.

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
3. Contivity C251 Deployment Example
CompanyABCin NA hasone small corporate central office and five remotebranch offices. They
plan to build a VPN (ABC VPN) using ISPInternet servicesand Nortel ContivityGateways. The
ABC VPN will allow remotebranch officesto accessto the private serversin headquarter CO with
low cost ofmaintenance and high security.
Note,theconfigurationsdocumented in thisexample were successfully testedin live network.
3.1 ABC VPN Deployment Tasks
•Network planning
•networktopologydraw
•order equipmentsand servicesand obtaininformation from ISP
•Setup COLAB
•Configure Contivity gatewayC1100
•Pre-build five BO-config-filesin CO
•Send “startup”instructionstoeach BO
•Deployment ABOT, coordinatewith BO
•Download config files from CO to BO
3.2 Network planning
- Networktopology: hub-spoke, 1x C1100 gateway,6xC251 Annex-A
- ConnectivityC251: configure one active ABOT and one inactive Client tunnel per C251
- BO IPaddress: 192.168.x.0/24, for private LAN and 192.168.x.1 for C251 management
- InitiatorID structure: office#-areacode-phone#
- static IPfrom ISP: 24.1.61.69 for ContivitypublicInterface, anddefault gateway: 24.1.48.1
- IP-pool: 172.16.55.1-172.16.55.10for C251 hard clientaccess
- Software level: C1100 V04_80.124; C251 VE251_2.1.0.0.007 (V2.1)

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
3.3 ABC VPN Topology
Figure 5: ABC VPN Topology
3.4 Order equipment and services
ABC purchased6 Contivity251unitsand one Contivity1100Gateway from Nortel.The Contivity
unitsshippeddirectly tothe remotelocationswithdefaultfactory configurations.
ABC ordered ADSLinternetaccessfor each branch office including CO, andordered broadband
high speed internetaccessfor CO Gateway.
Summary:
•order 6xC251Annex-A with V2.1SW, one for each BO,and onefor CO
•order 1x1100 with V4.8SWfor CO
•order ADSL servicesforeachBO
•order ADSL servicesfor CO
•order Broadband Internet service for CO, andstaticIP24.1.61.69/20
•obtain VPI/VCInumber for eachlocation. Office-6 and CO has0/35, and the reset are
8/35
CO
NOC Internet
UABC VPN Topology
BO-2
Name: C251_Office_2
KEY: Contivity
IP addr: 192.168.12.0/24
Initial ID: office2-214-123-2222
V04_80.124
C1100 gateway
192.168.3.1 priv-if
192.168.3.2 mgt
DHCP server
192.168.3.0/24
ABOT responder
Ip-pool: 172.16.55.1-
10
BO-5
Name: C251_Office_5
KEY: Contivity
IP addr: 192.168.15.0/24
Initial ID: office5-972-123-5555
BO-4
Name: C251_Office_4
KEY: Contivity
IP addr: 192.168.14.0/24
Initial ID: office4-813-123-4444
BO-3
Name: C251_Office_3
KEY: Contivity
IP addr: 192.168.13.0/24
Initial ID: office3-972-123-3333
Public interface
IP: 24.1.61.69/20
Gw:24.1.48.1
BO-6
Name: C251_Office_6
KEY: Contivity
IP addr: 192.168.16.0/24
Initial ID: office1-972-123-6666
Serv er
Dynamic IP
ULEGEND
ABOT

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
3.5 Setup CO LAB
CO LAB will be setup as shown in the diagram below. The C1100 will serve as the ABC company
gateway and asthe stagingequipment aswell.
The C251 will be configured to simulate Office-6 with VPI/VCI= 0/35, andprivateLAN with
192.168.16.0/24,management IP addressof 192.168.16.1
The PCin COisnamedas“S3”, andthePCinBO Office-6isnamedas“S4”, and theyboth
runningMicrosoftWindowsXP,and configured with dynamic IP.
Figure 6: ABC Company CO LAB
PSTN
phoneline
Cable
Modem Verizon
PSTN
ADSL
Publicinterface &gw
24.1.61.69/24
24.1.48.1.1gw
privateinterface
192.168.3.1
DHCP-server
192.168.3.3-254
IP-Pool
172.16.55.1-10
ABO
T
initiatoresponde
Internet
VPI/VCI =0/35
U
A
BC Company CO LAB
UC251-C1100 tunneling
Uover live Internet
192.168.16.3
PC-S4 WinXP
(dynamic)
C1100
V4.80
Defaultprivate
192.168.16.1
DHCP-server
192.168.16.3-
254
PC-S3 winXP
192.168.3.9
(dynamic)
DSL-Verizon.net
Comcast
Broadband
Hi gh Speed
Access
C251
Annex-A
F/W V2.1

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
3.6 Configure Contivity Gateway 1100
Figure 7: Configure C1100 from Factory Default
3.6.1 Configure IP address & DHCP for C1100:
1: Reset C1100 to FactoryDefault (V04_80.124)
Connect PCS3to C1100 (bothEthernet and serial port), and open a Hyper terminal. In
“Main Menu”, select “R” to reset the C1100 to be factory default.
2: configure IP addresses for management and private interface
(address and mask are determined during the phase of Network planning)
Slot 0, Port 1,Private LAN
Management IPAddress= 192.168.3.2, ( SubnetMask= 255.255.255.0 )
Interface IP Address= 192.168.3.1
SubnetMask= 255.255.255.0
3: Configure public interface (must obtain IP address and mask from ISP)
Slot 1, Port 1,PublicLAN
IP Address= 24.1.61.69
SubnetMask= 255.255.240.0
Speed/Duplex= AutoNegotiate
CO
NOC
S3
192.168.3.9
Dynamic IP
V04_80.124
C1100 gateway
192.168.3.1 priv-if
192.168.3.2 mgt
DHCP server
192.168.3.0/24
ABOT responder
Ip-pool: 172.16.55.1-10

Conti vity251 ABOT D eployment Version 1.0 April 26, 2004
4: Configure public default gateway (must obtain gateway address from ISP)
DefaultPublicRouteMenu
0) Gateway IP Address= 24.1.48.1
Cost = 10
A) Add New Gateway
R) Return to the Main Menu
5: Configure DHCP server for private LAN as defined
Return to main Menu, and select “L” to go to Command Line Interface. Enablesprivileged
commands, then type the following commands to Configure and enable DHCP server
ranging as192.168.3.0/24.:
Config t
ipdhcp server pool network192.168.3.0mask255.255.255.0
included-address192.168.3.3192.168.3.30
exit
service dhcp enable
exit
6: Renew PC IPaddress
On thePC, open a DOS command window,thenissue thefollowingcommandsto release and
renew theIPaddress:
Ipconfig /release
Ipconfig /renew
To open a DOS command window,go to Start->Run, thentype thenameof “cmd”.
In thisexample, the PC S3 hasa newIPaddressof 192.168.3.9.
Open WEB GUI to connect to C1100 usingUhttp://192.168.3.2U
3.6.2 Configure User Group for C1100
Go to Profile->User Group
1: add User Group “c251client”
2: add IP-Pool “c251client”