Planet MH-1000 User manual

Multi-Homing SecurityGatewayUser sManual
Multi-Homing Security
Gateway
MH-1000
User sManual

Multi-Homing SecurityGatewayUser sManual
Copyright
Copyright(C)2006PLANETTechnologyCorp.All rightsreserved.
Theproductsand programsdescribedinthisUser sManualarelicensedproductsofPLANETTechnology,ThisUsers
Manualcontainsproprietaryinformationprotectedbycopyright,andthisUsersManualand allaccompanyinghardware,
software, anddocumentationarecopyrighted.
Nopart ofthisUser sManual maybecopied, photocopied,reproduced,translated, orreducedtoanyelectronicmedium
ormachine-readableform byany means by electronicor mechanical.Includingphotocopying,recording,or information
storageandretrievalsystems,for any purposeotherthan thepurchaser'spersonaluse,and withouttheprior express
writtenpermission ofPLANETTechnology.
Disclaimer
PLANETTechnologydoesnotwarrantthatthehardwarewill workproperlyinallenvironmentsandapplications, and
makesnowarrantyandrepresentation,eitherimpliedorexpressed, withrespect tothequality,performance,
merchantability, orfitness foraparticular purpose.
PLANEThasmadeeveryeffort toensurethatthisUser sManualisaccurate;PLANETdisclaimsliabilityfor any
inaccuraciesoromissionsthatmayhaveoccurred.
InformationinthisUser sManual issubjecttochangewithoutnoticeanddoesnotrepresent acommitment onthepartof
PLANET. PLANETassumesno responsibilityforanyinaccuraciesthatmaybecontainedinthisUsersManual.PLANET
makesnocommitmenttoupdateorkeepcurrenttheinformation inthisUsersManual, and reservestherighttomake
improvementstothisUser sManualand/ortotheproductsdescribedinthisUsersManual, atanytimewithout notice.
Ifyoufindinformationinthismanual thatisincorrect, misleading,or incomplete, wewouldappreciateyourcommentsand
suggestions.
CEmarkWarning
ThisisaclassBdevice,inadomesticenvironment; thisproduct maycauseradiointerference, inwhich casetheuser
mayberequiredtotakeadequatemeasures.
Toavoidthepotential effectson theenvironment andhumanhealthas aresultofthepresenceofhazardous
substancesinelectricalandelectronicequipment,end usersof electricalandelectronicequipmentshould
understand themeaningof thecrossed-out wheeledbinsymbol. Donot disposeofWEEE asunsorted
municipalwasteand havetocollectsuchWEEEseparately.
Trademarks
ThePLANETlogoisatrademarkof PLANETTechnology.
Thisdocumentationmay refertonumeroushardwareandsoftwareproductsby their tradenames.Inmost,if notallcases,
thesedesignationsareclaimed astrademarksorregisteredtrademarksbytheirrespectivecompanies.
CustomerService
Forinformation on customerserviceandsupportfor theMulti-HomingSecurityGateway, pleaserefer tothefollowing
WebsiteURL:
http://www.planet.com.tw
Beforecontacting customerservice, pleasetakeamomenttogather thefollowinginformation:
♦Multi-HomingSecurityGatewayserialnumber andMAC address
♦Any errormessagesthat displayedwhentheproblem occurred
♦Any softwarerunningwhentheproblemoccurred
♦Stepsyou tooktoresolvetheproblemon yourown
Revision
User sManualforPLANETMulti-HomingSecurityGateway
Model: MH-1000
Rev: 1.0(February,2006)

Multi-Homing SecurityGatewayUser sManual
TableofContents
CHAPTER1:INTRODUCTION....................................................................................................................1
1.1FEATURES ...........................................................................................................................................1
1.2PACKAGE CONTENTS ............................................................................................................................2
1.3MH-1000 FRONT VIEW .........................................................................................................................2
1.4MH-1000 REAR PANEL.........................................................................................................................2
1.5SPECIFICATION.....................................................................................................................................3
CHAPTER2:ROUTERAPPLICATION........................................................................................................4
2.1OVERVIEW...........................................................................................................................................4
2.2BANDWIDTH MANAGEMENT WITH QOS....................................................................................................4
2.2.1Transparent Mode Connection Example......................................................................................4
2.2.2QoSPoliciesforDifferentApplications.........................................................................................5
2.2.3Guaranteed / MaximumBandwidth..............................................................................................6
2.2.4Policy Based TrafficShaping.......................................................................................................6
2.2.5PriorityBandwidthUtilization.......................................................................................................7
2.2.6Management byIPorMACaddress............................................................................................8
2.2.7DiffServ(DSCPMarking).............................................................................................................8
2.3OUTBOUND TRAFFIC .............................................................................................................................9
2.3.1Outbound Fail Over.....................................................................................................................9
2.3.2Outbound Load Balancing...........................................................................................................9
2.4INBOUND TRAFFIC ..............................................................................................................................10
2.4.1Inbound Fail Over......................................................................................................................10
2.4.2Inbound Load Balancing.............................................................................................................11
2.5DNS INBOUND ...................................................................................................................................12
2.5.1DNSInbound Fail Over.............................................................................................................13
2.5.2DNSInbound Load Balancing...................................................................................................14
2.6VIRTUAL PRIVATE NETWORKING ...........................................................................................................16
2.6.1General VPNSetup...................................................................................................................16
2.6.2VPNPlanning -Fail Over..........................................................................................................17
2.6.3Concentrator.............................................................................................................................18
CHAPTER3:GETTINGSTARTED............................................................................................................19
3.1OVERVIEW.........................................................................................................................................19
3.2BEFORE YOU BEGIN ...........................................................................................................................19
3.3CONFIGURING PCS FOR TCP/IPNETWORKING......................................................................................19
3.3.1Overview...................................................................................................................................20

Multi-Homing SecurityGatewayUser sManual
3.3.2WindowsXP.............................................................................................................................20
3.3.3Windows2000..........................................................................................................................22
3.3.4Windows95/98/ME...................................................................................................................23
3.3.5WindowsNT4.0........................................................................................................................24
3.4FACTORY DEFAULT SETTINGS ..............................................................................................................25
3.4.1Usernameand password..........................................................................................................25
3.4.2LANand WANPortAddresses..................................................................................................25
3.5INFORMATION FROM YOUR ISP............................................................................................................25
3.5.1Protocols...................................................................................................................................25
3.5.2Web Configuration Interface......................................................................................................26
CHAPTER4:ROUTERCONFIGURATION................................................................................................27
4.1OVERVIEW.........................................................................................................................................27
4.2STATUS .............................................................................................................................................28
4.2.1ARPTable.................................................................................................................................29
4.2.2Routing Table............................................................................................................................29
4.2.3Session Table...........................................................................................................................30
4.2.4DHCPTable..............................................................................................................................30
4.2.5IPSecStatus.............................................................................................................................31
4.2.6PPTPStatus..............................................................................................................................31
4.2.7TrafficStatistic...........................................................................................................................32
4.2.8SystemLog...............................................................................................................................33
4.2.9IPSecLog.................................................................................................................................33
4.3QUICK START.....................................................................................................................................34
4.3.1DHCP.......................................................................................................................................34
4.3.2StaticIP....................................................................................................................................34
4.3.3PPPoE......................................................................................................................................35
4.3.4PPTP........................................................................................................................................35
4.3.5Big Pond...................................................................................................................................36
4.4CONFIGURATION.................................................................................................................................37
4.4.1LAN..........................................................................................................................................37
4.4.1.1Ethernet............................................................................................................................................37
4.4.1.2DHCPServer....................................................................................................................................38
4.4.2WAN.........................................................................................................................................39
4.4.2.1ISPSettings......................................................................................................................................39
4.4.2.1.1DHCP........................................................................................................................................40
4.4.2.1.2StaticIP.....................................................................................................................................41
4.4.2.1.3PPPoE.......................................................................................................................................41
4.4.2.1.4PPTPSettings...........................................................................................................................43
4.4.2.1.5BigPondSettings......................................................................................................................44

Multi-Homing SecurityGatewayUser sManual
4.4.2.2Bandwidthsettings............................................................................................................................45
4.4.3Dual WAN.................................................................................................................................45
4.4.3.1General Settings................................................................................................................................45
4.4.3.2OutboundLoadBalance....................................................................................................................46
4.4.3.3InboundLoadBalance.......................................................................................................................47
4.4.3.4ProtocolBinding................................................................................................................................50
4.4.4System......................................................................................................................................51
4.4.4.1TimeZone.........................................................................................................................................51
4.4.4.2RemoteAccess.................................................................................................................................52
4.4.4.3FirmwareUpgrade.............................................................................................................................52
4.4.4.4Backup / Restore...............................................................................................................................53
4.4.4.5Restart..............................................................................................................................................53
4.4.4.6Password..........................................................................................................................................54
4.4.4.7SystemLogServer............................................................................................................................55
4.4.4.8E-mailAlert.......................................................................................................................................55
4.4.5Firewall.....................................................................................................................................56
4.4.5.1Packet Filter......................................................................................................................................57
4.4.5.2URLFilter..........................................................................................................................................58
4.4.5.3LANMAC Filter.................................................................................................................................60
4.4.5.4BlockWAN Request..........................................................................................................................61
4.4.5.5IntrusionDetection............................................................................................................................62
4.4.6VPN..........................................................................................................................................62
4.4.6.1IPSec................................................................................................................................................62
4.4.6.1.1IPSecWizard.............................................................................................................................62
4.4.6.1.2IPSecPolicy..............................................................................................................................66
4.4.6.2PPTP................................................................................................................................................70
4.4.7QoS..........................................................................................................................................71
4.4.8Virtual Server............................................................................................................................74
4.4.8.1DMZ..................................................................................................................................................75
4.4.8.2PortForwarding Table........................................................................................................................76
4.4.9Advanced..................................................................................................................................77
4.4.9.1StaticRoute.......................................................................................................................................77
4.4.9.2DynamicDNS....................................................................................................................................79
4.4.9.3DeviceManagement..........................................................................................................................80
4.5SAVE CONFIGURATION TO FLASH .........................................................................................................80
4.6LOGOUT ............................................................................................................................................81
CHAPTER5:TROUBLESHOOTING.........................................................................................................82
5.1BASIC FUNCTIONALITY ........................................................................................................................82
5.1.1RouterWon tTurnOn................................................................................................................82

Multi-Homing SecurityGatewayUser sManual
5.1.2LEDsNeverTurnOff.................................................................................................................82
5.1.3LANorInternet PortNotOn......................................................................................................82
5.1.4ForgotMyPassword.................................................................................................................82
5.2LAN INTERFACE .................................................................................................................................83
5.2.1Can tAccessMH-1000 fromthe LAN........................................................................................83
5.2.2Can t Ping AnyPCon the LAN..................................................................................................83
5.2.3Can tAccessWeb Configuration Interface.................................................................................83
5.2.3.1Pop-upWindows...............................................................................................................................84
5.2.3.2Java Scripts......................................................................................................................................85
5.2.3.3Java Permissions..............................................................................................................................86
5.3WAN INTERFACE................................................................................................................................87
5.3.1Can tGetWANIPAddress fromtheISP...................................................................................87
5.4ISPCONNECTION...............................................................................................................................87
5.5PROBLEMS WITH DATEAND TIME..........................................................................................................89
5.6RESTORING FACTORY DEFAULTS..........................................................................................................89
APPENDIXA:VIRTUALPRIVATENETWORKING...................................................................................90
A.1WHAT IS THE VPN?............................................................................................................................90
A.1.1VPNApplications......................................................................................................................90
A.2WHAT IS THE IPSEC?..........................................................................................................................90
A.2.1IPSecSecurityComponents.....................................................................................................91
A.2.1.1AuthenticationHeader (AH)...............................................................................................................91
A.2.1.2Encapsulating SecurityPayload(ESP)...............................................................................................91
A.2.1.3SecurityAssociations(SA).................................................................................................................92
A.2.2IPSecModes............................................................................................................................92
A.2.3Tunnel Mode AH.......................................................................................................................93
A.2.4Tunnel Mode ESP.....................................................................................................................93
A.2.5InternetKeyExchange (IKE).....................................................................................................94
APPENDIXB:IPSECLOGSAND EVENTS..............................................................................................96
B.1IPSEC LOG EVENT CATEGORIES..........................................................................................................96
B.2IPSEC LOG EVENT TABLE ...................................................................................................................96
APPENDIXC:BANDWIDTHMANAGEMENT WITHQOS.........................................................................99
C.1OVERVIEW ........................................................................................................................................99
C.2WHAT IS QUALITYOF SERVICE?...........................................................................................................99
C.3WHAT IS QUALITYOF SERVICE?...........................................................................................................99
C.4WHO NEEDS QOS?............................................................................................................................99
C.4.1HomeUsers...........................................................................................................................100
C.4.2OfficeUsers...........................................................................................................................100

Multi-Homing SecurityGatewayUser sManual
APPENDIXD:ROUTERSETUPEXAMPLES..........................................................................................102
D.1OUTBOUND FAIL OVER .....................................................................................................................102
D.2OUTBOUND LOAD BALANCING ...........................................................................................................103
D.3INBOUND FAIL OVER.........................................................................................................................106
D.4DNS INBOUND FAIL OVER.................................................................................................................108
D.5DNS INBOUND LOAD BALANCING........................................................................................................111
D.6DYNAMIC DNS INBOUND LOAD BALANCING..........................................................................................113
D.7VPN CONFIGURATION .......................................................................................................................117
D.7.1LANtoLAN.............................................................................................................................117
D.7.2HosttoLAN.............................................................................................................................118
D.8IPSEC FAIL OVER (GATEWAY TO GATEWAY)........................................................................................120
D.9IPVPN CONCENTRATOR ..................................................................................................................123
D.10 PROTOCOL BINDING .......................................................................................................................128
D.11 INTRUSION DETECTION ...................................................................................................................129
D.12 PPTPREMOTEACCESS BY WINDOWS XP........................................................................................130
D.13 PPTPREMOTEACCESS .................................................................................................................136

Multi-Homing SecurityGatewayUser sManual
-1-
Chapter1: Introduction
PLANETsMulti-Homing SecurityGateway,MH-1000 integrated withcutting-edge technologyincluding
Load Balancing,VPNand Firewallforcentralsitestoestablishofficenetwork and connectwithbranch
offices,remotedialup and tele-workers.It isdesignedforbusiness requiring application-based network
solution atlow-capitalinvestmentand isperfectlycatering tothe needsofsmalland mediumsized business.
Built-inmultipleWANinterfacescan preventyourInternetconnectionfromfailure,and alsoreducesthe risks
ofpotential shutdownifone ofthe Internetconnectionsfails.Moreover,itallowsyou toperform
load-balancing bydistributing the trafficthrough twoWANconnections.
Inaddition toamulti-homing device,PLANET sMulti-Homing SecurityGatewayprovidesacomplete
securitysolution inabox.The policy-based firewall,contentfiltering function and VPNconnectivitywith
3DES and AES encryption makeitaperfectproductforyournetwork security.Bandwidthmanagement
functionisalsosupported tooffersnetwork administratorsan easyyetpowerfulmeanstoallocatenetwork
resourcesbased on businesspriorities, and toshape and controlbandwidthusage.
1.1 Features
♦WANFail-over: Autofailoverfeaturecan be configured forasecond connectiontoensureredundant
connectivitywhen the primaryline fails.
♦LoadBalancing: MH-1000 providesthe abilitytobalancethe workload bydistributing incoming traffic
acrossthe twoconnections.
♦DNSinboundloadbalance: The MH-1000 can beconfigured toreplythe WAN2IPaddress forthe
DNSdomainnamerequest ifWAN1fails.
♦VPNConnectivity: The securitygatewaysupportPPTPand IPSecVPN.WithDES,3DESand AES
encryption and SHA-1/MD5 authentication,the network trafficoverpublicInternetissecured.
♦PPTPServer: The MH-1000 alsoprovidesPPTPserverfeature,the remoteusercan connectto
MH-1000 PPTPserverwithouttoo manycomplexsettingand toaccess the LANresource.
♦ContentFiltering: Thesecuritygatewaycan blocknetwork connection based on URLs,Scripts(The
Pop-up, JavaApplet,cookiesand ActiveX).
♦SPI Firewall: Built-inStateful PacketInspection (SPI)can determine ifadatapacket isallowed through
the firewall tothe privateLAN.
♦DenialofService (DoS): The MH-1000 protectsagainsthackersattack byDoS,itcan allowprivateLAN
securelyconnected tothe Internet.
♦QualityofService (QoS): Network packetscan be classified based on IPaddress and TCP/UDPport
numberand giveguarantee and maximumbandwidthwiththree levelsofpriority.
♦DynamicDomainName Service (DDNS): The DynamicDNSserviceallowsuserstoaliasadynamicIP
addresstoastatichostname.

Multi-Homing SecurityGatewayUser sManual
-2-
1.2 Package Contents
The following itemsshouldbe included:
MH-1000
nMulti-Homing SecurityGateway
nUser sManualCD-ROM
nThisQuickInstallationGuide
nPowerAdapter
nBracket x2(Forrack-mounted)
nScrewx4(Forrack-mounted)
Ifanyofthe contentsaremissing ordamaged, pleasecontact yourdealerordistributorimmediately.
1.3 MH-1000 FrontView
MH-1000 Front Panel
LEDDescription
PWRAsolidlightindicatesasteadyconnectiontoapowersource
STATUSAblinking lightindicatesthe deviceiswriting toflashmemory
LAN1-8Lit when connected toan Ethernet device
10/100: Lit green when connected at 100Mbps
Not lit when connected at 10Mbps
LNK/ACT:Lit when deviceisconnected.
Blinking when dataistransmitting /receiving
WAN1,
WAN2 Lit when connected toan Ethernet device
10/100: Lit green when connected at 100Mbps
Not lit when connected at 10Mbps
LNK/ACT:Lit when deviceisconnected.
Blinking when dataistransmitting /receiving
1.4 MH-1000 RearPanel
MH-1000 RearPanel

Multi-Homing SecurityGatewayUser sManual
-3-
Port orbutton Description
RESETToresetdeviceand restorefactorydefaultsettings,after
the deviceisfullybooted,press and holdRESETuntil the
StatusLEDbeginstoblink.
WAN1,
WAN2 ConnecttoyourxDSL/CablemodemorotherInternet connection devices
LAN1-8ConnecttoyourlocalPC,switchorotherlocal network
device
DC 12VConnect DC PowerAdapterhere(12VDC)
1.5 Specification
ProductMulti-homing SecurityGateway
ModelMH-1000
Hardware LAN8x10/100 Based-TXRJ-45
Ethernet
WAN 2x10/100 Based-TXRJ-45
Performance
Firewallthroughput90Mbps
IPSecVPNthroughput30Mbps
PPTPVPNthroughput10Mbps
MaximumConcurrent
sessions 10,000
Software
ManagementWeb
Network Protocoland
features
StaticIP,PPPoE, PPTP,BigPond and DHCPclient connection toISP
NAT, StaticRoute,RIP-2
DynamicDomainNameSystem(DDNS)
VirtualServerand DMZ
DHCPserver
NTP
Load Balancing
Increased bandwidthofoutbound and inbound trafficDNSinbound load
balance
Firewall Srateful PacketInspection (SPI)and Denialof Service(DoS) prevention
PacketFilter(byIP, port numberand packettype)
E-mailalertand logsofattack
MACAddress Filtering
Content Filtering URLFiltering
JavaApplet/ActiveX/Web Proxy/SurfingofIPAddress/CookieBlocking
VPNTunnels IPSec:100, PPTP: 4
VPNFunctions PPTP,IPSecVPNsupport
DES, 3DESand AESencrypting
SHA-1/MD5 authentication algorithm
Remoteaccess VPN(Client-to-Site)and SitetoSiteVPN
IPSec,PPTP, L2TPpassthrough
QoS Support DiffServapproach
Prioritization and bandwidthmanaged byIP, Port numberand MACaddress
Log and Alert Syslog support
E-mail Alert

Multi-Homing SecurityGatewayUser sManual
-4-
Chapter2: RouterApplication
2.1 Overview
MH-1000 isaversatiledevicethatcan be configuredtonotonlyprotectyournetwork frommalicious
attackers,butalsoensureoptimalusage ofavailablebandwidthwithQualityofService(QoS) and both
Inbound and Outbound Load Balancing.Alternatively,MH-1000 can alsobe settoredirectincoming and
outgoing network trafficwiththeFailOvercapability, ensuring minimal downtimeand increased reliability.
2.2 BandwidthManagementwithQoS
QualityofService(QoS)givesyou fullcontroloverwhichtypesofoutgoing datatrafficshouldbe given
prioritybythe router.Bydoingso,the routercan ensurethatlatency-sensitiveapplicationslikevoice,
bandwidth-consuming datalikegaming packets,oreven mission critical filesefficientlymovethrough the
routereven underaheavyload.You can throttlethe speed atwhichdifferenttypesof outgoing datapass
through the router.Inaddition,you can simplychange the priorityof differenttypesof upload dataand let
the routersort outthe actualspeeds.
2.2.1 TransparentMode ConnectionExample
QoSgenerallyinvolvesthe prioritization ofnetwork traffic.QoSiscomprised ofthree majorcomponents:
Classifier,Meter,and Scheduler.Eachofthesecomponentshasadistinctroleinensuringthatincoming
and outgoing dataismanaged according touserspecifications.
The Classifieranalysesincoming packetsand markseachone according toconfigured parameters.The
Metercommunicatesthe drop prioritytothe Schedulerand measuresthe temporalprioritiesofthe output
streamagainst configured parameters. Finally,the Schedulerscheduleseachpacket fortransmission
basedon information fromboththe Classifierand the Meter.

Multi-Homing SecurityGatewayUser sManual
-5-
2.2.2 QoSPolicies forDifferentApplications
By setting differentQoSpoliciesaccording tothe applicationsyou arerunning,you can useMH-1000 to
optimizethe bandwidththatisbeing used on yournetwork.
Asillustrated inthe diagramabove,applicationssuchasVoiceoverIP(VoIP)requirelownetwork latencies
tofunction properly.If bandwidthisbeing used byotherapplicationssuchasan FTPserver,usersusing
VoIPwillexperiencenetwork lag and/orserviceinterruptionsduring use.Toavoidthisscenario, this
Restricted PC
Normal PCs
VoIP

Multi-Homing SecurityGatewayUser sManual
-6-
network hasassigned VoIPwithaguaranteed bandwidthand higherprioritytoensuresmooth
communications.The FTPserver, on the otherhand, hasbeen given amaximumbandwidthcap tomake
surethat regularservicetobothVoIPand normal Internet applicationsisuninterrupted.
2.2.3 Guaranteed/ Maximum Bandwidth
Setting aGuaranteed Bandwidthensuresthat aparticularservicereceivesaminimumpercentage of
bandwidth. Forexample,you can configureMH-1000 toreserve10% ofthe availablebandwidthfora
particularcomputeronthe network totransferfiles.
Alternativelyyou can set aMaximumBandwidthtorestrictaparticularapplication toafixed percentage of
the total throughput. Setting aMaximumBandwidthof20% forafilesharing programwillensurethat no
morethan 20% of the availablebandwidthwillbe used forfilesharing.
2.2.4 PolicyBasedTraffic Shaping
Policy Based TrafficShaping allowsyou toapplyspecifictrafficpoliciesacross arange ofIPaddresses
or[D1] ports.Thisisparticularlyuseful forassigning different policiesfordifferentPCson the network.
Policybased trafficshaping letsyou bettermanage yourbandwidth, providingreliableInternetand network
servicetoyourorganization.

Multi-Homing SecurityGatewayUser sManual
-7-
2.2.5 PriorityBandwidthUtilization
Assigning prioritytoacertainserviceallowsMH-1000 togiveeitherahigherorlowerprioritytotrafficfrom
thisparticularservice.Assigning ahigherprioritytoan application ensuresthat itisprocessed ahead of
applicationswithalowerpriorityand viceversa.

Multi-Homing SecurityGatewayUser sManual
-8-
2.2.6 ManagementbyIPorMAC address
MH-1000 can alsobe configured toapplytrafficpoliciesbased on aparticularIPorMACaddress.This
allowsyou toquicklyassign differenttrafficpoliciestoaspecificcomputeron the network.
2.2.7 DiffServ(DSCPMarking)
DiffServ(a.k.a.DSCPMarking)allowsyou toclassifytrafficbased on IPDSCPvalues.Thesemarkings
can be used toidentifytrafficwithinthe network.Otherinterfacescan matchtrafficbased on the DSCP
markings. DSCPmarkingsareused todecide howpacketsshouldbe treated,and isausefultool togive
precedencetovaryingtypesofdata.

Multi-Homing SecurityGatewayUser sManual
-9-
2.3 OutboundTraffic
Thissection outlinessomeofthe waysyou can useMH-1000 tomanage outbound traffic.
2.3.1 OutboundFail Over
Configuring MH-1000 forOutbound FailOverallowsyou toensurethat outgoing trafficisuninterrupted.
Inthe aboveexample,PC1(IP_192.168.2.2)and PC2(IP_192.168.2.3)areconnected tothe Internetvia
WAN1(IP_230.100.100.1)on MH-1000. ShouldWAN1 fail,Outbound FailOvertellsMH-1000 toreroute
outgoing traffictoWAN2 (IP_213.10.10.2).Configuring yourMH-1000 forOutbound FailOverprovidesa
morereliableconnectionforyouroutgoing traffic.
PleaserefertoappendixDforexamplesettings.
2.3.2 OutboundLoadBalancing
Outbound Load Balancing allowsMH-1000 tointelligentlymanage outbound trafficbased on the amountof
load ofeachWANconnection.

Multi-Homing SecurityGatewayUser sManual
-10 -
Inthe aboveexample,PC1(IP_192.168.2.2)and PC2(IP_192.168.2.3)areconnected tothe Internetvia
WAN1(IP_230.100.100.1)and WAN2 (IP_213.10.10.2)on MH-1000.You can configureMH-1000 to
balancethe load ofeachWANportwithone of twomechanisms:
1. Session (bysession/bytraffic/weight oflinkcapability)
2. IPHash(bytraffic/weight oflinkcapability)
The IPHashmechanismwill ensurethat the trafficfromthe samesourceIPaddressand destination IP
addresswillgo through the sameWANport.Thisisusefulforsomeserverapplicationsthatneed toidentify
the sourceIPaddress ofthe client.
By balancing the load between WAN1and WAN2,yourMH-1000 can ensurethat outbound trafficis
efficientlyhandled bymaking surethatbothportsareequallysharing the load, preventing situationswhere
one port iscompletelysaturated byoutbound traffic.
PleaserefertoappendixDforexamplesettings.
2.4 InboundTraffic
LearnhowMH-1000 can handleinbound trafficinthefollowing section.
2.4.1 InboundFail Over
Configuring MH-1000 forInbound FailOverallowsyou toensurethat incoming trafficisuninterrupted by
having MH-1000 defaulttoWAN2 shouldWAN1fail.
230.100.100.1
213.10.10.2
ISP
192.168.2.2
192.168.2.3

Multi-Homing SecurityGatewayUser sManual
-11-
Inthe aboveexample, anFTPServer(IP_192.168.2.2)and an HTTPServer(IP_192.168.2.3)are
connected tothe Internetvia WAN1 (ftp.planet.com.tw)on MH-1000.Aremotecomputeristrying toaccess
theseserversviathe Internet.Undernormal circumstances, the remotecomputerwillgainaccess tothe
network viaWAN1.ShouldWAN1 fail,Inbound FailOvertellsMH-1000 torerouteincoming traffictoWAN2
byusing the DynamicDNSmechanism. Configuring yourMH-1000 forInbound FailOverprovidesamore
reliableconnection foryourincoming traffic.
PleaserefertoappendixDforexamplesettings.
2.4.2 InboundLoadBalancing
Inbound Load Balancing allowsMH-1000 tointelligentlymanage inbound trafficbased on the amount of
load ofeachWANconnection.
ftp.planetbillion.dyndns.
org
com.tw
Before Fail Over
192.168.2.2
192.168.2.3
ftp.planet.com.twbillio
AfterFail Over
ftp://ftp.planet.com.tw
ftp ftp.billion.dydns.org
Remote Access fromInternet
ftp:// ftp.planet.com.tw
ftp.billion.dydns.org
Remote Access fromInternet
FTP
HTTP
192.168.2.2
192.168.2.3
FTP
HTTP

Multi-Homing SecurityGatewayUser sManual
-12 -
Inthe aboveexample, anFTPserver(IP_192.168.2.2)and an HTTPserver(IP_192.168.2.3)are
connected tothe Internet viaWAN1(www.planet2.com.tw)and WAN2(www.planet3.com.tw)on MH-1000.
RemotePCsareattempting toaccess the serversviathe Internet.Using Inbound Load Balancing,
MH-1000 can direct incoming requeststothe correctWANport based on group assignment.Forexample,
asalesforcecan be directed to www.planet2.com.tw whilethe R&Dgroup can access www.planet3.com.tw.
By balancing the load between WAN1and WAN2,yourMH-1000 can ensurethat inbound trafficis
efficientlyhandled withbothportsequallysharing the load, preventing situationswhereserviceisslow
becauseone port iscompletelysaturated byinbound traffic.
PleaserefertoappendixDforexamplesettings.
2.5 DNSInbound
Using DNSInbound isagreat waytointelligentlydirectnetwork traffic.
DNS Inboundisathreestepprocess.First,aDNS requestismadetotherouterviaaremote
PC. MH-1000,based on settingsspecified bythe user, willdirect the requesting PCtothe correctWAN
www.planet2.com.twbilli
on2.dyndns.org
Remote Access fromInternet
www.planet3.com.twbilli
on3.dyndns.org
www.planet3.com.twbill
www.planet2.com.twbill
ion2.dyndns.org
192.168.2.2
192.168.2.3
FTP
Server
HTTP
Server
ISP
ISP

Multi-Homing SecurityGatewayUser sManual
-13 -
port byreplying the selected WANIPaddress through the built-inDNSserver.The remotePCthen
accessesthe network viathe specified WANport. HowMH-1000 directsthistrafficthrough the built-inDNS
serverdependson whetheritisconfigured forFailOverorLoad Balancing.
LearnhowtomakeDNSInbound on MH-1000 work foryou inthe following section.
2.5.1 DNSInboundFail Over
MH-1000 can be configured toreplythe WAN2 IPaddressforthe DNSdomainnamerequest should
WAN1fail.
Inthe aboveexample, anFTPServer(IP_192.168.2.2)and an HTTPServer(IP_192.168.2.3)are
connected tothe Internet viaWAN1 (IP_200.200.200.1)on MH-1000.Aremotecomputeristrying to
accesstheseserversviathe Internet, and makesaDNSrequest. The DNSrequest (www.mydomain.com)
willbe sent through WAN1 (200.200.200.1)tothebuilt-in DNSserver.TheDNSserverwillreply
200.200.200.1becausethisisthe onlyactiveWANport.ShouldWAN1 fail,MH-1000 will instead replywith
WAN2sIPaddress (100.100.100.1), and the remotePCwillgainaccess tothe network viaWAN2.By
configuring MH-1000 forDNSInbound FailOver,incoming requestswillenjoyincreased reliabilitywhen
accessing yournetwork.
PleaserefertoappendixDforexamplesettings.
Built-in DNS
Server
192.168.2.2
192.168.2.3
FTP
Serve
HTTP
Serve
200.200.200.1
www.mydomain.com
200.200.200.1
AuthoritativeDomain Name Server
for
www.mydomain.com
Before Fail Over
100.100.100.1
AfterFail Over
100.100.100.1
DNS
DNS
Built-in DNS
Server
192.168.2.2
192.168.2.3
FTP
Serve
HTTP
Serve
1st connection
2nd connection
1st connection
2nd connection
www.mydomain.com
DNS
DNS