ZyXEL Communications IES-5000 Series Manual

IES-5000
Support Notes
Oct 2006

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 2
INDEX
Application Notes............................................................................................................................ 3
Provide Different DSL Port Speeds to different subscribers.......................................3
How to configure 802.1Q VLAN.................................................................................7
Triple play Application................................................................................................9
802.1x Application....................................................................................................16
Setting up the Syslog Server ................................................................................... 20
Setting up the Ring Environment ............................................................................. 23
Setting up the IGMP Snooping/IGMP Filtering......................................................... 29
Limit the users behind the certain DSL port.............................................................31
DHCP Relay Option 82 Application..........................................................................32
Filter Some Certain Packet......................................................................................42
VDSLApplication- Triple Play .................................................................................. 45

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 3
Application Notes
Provide Different DSLPort Speeds to different subscribers
An ISP may provide different Line speeds for each DSL port. In our IES-5000 have
an easy way to configure the line speed for each port. It can create some profiles
which can set different parameters to meet the different users’requirement.
In this application, we will set up two profiles. One is for low speed requirement with
upstream/downstream is 2M/512Kbps and the other is for high speed requirement
with upstream/downstream is 25M/1Mbps. We suppose there are general subscribers
from port 1 to port 24 with a low speed profile and some enterprise users from port 25
to port 48 with high speed profile.
How to apply the profile to ports
In this application, we need to configure IES-5000 and ADSL CPE. We use ZyXEL
Prestige 660R-61 CPE here.
1. IES-5000 Settings
1.1 Profiles settings
Set up Low Speed Profile. Give this profile a name like Profile_LowSpeed and input
the MaxRate for Up Stream and Down Stream. In this case, we set 512Kbps and
2048Kbps for Up Stream and Down Stream.
xDSL
modem
IES-5000
ALC-1248G
Port 1
Uplink
Internet
Port 24 Port 25 Port 48
2M/512K 25M/1M

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 4
Set up High Speed Profile. Give this profile a name like Profile_HighSpeed and input
the MaxRate for Up Stream and Down Stream. In this case, we set 1280Kbps and
24992Kbps for Up Stream and Down Stream.
CI command:
a.)High Speed (1M/24M) profile setup:
MSG1000G> profile adsl set 1_24M 1024 24576 minrate 64 64 delay 20 20 usmgn
310 0 60 dsmgn 310 0 60 usra startup 90 30 dsra startup 90 30
b.) Low Speed (512k/2M) profile setup:
MSG1000G> profile adsl set 512_2M 512 2048 minrate 64 64 delay 20 20 usmgn
310 0 60 dsmgn 310 0 60 usra fixed 90 30 dsra startup 90 30
Save current configurations
MSG1000G> config save
1.2 ProfileAssignment
Assign Profile_LowSpeed to port 1. Select the Profile_LowSpeed profile. Copy the
settings of port 1 to the ports from 2 to 24. After finishing port 1 setting.
For the high speed profile, you can set the Profile_HighSpeed to port 25. You also can
select ADSL2+ mode. That will fix the mode on ADSL2+ mode.
Copy the settings of port 25 to the ports from 26 to 48. You can follow the same
procedures as port 1.
CI command:
MSG1000G> port adsl set 7-1~24 512_2M auto
MSG1000G> port adsl set 7-25~48 1_24M auto
MSG1000G> port enable 7-1~48
MSG1000G> port pvc set 7-1~48-0/33 DEFVAL llc 1 0
MSG1000G> config save
2. Prestige 660R-61 Settings
We configure Prestige 660R-61 as bridge mode. The default VPI/VCI of IES-5000 is

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 5
0/33. So we need to set up such values. Prestige 660R-61 has a Telnet server inside.
We need to configure it via Telnet.
2.1 Menu1: General Setup
Go to Menu 1. In this menu, we must set “Rout IP = NO” and “Bridge = YES”.
2.2 Menu4: Internet Access Setup
The encapsulation must be RFC 1483 for bridge mode. The Multiplexing should be
the same as IES-5000. The LLC-based is default mode of IES-5000. Additionally, we
must check if the VPI/VCI is the same as IES-5000. The default VPI/VCI of
IES-5000 is 0/33.
2.3 Menu11.1: Remote Node Profile
In menu11.1, we should activate this profile with “Active= Yes”. The Encapsulation
and the Multiplexing are the same as the menu 4. Setting “Edit ATM Options=Yes”

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 6
will enter Menu 11.6.
2.4 Menu11.6: Remote Node ATM Layer Options
Check the values above are the same as the IES-5000.

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 7
How to configure 802.1Q VLAN
AVLAN (Virtual Area Network) allows a physical network to be partitioned into
multiple logical networks. Stations on a logical network belong to one group called
VLAN group. A station can belong to more than one group. The stations on the same
VLAN group can communicate with each other. With VLAN, a station cannot directly
talk to or hear from stations that are not in the same VLAN groups.
We want to deploy VALN environment in this application. The following figure
shows the VLAN example. Two PCs connect to the port 1 and port 2 of the line card
and belong to different VLAN. One is VLAN 10 and the other is VLAN 20. So they
can’t communication with each other. But both PC 1 and PC 2 can connect to Internet.
How to set up a VLAN environment
In this application, we need to configure IES-5000 and ADSL CPE(or SHDSL CPE).
We use ZyXEL Prestige ADSL 660R-61(or you may use P791 for SLC-1248G) CPE
here. Because the two ports belong to different VLAN want to go to the Internet via
Uplink port of IES-5000, we need to set up an extra VLAN and let the two ports be
members of this VLAN.
ADSL/SHDSL
modem ADSL/SHDSL
modem
IES-5000
ALC-1248G
SLC-1248G
PC 1
VLAN10
Port 1 Port 2
Uplink
Internet
PC 2
VLAN20

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 8
1. IES-5000 Settings
1.1 VLAN settings
Add VLAN10.Assign Port 1, ENET1 and ENET2 to be members of VLAN10.
CI command:
TGE1> vlan set 10 up1 fix untag
TGE1> vlan set 10 up2 fix untag
TGE1> vlan name 10 VLAN10
TGE1> port pvc vlan 7-1-0/33 10 join untag
Add VLAN20.Assign Port 2, ENET1 and ENET2 to be members of VLAN20 as
shown.
CI command:
TGE1> vlan name 20 VLAN20
TGE1> vlan set 20 up1 fix untag
TGE1> vlan set 20 up2 fix untag
TGE1> port pvc vlan 7-2-0/33 20 join untag
Add VLAN200.Assign slot 7, Port 1, Port2, ENET1 and ENET2 to be members of
VLAN200 as shown.
CI command:
TGE1> vlan name 200 VLAN200
TGE1> vlan set 200 up1 fix untag
TGE1> vlan set 200 up2 fix untag
TGE1> port pvc vlan 7-1-0/33 200 join untag
TGE1> port pvc vlan 7-2-0/33 200 join untag
1.2 PVID settings
After set up the three VLAN, then, set the PVID.
We assign VLAN 200(PVID) to ENET1, ENET2. Also, we assign VLAN 10 and
VLAN 20 to Port1 and port2, respectively as shown.

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 9
CI command:
TGE1> switch port pvid up1 200
TGE1> switch port pvid up2 200
TGE1> port pvc set 7-1-0/33 DEFVAL llc 10 0
TGE1> port pvc set 7-2-0/33 DEFVAL llc 20 0
1.3 Port Isolation
If we just want to isolate ports of IES-5000 and don’t want to set any VLAN, there is
another easy way to do this, setup Port isolation.
CI command:
TGE1> switch isolation enable
2. Prestige 660R-61(P791) Settings
Please refer to the procedures in previous application.
Triple play Application
The IES-5000 allows you to use different channels (also called Permanent Virtual
Circuits or PVCs) for different services. Define channels on each DSL port for
different services and assign each channel a priority, a VLAN andATM Quality of
Service (QoS). TheATM QoS allows you to regulate the average rate and fluctuations
of data transmission. This helps eliminate congestion to allow transmission of real
time data (such as audio and video).
In this application, we demonstrate how to set up the multiple PVCs environment.
From the figure below, the PC wants to access the two kinds of network services. One
is the Internet service (data service) and the other is Video service. Because we hope
we can see the video smoothly, we need to set the video service higher priority. In
IES-5000, we can set the two services with different VLANs and assign the PVCs
with different VLAN, priority and ATM QoS. That will make the video traffic get the
higher priority than data traffic. We also can expand this application to triple play

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 10
environment.
How to set up a Multiple PVCs environment.
Following procedures will introduce the settings of IES-5000, VLAN-aware switch
and ADSL (SHDSL) CPE. We use ZyXEL ES-2024 and Prestige 660R-61(You may
use P791 for SLC-1248G) as VLAN-aware switch and xDSL CPE, respectively.
1. IES-5000 Settings
1.1 VLAN setup
We can set up VLAN like procedure described in VLAN application. Add VLAN10.
Assign Port 1, ENET1 to be members of VLAN10 as show. We need to check the
Tx Tagging on ENET1.
TGE1> vlan name 10 VLAN10
TGE1> vlan set 10 up1 fix tag
TGE1> port pvc vlan 7-1-0/33 10 join untag
Add VLAN20.Assign Port 1, ENET1 to be members of VLAN20 as show. We need
to check the Tx Tagging on ENET1.
TGE1> vlan name 20 VLAN20
CPE
802.1Q VLAN
Switch
0/33 1/34
PVID =10
Priority =7
ATM QoS=CBR
PVID =20
Priority =0
ATM QoS=UBR Video Server
VLAN 10
Internet
Internet Access
VLAN 20
DSL Port 1
Ethernet Port
Port 2
PVID=20
Port 1
PVID=10
Port 10
IES-5000
SLC-1248G or
ALC-1248G

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 11
TGE1> vlan set 20 up1 fix tag
TGE1> port pvc vlan 7-1-0/33 20 join untag
1.2 VC profile setup
Add Defval_CBR VC profile for Profile Setup. Set up Encap, Class, PCR and CDVT
as shown. Encap should be LLC the same as IES-5000. Class should be CBR which
has higher priority in ATM QoS.
CI command
TGE1> profile atm set Def_CBR cbr 300000
1.3 Multiple PVCs setup
We hope VPI/VCI with 0/33 get the higher priority. We should modify this VPI/VCI
with Defval_CBR profile which we created before.
CI command:
TGE1> port pvc set 7-1-0/33 Defval_CBR llc 0 7
Then, we add the VPI/VCI with 0/34. We apply the DEFVAL profile to this channel.
CI command:
TGE1> port pvc set 7-1-0/34 Defval llc 20 0
2. Prestige 660R-61(P791) Settings
We need to set two channels. One is 0/33 and the other is 0/34. From former
application, we already knew how to set up CPE with one channel (0/33). We just
demonstrate how to set up second channel.
2.1 Menu11.1: Remote Node Profile
In menu11.1, we should activate this profile with “Active= Yes”. The Encapsulation
and the Multiplexing are the same as the menu 4. Setting “Edit ATM Options=Yes”
will enter Menu 11.6.

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 12
2.2 Menu11.6: Remote NodeATM Layer Options
We should set up another VPI/VCI with 0/34 the same as the IES-5000.
3. ES-2024 settings
3.1 VALN
Click Advanced Application and VLAN in navigation panel to display configuration
screen as shown. Click Static VLAN to show VLAN setup screen.

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 13
Add VLAN10.Assign Port 1, Port 10 to be members of VLAN10 as show. We need
to check the Tx Tagging on Port 10.

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 14
Add VLAN20.Assign Port 2, Port 10 to be members of VLAN20 as show. We need
to check the Tx Tagging on Port 10.
3.2 PVID setup
Click Advanced Application and VLAN in navigation panel to display configuration screen
as shown. Click VLAN Port Setting to show PVID setup screen.

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 15
Let 10 be the PVID of Port 1 and 20 be the PVID of Port 2.
In this application, you will see the video traffic will go via 0/33 and data traffic will

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 16
go via 0/34. And the 0/33 get the higher priority. The video traffic will go first when the
two traffics arrive at the same time.
802.1x Application
IEEE 802.1x port-based authentication is desired to prevent unauthorized ports
(clients) from gaining access to the network. It is an extended authentication protocol
that allows support of RADIUS (Remote Authentication Dial in User Service,
RFC2138, 2139) for centralized user profile management on a network RADIUS
server.
We want to deploy 802.1x environment in this application. The following figure
shows the 802.1x example. PC1(supplicant) and PC2(supplicant) want to access to the
application server. If PC1 is not unauthorized, the traffic from PC1 to application
server will be blocked. If PC2 is an authorized client, then it can access to the
application server. From the figure, IES-5000 acts as an authenticator.
Station/
Application server
Authentication
Server (RADIUS)
Authorized
Unauthorized
X
SHDSL/ADSL
modem SHDSL/ADSL
modem
IES-5000(SLC/ALC)
(Authenticator)
PC 1
(Supplicant) PC 2
(Supplicant)
Port x Port y

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 17
How to set up an 802.1x environment.
We should configure Authenticator, RADIUS and Supplicant three parts in 802.1x
environment. The Microsoft 802.1x client and ZyXELVantage 50 will be used as
supplication and RADIUS, respectively. Following sections will describe the detailed
procedure to set up the environment.
1. IES-5000 (Authenticator) settings:
1.1 RADIUS settings:
Enable the 802.1x Authentication and the RADIUS server IP address, UDP port and
shared Secret, which is the same as Radius server. Then click Apply to make the
settings take effect.
TGE1> sys sw dot1x enable
TGE1> sys sw dot1x set radius server 192.168.1.3
TGE1> sys sw dot1x set radius port 1812
TGE1> sys sw dot1x set radius sec 12345678
TGE1> config save
2. Vantage 50(RADIUS) settings:
We use Vantage 50 as the RADIUS server. It’s a one of ZyXEL’s product. Of course,
you can use other RADIUS server like Funk Steel-Belted RADIUS, Cisco Access
Control Server, MeetingHouse Aegis server and so on. You can configure it by WEB
GUI and its default IP is 192.168.1.3.
2.1 RADIUS server setup
Click RADIUS, RADIUS SERVER in the navigation panel to display configuration screen
as shown. You can use the default values or change the Authentication port, Shared Secret.
Remember these values MUST be the as the settings of client.

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 18
2.2 Create UserAccount
Click RADIUS, USER ACCOUNT in the navigation panel to display configuration screen as
shown. You can use the existed user account or create the new one by clicking Add New User
button. Remember the client site MUST use the account in RADIUS server.
3. Windows XP(Supplicant) settings:
There are many supplicants we can choose like MeetingHouse Aegis client, Funk
Odyssey client and Microsoft 802.1x client. We take Microsoft 802.1x client as an
example here.
3.1 802.1x/MD5-challenge setup
Open the Local Area connection Properties, and then click Authentication page. Check the
Enable IEEE 802.1x authentication for this network and select the MD5-challenge in EAP
type combobox. Please see the following figure.

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 19
When the 802.1x starts, it will prompt you to enter the user name and password. Please see
the following figure.
After click the icon, there will be a dialog for entering the user name and password. Click ok
after input the correct user name and password that are in the database of authentication server.

IES-5000 Support Notes
All contents copyright (c) 2006 ZyXEL Communications Corporation. 20
The settings of client site are finished.
After above procedure, we can allow the authenticated port the access the server. If the DSL
port doesn’t be authenticated, the PCs behind the port can’t access the network.
4. Prestige 660R-61 Settings
Please refer to the procedures in previous application.
Setting up the Syslog Server
ZyXEL products are able to send system log to a Syslog deamon such as Unix
Syslogd and Kiwi's Syslog Daemon ( http://www.kiwisyslog.com/ ). When DSL or
Ethernet ports are linked up/down, IES-5000 sends a record to Syslog server. The
Syslog server can be placed on the network, which IES-5000 can access.