ZyXEL Communications IES-5000 Series Manual

IES-5000
Support Notes
Oct 2006

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 2
INDEX
Application Notes.............................................................................................................................3
Setting up different DSL port speeds to different subscribers..........................................3
Configuring 802.1Q VLAN.....................................................................................................7
Triple play Application.............................................................................................................9
802.1xApplication................................................................................................................16
Syslog Server Application...................................................................................................20
Ring Topology Application...................................................................................................23
IGMP Snooping/IGMP Filtering Application.....................................................................29
Limiting Internet access to users on specific DSL ports ................................................31
DHCP Relay Option 82 Application...................................................................................32
Packet Filtering.....................................................................................................................43
VDSLApplication-Triple Play............................................................................................46

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 3
Application Notes
Setting up different DSL port speeds to different subscribers
An ISP may want to configure a different line speeds for each DSL port. This can be
easily and efficiently done in the ZyXEL IES-5000 using profiles. You can configure
line profiles with different parameter settings based on the user requirements and
apply the profile to one or more subscriber ports.
In this application example, we will show you how to create two profiles -one for low
speed requirements with an upstream/downstream bandwidth of 2M/512Kbps and the
other for high speed requirements with an upstream/downstream bandwidth of
25M/1Mbps.
For this example, you want to provide low line speed to subscribers on ports 1 to 24
and high line speed to business subscribers on ports 25 to 48.
Configuring and applying the profiles to subscriber ports
For this example, we will use configure the profile on an IES-5000 that connects to
ADSL CPEs (ZyXEL Prestige 660R-61).
1. IES-5000
1.1 Profile Setup
Configure a profile to set low line speed. Enter a descriptive name for this profile (for
xDSL
modem
IES-5000
ALC-1248G
Port 1
Uplink
Internet
Port 24 Port 25 Port 48
2M/512K25M/1M

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 4
example, “Profile_LowSpeed”) and set the maximum upstream and downstream rates
(for example, 512Kbps and 2048Kbps).
Similarly, configure a profile to allow a high line speed. Enter a descriptive name for
the profile (for example, “Profile_HighSpeed”) and set the maximum upstream and
downstream rates (for example, 1280Kbps and 24992Kbps).
Configuration example using the CLI:
a.)High Speed (1M/24M) profile setup:
MSG1000G> profile adsl set 1_24M 1024 24576 minrate 64 64 delay 20 20 usmgn
310 0 60 dsmgn 310 0 60 usra startup 90 30 dsra startup 90 30
b.) Low Speed (512k/2M) profile setup:
MSG1000G> profile adsl set 512_2M 512 2048 minrate 64 64 delay 20 20 usmgn
310 0 60 dsmgn 310 0 60 usra fixed 90 30 dsra startup 90 30
Save current configuration
MSG1000G> config save
1.2 Profile Assignment
Select and assign Profile_LowSpeed to port 1. After setting port 1, copy the settings
of port 1 to ports 2 to 24.
Assign Profile_HighSpeed to port 25. You also can set the port to use the ADSL2+
mode. Then, similarly, copy the settings of port 25 to the ports 26 to 48.
CI command:
MSG1000G> port adsl set 7-1~24 512_2M auto
MSG1000G> port adsl set 7-25~48 1_24M auto
MSG1000G> port enable 7-1~48
MSG1000G> port pvc set 7-1~48-0/33 DEFVAL llc 1 0
MSG1000G> config save
2. Prestige 660R-61
Next configure the CPE device. Set the Prestige 660R-61 to work in bridge mode
using the VPI/VCI settings of 0/33 (the default on IES-5000). Since the Prestige

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 5
660R-61 has a built-in telnet server, you can telnet and log into the management
interface.
2.1 Menu 1: General Setup
Go to Menu 1 to set the Prestige 660R-61 in bridge mode. In this menu, select No in
the RouteIP field and Yes in the Bridge field.
2.2Menu4:InternetAccessSetup
For bridge mode, select RFC 1483 in the Encapsulation field with LLC-based
multiplexing. Also set the Prestige to use the same VPI and VCI settings as the
IES-5000 (the default is 0 and 33 respectively).
2.3 Menu11.1: Remote Node Profile
In menu 11.1, select Yes in the Active field to activate this remote node profile. Make
sure the encapsulation and multiplexing settings are the same as in menu 4. Select Yes

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 6
in the Edit ATM Options field and press [ENTER] to enter menu 11.6.
2.4 Menu11.6: Remote Node ATM Layer Options
Make sure the VPI and VCI settings are the same as on the IES-5000 (the default is 0
and 33 respectively).

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 7
Configuring 802.1Q VLAN
A VLAN (Virtual Area Network) allows a physical network to be partitioned into
multiple logical networks. Stations on a logical network belong to one group called
VLAN group. A station can belong to more than one group. The stations on the same
VLAN group can communicate with each other. With VLAN, a station cannot directly
talk to or hear from stations that are not in the same VLAN groups.
In this application, we will show you how to configure an 802.1q VLAN. The
following figure shows a VLAN network example where two computers (PC1 and
PC2) are connected to ports 1 and 2 on the line card. Each computer belongs to a
different VLAN (VLANs 10 and 20). Therefore the computers cannot communicate
directly to each other. However, PC1 and PC2 still need connection to the Internet.
Setting up a VLAN
For this application, we will use an IES-5000 and Prestige ADSL660R-61 CPE (any
DSL CPE or P791 if you have the SLC-1248G line card installed on the IES). Since
the two ports belonging to different VLANs need Internet access via the Uplink port
ADSL/SHDSL
modem ADSL/SHDSL
modem
IES-5000
ALC-1248G
SLC-1248G
PC 1
VLAN10
Port 1
Port 2
Uplink
Internet
PC 2
VLAN20

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 8
on the IES-5000, another VLAN (to which the two ports are a member of) need to be
configured.
1. IES-5000 Settings
1.1 VLAN settings
Create a VLAN group with VID 10 and set Port 1, ENET1 and ENET2 to be members
of this VLAN.
CI command:
TGE1> vlan set 10 up1 fix untag
TGE1> vlan set 10 up2 fix untag
TGE1> vlan name 10 VLAN10
TGE1> port pvc vlan 7-1-0/33 10 join untag
Create a VLAN group with VID 20 and set Port 2, ENET1 and ENET2 to be members
of this VLAN.
CI command:
TGE1> vlan name 20 VLAN20
TGE1> vlan set 20 up1 fix untag
TGE1> vlan set 20 up2 fix untag
TGE1> port pvc vlan 7-2-0/33 20 join untag
Create a VLAN group with VID 200 and set slot 7, Port 1, Port 2, ENET1 and ENET2
to be members of this VLAN.
CI command:
TGE1> vlan name 200 VLAN200
TGE1> vlan set 200 up1 fix untag
TGE1> vlan set 200 up2 fix untag
TGE1> port pvc vlan 7-1-0/33 200 join untag
TGE1> port pvc vlan 7-2-0/33 200 join untag
1.2 PVID settings
After creating the three VLANs, you need to set the PVID on the ports.

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 9
For this example, assign VLAN 200(PVID) to ENET1 and ENET2. Also, assign
VLAN 10 and VLAN 20 to Port1 and port2 respectively.
CI command:
TGE1> switch port pvid up1 200
TGE1> switch port pvid up2 200
TGE1> port pvc set 7-1-0/33 DEFVAL llc 10 0
TGE1> port pvc set 7-2-0/33 DEFVAL llc 20 0
1.3 Port Isolation
On the IES-5000, you can isolate ports without configuring VLAN groups in the CLI.
CI command:
TGE1> switch isolation enable
2. Prestige 660R-61(P791) Settings
Please refer to the steps in the previous application.
Triple play Application
On the IES-5000, you can use different channels (also known as Permanent Virtual
Circuits or PVCs) for different services. Define channels on each DSL port for
different services and assign each channel a priority, VLAN and ATM Quality of
Service (QoS). The ATM QoS allows you to regulate the average rate and fluctuations
in data rates. This helps eliminate congestion and to allow smooth transmission of real
time data (such as audio and video).
In this application, we will show you how to set up multiple PVCs using the IES-5000.
The following figure shows a network example where the computers want to get
different services (data service for Internet access and video service) from two
networks. Since a smooth video streaming quality is desired, we want to give the
video service a higher priority. To do this on the IES-5000, create a different VLAN
for each service and configure the PVCs with a different VID, priority and ATM QoS.
This allows the video service to have a higher priority over the data service. You can
easily adapt this application for a triple-play service network.

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 10
Setting up Multiple PVCs
This section shows you how to configure settings on the devices for this application.
In this network application, we will use an IES-5000, a ZyXEL ES-2024
VLAN-aware switch and Prestige 660R-61 CPE (you may also use P791 if you have
the SLC-1248G line card installed on the IES).
1. IES-5000 Settings
1.1 VLAN setup
Follow the procedure as described in the VLAN Application section to configure the
VLAN settings on the IES-5000.
Create a VLAN with a VID of 10 and set Port 1 and ENET 1 to be members of this
VLAN. Also enable egress tagging on ENET 1.
TGE1> vlan name 10 VLAN10
TGE1> vlan set 10 up1 fix tag
TGE1> port pvc vlan 7-1-0/33 10 join untag
Create a VLAN with a VID of 20 and set Port 1 and ENET 1 to be members of this
CPE
802.1Q VLAN
Switch
0/33
1/34
PVID =10
Priority =7
ATM QoS=CBR
PVID =20
Priority =0
ATM QoS=UBR
Video Server
VLAN 10
Internet
Internet Access
VLAN 20
DSL Port 1
Ethernet Port
Port 2
PVID=20
Port 1
PVID=10
Port 10
IES-5000
SLC-1248G or
ALC-1248G

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 11
VLAN. Also enable egress tagging on ENET 1.
TGE1> vlan name 20 VLAN20
TGE1> vlan set 20 up1 fix tag
TGE1> port pvc vlan 7-1-0/33 20 join untag
1.2 VC profile setup
For profile setup, create a Defval_CBR VC profile with the Encap, Class, PCR and
CDVT settings as shown. Make sure the profile has the same LLC-based
encapsulation setting as the IES-500 and the CBR class is set with a higher ATM QoS
priority .
CI command
TGE1> profile atm set Def_CBR cbr 300000
1.3 Multiple PVCs setup
Since we want to give the 0/33 VPI/VCI a higher priority, change the VCI/VPI
priority in the Defval_CBR profile that was just created.
CI command:
TGE1> port pvc set 7-1-0/33 Defval_CBR llc 0 7
Create another PVC with a VPI/VCI of 0/34 and apply the DEFVAL profile to this
channel.
CI command:
TGE1> port pvc set 7-1-0/34 Defval llc 20 0
2. Prestige 660R-61(P791) Settings
On the CPE, we need to configure two channels: 0/33 and 0/34. The previous
application example already shows you how to configure a channel (0/33) on the CPE.

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 12
Here, we will show you hot to configure the second channel.
2.1 Menu11.1: Remote Node Profile
In menu 11.1, select Yes in the Active field to activate this remote node profile. Make
sure the encapsulation and multiplexing settings are the same as in menu 4. Select Yes
in the Edit ATM Options field and press [ENTER] to enter menu 11.6.
2.2 Menu11.6: Remote Node ATM Layer Options
Make sure the VPI and VCI settings are the same as on the IES-5000 (the default is 0
and 34 respectively).
3. ES-2024 settings
3.1 VALN
Click Advanced Applicationand VLAN in navigation panel to display the
configuration screen as shown. Click Static VLAN to display the Static VLAN
screen.

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 13
Create a VLAN with VID of 10. Assign ports 1 and 10 to be members of VLAN10.
Select the Tx Tagging option to enable egress tagging on port 10.

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 14
Create a VLAN with VID of 20. Assign ports 2 and 10 to be members of VLAN20.
Select the Tx Tagging option to enable egress tagging on port 10.
3.2 PVID setup
ClickAdvanced Applicationand VLANin navigation panel to display the configuration
screen as shown. Click VLAN Port Setting to show VLAN Port Setting screen.

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 15
Set the PVIDs on port 1 and 2 to 10 and 20 respectively.
After the configuration on the devices are complete, video traffic will go through the

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 16
0/33 channel and the data traffic will go through the 0/34 channel. Since the 0/33
channel has a higher priority, video traffic will get processed and sent first if both traffic
types arrive at the same time.
802.1x Application
IEEE 802.1x port-based authentication can be used to prevent unauthorized ports
(clients) from gaining access to the network. It is an extended authentication protocol
that allows support of RADIUS (Remote Authentication Dial in User Service,
RFC2138, 2139) for centralized user profile management on a network RADIUS
server.
The following figure shows a network example where the IES-5000 acts as an
authenticator to provide 802.1x authentication. In this example, the supplicants (PC1
and PC2) want to gain access to the application server.
Station/
Application server
Authentication
Server (RADIUS)
Authorized
Unauthorized
X
SHDSL/ADSL
modem SHDSL/ADSL
modem
IES-5000(SLC/ALC)
(Authenticator)
PC 1
(Supplicant)
PC 2
(Supplicant)
Port x
Port y

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 17
Setting up 802.1x
To set up an 802.1x infrastructure, we need to configure the authenticator, RADIUS
and supplicants. In this example, we will use Microsoft 802.1x client as the supplicant
and ZyXEL Vantage 50 as the RADIUS server. The following sections describe the
procedures.
1. Authenticator Setup: IES-5000
1.1 RADIUS settings:
Enable 802.1x Authentication and specify the RADIUS server IP address, UDP port
and shared Secret on the IES-5000. Make sure you enter the same UDP port and
shared secret as the RADIUS server. Then save the settings to make them take effect.
TGE1> sys sw dot1x enable
TGE1> sys sw dot1x set radius server 192.168.1.3
TGE1> sys sw dot1x set radius port 1812
TGE1> sys sw dot1x set radius sec 12345678
TGE1> config save
2. RADIUS Setup: Vantage 50
You can use any RADIUS server (such as Funk Steel-Belted RADIUS, Cisco Access
Control Server or MeetingHouse Aegis server). In this example, we will use ZyXEL
Vantage 50 as the RADIUS server. You can configure Vantage 50 through its web
configurator (the default management IP address is 192.168.1.3).
2.1 RADIUS server setup
Click RADIUSand RADIUS SERVER in the navigation panel to display the configuration
screen as shown. You can use the default values or change the Authentication port, Shared
Secretsettings. Make sure these values MUST are the same as on the client.

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 18
2.2 Create a User Account
Click RADIUSand USER ACCOUNT in the navigation panel to display the configuration
screen as shown. You can use existing user accounts or create a new one by clicking the Add
New Userbutton. Clients must enter the correct user name and password to log into the
network.
3. Supplicant Setup: Windows XP
You can use any supplicant/client software (such as MeetingHouse Aegis client, Funk
Odyssey client and Microsoft 802.1x client). In this example, we will use take
Microsoft 802.1x client software.
3.1 802.1x/MD5-challenge setup
Open the Local Area connection Properties screen and click the Authenticationtab. Select
Enable IEEE 802.1x authentication for this network and select MD5-challenge in the
EAP type field.

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 19
When the 802.1x authentication process starts, a message displays in the system tray
prompting you to enter the account user name and password. The following figure shows an
example.
Click on the message balloon to display the login screen where you can enter your account

IES-5000 Support Notes
All contents copyright (c) 2005ZyXEL Communications Corporation. 20
user name and password. After entering the required information, click OK to continue. Once
the authentication process is successful, client setup is complete.
Once you are authenticated successfully, you can access the network. Otherwise, network
access is not allowed through the DSL port on the CPE.
4. Prestige 660R-61 Settings
Please refer to the procedures described in the previous application.
Syslog Server Application
You can set your ZyXEL product to send system logs to an external syslog server
(such as Syslodd in Unix and Kiwi Syslog Daemon ( http://www.kiwisyslog.com/ )).
When the DSL or Ethernet connections are up or down, the IES-5000 sends a log
record to the syslog server. You must install the syslog server on the network that
the IES-5000 can access. The following figure shows an example.